Reddit Security Incident - <AUTHOR> https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/ <comment><USER2> Interesting that the data accessed was very specifically only limited to:

* A complete copy of an old database backup containing very early Reddit user data -- from the site's launch in 2005 through May 2007

* Logs containing the email digests we sent between June 3 and June 17, 2018

Also of note:

"Already having our primary access points for code and infrastructure behind strong authentication requiring two factor authentication (2FA), we learned that SMS-based authentication is not nearly as secure as we would hope, and the main attack was via SMS intercept."

If this doesn't put the nail in the coffin of SMS-based 2FA, I'm not sure what will.

<comment><USER3> Can you or someone else explain/link to me the basics of why SMS-based 2FA is so terrible? I've never really heard the sentiment before, but it appears to be common knowledge.

<comment><USER4> Because the telephone companies are terrible about security and often highly disorganized internally. They are beyond stupidly susceptible to Social Engineering and any "passcodes" against giving away access do not stand in the face of stupid customers and the need for customer service to satisfy them.

Your number can easily be stolen or redirected to get and sometimes send SMS from/to your number. Your cell phone account is the linchpin for a very extensive identity theft attack.

<comment><USER5> In their defense, being able to successfully identify a customer is who they say they are is a difficult problem that is only compounded when you might only speak to a customer as infrequently as every few years. 2F devices and codes can be lost. Passwords and pins can be forgotten. Answers to security questions can change. Have you ever tried to access your own account with a company like this without this data? There are few things more frustrating than being locked out of your account because you can't recall what you said your favorite movie was in 2012. Throw in the low odds of actually being targeted in a social engineering attack and companies optimize for customer satisfaction and convenience over security.

Blaming companies for responding to that incentives isn't going to accomplish anything. The way to fix things is to change the incentives by either increasing the punishment for falling for social engineering or create a system that makes it easier to remotely identify people.

</comment></comment></comment></comment><comment><USER5> The hacker(s) took a database backup from 2007. I have never worked anywhere that has kept a backup that long. It is possible it is some sort of final archive before a large migration, redesign, or something like that. However if the intent is to keep it forever it should at least be encrypted. As far as I'm aware, the only strong reason to not enable encryption on backups is to allow a secondary backup or mirroring system to compare the changes between backup files rather than reprocessing the entire thing as a single new file. That reason disappears for an archived backup.

<comment><USER6> Given the weird collection of stuff they got (including the ancient database backup) I wouldn't be surprised if this was the contents of an admin's home directory.

<comment><USER7> +1 insightful.

While looking at GDPR compliance, I came across a guide that said "backups are kept for as long as it will take you to notice the missing data and restore it. Exported data kept for longer than this is an archive".

That helped me realise I really shouldn't be keeping 5-year-old database backups for some systems; a few months is plenty sufficient time for us to notice any corruption. As part of that clear-out, I searched for and deleted many old mysql-backup-2012-just-in-case.tar.gz from /root and similar places.

<comment><USER8> Do you have the link to that guide by any chance? I haven't found a guide that's practical enough for my needs yet.

<comment><USER7> I think it was this, and the source it links to.

[https://community.jisc.ac.uk/blogs/regulatory- developments/a...](https://community.jisc.ac.uk/blogs/regulatory- developments/article/gdpr-backups-archives-and-right-erasure)

</comment></comment></comment></comment></comment><comment><USER9> While everyone is piling on how SMS 2FA is oh so bad, it is worth noting that it is supposed to be the second factor here. So what happened to the first factor is the obvious question. Someone was using weak/compromised password or got social engineered would be my guesses, neither which are very good options.

<comment><USER10> This was also my first thought when reading this. It almost makes me wonder if it was really a SMS exploit at all — when someone has the user, pass, and 2FA code, that sounds to me like the target clicked on a convincing URL and readily supplied all the things their attacker would need.

</comment></comment><comment><USER11> This incident report glosses over the depth of what access was given to focus on the user data that was compromised... but it sure seems like they got pretty deep:

* A complete copy of an old database backup containing user data from launch in 2005 through May 2007 including:

      -usernames,

      -salted/hashed passwords,

      -e-mails,

      -all content including private messages

* Reddit source code

* Internal logs

* configuration files

* other employee workspace files [?]

<comment><USER12> This is a serious breach and I'd suggest "gloss over" does not characterize Reddit's statement appropriately.

Given how the report is structured, it seems like the amount of leaked data is purposefully being hidden behind red herring info about SMS 2FA that is not important to users who want to know where they stand.

When this DB is leaked, there should be more than enough weak passwords to both pwn and dox many, many reddit users. Do we know the encryption scheme reddit used to encrypt their password database involved in the leak?

Also, how is it that Reddit gained a head of security 2.5 months ago? Who was in charge of this prior to that date?

<comment><USER13> > Do we know the encryption scheme reddit used to encrypt their password > database involved in the leak?

At the time of this backup, it would have been SHA1. Here's the relevant hashing code:

[https://github.com/reddit- archive/reddit/blob/4778b17e939e11...](https://github.com/reddit- archive/reddit/blob/4778b17e939e119417cc5ec25b82c4e9a65621b2/r2/r2/models/account.py#L244-L248)

Edit: reddit's confirmed this here: [https://www.reddit.com/r/announcements/comments/93qnm5/we_ha...](https://www.reddit.com/r/announcements/comments/93qnm5/we_had_a_security_incident_heres_what_you_need_to/e3f8og0/)

<comment><USER9> randstr has this goldnugget of a comment:

        """If reallyrandom = False, generates a random alphanumeric string
        (base-36 compatible) of length len.  If reallyrandom, add
        uppercase and punctuation (which we'll call 'base-93' for the sake
        of argument) and suitable for use as salt."""

[https://github.com/reddit- archive/reddit/blob/4778b17e939e11...](https://github.com/reddit- archive/reddit/blob/4778b17e939e119417cc5ec25b82c4e9a65621b2/r2/r2/lib/utils/utils.py#L41)

The function has specifically a flag for use as salt, but the hashing code does not actually use it. Whoops. Of course the loss here is not really that significant (~4bits of entropy), but I find it still bit funny.

<comment><USER9> Picking on the code bit more while we are at it, random.choice that randstr uses is of course not backed by CSPRNG so its not ideal for salts. Although I would be shocked if attackers would be able to exploit that in any way.

Kinda interesting is how they decided on specifically 3 characters for salt, which seems really low. Its not like the characters cost anything, why not 30 characters instead?

</comment></comment></comment></comment></comment><comment><USER13> The scary part of this is probably for people that had accounts on reddit in 2007 but later deleted them, or just completely forgot they existed. Reddit's not going to be able to contact the owners of those accounts.

Did you have an account 11 years ago? Did you vote on anything embarrassing, or send any compromising messages? How sure are you?

I don't even know the answer to those questions for myself.

<comment><USER14> Reddit can't contact them because Reddit didn't require an email address to create an account back then.

If they did require an email address, they could restore their database backups to retrieve that information.

<comment><USER15> Reddit still doesn't require an email, the signup form is just a well executed dark pattern - you can hit next and skip providing an email.

<comment><USER16> I wouldn't call a form requesting your email (the only entry field on a dedicated page) a "dark pattern". They out right imply an email is necessary and knowing it's not requires knowledge otherwise or accidentally clicking "next".

<comment><USER17> I've made a couple of reddit accounts in the last 1-2 years and it was always explicit that an email was optional. Is this all since the recent redesign?

<comment><USER18> The only indication that an email is not required is that the email field doesn't contain a blue dot, as opposed to the username/password fields. However those are on the next page, so you have no indication that it's not required. That's actually on the new design, on old.reddit.com there is not even that indication.

<comment><USER17> I see. that's a shame, last time I used the register form it was all fields on one modal popup and said email wasn't required.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> If the logs contained IP addresses, they could be used to correlate multiple accounts, leading to throwaway accounts being doxxed.

It doesn't sound like IP address data was compromised, but I wouldn't be surprised.

<comment><USER20> Could probably also correlate by password. I'm sure lots of users re-use the same password at least for their throwaways.

<comment><USER12> They certainly did 10 years ago.

</comment></comment></comment><comment><USER21> Alright, 2FA tokens came up the other day on HN and now we have this. Time to make the switch.

Yubikey 4 / Feitian looks interesting, but it seems it only works in Chrome with Gmail etc. etc.

Anyone have any thoughts on solutions that include Safari on Mac and/or iOS? The NEO claims NFC support but I doubt that works on iOS.

<comment><USER22> 2FA does not usually mean U2F hardware such as Yubikey. Reddit does not support hardware keys.

Most of the time, 2FA means using a token generator, such as Google Authenticator, Authy, or similar. They are just apps. This is much safer than SMS because one would need physical access to your unlocked phone to generate a token.

<comment><USER23> TOTP has a downside when compared to SMS as well.

In cases where server security was breached and databases (or database backups or dumps) were accessed, if the TOTP seeds were part of the database (not sure how likely that is, but I'm guessing it's likely), then TOTP is doing nothing for security.

TOTP protects against things like credential stuffing and weak passwords, and is safer than SMS (no hijacking/intercepting), but for database security breaches things aren't so cut and dry.

I wonder if there should be a TOTP-like app which you still register with a site when you first log in or create your account, and which codes are sent to when new logins are needed, but which uses a more secure communication channel than SMS. This gives you the best of both worlds, no? One-time codes not generated from a single plain text seed, communicated to a known client over a secure channel, to prove the initial user is still in possession of the known client?

<comment><USER24> A standard called SQRL is similar to many of the concepts of U2F and can be done with an app scanning a QR code.

[https://www.grc.com/sqrl/sqrl.htm](https://www.grc.com/sqrl/sqrl.htm)

<comment><USER23> Looks like SQRL is aiming higher than just 2FA, they try to be the entire login process. Thanks for the link, but not sure it's quite what I'm looking for.

</comment></comment></comment></comment></comment><comment><USER25> For what reason was a decade old backup kept online for? That is insane. If they have hygine that poor I'm really worried about what other problems they have.

<comment><USER26> Good grief. You're talking about a decade old data set.

Try this: Go to your own site backup for whatever you've got, be it a personal disk backup or something you made for a customer or friend or whatnot. Now, tell me which files might contain sensitive information to third parties. I'll wait.

This isn't "hygine". This is "we have a 11 year old backup mounted somewhere that we all forgot about and we honestly don't know what's in it". Yeah, it sounds dumb, but it's not reasonably avoidable by internet pontification regarding "best practices" unless your "best practices" involve eidetic memories or time machines.

<comment><USER25> It's simple. If it's a couple of years old and I haven't accessed it then it gets archived offline. Metadata about it is kept hot so I can track what I have. I might be a bit sloppy personally and have a _limited_ amount of 4 year old stuff still internet connected but certainly not anything approaching 10 years and it's sure as hell not large archives of other people's data I have a duty to protect.

There is just no excuse for that, it serves no business purpose, ancient backups that have no recovery value should not be online if they are kept at all. This incident shows an appalling lack of care by reddit technical leadership. Obviously they are not systematically tracking and reviewing the data they keep. Given this incident I would not be the least bit surprised if they have copies of this and that all over the place with no awareness or oversight.

<comment><USER26> > It's simple. If it's a couple of years old and I haven't accessed it then it > gets archived offline

How is that remotely simple? This is a medium size company. They have thousands or tens of thousands of storage devices mounted "online" in some way. How do you purport to audit every single one of them to determine when the "last access" time was for all the relevant data?

I suspect, as mentioned earlier, that your answer is going to involve a time machine to go back to 2007 and make sure reddit was doing things "right".

<comment><USER25> It's one thing to get owned by 0 day and lose the stuff you were working on last month. If you lose stuff from 10 years ago you absolutely had it coming.

The way you protect old data is by routinely auditing what you have. You make sure each department is on top of organizing its data. If you're not sure what it is, you offline it. It can always be brought back online if necessary. Even lowest-common-denominator schemes like ISO 27001, a system designed to allow management that doesn't even know how to turn on a computer to manage information security, covers this basic idea. It would be one thing if a non- technical department had leaked some ancient folder full of reports containing some sensitive data, but this is a database dump of one of the most highly trafficked sites on the net. Reasonable people should expect the custodians of those sorts of things to know better. To anyone with technical knowledge, minimizing your data exposure should be as natural as breathing.

And yet again this time we get the usual "the attack was so sophisticated" refrain. Oh, the defenders were so careful, and tried to take every precaution for sure! The attackers hacked the 2FA! If that's true why didn't the attackers get the 2018 data? Frankly I don't believe the Reddit management. They probably left that old database dump on some old system they forgot about that tons of people had access to.

How many breaches to we need to remind us to be aware of what data we are managing and take precautions? How many more is it going to take before we collectively stop being so careless?

<comment><USER26> > If you're not sure what it is, you offline it

I've literally never worked at nor heard of an employer that tried this. You have a case study example? You seriously think IT departments are in the business of finding an archiving the contents of every random PC on the network?

<comment><USER25> No, of course I don't believe IT departments do that. It's management's responsibility to make sure someone is responsible for the data on every random PC on the network. Management is responsible for putting systems in place to manage risk effectively. Random PC users need to be compelled to comply by policy and enforcement because otherwise they usually don't have the knowledge or incentive to do what must be done.

People working in development or operations on the other hand, should instinctively know and do what must be done with their own data. And reddit didn't do that. Management failed and even worse the technical leadership inside the company was directly responsible.

Remember this next time you're working at a place with a poor management of data and a culture of indifference. Do something about it, sound the alarm instead of sitting on your hands waiting for the inevitable leak.

<comment><USER26> So... who exactly does this again? You seem to be "solving" this problem by turning it into a simplified academic exercise. Real security happens in real companies with real people.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> If you are using SMS based 2FA, understand the risk:. "Already having our primary access points for code and infrastructure behind strong authentication requiring two factor authentication (2FA), we learned that SMS-based authentication is not nearly as secure as we would hope, and the main attack was via SMS intercept. We point this out to encourage everyone here to move to token-based 2FA."

</comment><comment><USER28> In comment from the admin: « In other news, we hired our very first Head of Security, and he started 2.5 months ago. » No comment.

«Old salted and hashed passwords» This sentence mean: All hashed were readable. It also mean, if they are still needed on their servers, that they are probably still in use. It would had been easy to salt this hashes.

First fix holes, then redesign...

</comment><comment><USER29> SMS is not about securing an account. It's only use is as a proof of work (money) to make it harder/more expensive to make a bot account.

Using it as a security measure is a mistake.

</comment><comment><USER30> I keep telling my bank SMS 2fa is bad but they say it is not. Many banks replaced tokens with SMS unfortunately.

<comment><USER31> I don't know any bank that supports token-based 2FA and most support both SMS and email based 2FA. Email is a terrible 2FA method since most users re-use passwords.

One way to help protect you is to visit your carrier's retail store and have them turn off online access to your account and require all changes to your account to be done in person with a valid government ID. This should make it more difficult for number porting attacks but they can still sniff the SMS message when goes over the cell network. As far as I know, mobile network control messages aren't protected.

<comment><USER7> Several British banks use Chip+PIN cards to provide a token — not necessarily for login, but for authorizing a transaction.

Like this: [https://c7.alamy.com/comp/CYGATP/online-banking-security- chi...](https://c7.alamy.com/comp/CYGATP/online-banking-security-chip-and-pin- card-reader-for-authorising-transactions-CYGATP.jpg)

</comment></comment></comment><comment><USER32> I got the alert to change my PW. I had had the same PW for 12 years!

Edit: 12 years, not 13.

\</comment><comment></comment><comment></comment><comment></comment><comment></comment><comment>-

 __ _Account credentials from 2007 compromised_ __

 __ _from reddit_ __

 __ _[A] sent 35 minutes ago_ __

 __ _Hi,_ __

 __ _TL;DR: As part of the security incident described here, we 've determined that your account credentials may have been compromised. You'll need to reset your password to continue using Reddit. Details below._ __

 __ _On June 19, Reddit was alerted about a security incident during which an attacker gained access to account credentials from 2007 (usernames + salted password hashes)._ __

 __ _We 're messaging you because your Reddit account credentials were among the data that was accessed._ __

 __ _If there 's a chance the credentials relate to your current password, we'll prompt you to reset the password on your Reddit account. Also, think about whether you still use the password you used on Reddit 11 years ago on any other sites today. If there's a chance the credentials relate to the password you're currently using on Reddit, we'll make you reset your Reddit account password. You can find more information about the incident in the announcement post linked above. If you have other questions not answered there, feel free to contact us at firstname.lastname@example.com._ __

<comment><USER33> Has reddit been live for 13 years? Jeez. I thought my 11 year account was old.

<comment><USER34> I got on reddit in 2005, before you could comment.

Got on thefacebook as well in 2005 because the college kids in my classes (taking for fun as an adult) told me I needed to be on there to get invited to parties and so they could write on my wall. Good times.

<comment><USER32> With those comments and your username, you can tell people to CD .. off your lawn.

</comment></comment></comment></comment><comment><USER35> How would an attacker go about intercepting an SMS?

<comment><USER36> By taking control of your phone number or the radio network your phone connects to, or attacking the signaling network itself, to intercept information going to your phone number.

Basically, imagine every conceivable way any human or computer might at any point interact with a plaintext signaling packet designed to be passed around the world by different companies and eventually read by people. Now attack all of them. Something somewhere will give it up.

<comment><USER37> It's fairly easy to claim the general case, and indeed you're right. But the challenge is that not all attackers have infinite resources, and the ones that effectively do us small fry really can't protect against anyway, because they're already where they need to be.

So specific information on known attack paths is an interesting conversation, because part of the SMS 2FA security is the belief that while 1-off SMS 2FA attacks are possible, they generally don't scale, and so that puts a high cost on carrying out the SMS 2FA, or informs a limit on the value that can be protected by SMS 2FA.

So, good for reddit? Maybe yes. Good for your bank? Maybe not, but maybe yes, depending on the diligence of the customer, the robustness of anti-fraud measures, and the cost of fraud insurance.

<comment><USER38> > So, good for reddit? Maybe yes. Good for your bank? Maybe not, but maybe > yes, depending on the diligence of the customer

Good for Instagram? Maybe no, without much dependence on the diligence of the customer.

[https://motherboard.vice.com/en_us/article/vbqax3/hackers- si...](https://motherboard.vice.com/en_us/article/vbqax3/hackers-sim-swapping- steal-phone-numbers-instagram-bitcoin)

<comment><USER37> Alrighty then. Thanks for the enlightening read.

</comment></comment></comment></comment></comment><comment><USER39> You mean they tell us 1.5 months after the event that our emails and passwords might be compromised?

</comment><comment><USER40> Would someone kindly explain how a SMS can be intercepted during 2FA and how/why tokens otoh are safer?

A friend and I were brainstorming the design of a fraud prevention app/startup just this week and we naively thought SMS would be the way to go. Yikes!

<comment><USER41> SMS ties security to phone numbers. Phone companies can trivially move numbers to different people, accounts, and SIMs. When you rely on SMS for security, you are relying on the customer support staff of giant mobile phone companies for your security.

There are other more technical weaknesses with SMS, because the phone networks themselves are also insecure. But the big issue is phone companies themselves.

Don't use SMS 2FA.

<comment><USER42> Google pretty much foists it on all our employees.

<comment><USER43> For Google, it's not a text message though, is it? IIRC, it's tied to your Google account and not to your phone number.

<comment><USER42> They enforce it via SMS.

</comment></comment></comment></comment></comment><comment><USER44> How does SMS interception actually work in practice? Wouldn't this require physical access to the phone/SIM, or are there any known remote exploits?

<comment><USER41> How about "teenager calls phone company, gets number reassigned"? That's the level of assurance we're dealing with in SMS.

</comment></comment><comment><USER45> So what's to stop a hijacker persuading the website to take off 2FA or switch you from TOTP to SMS.

Seems just as possible as hijacking your phone.

</comment><comment><USER46> SMS Interception is what got them. Moving to offline 2FA needs to happen. SMS Interception is on the rise.

<comment><USER47> And yet bizarrely, the number of organisations with serious security requirements that are adopting SMS messages or other methods dependent on phone numbers as 2FA just recently is quite noticeable.

Stripe use it for logging into your business's account.

HMRC (the UK government tax office) also uses it for logging in.

Various banks and financial services I use in a personal capacity rely on secondary phone authentication to set up things like new recipients for paying bills online.

</comment></comment><comment><USER48> Was the notification to Reddit users about the incident, sent from firstname.lastname@example.com ?

</comment><comment><USER49> >In other news, we hired our very first Head of Security

wow...

<comment><USER50> > we hired our very first Head of Security, and he started 2.5 months ago

He started before the hack happened

<comment><USER29> I'm pretty sure he didn't fix every security problem on his first day of work. Once a company gets big enough every change ends up being an ordeal of organizing all stakeholders and getting them to agree and giving them time to update their own systems so they won't be broken when the change happens, etc...

</comment></comment></comment><comment><USER51> Edit: nevermind

<comment><USER52> They didn't say write-only access.

They said they only got R access instead of RW access.

</comment></comment><comment><USER53> >In other news, we hired our very first Head of Security, and he started 2.5 months ago.

Uh huh.

</comment><comment><USER54> SMS hijacking? Really?

How is it that Reddit's security team is continually learning security lessons that have been common knowledge among non-technical people for 5+ years? They seem to treat their production systems more carelessly than the average person treats their Nintendo switch account.

<comment><USER55> > been common knowledge among non-technical people for 5+ years

Who are these non-technical people that you know that are not only using MFA but also know that SMS is insecure for MFA?

Rather than putting them down I'm happy they're willing to share and bring knowledge, that some communities already know, to even more people.

<comment><USER54> > Who are these non-technical people that you know that are not only using MFA > but also know that SMS is insecure for MFA?

Anyone who reads pretty much any mainstream newspaper? At this point it would be easier to name mainstream media publications that _haven't_ covered this issue extensively. E.g. just google:

site:nytimes.com sms hijacking

site:wsj.com sms hijacking

site:latimes.com sms hijacking

Not to mention the fact that it's been discussed on Reddit itself hundreds of times. And on the front page of HN dozens of times as well. E.g.:

[https://news.ycombinator.com/item?id=14480191](https://news.ycombinator.com/item?id=14480191)</comment></comment></comment>


Pspg – Postgres Pager - <AUTHOR> https://github.com/okbob/pspg <comment><USER2> "If you like it, send a postcard from your home country to my address, please"

My impression of the author went up 100%

<comment><USER3> [https://en.m.wikipedia.org/wiki/Postcardware](https://en.m.wikipedia.org/wiki/Postcardware)

</comment></comment><comment><USER4> I recommend using _pspg_ in conjunction with _pgcli_.

To install pgcli, simply "pip install pgcli" at the command line.

When you pip install pgcli, the config file is located in ~/.config/pgcli/config

\- The pager config line, which by default is commented out. You can define the pager to use pspg here, or leave it commented out and simply add something like this to your shell rc file: export PAGER="pspg -s 2"

\- Check out syntax_style (I like monokai)

from within a pgcli terminal, F4 lets you switch into VIM mode

Also, play around with the table format in the pgcli config. I have yet to find a solid line grid but haven't stopped looking for it yet.

then, you get to combine the power of pgcli with pspg, for ultimate powahhhhh

</comment><comment><USER5> It's so good that people still write high quality command line utilities in the time everybody runs copies of browser engines for their editor and messenger on the desktop (refereing to Electron, Atom, Slack). Especially when managing servers over ssh (or ssh tunneled throught ssh tunneled thought ssh), good utilities are invaluable.

<comment><USER6> This actually raises a good question. Are operating systems going to like, incorporate a "WebKit daemon" so that multiple instances of the browser backend aren't loaded individually in every app?

</comment></comment><comment><USER7> Not bad but i like pgcli (pgcli.com) display of tabular data better. besides it is not just that, it is such a nice command line tool for pg. That autocomplete is a killer!

<comment><USER8> Edit: Nevermind! I was looking at a broken psql shim.

<comment><AUTHOR> This is not correct. ctrl+c cancels the query and does not quit psql:

      =# select pg_sleep(10);
      ^CCancel request sent
      ERROR:  canceling statement due to user request
      Time: 1269.674 ms (00:01.270)

</comment></comment></comment><comment><USER9> > Everybody who uses psql uses less pager.

Huh, I need to look into psql using less[0][1]. But having a look at the links it seems running `psql` in `tmux` with `^b[` for back buffer access with vim keys and regex search is how "I solved" this problem.

But in all honesty I normally find myself in pgadmin4.

[0]: [http://merlinmoncure.blogspot.co.za/2007/10/better-psql- with...](http://merlinmoncure.blogspot.co.za/2007/10/better-psql-with- less.html) [1]: [https://stackoverflow.com/questions/26257724/set-less-as- pag...](https://stackoverflow.com/questions/26257724/set-less-as-pager-in- psql)

</comment><comment><USER10> Looks like a very interesting project. Could it be used with sqlite or Mysql?

Also interesting to note, that people refer to the blue colors as "Midnight Commander Theme". I knew them as the colors of Norton Commander. :-)

</comment><comment><USER11> If one prefers to use vim as a pager for psql, try this:

[https://unencumberedbyfacts.com/2016/01/04/psql-vim-happy- fa...](https://unencumberedbyfacts.com/2016/01/04/psql-vim-happy-face/)

I've been using it for a few months, and it works great for me.

</comment><comment><USER12> Not bad, I like the column freeze feature.

If you have to use less, -S (on command line or inside less, it works in both places) turns off line wrapping. It makes wide result sets workable and you can scroll left and right (but no freezing, naturally).

<comment><USER13> You could also use \x auto in .psqlrc to have it switch to vertical display of records when they are too wide to display horizontally.

</comment></comment><comment><USER14> I use it for some time. No need to challenge your eyes with long lines or json values anymore. This kind of result presentation should be in each command line client. Very very useful.

</comment><comment><USER15> Nice work! Cool project.

I like the combination of pgcli + pspg... now if there were only a way to graph stats a-la pgadmin!

</comment><comment><USER16> I have been using this for an hour, and it's already indispensable in my eyes.

</comment><comment><USER17> Looks great! I'm excited to try this out

</comment><comment> cup-of-tea This looks good, but why is it specific to postgres? Can't something like this be used with any tabular data?

<comment><USER18> I checked it, and I hope so MySQL can be supported too. pspg is just pager - it is not data formatter, so raw data like CSV cannot be processed there. But if some tool translate data to MySQL or PostgreSQL tabular format, then this pager can be used.</comment></comment>


The Oldest Problem in American Prisons - <AUTHOR> http://aging.nautil.us/feature/204/the-oldest-problem-in-american-prisons <comment><USER2> The "Gulag Archipelago" reference got me googling: [http://seansrussiablog.org/2013/05/11/us-prison- industrial-c...](http://seansrussiablog.org/2013/05/11/us-prison-industrial- complex-versus-the-stalinist-gulag/).

Apparently, if you compare apples to apples, in 1953 the USSR period had more like 7.4 million "adults on probation, in jail or prison, and on parole". 2.61% of total population vs 0.76% in present US.

<comment><USER3> Where are you getting the 0.76% figure? The article mentions 6.7 million, which is about 2% of the US population. Still perhaps a lower percentage than during the height of the gulag days, but not that much lower.

<comment><USER4> 0.76% is about the number that's currently incarcerated, with the rest on parole. It works out to be about 1 in 100 adults in the US that are currently incarcerated (even the US balks at the idea of locking up children)

</comment></comment></comment><comment><USER5> People jailed for life have usually done some pretty nasty stuff.

Getting old is a prospect a lot of their victims were spared if that's the right word. And life becoming more miserable as we age is an experience not confined to prisoners.

To my mind an old folks home can be an experience that must be not too dissimilar to prison. We like to have a benign view of old people but horrible young people don't become nice old people. I don't like the thought of inflicting yet further misery on old people by having these people joining them.

There should be old folks prisons for old prisoners.

<comment><USER6> In much or Europe, murder carries 15 to life vs the US where it's 25 to life.

I do realize it is a serious crime; the most serious crime when you deprive another human being of the ability to live. There is no way to ever pay that debt, but at the same time, 25 years is a very long time. 15 years is your birth to a drivers permit. It's enough time to go from a high school diploma to a PhD. It is a significant portion of one's life.

> People jailed for life have usually done some pretty nasty stuff.

In America there are many people serving insanely long terms for even lesser crimes. In places with three strikes laws or point systems, people can be serving over 20 years for low volume drug distribution.

Incarceration does not make a better or safer society. It just creates a new slave class. America has the highest percentage of prisoners of any other country on the planet. It's also the only high-income/western country with the death penalty. It indicates something is terrible wrong with our justice system.

Unless they're child molesters, many of the elderly in prison are in a condition where it is almost impossible for them to physically harm anyone again. What does society gain by not letting them spend the last few years of their lives dying humanely?

<comment><USER5> If people are in prison who should not be in prison, that's a different thing. You mentioned murder. Personally I don't believe that murderers should ever be released. The fact that we do so sends a signal that murder is bad, y'know, and we give a life sentence and all, but we don't really mean it, particularly if it wasn't a 'bad' murder. Hypothetically, I would not be happy if my elderly father was in an old folks home and in the next room was a convicted murderer.

By all means though, let's have prisons that are essentially old folks homes with secure fences around the grounds and treat the inmates as decently as possible.

</comment></comment></comment><comment><USER7> "6.7 million people under correctional supervision in 2015...more than were enslaved in antebellum America and more than resided in the Gulag Archipelago at the height of Stalin's misrule"

Woah. How many thanks to the for-profit prison industry?

<comment><USER8> Minimum sentencing and the three-strikes policy are probably more to blame.

<comment><USER6> Which are lobbied for by the for-profit prison industry and police/prison guard unions.

</comment></comment></comment><comment><USER9> California has an Elderly Parole Program for prisoners 60 years or older and have served 25 years or more. Only 5.3% of California state prisoners are over 60.

</comment><comment><USER10> We need human cooperatives stat. Militarised police and wretched prisons are not good churning mechanisms for a utopia-to-be.

<comment><USER6> Don't know why you're getting down voted. I like the idea of coops from Kim Stanley Robinson's Mars trilogy. Where ever you work, you should gain shares of ownership based on the number of years you put in, and get dividends for as long as you own those shares.

The current system of work is pretty insane. It basically turns us into slaves that produce for peanuts what nets the people in charge a massive cut. They essentially get large payouts for being willing to take massive risks. Why is the FedEx guy who gambled the company to success considered an amazing story? That's as fucked up as Abraham being asked to murder Issac. He didn't give a damn about his employees. He was just willing to take insane risks to keep his shipping company going or let it all burn.

<comment><USER10> Yeah I don't understand the down-vote but people are afraid of the unknown, which is sad because there is a lot of good unknown out there.

The best formula I've figured out so far is actually something I'm bending my life toward(!) and that is creating alternative environments to prisons.

As someone wisely pointed out, the first question is "Are prisons for punishment, or for healing?" If they are for punishment, our society will suffer that price when people mingle minds with prisoners who are under punishment, and then try and re-integrate. This is why recidivism (rate of falling back into the prison machine) is really high in the US comparatively.

Consider if the prison system were meant to heal and help people re-integrate! You know, I was reading about French philosophy and very early on, like in the 1600s the French realized that if you have a death penalty, the incentive for an inmate to reform is gone. Meaning: death penalty equates to "do not change because there is no point" but a prison sentence that is not terminal / whole- life actually does give incentive to reform.

Yes, the economic system is unjust, but even worse we have people who are starving and dying in the cold because they have no money, and if they have no money we assume that they are not worth-y in the US. Very tragic.

Anyway, I don't want to harp on too much about things I would change, I am actively in the process of creating a foundation for such things, and I'd rather do than say, and be than dream.

I like your idea about getting shares -- it would be great if that is how we operated. Then you'd actually experience some of the wealth of the company over time. You help build this grape vine? Here, have some grapes in 6 months when it starts fruiting. Sure, more people join and maybe you only get 10 grapes next year since you left, or just one grape ten seasons from now, but it all adds up.

Money is good for many things, but the fact that it is a requirement to have basic survival taken care of is just deplorable.

"Who will pay for basic survival then?"

Well, nobody! This place is so abundant with resource, we throw away enough food to feed the homeless. We already have empty houses where people could live, it's just our human concepts and discriminations that block us on the daily.

If people did not have to fight for basic survival, could you imagine the number of Tupacs coming out of the ghetto? Could you imagine the number of Neil deGrasse Tysons coming to fruition? Most of the amazing minds we have are squandered to total frivolity, but will we ever show that on television? Will we ever have our propaganda machine look at its own shortcomings so we can make the nation we know possible?

</comment></comment></comment><comment><USER11> Maybe the death penalty really is not more expensive than life in prison?

<comment><USER12> Maybe we use prisons for punishment, not rehabilitation.

<comment><USER13> Which is a problem. A punishing prison likely produces a hardened, system- hating criminal, not a person who'd rather want to integrate back into the non-criminal society.

<comment><USER14> " who'd rather want to " -> " who could "

<comment><USER10> both equally valid in this case

</comment></comment></comment></comment></comment><comment><USER15> I believe we need free housing and food for people who are in difficult emotional situations so they aren't desperate enough to commit crimes.

<comment><USER16> Sounds great, but who feels like paying for it?

<comment><USER17> Me? Compared to prisons I'd bet it would be a bargain.

The real issue isn't paying for it, it's administering it. We make it so difficult to to navigate the social safety net that it _becomes a skill_ and the people who need help are frequently without that skill.

<comment><USER18> > Me?

Thanks for your sacrifice. What if _I_ am not willing to pay? Will I be sent in prison? That'd be pretty ironic.

<comment><USER19> Americans manage crime by moving away from it into the next county. Don't worry, you'll get to pay anyhow through a longer commute and a HOA-mandated minimum enclosed floor space.

<comment><USER10> If only we analysed actual costs and not just numerical metrics!</comment></comment></comment></comment></comment></comment>


But I'm Not a Lawyer, I'm an Agent - <AUTHOR> https://davidsimon.com/but-im-not-a-lawyer-im-an-agent/ <comment><USER2> This is pretty dense with industry-specific terms, but I think I figured it out.

"Packaging" is a talent agency bundling up different creative roles (writer, producer, actor) for a project (film or tv show) and then pitching that group of people for that specific project to the studios. The agency takes a percentage of the _project_ revenues instead of a percentage of each individual _talents_ pay for the project.

This is apparently the standard way things work in Hollywood now and has some consequences:

1\. It screws up the "Agent" part of the talent agency. They no longer directly represent an individual's interest (like a Real Estate agent or a Lawyer) because they just want to get people into a "package". This is the main problem described in the article, that there are some massive conflicts inherent to this process.

2\. Packaging projects make agencies way more money than directly representing clients.

3\. It reverts movie and tv making back to something like the studio days. Every actor isn't really able to work with every director, in order to get something made they need to be "packaged" which means working with someone else from within the same agency.

4\. It messes up people lower on the rung more than top tier folks because they're less able to buck the system.

<comment><USER3> Real Estate agents are famous for not representing their customer's interest. In real estate, half the time (buy-side) your agent is being paid their entire income for the transaction _by your adversary_. In several states, "your agent" is legally required to disclose the fact that they are _not_ your agent!

<comment><USER4> Your agent, no matter who is paying them, has a fiduciary duty to you. I've bought and sold a lot of property and can guarantee you that the fact that commissions are paid by sellers makes zero difference. Really, it's coming out of the purchase price, which is netted to the seller but technically is being paid by you.

<comment><USER5> _Your agent, no matter who is paying them, has a fiduciary duty to you._

This isn't universally true. In some US states, the frequent problem is that the agent who is showing you homes (and who you tend to think of as "your agent") is not actually your agent (with fiduciary duty to you), but a subagent of the seller (with fiduciary duty to them). Here's an excerpt from recent report on this:

\---

For many years, a large majority of home buyers and sellers have worked with real estate agents. Most consumers believe that these agents always or almost always are required to represent the interests of the home buyer or seller with whom they are working. ... Yet, real estate agents often are not required by law to represent the interests of the buyer or seller with whom they are working, and many do not.

In reality, there are a number of different types of relationships allowed in most states between real estate agents and their clients.

      • Single agent: The agent works solely for the client
      and has fiduciary responsibility. A fiduciary agent
      is "obligated to procure the greatest advantage to
      his client."
      • Designated agent: The agent is recruited by the
      listing agent to work with a buyer and has fiduciary
      responsibility to that buyer.
      • Subagent: The agent works with the buyer but has
      fiduciary responsibility to the seller.
      • Dual agent: The agent somehow is expected to represent the
      interests of both the seller and buyer in a home purchase.
      • Transactional agent: The agent works with both buyer and
      seller to facilitate a sale but has no fiduciary
      responsibility to either party.

[https://consumerfed.org/wp-content/uploads/2019/01/the- agenc...](https://consumerfed.org/wp-content/uploads/2019/01/the-agency-mess- home-buyer-and-seller-confusion-report.pdf)

\---

So while it's possible that you live in a state where you are correct, where subagency and dual-agency are forbidden, in the absence of a signed contract for the services of a buyers agent, others should not follow your advice until they are certain the same is true for them.

<comment><USER6> So who does a Secret Agent have a fiduciary responsibility to?

<comment><USER7> Depends, are they a double agent?

</comment></comment></comment></comment></comment></comment><comment><USER8> "[Andreessen Horowitz] aims to flip the venture industry on its head by acting more like a talent agency - specifically Creative Artists Agency, which became so prominent in Hollywood that it was hard to do deals without them being involved."

[https://blogs.wsj.com/venturecapital/2011/01/21/why- andreess...](https://blogs.wsj.com/venturecapital/2011/01/21/why-andreessen- horowitz-models-itself-after-a-hollywood-talent-agency/)

This being Hacker News and all, I thought the idea that a16z is modeled on CAA would have come up already.

<comment><USER9> _Who is Michael Ovitz_ is a great read on the formation of CAA and (what was then) the new world of packaging. This has been going on for decades.

</comment></comment><comment><USER10> Writing like that, in a showboating over-the-top style, is effectively its own special genre. It's not supposed to be economical. It's not solely meant to communicate a specific message. It's the "hold my beer" of writing. It's the kind of writing other writers appreciate for what it is -- like the jokes that comics tell each other -- not meant for general consumption.

If you want to label it as "bad writing", you're certainly within your rights. But it's reductive, it misses the point, and worst of all, as an insult, it's rather boring.

<comment><USER11> Was someone accusing david Simon of being a bad writer?

<comment> village-idiot Yes. Scroll down and try to read the low contrast entries at the bottom.

<comment><USER12> It seems to have completely disappeared.

Too bad, too, because I make the same criticism myself, of the New Yorker style of "make me wade through 500 words just for an inkling of what this is actually about". But yeah, it's a matter of taste.

<comment> village-idiot Keep in mind that he's writing to convince other writers, statistically you probably aren't the target audience. My gym buddy who's a professional tv writer says that this entry had a big impact on getting WGA to do something.

<comment><USER12> Fair enough, this is a case where it would actually be more correct to use that style!

</comment></comment></comment></comment></comment></comment><comment><USER13> This article is a little bit old because he mentions the upcoming union vote. The vote has now been cast, and 95% of writers have voted to only work with agents signing a code of conduct that bans packaging:

[https://deadline.com/2019/03/wga-members-overwhelmingly- appr...](https://deadline.com/2019/03/wga-members-overwhelmingly-approve-new- agency-code-1202585826/)

Funny side note I learned from my girlfriend who is an aspiring writer and has worked at an agency: agents call this practice "getting points on the package" which may be a term that rings a bell if you've watched the wire, [https://www.urbandictionary.com/define.php?term=Points%20on%...](https://www.urbandictionary.com/define.php?term=Points%20on%20the%20package)

</comment><comment><USER14> A tangent to this is the recent fallout from the Bones -- Hulu case.

In that case, the guy representing Fox and Bones was also the guy representing Hulu. So he sold the rights for $0.

He literally signed both party lines on the streaming rights contract. And thought he'd get away with it.

</comment><comment><USER15> David Simon's books "Homicide: A Year on the Killing Streets" and "The Corner: A Year in the Life of an Inner-City Neighborhood" (co-written with former homicide detective Ed Burns) are the kind of stories that change your thinking forever.

</comment><comment><USER16> I follow David Simon on Twitter just because his takedowns of idiots who attack him are so entertaining.

Example from this morning: [https://mobile.twitter.com/AoDespair/status/1113779904028598...](https://mobile.twitter.com/AoDespair/status/1113779904028598272?s=09)

</comment><comment><USER17> A fun read rife with lyrical, bilious insults....but he doesn't really explain the economics of "packaging"

<comment><USER18> I thought that for a good writer, that was actually terribly written. An author intoxicated by the ebullience of his own verbosity.

<comment><USER19> Indeed. "fuckbonnets"? This article would have been much better without these.

<comment><USER20> Personally I avoid profanity in my writing, because I don't think it would add anything. But this essay illustrates that it _can_ add quite a lot, if you know how to use it. Deployed with expert timing and creativity, in the context of other effective rhetoric, it conveys the depth of Simon's outrage and disgust. I still don't think _I_ would achieve anything by peppering my comments with f-bombs, but I think _he_ has earned them.

<comment><USER21> Kurt Vonnegut said that when you curse you give him the right to ignore you. And I agree with you.

<comment><USER22> Kurt Vonnegut has always had the right to ignore me, regardless of whether or not I'm cursing.

</comment></comment></comment></comment></comment></comment><comment><USER23> Probably not much different in substance from the treatment of musical artists by the big recording companies, or of novelists by publishing houses, or ... insert any comparable paired relationship of creative maker and avaricious exploiter and you'll get the same outcome.

</comment><comment><USER24> If you're interested in learning more - I recommend reading the book Powerhouse about the creation of the Creative Artists Agency.

<comment><USER25> And "Who Is Michael Ovitz" which tell the story from one of the founders.

</comment></comment><comment><USER26> Entrenched middlemen become abusive gatekeepers. Is it inevitable across human society? Is there a way to prevent it from happening?

</comment><comment><USER27> It seems the easy win here is for everyone who gets packaged to walk into the studio the next day and say "cut out the agent and we will take the agency's 20% and give you back 5%"

If acted on like a union (Equity) then the whole process would stop in a month

</comment><comment><USER28> Tangent... [https://theoutline.com/post/7023/what-is-a-douchenozzle- swea...](https://theoutline.com/post/7023/what-is-a-douchenozzle-swear- nerds?zd=1&zi=s5i4uvdc)

<comment><USER29> Spare me the j-school varsity social criticism takes, especially if they're gonna go after that kind of language play without even referencing Armando Ianucci.

</comment></comment><comment><USER30> I got five sentences into this, thought "wow this sounds like David Simon," looked up, and sure enough it was.

</comment><comment><USER31> He learned about this "packaging" crap back in 2002. What took him so long?

<comment><USER32> There's a union vote up for the relationship between the WGA and the big 4 agencies, and he is on the WGA council. So this is him giving a stump speech for voting for the restrictions on agencies. Here's an article on the subject:

[https://variety.com/2019/biz/news/wga-agencies-writers- agree...](https://variety.com/2019/biz/news/wga-agencies-writers-agreement- april-6-1203178981/)

> The WGA aims to revise its decades-old rules to bar agencies from taking > packaging fees from production entities on TV series and movies, and the > guild seeks to bar WGA members from working with talent agencies with parent > companies active in the production arena.

</comment></comment><comment><USER33> Whatever they paid an editor to make that writers other work readable, it was not nearly enough.

Agents are notoriously terrible people, but they get away with it because of conceits like these from the talent.

Good God, my eyes.

The ethics of taking both sides of a deal need to be more explicit, as it is very common, and in any agency market, considered ideal.

<comment><USER34> You're talking about the Creator of "The Wire", one of the most anointed TV series of all time.

<comment><USER35> And Homicide (the book) is immensely readable, one of my favourites.

<comment><USER15> His followup, The Corner, is one of the most devastating books I have ever read. The show The Wire also pulls from it.</comment></comment></comment></comment>


US House approves $5,000 fee for official drilling protests - <AUTHOR> http://rt.com/usa/house-drilling-protest-fee-fracking-123/ <comment><USER2> Old news. Fuck you America.</comment>


When In Doubt on Pre-Money Valuation, Smart Guys Procrastinate - <AUTHOR> http://vcexperts.com/vce/library/encyclopedia/documents_view.asp?document_id=1360

<comment><USER2> I've seen this technique applied recently. The founders had plenty of people interested in the angel round. Yet, they refused to put a price on the investment, deferring it to a future funding event. Even many savvy investors that understood why they were doing this and found the contracts to be clean, decided not to invest as the founders were saying "I need $x hard cash from you now and some time in the future you will know what percent of the company that translates to." It may be a good way to go, but its a hard way. Its much easier to be prepared to name your price, raise only what you need and live with it.

</comment><comment><USER3> Convertible debt sucks for angel investors, they are taking far more risk than the VCs but are only getting a 20 to 30 percent discount.

<comment><USER4> Nowadays though, convertible debt actually has a pre-money valuation tied to it and is just a faster financing mechanism.</comment></comment>


Argentina sinks Chinese trawler during pursuit for illegal fishing - <AUTHOR> http://www.theguardian.com/world/2016/mar/16/argentina-sinks-chinese-trawler-during-pursuit-for-illegal-fishing <comment><AUTHOR> Official report translated here by a reddit user: [https://www.reddit.com/r/worldnews/comments/4al2ek/argentina...](https://www.reddit.com/r/worldnews/comments/4al2ek/argentina_sinks_chinese_vessel_cites_illegal/d123c83)</comment>


Ask YC: Any good Rails log anlysis tools? - <AUTHOR>

We've been looking for a way to analyse our Rails production logs, but haven't really found anything suitable. Basically we'd like something which can (1) provide site traffic information on a slightly more real-time basis than Google Analytics, (2) help figure out which pages are taking a long time to render, or are heavily loading the database, and most importantly, (3) pull out any errors thrown by the code. Does anyone have any suggestions for tools which might help do this? <comment><USER2> For #3, check out the Exception Notifier plugin: <http://agilewebdevelopment.com/plugins/exception_notifier>. It'll email you any app errors, along with associated session data and whatnot.

For #1, I just rolled my own admin stats with XML/SWF: <http://www.maani.us/xml_charts/>

For #2, we've been trying to find a good profiling tool, too. Anyone have any experience with railsbench? <http://railsbench.rubyforge.org/></comment>


Ask HN: Is security consulting a good market/career path? - <AUTHOR> I've always been interested in security consulting (for instance, working for a company like Matasano). I'm curious what the market is like for security consultants/penetration testers. Is it profitable? Easy to find jobs (assuming you're decent at what you do)? <comment><USER2> _Is it profitable?_

It's difficult to not be profitable in a services business. Is the question "Is it lucrative?" Application security is a lucrative specialization when one is doing it towards the high end. There also exist a bunch of folks who specialize in running off-the-shelf software and emailing the PDFed reports that software produces. Consultants who charge peanuts exist, but they're monkeys. Don't be a monkey; don't work for peanuts. (If you need a rough indication of rates I'd say "Similar to Rails development at the medium-to- high end of sophistication; similar to white-hot specialties like e.g. iOS developers with a strong portfolio or marketing engineers at the very high specialized end where one is doing e.g. cryptosystem review, embedded devices, etc." If you need further color on the weekly rates implied by that sentence: $8k is a fairly standard Rails journeyman weekly rate; there exist consultants in those white-hot specialities who charge north of $20k a week.)

 _Easy to find jobs (assuming you 're decent at what you do)?_

Contingent on one having the inclination and execution ability required to run a consultancy, which is something which comes much more easily to some technologists than to others, it is straightforward to get gigs as an appsec consultant. You go to people with applications and convince them to buy application security assessments and remediation from you. If this strikes you as being a straightforward problem, you will not experience difficulty finding work. If you're mystified as to how one would go about identifying software companies and finding someone inside them who can purchase application security assessments, it will be harder. (This is not directed at you personally but rather at a portion of the would-be consultants I've met over the years.)

As to career path: I would strongly, strongly suggest that application security consultants should have and maintain strong coding chops. If one does this -- and, incredibly to me, there appears to be a large swathe of the security industry which does not feel like they need to be able to actually write software -- one will never lack for professional opportunities.

<comment><USER3> What about a non-business owner? How about an application security consultant working with a business such as Matasano? How do those salaries compare?</comment></comment>


Why 4 A.m. Is the Most Productive Hour (2016) - <AUTHOR> https://www.wsj.com/articles/why-4-a-m-is-the-most-productive-hour-1471971861 <comment><USER2> Due to my rowing habit (once a week, early the water is far quieter) I now wake consistently at 5am. I think a quality in this story is true: there are far less distractions. Its not entirely free of external sources, the sun rises, the birds sing, you are in the world after all. So perhaps, the quality being sought here, is to be capable of freeing yourself of _human centred distraction_ -don't turn on the radio, don't make coffee, don't lay the table, or do the dishwasher, or any of 100 multitasking things, which actually demand more brain than we acknowledge.

If you take the time, to have some time, free of other distractions, it doesn't matter when it is: the thing is to have _time to focus_

btw, what I mainly do at 5am on the non-rowing days, is read the web in a 20 tab chrome pane, and then write responses online. I think its a bit distracting, but enjoyably fills the time. If I was less oblomov like, I'd plot world domination or learn a new programming language, but when I am of a mind to do _work_ I try to do the thinking part, because this time, is a golden time for thinking. Thats what free of distractions actually gives you. Thinking time. Don't waste it online, or if you do, use it to make thought concrete.</comment>


M-Pin says it can do ECC based 2FA in browser - no usr/pswd DB - doc-m http://www.certivox.com

<comment><AUTHOR> How can ECC be fast enough in Javascript? Anyone tried this or am I first?

<comment><USER2> it seems okay on the demo page, I tried on my iPhone 4s too and that wasn't too shabby.

</comment></comment><comment><USER3> My question is how in the world do they make ECC crypto run that fast in browser, if that is indeed what they are doing?

</comment><comment><USER4> a 4-digit pin? brute force in 10,000 tries? this is secure, how?

</comment><comment><USER2> if this is as good as it claims to be that's pretty cool. I use Google Authenticator for some things but's no good if your damn phone has died!

</comment><comment><USER5> Where can I get more info on the strong elliptic curve cryptography and identity-based encryption behind this open source code?

<comment><USER3> They made the source code available on GitHub [https://github/certivox](https://github/certivox)</comment></comment>


Startup Quote: Jim Collins, author, Good to Great - <AUTHOR> http://startupquote.com/post/3524594444

<comment><AUTHOR> Whether you prevail or fail depends more on what you do to yourself than on what the world does to you.

\- Jim Collins

<http://startupquote.com/post/3524594444>

</comment><comment><USER2> What a fantastic site. One of my favorites from looking at the last couple of weeks:

<http://startupquote.com/post/3218837306></comment>


Where to find a freelance web design student? - <AUTHOR> Hi, we're trying to find a web design student who can set up our wordpress site (it doesn't require any coding, it just needs to be set up through the admin panel and a nice layout has to be made with Divi). On Upwork we only get responses from people in Asia, but I'm honestly not very happy about the quality of work from there based on my previous experiences. Where do people turn to to find someone like this? <comment><USER2> Upwork can be powerful if properly used. Maybe try to increase the rate? hand pick candidates, send invite to US based web devs</comment>


Ask HN: Anyone have insight into local US lobbying? - <AUTHOR> I am currently investigating how feasible a lobbying idea I had would be. I have scoured the internet with little success. Does any here have lobbying knowledge? Or know where I should look? I am willing to pay :) <comment><USER2> At one (long ago) point in my career, I was a registered lobbyist. Dunno how helpful I can be in your specific case, but I'm always happy to talk to people. Contact info is in my profile.</comment>


Show HN: InstaWifi, an app that uses NFC and QR codes to connect and share wifi - <AUTHOR> http://www.instawifi.jessechen.net/

<comment><USER2> It's neat, but it _is_ just for phones. Most people on smartphones are already connected to a network of some sort, meaning that they most likely won't ask for your wifi password.</comment>


A Lisp based programming language I'm creating - <AUTHOR> https://github.com/rogcg/pixel

<comment><USER3> I'm looking at Prog1.px et. al. If you format your Lisp code this way, the Lisp community is not likely to take your project very seriously.

<comment><USER4> I suspect you're missing the point. He's writing Algol-ish code using Lisp syntax/data structures. The formatting is to emphasize this fact.

Thus, if I understand correctly, he wants to allow us to write & think about the code much as we might handle C code, while still having Lisp-style code- as-data power & flexibility available to us.

Or maybe not. Just guessing.

<comment><USER3> I'm actually making a prediction, and not a judgement. Nobody would say I'm a member of the Lisp community, whatever that might mean. But I have seen people get landed on pretty viciously for this kind of formatting before, and if you want participation from a community you should abide the community's standards, even if they are irrational.

Even if the point is to write Algolish code, formatting it like this is likely to earn scorn rather than appreciation.

<comment><USER5> On the other hand, if you want participation from the Algol-descendant community, who frequently scorn the Lisp community's formatting, that may be exactly the right decision to make to get them familiar with Lisp-like syntax and worry about teaching them the more standard Lisp-community formatting conventions later.

<comment><USER3> That's a really good point.

</comment></comment></comment></comment></comment><comment><USER6> I also toyed with my own Lisp[1] a few weeks ago, after being inspired by Peter Norvig's Lispy[2]. It's an interpreter though, and written in C++. I mixed together features from different languages (eager/lazy evaluation, call- by-value/reference, macros). It was very instructive and a lot of fun!

[1] <https://github.com/apresta/lime>

[2] <http://norvig.com/lispy.html>

</comment><comment><USER7> Well. This language seems to be senseless. It looks like all those parenthesis are there to make language look like Lisp. Well, I'd grade Lispness of this code as totaly non-Lisp like. Far more interesting would be atempt to create C-looking functional language that could look like that:

      define( fact, ( n ), function(
          cond( ( n = 0 || n = 1, 1 )
                ( n > 1, n * fact(n-1) )
          )
      )

      print( fact( 5 ) )

I think I'd try to program in language like that. Lisp way of thinking, but parenthesis are bit more helpful and there are "normaly" used operators which makes language bit more readable. Your project looks like another purely academic example. I think purely academic examples sucks because don't teach people to do what is actualy needed.

I didn't read your code carefully, but "endles" elsif chains looks terrible and I think there shouldn't be stuff like that in tutorial project. Moreover I believe java isn't good tool for that purpouse( another nobody seems to teach ). I'd use flex and bison or perl if you realy want to implement lexical analisis yourself..

<comment><AUTHOR> Well, explaining your point of view - the parenthesis aren't there only to make the language look like lisp - I used it for its syntax and for delimit the scopes.

Now, about the "else if", I also felt bad about it, and I'm thinking about a changing for it, I'm still working on it, as in a lot of features. If you want to add some feature or change something, please feel free and do it - <USER2> show your purpose before do anything, so we might discuss how it will work .

And yes, I started this project while on university, and I don't think it sucks, because my intention is not to create a new technology - at first instance - but help people who want to learn how to write a programming language (as you can read on the README file), whatever comes to this project (bad or good), it will be well accepted for learning.

I also agree with you that Java is not the best tool for implement such thing, and I was thinking about rewriting it to C++ or Python.

</comment></comment><comment><USER8> Could be better, could be worse. The implementation definitely needs a bit of love, yet I think this project could turn out to be rather useful. I guess I see it not as a low-level Lisp, but as a Lispy high-level assembly. Applying Lisp macros to assembly generation seems like a pretty natural thing, similar to Forth in a way. Instead of trying to make high-level stuff efficient, just make low-level stuff easy.

</comment><comment><USER5> Neat! I just started playing around with the implementation of another Lisp- inspired language I've been thinking about for a while now (<https://github.com/gliese1337/vernal-lang>); I suspect this could turn out to be a really useful reference for implementing the compiler (not to mention inspiring me to steal features).

</comment><comment><USER9> Just pointing out that this is pretty much the dead centre of the Hacker News interest group - if you join the dots.

This is all about the combination of

(a) the 0x10c compiler writing <http://0x10c.com/> (assembler project), (had many hacker news posts) and

(b) Abdulaziz Ghuloum's An Incremental Approach to Compiler Construction <http://scheme2006.cs.uchicago.edu/11-ghuloum.pdf> (which has had about two separate Hacker News posts):

</comment><comment><USER10> This is similar to something that I've been working on called sxc (S-Expression C). I'm not sure what language he's writing it in, but without a powerful macro language that can manipulate the s-expressions/lists the lisp syntax is just cosmetic.

</comment><comment><AUTHOR> IMO, I believe that for a good programming language to exist, the power is on its grammar. Of course we can choose the wisest syntaxes, and the best technologies to build it, but the kernel of the language is on its grammar.

That's my opinion.</comment>


The mathematics of weight loss - <AUTHOR> https://www.youtube.com/watch?v=vuIlsN32WaE <comment><AUTHOR> Basically fat becomes CO2 and Water. You lose fat breathing and sweating.</comment>


SpaceX Says It's Ready for Liftoff Again. The FAA Begs to Differ - <AUTHOR> https://www.wired.com/2016/12/spacex-says-ready-liftoff-faa-begs-differ/ <comment><USER2> Not only is the article trying to be sensational, this part describing the previous accident:

"After several months, the company identified the cause—a faulty bit of scaffolding in the one of the helium fuel tanks"

is extremely wrong. Helium isn't fuel, and the scaffolding was inside of the LOX tank holding up a helium tank.</comment>


ITER Live: Start of Machine Assembly - <AUTHOR> https://youtu.be/2-7GyVLKE6A <comment><USER2> I recall multiple conflicting stories about how this is the future and how this is waste of money on a ill conceived giga-project.

I also recall a skunk works reactor that takes radically different approach (smaller reactors, instead of big) and was supposed to have results if few years.

[2014]: [https://news.ycombinator.com/item?id=8458339](https://news.ycombinator.com/item?id=8458339)

Then there are new stories about skunk works being on track.

[https://aviationweek.com/defense-space/lockheeds-skunk- works...](https://aviationweek.com/defense-space/lockheeds-skunk-works- building-bigger-fusion-reactor)

<comment><USER3> IIRC, when ITER was conceived, it wasn't a waste of money. They just chose a conservative development path that was expensive but very likely achievable. Technology and theories have since advanced that might leapfrog it, but the project has still contributed a great deal to our understanding of fusion and the engineering required to produce it.

Relevant talk by one of the MIT professors working with Commonwealth Fusion Systems:

Breakthrough in Nuclear Fusion? - Prof. Dennis Whyte (2016) - [https://www.youtube.com/watch?v=KkpqA8yG9T4](https://www.youtube.com/watch?v=KkpqA8yG9T4)

Timeline (in case you want to skip over some parts):

      00:01:00 - introducing Dennis Whyte, MIT department head for nuclear science
      00:04:24 - presentation starts
      00:06:00 - identifies breakthrough with REBCO magnets
      00:07:25 - explains deuterium-tritium fusion
      00:12:30 - basic metrics for reactor performance
      00:17:15 - energy output of other previous fusion experiments
      00:19:00 - examines ITER and the problems of its approach
      00:22:00 - problems solved by high energy magnetic fields
      00:28:15 - full scale reactor concept, teardown of REBCO magnets
      00:37:00 - design limits and margins
      00:39:00 - fixes plasma instabilities found in weaker magnetic chambers
      00:40:00 - maintainability, lifespan, component replacement
      00:45:00 - solution to neutron damage and energy capture
      00:50:30 - cost and profitability
      00:54:00 - full graph of field strength vs reactor scale (and thus funding requirements)
      01:01:50 - Q&A
      01:30:00 - question about the biggest risks

A more recent (2019) talk with more numbers and even more confidence: [https://www.youtube.com/watch?v=rY6U4wB- oYM](https://www.youtube.com/watch?v=rY6U4wB-oYM)

<comment><USER4> > Technology and theories have since advanced that might leapfrog it

With "might" being the operative word. As long as none of these new approaches has achieved viable fusion (so, more power out than in) I think it's not a bad idea to just continue with the less radical plan that will probably work, even if it is slower.

<comment><USER5> ITER is research. There are numerous engineering problems yet to be solved, plasma physics, materials science, you name it. Research projects are always a "waste of money" in some way so that particular criticism is neither surprising nor very helpful.

</comment></comment></comment></comment><comment><USER6> Does this mean we are only 10 years away from fusion?

<comment><USER7> No, ITER will not be used as a power plant. Think of it as an experimental device like the LHC. The findings from ITER will be used to build DEMO which will be able to output power continuously. And DEMO's findings will be used to create PROTO, a commercial power plant. Sometime after 2050. Maybe longer.

And if you want to be really technical, we've had fusion reactors for decades, but ITER should be the first one that produces more energy than it consumes.

[https://en.wikipedia.org/wiki/DEMOnstration_Power_Station](https://en.wikipedia.org/wiki/DEMOnstration_Power_Station)

[https://en.wikipedia.org/wiki/PROTO_(fusion_reactor)](https://en.wikipedia.org/wiki/PROTO_\(fusion_reactor\))

</comment></comment><comment><USER8> How far behind? How much over budget?

</comment><comment><USER9> All the while, we have the new company formed out of the work of the SAFIRE project that uses self-organizing plasma fields that makes traditional tokamaks look entirely stoneage.

Not only are they doing fusion at a tiny fraction of the power, they're doing it with a much much much smaller system that is producing heavier elements out of thin air _while_ having started as just a "sun in a bottle" research system to understand how the Sun interacts with the electromagnetic field of the galaxy (and why the 1960s nuclear fusion model of the Sun explains _nothing_ of the past 50-60 years of observations published since).

They did it on basically a shoestring budget, too.

<comment><USER10> I really wanted to believe in the SAFIRE project, but it looks like an embarrassing scam, unfortunately: [https://www.youtube.com/watch?v=vmVdPgkudC8](https://www.youtube.com/watch?v=vmVdPgkudC8)

Really hope I get proved wrong in the next years.

<comment><USER9> Yeah, I don't get the point of those kinds of Youtube videos. If they think its a "scam", they should publish a paper on the inability to replicate of the results.

Instead its just some weird reaction video by some rando on Youtube that has not cited his sources. The irony of this is, he accuses them of doing the same thing EU proponents have accused modern Cosmology of doing: filtering out anything that doesn't fit their narrative, even when its established science in another field for the past few decades.

The SAFIRE guys aren't cosmologists, they're approaching the problem of the Sun the same way a plasma physicist would. Literally, they are following in the footsteps of Hannes Alfvén (the guy that got the Nobel for magneto- hydrodynamics), and Kristian Birkeland (nominated for a Nobel seven times due to his work in this field), and continuing their work.

The people who claim that plasma physics has no place in space, in solar/planet interactions, in galactic/star interactions, etc are, frankly, insulting both the Nobel committee _and_ the work of NASA for the past 30+ years. They're on the same delusion spectrum that flat earthers are on, just not quite to that extreme.

I'm not saying SAFIRE is right, but SAFIRE isn't even saying they're right. They've literally asked for other labs to replicate their results because they've found a novel way of replicating the Sun's activity in their lab, and they need to rule out measurement error in ways they haven't already. They are _seeking_ replication and validation, something scammers don't do.</comment></comment></comment>


Trump: Internet must be "cut off" to stop terrorist attacks - <AUTHOR> http://www.independent.co.uk/life-style/gadgets-and-tech/news/donald-trump-twitter-internet-cut-off-terror-attacks-parsons-green-tube-attack-explosion-latest-a7948141.html <comment><USER2> You are all falling for fake news clickbait.

"Loser terrorists must be dealt with in a much tougher manner," he wrote. "The internet is their main recruitment tool which we must cut off & use better!"

He doesn't mean cut off civilian access in the USA or in the UK, if he meant shut down the Internet he wouldn't have added the "we must use it better" at the end of the sentence.

Why are everyone getting so excited about it? It's a nothing burger...

<comment><USER3> I agree with your general sentiment, but it's still dangerous for governments to unilaterally decide that certain people won't have a voice. Who decides who the "terrorists" are? It's easy to agree when you're talking about ISIS recruiting kids in the US and convincing them to shoot up schools. It's harder to agree when you're talking about people who chain themselves to Redwoods so they won't be logged (aka ecoterrorists).

</comment></comment><comment><USER4> Cut off the internet and you just create the incentive for developing popular decentralized networking and motivate millions of the 'silent majority' to research how to connect to it.

I don't see what the internet has to do with how little it takes for these terrorists to radicalize loners. Surely fixing that would be better goal, and less of a hydra..

<comment><USER5> Are they loners? Not sure religious extremist terrorism is equatable to the solo nutjob unabomber-style terrorist.

<comment><USER4> I guess my assumption is the more people you can go to in a community (or community within a community), the less likely your political belief is to target its citizens. That it presents uses signifiers and phrases from religion (ie a vehicle for rituals) doesn't alter that it's just a totalitarian political belief (self-granted permission to use violence to gain power); if anything, the radical fundamentalism comes from something like "we have been powerless because we were too pragmatic and not unreasonable enough" \- imo, which pretty much confirms that the violence arises from nihilistic disavowal of religion.

</comment></comment></comment><comment><USER6> _Somebody will say, 'Oh freedom of speech, freedom of speech.' These are foolish people._

What a country!

<comment><AUTHOR> Absolutely agree.

We have a constitution that guarantees our right to free speech.

And then we have a number of individuals in government who find every possible way to explain that right away, and throw you in jail.

It's like saying, "everyone has the right to not be searched without a warrant...

... but I swear I smell marijuana somewhere around here so let me call a judge and in 15 minutes we'll be kicking down your door."

</comment></comment><comment><AUTHOR> It never ceases to amaze me how politicians "never let a crisis go to waste".

Shutting off the internet has happened in Egypt and Cameroon. It brings communication and innovation to a halt for 99.999999% of "good people".

The 0.000001% of people who desire to commit terrorist acts will simply find another way to communicate. Radio? Word of mouth? Sneakernet?

Cutting off the internet is cutting off our noses to spite our faces.

Such a proposal should NEVER, EVER be uttered, unless you want to lose all credibility whatsoever.

It is the equivalent of saying "just bomb the Middle East", as if millions of civilians and foreigners wouldn't be affected.

<comment><USER7> Well we have Trump here calling for it. He has ZERO credibility outside of his dumbass supporters.

<comment><USER8> Could you please not post like this here?

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

</comment></comment></comment><comment><USER9> Trump's antics aside, I wonder how much more turmoil will it take for cutting off the Internet to become an acceptable solution for a significant minority of people in the West. Both sides of the political divide are becoming increasingly frustrated with it: the Right see it as a terrorist recruiting tool, the Left fear the Russian influence/trolls/hackers, and everyone seems to despise fake news and echo chambers. Some sort of a semi-popular anti- Internet/Internet Reform movement is bound to spring up sooner or later.

<comment><AUTHOR> This is an interesting and troubling thought. It is much like the "Washington Consensus" that keeps the NSA alive and thoroughly funded. The NSA is probably the best example of bipartisan collaboration in the world- which hurts all of us around the world.

I think Internet censorship and restriction continues to slowly creep along in fits and spurts. We see article after article of people being thrown in jail or targeted (Lauri Love, Kim Dotcom, Aaron Schwarz, TPB and Peter Sunde specifically, Julian Assange, etc)... and though we express outrage and we organize...

We really are powerless to corporate and governmental control.

So I guess some day the probably will shut off the internet just for fun. They've already been droning people and SWATting people for fun, why not shut off the internet too?

Just make sure you say it's for vital US national security interests.

<comment><USER9> I feel that the governmental/corporate attempts at killing free Internet are mostly ineffective as long the public unanimously wants to preserve it. But as soon as enough people begin to question it themselves, thinking that maybe they _would_ be better off with a walled garden, that their lives would be some much less stressful and chaotic if they just let it be properly regulated, then it becomes a different struggle altogether. If you ever see outlets publishing articles about how less stressful people's online lives are in China/Iran/Russia, know that that's the angle that's being pushed.

</comment></comment></comment><comment><USER10> To anyone who is perplexed by Trump (I certainly counted myself as one) you will find that one simple rule will help you decipher his outbursts: he doesn't mean what he says. His manner of speaking simply is not meaningfully quotable and it's part of a larger strategy of persuasion that's actually worked quite well for him. If you haven't listened to Scott Adams' explanation of Trump, you really should: [https://www.youtube.com/watch?v=ReKIJvOJDrs](https://www.youtube.com/watch?v=ReKIJvOJDrs)

</comment><comment><USER11> In case anyone doubted the pure purpose of terror is to control the masses.

</comment><comment><USER12> Please listen to him and cut his access to the internet and twitter!</comment>


The Real Narcissists - <AUTHOR> https://www.psychologytoday.com/articles/201609/the-real-narcissists <comment><USER2> > A growing consensus among psychologists says no, it isn't. True pathological > narcissism has always been rare and remains so: It affects an estimated 1 > percent of the population,

That is not actually rare. That's 1000 out of 100,000.</comment>


Canadian PM Justin Trudeau Facing Resignation - <AUTHOR> https://www.cbsnews.com/news/justin-trudeau-brownface-photo-shows-canada-prime-minister-west-point-grey-academy-college-party-2019-09-18/ <comment><AUTHOR> Appropriate moment, Trudeau faces re-election next month.

Some time ago it was an Austrian PM, now it is a Canadian. At this digital age is there anyone without digital traces that can be used against him/her?</comment>