The Mathematical Con of Hedge Funds and Financial Advisers (2014) - <AUTHOR> http://www.psmag.com/business-economics/dangerous-mathematical-con-hedge-funds-financial-advisers-79212 <comment><USER3> "When it comes to publishing in the Journal of Finance or the Journal of Financial Markets, the editors simply don't have the mathematical knowledge necessary to vet some of the more complex and nuanced assertions."

Personally, I think everyone should stop reading at this point. Of course I went through to the paper itself.

What is the paper? Mathematicians citing Leontief from 1982 about the woes of economics as a science, running some simulations (no data for me, thanks!) and really getting quite angry, for what, to remind us that backtesting is a flawed methodology? If you invest based on some random back-tested wavelet bullshit you're doing it wrong, this is not news to anyone. Harvey, Liu and Zhu made their point already (note - not the Zhu who authored this paper) and nobody cares about your filling in some dull derivations in a mathematical appendix and calling them "proofs." Everyone complains about economists doing too much of that already.

<comment><USER4> I find it entertaining that you simultaneously critique the lack of rigor and also complain about economists making the math rigorous.

The point of proofs, simulations, and the like, is to make sure that your model is at least internally consistent and your assumptions actually yield the results you think. A lot of times models specified with vague verbiage don't even do that.

</comment></comment><comment><USER5> The point put forth in this article is that a certain degree of scientific rigour is important in running a business and it's a principle that is broadly generalisable. In particular in software development one encounters the philosophy of "get it out the door quick" regardless of the cost to quality. Engineers are often viewed as a cost-centre rather than the actual producers of value in a business when the bottom line is evaluated. It should be clear to us that businesses that actively capture and nurture engineering talent (google, apple, facebook etc.) are the businesses that are doing better at the moment than those that focus on "unit cost" of "resources" (e.g. IBM, HP) and many are now trying to make that transition as we can see from the trend towards more engineer-friendly processes such as Scrum (away from the more punishing "waterfall" style approaches).

<comment><USER6> I'm with you except that I think the "unit cost" thinkers are only shifting towards Agile/Scrum because the cool kids are doing it. In the brand of Agile/Scrum that those shops create, it is anything but engineer-friendly, and they absolutely still view engineering and software development as cost centers instead of value centers. In fact, in a lot of cases, Agile is used explicitly because it enforces an aggressive deadline culture in which the sacrifice of quality in favor of short release cycles is explicitly codified into the work culture, and reinforced every day in every team interaction. These situations also foster extreme degrees of "surveillance culture" \-- basically since the middle management over top of the so-called cost center of engineering can't do much, technologically, to mitigate the realities of creating software value, they opt instead for draconian surveillance and progress tracking environments, like stodgy Jira, and they take things like team burndown literally and draw sweeping conclusions from an extremely small set of burndown data. This all typically goes hand-in-hand with open-plan offices too, where everyone can be literally seen during their work and there is an implicit mandate from the company that your status is partially related to how much you 'look the part' while in the office. Even if you're a developer needing quiet time to creatively solve a problem, and you're seated smack in the middle of a loud group of sales associates whose job requires them to be on the phone all day, the business doesn't care. Your actual productivity as a developer isn't as meaningful to them as your ability to look like a good piece of office furniture most of the time by fitting into their surveillance and micromanagement culture. Typically, promotions and advancement are won in the environments not through technical skill or hard work, but through one's ability to sublimate your natural desires for reasonable working conditions and "endure it with a smile" better than peers can, a phenomenon which Michael O. Church referred to as "macho subordination." In my working experience, at least, this has been precisely how Agile/Scrum are used, whether in a start-up, a finance firm, or a long- standing education tech company.

<comment><USER5> To borrow and misuse a phrase, "guns don't kill people". If you're working in this kind of environment you're on to a loser no matter what.

</comment></comment></comment><comment><USER7> Anything anyone is trying to sell you in this space is a con. If it were profitable, they'd be doing it themselves. Exactly the same as gambling systems.

<comment><USER8> Investing other people's money is always more profitable than your own. If you found a way to get a risk free 30% IRR year on year, wouldn't you rather take 5% of the profit from $1,000,000 invested than 100% of the profit from $10,000?

<comment><USER4> It's only more profitable if you don't have capital. Most of the very successful hedge funds stop taking other people's money and just invest their own once they have enough.

<comment><USER9> You're confusing the math with the reason they stop taking external funds. They always make more money if they add external funds just like 20% of $101 is greater than 20% of $100.

They stop taking external money because managing clients can be a pain. At some point, depending on the fund (e.g. a niche fund that can never grow beyond a certain size), a shrewd money manager can grow to dominate the niche. In that space, they might as well just kick everyone else out and save the headache because the reward of the bigger pie just isn't worth it.

Frankly, even though I manage money for a living, and I really like my clients, it's still difficult. If it were my 1 beeellion dollars (touch pinky finger to the lips), then I wouldn't manage other people's money either - <USER2> marginal profit to me personally just wouldn't be worth it (for me, after the first billion, it's pretty darn trivial).

<comment><USER4> Most strategies can't take unlimited capital. I've got $100k in one strategy right now, but if I put $200k in it I wouldn't make any more money.

</comment></comment></comment></comment></comment><comment><USER10> I've worked in quant funds for over a decade. The article is right that there's a lack of rigour, and it's true the number of trials is an issue. However it doesn't go into why it happens:

\- People with phds often have an authority that is unwarranted. People with advanced degrees in similar sounding fields may have spent their time doing very different things. Phds are also coming from an environment where getting credit matters a lot, so you get political struggles that appear to be mathematical in nature to the uninformed manager.

\- Programming skills tended to be crap in the places where I worked. Most of the researchers think of coding as a necessary evil, and their code looks like the kind of code you write when you're trying to take shortcuts. What effect does this have on overfit? Well, it's simply impossible to know how many tests are actually being performed. There's a lot of informative errors, too: something gets coded up, you see a backtest, you realise there was an error after. Now you have information that you can use to get a better result, having not incremented your number of tests.

\- There's a lot of pressure to come up with something new. Pretty hard when there's loads of people attempting the same. The most natural way to try to make something "new" is to take something old, add a twist to it, and see how it goes. Of course when you add a twist, there's more parameters to fit. And because it's supposed to be complex, you can get away with an elaborate fitting mechanism. Often something that hides the fact you're doing more tests.

\- Backtest fetish: it's natural to think about how a system would have done in the past. But unfortunately we all know about the past. Anyone coming up with a strategy is going to know volatility spiked in 2008, so he'll avoid anything that would have lost money then, or worse, just restrict the parameters so they are in a safe zone. Basically, there's a bunch of tests that aren't done, but should have been counted anyway.

\- How to fix this: well, there's no magic bullet. You should start by being wary of adding parameters. If you add one, it should work with a number of reaction functions. If it works with a step func, does it work with an s-shape or a ramp? Does it work when the parameters are perturbed? Does it work when the input data itself is perturbed? If you've built a model, does it work on simulated data? Something I rarely see is when someone says "model is an ARMA(2,2)" that they've generated an ARMA22 with the same parameters.

</comment><comment><USER11> I develop a number of backtesting systems and algortihms and the article is spot on but lacks to address far more sophisticated backtesting systems that include running once on sample data. These are the best algos.

</comment><comment><USER12> TL;DR Over-fitting investment models is pseudo math.

<comment><USER13> the greatest overfitting of an investment scheme the world has ever known: markets must go up.

<comment><USER3> Er, no, that's basic economics. If you make an investment, you are going to expect some sort of profit, on average.

<comment><USER9> That's a different issue. I think what @lintiness is trying to say is that just because a market went up in the past does not mean it will in the future. Survivorship bias is absolutely huge here.

Most people forget this, but if you look at global markets since the early 1900's, there were several that went down and never came back up. Germany's markets failed on at least one occasion and never came back. A good paper that addresses part of this is here: [http://www.researchgate.net/publication/4913017_Global_Stock...](http://www.researchgate.net/publication/4913017_Global_Stock_Markets_in_the_Twentieth_Century)

Depression and war do many things that create discontinuities. Most people don't come close to thinking about those because they aren't knowledgeable enough to even understand how strong the survivorship bias in their current local market like the US.</comment></comment></comment></comment>


The AI-Box Experiment - <AUTHOR> http://yudkowsky.net/singularity/aibox/

<comment><USER2> pretty simple solution. I'm surprised no one has posted it.</comment>


FISA Renewal in Jeopardy - <AUTHOR> https://www.politico.com/news/2020/05/27/fisa-renewal-limbo-284025 <comment><AUTHOR> I'm pleasantly surprised by the resistance this renewal is getting. Senator Wyden is one of the few people in congress that seems to understand technology and privacy issues. Him coming out against this bill is nice to see.</comment>


Google launches "Shielded VMs" to protect cloud VMs from rootkits, data theft - <AUTHOR> https://arstechnica.com/information-technology/2018/07/google-launches-shielded-vms-to-protect-cloud-servers-from-rootkits-data-theft/ <comment><USER2> So now I can tell my boss "Oh, we're using Google's budget non-secure VMs - which are vulnerable to rootkits and data-theft."</comment>


Ask HN: Why should an ordinary person care about big company data breaches? - <AUTHOR> Most people really have no idea how these kinds of things could affect them. They may have had to have gotten a new credit card, changed a password or two, but that's about the extent of it for the vast majority of people.
What things should most people know about data breaches and privacy?
What are the most common consequences for most people who's information is included in a data breach?
What are the most dire consequences possible? <comment><USER2> It may have direct (monetary) impact on an ordinary person. One of the examples: FB may know their user's lifestyle - eating habits, drinking habits etc. (based on the content/media users upload) If this info is leaked to insurance companies, it'll have direct impact on the premium you pay.</comment>


Sprint fires employee who publicly exposed exaggerated Android EVO sales numbers - <AUTHOR> http://www.mobilecrunch.com/2010/06/14/sprint-cans-employee-for-leaking-evo-4g-sales-numbers/

<comment><USER2> This employee posted the sales numbers _BEFORE_ Sprint even released their exaggerated sales figures. Though this employee's 'leak' may have been what caused Sprint the recant their original information, you could hardly call the person a whistle-blower.

[ Also, "Sprint fires employee who publicly exposed exaggerated Android EVO sales numbers" is a highly 'exaggerated' version of "Sprint cans employee for leaking EVO 4G sales numbers." The MobileCrunch title doesn't infer that the employee had some intent to expose Sprint. ]

<comment><AUTHOR> You can argue intent all you want (and btw no one has described the employee as a whistle-blower)

However, as a matter of fact, Sprint's exaggeration (claiming that sales were around 3 times as much as they really were) was exposed by what that employee did.

<comment><USER3> >> btw no one has described the employee as a whistle-blower

"publicly exposed exaggerated Android EVO sales numbers" reads like he is a whistle blower. and it doesn't express what really happend.

I totally agree to your second point.</comment></comment></comment>


Why math is strangling videogame morality - <AUTHOR> http://www.pcgamer.com/why-math-is-strangling-video-game-morality/ <comment><USER2> So numeric modeling bad, finite state automata good? But I guess that's how it is, since people think black boxes are more "human."</comment>


Yannis's Law: Programmer Productivity Doubles Every 6 Years - <AUTHOR> https://yanniss.github.io/law.html <comment><USER2> Definitely an interesting take, though I'm not sure it'll catch on. The unit measurement for productivity is not as clear as, say, Swanson's or Moore's law.

Would be interesting to see you quantify this (in output maybe?)?</comment>


How to Introduce a Speaker: 16 Essential Tips for Success - <AUTHOR> http://sixminutes.dlugan.com/how-to-introduce-a-speaker/

<comment><USER2> I think I prefer Johnny Carson's introduction of Bill Clinton in 1988. :)

<http://www.npr.org/templates/story/story.php?storyId=4464083></comment>


Haskell and floppy disks in Norwegian government - <AUTHOR> https://gundersen.net/functional-floppy-disks-in-2015/ <comment><USER2> There is a whole host of old in work there, not just the floppies and the DOS software.

Notice that the company he works for gets the records that are to be distributed in EBCDIC format.

According to Wikipedia that can be traced back to IBM punchcards! [https://en.wikipedia.org/wiki/EBCDIC](https://en.wikipedia.org/wiki/EBCDIC)

And i'm not surprised, likely older, doctors cling to their DOS interfaces. I recall watching cashiers operating similar ones at various stores, and once you have the keys down navigating the interface can be quite fast.

Also, you never have to worry about some errant popup or other stealing focus...

<comment><USER3> The reason a lot of Norwegian doctors cling to their DOS interfaces is not because of age, or a resistance to upgrade.

I have discussed the topic of medical software with my father extensively, who is a M.D. in a rural town in Norway.

The reason is efficiency. As a doctor you are required to look up a lot of information on the patient, while maintaining a conversation with them. This is only really possible with a keyboard only interface. The older DOS systems does this, and the newer GUI based packages largely does not.

<comment><USER4> Cool, someone should write an Emacs mode for them! I am very sympathetic to the arguments for using a keyboard-only interface, i try to achieve that on my own computer as much as possible, too.

<comment><USER2> I dunno. Emacs seems to have the very X+Y+Z+butt+cat kind of key combo issues that was mentioned as a problem elsewhere.

The basic benefit of these interfaces seem to be about single keys (F keys mostly) for reaching major functions.

I am guessing that once the patients id number has been entered, a single key brings up the journal, and one can page through entries (and their content) using single presses (next/prev entry, page up/down style).

<comment><USER4> > _Emacs seems to have the very X+Y+Z+butt+cat kind of key combo issues that > was mentioned as a problem elsewhere._

You can rebind stuff. As an example, the magit mode for rebasing has a whole bunch of one-key functions, specifically optimised for the task at hand. A "doctor-mode" might have exactly those F-keys do what you describe. But anyway, this is a case of me wanting to do everything in Emacs :P. At least that would allow the rest of the system to be upgraded, instead of running DOS(box) or whatever they do now...

Anyway, way OT.

</comment></comment></comment></comment></comment><comment><USER5> I'm quite surprised by this. My experience with floppies (dos-formatted) was that in a bike ride of 1 hour 1 out of 10 floppies would have corruption. Or maybe the drives i used to copy on them just did not do write verification.

<comment><USER6> I think that's a function of the quality of the disk drives and the media; both of which went into the toilet when floppies stopped being generally useful. (was windows 98 available on floppies?)

<comment><USER7> Windows 98 was available on floppy. I know, because I painfully installed it that way.

For me, floppies started failing when I didn't need to use them as often. The drive would get dusty from lack of use, and I'd put a disk in and it would be destroyed. I ended up using one floppy as a "cleaning disk" for the rare occasion when I needed to use the floppy. I'd attempt to do something on the disk and the activity would make it safe for the next disk I put in (generally).

<comment><USER8> I recall doing an Oracle Forms based install back in 94 you had to feed 13 or 14 floppys in the right order then you could install our forms application (another 3 floppys).

It to a coworker and my self 2 days to install the pilot site for only 5 users.

I remember saying to my boss that about the www that when the it becomes more mature we could save so much time in product roll out.

<comment><USER2> In effect bringing back the X terminal era...

<comment><USER8> Only with much less suck :-) at one time our entire team at BT was slated to switch to native X development luckly the MCI fiasco happened and we dodged a bullet

<comment><USER2> From a user angle i find it to be a different kind of suck.

I have yet to find a web app that can make up its mind about being a app or a site.

Maybe the problem is more that they invariably existing inside a chrome-less browser window, but sooner or later some niggle shows up that you can't find on proper native UI.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> For doctors that really really don't want to switch:

[https://en.wikipedia.org/wiki/Floppy_disk_hardware_emulator](https://en.wikipedia.org/wiki/Floppy_disk_hardware_emulator)

<comment><USER10> That's quite cool, although it would be more practical to run the MS-DOS software in DOSBox or a virtual machine and configure a virtual floppy disk drive.

<comment><USER11> Can it emulate Amiga floppies?

<comment><USER12> Like gotek?

</comment></comment></comment></comment><comment><USER13> I'm surprised a plain floppy disk is considered secure because it is in an envelope. Even though that envelope requires an id to pick up, I see that similar as a message in plaintext that has a header: _private - please don 't read_.

<comment><USER14> From another perspective, a floppy is also secure because it is a _completely dumb_ storage device: it's just a piece of magnetic media in a plastic case. The drive is equally dumb, and the controller IC is usually a hard-wired logic array. The format has been around for a long time and publicly documented in standards. Contrast this with USB drives which have their own firmware and microcontrollers that can hide maliciousness, or even CD/DVD drives that also have modifiable firmware.

Someone could intercept a floppy and read/write its data, but putting malware on it and getting the receiver to execute it unnoticed is going to be much harder than with a USB drive. Putting a floppy into a drive literally does not cause any code to execute - it's only when commanded to, i.e. when the drive is accessed, that things start happening. There's no AutoPlay for floppies. Contrast this with the whole USB enumeration process.

<comment><USER15> Have you ever tried to intercept some one else's snail mail (or even your own wrongly delivered)? Its a lot of work if you don't have an insider at the post office. Requiring major time investments, to visit mail boxes or collect mail. E-mail even encrypted is much easier to permanently monitor than basic post, even for state level actors.

Opening an envelope is easy, doing so without being detected day in day out is hard.

<comment><USER16> The (East) Germans managed - the Stasi (East German secret police) did so for years on end with any number of suspected citizens.

Actually there was a joke going around here in Germany when the NSA scandal broke, talking about how jealous all the ex-Stasi guys must be that the NSA had beaten them at their own surveillance game...

<comment><USER2> I keep having the feeling that the west only stayed somewhat sane by having the eastern block as a comparison.

</comment></comment></comment></comment></comment><comment><USER17> > A floppy copy workstation in 2015. The retro handset is just there for > giggles.

As a norwegian, I have to say its good to see these guys have a sense of humour about their (honestly) pointless work :)

</comment><comment><USER18> > Norwegian doctors get one 3.5″ floppy in the mail from the government [..] > every month. For a long time this applied to all of them, but for about the > last decade a secure electronic option has been available. Problem is, a lot > of doctors love their MSDOS-based electronic journals and haven't switched > yet.

> The government seems to finally close down floppy distribution at the > beginning of 2016, forcing any remaining doctors over to newer electronic > patient journals. Sadly, the chosen strategy is just to offer paper > printouts instead, requiring error-prone rekeying at the doctor's office.

It seems like these guys have a potential business in selling a device/appliance to bridge the "secure electronic option" to floppy gap (without relying on paper): Basically make doctors do this work themselves. A laptop (running locked down Linux for security reasons) and a USB floppy drive. You can easily charge 10x hardware cost, so no need to skimp, and you can support by exchanging the entire setup via post.

<comment><USER19> The problem could be that the solution must be "open", so there is no potential for lock in, hence not much money to be made.

<comment><USER18> It's not a huge, long-term business, for sure. There are only _n_ doctors still running the DOS app in the entire market, and that number will only ever shrink.

The lock-in is provided by the extreme niche-ness of the market the conservatism of these doctors. These floppy-guys have a unique position in the market, they know exactly what to do -- they are basically the only ones who can credibly pitch these doctors at all. Once they've bought a solution that actually works, is stable and compliant etc., these doctors are not going to shop around to save maybe $1-2000/year (or whatever you can charge in maintenance), it's simply not worth their while and the risk. Remember, these are not scrappy little outfits, they have cash to spend, and they _will_ spend it if you can supply stability and continuity.

</comment></comment></comment><comment><USER20> The first thing I thought seeing the picture in that article:

"Classified info on a Lenovo Thinkpad?"

<comment> semi-extrinsic From looking at the webpage of TFA's author I'd say it's very probably airgapped and running some BSD flavor.

<comment><AUTHOR> Airgap is a requirement, I will update the article. Thanks for reminding me.

</comment></comment></comment><comment><USER21> > Fun fact: while floppies are indestructible

Haha, oh boy.</comment>


How We Monitor and Run Elasticsearch at Scale - <AUTHOR> https://signalfx.com/how-we-monitor-and-run-elasticsearch-at-scale/ <comment><USER2> Very light on details. One thing I've noted about a number of Elasticsearch- related blog posts - it's almost like companies are jealously guarding their cluster configurations. Sure, lots of the tunable parts are particular to each deployment. But it'd be nice to know details, sometimes.

<comment><USER3> Agreed, every other line was a pitch for how amazing SignalFX is.</comment></comment>


Google has indexed thousands of publicly accessible HP printers - <AUTHOR> http://port3000.co.uk/google-has-indexed-thousands-of-publicly-acce <comment><USER3> Idea for startup.

1\. write a script to scrap google links to HP admin panel

2\. filter out the IPs that are from US (given you want to work on US market)

3\. assemble the list of printer types and current toner levels.

4\. write a script that will print to each of those printers a one single page, stating your company "Cheapo Suppliers Inc" was notified that "your printer is low on toner. Call xxxxxx to re-fill. Lowest prices quaranteed within one day delivery!". You can add link to your shop page that already redirects user to specific type of printer they have, some type of one-click order (based on which toners are low).

5\. daily rinse repeat.

6\. sell your business to HP (at least try to).

<comment><USER4> Nostalgia Scam Time:

Back in the late 90s there was a common scam run against big-ish offices.

A caller would call asking to talk to the person in charge of printers, typically either IT or Facilities.

Once connected they would say that they are sending out the recipients free gift, which was some lame piece of electronics - often a small television. They would get the work address and confirmation to ship the free gift. They would claim that along with the free gift - they would send a sample toner cartridge that had "super fine toner in it, certified by HP to last 3 times as long as other toner cartridges"

Then, along with the free gift, a PALLET of toner cartridges would be sent - along with an invoice for some ridiculous amount.

When I got my first call about these "super fine toner cartridges" - I got suspicious and contacted HP. They told me about the scam - but that it was hard to find the people. They asked me to get as much info as I could from them if they called again. I got a call again, got as much info as I could without accepting the offer for the free gift - but they wound up sending it to me, along with the pallet of cartridges as well.

HP came to my office and picked it all up after contacting them again.

Over the years - I received more of these calls - and as soon as they brought up toner and free gifts, I tol them I knew the scam they were running - <USER2> they would promptly hang up on me...

<comment><USER5> I'm a little unclear as to how how exactly they planned to enforce payment for un-solicited toner. What am I missing?

<comment><USER6> [http://business.ftc.gov/documents/bus24-avoiding-office- supp...](http://business.ftc.gov/documents/bus24-avoiding-office-supply-scams)

They threaten, talk to A/P directly and demand payment (skipping over the original agent), all sorts of ways.

<comment><USER7> How long ago was this written? They make reference to ordering typewriter ribbons ...

<comment><USER6> The PDF says March of 2000, but it was probably around for decades beforehand :)

</comment></comment></comment></comment></comment></comment><comment><USER8> Worse than printing somewhere remote, many of those are probably also scanners. If the original is left on the glass (I forget it all the time), an attacker could scan it remotely.

<comment><USER9> That's a very bad idea, you should call your lawyer/a law firm to prepare for the impending deluge of threatening letters and lawsuits filed against you.

<comment><USER8> I only pointed out that there is more danger for people with publicly available printers than just getting random junk printed.

You are jumping to conclusions.

<comment><USER10> These sorts of interfaces are often connected to fileshares, so there's probably a route in there for a cracker. Also it may be possible to upload firmware - either corrupted firmware that bricks the printer or firmware that sends copies of all printed docs to a file store.

</comment></comment></comment></comment><comment><USER11> Some of the IPs are registered to large US universities, who list abuse/tech support email addresses in their records. I've already emailed several with a headsup and had a couple of "thank you!"s in reply.

<comment><USER12> You're lucky you haven't gotten accused of "hacking" yet.

<comment><USER13> Smart good Samaritans still use dead drop email addresses.

</comment></comment></comment><comment><USER14> So... Where's Ang Cui at?

In case you guys haven't seen it, Ang Cui is the guy who did the Cisco hack last month and he's also the guy with the coolest resume on the planet.

He actually found a way to compromise printers during the print process, so by printing his resume, he pwns your printer. This seems like a bull in the china shop situation for that code.

<comment><USER15> This is what you're talking about.

And for those that haven't seen it.. do yourself a favour and sit through the entire hour-long video; you won't regret it.

[http://arstechnica.com/security/2013/01/hack-turns-the- cisco...](http://arstechnica.com/security/2013/01/hack-turns-the-cisco-phone- on-your-desk-into-a-remote-bugging-device/)

</comment></comment><comment><USER16> That's really nothing compared to searching for Canon ImageRunner admin pages (google lets you search for a URL by content/markers/text in the page info/name) - over on those imagerunner tech forums, people were able to bring up previous scans going back however far, and in minutes be looking at passports, medical records, college information, etc...

Maybe more disturbing is that as these things are decommissioned they are just 'junked'. Meaning sent over seas as is to be 'disposed' - anything ever copied, scanned, or sent on that thing is in there somewhere and some foreign nation is in control of MFDs that were in hospitals, law firms, architect/contractor office, police stations, and on and on and on.

The holes have been largely fixed through encryption and other techniques but only very recently - which I've been able to work around myself with forensic tools. I won't provide the link here, but if you google around you can find discussion on this topic pretty easily.

<comment><USER17> _anything ever copied, scanned, or sent on that thing is in there somewhere_

I wouldn't be terribly surprised to find out my MFD has more persisted and recoverable in it than my first guess of how much it has (nothing), but it certainly doesn't have every page that's ever gone in or out of it.

</comment></comment><comment><USER18> This is actually one of the earliest searches that was used on the Shodan search engine! Shodan specializes in finding all devices connected to the Internet (including Telnet, SSH, FTP, SNMP etc.):

<http://www.shodanhq.com/search?q=hp+jetdirect> <http://www.shodanhq.com/search?q=laserjet> <http://www.shodanhq.com/search?q=HP-ChaiSOE>

</comment><comment><USER19> I wrote a scriptable "chooser" when I was at Apple -- it let you programmatically find and select a printer to print to.

I enumerated every printer on campus (about 900 of them at the time, I think), and came /this close/ to printing a snarky page -- a fake version of the "Five Star News" internal company news -- on each one of them. Decided not to; probably a good career move that I resisted that urge.

<comment><USER20> Someone did just this in my high school. They nearly got expelled.

</comment></comment><comment><USER21> So is the secret service going to knock on my door if I click a link? I can't tell anymore.

<comment><USER13> The secret service is going to knock for some reason or another anyway, so stop living in fear and live your life.

</comment></comment><comment><USER22> I've written about this before.[1] Many network-connected printers simply assume that the local network they connect to will be securely protected from external threats, so they're not configured to withstand even the simplest of attacks. This is exactly the opposite of what many security experts recommend: devices should be secure regardless of whether the network they're on is secure or not.

Bruce Schneier's personal WiFi network at home is fully open, because -- in his own words: "If I configure my computer to be secure regardless of the network it's on, then it simply doesn't matter. And if my computer isn't secure on a public network, securing my own network isn't going to reduce my risk very much."[2]

I'm waiting for the great network printer security apocalypse...

\--

I ran a quick nmap command (nmap -T4 -A -v -PE [IP address]) on a few of the many printers indexed by Google, and here's a typical result, showing tons of open ports and passwordless login options (I've deleted the hostname and IP address to protect the innocent):

      Starting Nmap 5.21 ( http://nmap.org ) at 2013-01-25 12:15 EST
      NSE: Loaded 36 scripts for scanning.
      Initiating Ping Scan at 12:15
      Scanning XXX.XXX.XXX.XXX [1 port]
      Completed Ping Scan at 12:15, 0.10s elapsed (1 total hosts)
      Initiating Parallel DNS resolution of 1 host. at 12:15
      Completed Parallel DNS resolution of 1 host. at 12:15, 0.14s elapsed
      Initiating Connect Scan at 12:15
      Scanning [HOSTNAME] (XXX.XXX.XXX.XXX) [1000 ports]
      Discovered open port 23/tcp on XXX.XXX.XXX.XXX
      Discovered open port 21/tcp on XXX.XXX.XXX.XXX
      Discovered open port 443/tcp on XXX.XXX.XXX.XXX
      Discovered open port 80/tcp on XXX.XXX.XXX.XXX
      Increasing send delay for XXX.XXX.XXX.XXX from 0 to 5 due to max_successful_tryno increase to 5
      Increasing send delay for XXX.XXX.XXX.XXX from 5 to 10 due to max_successful_tryno increase to 6
      Warning: XXX.XXX.XXX.XXX giving up on port because retransmission cap hit (6).
      Discovered open port 14000/tcp on XXX.XXX.XXX.XXX
      Discovered open port 631/tcp on XXX.XXX.XXX.XXX
      Discovered open port 280/tcp on XXX.XXX.XXX.XXX
      Completed Connect Scan at 12:15, 37.26s elapsed (1000 total ports)
      Initiating Service scan at 12:15
      Scanning 7 services on [HOSTNAME] (XXX.XXX.XXX.XXX)
      Completed Service scan at 12:16, 13.09s elapsed (7 services on 1 host)
      NSE: Script scanning XXX.XXX.XXX.XXX.
      NSE: Starting runlevel 1 (of 1) scan.
      Initiating NSE at 12:16
      Completed NSE at 12:16, 3.57s elapsed
      NSE: Script Scanning completed.
      Nmap scan report for [HOSTNAME] (XXX.XXX.XXX.XXX)
      Host is up (0.11s latency).
      Not shown: 978 closed ports
      PORT      STATE    SERVICE      VERSION
      21/tcp    open     ftp          HP LaserJet P4014 printer ftpd
      |_ftp-anon: Anonymous FTP login allowed
      23/tcp    open     telnet       HP JetDirect telnetd
      25/tcp    filtered smtp
      80/tcp    open     http         HP-ChaiSOE 1.0 (HP LaserJet http config)
      | html-title: hp LaserJet 9050
      |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher
      111/tcp   filtered rpcbind
      135/tcp   filtered msrpc
      139/tcp   filtered netbios-ssn
      280/tcp   open     http         HP-ChaiSOE 1.0 (HP LaserJet http config)
      | html-title: hp LaserJet 9050
      |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher
      443/tcp   open     ssl/http     HP-ChaiSOE 1.0 (HP LaserJet http config)
      | html-title: hp LaserJet 9050
      |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher
      445/tcp   filtered microsoft-ds
      515/tcp   filtered printer
      631/tcp   open     http         HP-ChaiSOE 1.0 (HP LaserJet http config)
      | html-title: hp LaserJet 9050
      |_Requested resource was http://XXX.XXX.XXX.XXX/hp/device/this.LCDispatcher
      1433/tcp  filtered ms-sql-s
      1720/tcp  filtered H.323/Q.931
      3168/tcp  filtered unknown
      4550/tcp  filtered unknown
      6000/tcp  filtered X11
      6112/tcp  filtered dtspc
      8654/tcp  filtered unknown
      9100/tcp  filtered jetdirect
      14000/tcp open     tcpwrapped
      19315/tcp filtered unknown
      Service Info: Device: printer

\--

[1] <http://news.ycombinator.com/item?id=4412714>

[2] [http://www.schneier.com/blog/archives/2008/01/my_open_wirele...](http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html)

<comment><USER23> A few months ago I erroneously port scanned our office HP networked printers (I meant to scan our internal servers but a typo meant I selected the wrong IP range). As soon as nmap encountered the JetDirect ports every single printer spewed out a dozen pages of total gibberish. Put it this way - I bet the owners of the printers you just scanned are slightly puzzled why their printer kicked into life.

More worryingly is that on many unpatched HP printers[1] it is entirely possible to push an unauthorised firmware update through port 9100.[2]

\--

[1] Enabling OS updates is one thing but I wonder how many businesses actively update their printers to the latest firmware versions?

[2] [http://h20000.www2.hp.com/bizsupport/TechSupport/Document.js...](http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03102449)

<comment><USER22> mattkirman: nothing happened to the owners of those printers, because I didn't run nmap with the "--allports" option. As the man page explains, by default nmap doesn't send anything to port 9100 precisely to avoid running into this issue:

      --allports (Don't exclude any ports from version detection).
          By default, Nmap version detection skips TCP port 9100 because some
          printers simply print anything sent to that port, leading to dozens
          of pages of HTTP GET requests, binary SSL session requests, etc.
          This behavior can be changed by modifying or removing the Exclude
          directive in nmap-service-probes, or you can specify --allports to
          scan all ports regardless of any Exclude directive.

</comment></comment></comment><comment><USER24> Interestingly, if you try to browse far into the results, Google decided it actually only has 73 to display (after telling it to include ommitted similar results).

<comment><USER25> Google makes only a rough estimate of the total number of results. Try it on any query that returns a relatively small number of results.

<comment><USER26> 86000 is certainly a _rough_ estimate of, um, 17.

</comment></comment></comment><comment><USER27> A friendly thing to do would be develop a script that took the google results, checked with whois for abuse address and sent emails. Of course that could also end up with one being sent to jail for a long time.

<comment><USER28> Why would anyone go to jail for this?

<comment><USER29> The nail that sticks up gets hammered.

If someone else later does something bad with the publicly accessible printer and there's a witch hunt for the responsible party, and the only lead they have is that you emailed them about the possibility in advance...then they'll go after you, even though you were just trying to do a good thing.

And if you're expecting the victim / police / legal system to understand that, technically speaking, it could have literally been _anyone with an Internet connection_...Or if you think that your good intentions and lack of criminal record mean that the most you'll get is a slap on the wrist even if they think your email "proves" that you did it...you're quite naive, especially given all the recent coverage of Aaron Swartz.

<comment><USER28> Also, if someone really wanted to do something bad at least they would do it from Tor or a shadowy proxy from eastern Europe...

<comment><USER29> Yes, but a Good Samaritan probably wouldn't go to such lengths to hide their identity.

</comment></comment></comment></comment></comment><comment><USER30> How can I tell if my home printer is securely protected? Is there a good web page or text book anyone can recommend that will teach me more details about this? Thanks.

<comment><USER31> In a home network you typically have a router that separates your LAN (local area network) from the internet and shares one public IP among the devices in your network; in that case you have little to worry about. You can tell by the kinds of IP addresses your devices have: if it starts with 192.168.x.y, 172.x.y.z, or 10.x.y.z, then it's not reachable from the internet. The problem with these printers is that on their network there's no such separation and they are listening on a publicly routed IP address, but they've been designed with the tacit assumption that they will be used on a secured network.

<comment> X-Istence Unless you have IPv6 turned on ... in which case many of these printers will automatically grab an IPv6 and be publicly accessible.

<comment><USER32> Depends. Some builds of Tomato (Toastman's for sure) put a firewall up on IPv6 by default. Asus's firmware does NOT firewall IPv6 at all. If you have shell access to your router, I suggest putting up a firewall on IPv6. The following should work (change br0 to the bridged LAN interface and eth0 to the WAN interface, sometimes it's a vlan):

      ip6tables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
      ip6tables -A FORWARD -i eth0 -o br0 -p all -j DROP
      ip6tables -A FORWARD -i br0 -j ACCEPT
      ip6tables -A FORWARD -o br0 -j ACCEPT
      ip6tables -A FORWARD -j DROP

Of course insert whatever open ports you want after the first line.

</comment></comment></comment></comment><comment><USER33> Should we now all print documents to those printers with warnings saying that they are publicly accessible?

<comment><USER34> I'm assuming that it is just the setup/status/diagnostics control panel so you'll not be able to print anything arbitrary (shame, it could be a fun game!). If you are of a mind to wind someone up you might be able to kick out a pile of test pages and reconfigure the thing so it is no use until someone does a factory reset.

A similar but worse case was some years ago when a range of consumer router+firewall boxes had a fault which made them present their control interface on the WAN interface and had no password set by default. A large number of those somehow got into a search index (it may have also been Google, I can't rightly remember), and from there you can probably do more harm than you can from a printer.

<comment><USER35> I've looked at two and both had the option to print a file that you uploaded. Of course I didn't actually try to print anything, but it looks like you probably could.

<comment><USER36> I may or may not have just printed out some random messages for people to find.

There is something strangely compelling about sending thoughts out into the ether with no chance of feedback. Fax pranks are before my time, but I totally get it. I hope I made somebody smile today.

</comment></comment></comment></comment><comment><USER37> So within 24 hours, lots of people are going to find out what a goatse is I reckon.

Even better, a lot of people in the UK have Thomson routers which have an easily calculable WPA default password. Most of these also have smart tvs these days too which will allow anything to be pushed to them.

<comment><USER10> > _Even better, a lot of people in the UK have Thomson routers which have an > easily calculable WPA default password._ //

That rather looks to oversteps the legal line.

<comment><USER37> Probably yes, but there is no excuse for incompetence on the part of the ISPs when they ship routers to the customers.

</comment></comment></comment><comment><USER38> So, next question is how much malware is hanging around for those printers? Are all / mostly / some / none compromised?

</comment><comment><USER39> Those poor IT Support guys that get a call because their small business clients network is going down due to everyone hitting their printer(s) at once because they show up on the first page :-\

</comment><comment><USER40> You did this from your _house_?

What are you, stoned or stupid?

</comment><comment><USER41> You can find a lot of open machines and sensitive information using Google, this one for the HP printers was submitted to the Google Hacking Database[1] in 2004.

[1] <http://www.exploit-db.com/google-dorks/>

</comment><comment><USER42> I did the Google search, and while the first page does indeed show 86K results, as soon as I navigate to the second, the number drops to 13...

Am I the only one with this problem, or did Google really not index "thousands of publicly accessible HP printers"?

</comment><comment><USER43> If you recall from the early days of google, there are plenty of indexed dark data that Google actively scrubs out of the public results. For example it was trivial at one point to find credit card numbers and social security numbers.

</comment><comment> hn-miw-i One million trees just died. The problem with some of the earlier HP printers was that they would accept unsigned firmware updates, you could literally reflash the thing with an update instruction in postscript.

Some work was done at Columbia University with developing trojanised firmware, i recall a firmware that could transmit CC# over tcp when it saw then in the print stream.

Extreme care must be taken if connecting printers to the Internet. It's at best a horrible idea and I'd say that most of these are unknown to their owners. Hopefully this gets some MSM coverage and people address the connected printer problem forever. (not likely)

</comment><comment><USER44> As far as I know this problem has been around for years. If you want to dive deeper into this, i recommend you visit Shodan (<http://www.shodanhq.com/>)

</comment><comment><USER45> Direct link on Google.com: [https://www.google.com/search?q=inurl%3Ahp%2Fdevice%2Fthis.L...](https://www.google.com/search?q=inurl%3Ahp%2Fdevice%2Fthis.LCDispatcher)

</comment><comment><USER46> Make sure to watch Ang Cui's demonstration on printer malware at 28c3. <http://www.youtube.com/watch?v=njVv7J2azY8>

</comment><comment><USER47> Use this only to test your own printers. <http://cdn.memegenerator.net/instances/400x/33855503.jpg>

</comment><comment><USER48> I'd hate to be at the top of that google search result!!

<comment><USER10> I've a vague recollection that Google stepped in to prevent such searches working in the past?

</comment></comment><comment><USER49> Webcams too: <https://news.ycombinator.com/item?id=5116676>

</comment><comment><USER50> The first thing I thought of was a course that I took decades ago that discussed using printers for covert channels to get data out of secure networks.

I wonder if any of those are honeypots. It may be interesting to see if any visitors do something clever or unexpected.

</comment><comment><USER51> I'm surprised nobody mentioned PrintFS in this thread: <http://www.remote- exploit.org/articles/printfs/index.html>

</comment><comment><USER52> Time for fun. Insert Coin, PC Load Letter, etc. Good times. <http://miscellany.kovaya.com/2007/10/insert-coin.html>

</comment><comment><USER53> Wow. There is at least one printer on there in a US governmental department, and on one of the settings pages is a huge list of emails of employees. And now I'm probably on some kind of list.

</comment><comment><USER54> >What happened to you today?

My printer got slashdotted :(

> Eh?

</comment><comment><USER55> And again - so many wasted IPv4s...

<comment><USER56> yes why would a printer need to be externally addressable - the problem will only get worse if ipv6 (aka ipv4 with rivets as the sainted verity stobb calls it) takes off.

<comment><USER57> I used to do it so I could print stuff for consumption or filling out when I got home from the field... also, because I could (a good reason for anything). Now I use IPP for the same purpose, less security risk.

</comment></comment></comment><comment><USER58> And bam, junk fax companies are back in business.

<comment><USER59> They never were out of business.

</comment></comment><comment><USER60> This is truly an old hack, from the days of Altavista, you can find all sorts of open devices and even file folders(I think they've censored those results now) on the internet.</comment>


Remember Ghost? It's almost here. - <AUTHOR> http://mike.onolan.org/index.html

<comment><USER2> You probably should try and fix the link to the kickstarter page on the "try it now" popup.</comment>


Why writing user stories the right way is not childish - <AUTHOR> http://garmlucassen.nl/post/123545121591/why-writing-user-stories-the-right-way-is-not

<comment><AUTHOR> Hi everyone, if you enjoyed this post please take a moment to complete this 5 min survey. Your contribution is of incredible value to my research!

[http://garmlucassen.nl/survey](http://garmlucassen.nl/survey)</comment>


Anesthesia Miracle: No Power, No Oxygen Tanks, No Problem - <AUTHOR> http://www.npr.org/blogs/goatsandsoda/2014/11/23/363113747/anesthesia-miracle-no-power-no-oxygen-tanks-no-problem

<comment><USER2> The device looks interesting, and it's probably a good solution for place where the electricity grid is unreliable. But I don't like this sentence:

> _The device sucks regular air from a room using a compressor and turns it > into purified oxygen for a patient 's lungs._

It's difficult to separate the oxygen from the nitrogen without a complex device. Do anyone have a link with more information? Is this a mistake in the press article?

<comment><USER3> It's note pure oxygen. It's 95%. They are using a fairly normal oxygen concentrator that uses zeolite to remove nitrogen.

Details on the machine are at the company's site, including a nice animation showing how the whole thing works: [http://www.gradianhealth.org/universal- anaesthesia-machine/](http://www.gradianhealth.org/universal-anaesthesia- machine/)

<comment><USER4> [http://en.wikipedia.org/wiki/Atmosphere_of_Earth](http://en.wikipedia.org/wiki/Atmosphere_of_Earth)

That makes it 95.6% oxygen. Probably good enough for most purposes. And the bulk (96%) of the non-oxygen is argon, which is inert.

</comment></comment></comment><comment><USER5> This sounds like a great example of well meaning donors not really understanding the people they are trying to help.

It would also be exciting to see some of these re-configurations reducing costs in developed countries.</comment>


Matrix is hacked, hacker leaves friendly post-mortem on GitHub - <AUTHOR> https://twitter.com/SteveD3/status/1116615320448356353 <comment><USER2> Previous discussion on this [https://news.ycombinator.com/item?id=19642554](https://news.ycombinator.com/item?id=19642554)

</comment><comment><USER3> Guess that is what happens when the lead developer makes comments like this:

[https://news.ycombinator.com/item?id=19425361](https://news.ycombinator.com/item?id=19425361)

<comment><USER4> Is "Arathorn" the dev? I don't see anything malicious in that comment. Why do you feel this way?

<comment><USER3> Yes. I didn't say that I felt it was necessarily malicious, but that I guess that is what happens. If you look at the parent comments there is a lot more context and he accuses the other dev of maliciously exploiting security issues after discovering them. Would seem likely that he is the one responsible then.

<comment><USER5> I don't follow the logic here at all, fwiw. If someone discovers a vuln and then exploits it rather than disclosing it... why does that make me responsible?

<comment><USER3> I'm saying the dev you were referring to that you personally have issues with is likely the individual that hacked Matrix.</comment></comment></comment></comment></comment>


Unicode Consortium requests addition of new block "Symbols for Legacy Computing" [pdf] - <AUTHOR> http://www.unicode.org/L2/L2019/19059-future-adds.pdf <comment><USER2> Here is a link to the PDF with the characters:

[https://www.unicode.org/L2/L2019/19025-terminals- prop.pdf](https://www.unicode.org/L2/L2019/19025-terminals-prop.pdf)

This is great! Lots of nostalgia.</comment>


Atom 1.26 - <AUTHOR> https://blog.atom.io/2018/04/18/atom-1-26.html <comment><USER2>
      - Atom is good but...
      - Electron is heavy
      - It uses X GB of RAM on my machine
      - It's cross platform though
      - Beautiful website too!
      - Why is Visual Studio Code so much better?
      - It doesn't compare with [vim/emacs/nano/ed/Sublime Text]

This is a summary of 90% of the content of Atom release threads on HN.

<comment><USER3> > Why is Visual Studio Code so much better?

To be fair Microsoft has been building IDE tooling for a lot longer than GitHub has been around so if VS Code was somehow worse than Atom I'd be worried. I don't wanna get into Atom vs other editors but Atom does get some things right that I wish VS Code would adopt, like changing settings has an actual view vs just a JSON file.

<comment><USER4> Yeah, VSCode's solution is slightly better than hand editing JSON but Atom's handling of config is the best.</comment></comment></comment>


Return to the Source - <AUTHOR> http://www.cipht.net/2017/10/05/why-read-code.html <comment><USER2> One of the greatest strengths of the Web platform is "view source," the ability to start diving into the code any time you find yourself wondering "how did they achieve that?" So a major criticism of WASM is the erosion of that tradition.

However, I suspect that, by volume, most of the WASM code out there is going to be built from open source components, with a little customization sprinkled on top. It takes a little more detective work to find these sources and read them, but I think it's just as worthwhile as in the plain HTML days. Perhaps we could converge on tools and practices that would make it easier to discover the sources from which WASM artifacts were built.

</comment><comment><USER3> After actually reading the article, my first thought was how awesome of the open source movement to actively promote enabling opportunities to learn by reading code, and how sad that various licenses (and unfortunately even incompatibilities between various open source licenses) and fear of patents restrict those same opportunities.

</comment><comment><USER4> SRE consultant here.

I was dissatisfied with Linux and FreeBSD, seL4 seems much more robust, in terms of system reliability and security. (seL4 is not an OS, but a framework to build an OS on top.)

Then I was dissatisfied with all the crap in the x86 ISA (bucket of modes, 4 rings, many deprecated features, insecure SMM and zillions of feature flags), the mostly failures of RISC and the over complexity of many versions and variants of ARM (but it's nice that it's available as IP).

It seems there ought to be an architecture that can make writing OSes easier and more secure:

\- handle task/context switching much faster than x86

\- IPC (zero-copy both register and page borrowing, maybe copy if source page is locked or if async.) This enables L4-fast CSP in the ISA.

\- resource limits / counters

\- memory page allocation

\- capabilities management

\- transparent page compression and encryption

\- OS bookkeeping (kernel-specified privileged data: per task/core/etc.)

in addition to the usual suspects (MMU, FPU, SIMD, etc.):

\- virtual memory

\- paging (including possible unprivileged page-fault handler)

\- hypervisor (VM lifecycle)

\- interrupts / faults / exceptions

\- TLB

\- tiers of caches / cache coherency protocol

\- memory controller

\- standard I/O controllers

\- clock throttling w/ spread-spectrum and thermal management

\- micropower standby

\- JTAG

\- at least one system-wide atomic operation (compare&swap or ainc/adec)

much more rigidly, faster and less clunkily that most OS gunk tends to be. Not CISC overload, but healthy facilitation of fast AND secure OS and user-mode program constructs that are batteries-included.

Also, SystemVerilog looks doable (I'm reading the whole IEEE spec for SV2012) and there's always MOSIS should a Kickstarter be in order to make actual ASIC dev kits. EDA looks manageable but there's a definite learning curve to testing, verification, behavioral design, RTL and DRC.

Plus, opaque firmware blobs and chips aren't conducive to trusting the end-to- end security of the supply chain of a finished product. End customers are almost praying that some fab hasn't slipped in malicious microcode or RTL changes or the parts stuffers didn't insert a backdoor into unsecured firmware.

<comment><USER3> You must be astroturfing (or whatever it's called - submarining, secretly shilling, etc.) for the Mill project[0]! ;)

Every once in a blue moon someone from that group returns from "investing sweat equity into patents" (or however they're [not] getting paid for whatever they're doing) to HN's reality distortion field (welcome!) and blesses us with wisdom[1] from their awe-inspiring project currently classified as vaporware by many such as myself with no public evidence of even a single physical hardware prototype.

I would be interested to hear your thoughts about that project, and also hope my playful jab (not too harsh?) can provoke any of them to respond to your comments (maybe they should hire you!). There are other projects mentioned in those comments that you may find interesting as well (CheriBSD, L4 Linux, etc.)

Also, any thoughts you have time to share on the adaptability of the various open hardware RISCV projects, which seem to be at the beginning stages of delivering just beyond basic functionality without much priority allocated for your secure performance concerns. I was surprised to see no specific mention of it in your initial comment.

To the best of my very limited knowledge, a genuinely secure processor, even versus nation-state level actors, is unfortunately still non-existent or near uselessly underperformant (is that a word?) at this point. Not to mention all of the various other, often easily side-channel attacked, bits and pieces are required to have a working computer!

Perhaps an introduction is already behind you but this is a helpful recent discussion for anyone developing an interest in this aspect of information security: Ask HN: Where do I get started on ASICs, FPGA, RTL, Verilog et. al? | [https://news.ycombinator.com/item?id=15379418](https://news.ycombinator.com/item?id=15379418)

PS. Paging HN user nickpsecurity[2] once they wake up since this topic is pretty much their personal hobby horse here. Your comment seems like it was posted by this user a few years ago in an alternate universe, which I mention as a nice way of documenting the very unique similarities of your level of concern.

[0] [https://millcomputing.com/](https://millcomputing.com/)

[1] [https://hn.algolia.com/?query=%22mill%20project%22&sort=byDa...](https://hn.algolia.com/?query=%22mill%20project%22&sort=byDate&type=comment)

[2] [https://hn.algolia.com/?query=user:nickpsecurity%20hardware&...](https://hn.algolia.com/?query=user:nickpsecurity%20hardware&sort=byPopularity&prefix&page=0&dateRange=all&type=comment)

\- specifically, on real-world implementations of secure systems [https://news.ycombinator.com/item?id=9628845](https://news.ycombinator.com/item?id=9628845) | [https://news.ycombinator.com/item?id=14692557](https://news.ycombinator.com/item?id=14692557) | etc.

\- bonus: on web browsing [https://news.ycombinator.com/item?id=9962444](https://news.ycombinator.com/item?id=9962444)</comment></comment>


World first for strange molecule - <AUTHOR> http://news.bbc.co.uk/1/hi/sci/tech/8013343.stm <comment><USER2> I can't decide what is more amazing: that we can create molecules, that we can _see_ them in their 18 micro-second life, or that some guy predicted this particular one in 1934. Maybe it's just me, but I'm still impressed by the crazy crap we as human beings are capable of.</comment>


Google Team Refines GPU Powered Neural Machine Translation - <AUTHOR> https://www.nextplatform.com/2017/03/20/google-team-refines-gpu-powered-neural-machine-translation/ <comment><USER2> TL;DR - It's the code from "Massive Exploration of Neural Machine Translation Architectures", where they run extensive hyperparameter search using 250K hours of GPU time.

Direct GitHub link: [https://github.com/google/seq2seq](https://github.com/google/seq2seq)

Arxiv: [https://arxiv.org/abs/1703.03906](https://arxiv.org/abs/1703.03906)

</comment><comment><USER3> I'm surprised they used k80 and not something like 1080*. Surely they don't need the double precision-performance ? Am I missing something?

<comment><USER4> Using a Geforce card in a datacenter or "GPU cluster" setup voids the warranty, which might be a factor for them at scale.

<comment><USER5> That's invalid in the EU — maybe Google should move their GPU clusters to the EU instead.

</comment></comment></comment><comment><USER6> Seems it mishandles the difference between Premiers and Prime Ministers.

<comment><USER7> In what language pair going which way

<comment><USER6> In English, Justin Trudeau is not the premier of Canada, he is the Prime Minister. The problem with the translation is that the machine translator would need to know specifically about Prime Ministers as a linguistic category, and know that Justin Trudeau is in that category. The Chinese side of the translation does not encode the difference.

<comment><USER8> With enough data the Chinese side can encode <head of state> [Justin Trudeau] -> <head of state/premier> [Justin Trudeau]

<comment><USER9> In fact, the Chinese text says 加拿大+總理+杜鲁多 which is Canada+<head of state>+Trudeau. That's apparently enough context for the machine translation to pick up on, producing the correct "Prime Minister" title.

The only flaw in the GNMT version I can find is that 此行, "this visit" is left untranslated. (But I'm not a native Chinese speaker, so there might be more.)

</comment></comment></comment></comment></comment><comment><USER10> Why not use DGX-1? Surely Google can afford a bunch of these.

<comment><USER11> Because the DGX-1 is insanely overpriced. Just because you can afford something doesn't make it a reasonable purchase.

<comment><USER12> Last I checked (around the time Nvidia launched it), the DGX-1 seemed "perfectly priced" against Intel's systems. As in they seemed to have priced it in terms of how many Xeon chips you'd have to get to have equivalent performance.

I guess that's one way to go if you value profits above anything else, but I think Nvidia is making a strategic mistake. If it doesn't _have to_ price them that high, then it shouldn't. Because otherwise it's just leaving a bigger opening for Intel to enter the market in a big way.

I think a better long-term strategy would be to make it as hard as possible for Intel to enter the market, and one way to do that is to have _reasonable_ but yet quite aggressive pricing for its GPUs.

Unlike Nvidia, Intel is going to be pressured to recoup the $31 billion it put into Altera and Mobileye, so even if Intel will match Nvidia's new prices, Intel will struggle to recoup that money, while Nvidia can do just fine continuing to sell its GPUs.

<comment><USER13> And yet, (from what I've read) DGX-1's are getting snapped up faster than Nvidia can make them. If you have a >6 month wait list, and people still want them at that price, then supply & demand suggests you may even be _under_ -priced (of course Nvidia wants that market saturation).

<comment><USER10> 1\. Clone DGX-1

2\. Rent it out.

3\. Profit!!!

I would pay for cloud DGX-1 servers.</comment></comment></comment></comment></comment>


Google Search broken query - <AUTHOR> http://www.google.com/search?q=123456..654321

<comment><USER2> > Sometimes you may see this page if you are using advanced terms that robots > are known to use

Interesting. I'd guess there's some malware out there making these requests.</comment>


25 Years of Linux – so far - <AUTHOR> https://lwn.net/SubscriberLink/698042/76a0ec8ba4b729bd/ <comment><AUTHOR> If you enjoy this article, please consider subscribing to LWN so they can continue covering the world of Linux.</comment>


Introducing Avocado: A new toolbox for interaction designers - <AUTHOR> http://labs.ideo.com/2014/05/27/avocado/

<comment><USER2> It's nice to have a set of abstracted patches instead of having to build every goddamn thing from scratch.

</comment><comment><USER3> Why does everyone build these on top of Quartz Composer? It seems like there's a huge demand for a prototyping tool that supports animations.

<comment><USER4> Axure is able to illustrate quite a few animations, although it could certainly stand to include more. I'm hoping they'll make this a priority in future releases.

<comment><USER5> I'm just hoping Apple offers up a new release of Quartz Composer which incorporates the Origami patches and fixes a few more bugs. Speeding up live renders would be a bonus, and I'd cry tears of joy if they figured out a way to openly release their internal Core Animation prototyping tools.

</comment></comment></comment><comment><USER6> Oh no! Not another VPL :-) I am looking forward to seeing interesting applications.

</comment><comment><USER7> See also: [http://facebook.github.io/origami/](http://facebook.github.io/origami/) \- Another QC-based UI/UX toolchain

<comment><USER8> Does Avocado play nicely with Origami? Am I correct in saying both act as QC plugins, adding patches and new default behaviors?

<comment><USER9> According to the readme, Avocado is built on top of Origami: [https://github.com/ideo/avocado](https://github.com/ideo/avocado)

</comment></comment></comment><comment><USER10> please do not auto play the videos.

</comment><comment><USER11> Another design tool that ignores Windows users :(

<comment><USER5> Don't worry. Apple ignores Quartz users too. :D

</comment></comment><comment><USER12> Probably not the best interaction I could have experienced: [http://imgur.com/IlZD2sB](http://imgur.com/IlZD2sB) (using iCabMobile on iOS7/iPad 2).

<comment><USER13> The server was temporarily having issues, it should all be fixed now!

</comment></comment><comment><USER14> Avocado ... Also called alligator pear. a large, usually pear-shaped fruit having green to blackish skin, a single large seed, and soft, light-green pulp, borne by the tropical American tree Persea americana and its variety P. adrymifolia, often eaten raw, especially in salads.

What does this product have to do with Avocados? I know you had to call it something ... but why Avocado? Enough with the trendy product names!

<comment><USER15> Avocado the tool is like a real avocado because there's a rich buttery filling over a nut in the center. The nut in the center is Quartz. Quartz is tough nut to crack and so are avocado nuts. But what Avocado the tool does is add a nice buttery layer of patches (like the avocado soft filling) over the tough nut to bring out the goodness. Hence the name Avocado. It's really that simple</comment></comment>


Developers Call BS On $2.4B iPhone App Store Number | Cult of Mac - <AUTHOR> http://www.wired.com/epicenter/2009/08/developers-call-bs-on-24b-iphone-app-store-number-cult-of-mac/

<comment><USER2> the actual article:

[http://gigaom.com/2009/08/28/the-iphone-app-market-size- deba...](http://gigaom.com/2009/08/28/the-iphone-app-market-size-debate-is- it-2-4b-a-year-or-250m-admob-responds/)</comment>


Imposter Syndrome (in Data Science) - <AUTHOR> https://brohrer.github.io/imposter_syndrome.html <comment><USER2> Data science is one of the most imposter-filled "professions". It's a recently-established category of worker that falls across multiple disciplines and is very effected by technological progress. I have met "data scientists" who aren't really good at any aspect of it, but they still get by because of the supply/demand and lack of any existing expertise to say "hey, you know, this person we hired is barely competent and just googles everything we ask of them"

<comment><USER3> All this means is that we will inevitably reach a point where separate titles are used, and 'data scientist' will means about as much as 'engineer'.

We will distinguish 'machine learning specialist data scientist' from 'database specialist data scientist' just like we distinguish 'electrical engineer' from 'lab systems engineer', for example.

Then, we might have a term for generalists like 'data science technician'. And by then, the people who 'aren't really good at any aspect of it' and can't really function as generalists will be naturally sorted out because they can't really fit into any of those titles

<comment><USER4> The thing is that we already have/had that. Data science is really just a blend of statistics, machine learning, data engineering, and software development. I think the data science explosion is the result of more people/companies wanting to hire a single person to do all of these jobs rather than individuals for each.

If we ever go back to a world where we distinguish people by these specialties we would basically just be going back a decade to where we had statisticians focusing on statistics, data engineers maintaining databases, software developers creating the prodect, etc. (which isn't necessarily a bad thing).

</comment></comment></comment><comment><USER5> This describes my situation to the point. I have worked in big unicorns and have deployed many ml based models in production which had moved the numbers significantly while many a data scientists in our team just kept cribbing about errors in data or scarcity of it.

I have no DS background, am a humble engineer but believe it's 10x better to just work with whatever you have available and get sit done.

<comment><USER4> Entirely depends. "Moving the numbers significantly" doesn't mean much if the numbers aren't moving in the correct direction. Errors and scarcity in data are real, significant problems. I'm a statistician working in data science, and I can't count the number of times people complain about "why can't you just work with what is available" while failing to understand that what is available is total garbage.

You can dress up bad data in any number of ways to get results that sound and look pretty. I see this all the time. Sometimes you get lucky and the model is ok regardless. Lots of times the model performance isn't great, and it is later assumed there are other outside issues to blame, or the project is redone for the umpteenth time. Ocassionally you will have colossal failures that do real damage.

Keep in mind that when a poorly designed machine fails and kills dozens, or the financial system of the world crumbles under the weight of terrible loans and convoluted financial instruments, or millions of people's personal info gets hacked due to terrible, antiquated security systems, and everyone starts asking "How could people be so stupid to let something like this happen?", the answer is almost always executives, management, or "humble engineers" sweeping the problems they don't like under the rug because they believe "it's 10x better to just work with whatever you have available and get shit done".

</comment></comment><comment><USER6> As a data scientist I have wondered if this field is particularly suited to imposter syndrome. My formal background is economics, and every once in a while I become terrified at how little formal statistics I've studied, or large gaps in data structures etc. although I'm similarly surprised at how far I've gone by just going home and studying the basics when I run into something I don't know, and the gaps in knowledge some coworkers have in areas where I know more.

...although I have met a few genius data scientists who seemingly really can do everything. Although I'm pretty sure they are paid upwards of 300k.

<comment><USER7> I tend to agree. I think it's because the field uses statistics, which most people have decided are incomprehensible and don't even try to understand. Combined with how bad our brains are at thinking statistically, and you have a powerful desire-for-avoidance by non statisticians.

Combine with the value that good ones can provide, and you have a perfect situation where a boss or peer just thinks thar be dragons in the work sphere of the statistician.

<comment><USER4> I think the issue lies in the fact that data science is a massive umbrella term which really covers multiple large fields, namely statistics and computer science, both of which by themselves are massive. Its very difficult if not impossible for people to feel like they have enough expertise in all of the subjects that fall under the umbrella of "data science". Which typically leads to lots of self-teaching, learning on the fly, and hacking solutions together, which is often the source of all impostor syndrome feelings.

</comment></comment></comment><comment><USER8> I enjoyed this Partially Derivative podcast where two of the podcasters discuss their experience with imposter syndrome

[http://partiallyderivative.com/podcast/2017/03/06/badasses-f...](http://partiallyderivative.com/podcast/2017/03/06/badasses- feel-like-imposters)</comment>


Some Web sites are designed for older browsers - <AUTHOR> http://support.microsoft.com/kb/956197 <comment><USER2> Joel Spolsky has an excellent write-up called "Martian Headsets" that explains why MS is damned either way on standards issues.

<http://www.joelonsoftware.com/items/2008/03/17.html>

It should be mandatory reading for everyone who supports web standards.

<comment><USER3> MS is in a lot of situations where they're screwed either way, but people tend not to feel sorry for companies with market caps over the quarter trillion mark.

</comment></comment><comment><USER4> "Internet Explorer 8 includes a Compatibility View feature that displays Web sites that were created for older browsers as they were designed to appear. You can enable Compatibility View in Internet Explorer or on the Web server."

Thank goodness for that!

</comment><comment><USER5> How about rather than asking web designers, server owners and IT staff everywhere to add some hack tag to their code, you force IE8 into compatibility mode _unless_ a designer specifically enables IE8 rendering on their page by adding said tag? That mediates the issue pretty easily.

<comment><USER6> IIRC, they were originally planning to do exactly what you said, requiring a special tag to enable standards compliance in IE8, but there was a gigantic backlash from the web development and standards community.

Why? Because then we get nowhere; all the clueless web designers never find out about the special tag to make IE8 comply with internet standards, and continue making webpages for the broken IE rendering model for the next 10 years.

We _need_ to make all those old websites break, because otherwise they'll never comply with modern standards. We _need_ to have standardsbased rendering be the default because then the designers that test against IE8 will be making sites that work better with other browsers.

By forcing developers to realize that their websites are non-compliant (either from angry users or specifically forcing quirks mode) and by defaulting to standards-based rendering, we make the web design future a much nicer place to be.

<comment><USER7> Well... I see there is still a "method to enable Compatibility View for specific Web pages".

 _< meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />_</comment></comment></comment>


Ask HN: Frontend, Front-end, or Front end? - <AUTHOR>

<comment><USER2> [http://gcc.gnu.org/codingconventions.html#Spelling](http://gcc.gnu.org/codingconventions.html#Spelling)

"Front end" when used as a noun, "Front-end" when used as an adjective.</comment>


Twitter founders address all-staff meeting on eve of IPO filing (photos) - <AUTHOR> http://qz.com/131651/photos-twitter-founders-address-all-staff-meeting-on-eve-of-ipo-filing/ <comment><AUTHOR> Notable absence is Noah Glass (imho) - the 4th cofounder pushed out in 2006</comment>


Ask HN: Why aren't there 3rd party laptop power adapters? - <AUTHOR> Aside from mag-safe adapters for the likes of Apple laptops, I'm just wondering why there aren't 3rd party power adapters available. Clearly, Apple put some time into designing the form factor of theirs but other companies don't seem to invest nearly the same effort. Since it's just a power supply, this seems like an area where a 3rd party could provide "one power supply to rule them all" with form factor, built in surge protection and adapters to fit various laptops.<p>Just wondering how, in 2016, power supplies are so bad? <comment><USER2> Actually there are plenty! Search for 'multi laptop charger' or 'universal' or keywords that imply interchangeability. Like this randomly picked unit [1], they typically come with a voltage selector and a variety of plugs that can be switched out to fit a particular socket.

Potential problems with these devices are manyfold. They won't be specialized to deliver a particular amperage [2]; the voltage selector means additional moving parts that can fail, and mainstream brands usually don't play in this space, so the quality can run the gamut from decent to sketchy to hazardous.

[1] [http://www.newegg.com/Product/Product.aspx?Item=9SIA6RP37N67...](http://www.newegg.com/Product/Product.aspx?Item=9SIA6RP37N6759) [2] [http://lifehacker.com/pay-attention-to-charger-amperage- to-j...](http://lifehacker.com/pay-attention-to-charger-amperage-to-juice-up- your-gadg-1492446246)

<comment><AUTHOR> This one looks along the lines of what I was thinking. Thanks!

[http://www.newegg.com/Product/Product.aspx?Item=9SIA8UY3HB59...](http://www.newegg.com/Product/Product.aspx?Item=9SIA8UY3HB5966&cm_re=multi_laptop_charger-_-9SIA8UY3HB5966-_-Product)

</comment></comment><comment><USER3> There's no demand really. Would you pay premium for an extra power supply? I wouldn't.

<comment><AUTHOR> I'd pay a premium for a quality power supply that was lighter, smaller & cleaner. Bonus for a retractable cord.

<comment><USER3> Sounds like you guys have a good business idea</comment></comment></comment>