Division by zero in type theory: a FAQ - <AUTHOR> https://xenaproject.wordpress.com/2020/07/05/division-by-zero-in-type-theory-a-faq/ <comment><USER3> This strikes me as having some interesting similarity to the practice in Haskell of placing type class constraints on functions, not data types. A deprecated feature of Haskell used to allow you to write data types like:

        data Ord k => Map k v = ...

This defined a data type representing an ordered map from k to v, with the additional restriction that before you can talk about such a map you had to know that the type k is orderable (has an instance of the Ord type class which defines comparison operators).

This may be considered to be similar to the definition of (/) requiring that its second argument is nonzero.

This style was supplanted by leaving the data type definition 'bare' and placing the constraints on the API's functions instead:

        data Map k v = ...
        insert :: Ord k => k -> v -> Map k v -> Map k v
        lookup :: Ord k => k -> Map k v -> Maybe v

This style is similar to instead placing the nonzero-ness constraint on the theorems which define the API of (/).

In both cases there are basic engineering reasons for the switch:

\- Having the constraints in the definition of terminology (Map, /) doesn't save any work, as you still need to prove those constraints to do anything or refer to it (in Haskell this meant sprinkling `Ord k =>` in the type of anything that referred to Map k v).

\- In fact it results in doing _more_ work than necessary, as you are sometimes forced to prove the constraints just to mention Map, even when what you are doing does not require them. For instance defining the empty map 'empty :: Map k v' shouldn't require you to know anything about k, because an empty tree doesn't contain any keys, let alone care about their ordering. In this case requiring Ord k in order to mention Map k v would be superfluous.

<comment> Ar-Curunir Rust tends to take the second approach as well; it tends to place trait bounds on `impl` blocks, and not on the struct itself.

(This is by no means a standard across the community though; I'd say it's a 50/50 split)

<comment><USER4> A case where it is unavoidable is when you want to refer to an associated type in your struct declaration.

In most other cases, putting bounds on impls leads to less repetition of those bounds and better error messages!

Another related topic is trait methods with method-level type parameters that have bounds. Those have to be repeated on every usage site so it is usually preferable to go for a design that has the type parameters in the actual trait.

Instead of:

        trait Foo {
            fn foo<T: Bar>(&self, bar: T)
        }

do this instead:

        trait Foo<T> {
            fn foo(&self, t: T)
        }

        impl<T: Bar> Foo for XYZ {
            fn foo(&self, bar: T) {

            }
        }

One bound might seem fine in this example but once stuff needs to be Send, Sync and 'static is when it gets annoying.

</comment></comment></comment><comment><USER5> This sounds like the idea that it's fine for C++ templates to not be typechecked, because the expanded template will eventually be checked by the compiler. Perhaps, but it makes for errors a long way away from their causes, which are difficult to debug.

If I ever divide by zero (or by something that might be zero) in my proof, I've almost certainly made a mistake. I'd rather hear about it straight away than later when I try to use some fact about the result of that division.

<comment><USER6> For completeness: C++ eventually introduced a feature to allow something analogous to type-checking for template metaprogramming, called _concepts_ \- [https://en.wikipedia.org/wiki/Concepts_(C%2B%2B)](https://en.wikipedia.org/wiki/Concepts_\(C%2B%2B\))

</comment></comment><comment><USER7> Using Scott encoding in the Lambda Calculus it is actually possible to define a 'usable' infinite natural number as a recursive construction (essentially its predecessor is defined as itself).

Interestingly enough, constructions for add, (natural) subtract and multiply work as you would expect with this infinite number without needing special handling. E.g. for all n, n + inf == inf, n - inf == 0, n * inf == inf.

Furthermore, the construction for (natural) div yields this infinite term (or at least something that behaves exactly like it) when the denominator is 0. Even more interestingly, 0/0 == inf for this system.

EDIT: Why might this be useful? Well now when you 'take n' from a list, n=inf will give you the whole list, regardless of how long (or even if it is infinite - i.e. lazy). Likewise 'drop n' will return the empty list - <USER2> with an infinite list, whereupon the calculation will fail to terminate.

EDIT: inf - inf == non-termination in this system, suggesting that not only inf - inf != 0, but it != inf either, and in fact it is something unreachable (in this system) (note the correspondence between 'subtract' and 'drop').

<comment><USER8> Mathlib does indeed define the extended real numbers, but they also need to define division on the reals. This is similar to the definition of subtraction having to be done for integers and for naturals (mentioned in the article)

<comment><USER7> I presume though that Mathlib does not define the extended _naturals_? If they did then 1:N / 0:N would be valued at this infinity.

What I found interesting about the Scott encoding was that natural infinity was trivial to define, and _arises directly_ from a straightforward construction of the div function (for naturals).

The encoding is as follows (\x indicates lambda abstraction for identifier x. Recursion is assumed, of course it could be made explicit with the Y combinator):

      zero := \f \x n
      succ := \n \f \x f n

      infinite := \n succ (infinite n)
      infinity := infinite zero

      subn := \n \m m (\p n (\q subn q p) n) n

      divn := \n \m (subn m n) (\p zero) (succ (divn (subn n m) m))

      divn (succ zero) zero => infinity

EDIT: Note that infinity does not have a normal form (does not terminate), but:

      subn n infinity => zero

<comment><USER8> The extended reals can also arise directly from the definition of reals either as Cauchy sequences of rationals (as unbounded increasing sequences, etc) or Dedekind cuts (let the lower cut contain all rationals) :) for reals IIRC the main reason to exclude the extended reals is to make it a field.

However I don't think any of this matters for the point the article made. The problem is not that 1:N/0:N has "nothing sensible" to return, the problem is that if you define it in the way most mathematicians do, a lot of your proofs will be littered with (inline) lemmas showing that the result of such-and-such a division is a finite natural / finite real. This is analogous the problem brought up in the article of having proofs littered with lemmas showing that the result of such-and-such a square root was real.

</comment></comment></comment></comment><comment><USER9> I think this behavior makes perfect sense when you view it through the lens of type theory. Functions that return a real number must always return a real number. Some function types are defined by something like 'R, error', and then it's up to the caller to check 'error'. Others throw exceptions that bubble up the call stack and may never return 'R', which in a sense breaks the type contract and has "exception" theory preceding type theory.

<comment><USER10> I don't understand what you mean. You still have the different obvious ways of formulating, e.g. division in type theory:

1\. The article's way: "R^2->R", but garbage value for 0 in the second argument.

2\. What you propose: "R^2->Maybe R"

3\. The mathematician's dependent-type-theoretic way "R * (x:R, proof that x!=0) -> R",

4\. the conventional way "R * (R\\{0}) -> R".

They have their advantages and disadvantages. The first is useful in proof verification since it simplifies most proofs, from which perspective this garbage value of 0 is actually well-behaved, and doesn't need to be handled as a special case. But you allow seemingly nonsense theorems when you forget to condition (x>0).

What you propose is similar, except that you are forced to reason about whether the output value is valid.

3 and 4 are tedious, since you always need to prove that the inputs are nonzero. 4 is more tedious since you have merely shifted the problem of handling the zero case into proving properties about the canonical embedding "R->R\\{0}" (which must still have a garbage value for 0). On the upside, these functions surject into R.

<comment><USER11> > But you allow seemingly nonsense theorems when you forget to condition > (x>0).

Such as what? I've only spent a few hours with lean, but I'm fairly sure that any attempt to prove something silly would fail because it would catch the weird behavior of 0.

For example. If you tried to use a/a = 1 as the article mentions, you'd be unable to prove it without adding the condition that a != 0, and you'd be unable to use it further on without that condition in place.

<comment><USER12> Here is a "nonsense" theorem that is provable in Lean:

"There exists a real number r such that 1/r = 0."

If you try to translate this theorem into maths, you will run into trouble at some point. At which point exactly depends on how you want to make things precise... which is exactly what mathematicians avoid when talking about division in fields.

<comment><USER11> That's a perfectly sensible function, it's just not ordinary division on the reals where x = 0, and you can't use it that way.

</comment></comment></comment></comment></comment><comment><USER13> With humility I will say that I don't like this solution.

In mathematics functions have domains and codomains. Two functions are equal if their domains are equal, their codomains are equal, and for all the values in the domain they return the same values in the codomain.

A mathematician who doesn't know anything about type theory, but hears Lean is good at formalizing math, will expect the division function to have the domain R x (R\\{0}). Modifying the domain to be R x R and returning a garbage value for the added points is not a good solution. Maybe it works "in real life", but you always need to carry with you an invisible asterisk and footnote that Lean did the right thing only assuming you asked the right question.

Again, being humble (my Lean experience is about one hour in total, spread across several sessions), I think it would be better to invest a bit more time upfront and always define properly the domain of the function used, rather than introduce edge cases that can bite you in the back twenty five theorems down the road.

</comment><comment><USER14> The title is a bit sneaky. Division by zero in "type theory" will depend on just that -- your type theory. Some theories use special values for division by zero (e.g. could spit out DNE or +INF/-INF). But then you need to formalize how you do "things" with DNE or infinities. This is, more often than not, an unnecessary rabbit hole, so just returning 0 is simpler. Some theories might require a proof that the denominator isn't zero (essentially making division a three-argument function) -- which is kind of a cool way of thinking about it[1].

[1] [https://math.stackexchange.com/questions/334393/how-does- typ...](https://math.stackexchange.com/questions/334393/how-does-type-theory- handle-division-by-zero-and-such)

</comment><comment><USER15> I don't think the "in type theory" restriction is correct.

This choice works fine when using type theory in theorem provers, but would be unacceptable if we did it in programming languages that use type theory (or would that be called "type practice" ;-)?)

In Haskell, for example, _1 /0_ returns _Infinity_.

<comment><USER16> That's not exactly right... in Haskell, 1/0 has type Fractional a => a. So, it could be any fractional type. If 1/0 occurs in a context where it'll be interpreted as a floating-point number, you'll get Infinity, yes, as per how standard floating-point works. In other contexts though you may get an error. E.g., if you import Data.Ratio and do 1/0 :: Rational, you'll get an error.

</comment></comment><comment><USER17> I ran into this argument before.

I can understand that it makes sense for proof assistants. As the post shows, proof assistants don't allow you to misuse that anywhere else.

(But as a sidenote: couldn't you fix this with dependent types somehow?)

I still think it would be wrong for a regular programming language. Afaik, the Pony language does this too, but that is a general-purpose programming language that does _not_ check your logic, and I am very wary of something like that. People might type up some algorithms, or even just try to compute an average, and the system absolutely should yell at you if you try to divide by zero.

<comment><USER18> Pony now includes both partial division (which raises an error when dividing by zero) and checked division (which returns a tuple of both a result and a boolean which indicates whether an error occurred): [https://tutorial.ponylang.io/expressions/arithmetic.html#par...](https://tutorial.ponylang.io/expressions/arithmetic.html#partial- and-checked-arithmetic)

For what it's worth, I'm willing to argue that Pony is making a strongly motivated choice by making x/0 return 0 by default with respect to their specific error-handling model. In general, I don't think it's as much of a problem as you might imagine. The _average_ function is a perfect example: if I naïvely implement it in such a language, then it would mean… that _average([])_ returns 0. That doesn't seem terribly bad to me.

<comment><USER17> I don't think that the average of an empty list being zero is semantically correct, but I can accept that it may not be so bad in practice (e.g. if it shows up like that in a UI and you display the number of elements anyway).

But I still think in other situations I'd want to be yelled at for trying to divide by zero. E.g. imagine I'm trying to compute the slope of a secant between two points. If both points are the same, I'd like the compiler to yell at me (the problem either makes no sense here, indicating a problem somewhere else in my code, or that I should instead compute the derivative) - in most cases, 0 would be the wrong answer. I think the issue here is that with division by zero you lose continuity (unless you use +Inf) which can contradict intuition.

I'm not saying it doesn't work for Pony, maybe it does, but I don't think I would feel comfortable with that behaviour.

Silent wrapping around on overflow is arguably even worse, that I could definitely see leading to logic errors.

<comment><USER19> You could also argue that 0^0=1 is also not semantically correct, but it is the most widespread convention among mathematicians.

<comment><USER20> It IS semantically correct. The number of functions from a set of 0 elements to a set of 0 elements is exactly 1. No parallel argument exists for division by zero. The two situations are not analogous at all.

<comment><USER19> Mathematics is full of cases where the same notation means different things. You've kind of dodged the question of what 0^0 is by talking about set theory, because it is (in some sense) arbitrary that X^Y means Y -> X or its size (cardinal exponentiation), and in analysis may mean exp(y log x). We accept that for natural X,Y except (0,0) these must agree but that does not imply that they should agree at (0,0), because the definitions are simply not the same.

If you are serious about math, which it seems you are, I would be a bit more careful about "transporting" notation from one field from another and arguing about correctness.

The usual way to transport a definition from a discrete domain to a continuous one is a technique called analytic continuation. I am curious if there is an analytic continuation of the discrete X^Y which contains 0^0=1, and what that would look like, but at that point you're _definitely_ not talking about exponentiation any more.

See: [https://en.wikipedia.org/wiki/Zero_to_the_power_of_zero](https://en.wikipedia.org/wiki/Zero_to_the_power_of_zero)

See: [https://math.stackexchange.com/questions/11150/zero-to- the-z...](https://math.stackexchange.com/questions/11150/zero-to-the-zero- power-is-00-1/11155)

<comment><USER20> > it is (in some sense) arbitrary that X^Y means Y -> X or its size (cardinal > exponentiation)

Are you referring to the notation? I don't think notation is what's being contested.

> in analysis may mean exp(y log x)

Doesn't work with a base of 0.

> We accept that for natural X,Y except (0,0)

Why "except"?

> that does not imply that they should agree at (0,0), because the definitions > are simply not the same.

The definition of exponentiation of reals typically _starts with_ exponentiation of naturals as a given (see Baby Rudin).

> The usual way to transport a definition from a discrete domain to a > continuous one is a technique called analytic continuation. I am curious if > there is an analytic continuation of the discrete X^Y which contains 0^0=1

Analytic continuation refers to something else, but I get what you're trying to say.

The answer is simple: Real exponentiation is an _extension_ of natural exponentiation. Hence, it should have the same value as the latter wherever the latter is defined.

Yes, I've read that SE question before. It's good that you brought it up. I recommend reading the comments under the accepted answer and the other answers as well.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Obviously a system can define a symbol like "/" as whatever it wants to. But then it isn't what many mathematicians would expect.

The Metamath Proof Explorer defines "/" so it only has a value if the denominator is a nonzero complex number: [http://us.metamath.org/mpeuni/df- div.html](http://us.metamath.org/mpeuni/df-div.html)

You can argue if that is better, but that is a possible choice.</comment>


The Data That Turned the World Upside Down - <AUTHOR> http://motherboard.vice.com/read/big-data-cambridge-analytica-brexit-trump <comment><USER2> In which you prove that your social engineering product works by supporting what was supposed to be the two largest long shots in recent history (Brexit, and Trump).

Also love how the title doesn't use those two swear words to get 'anger views/network effects'. Though let's be honest there wasn't going to be much else it was going to talk about.

Also IMO it's a high effort article. Actual research and reporting went into this.

This is why companies are obsessed with all data. Even small things like windows 10 asking you to up/down vote pictures on the login screen.</comment>


This chart shows how far behind Apple is in the global phone market - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2013/08/20/this-chart-shows-how-far-behind-apple-is-in-the-global-phone-market/

<comment><USER2> Boy are they screwing up, big-time.</comment>


Ask HN: Python – simple pass fail read out to the terminal - <AUTHOR> I was watching a video of a python dev code. When he'd run the code the script would run in terminal and out put green or red text with a pass/fail output. Does anyone know what testing framework this is? I'm new to writing tests into code but would find this incredibly useful.<p>Output<p>[check]...............Pass [check]...............Fail <comment><USER2> Why not share the video?

<comment><AUTHOR> I can't find it. Might be out of luck but figured someone might now off hand</comment></comment>


Zenound Music Service - Need beta testers - <AUTHOR> http://www.zenound.com Just released my new music service. If anyone would like to help test it please do so and give me some feed back =) <comment><AUTHOR> Please let me know what you think!</comment>


My contribution to XKCD's #949 - <AUTHOR> http://www.joachim-breitner.de/blog/archives/632-My-contribution-to-XKCDs-949.html <comment><USER2> "You can already build such a system yourself quite trivially by getting an FTP account, mounting it locally with curlftpfs, and then using SVN or CVS on the mounted filesystem."

[https://news.ycombinator.com/item?id=9224](https://news.ycombinator.com/item?id=9224) :)

<comment><USER3> It's a really geeky approach. The 949 problem concerns a lot of persons who does not even know what a server is.

<comment><USER4> [https://news.ycombinator.com/item?id=8863](https://news.ycombinator.com/item?id=8863)

:)

</comment></comment></comment><comment><USER5> Didn't Dropbox's share links more or less solve this problem? Maybe not for 100% of the population, but I've managed to walk my mom through the process, and isn't that generally the success metric for things like this?

<comment><USER6> I recently had to sign up with Dropbox just to download a file somebody was sharing with me.

The way UbuntuOne (and maybe other providers) just give you a link anybody can use is much better imho.

<comment><USER7> I'm pretty sure they did it wrong then. You can share a link to any file inside of your dropbox, and anyone can download it regardless of whether they have an account.

<comment><USER8> 1) Right click "Share Dropbox link"

2) New incognito window

3) Paste, enter

4) Download, no sign-up required

</comment></comment></comment></comment><comment><USER9> The problem isn't 'sending a file', it's 'peer to peer communication', which is hard without an intermediary and/or shennanigans due to ubiquitous NAT. I image in the everyone-has-an-IP universe of ip6, this will no longer be an issue.

<comment><USER10> ipv6 will still have this issue, because _no fucking way_ will i put a directly-accessible-from-anywhere computer on a network.

the "how do i serve a directory" problem is _so_ solved:

`python -m SimpleHTTPServer`

or:

dropbox (it's not hard to install, as much as xkcd whinges about it) google drive email

This is a solved problem.

<comment><USER11> > directly-accessible-from-anywhere computer on a network

followed by

> python -m SimpleHTTPServer

is a bit of a contradiction.

Dropbox has some pretty serious limitations for transferring files; you're limited on file size, you have to upload to their servers, you're subject to their definition of objectionable content, and sharing a particular file too much (for their definition of too much) will cause them to take down the file.

<comment><USER10> My suggestion for SimpleHTTPServer was in response to the blog post.

>Dropbox has some pretty serious limitations for transferring files; you're limited on file size, you have to upload to their servers, you're subject to their definition of objectionable content, and sharing a particular file too much (for their definition of too much) will cause them to take down the file.

Link to this being a real problem for someone?

</comment></comment></comment></comment><comment><USER12> On Windows, I run a local torrent tracker (built into uTorrent: bt.enable_tracker true) and share the magnet links.

The disadvantages are that I need to create a torrent file with my ip in announce field for each file I want to share and that the recipient must have torrent software (all of my friends incidentally do).

Perhaps I could simplify the torrent creation using the correct announce field with a nifty right click - 'Send to' script. edit: Looks like it would be possible with a combination of [https://github.com/bittorrent/btc](https://github.com/bittorrent/btc) , [http://www.robertnitsch.de/projects/py3createtorrent](http://www.robertnitsch.de/projects/py3createtorrent) and a batch file.

The advantages are built-in checksumming, no intermediate upload server, interoperability with various torrent software, ability to stop and resume the transfer at any time and very good transfer rates (for some reason I've had terrible performance with those browser-to-browser services like e.g. sharefest)

</comment><comment><USER13> Quick and easy file sharing is hard to do not only from a technical standpoint, but also from a legal standpoint. It only takes one DMCA lawsuit to shut down a file sharing startup. The likelihood of a lawsuit increases as the file sharing becomes easier, quicker, and more anonymous (as the chances that someone will use it for illegal purposes increases the easier and quicker and more anonymous it becomes).

You have to set some restrictions on who can share what with how many people and how often. Even torrent trackers that do not store any files other than the tracker become targets. I really would love it if there was a way to type "scp /home/freehunter/your-granddaughter-laughing.mpg //grandma/home/grandma/videos" with UPnP to get around grandma's dial-up NAT. Unfortunately, the closest we have is Dropbox (requires an account) or BitTorrent (requires dodging law enforcement and porn popups).

<comment><USER14> it really works: [http://www.bittorrent.com/sync](http://www.bittorrent.com/sync)

</comment></comment><comment><USER15> As far as quick 'n dirty solutions go, if you're not overly concerned with security, you can always use "python -m SimpleHTTPServer" to serve all the files on the current directory over HTTP.

I also recall that KDE had a panel applet that pretty much did the same thing on the 3.x days (not sure it's been ported to 4.x)

<comment><USER3> Do not forget that this solution is inherently mono-threaded and does not benefits from a proper concurrency model like node.js for example (which is also mono-threaded by "design" but provide non blocking IO).

So for big files with multiple downloaders, it can be sometimes not as good as you want it to be.

<comment><USER16> But at that point you're hosting a file server, not just sending a 25mb file to a friend. Out of scope.

</comment></comment></comment><comment><USER17> Ever tried talking a non-techie friend/relative through the process putting a port-forward on a NAT router? Not fun at all.

<comment><USER18> I believe he's connecting to a SSH server, and the server is proxying the request back to a local HTTP server. So there's no need to mess with port- forwards.

</comment></comment><comment><USER19> I ran into a "trying to share files" thing recently, and I ran into the "pipe things over netcat" solution ([http://superuser.com/questions/98089/sending- file-via-netcat](http://superuser.com/questions/98089/sending-file-via- netcat)). For techies it's pretty fun.

With things like google docs, I've found that file sharing has become a lot less necessary. We're sort of moving into a very file-less space, and I'm kinda fine with it.

</comment><comment><USER20> I've got a CLI that lets you upload a file through FileTea. I'll clean up the source and post it soon.

See [https://github.com/brechin/FileTeaSend](https://github.com/brechin/FileTeaSend) Tested with Python 2.6. Only external requirement is requests.

<comment><USER21> Great! Guess I'll ditch my tool sooner than I thought...

<comment><USER20> Glad I could help!

</comment></comment></comment><comment><USER22> So he's built a file sharing tool which requires an SSH server to work? So why not just use sshfs, scp or rsync?

I don't mean to stamp on someone's creativity, but SSH already has a whole bunch of tools for transferring files - all of which already work pretty well.

<comment><USER21> Because with file-share, the file is never stored on the ssh-server; it is transferred the instant the other sides starts the download. The SSH-Server is required to share the file at a publicly available address (which my own computer is likely not). So no need to clean up files after the download, for example, or even to have any free disk space.

<comment><USER22> If you need an SSH server to begin with, then there's still some setting up you need to do before hand. The pain of having to delete a few files afterwards is really nothing compared to renting a Linux box, setting up SSH accounts with fail2ban and/or SSH keys; and so on.

So _file-share_ doesn't even work as a pain free solution like you suggest it does.

As I said before, I don't like to stamp on another's creativity. I'm just saying that there are better tools for doing this which already come pre- installed with most Linux distros, UNIX's and OS X.

<comment><USER21> Why would you have to mess with SSH account_s_? Only the sending side needs an account, no further setup on the server required. It doesn't even have to be your server, your university's server is enough.

<comment><USER22> Most people are not at uni and rented boxes usually have root open by default expecting customers to then disable root access and create a user with su / sudo rights. Plus I tend to take things further and create a dedicated groups for ssh so that rsync / sftp users cannot use a system shell nor port forward and are chrooted while a very small subset of administrators have full ssh access.

Plus even if you do borrow someone else's box, can you be sure that they'd even be grateful that you're using up their bandwidth?

Ssh is a dangerous protocol to leave open to the WAN, so setting up an ssh server properly, while not a time consuming job, will still take longer and more effort than simply deleting a few files afterwards.

</comment></comment></comment></comment></comment><comment><USER23> Dropbox solves the problem of sharing a file I have, but on the receiving side of the equation, dbinbox ([http://dbinbox.com/](http://dbinbox.com/)) is probably the easiest solution for non-technical folks.

</comment><comment><USER24> WeTransfer (wetransfer.com) is pretty popular in the Netherlands. It's easy to use, only requires an e-mailadress and allows you to send files up to 2GB and as an added bonus it's quite pretty. I really love it's simplicity.

<comment><USER25> WeTransfer solves this problem, without needing an user account. I don't know why people wouldn't use it.

</comment></comment><comment><USER26> You can always uses a p2p data transfer with WebRTC. All you need is a browser.

<comment><USER27> OK, I've got a browser window open right here. Now what?

(Serious question.)

<comment><USER28> [http://lmgtfy.com/?q=webrtc+transfer+files](http://lmgtfy.com/?q=webrtc+transfer+files)

<comment><USER27> The snark doesn't work here; "googling" is more than "just a web browser".

</comment></comment></comment></comment><comment><USER21> Follow up post, summing up alternatives (especially the FileTea command line client): [https://www.joachim-breitner.de/blog/archives/634-My- contrib...](https://www.joachim-breitner.de/blog/archives/634-My-contribution- to-XKCDs-949-is-not-needed.html)

</comment><comment><USER16> A neat solution indeed, but for anyone capable enough to setup what you've concocted, why not just scp the files on a lowendbox.com VPS. You also benefit from an intermediary with a decent up and down connection for the person you're sending to.

</comment><comment><USER29> Munroe did not mention Skype. Tons of people have accounts there, and it transmits files like ICQ did back in the day.

</comment><comment><USER30> Wow, thanks for pointing me to [https://filetea.me](https://filetea.me)

</comment><comment><USER31> _cough_ onewaybits.com _cough_ (shameless self promotion)

Supports up to 50mb files for now.

</comment><comment><USER32> Looks quite neat :).</comment>


Who Owns Your Wireless Service? Crooks Do - <AUTHOR> https://krebsonsecurity.com/2019/08/who-owns-your-wireless-service-crooks-do/ <comment><USER2> I see these problems from a different angle than the usual commentators. I continue to ask myself: Why is mobile used for important things, e.g., banking, payments, etc.?

A great example is authenticating a person's identity via possession of a SIM card, i.e., their mobile number. If one can switch SIM cards, then one can switch identities. This flexibility is not a flaw in mobile communications; the ease-of-use is what makes mobile so useful. However it is silly to pretend mobile is as safe as landline for all uses. Mobile may be altogether more useful than landline -- few could argue otherwise -- and at the same time it can be entirely inappropriate for use in important things like banking. This concept seems non-existant. Instead the prevailing thinking is all-or-nothing.

In addition to "convenience", mobile has introduced a new class of problems when used for important things like banking and payments. These problems either do not exist or exist at a much lower scale with respect to landline. Who owns landline service? Crooks?

From where I stand, the risks of using mobile for important transactions outweigh the benefits. Unfortunately, I also see that "convenience" continues to prevail over common sense. I am willing to sacrafice convenience for peace of mind. Meanwhile banks and others push harder and harder for customers to use mobile, including as a means of verifying identity.

<comment><USER3> > These problems either do not exist or exist at a much lower scale with > respect to landline.

Except for an ever-growing amount of the population doesn't have a landline -- only mobile.

<comment><USER4> The vast majority of people do not have a land line. Per World Bank data, there are 12 landlines per 100 people and 102 mobile lines per 100 people.

<comment><USER2> What are the statistics for businesses?

How many landlines per business entity?

Are the vast majority of businesses using cellphones exclusively? Why not?

<comment><USER5> Is a business accessing their lines via voip considered a landline?

</comment></comment></comment></comment></comment><comment><USER6> As a personal hacking project in my spare time, I switched from T-Mobile to anveo and an asterisk setup. I can send and receive SMS on my server and can make WiFi calls on my phone. SMS gets sent to my email as well. This costs maybe $45 USD a year. I've thought about documenting my setup but I don't know if there is any interest.

<comment><USER7> I am rarely in the same country very long and use [https://www.aa.net.uk/](https://www.aa.net.uk/) in the UK for a UK 07 number that can retrieve SMS and that I can use a VOIP phone with. As far as I'm aware they're the only service in the UK allowing this with 07 numbers.

<comment><USER8> How much do they charge for this? I looked on their web site but when you select that option they say:

'Sorry, you will need to contact sales to order an 07 mobile number at this time.'

<comment><USER7> Very very little. Paying a couple of quid a month I think. Yes, you'll need to contact sales, but also you can port your existing number in.

</comment></comment></comment></comment><comment><USER9> It's hard not to get really depressed when you think about all the political institutions that were setup to protect consumers and have since been hijacked by the corporations to protect them from the consumers.

<comment><USER10> Maybe you won't be so depressed when you realize that some of the quotes in that article by Gigi Sohn ("complete and total abdication of oversight") are prima facie hyberbole, and thus we can dismiss them as politically motivated. How can I say it's hyberbole? The rest of the article tells us that there are lawsuits, prosecutions, and FCC investigations. That doesn't sound like a complete and total abdication of oversight. Is the problem serious? yes. Is it ongoing? yes. Is there regulatory capture? yes. But is nothing being done about it? no.

<comment><USER11> I think you're overreacting. The Sohn quote is referring specifically to oversight by relevant government agencies. Lawsuits are not relevant to the statement. The article implies that the FCC investigation into location data sharing was, at best, proceeding slowly.

<comment><USER10> Perhaps. I mostly concur with the article. I think FCC deregulation was poorly done. I'm not happy with the wording of my prior statement but I'm not going to edit it. What I was thinking when I wrote it was "cheer up, things will work out okay"

</comment></comment></comment></comment><comment><USER12> Curiously enough, an edition of the Encyclopedia Galactica that had the good fortune to fall through a time warp from a thousand years in the future defined the telecommunications executives of America as "a bunch of mindless jerks who were the first against the wall when the revolution came."

<comment><USER13> How I miss Douglas Adams

</comment></comment><comment><USER14> AT&T's response to this sounds pretty bad. They're not going to prevent SIM swaps but they're going to let banks (not Google, not cryptocurrency exchanges) discover that you got swapped after the fact.

<comment><USER15> Eventually, this could make legitimate SIM swaps unusable. The point of SIM swaps was to retain a phone number when swapping carriers or SIM chips. If a number becomes untrusted after a SIM swap, you may be better off getting a new number.

<comment><USER16> Assuming it wasn't bribery but simple social engineering, what's there to prevent this from being abused? In Germany, porting the number to another carrier would be next to impossible without the victim realizing. You have to request from the old carrier to release the number for porting, then you have to tell the new carrier you want to port over the old number from the old carrier. Then the old carrier informs you via SMS and email when the switchover will happen. That date is usually at least one week in the future. And usually the evening before the switch you get another SMS.

Pretending to have lost your SIM and requesting a new one might be slightly easier, I never needed to do that. But it would mean your SIM gets deactivated the moment they start the process of shipping out the new SIM, so it will give you at least a full 24 hours to notice you got no service, usually two days. I wouldn't be surprised if they'd also send you a text plus email before deactivation just in case.

But in general I feel like call center workers here are very good at following the protocol. I'd be very surprised if you'd manage to convince one that you lost your phone and you also happen to have moved and want it sent to another address.

But sure, if you're paying someone on the inside, all bets are off.

<comment><USER15> I could probably go a week before I noticed that my phone had no service.

There doesn't seem to be much security at all in Australia. Enter the number and date of birth (and contract number, if it's not a prepaid phone) and wait a couple of hours.

<comment><USER16> > I could probably go a week before I noticed that my phone had no service.

Fair enough, not everyone is checking their phone every 5 minutes. But otoh if you wouldn't realize it within a day or two you probably aren't using it for Apple pay, 2fa and whatnot so you're not a likely target anyways.

<comment><USER15> Not using it for much stuff like that. But considering everything I wrote above, I think I'll start checking the service once a day.

</comment></comment></comment></comment></comment></comment><comment><USER17> this is actually an existential financial threat for some people:

\- SIM swap to get obtain SMS/telephone capability

\- hijack email, if known + non-2FA or known SMS/telephone 2FA

      - this could be socially engineered as well - "sorry, i forgot my password to that email account, can you change it to..."

\- using gathered intel from email (e.g. monthly statements), call up banks/financial account (many of which are non-2FA or SMS/telephone 2FA)

\- password reset/etc any accounts without 2FA or with SMS/telephone 2FA

\- social engineer way into bank/financial accounts

\- drain and profit

i've seriously considered tying up financial stuff to an undisclosed phone number on its own account.

<comment><USER18> this happens to people that store their cryptocurrency on services with sms- based 2fa.

any service that uses sms-based 2fa without any other option like client side generated one time passcodes (otp) should be sued for negligence at this point. the otp should be the default choice.

people are currently masquerading incompetence as an indictment to cryptocurrencies as a concept. this is allowing negligent, incompetent businesses to get a free pass, because the people that should be in charge of protecting consumers are thinking the cryptocurrency itself is insecure or "got hacked" which so far isn't what is happening.

(with regard to storing cryptocurrency on someone else's server, yeah those users are being negligent too.)

<comment><USER19> My personal peeve is various services that offer MFA, but very quietly still offer SMS-based 2FA as a backup that is nearly impossible to turn off. If you set up MFA, be absolutely sure that recovery is only done through one-time codes and the service doesn't automatically fall back on SMS.

<comment><USER18> So Coinbase and .... who else?

</comment></comment></comment></comment><comment><USER20> Are any providers offering an opt-in SIM freeze of sorts with some kind of enhanced authentication in order to unfreeze? Wouldn't such a feature/service easily prevent the SIM-swap risk? I don't know how easy this is to prevent regarding the infrastructure (do networks detect a SIM-swap via change in host IMEI?). I understand the article describes a rogue employee but it seems to me that an added layer for such a service could easily prevent unauthorized access.

</comment><comment><USER21> I didn't know AT&T was just selling real time data in defiance of the FCC rules and I'm quite inclined to just terminate my service after holding an account for nearly 20 years with them over it.

That's beyond unacceptable.

</comment><comment><USER22> I liked the smart title of this article!

</comment><comment><USER23> Great piece of content. First time I read something in krebsonsecurity

Love the combination of investigation and cybersecurity.</comment>


Arthur C. Clarke presents Fractals: The Colors Of Infinity  - <AUTHOR> http://inpotential.com/wordpress/articles/numerology/arthur-clarke-fractals-colors-infinity/

<comment><USER2> You know what, you can go watch the whole video in one piece here: <http://video.google.com/videoplay?docid=-6939286120674554766> , and not have to suffer that Personal Enegery Mandala Aura Third Eye Chakra nonsense!

</comment><comment><USER3> Aka: "proof that Arthur C Clarke does acid"</comment>


Taiwan to donate 100k masks per week to US - <AUTHOR> https://www.taiwannews.com.tw/en/news/3899531 <comment><USER2> I don't understand this donation effort. It's not the US that needs help, it's Peru or Niger or Tajikistan, countries that lack resources and funds and don't have own production.

Few will die in the US, far more in Rwanda or Guatemala or Papua New Guinea.

<comment><USER3> Here's an easy tip for trying to understand a claim that you can't justify. Read the article.

"As Taiwan and the U.S. step up their cooperation on the development of drugs and vaccines to battle the Wuhan coronavirus (COVID-19), Taiwan has pledged to donate 100,000 face masks per week to the U.S., while the U.S. is reserving 300,000 hazmat suits for Taiwan."

That's literally the first sentence.</comment></comment>


U.S. Dept of Labor Predicts Decline in Programming Jobs - <AUTHOR> http://www.onetonline.org/link/summary/15-1131.00?redir=15-1021.00#AdditionalInformation

<comment><USER2> This is the same dept that gives sunny outlook to "Software Developer, Applications", "Software Architects", etc...

<http://www.onetonline.org/find/quick?s=software+engineer>

Sadly, "programmers" are no longer needed. But as code still needs to be written, nice to know that "software developers, applications" will be hired to write the programs, and so many nice syllables in the new job title!

</comment><comment><USER3> They differentiate between programming and software engineering. Combine both occupations and you get a projected 29% increase from 2008 to 2018.

<http://www.bls.gov/oco/ocos303.htm#projections_data>

</comment><comment><USER4> They also claim that programming requires "The ability to add, subtract, multiply, or divide quickly and correctly."

I'm skeptical.

</comment><comment><USER5> also, how many programmers are self employed these days...?</comment>


YouTube is down - <AUTHOR> https://www.youtube.com/

<comment><AUTHOR> Individual user pages and searching still appears to be working, but My Subscriptions and the homepage are down.

<comment><USER2> I've only had problems with videos loading - not the front page - but that's been happening all day today.</comment></comment>


8x Nvidia GTX 1080 Hashcat Benchmarks - <AUTHOR> https://gist.github.com/epixoip/a83d38f412b4737e99bbef804a270c40 <comment><USER3> I'm going to wait for the 1070 benchmarks as in other series the x70 models had a better price/performance ratio:

[http://www.videocardbenchmark.net/high_end_gpus.html#value](http://www.videocardbenchmark.net/high_end_gpus.html#value)

The 1080 is $599 while the 1070 will be $379 while the Titan X is ~$1000.

$1,500 for a 4x 1070 setup could be _very_ attractive considering the performance should be on par with 4x Titan X (at $4k)

edit: forgot to mention power consumption as well, which should be a component of price/performance

<comment><USER4> PCIE slots are limited so when you are talking about actual compute scale the 1070 can be more expensive considering you'll have to get another case, cpu, ram, and an PSU that can handle 4 cards at max load. And of course the more components you have in a given system the more likely is that one of the will fail, granted if you are designing a system to be resilient against attrition a system with more lower powered components can be more resilient than a system with fewer more powerful ones based on the performance difference between them and the MTBF for each component.

But bang for buck charts don't mean much even for Gaming I never understood why people even use them, spend what you can and want to get the performance you want. Spending 50% more to get only 20% more performance is a valid option because those 20% can mean the difference between a playable game at high resolution and a laggy mess. Traditionally SLI setups for mid range cards could out-perform and be cheaper than high end cards but with a huge caveat - being dependant on the SLI profile for the game, if it come out to be shitty or non-existent you are just stuck with 2 cards that can't really run the game at the settings/resolution you want.

Also unless you are building a small datacenter power consumption can be ignored, the 50-75W difference in total system draw between a mid range and a high end card when the rest of the hardware is the same isn't going to have any financial impact on anyone even if we take the most expensive power in Europe that's going to come out to about 30 cents per KWh.

<comment><USER3> I agree that for gaming it makes sense getting the higher end cards rather than dealing with SLI, but my use case is password cracking that doesn't require five 9's uptime.

The GTX 1070 is 150W power consumption while the 1080 is 180W. Rather than get another case i'd just scale up the case size based on the number of cards - <USER2> cards ($100[0]) 4 cards ($200[1]), 6 cards ($400[2])

1200W PSU $300[3], riser cards $10[4] and then motherboard + cpu + SSD about $200-250 so it works out $700 base for 2 GPU system, $900 base for 4 GPU system and $1400 for 6 GPU (2 PSU's)

If you work that out with the card options the sweet spot is 4x 1070 GPU's for $1500. It really isn't worth spending $4k on cards to get equiv performance from Titan X's or 15-30% more performance with the 1080 (although power/performance is better).

[0] [http://www.coolermaster.com/case/mid-tower- cm690-series/cm69...](http://www.coolermaster.com/case/mid-tower- cm690-series/cm693/) [1] [http://www.corsair.com/en/obsidian- series-900d-super-tower-c...](http://www.corsair.com/en/obsidian- series-900d-super-tower-case) [2] [http://www.miningrigs.net/?product=graymatter-6gpu-server- ca...](http://www.miningrigs.net/?product=graymatter-6gpu-server-case) [3] [http://www.newegg.com/Product/Product.aspx?Item=N82E16817139...](http://www.newegg.com/Product/Product.aspx?Item=N82E16817139039) [4] [http://www.amazon.com/Fixable-Adapter-Flexible-Extension- Con...](http://www.amazon.com/Fixable-Adapter-Flexible-Extension- Connector/dp/B00IMYODGS)

<comment><USER4> What motherboard can you buy for under 50 with 6 PCIeX16 (power) slots? The cheap "bitcoin" motherboard that go for about 50-75$(old intel express chipset) won't work in this case, not sure about the 1070 but the 980 (non-ti) and the Titan X do not want to work with any PCIe slot that isn't a true PCIeX16 power slot. The PCIe x1-4 to x6 riser converter boards do not work, even the "good" ones with a SATA power connector and an actual power PCB for some reason, my guess is that there is some actual sensing going on in the card itself.

Unless you buy something like this [http://www.amazon.com/ASRock- Motherboard-H81-PRO-BTC/dp/B00H...](http://www.amazon.com/ASRock- Motherboard-H81-PRO- BTC/dp/B00HEUIS2G?ie=UTF8&keywords=asrock%20bitcoin%20motherboard&qid=1465300259&ref_=sr_1_1&sr=8-1) which which is i think the only non-server motherboard which is commonly available you aren't getting more than 4-4 PCIe slots, and even to get 4 (PCIe16) you need to spend about 200$ on a motherboard these days and the H81 chipset mobo's don't want to work with modern nVIDIA cards (or the other way around) with all but the main PCIe16 slot.

Pretty much to get more than 2 PCIx16 slots these days you have to buy a good gaming Z170/Z97/X99 motherboard, that ain't cheap, nor are the CPU's that go into them. While the AMD CPU's might be a bit cheaper again the motherboards won't be.

P.S. my personal password cracking setup at home is 4 5970's you could get them for about 100$ even a couple of years ago (today they are much cheaper 2 for 130 or b/o: [http://goo.gl/yplISa](http://goo.gl/yplISa)) and for most hashes they go 40-50% of the perofmrnace of a Titan X (I do have 2 Titan X's in my personal gaming rig which i can use in a pinch). I got them setup on an ASROCK motherboard (h61 iirc) that was designed for bitcoin mining so it comes with 8 PCIE slots and powered converter ribbons connect the cards do it all of this sits in a al cheapo rackmount case of a 20 year old compaq server.

But if you are looking for more scalable compute instance AWS CUDA instances are probably a better solution and I've been using them more and more lately.

<comment><USER5> I have been wondering about the AWS GPU instances. They are something like $2.60 / hour. At what point do they make sense monetarily? You can build a machine like described here for ~$5000 total. Thats not that many hours of AWS time. So if anyone is doing any long running cracking, or machine learning, does it ever make sense? I am truly curious about what people's experience has been.

<comment><USER6> >At what point do they make sense monetarily?

For password cracking? Never, especially considering you can just go on insidepro or something and rent access to someones cluster.

<comment><USER4> Insidepro is a great resource, but you usually aren't going to get a VAT invoice to either bill your client for or deduct in your taxes ;)

AWS is simple, it's not overly expensive for most password cracking ventures (e.g. password quality audit that certain organization like to do on their AD/LDAP) and more importantly you aren't giving away potentially very sensitive information to people that by default cannot be trusted.

Inside pro is ok if you are going mostly non-legit / off the books to begin with, it's also ok for basic research on non-real world data, but never use it for actual real world data not to mention B2B services.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> The scrypt and bcrypt rates are a bit misleading because they're with unrealistically low work factors:

* bcrypt: 2^5, when 2^10 or 2^11 is a much more typical figure

* scrypt: N=1024 r=1 -> 128KiB. For interactive logins the recommendation is N=16384 r=8 -> 16MiB.

LastPass is also off by a factor of 10 (500 rounds, when they default to 5000).

<comment><USER8> It would help if they indicated number of iterations for all algorithms.

<comment><USER7> Most of them are defined here:

[https://github.com/hashcat/oclHashcat/blob/master/include/sh...](https://github.com/hashcat/oclHashcat/blob/master/include/shared.h#L1071-L1123)

</comment></comment></comment><comment><USER9> (entrepreneur hat on)

The hashcat project could make a bunch of money with cracking as-a-service: you supply hashes, hashcat runs on a dedicated multi-GPU instance (SoftLayer etc provides these), and get outputs.

For users: no setting up hardware or software and much better price / performance than DIY

For hashcat developers: money to pay their rent and work on hashcat

Edit: looks like the company sells SW/HW but not as-a-service. Massive opportunity for them there: [https://sagitta.pw/software/](https://sagitta.pw/software/)

Edit 2: they're doing it: Q1 2017 [https://twitter.com/jmgosney/status/740146970254147584](https://twitter.com/jmgosney/status/740146970254147584)

<comment><USER10> I think you're talking about what gpuhash.me does now

<comment><USER11> Also hashcrack.org where you can use paypal, visa, bitcoin or even fancy ethereum for your shady cracking needs.

<comment><USER6> And the good old cmd5.org, which at least in the past has been the best such service available.

</comment></comment></comment></comment><comment><USER12> Interesting that the GOST-R 512bit seems no slower than the 256bit hashing.

Does this mean the 256bit is underperforming or is the 512bit flavour just as compute intensive as its lesser counterpart with half the number of bits. Least for me seems to stick out a bit(sic).

"Hashtype: GOST R 34.11-2012 (Streebog) 256-bit

Speed.Dev.#1.: 50018.8 kH/s (334.18ms) Speed.Dev.#2.: 49784.4 kH/s (332.43ms) Speed.Dev.#3.: 51323.1 kH/s (325.52ms) Speed.Dev.#4.: 50947.0 kH/s (327.87ms) Speed.Dev.#5.: 51510.6 kH/s (329.13ms) Speed.Dev.#6.: 50417.3 kH/s (331.39ms) Speed.Dev.#7.: 50825.4 kH/s (333.57ms) Speed.Dev.#8.: 50853.3 kH/s (333.38ms) Speed.Dev.# _.: 405.7 MH /s

Hashtype: GOST R 34.11-2012 (Streebog) 512-bit

Speed.Dev.#1.: 49979.4 kH/s (329.40ms) Speed.Dev.#2.: 49849.7 kH/s (330.26ms) Speed.Dev.#3.: 50315.4 kH/s (336.13ms) Speed.Dev.#4.: 50305.3 kH/s (328.99ms) Speed.Dev.#5.: 51486.7 kH/s (326.69ms) Speed.Dev.#6.: 49709.2 kH/s (328.72ms) Speed.Dev.#7.: 51328.8 kH/s (330.30ms) Speed.Dev.#8.: 51530.7 kH/s (326.41ms) Speed.Dev.#_.: 404.5 MH/s"

</comment><comment><USER13> >WPA/WPA2: 3177.6 kH/s

22.5 minutes (11.25 on average) to crack a randomized 8 hex digit password that a good number of wifi modem/routers come with (mine certainly did)

<comment><USER14> Can you point me to some resources for learning how to do this? Starting with capturing my wi-fi traffic to running the right tools to crack it? I'd like to see how long it takes me to crack my own password.

<comment><USER15> This[0] guide goes over how to use WiFite in Kali Linux[1] to capture a wpa handshake and how to use hashcat to crack it. You have to have a wifi-card that is compatible with aircrack-ng[2].

[0][https://www.blackmoreops.com/2014/03/27/cracking-wpa- wpa2-wi...](https://www.blackmoreops.com/2014/03/27/cracking-wpa-wpa2-with- hashcat-kali-linux/) [1][https://www.kali.org/downloads/](https://www.kali.org/downloads/) [2][http://www.aircrack- ng.org/doku.php?id=compatible_cards](http://www.aircrack- ng.org/doku.php?id=compatible_cards)

</comment></comment></comment><comment><USER16> I'm surprised that the primary use case for a machine with 8 of these things in would be password cracking. ([https://sagitta.pw/hardware/gpu-compute- nodes/brutalis/](https://sagitta.pw/hardware/gpu-compute-nodes/brutalis/))

There's not even any mention of training neuralnets, rendering things or doing science. Are there many non-shady reasons for purchasing the above device based on the purpose described?

<comment><USER17> FWIW password cracking is not necessarily a shady use-case. At my old job the infosec team had a GPU cluster continuously trying to crack employees' passwords and would force users to change passwords if they succeeded.

</comment></comment><comment><USER18> Fascinating hardware with great processing speed.

One question for the knowledgeable: Why are speeds for PostgreSQL hashes so high (~ 25k MH/s) compared with, say, MSSQL(2012) (~ 1k MH/s)?

<comment><USER19> Postgres is MD5; MSSQL(2012) is SHA-512.

<comment><USER20> And they're both terrible.

</comment></comment></comment><comment><USER21> It just goes to show that in 2016, you really can't be using SHA1/256/512 for password hashing anymore, even salted. Bcrypt/Scrypt or similar is a must.

<comment><USER22> From what I can tell with reasonable password length SHA512 still seems relatively secure. I'm not saying there is any reason you _should_ use it - but if it does 8624.7Mh/s and your password is JUST numbers, lowercase and uppercase English letters and it's only 10 characters it would still take it (26+26+10)^10 / 8624.7Mh/s ~= 83929936 seconds which is still about 3 years for a single hash.

If it's 12 characters - then you're up to 10,000 years.

<comment><USER21> True - reasonable password length being the important factor. I was basing my calculations on 8 character passwords.

At my university we were forced to use passwords that are exactly 8 characters long, for some ridiculous reasons. And this was meant to be one of the top universities in Australia...

<comment><USER22> It's because the internet is full of monkeys: [http://security.stackexchange.com/questions/33470/what- techn...](http://security.stackexchange.com/questions/33470/what-technical- reasons-are-there-to-have-low-maximum-password-lengths)

> Originally, some developer, somewhere, was working on an old Unix system > from the previous century, which used the old DES-based "crypt", actually a > password hashing function derived from the DES block cipher. In that hashing > function, only the first eight characters of the password are used (and only > the low 7 bits of each character, as well). Subsequent characters are > ignored. That's the banana.

</comment></comment></comment></comment><comment><USER23> Time to get a new password.

<comment><USER24> No. Time to start using proper _password_ hashing algorithms (e.g. scrypt) with added protections such as requiring _n_ rounds of hashing.

Tip: To require 65535 rounds of hashing on a Debian or Ubuntu system just run this:

        sed -i -e 's/sha512$/sha512 rounds=65535\n/g' /etc/pam.d/common-password

(Note: Assumes you're still using the default hashing SHA-512 hashing algorithm)

<comment><USER25> There was an earlier discussion about KeePassX, where I mentioned I used 10 million rounds of the AES encryption. Someone commented that it doesn't really add much additional strength.

I'm not familiar enough with the topic to understand why it would be so. I wonder if there is some basis for that claim?

<comment><USER4> [Disclaimer: This is assuming you aren't talking about key schedule, since you use odd terminology, and even then how do you get to 10M rounds is beyond me] Because you use the same key, not to mention the same IV most likely, unless you are storing 10M IV's some where... Doing 10M rounds of AES is just stupid(ly) expensive.

Also verifying the decryption with 10M rounds, means, 10M CRC checks, and if you are using it on a non-ECC system there is a good chance that many attempt to decrypt anything stored like that will fail due to single bit errors.

<comment><USER7> He's talking about KeePass's key derivation algorithm - SHA256 the password, make a random 256 bit key, AES-encrypt the hash N times using the key, and SHA256 the result.

10 million iterations is about a second of work on a typical desktop.

<comment><USER26> Typical being AESNI accelerated?

<comment><USER25> I don't have expertise on the subject as was probably already evident. For me it's a setting in KeePassX, and that's it.

With the 10 million config, opening the password database takes just a bit over a second on i7-4800MQ which should come with AES-NI. I can't say if the software is using that or not.

On my Android it takes 4 seconds, so very acceptable still.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> I'd be interested in seeing that the numbers are like for Argon2.

</comment><comment><USER28> I wonder how many fps runs Minesweeper...

<comment><USER29> I wonder how many shaders can be run in Minecraft and still get 60fps with this setup.

<comment><USER30> Probably still none.

</comment></comment></comment><comment><USER31> Is double precision performance crippled?

<comment><USER32> Yes: DP runs at 1/32 the rate of SP on GP104: [https://en.wikipedia.org/wiki/Pascal_(microarchitecture)#Per...](https://en.wikipedia.org/wiki/Pascal_\(microarchitecture\)#Performance)

However it is uncrippled on GP100 (ie. Tesla P100).

</comment></comment><comment><USER33> Can you do some gaming performance in FPS?

<comment><USER3> 1080: [http://www.hardocp.com/article/2016/05/17/nvidia_geforce_gtx...](http://www.hardocp.com/article/2016/05/17/nvidia_geforce_gtx_1080_founders_edition_review)

1070: [http://www.hardocp.com/article/2016/06/06/nvidia_geforce_gtx...](http://www.hardocp.com/article/2016/06/06/nvidia_geforce_gtx_1070_founders_edition_review/4)

Other benchmarks: [http://www.trustedreviews.com/nvidia-geforce- gtx-1080-review...](http://www.trustedreviews.com/nvidia-geforce- gtx-1080-review-performance-benchmarks-and-conclusion-page-2)

<comment><USER34> Im sure he meant 8-way sli gaming benchmarks</comment></comment></comment>


The Holocaust epigenetics study was over-interpreted - <AUTHOR> http://epgntxeinstein.tumblr.com/post/127416455028/over-interpreted-epigenetics-study-of-the-week <comment><USER2> Whether it was "over-interpreted" or not -- some stressors methylate genes, and those mutations are passed on to descendants.

Does surviving the holocaust count as a stressor? Yes. Would going through that probably involve a bundle of stressors, of which some are likely to produce epigenetic mutations? Likely.

The author of this article is in the business of writing papers that are anti- trans-generational epigenetic inheritance. The author either doesn't believe it is possible, or doesn't believe to have seen evidence for it yet.

It's a useful counterpoint to the majority opinion, tho it's very much the opinion of someone peddling a particular line that happens to be the line their in the business of writing papers about.

The most interesting thing in this study was that the descendants of those who had experienced the holocaust seemed to have become more immune to the stressors their ancestors faced. That's a pretty clear case of the genome responding by becoming more fit, the occurrence of which has evolutionary advantage.

<comment><USER3> I wonder what an similar survey of the genetics of Palestinians living under occupation for five decades would show - and whether the epigenetic effect not only makes people more "fit" for dealing with trauma, but perhaps desensitised when it comes to inflicting trauma on others.

<comment><USER4> As bad as the Israeli occupation is, it's not even in the same order of magnitude in terms of per-human suffering.

<comment><USER5> How did you measure the suffering ? If you just guesstimate the magnitude of the suffering I try a guesstimation too: In my opinion 4.5 years of intense suffering are in the same order of magnitude with 45 years of not so intense suffering. Unless some suffering is way more important than other suffering. I don't know.

<comment><USER6> You might also count the % or # of non-combatant population that was intentionally killed.

I also think that if palestinians were really suffering, they would agree to the terms offered to them. Repeatedly. The fact that they keep refusing to live in peace shows that things aren't all that bad.

Here is one fact - they are one of the most obese people on the planet: [http://www.liveleak.com/view?i=238_1406451164](http://www.liveleak.com/view?i=238_1406451164).

<comment><USER7> > The fact that they keep refusing to live in peace shows that things aren't > all that bad.

I think history shows it doesn't work like that. You can't oppress people into "wanting to live in peace", quite the reverse.

<comment><USER6> Not really. That's called losing a war. In most cases, when a war is lost, one side agrees to the terms they would probably deem unfavorable before the war had started. That's why we say they 'lost' the war.

<comment><USER7> I think there are few if any post-WWII wars that works like your idealized model of war. Most of them have been very assymetric from the start, such that one state's population hardly has it's 'conditions' touched at all while another's way of life is completely destroyed -- but that doesn't mean the more powerful actor always 'wins'.

For instance, did the US 'lose' the Vietnam war, because the Vietnamese somehow made conditions in the U.S so horrible that the U.S. had to "agree to terms they would deem unfavorable before the war"? It just doesn't make sense to even try to frame it that way.

How about the U.S. in Iraq or Afghanistan, did one side 'win' because they made life so miserable for the other side that they were willing to accept conditions they would have seen as 'unfavorable' at the beginning? The question doesn't even make sense, it's got nothing to do with what happened. And indeed, it could be argued that the worse U.S. forces made the lives of Iraqis, the _more_ resistance to U.S. forces there was, it got the U.S. no closer to 'victory' to immiserate Iraqis.

Let alone wars against 'internal enemies', which if you insist on framing the Israeli/Palestinian conflict as a war, it clearly is. Did hostilities between the UK government and the IRA cease because one side made the other so miserable they had to agree to terms they would have considered 'unfavorable' before? Again, it doesn't even make sense to frame it that way. If anything, the reverse, the Irish were no longer nearly as discriminated against or as subject to military occupation as they had been earlier in the conflict, and this in fact was pertinent in cessation of hostilities.

<comment><USER6> The war I am referring to is Israel's War of Independence [https://en.wikipedia.org/wiki/1948_Arab%E2%80%93Israeli_War](https://en.wikipedia.org/wiki/1948_Arab%E2%80%93Israeli_War) \- which the arabs lost.

Subsequent conflicts are simply an extension of the same one - one side's unwillingness to accept Israel's existence.

The territories in question are occupied because they were lost in the war of 1967. Had there not been that war (effectively started by the arab states), Israel would not have taken over the Egyptian / Jordanian lands (which never had a Palestinian state there).

<comment><USER7> And meanwhile, what is it you actually want the actual people living in the occupied territories, 2, 3, 4 generations on, to actually DO? They should acquiesce to living without civil or human rights indefinitely, because some nation-states of the purported same ethnicity as them (which have never treated the Palestinians well either) lost a war 50 years ago? (it's debatable who 'started' that war, but it doesn't really matter)

People living under that kind of repression have always resisted, throughout history. Always will. You probably would too.

Anyway, this has nothing to do with the OP really, or HN.

<comment><USER6> Ok - that's a fair point.

Given that palestinians don't really have a functioning democracy, it's hard to say what the actual people 'can do'.

However - we can look at opinion polls for ideas. Right now majority of palestinians support waging a war with Israel:

""A majority of 74 percent favors Hamas way of resisting occupation. … Furthermore, 56 percent favor the transfer of Hamas' armed approach to the West Bank and 40 percent oppose that," the center noted."

[http://www.theblaze.com/stories/2015/03/25/new-poll-shows- wh...](http://www.theblaze.com/stories/2015/03/25/new-poll-shows-what-a- majority-of-palestinians-think-about-peace-with-israel/)

As long as that is the case, Israel will respond in kind. Look at what happened after Israel unilaterally withdrew from Gaza.

So when we talk about 'living under opression' we have to be mindful of the alternative which they continue to refuse.

For example here are details of the latest offer that was refused: [http://www.haaretz.com/news/diplomacy- defense/1.645676](http://www.haaretz.com/news/diplomacy-defense/1.645676)

I fully accept that it's not an ideal solution for majority of Palestinians who would prefer Israel to disappear altogether.

PS I agree that this has nothing to do with OP or HN - but any discussion of Jews (or Holocaust) turns to 'but what about the Palestinians'. C'est la vie.

<comment><USER7> > However, the Prime Minister's Office said the document was a U.S. proposal > that Israel had never accepted. "At no point did Prime Minister Benjamin > Netanyahu agree to withdraw to 1967 lines, divide Jerusalem or recognize the > Palestinian right of return. That was and remains his position," Netanyahu's > office told Yedioth Ahronoth. read more: > [http://www.haaretz.com/news/diplomacy- > defense/1.645676](http://www.haaretz.com/news/diplomacy-defense/1.645676)

<comment><USER6> We're getting into the nitty-gritty of he said-she said, leaks, etc. Maybe after a secret proposal is rejected, Israelis can not admit having proposed those things (since in the next round of negotiations, that will be the starting position that must be improved on).

The point is that there are proposals put on the table regularly. They probably do not include all things Palestinians want (Jerusalem, right of return) - but they never will. So all they have is sitting with nothing in relative squalor while waiting for a city upon a hill.

Parent comment asked me what I would do in their shoes - I'd say 'Ok, fuck this, I'll take what I can and build a life out of it - because otherwise my grandchildren will live in the same conditions'.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> After seeing this sort of _research_ , I sometimes think that we are drowning in an excess amount of scientific information regarding more humane things. I think that such approach will not let us understand ourselves better.

<comment><USER9> We need to broaden our epistemological horizons. The other day I was reading the wikipedia article on physical attractiveness; it is mostly a litany of controlled studies isolating various physical variables. This is rapidly becoming the only way we know how to think.

<comment><USER8> > [... The scientific method] is rapidly becoming the only way we know how to > think.

And for better or worse, it's not a way to _think_ , it's a way to _know_ and _prove_.

<comment><USER10> Can fashion, politics, philosophy, or religion help scientists decide what to prove or what to know? Or is that also within the purview of science?

<comment><USER8> Science is a method for getting to know the universe. Fashion and politics are unrelated. Philosophy, religion and science are the most common ways to acquire knowledge. In religion, the source is the myth. In philosophy, the source is the thought. When philosophy needed a method to get to know for better the nature, it begat science. Science produces raw data. Philosophy, or any other method of thinking for that matter, are to interpret what science collects. But paraphrasingly-quoting Socrates via Plato, in Alchibiades II 144a and 146-147, without the knowledge of the good from the bad, information otherwise is useless, and maybe pericolous.

And, it's not established that Mathematics be a science, so, shall we dismiss it[1]?

[1] [https://en.wikipedia.org/wiki/Mathematics#Definitions_of_mat...](https://en.wikipedia.org/wiki/Mathematics#Definitions_of_mathematics)

</comment></comment></comment></comment></comment><comment><USER11> "I really don't like criticising colleagues, a tendency I'm guessing we all share in science."

This. This is everything that's wrong about modern science.

<comment><USER12> I think there is plenty else that is wrong. For example:

* Corporate influence via funding studies (and not publishing the failures), as well as hiring away top researchers (e.g. Hinton by Google)

* The tenure system is vanishing, with more and more staff turning into non-tenured "associates", and fewer and fewer young hopefuls finding a successful career in science.

* Promotions are based on dubious publication metrics.

</comment></comment><comment><USER13> I am still fascinated by the possibility of genetic memory, but also heartened by the existence of skeptics. Looking forward to the debate, assuming it's a healthy one.

</comment><comment><USER14> Politics is much more efficient than hard science at getting you research grants, so the researchers adapt their proposals and ultimately their results to the market.</comment>


Google: Go ahead and hack the Chrome Book - <AUTHOR> http://techcrunch.com/2011/05/11/hack-chromebooks

<comment><USER2> This is good. But it's a little bit sad that we are at a point where companies have to assure me beforehand that I'll be allowed to, you know, use their products if I buy one.

</comment><comment><USER3> Not surprising to me as a CR48 beta tester: [http://www.chromium.org/chromium- os/developer-information-fo...](http://www.chromium.org/chromium-os/developer- information-for-chrome-os-devices/cr-48-chrome-notebook-developer- information/how-to-boot-ubuntu-on-a-cr-48) Pretty awesome though that they are bucking the trend of locking down consumer devices.

<comment><USER4> "Bucking the trend"? I can't think of a single x86 laptop in existence that's locked down.

<comment><USER3> I'm talking about consumer devices in general. XBOX, PS3, iPhones, carrier locked Android phones, iPads, you name it.

Also, this is not an ordinary x86 laptop. I think most people would assume that considering that you cannot by default install _anything_ on it, and that it has a verified boot sequence (will not boot an unsigned OS by default) that it would be completely locked down.

<comment><USER4> I think your list is the end. I can microwave metal. I can put a newspaper in my toaster. I can submerge my hairdryer in water and be amused as it pumps the water around.

Most consumer devices can do whatever you want. It's just gaming consoles and phones that can't. Everything else... do whatever you want.

Hell, handguns are still legal in the US, and you can use those to do some mighty antisocial dealings.

</comment></comment></comment></comment><comment><USER5> What really matters isn't what people can install or not. What really matters is if people can remotely verify if it's still locked or it's jailbroken. This gives organizations and users a choice to install whatever they want, or to have a verifiable environment.

It also gets you out of Sony's losing position, where you get neither security and you piss off people who have the technical knowledge to make your life harder.

</comment><comment><USER6> As someone who's enjoyed building my own customized distros & livecds with homebrew packages, I'm looking forward to being able to put my own customized chromiumOS build and other distros onto a Chromebook.</comment>


Ask HN: Finding small, local companies who need websites? - <AUTHOR> I want to stop doing overly complicated freelance jobs and just stick to small mostly static websites for local businesses. Instead of doing 1 or two big projects a month, I just want to do 4 small sites for a fixed price.<p>Any idea on where to find small companies in need of a websites locally? <comment><USER2> Join your chamber of commerce. Go to the meetings. Offer to do a talk: 'what you need to know about the web'.

</comment><comment><USER3> Have a look at the yellow pages (not online) and visit all the companies who advertise a website. I think you'll find loads of them who say 'Under Construction' or who have a very basic website. I recall looking a few years back in the Yellow Pages Book and I was amazed at the amount of businesses who advertise a website but don't have one.

</comment><comment><USER4> Here a small Hack. You can scrape a local list of new incorporations, and set up a system to check for them on google. If one don't get results, could be interested in your services, so contact them. I think it's feasible, to scrape an official list and a small script that searches google from that list, as the names of the companies normally appear in the legal sections of web pages. Regards.

</comment><comment><USER5> In terms of planning your day: start with the sales task first thing, 2-3 hours focused on selling and developing leads. Think of it as investment time.

Here's a good read on why people buy > [http://www.gitomer.com/Jeffrey- Gitomer-Little-Red-Book-of-Se...](http://www.gitomer.com/Jeffrey-Gitomer- Little-Red-Book-of-Selling-pluLRB.html)

</comment><comment><USER6> Go to Google. Search for your favorite companies. See if they have Google Places pages, Facebook pages or websites. Chances are some of the smaller ones won't have the latter.

</comment><comment><USER7> Buy google ads for " _your town name_ web design" and variants. Or get to the top seo wise.

</comment><comment><USER8> Please email me to: email@example.com I could be your first customer.

</comment><comment><USER9> Here's what I did. Even before getting an order or making a pitch, I pre- designed five Chinese restaurant websites. I sourced the images, wrote the copy and made a sample menu -everything. The websites were beautiful.

Where ever the restaurant's name was supposed to be, I put "YOUR NAME HERE".

After I completely finished the websites (it was a lot of work), I SEO'd them for local search.

Once all five websites ranked in the top 10, I went and visited every Chinese restaurant in town with a pitch and printed screenshots of each of the websites.

I told the owners if they wanted a website, they could choose one of the five. They were already online, ranking high on Google, and phone calls for orders like sweet and sour pork were already coming in on my personal line!

Their new website was ready for them to take over, right away. No waiting, no cognitive dissonance, they could have it same-day. Instant gratification!

I priced the websites cheap too, several hundred bucks. A steal.

Surprisingly, I didn't sell one. Not one. I practically gave one away for a bubble tea (I was so thirsty from pounding the pavement). Maybe Chinese restaurants weren't the right market. Should have gone with lawyers.

So I tried to rent the websites for only $25 a month. Their company name would be on the website as long as they kept up with the monthly payment. I thought it was a novel idea.

Again, not one order.

Moral of the story? There are two. 1) Wait until you get intent to buy and a deposit before working on a website and 2) don't put your personal phone number on a fake Chinese restaurant website unless you want phone calls from drunk people at one in the morning.

<comment><USER10> So what are you doing now? It seems like being able to approach small businesses is such a valuable skill.

<comment><USER9> If you believe in what you're selling, and you are convinced it can help small businesses, talking to them isn't a problem.

I design social games and write ebooks, among other things.</comment></comment></comment>


Why we start company - not only Money, dear Holtzclaw - <AUTHOR> http://www.istarter.it/blog/item/23-why-we-start-companies

<comment><USER2> I really wonder how many entrepreneurs had it clear, when they set up their companies, whether they had to become cash factories, M&A candidates or One- man bands. Probably only Mr. Holtzclaw...</comment>