Ask HN: If you found an easy way to factor large numbers, would you tell anyone? - <AUTHOR> <comment><USER2> I might avoid telling anyone that my brain carries a superweapon, but I also might put three or so of the RSA challenge numbers in an anonymous letter to someone at the NSA and the chair of the Mathematics department at Harvard saying that I'd appreciate if they could spare a room for a potentially interesting lecture in 3 years.

Another option is pastebinning an innocuous message signed with private keys of an implausibly diverse collection of sites and then dropping a link to that in front of a large audience including at least one person who could understand what big of a deal it was.

Either of these is a multi-billion dollar firecracker, of course.

</comment><comment><USER3> I'd call the NSA and ask for them to clear my name, a winnebago, a european (+ Tahiti) vacation, a uzi-carrying girl's phone number, and peace on earth and goodwill toward men.

(see: [http://www.imdb.com/title/tt0105435/?ref_=nv_sr_1](http://www.imdb.com/title/tt0105435/?ref_=nv_sr_1))

<comment><USER4> They're the NSA, they don't do that sort of thing

</comment></comment><comment><USER5> I would send Bruce Schneier (or some other security expert) and encrypted message containing a good part of their private key, to convince them I was for real, then have them decide what to do.

Just because I've figured out the math of factoring large numbers, doesn't mean I'm qualified to make the non-mathematical decision of how to handle that information.

<comment><USER6> I think I disagree. You should be allowed to do anything you want of you aren't stealing or murdering anyone.

<comment><USER5> Openly revealing how to factor large numbers without at least months of notice would _definitely_ lead to many people getting stolen from. I'd bet it would also lead to people being killed, but possibly would save more lives than it cost; too complicated to resolve. So even if the responsibility is indirect, it's there.

</comment></comment></comment><comment><USER7> Yes, I'd publish either right away or after a short delay to allow especially important websites to revoke RSA certificates. (I'd ask some better-informed cryptographers which is best.)

Perhaps you're thinking that you could make huge $$$ breaking into computers with it. Not really. There are already ways of breaking into many webservers and stealing info and crooks already do this, so we know how profitable / risky it is: not very / very.

<comment><USER8> I'm not so sure, unlike other vulnerabilities we talk about here as being nearly worthless (things against facebook, etc) this would take a serious amount of effort to protect the internet against and have a very long tail of patching. I would bet that you could get a pretty penny selling it. To either a state agency or a large criminal enterprise.

</comment></comment><comment><USER9> There's a movie called Travelling Salesman about a group of computer scientists who successfully prove P=NP for the NSA or whoever and the whole movie is them debating what to do with their discovery. It's not great, not bad, but it's worth watching if that kind of thing interests you.

[https://en.wikipedia.org/wiki/Travelling_Salesman_(2012_film...](https://en.wikipedia.org/wiki/Travelling_Salesman_\(2012_film\))

<comment><USER10> IMHO, Traveling Salesman was awful enough to poison a really interesting and underexplored cinematic well. :( It left me wanting both my mental and IP bandwidth back.

All I could think about was how great it would be if someone like Shane Carruth (Primer, Upstream Color) had written/directed it instead.

</comment></comment><comment><USER11> I'd tell everyone right away. If I've figured it out then so have other people and security doesn't exist.

</comment><comment><USER12> Yep, being open and sharing this information via a paper or papers, slide decks and videos would help the science, engineering and technology fields advance faster than anyone thought possible.

Though, the full details would more then likely need to be delayed until higher end security improvements could be created. Maybe having the top in mathematics, especially cryptography, quantum mechanics work on creating more secure algorithms to be used.

</comment><comment><USER13> Of course. If I figured it out, then someone else has. People should know that their encrypted comms are not as secure as they thought.

</comment><comment><USER14> I'd put the factors of all outstanding RSA numbers in an arXiv paper, cc'd to my lawyer and several trusted friends, and announce the release of the algorithm on Github in a week. If the solution was a device, then blueprints/quantum circuits/etc.

What I'd do next -- and whether I'd release it -- depends on the public reaction. My first priority would be to light a fire under as many asses as possible, but without hurting anyone.

</comment><comment><USER15> There was once a man called John Titor, who turned up on bulletin boards claiming to be a time traveller. He presented elaborate documentation to back his case, including photographs of his time machine, his uniform, detailed operations manual and tools for maintaining the machine. He even showed light bending around the singularity used to power the machine. He even gave a convincing explanation of how the machine worked. He fooled a lot of people, but most people never heard of him and most of those who did believed it was a hoax.

Convincing a bunch of people you can factor large numbers isn't that hard. And there have been many claimants. But there are security researchers out there that publish lists of numbers to factor of various sizes, including ones (only) they know the factors of, and ones no one knows the factors of.

However, consider what happens if you convince a small number of people you really did it. Most people will either disbelieve it until their bank accounts are emptied, or they will believe it to be no more important than any other security breach.

There are three main groups of people who would understand what it meant. The first are mathematicians who would want to understand the factoring method to push forward their research. The second are Governments and large corporations who depend on factoring for security. The third group are hackers who would want to use it to steal secrets and money.

The second and third group probably wouldn't have your best interests at heart. And many of the first group are working for the second group. So pretty much you should boast about it on conspiracy forums and the like and tell people who don't necessarily understand your accomplishment. At least you'll get a Wikipedia page and people will remember you after you disappear.

<comment><USER16> > He fooled a lot of people, but most people never heard of him and most of > those who did believed it was a hoax.

Implying John Titor wasn't real! :P

</comment></comment><comment><USER17> Yes, I would tell everybody because I'm a computational number theorist and (1) such an algorithm would _also_ be very useful for many other algorithms in algebraic number theory, e.g., computation of rings of integers of number fields which requires factoring discriminants, and (2) whatever amazing insight led to the algorithm would probably also open up many new research directions in computational number theory, just as past progress on integer factorization has done (my thesis advisor Hendrik Lenstra introduced the groundbreaking elliptic curve factorization technique, telling the world in research papers and beautiful lectures). That said, sadly I'm not optimistic that there exists a fast non-quantum algorithm to factor large composite integers. It may simply be a hard problem.

</comment><comment><USER18> No. My safety is more important than my ego.

<comment><USER19> But you could at least give advance warning. Let people in the right places know things are fundamentally broken, have them, as someone else said, revoke certificates, and other similar ways to prevent it from being absurdly catastrophic while we try to replace it.

If you found out, someone else almost certainly will as well.

</comment></comment><comment><USER20> for the ignorant (i.e. me) among us, what are the implications of factoring large numbers?

<comment><USER21> Most cryptographic methods rely on factoring being computationally difficult. The outcome of this would be the near-total compromise of modern cryptographic methods, i.e. the backbone of the internet would fall out.

<comment><USER22> No, RSA depends on factoring. Virtually nothing else does, although the conventional discrete logarithm might be related to factoring.

If RSA was broken, we'd deprecate RSA and move to elliptic curve. Continual advances in factoring and index calculus are in fact the reason we deploy elliptic curve in the first place. Almost every mainstream browser handles it fine.

No matter what happens with factoring, we should all be transitioning away from RSA anyways.

<comment><USER21> Sorry, I am not an expert. I was under the impression that RSA is still widely in use today, so the ramifications would be quite devastating.

<comment><USER22> RSA is in wide use, but alternatives to RSA are also widely deployed --- bordering on ubiquitous. A total break of RSA probably wouldn't be that much more traumatic than, say, Heartbleed was.

Multiple times over the last 15 years, we've had for all intents and purposes comparable breaks --- BERserk and the original rump session Bleichenbacher e=3 breaks, for instance --- which broke TLS, to the point where you could stand up an evil server and DNS-MITM people to it, and compromise pretty much everyone running (say) Firefox. It wasn't the end of the world. The patch for "integer factorization is solvable in polynomial time" would be slightly more dramatic than the e=3 bug, but not much more: everyone would just deprecate RSA and use ECC.

<comment><USER21> Gotcha. Very interesting. Thanks for the information. I didn't expect that a compromise of RSA would have such a (relatively speaking) small impact.

<comment><USER23> You wouldn't want to use a browser so old it doesn't support ECDSA with P-256 (e.g. Android < 4.0). There would be a lot of scary stories in the media, but servers can switch to ECDSA (e.g. let's encrypt supports it). Devices which cannot be updated (e.g. credit card terminals) would need to be replaced.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> I can show this and more, alas this CSS margin is too small to write my proof!

(apologies to a real mathematician. who. was. also. correct :-))

</comment><comment><USER25> I don't think so, I would probably just try to make a lot of money from it, as unimaginative as that may be. Telling would almost certainly invite a large amount of unwanted attention.

Oh, and maybe keep using it to factor the keys of whoever I really don't like, and publish them, just to make their life a little more difficult.

</comment><comment><USER26> This is similar to discussing what one would do if you invented an efficient quantum computer, which is something many private companies and governments are chasing. If one government had this ability they'd have no incentive to disclose it, they'd just crack every encrypted communication out there.

</comment><comment><USER27> I would send Mr. Obama a mail signed by Mr. Putin's private key. The message would just be: "All your mail are belong to us, sucka". After which, I will send Mr. putin the same message but signed by Mr. Obama. :)

</comment><comment><USER28> SETEC ASTRONOMY

</comment><comment><USER27> Ohh, and I would found an business to provide psychological counseling for ex- NSA employees. :D

</comment><comment><USER29> "I'd sell it to the NSA for some bitcoin"

</comment><comment><USER30> Sure, I would find it hard to monetize, it'd be easier to ask the Chinese for help cash it in.</comment>


Things We Love About Java - <AUTHOR> https://blog.jetbrains.com/idea/2020/05/25-things-we-love-about-java <comment><USER2> For free open source binaries:

download link: [https://adoptopenjdk.net/](https://adoptopenjdk.net/)

license link: [https://adoptopenjdk.net/about.html](https://adoptopenjdk.net/about.html)

</comment><comment><USER3> Java and Kotlin are both great languages. I do wish it was simple to build / run like Go though. Dealing with gradle is a huge pain. The only reason I use Go over Kotlin for personal projects is that setting up and maintaining a gradle project is quite a chore.

<comment><USER4> Just use Maven. Works very well w/ Kotlin.

<comment><USER5> Maven is IMO the best choice for Java and Kotlin, but even maven is stupidly complex. It's sort of maddening that all JVM languages seem to suffer from clunky build tooling, though I'm certainly glad that they work as well as they do.

<comment><USER6> I like the stability of Maven, despite XML and people complaining about it's complexity, I just find it stable enough and does the job quite well.

For one of my clients, we created lots of similar microservices, similar setup but slightly differ. What I did was creating a template using maven archetypes so spinning up a new microservice for a new piece of work or simply to try something out or an ad-hoc job is a matter of seconds, so setup time is stopped being a hindrance to start something new.

Also these days there are quite few tooling that supports project generators which can give you a bit of setup to start from.

</comment></comment></comment></comment><comment><USER7> Java is definitely not free.

[https://blog.joda.org/2018/09/do-not-fall-into-oracles- java-...](https://blog.joda.org/2018/09/do-not-fall-into-oracles- java-11-trap.html)

<comment><USER8> The article specifically mentions Java 11.

I'm sure Jetbrains more than anybody knows about Java's licensing...

<comment><USER7> Oracle is so supportive, free and open that it is suing Google for copying from a free software.

<comment><USER8> Don't get me wrong, Oracle sucks, I know—but the article (kind of) acknowledges that and underlines that you don't _have_ to do business with Oracle to use Java.</comment></comment></comment></comment>


Want an Unconquerable Mind? Try Stoic Philosophy - <AUTHOR> http://www.forbes.com/sites/carriesheffield/2013/12/01/want-an-unconquerable-mind-try-stoic-philosophy/ <comment><USER2> Tim Ferriss believes in stoicism, which is how I first learned about it. Great article, it really makes a lot of sense.

</comment><comment><USER3> Forbes, you're so cheesy you make me laugh. Thank you.

<comment><USER3> Actually, it's a pretty good article - especially for Forbes. Disregard my previous comment.</comment></comment>


Ditch JS For loops - <AUTHOR> https://advancedweb.hu/2017/11/21/a_detailed_case_study_against_for/ <comment><USER2> I agree with the author that performance optimizations for the vast majority of the code we're writing are usually not addressing significant bottlenecks, but they should still include benchmarks.

I put them here: [https://jsperf.com/advancedweb- test/1](https://jsperf.com/advancedweb-test/1)

The for loop executes 20.64x faster in V8.

Again, I think that iterator functions are great and should definitely be used, but it's important to know the cost.

<comment><USER3> How much of that is because the collection based prime detector has to perform the calculation for every item in the array, even _after_ it's gotten to the 10th item?

</comment></comment><comment><USER4> Title is a little clickbaity; these are decent examples for where higher order functions may provide more clarity than for loops, but there are also good examples where for loops provide more clarity than higher order functions.

Knowing when to use one or the other is the important bit. Blindly ignoring one of the tools in your toolbox may not be the wisest choice.

<comment><USER5> Agreed, especially depending on the functional programming background of people involved in a project.

In one project my guideline simply became `for (of)` is welcome, `for (;;)` is not. If you are too busy worried about index numbers as `for (;;)` is, you may be missing the big picture (and doing a lot of "useless" math), `for (of)` at least is relatively high level, and with Iterable support `for (of)` gives you more room to more easily move things out of the loop and into higher-order iterable functions before the loop.

Also with async/await, `for (of)` can sometimes be a lot easier to reckon with than higher order functions. People don't easily grasp Promise combinators, but `for (of) { const thing = await process() }` is readable for most everyone.

</comment></comment><comment><USER6> Cool story... until you want to BREAK out of the loop.

<comment><USER7> Wouldn't a while loop be a better option there?

From what I understand the point of a for over a while is that you will iterate for a certain known number of times. But if you aren't doing that (break) isn't the while a better option so you can encapsulate the break in the condition as opposed to random locations in the block.

<comment><USER8> Say you have 10,000 lines of text, and you want to find the index of the line that contains the 302nd 'U'. You could do this with a while loop, but in the process you would find yourself setting up an index and dutifully incrementing it by 1 to keep track of the line you're currently looking at. A for loop is simpler here.

</comment></comment></comment><comment><USER9> I am going to call that wasteful. A for loop has the ability to do most of these things with ONE iteration over a list or array.

Using map/reduce/filter means iterating over each subsequent list, making what could be an O(n) algorithm a lot slower.

I understand the quest for clarity, but one has to consider each case.</comment>


Millennials' distrust of banks is spawning a new breed of startups - <AUTHOR> http://www.businessinsider.com/millennials-distrust-banks-new-startups <comment><USER2> Who are these 'millenials'? Apparently these 'millennial' exist somewhere, and according to the definition I am also apparently one of them, and yet I nor the shit ton of young people around me distrust banks. We use banking everyday.</comment>


Be wary of one-time pads and other crypto unicorns - <AUTHOR> https://freedom-to-tinker.com/blog/jbonneau/be-wary-of-one-time-pads-and-other-crypto-unicorns/ <comment><USER2> Another way to say this: there's a hierarchy of ways in which cryptography fails.

At the very lowest level, a cipher can catastrophically fail, like FEAL-4 did.

Going up through the levels, your block cipher mode (the adapter layer that allows a fixed-size cipher to encrypt a whole message) could be improperly constructed. Your random number generator could be biased. Your messages could be unauthenticated. You can accidentally create an oracle from observable behavior. Your key exchange could be insecure. Your UX could be insecure, so it's impossible to tell who you're talking to. Your encryption could be off by default.

Of all the levels where modern cryptosystems are going to fail, _a catastrophic failure of the cipher itself is the least likely_. It is fantastically unlikely that a secure messaging app is going to fall because AES is broken. And the best fundamental attacks on the worst ciphers still make demands of attackers that are unrealistic for message apps.

So the whole idea of using a one time pad to secure a messaging app is alarming. It's like an engineer told you they were going to design a bridge out of, I don't know, lithium to save on weight.

There are lots of ways for a cryptosystem to fail. Unlike fundamental cipher breaks, which are so extraordinarily rare as to be discountable, some of them are _very, very_ likely. In cryptography engineering, the way these problems are mitigated is to use standardized, well-known, well-tested constructions. Any time you leave the golden path --- an AEAD stream cipher construction --- you're risking lots of flaws across every layer of your cryptosystem. Doing that to avoid an AES break is malpractice.

Also, as this post points out: this app didn't even use an OTP. It used a stream cipher keyed by the HMAC-DRBG (iirc) embedded in JVM SecureRandom. So there's that, too.

<comment><USER3> Serious question: does the same apply to encryption between routers? Like large PiB/day loads. Between the old 'bandwidth of a 747 full of tapes' exercise and the speed of XOR, I've wondered for awhile now why it isn't standard. Specialized entropy sources can make a lot of the stuff rapidly, and it seems like a case where reducing that layer of security to a a couple consumable tapes that get swapped out like batteries when they're dead would be practical, and would have the advantage that seizing the cipher clearly involves having several tens of grammes of tightly-encoded data.

<comment><USER2> It doesn't matter how many AES ciphertexts you collect. No number of them that physics suggests could ever be feasible will allow you to break the cipher. That's part of what makes one time pads so silly. The gap between the security margin of AES and the "infinite" security margin of a one time pad is totally meaningless in reality. Meanwhile, attempting to use a one time pad has huge collateral costs throughout the rest of the system.

</comment></comment></comment><comment><USER4> "Uses, or claims to use, one-time pads" is, by itself, strong enough evidence that an encryption product is bogus that you'd be wise to not use the product based on that evidence alone.

Similar is the claim that it uses a proprietary algorithm.

[https://www.schneier.com/crypto- gram/archives/1999/0215.html](https://www.schneier.com/crypto- gram/archives/1999/0215.html)

</comment><comment><USER5> So, there's a pattern I'm noticing again and again. Whenever a startup announces a new secure communication product, extremely knowledgeable and respected people in our community write posts talking about the (awful) mistakes they've made.

In the wake of the Snowden revelations, its incredibly important that we bootstrap a usable new generation of software with security at its core. But I'm worried that lots of people will be afraid to make security a core feature of their product because of the bad press they'll get if they do it a little bit wrong. Frankly the security community does not have a history of making systems that my mum can use. We really need an army of software engineers to work on fixing this problem and I don't think blog posts like this are helping. (Notable exception is Textsecure).

In this case, as I understood the press release:

\- The QR code is used to initialize a direct (encrypted) bluetooth / wifi direct connection. Taking a picture of the QR code isn't enough to get the one-time pad.

\- Cameras on modern mobile phones should be able to generate more than enough entropy (even if this isn't happening _yet_ ).

But there is no discussion of these points so far. Everybody is just piling hate on the product for its failings. We need to be better than that if we want a secure app ecosystem.

<comment><USER6> It ends up being a product of the fact that the smartest crypto folks aren't software developers, and the smartest software developers (or the most innovative -- the guys starting companies or building products) aren't crypto folks.

So you have a bunch of what are effectively scientists who aren't all that familiar with how products get made (first build _something_ , release it, then refine it over time through feedback) and you have a bunch of developers who aren't familiar with how security products are managed (you _don 't_ release anything until you're willing to put people's lives on your product).

What you're left with is an ecosystem of developers releasing code that's not cryptographically sound because they need feedback and a community to help them refine the software, and crypto scientists who scream bloody murder every time they find a bug because, "what if the next Snowden uses your new tool!?!"

Everyone's right in this argument, it's just hard to bridge the gap between these two _very_ different schools of thought.

<comment><USER2> Snowden and Greenwald _actually used_ one of the most popular of those tools, as you know, and according to the person who did the most conclusive, reputable, and devastating security analysis of that tool, they used it during a time when it was catastrophically broken.

The clear message you are trying to communicate is that the security community hyperventilates over security problems to the detriment of the community. That's not what happens. Look at Lavabit --- another example: the problem with serverside encrypted Internet email was absolutely written off as hyperventilation, to the detriment of every single Lavabit user, whose communications were almost certainly recorded and are, as a result of the way Lavabit handled a request for Snowden's communications, retroactively decrypted.

<comment><USER6> Since our prior conversations, I've softened on my stance and at this point I think it's mostly just a UX issue. I don't think you or any other expert is _wrong_ in being as... "hyper" about the problems in current software. I just think "your" (as the stand-in for crypto experts everywhere) solutions are, while strong, not the best UX, and I consider UX to be a critical part of security -- if people won't use it, then it's not good.

All I'm saying here is that there's a disconnect between security and usability that needs to be bridged, and sometimes one side forgets about the difficulty of correctly implementing the other.

<comment><USER2> I'm sorry, but just to make sure I'm getting my point across, I'm going to restate it more simply:

Security people freak out at new amateur encryption tools because when they don't, those tools get adopted by hapless users who entrust real secrets with them. It's not a theoretical concern; it happens over and over again in the real world. It happened to Snowden _twice_ , once with Cryptocat and once with Lavabit. In both instances, crypto experts begged people not to use those tools. In both instances, misguided privacy advocates pushed back on the crypto experts. The tools either didn't get fixed (because, in Lavabit's case, they couldn't be) or didn't get fixed in time. Almost certainly, NSA has decrypted intercepts as a result.

It's happening right now with other tools. It will, with certainty:100%, happen again with Cryptocat.

During the snake oil era of medicine, people used to take radium tonics as a cure-all. That's what these tools are: radium tonics.

<comment><USER6> That's not really what I'm talking about, though it is a manifestation.

"Don't use the tool" is a cryptographically sound piece of advice, given what you know about the specific implementation, but it's utterly useless for Cryptocat, from a product standpoint. What's a developer supposed to do when a crypto expert just says, "no"? That's terrible feedback, it needs to be better, and it can be better (sometimes it actually is better, I think you've mentioned in the past that you've lent a hand to Cryptocat).

As with every other "theory vs. practice" discussion, the theorists need to tone down the rhetoric, and the practitioners need to actually listen to what the theorists are saying.

<comment><USER2> To be clear: I've never done anything to help Cryptocat, nor will I.

The right thing to happen with Cryptocat is for it to be scrapped. Its security issues pervade beyond bad cryptography. Its users are literally better off with Google Hangouts or iMessage.

And, in fact, the same was true of Lavabit: there _was no recommendation_ that would allow a mail service that worked (for users) the same way Google Mail to resist serious attacks. But that was the premise of the system! It needed to be scrapped.

<comment><USER6> And _this_ is the nonuseful advice that the crypto experts need to stop giving. Joe Developer sees this advice and decides _not_ to write crypto software.

That's unambiguously bad, because the software industry _thrives_ on failing a lot until a good solution is found.

There needs to be a way to develop crypto software that falls in a land of, "Don't use this _yet_ , but maybe someday after we're done testing it, you can start using it and be secure" rather than "nope, just scrap the whole thing".

<comment><USER7> You are wrong on practically every account:

> Joe Developer sees this advice and decides not to write crypto software.

False. Moe Manager stomps his foot and makes Joe Developer wire together "something good enough", regardless of Joe's qualifications. Since neither Joe nor Moe are able to tell how good a crypto system is, they invariably end up with something in the awful-to-kludge spectrum. Both Moe and Joe need to be repeatedly reminded that they don't know enough about this non trivial problem to make good enough calls.

> That's unambiguously bad, because the software industry thrives on failing a > lot until a good solution is found.

"Unambiguosly bad" is a thought stopper, a rhetoric trick. This just means that since you don't like any of the options made available to you by reality (like... paying big bucks to a real expert), self deception is preferable.

Now, the fact that our software industry thrives on failure... I am ashamed to say that this just means our industry is really good at externalizing the consequences of our own incompetence to the customers. This is all good and fun, until real lives are on the line. Crypto is one of those cases, so it is one of those lines you don't cross.

> There needs to be a way to develop crypto software that falls in a land of, > "Don't use this yet, but maybe someday after we're done testing it, you can > start using it and be secure" rather than "nope, just scrap the whole > thing".

Are you familiar with the term "Security by Design"? It is one of those pesky realities I was talking about. It basically says that you cannot create a product giving no concern to security, sprinkle some crypto fairy dust on top of it, and magically turn it into a secure product. If you try to do that, you'll end up with a product with broken security.

Which is not all that bad in practice. There are lots of useful products that we all are better of having in insecure form than not having at all. But if the whole point of product X is to be "Y, but done securely" there is no redeeming feature that can save X from the axe.

<comment><USER6> I'm not sure how to respond to this. On one hand you talk about "rhetorical show stoppers", and on the other hand you reply to a statement I've made with the one word sentence, "False.", and in another sentence you say I'm "wrong on practically every account".

I guess I could point out that there lies, in a continuum of software, a place for experimental products which offer nothing other than the exploration of an idea and the opportunity to refine said idea through testing and discussion. I could also point out that your strawman of "sprinkle some crypto fairy dust" is entirely irrelevant to this conversation, and that your lack of understanding of how threat actors are modeled is evident in your inability to comprehend a tool that might protect against certain threats but can acceptably not protect against all threats.

But I think those points would fall on the "ears" of someone who just wants to be combative. Maybe someone else will pick up where you left off and engage in a more honest and less antagonizing manner, but this deep in the comment tree, "here be dragons".

<comment><USER7> I guess am sorry that we ended up in bitter ends of a pointy discussion. For what's worth, I was not trolling. I stand by anything that I said (specially the "sprinkle of crypto fairy dust", which I have seen IRL more often that I wish). If I am ignorant or not, I am by definition unqualified to tell.

Other than that, if you prefer to have non combative discussions, please stop bossing professionals around and tell them what to do. Specially if they are not providing a service you paid money for.

<comment><USER6> I am a professional and I "boss" other professionals around on this topic (admittedly, mostly other topics, but this specific one does come up) for a living.

But it's funny, because what you're saying here (don't "boss" people around) is similar to what _I_ am saying, with regard to experimental crypto software. The crypto experts need to let the developers develop, and find a constructive way to contribute to that process, rather than chicken-little every time a bug appears.

Imagine software that comes out, stating: "This software is not meant to do anything other than hide your porn from your mother. Please do not use this software to do anything other than protect yourself against a threat who has limited understanding of computers and software."

As that software matures, the disclaimer could expand to, "This software is not meant to do anything other than protect information against low-level criminal activity. Please do not use this software to do anything other than to protect your information from larceny or identity theft. This software will not protect you against a sophisticated or well-resourced actor."

Eventually expanding to, "This software has been tested by a community of crypto experts. While there is currently no known reason why this software won't protect your information from all bad actors, there is no guarantee in place that your information is absolutely safe. Always exercise extreme caution when protecting your data from sophisticated actors."

The idea being that, once an _experimental_ piece of software becomes "good enough", it can be used to protect against a more diverse threat model.

The idea that you _have_ to ship an NSA-proof product on day 1 is completely unfeasible and will _never_ happen, and the crypto scientists out there need to realize that.

<comment><USER7> You keep talking about bugs and therefore you keep missing the point. As a matter of fact, I tend to agree with you that the Infosec community would benefit enormously by adopting some of the best practices that we lowly programmers take for granted. There would arguably be less bug and less high- profile bugs that way.

What I am trying to point out is that you cannot fix a flawed Security Design by incremental improvements. I am not talking about individual coding defects or even desirable features that have been left temporarily unimplemented on purpose. I am talking about Stupid!Ideas that get implemented because there was nobody around that recognized them as such, and then the usual traits of human nature (denial, previous investment bias, rationalization, etc) prevents the incumbents from scrapping those ideas until insurmountable evidence is assembled.

The article in question talks about using One Time Pads (OTPs) to conceal secrets. This is an idea that sounds good, OTP is mathematically proven to be "unbreakable" and all that... The problem is when theory meets practice and nobody asks the hard question: How are sender and receiver going to share the OTP prior to sending the real message.

This is not a trivial question to ask, giving the fact that OTP must have the same amount of bits as the message it is protecting. You can also not "recycle" a single OTP for many messages (that would be a Many Time Pad, which by definition violates the very preconditions that make OTP secure).

So, you end up with the scheme used in spy movies (I have no idea how real spies worked during the Cold War). Each spy carries around a code-book of OTPs that he received in hand by a trusted contact. The fact of being in possession of such book is itself a proof of being a spy so he was to take great care to hide it, which is hard because it is a whole book (OTP, lots a lots of messages). Also, the spy agency will have the cumbersome work of providing a different code-book to each spy (because otherwise, when the enemy catches one spy, they could theoretically run the OTP on all previous communications from suspected spies and have each one of them rounded and shot before the word comes out that the first spy was in prison).

This example also serves to illustrate another point. Maybe a Bad!Idea can be made to work in a limited way, if need is dire and resources are plenty. But any organization which kept secrets of real importance and tried to rely on this kind of solution would end up eaten alive by any adversary that had heard the words "asymmetric cryptography" spoken together.

<comment><USER6> I'm trying to understand how you could possibly think I've been talking about "Bad!Idea" at all.

I really can't find in anything I've written where I talked about writing a "bad" piece of crypto software. In fact, I've been talking about a potentially "good" piece of crypto software that isn't getting written because no software is perfect, but that's what crypto experts are demanding out of the gate.

Can you more succinctly sum up what you're trying to say? Do you think software shouldn't be written in the crypto space unless it's perfect from v0.0.0? I can't imagine you think that, so I'm wondering what exactly it is you're arguing here.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I'm not a crypto expert, but I understand the terms and arguments made in this article.

"Wary" is the key word. If I have a true physical RNG, I can certainly make 2 DVDs full of identical random numbers. I can share one with you -- physically, not using email or barcodes. We can then communicate in the open, saying something like "beginning at position x on the DVD, here is my message" and nobody can _read the part of the message that travels between the crypto functions_

They can still read my keystrokes, or gain entrance to where I work and video record me. They can gain useful information simply based on the pattern of you and I communicating. They even may be able to surreptitiously copy our OTP by using compromised software. But the OTP part is secure.

The real problem is that the entire OSI stack is a leaking piece of crap. It's been broken at every level. So even if you have "perfect" crypto? It doesn't matter so much.

ADD: Nothing's stopping you from using a OTP on top of a normal set of crypto algorithms. I like the OTP idea -- I'm just not sure in the current environment you're getting anything from it.

<comment><USER9> _> They can still read my keystrokes [...] They even may be able to surreptitiously copy our OTP by using compromised software._

 _> The real problem is that the entire OSI stack is a leaking piece of crap._

How is breaking into your computer an issue of the OSI stack? Are you using "OSI stack" as synonymous to "the whole operating system with all its running processes"?

<comment><USER8> Yes, I was, but more specifically I was giving two examples of the types of insecurities found in modern technology. It was a broad argument and a loose choice of examples. Thanks for pointing that out. The point was that "don't try this at home" is a little over-used from experts. Even novices can poke holes in the idea here -- so perhaps my loose argument was appropriate.

</comment></comment></comment><comment><USER10> The sad thing is that really cool, potentially world changing, crypto has been created in the past few years but its not the crypto that gets media coverage. Concepts like Fully Homomorphic Encryption and Secure Obfuscation may revolutionize security in the coming years, but nobody has heard of them precisely because they were published in scholarly journals instead of popular science magazines. Maybe cryptographers should create useless apps that claim to solve all security problems whenever they come up with actually important crypto :)

<comment><USER11> Well.

Homomorphic encryption is still very much an emerging tech. For most applications it's still too slow. There's all sorts of cool things we can build when it gets a bit more mature, but for now it's not unreasonable that there's no press coverage of it.

On secure obfuscation - there was actually a wired article about this (unsurprisingly the title was rather overhyped and click-baity), so I don't think it's fair to say it didn't get press coverage. This is closer to being usable in the real world and thus got more press coverage. Again though, it seems unfair to complain about the amount of coverage it got, because regular readership can't go out and use it yet.

The problem IMO is more that there's a conflict between the big splashy software release that gets you lots of users and attention, and the slow careful discussions on crypto lists that gets you more confidence your software is actually secure before it's in the hands of end users.

Without the big release, it can be hard to build a user-base - and if no-one uses your new more-secure messaging app it doesn't really do a lot of good. Without the slow discussions you're potentially endangering your users. Some sort of compromise is probably the answer, but I'm not sure exactly what that should look like (although I have some ideas).

</comment></comment><comment><USER12> > RC4 is almost 30 years old now, and despite it being "broken" practical > attacks still require enormous amounts of ciphertext and would probably not > affect security in a meaningful way if you deployed it in a messaging app.

Sure, but please use ChaCha20-Poly1305 if you can. Two libraries (nacl and libsodium) implement it for you; libsodium is a portable implementation of nacl with bindings for most popular programming languages.

<comment><USER2> Sodium/Nacl is a good recommendation. If you can use them, do.

If you're not using Sodium/Nacl, don't go out of your way to use Salsa/ChaCha/Poly1305. If your platform has a good AES-GCM, that's also fine.

The important thing is to use the best tested, simplest interface available to you. If switching from AES to ChaCha means you have to do any of your own protocol design, it's not a win.

<comment><USER12> > If you're not using Sodium/Nacl, don't go out of your way to use > Salsa/ChaCha/Poly1305.

Right, sorry if I implied that anyone should roll their own crypto libraries.

 _Use the standard implementations!_

[http://doc.libsodium.org/bindings_for_other_languages/README...](http://doc.libsodium.org/bindings_for_other_languages/README.html)

For PHP developers: [https://github.com/defuse/php- encryption](https://github.com/defuse/php-encryption) (wrapper for openssl)

</comment></comment></comment><comment><USER13> I have a few comments/questions about the post:

1) Why is a mobile phone random number generator good enough to generate encryption keys, but not good enough to generate one time pads? What extra weaknesses do one time pads expose?

2) For their 2nd point, Zendo has said that the pad exchange happens locally ( device to device ). So you would need to be in the room to eavesdrop. So the transport mechanism they choose there is a little bit less of a risk I think.

3) Their 3rd point also doesn't seem to be that big enough of a deal to warrant the tone... if sha256 is broken, a man in the middle would be able to corrupt messages, but not in a meaningful way ( ie switching yes to no ), it would just look like garbage to the other person...

I think #1 is probably the biggest issue, I'd like to understand it a bit more.

<comment><USER2> 1\. It's not that SecureRandom isn't "good enough" for an OTP. It's that it's _not_ an OTP. It's a keyed deterministic bit generator. Its security depends on attackers not having its key. The problem isn't that SecureRandom is a devastating weakness; it's that using it for a pretend OTP creates not an OTP but instead a stream cipher based on an HMAC keystream. The irony is that the hash function underneath HMAC is far more likely to fail than AES is. But it's a theoretical observation, not a cryptanalysis.

2\. It's a key exchange that can be attacked with a video recorder and, more importantly to this analysis, that depends on AES. There is no point in using a one time pad whose key is encrypted with AES; you might as well eliminate the added risks of a one time pad and just use AES.

3\. Integrity failures in cryptosystems tend to produce confidentiality failures. For instance, error oracle attacks depend on attackers injecting bogus messages and observing behavior. You can't have confidential message encryption without message integrity.

<comment><USER14> Still, it reminds me of Snuffle. Remember the lawsuit?

</comment></comment></comment><comment><USER15> There are old established methods to guarantee sufficient security for message encryption, it's rather trivial and idk why every other new product has to reinvent the wheel. Key Exchange on the other-hand is hard and much more likely to be the failure point.

</comment><comment><USER16> Usually, the complaint with OTP is how to move a copy of the pad in a way that is both secure and still useful/practical. I think there is a simple solution to this (at least some of the time) if you limit the scope to "friends that meet occasionally".

What I want to make[1] is a pair of basically any embedded micro, in a "thumbdrive-ish" (or whatever for the prototype) size that has some amount of flash on it to store the pad, a USB interface, and a hardware-RNG[2]. Additionally, there is some sort of serial interface that will be used to null-modem two of these devices together.

When connected, the devices generate public keys (for authentication, etc), and generate noise. They send the noise to each other, and save the XOR of the noise to flash, so no device has total control of the generation.

The idea is that the "user experience" would be this: go over to a friends house, and plug your devices together for some period of time (hours, probably, but it can be cut off early). Then when you go home, plug it in to your computer and you can chat securely, slowly burning the pad from flash automatically. This is done over USB, so the pad never leaves the device. The firmware can handle the destruction of the pad as it is used and other details.

This doesn't solve everything, and the pad _would_ run out fast if you wanted to send non-text data. What it should do is make it trivial for two parties to chat/email securely. Details like refilling the pad (visit friend for dinner, plug devices together while you eat) shouldn't be hard for most people, as long as they can see how much pad is remaining.

[1] I plan to implement a prototype of this as soon as I have spare time & cash for some hardware to experiment on.

[2] probably using something like the reverse-biased transistor method discussed in TFC

</comment><comment><USER17> _" We don't need crypto unicorns so much as we need diligent engineering to deploy the crypto we already have."_

If we took this seriously, we would all still be using modified versions of DES, which, in a twisted way, we are. This isn't a good argument for ignoring new implementations of different cryptosystems.

 _" If a new crypto tool is first announced in a press release or popular science magazine, don't use it."_

This is far more accurate, but i'd extend this even further and define it as: "Don't use any new crypto." (Unless it comes from someone with high social influence in the sphere of cryptography research, of course)

<comment><USER18> I don't think DES is an accurate comparison here. The world abandoned DES because a) everyone suspected it had a backdoor, and b) it was demonstrably broken by the EFF in 1999. We rely on a primitive until someone who's job it is finds holes in it. Engineers don't need to be inventing new encyrption.

<comment><USER2> DES was abandoned because its key size was too small. It also has a block size that's too small for safety, which is why we don't use Triple DES or Blowfish as bulk ciphers either.

Ever since Biham and Shamir published the differential cryptanalysis, we've known that NSA didn't backdoor DES, but rather helped strengthen it against that attack. Concerns over a backdoor had nothing to do with it.

</comment></comment></comment><comment><USER19> So in order to start breaking Zendo, you need to break AES-256 and SHA-256?</comment>


Stellar, File System for Human Interaction - <AUTHOR> https://www.behance.net/gallery/22032379/Stellar

<comment><USER2> How does the UI scale with display size?

How are system files tagged and treated?

Does search weight results? Eg: If there are multiple documents named "foo", which ones go to the top?

What does the timeline look like when information density is high?

With a mouse, do other clicks beyond the primary "left" click do anything?

What does the system do when foreign files are detected? Eg: plug in a thumb drive?

</comment><comment><USER3> This system organizes files in a very efficient way. It could save us so much time everyday and the interface is very good-looking. It seems this system can't show the size of each file or copy/paste a lot of files simultaneously. I really recommend this and hope this could be implemented soon!

</comment><comment><USER4> \- Looks really cool! \- What happens if I needed to transfer thousands of pictures, how are they labeled, if there any efficient way of batch-labeling all files?

</comment><comment><AUTHOR> It's convenient for people with little knowledge about computer, easy to understand and use.</comment>


Build a serious WordPress server for high traffic website  - <AUTHOR> http://www.beyondlinux.com/2011/11/10/build-serious-wordpress-site/ <comment><USER2> nginx has a feature to upgrade the binary without any lost requests:

[http://wiki.nginx.org/CommandLine#Upgrading_To_a_New_Binary_...](http://wiki.nginx.org/CommandLine#Upgrading_To_a_New_Binary_On_The_Fly)</comment>


How Japan Copied American Culture and Made it Better - <AUTHOR> http://www.smithsonianmag.com/travel/how-japan-copied-american-culture-and-made-it-better-180950189/?no-ist <comment><USER2> There are plenty of other examples from America, including vintage Ford Mustangs, Winnebagos, Converse tennis shoes and Baseball. I spent a couple of years expatriated to Japan and learned that for a Japanese person to admit they had a hobby or interest actually meant they were expert with it. You wouldn't admit you 'enjoyed playing violin' in your spare time unless you were a maestro. If you were not an expert, you would not talk about your interests. If a Japanese colleague mentioned they had 1966 Mustang, you could be certain it was perfect. For many Japanese colleagues, if I spent enough time drinking with them, I'd find a surprisingly intense sense of pride and mastery in an obscure area of interest. You'd never know about it unless you spent time enough to get past their modesty so they'd talk about it. I'd venture that this is the source of the author's observation about not just copying, but improving.

There were also some pretty twisted counter-examples of not getting Americana quite right. I ran across an outer wear store named 'Violence Jack Off', display windows crowded with black leather jackets.[Edit]

<comment><USER3> Possibly a play on "Violence Jack"?

[https://en.wikipedia.org/wiki/Violence_Jack](https://en.wikipedia.org/wiki/Violence_Jack)

</comment></comment><comment><USER4> Almost everything is better in Japan!

\- Taxi doors open themselves (and the drivers wear white gloves)

\- Subway maps light up to indicate where you are

\- You can hold your table at a cafe by leaving your phone or keys or wallet & nobody will steal it

\- Take out coffee often has a piece of tape so it won't spill

\- People are friendly & cheerful when you met them (although they are much the same when you get to know them)

\- Goods are packaged beautifully (if perhaps excessively)

\- Sexuality is much more specialized (if sometimes bizarre)

\- French pastries are better than in France

\- Even ice cubes are better

\- I could go on and on...

While Japan has many flaws almost any "thing" you can point to, if not always better, is usually better. What is perhaps more interesting is the things that are worse.

<comment><USER5> "What is perhaps more interesting is the things that are worse."

First and foremost I believe is resistance to change. The reasoning of "because that's the way it has always been" and general bureaucracy means change is very slow to come. When change is actually put into motion it occurs with amazing efficiency but initial resistance seems much stronger than many other cultures.

Anyway, my personal counter list might go like this:

\- Blatant sexism

\- The work emphasis placed on quantity (time) over quality

\- Despite a reputation of High Tech, requiring paper (printed) documents for nearly everything.

\- Meeting people outside of work/school is so unusual that often you can make someones night by striking up a conversation in a bar. Great for the visiting tourist but seems suffocating for many Japanese.

\- Fantastic food often ruined by the people chain smoking right next to you.

Still really enjoy living here, but I fortunately don't have to deal with the Japanese work environment like many of my friends do.

<comment><USER6> Don't forget trash cans. I regularly spend 10+ minutes walking around looking for a trash can. I know they got rid of them due to terrorism but c'mon that was 15 years ago.

<comment><USER7> That's not true. They generally consider it people's own responsibility to take care of the trash themselves by taking it home & disposing of it there.

Most people don't stop to think: it costs money to dispose of trash. Here they just don't believe the city should have to foot the bill for your garbage. Different way of thinking about it, is all.

<comment><USER8> No, it's a lack of consideration. That's the paradox of Japan. They consider a lot, say spending zillions on the care of vegetation by the municipality. But then you find that there's not enough waste cans to dispose of the trash from the street food you just bought. They could tax the vendors a bit more, have them pay for the waste removal they are ultimately generating, then everyone's happy.

Then there's the lack of soap dispensers in restrooms. you know where you might have just had an accident, you get to clean up your hands with just water. Then jet dry all the particles into the air on that overbuilt $1900 unnecessary hand dryer. You know for the sake of cleanliness. I guess dry hands are clean hands right?

It's a different way of thinking about it. So the guy who had shit on his hands, cleaned it up, but it's still on the faucet. Now I've touched the faucet (with my had because no towel dispenser of course) and I've got his shit on my hands. Real cool. But they good thing the hedges outside the restroom look so nice.

<comment><USER9> To the untrained eyes, it may appear that there is no where to throw trash away in Tokyo. This is because the Japanese have cleverly disguised the trash cans as vending machines (PET bottles/aluminum cans) and convenience stores (other garbage).

</comment></comment></comment></comment></comment></comment><comment><USER10> A remarkably American centric article, in which the author appears to see America as the origin of things instead of just a dot on a long line that has always been weaving back an forth between different cultures and countries.

A casual remark betrays this blind American-centrism: _" the new American hipster ideal of Brooklyn is clumsily copied everywhere from Paris to Bangkok"_.

Seriously? Coming from Amsterdam I have a hard time seeing the American hipster culture as anything other than heavily copying Northern-European lifestyles in a way that strongly reminds me of how Japan so often imitates Western cultures. (Also the same pattern, stuff that is added or reshaped in America appears here again, which may confuse the author. But "clumsily copyied", are you f-ing kidding me?)

Interesting article, but the lack of perspective bothers me.

<comment><USER11> I agree...

I visited Stockholm in the 90's and there were many many young people there that were defacto hipsters in they way they dressed, bought vinyl, used old film cameras like lomo's etc. etc. way before I saw the same in London or New York.

I have this view that the individualist fashionistas all around the world are in realtime creating a movement like hipsterism without realising it, and for the most part people think they look like idiots, but every now and again the right person hits the right look at the right time and there's suddenly lots of people copying it, and validating the look creating a movement.

</comment></comment><comment><USER12> I feel the Japanese struggle within their overcrowded society and that "specialization" is a way that one can have his own corner of freedom. If you go over there, you will notice that people work extraneously long hours, get paid little, and are constantly playing an intricate interaction model where seniority, class, sex, origins all play major roles. This is why so many went into video games, anime or manga. They need an escape. And just as you find that drive within their work, which is at the most strict expectation level, you can find traces of it in their hobbies.

<comment><USER13> Is Japan overcrowded? Because I don't think it is. Yes their cities are (I fail to understand the drive to live in a city, I see mostly disadvantages) but they have a large amount of unpopulated areas which, if people spread out, would not be considered overcrowded? Unlike the Netherlands where I'm from for instance, which is basically a big city.

<comment><USER14> And Drenthe.

<comment><USER13> And Drenthe.

Edit: I love HN, people care to downvote this joke on a sunday. Must be Drenthenaren who feel discriminated on. Sorry, it wasn't meant that way.

</comment></comment></comment></comment><comment><USER15> One thing that it's difficult for foreigners to acknowledge is that Japan is so completely different to the western world that it's almost impossible to comprehend. Articles like this, and the musings of western visitors/workers, read more to me as people misinterpreting their surroundings and misunderstanding Japanese culture. I'm convinced that a lot of Japanese have difficulty understanding the current state of their own culture too. The best way I can describe it is that western culture (capitalism/consumerism/democracy) does not mix well with traditional Japanese culture and has resulted in a bizarre chaos. My first-hand experience has shown me that a lot of Japanese prefer the traditional culture to what they currently have and I do not blame them one bit.

<comment><USER16> What makes you say that it's impossible to comprehend?

I've been here on and off ~8 of the last 16 years. Several non Japanese friends that have been here 10, 15, 20, 25 years. I don't get the impression any of them have a hard time comprehending any of it.

As for some Japanese (not all by a long shot) preferring traditional, first off, those are not all or even most. Many of those that do are similar to people in the west that prefer "organic" or "natural" or "traditional" for arguably no rational reason.

I don't personally know any Japanese that want to go back to any kind of "traditional culture". Heck, I'm writing this from "The Terminal", a shared workspace in Harajuku surrounded by Japanese on notebooks. Hardly "traditional" in any sense.

<comment><USER17> I see you're still perceiving Japanese culture through your native Western lenses.

Well done on wasting those 16 years understanding nothing but the superficial.

</comment></comment></comment><comment><USER18> From my years with my Japanese wife, and the time I've spend in Japan. I've learned that the key difference of Japanese culture from American culture is is that americans consider quantity as the measure of value, and Japanese consider quality to be that measure.

Japanese people will pay more for the higher quality of equivalent goods, and are interested to learn the difference. While americans feel cheated if they pay more for a great meal served in small portions, and consider stores like costco and k-mart to be some of the best shopping choices.

I can assure you if you think Japanese people are missing the point by copying others you are very much mistaken.

They are not making a copy, they are embracing the point.

<comment><USER19> I think this is far too blanket of a statement given the radical diversity of America in most every respect.

Many Americans certainly will go for the 50% cheaper, 85% as good product. And yet America is the largest market for the iPhone, and it does particularly well here. In the not so distant past, superior Sony products - amongst people I know - used to be heavily desired for their quality.

I don't think very many people consider K-Mart to be among the best shopping choices, quite the opposite in fact; ditto Wal-Mart. Being economical doesn't mean they consider it ideal shopping.

<comment><USER18> It's very difficult to grok without seeing it at many levels for many years. And your counter point is a good example of why. It's easy to point to Americans who have plenty of money and so shop at finer stores. Nevertheless, at every level the difference between cultures is quality vs quantity.

Regardless if you and I shop at K-Mart you can not deny the market share those types of stores hold in the US. Most people who don't go to them associate them with being poor, or unfashionable products. Not because we truly evaluate, or even know how to evaluate the quality of the products they sell. This is why rich Americans are just as likely to buy poor quality expensive products. The measure is exclusivity, or status symbol, which is an aspect of quantity. Successful Americans rarely show off their good taste and fine quality, they show off the amount of money they have.

Whereas a Japanese person will go into a K-Mart or a Forever-21(low price current fashion 'knock-offs') for that matter and look at the stitching and actually judge the quality. There are poor people in Japan, who wold never buy some types of american products because they know that while it's cheep it won't last very long so the net value is lower. I rarely, if ever, see an American make that trade off (especially in business). In a quality oriented society, people actually build skills to judge quality over a life time.

Not every single person mind you, but as a culture we each lean in a direction.

</comment></comment></comment><comment><USER20> My wife is Japanese and through her I cam to a realization about this very topic.

My hypothesis is: Japanese do not accept anything less than perfection. The accompanying motto seems: "If you cannot archive perfection, don't even bother starting."

To illustrate my point; My wife might ask me to purchase something for her. Whenever I could not get the specific product she asked for, I just bought something comparable. At home she would be disappointed to her core, to the point where she considered the possibility that my intentions where nefarious. Every time this happened I was shocked. Why would I try to bring her harm by not buying the exact same thing, but something comparable? Now I was convinced that her thought-process is rather unique. Yet, to my surprise, almost every Japanese person who I befriended on a deeper level behaved the same way.

To me it seems for Japanese people there is an crucial "line of competency". An average Gaijin (non-Japanese) is seen as incompetent to act according to Japanese customs (rightfully so). Almost everything a Gaijin does, even if it is rather obnoxious, is not judged by Japanese, but accepted as: "Well..., different culture, different habits."

When they allow you in their circle, befriend you, you are seen as to cross the "line of competency" and your actions will be judged by higher standards.

Now imagine you grew up in a society where everything you do is expected to be done perfectly. And a consequence of not doing something perfect is bringing shame to you and those around you (Japan is a shame based culture, so that is extremely bad). You will not consider starting a task unless you have a very high chance of archiving mastery. If you do a task, you are not perfect in, you better hide it.

Another example: A friend of mine visited me in Japan and quite frequently asked people for directions. To his awe every single one of them went out of their way to help him. People walked for very long distances with him, making 100% certain that he will get to an ATM. In their mind, drawing on a map just did not suffice. They would walk with him all across Shinjuku station (the busiest station on the planet) making sure he will find the right train. To him these were just examples of nice people in Japan. I believe he, unknowingly, tasked these poor people with unreasonably big requests. When asking for the nearest ATM these Japanese did not consider the possibility of pointing in a direction, as this would have left too much room for error. Anything less than walking with him would have brought shame to them. Actually when you ask directions and they "just" point (it happens) look at their faces. Often thy turn away from you in shame. Or their faces will freeze as if they just did something appalling.

Imagine having a country of 129 million perfectionists. How would the society be run? Trains would always be perfectly on time. Food would always look as delicious as in the ads and taste like you hope it would. People would be very stressed committing to anything they have not done 100 times before. People would feel the constant pressure to live up to insane expectations and if they could not hold up to them, they would be anxious to leave their houses (otaku). — If you are not familiar with the Japanese culture, this is exactly like it is in Japan.

A last point to support the article, I was in Rome and an Italien friend brought me to "the best pizzeria in Italy". I must say, it was a truly delicious pizza. 3 Days later I was in Osaka and went with a Japanese friend to a "very good " pizza place. Every single slice of pizza I ate there was pure perfection. It blew the "best pizzeria in Italy" out of the water. The pizzeria in the Namba Parks is run by Japanese who studied in Italy.

<comment><USER21> Friendly advice: you should think twice before posting long comments where you systematically examine racial generalizations (and dare I say it: stereotypes!) you find to be anecdotally valid.

It's this sort of "reasoning by anecdote" that, while convincing to the individuals relating them, can easily mislead others into believing your conclusions are rational.

<comment><USER20> Thank you for your advice, I fully agree. I cannot edit my comment anymore, so I actually think about just deleting it.

Edit: I am surprised to find; I mistakenly assumed I have the ability to delete my comments. That seems new...

<comment><USER22> I enjoyed your comment, as I have enjoyed many comments here on HN that quite thoughtfully and often eloquently take the time to provide a personal context and, yes, anecdote, to a more generally reported circumstance.

Don't worry about it. I -- for one ;-) -- think your comment was appropriate and useful, in this context.

(For example, it provides me with some additional insight to my own occasional interactions with Japanese culture. Most useful, to me.)

Nor do I mean to be overly critical of the critiquing response. Yes, we do need to be aware of anecdote versus corroborated fact. But, as one other respondent has commented, we make some assumption that those on HN can judge this for themselves.

\--

This comment meant in good spirit, all around. And yes, it's just my opinion.

</comment></comment></comment></comment><comment><USER23> W. David Marx has been doing wonderful analysis of Japan and this phenomenon of trend adoption/synthesis/evolution—specifically with regard to fashion but he's covered many other topics as well—at [http://neojaponisme.com](http://neojaponisme.com) for years now.

Don't lose your weekend to the archive. Or, you know, do.

<comment><USER24> But be aware he's considered something of a blowhard and not taken very seriously by the expat community in Tokyo.

<comment><USER25> But also be aware probel always says the opposite of the truth and is a little too overly beloved by the expat community in Tokyo.

</comment></comment></comment><comment><USER26> > _Dylan is, in fact, the bar's reason for being: Japanese fans come here to > watch his concert videos, listen to his tapes and relive the '60s in > America, a time and place almost none of them witnessed firsthand._

Are there any places in America where one may do this today?

<comment><USER19> I've found that a lot of (all?) major cities in America have throw-back diners and similarly themed restaurants (I don't know any specific to Dylan mind you).

<comment><USER27> There should be. Dylan is awesome.

</comment></comment></comment><comment><USER28> The fashion industry owes an enormous debt to Japan for preserving American heritage after America threw it away.

<comment><USER19> This is hardly accurate. Cultures regularly "throw away" and then later rediscover (re-popularize) pieces of their own historical culture / identity. It has nothing to do with it being preserved by another culture (such that if it weren't, it could have never existed again).

<comment><USER29> Yes. Western civilization became estranged from scientific inquiry itself for many long centuries.

If not for the patient and curious scribes of medieval Islam, many significant works from Ancient Greece and Rome would have been lost forever.

</comment></comment></comment><comment><USER30> single page version: [http://www.smithsonianmag.com/travel/how-japan-copied- americ...](http://www.smithsonianmag.com/travel/how-japan-copied-american- culture-and-made-it-better-180950189/?all)

</comment><comment><USER31> Understand the way of the Samurai and you're half way to understanding the Japanese.

Shame, dishonour, pride.... these are words that stem from the Samurai way.

"Measure twice and cut once."

Advice to those who care, watch a few Samurai films and you'll get it.

</comment><comment><USER32> I'm really interested in this phenomenon. Can anyone recommend/does anyone know of other articles, essays, or books on the subject?

</comment><comment><USER33> The focus on material things highlights the problem. They have copied everything, but failed to capture the spirit by not acting like their idols. I would like to see the Japanese people act, rebel, and change the world.

All I see is escapism, ironically similar to the escapism Westerner's find in Japanese culture.

</comment><comment><USER34> WARNING: AUTOPLAY VIDEO. Flagged.

</comment><comment><USER35> I hope patio11 can comment on this. I've always enjoyed reading his take on Japan. He is extremely well qualified to compare American and Japanese culture: he was born and raised in the US, moved to Japan after graduating and got married there.

<comment><USER36> No offense but your patio11 sounds like a textbook LBH case.

</comment></comment><comment><USER37> American culture? There's more culture in yoghurt.

<comment><USER38> The only other country I have been to outside of my own country, is America. And I must say I loved the people and the culture there.

If you look at all the small differences between way of life in America and different parts of the world, you will start appreciating all cultures for what niceties they offer.

Do try it :-)

</comment></comment><comment><USER39> The Japanese culture and way of life were systematically gutted during and after WWII, after which they slowly came to adopt American norms. Defeated people have imitated the victors time and again throughout history. This has little to do with how amazing the other culture is.

I find little to celebrate in the Americanization of yet another unique & rich culture.

<comment><USER40> Japanese culture, though very "western", is not very American. Many essential American cultural elements such as religion, guns, cars, libertarians, feminism, and no sex on TV are missing, and it is certainly not as individualist.

It's not a great place to be a programmer, though - people I know working at pixiv (a modern foreigner-friendly web startup) aren't paid even entry-level US salaries.

But with pixiv you can see one of the good sides of Japan. It's basically DeviantArt, but amateur artists on pixiv have often practiced for years and their art is technically good, whereas DeviantArt posters are all more than satisfied with their weird fetish art they drew in MS Paint.

You could try Korea, which is a lot more like America. Specifically, Texas.

<comment><USER41> I'm a programmer in Japan. And there are so many dev jobs here it's ridiculous... _IF_ you can speak Japanese.</comment></comment></comment>


Show HN: Chrome Extension to automatically block the annoying Quora login prompt - <AUTHOR> https://chrome.google.com/webstore/detail/fkbnfnaikpdihahjljbigedkangbieih <comment><USER2> I'd love it if someone would make something that would let me see answers past the first without creating an account. Presumably it could be done with an extension plus a database of accounts a la (or even from) Bugmenot.

Incidentally, does anyone know why Quora wants to force me to create an account? They can already use cookies to tell which pageviews are from the same user. What difference does it make if there's a username and password associated with them?

<comment><USER3> Higher user count => more $$$

<comment><USER2> How do they make more money if my pageviews are associated with an account?

<comment><USER4> I think getting you to sign up is the start of a process that culminates with you inviting all of your contacts. The username/password step is just the top of the funnel.

<comment><USER2> Ah yes, that could be it. I don't think I would advise a startup to do that though. If you have to be that heavy-handed to make it spread, what that really means is that the site isn't good enough.

</comment></comment></comment></comment></comment><comment><USER5> While I appreciate this extension, I think a better tactic would be to not visit Quora if you don't agree with the way the site is run.

Between the blurred answers and the login prompt, I will never visit Quora, for any reason, ever.

<comment><USER6> This is how I feel about people who religiously use AdBlock.

<comment><USER7> If they didn't want to see ads on site X, they just shouldn't go on site X?

How do you feel about people who change the TV channel when a commercial comes on? What about PVRs that automatically skip commercials on playback?

<comment><USER6> Yeah. The website owner makes a conscious decision to fund their website using ads, and if the ads are so offensive that you literally need to block them, why go to the site? What sites are so crucial that you absolutely must use AdBlock?

I also don't pay for cable TV partly for similar reasons - I buy shows I like directly on Amazon, and use Netflix as a filler.

Do you disagree with nickpresta's comment? The less traffic Quora gets, the more likely it is that people will move to a more open platform. The solution isn't to just bypass their design choices.

<comment><USER8> This mentality bothers me a bit. Not everything is all or nothing. Things can be made to be better, or worse.

It's like if you had a jetski, but it was the wrong color. From your approach, you'd say "I'll never ride on that jetski! I'm perfectly fine not riding it."

Yes, clearly you are. You totally, completely, without question have the right to go on living without it. No problem. But the real question isn't whether or not you'll be fine without it. The real question is: are you missing out on pleasure you could be experiencing?

<comment><USER9> But if you were rented a free jetski for the day from someone who had painted some ads on the sides to cover his expenses would you go and tape over the ads before riding? Oh, you would?

<comment><USER7> To make that comparison more fair, the ads need to be canvas that flapped in the wind, slowing you down occasionally (as ads on websites will do) and every once and a while one would lift up in front of the control panel so you had to clear it out of your view (popups).

<comment><USER6> If that was the case, I wouldn't rent a jetski from that company.

Now, if that was the only company offering jetskis at that particular location, and there was no paid option available.. well, I'd question whether or not they're owned by YouTube, who I sincerely wish I could pay a few bucks a month to, to get rid of their awful ads.

<comment><USER7> I'd just get my ideal tape out (waterproof, no residue) and strap those ads down and enjoy my free jetski time. But this comparison will always be flawed, like so many digital/real world ones are today.

I don't see running AdBlock as immoral. If I can change something in my browser to better suit my browsing experience I will, and I feel that's my right. A site can serve up content, but it's my choice as to what portion of that content I choose to view, just as people with PVRs or VCRs can choose to skip ads. Impressions are shit for revenue anyway and I don't think I've ever intentionally clicked on a banner ad so I'm not taking much away from content owners.

I skip sites that have an interstitial ad with a 5 second countdown, so I'm choosing to not ride that jetski.

And agreed on YouTube.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Protip: If people find your site's UI so irritating that they bother to write browser extensions to "fix" it _(and said extensions become popular)_ , you might want to rethink your site design.

<comment><USER11> I'm sure they're aware of the conflict. My guess is that they aren't growing fast enough to justify all the money they raised, so they're eager to get more people involved, and are willing to do that even at the expense of annoying some people.

If they were smart about this (and they are very smart in general), this is something where they would have done some A/B tests with cohort analysis and discovered that they sufficiently larger growth with the dickish pages.

Not that I still don't hate them for it. I still enjoy writing and reading answers there, but they've totally killed my willingness to share answers outside of Quora.

</comment></comment><comment><USER12> I'd prefer a plugin to block all links to Quora. I will not support a website that uses tactics to get ranked in Google for content they aren't going to show human browsers.

<comment><USER13> [https://chrome.google.com/webstore/detail/nolijncfnkgaikbjbd...](https://chrome.google.com/webstore/detail/nolijncfnkgaikbjbdaogikpmpbdcdef)

<comment><USER12> This is a step in the right direction, thanks :)

</comment></comment></comment><comment><AUTHOR> Source: <https://github.com/niftylettuce/block-quora-login-popup>

<comment><AUTHOR> could also redirect to window.location w/o ?ref=fb

</comment></comment><comment><USER14> Could this be expanded to including UX fixes for other sites?

To get the feature request going, I'd like those click-through slideshows to be replaced with a single (scrollable?) grid-based gallery.

<comment><USER7> Having "UX fixes for various sites" is too generic and varied in description - it would be a hard sell.

However, I could see it working if you were to drill down to one specific feature, like hiding the login prompt for a selection of sites.</comment></comment>


Dearest Delicious, a breakup letter - <AUTHOR> http://blog.earth2marsh.com/2012/01/dearest-delicious.html <comment><USER2> At this point, I can't even find my own bookmarks in Delicious anymore. Honest, last night I wanted to check out the link I have saved for Twiddla, so I typed "twiddla" into the search bar at delicious.com.

3 results. None of which were Twiddla.

I know it's in there. It had 8000 points last time I checked on the old interface. But searching for a link to the root of a domain by its domain name doesn't appear to be a use case that the new Delicious team thought of.

Of course, it doesn't show up when searching for any of the tagnames that I or anybody else gave it either. It used to float around the top of "whiteboard" and "collaboration". Now those terms return a few "stacks" (something I'd never heard of before), none of which contain any of the things that used to be tagged "whiteboard".

It's amazing that they could have taken something so simple and good and completely ruined it in so short a time. At this point the best I can hope for is that somebody else has an import tool that will suck my stuff out of it so that I can at least view my own saved bookmarks.

Sad.

<comment><USER3> I just searched for Twiddla from the main page, and it's the top result, with 3717 saves. Tagged with whiteboard.

<http://delicious.com/search?p=twiddla>

Is it possible you bookmarked something more specific, like twiddla.com/specific_page ?

<comment><USER2> Could be that it was just plain broken earlier today, rather than broken specifically for me. The entire page previously consisted of the top two sections that you see now (My Links and Stacks), both of which are truncated to 3 entries with little indication that they can be expanded.

Previously, you'd see the (now re-existant) 3rd section only. Y'know, a list of bookmarks that match your search.

<comment><USER4> I can confirm that the page was broken yesterday and the day before for me. Started working sometime between yesterday AM and this morning.

</comment></comment></comment></comment><comment><USER5> Stacks have seriously altered what Delicious is and not in a good way.

I've been using Diigo which I'm not in love with. I couldn't tell you why exactly but I think if I'm honest I just want the old Delicious back.

The one very cool thing that Diigo does which I now couldn't live without: Chrome extension which auto searches your bookmarks when you search in Google. One hell of a time saver. Example screenshot: <https://p.twimg.com/AbAkwvXCEAAjLUa.png>

</comment><comment><USER6> I guess we're a lot in this situation. Yet I haven't found the perfect service to replace Delicious. Any thoughts?

<comment><USER7> The most popular seems to be <http://pinboard.in/>

I use it and highly recommend it.

<comment><USER8> how are the chrome plugins for pinboard?

<comment><USER9> I use two of them and they haven't given me any trouble. Pinboard[1] adds a menu option, which I have positioned next to the address bar. Pinboard Right[2] adds a 'Post Page to Pinboard' link to my right-click menu.

1\. Pinboard: [https://chrome.google.com/webstore/detail/lclbbneapfiaihigbk...](https://chrome.google.com/webstore/detail/lclbbneapfiaihigbkalcoophalpbapl)

2\. Pinboard Right: [https://chrome.google.com/webstore/detail/mpiepoibcfbjicpaic...](https://chrome.google.com/webstore/detail/mpiepoibcfbjicpaicclndcjebbibpld)

<comment><USER8> i pulled the trigger on pinboard, and couldn't be happier with it and the chrome plugins. nice, simple, works!

</comment></comment></comment></comment></comment><comment><USER10> I was never able to get into social bookmarking.

Until I was introduced to diigo. It just works.

Best part for me: when I bookmark something, I'm usually bookmarking a sentence, or some information. Diigo lets me do the usual create a bookmark / tag it, but also highlight and annotate the link, something that shows up in my central Diigo feed.

No more digging through my links to find one link, then digging through pages of the article to find the one sentence or point I was looking for.

</comment><comment><USER8> the other day i opened my delicious page.. and to my horror i discovered that all the bookmarks I added in past few months had one tag with all tags concatenated by a space. it appears that delicious started accepting spaces in tags (instead of using them as delimiter like they have for years), so all the bookmarks i meticulously tagged were useless and i had new tags such as "programming computerscience learning" etc.. had to go through every bookmark and re-add all the tags + delete the monster tags that got created as a result. so.. had to do it couple hundred times. apparently now, only a comma delimits them. why allow spaces inside tags anyway? who made this decision? what good are tags such as the one above? This on top of having to re-install all my browser plugins until i found a version that supports auto-complete again.. seems like delicious was taken over by a bunch of jr engineers and no one at Yahoo gives a fuck about things such as backwards compatibility.

</comment><comment><USER11> I did my break up and I didn't write any letter. I don't think they care, why should I?

<comment><USER12> In the spirit of the submitted post: for old time's sake :)

</comment></comment><comment><USER13> It's a funny redesign indeed: basic things that used to be simple (such as bulk editing tags) are not there anymore, and even basic stuff (editing tags of ONE bookmark) take a long time, since they require a full page reload.

</comment><comment><USER14> I remember the good old days of Digg. I could write a blog article, get my friends to up vote it (it was very easy to amass a large number of friends on Digg) and the result was 70,000 unique visitors.

I was able to to this successfully at least twice a week. If I had been smarter, I would have monetized it. Instead, my blog floundered and I ended up shutting it down.</comment>


Appcelerator: extortion is just part of the job - <AUTHOR> http://weblog.masukomi.org/2012/09/22/appcelerator-extortion-is-just-part-of-the-job-dot-dot-dot

<comment><USER2> Saying that Appcelerator is extorting their users I'm pretty sure enters into libel territory. Extortion is a crime, and saying that Appcelerator committed a crime is setting you up for a lawsuit.

It could very well have been an accident on the part of the sales person, and saying that the CEO is deceiving people because he doesn't use the same words that you would have used is simply wrong.

If I were you, I would take down the post, or at least change the wording so that you're not saying they are extorting their customers.

<comment><AUTHOR> You should note the very explicit disclaimer at the end noting that this is my personal opinion. Furthermore, the CEO apologized for the incident, and mentions that it happened before. Logically it happened by their own admission (so i'm not claiming anything they haven't already admitted to) and the conclusions based upon their comments ( like moral bankruptcy ) are A) literally unprovable and subjective and B) explicitly noted as my personal opinion, which is something we are legally allowed to note publicly.

<comment><USER2> I strongly suggest you read up on what constitutes libel/defamation. Just by saying something is your opinion does not protect you, as least in the US.

[https://www.eff.org/issues/bloggers/legal/liability/defamati...](https://www.eff.org/issues/bloggers/legal/liability/defamation)

They didn't apologize for extortion. They apologized for accidentally charging a developer. That is not extortion. Extortion is a very serious criminal offense. Unless you have proof that they are actually engaging in extortion, and that they are engaging in criminal activities, you are making yourself vulnerable to a lawsuit.

</comment></comment></comment><comment><USER3> I'm having a hard time giving this current dust up any credence. There has been one user who has come forward saying there was unethical behavior from the UK sales office, the CEO said there have been a couple reports. I'm not seeing a wide spread change in their behavior or offerings as this blog post suggests. While something to keep an eye on, I hardly think it warrants the attention it is currently receiving.

<comment><AUTHOR> if you followed the story more closely you'd see that there are at least three reported instances, AND a CEO confirming multiple. this should NEVER happen. The fact that it has happened multiple times.... how can you not think that worth a dust-up... or four? You think it's ok to occasionally attempt to extort your customers? You think salespeople shouldn't be fired on the spot for treating your customers with such broken morality... repeatedly?

<comment><USER4> You are misinterpreting the CEO's statement. He said:

       Was the sales rep over eager and trying to hussle
       to get a deal? Probably. In my opinion, that's the
       job of the rep and we work with hundreds of new paying
       customers each quarter and we've only had a few
       complaints about it.

He's not saying they've had a few complaints about so-called "extortion". He is saying they've had only a few complaints about their sales reps total for all causes.

</comment></comment></comment><comment><USER5> Erm, something is dodgy here. Either this article is completely fiction or the CEO's response has been edited since this was posted (2 days ago).

Here is the original post, the CEO's response is the accepted answer at the top:

[http://developer.appcelerator.com/question/142516/warning- li...](http://developer.appcelerator.com/question/142516/warning-licensing-of- titanium-chaotic-and-unclear-how-to-avoid-extortionate-fees)

EDIT: Oh these quotes are from a comment by the CEO on the accepted answer.

<comment><USER6> The CEO's response has been edited a few times since the incident.

</comment></comment><comment><USER7> I used Appcelerator to build my first app. I just loved the platform and started a meetup in my area recently because one did not existed. Before I built the app, I read the pricing page and went through their pricing FAQ and see that it was FREE if I dont use any of the add on features - and now I read this. I hope it turns out that there was just a shitty salesperson who was being over agressive and nothing else but I am sad to see that there is no clarification on pricing yet. Someone posted a link to an email chain with the companies sales person in that thread - [http://dl.dropbox.com/u/4600727/Learning%20TI/AppC_Pricing_e...](http://dl.dropbox.com/u/4600727/Learning%20TI/AppC_Pricing_emails.pdf) \- where the sales person made this statement -

AppC Explore – This is free for anyone who wants to create an app that does not generate revenue in any way.

Why is this statement not on the pricing page or even on Pricing FAQ page?

<comment><USER8> if i understand the CEOs comments correctly (which is not an easy thing) then this statement

>his is free for anyone who wants to create an app that does not generate revenue in any way.

is just not true (a.k.a. false). but in the current state of this affair, we do not know for sure (and maybe never will).

</comment></comment><comment><AUTHOR> INTERESTING UPDATE:

The CEOs comments to his "accepted answer", which my quotes were taken from, have since been removed from the Appcelerator forum. Funny that. ;)

<comment><USER9> No, they haven't. They are just not showing up right away because of the forum software's comment hiding. I just went to the post and loaded the entire text of his comment, which you reference in your post. I can't link to it, again because of their forum software, but if you click 'show X more comments' under the Accepted answer, you'll see the post.

<comment><AUTHOR> ahh thanks @russnewcomer will update the update comment on the post.

</comment></comment></comment><comment><USER10>
        The iPad app we've been working on is currently
        using a very useful plugin that can only be found
        in the Appcelerator ecosystem. I shall be ripping
        that out and finding some other solution to the
        problem. There are plenty of competitors in this
        space.

If you were writing a native app you wouldn't have to rip anything out or have to find it elsewhere. Just sayin'.

I have a fairly aggressive lack of sympathy for phonegap/titanium/"cheap shortcut" users in general and this whole incident is just sort of confirmation to part of the reason why.

<comment><AUTHOR> meh, I don't think _this_ has really got anything to do with "cheap shortcut" methods. _this_ is about broken morals. But, with that said, my impression is that while there are a lot of downsides to using HTML5 for your app, there's a LOT of amazing things you can do with the UI that are much harder in Objective C, and it's a hell of a lot more affordable to contract HTML devs than it is Obj C devs. ;) And when you're bootstrapping an app that is a big deal.

<comment><USER11> Titanium isn't an HTML5 based app framework like Phonegap. It's a Javascript framework for building apps that use the native UI widgets.

<comment><USER12> My experience with titanium was really poor. Lots of silent fails with no real error output. Also I found it very limited, more limited than just opening a webview and using html5 really and hooking into it with code for the native functionality.

<comment><USER13> You must be joking. I've built _several_ projects, for pay, using Titanium and find it to be very powerful and fast for building even complex mobile apps. The customers have been thrilled that I'm able to deliver tons of features in shorter time frames and hence lower cost.

As for error output - you just need to look at the logs in detail (and turn them up to trace) to get details for hard crashed.

<comment><USER12> I built one project with it for pay. It is much more limited than a real native solution like obj-c, monotouch, etc.

What exactly would you do if the client came back to you and requested something titanium couldn't do?

When I was using it it had problems even moving to a page with a webview already loaded up to a webpage.

Have you built a project with a real native language for pay?

</comment></comment></comment></comment></comment></comment><comment><USER14> Did appcelerator steal your blankie ? It's annouing dealing with developers like this that feel entitled to everything for free.

<comment><AUTHOR> ... free? I don't give a shit about free vs. paid. I give a shit about how morally broken it is to practice extortion on your customers (free or otherwise). I've got no problem with paying for good service. Are you suggesting that it is unreasonable to be upset about a company you deal with trying to extort thousands of pounds from people?

<comment><USER14> I don't mean to sound patronizing but that's how sales (and business) works. Like it or not when you sign up for apcelerator you are part of their sales life cycle. And sometimes there might be confusion about who to contact about upgrading to a pro license. Sounds like an isolated human error.

If you can't handle the prospect of being contacted by companies don't develop using their sdk, stick with developing apps for gnome or openbsd.

Also you sound so bitter. Give forgiveness a chance.

<comment><USER15> You wrote "Did appcelerator steal your blankie?", which is quite literally treating him like he's a three-year-old and you claim you didn't mean to sound patronizing? What else could have you possibly meant with that as an opening sentence?

Also, you aggressively miss the point. He's not upset about being contacted. He's upset about having them threaten to take down his app.</comment></comment></comment></comment>


5 Ways to Redesign the Movie Theater Experience. - <AUTHOR> http://fourstarters.com/2007/09/12/5-ways-to-redesign-the-movie-going-experience/

<comment><USER2> How about: don't run ads (except trailers) before films. It is so obnoxious to be forced to sit through an ad before something you're paying for. Especially in a theater. If an ad on TV bothers you, you can turn off the sound or go into the next room. If an ad in a newspaper or magazine bothers you, you can cover it or turn the page. But an ad in a theater you are getting shoved in your face no matter what.

Ads have a cost. People who think they can keep sticking more and more ads on things don't realize that they're gradually making whatever it is less attractive. But eventually you cross a line.

<comment><USER3> The studios and theater owners punish the people who don't pirate films the most.

If you pay full price for a theater movie you have to sit through 15 minutes of ads and trailers.

If you pay full price for a DVD, you have to sit through the trailers (which you often can't fast forward) and a bunch of annoying FBI messages.

If you pirate the film, you see exactly what you want - a movie.

</comment></comment><comment><USER4> I'm interested in the advances digital cinema projection can bring. Smaller cinemas (20-50 seats) for on demand viewing of a catalog of 1,000s of films. Simply select what you want and go watch it in comfy seats with food served to your seats. Whilst your watching the 15 mins of trailers any other people can choose to also come watch the film. Then on the way out pick up a copy of the DVD..

<comment><USER5> Definitely. The economics of the thing are actually really nonsensical. A "home cinema system" of any serious quality is, at least for now, at least a thousand bucks. That buys a lotta movie tickets.

Just figured out a sixth point: re-run famous movies of yore. It's almost 100% profit on the ticket, as I understand it, and with the comfy seat + some sort of pre-movie kickoff drink, you attract fellow fans of said movie (cult movies are a plus), and you make more money on the sales.

I'd SO go to those for the movies I got in my all time top 10 list.

<comment><USER6> In Tucson, there are multiple theatres (art houses, mostly) that do this. They usually get a good showing. (I remember a midnight showing of beatlejuice that was great fun. In fact, a large group of us sat on the floor before and played duck duck goose...)

<comment><USER5> There you go. The business model sells itself purely on the idea but for the doubters in the audience there's practical proof to be found.

As I said in the article, art houses are exempt from the 'WTF is wrong with you???!???' nature of the rant. They pull creative stunts all the time. Probably because those aren't run by an oligargic chain of idiots.

</comment></comment></comment></comment><comment><USER7> > 3\. Breaks are good

Uhmmm... no they're not! Movies are quite long as it is, last thing I need is to break a story and spend extra 15min at the theater.

</comment><comment><AUTHOR> Weird how everyone is commenting here, and not on our blog ;) Common thing for news.ycomb.com?</comment>