John Resig joins the Khan Academy - <AUTHOR> http://ejohn.org/blog/next-steps-in-2011/

<comment><USER3> I'm happy for John, and this is great news for the Khan Academy. But I have to admit my reaction was mixed about his initial plans to focus on the iPad. On one hand, this is tantamount to saying you want to ensure that rich kids have better access to educational materials. Relative to the rest of society, children of parents who can afford an iPad are probably the least needy re educational tools. On the other hand, they're probably the ones who will make the most use of the tools.

<comment><USER4> You don't plan for today, you plan for five years down the line. Tablet computers are likely to become as ubiquitous as desktops or laptops, it's purely a matter of time.

Tablets are a much more useable form factor in classrooms, etc.

<comment><USER3> That line of reasoning makes sense. He specifically mentioned iPad - <USER2> tablets in general. When I think of the educational needs of tomorrow, I think of school districts like Los Angeles, where the drop out rate is ~33%. It's really hard for me to imagine a scenario where tablets are wide spread among students in the lower income areas of that district.

Hopefully the iPad is just a kickoff point. One of my philosophies is that at least some part of your job should give you joy, and out of that great things can happen. Maybe iPad development is just something he wants to do for the joy of it.

 _NB: I know that John's not a one man army, and I'm not trying to lay this all on his shoulders. I'm just thinking out loud on HN._

<comment><USER5> "Hopefully the iPad is just a kickoff point."

That's precisely it. Being who I am, I'm going to be building everything with Open Web technologies and most likely built on top of jQuery Mobile. The iPad is just serving as a good initial platform to target and test on before expanding massively.

I wouldn't be surprised if much of the work that happens on the tablet version of the site gets back-ported to the main site itself (as things like tablets and mobile devices tend to encourage minimalist UIs and a larger emphasis on what the user is attempting to achieve).

I did work for the One Laptop Per Child project in the past, I'm a strong advocate for getting useful resources out to as many people as possible - regardless of their means.

<comment><AUTHOR> John beat me to the punch here. We're thinking about a much more general mobile strategy. My personal mission is to try to design an experience for content, student interaction, and exercises that is usable on smaller screens because, although the tablet market is booming (thanks in great part to the growth of the iPad) the smartphone market is much bigger and growing more quickly. They are also likely to become commoditized more quickly (if you want to argue that they aren't there already). In any case, replace the word "iPad" in his post with "mobile" and I think you are closer to what John, I, and the rest of the team are talking about.

</comment></comment></comment></comment></comment><comment><USER6> It is awesome that Khan Academy has attracted so much top talent. Has the potential to make a real difference in world education and thus in human potential. Goes to show how much effect a relatively small investment can make when joined with amazing, driven, talented people.

<comment><USER7> I agree except for "Has the potential". It is making an improvement right now. It is hard to describe how it feels to watch my 9 year old pop off months worth of school tedium in one morning, moving up through long division into simple algebra equations. Or my 14 fill in gaps that had been confusing her for years. Comments like "oh, I get it now" or "that's not hard at all" are common.

<comment><USER8> Awesome to hear! Can you give us any information on how their grades have developed? Of course, kindling fun and excitement for education and science is already a great, if not the most important, achievement. But I'm curious about the effect, that was discussed here before [1]. Derek Muller claims [2], that these videos give a false illusion of understanding. If I get him right: If your kids don't feel a bit confused and overwhelmed afterwards, they might have reinforced their prejudice about how think are and work.

Anyway, its great to see good people choosing a career in education!

[1] <http://news.ycombinator.com/item?id=2348476> [2] [https://fnoschese.wordpress.com/2011/03/17/khan-academy- and-...](https://fnoschese.wordpress.com/2011/03/17/khan-academy-and-the- effectiveness-of-science-videos/)

<comment><USER7> The videos are just one part of the academy. There is a tree you progress through by passing off problems. Ten correct in a row marks you as proficient and you go to the next level. Every so often there is a review section with random problems from any earlier level. The entire system of instruction, practice, and review gives more than an illusion of understanding.

My nine year old's grades have always been really good. The fun for him is just being able to go as fast as he wants. My 14 year old has moved from struggling for c's to breezing along with b's. She just really doesn't care about math but at least she doesn't hate it anymore.

<comment><USER8> Thanks! I wasn't aware of that system. Can't wait till my nephew can watch Khan Academy ..

</comment></comment></comment></comment></comment><comment><USER9> > I should note that I've made a personal decision to scale back some other > aspects of my professional life. I'm no longer accepting any new speaking > engagements...

It is very hard to leave/scale-back unfinished business or commitments but it is a very important step before starting something new and big. I know many creative people who have tons of projects and commitments that they can't bring themselves to leave and as a result, they never have enough time to concentrate fully on their next big things. I highly commend John for making the tough decision of leaving Mozilla and lots of personal projects so that he could do something big.

<comment><USER10> I wish I could up-vote you to the top.

Just feel like without this comment, your comment might not stand out to many.

</comment></comment><comment><USER11> I spoke to John Resig the other day after he fixed /r/f7u12's stylesheet (he really earned his mod place!), and now I hate him with all my heart for being more successful and more of a nice guy than I am. I bet he's also more handsome.

EDIT: _And_ he's a year younger! Damn you, jeresig!

<comment><USER12> (completely unrelated buy why is historio.us down, did you shut it down? I don't see any mention of outages on Twitter)

<comment><USER11> Oops, sorry, apparently the maintenance I'm doing killed some component due to low memory. I'll reboot as soon as I'm done and it'll all be back to normal!

</comment></comment></comment><comment><USER13> Bill Gates calls this the future of education. I think he is correct. I am doing a project involving corporate training and this method has vast implications for my work. I also have three school age children, and they will be "attending" Khan tonight. This is the very first post I've read on HN and I'm overwhelmed by its significance. Thanks!

<comment><USER14> That's great. When you say "this method", could you explain what you mean? How does it have vast implications for your work?

In addition, I agree that it will make a great impact in the future. However isn't labeling it as "THE future" is going a little too far for now anyway? I would like to see a study on the type of person this type of study works for. If I'm not mistaken, it's not everyone?

<comment><USER15> I think "this method" is letting people absorb the main lecture/explanation at their own pace, freeing up teachers to focus on one on one assistance, identifying people who are struggling, focusing classes on mastery instead of minimum level competence (C students pass, but obviously have knowledge gaps), etc.

<comment><USER14> Cool. I'm curious how you'll implement it? Recently I took an Agile course at work where they had a similar method -- there was a 3 hour video that everyone was supposed to watch before the course. I'd say about 10% of people watched it.

<comment><USER15> It's not my method and I don't have any plans to implement it, I'm just parroting stuff I've heard about Khan Academy in use.

I think in your case the problem was multifaceted. First, it was a 3 hour video on Agile. Excessively long, probably boring, probably unnecessary (in my own experience, the agile methods are mostly to get managers to see the light, not the programmers). Second, there was probably little penalty for not watching it either. I've been through Scrum training, it was boring and "successful completion" mostly meant sitting in a room and not doing my actual job for a few days. Failing the course would have required more effort than completing it.

For schools, obviously they'll still be grading your work and ensuring mastery of the subject where not watching the lectures would probably reflect on homework and test scores pretty quickly as you advanced, they're also much shorter than 3 hours, where your attention is less likely to wander.

<comment><USER14> I definitely agree the problem was multifaceted. I also believe the problem runs very deep at the same time.

Even if the courses were 10 minutes each like Khan, I doubt the view rate would be increased by much in this case.

Also, it is true that there are no immediate and visible penalties for not watching it, though at the same time, being penalized through completely artificial means (chasing artificial targets, aka what happens in school) isn't healthy for anyone and I believe contributes to one of the major problems we're having.

Thirdly, I never was ensured mastery (or even pushed towards it) in any class I ever took. I was ensured a good grade if I jumped through the right hoops just how the teacher wanted it.

</comment></comment></comment></comment></comment></comment><comment><USER16> This is perfect. The alignment of terrifically smart, talented and passionate people to come together for a worthy cause. Congrats and wish you the best.

With the recent startup boom, its sad to see some great talent spend time building little features or apps; just wish they could use their amazing talents to solve some really large problems..

</comment><comment><USER17> I wish the Khan Academy and everybody who is working for this awesome idea and good cause all the best. It is these people that make me feel so proud of mankind.

Getting the chance to work on such a project makes money and career fade far into the background. All the Good this project is doing for the world makes it worth it. And all without the need to charge for the service or display ads.

Congrats John on this excellent choice for a chance to make a change.

</comment><comment><USER18> If I'm not mistaken Khan Academy is still hiring: <http://www.khanacademy.org/jobs/dev> and <http://news.ycombinator.com/item?id=2412000>

I'm sure there are many great minds in here who would love to join John and the rest of the KA team

<comment><USER19> You're definitely not mistaken. Use either link -- applications welcome.

</comment></comment><comment><USER20> Wow! We're thrilled that this happened. Today is another great day for education. The greatest day was probably when Salman Khan quit his job and went home to upload his videos full time. We use Khan academy almost every day, for our children and ourselves.

</comment><comment><USER21> Congratulations to the Kahn Academy, and congratulations to John.

I am really looking forward to you building software full time. It is going to be great for jQuery!

<comment><USER22> This is seriously the best thing that can happen for JQuery Mobile, assuming he does release some apps. If anyone can push the technology as far as it can go, it's John.

</comment></comment><comment><USER23> Congratulations John and Khan Academy! Khan Academy, as I've said before, I think is one of the most important pieces of technology I've seen. I think maybe one day on par, in terms of impact, with the web itself. Great news.

</comment><comment><USER24> Noble Cause. But I am curious to know will Khan Academy give a basic salary or he working for free? in which case, I salute you

Congrats!

<comment><USER25> When Bill Gates uses your product to teach his kids, asking for some grant money probably isn't much of a problem.

<comment><USER15> I don't know their relationship, but in Salman Khan's TED Talk[1], Gates performs some closing remarks with him.

In the talk, he mentions that they're doing a pilot program with the Los Altos school district[2] as well, which I'm sure wasn't for free since it involved custom development.

[1] [http://www.ted.com/talks/salman_khan_let_s_use_video_to_rein...](http://www.ted.com/talks/salman_khan_let_s_use_video_to_reinvent_education.html) [2] <http://lasdandkhanacademy.edublogs.org/about/>

<comment><AUTHOR> Actually, it was totally free in terms of the school not having to lay out any cash. The reason we chose to work with them, however, is that they committed a ton of time from teachers, students, administrators, and parents to help us make the Khan Academy work better for the classroom use case.

The experience working with them has been fantastic. The teachers are fearless in the face of the significant uncertainty that introducing something like the KA in a classroom can create. They've been creative about experimenting with different ways of integrating KA into the classroom (trying things we didn't anticipate). Speaking as a UX designer, having nearly unlimited access to teachers and students for interviews and observations has been invaluable. Plus the teachers aren't shy about letting us know if something isn't working out. If anything, it feels like we should be paying them.

<comment><USER15> That's awesome. Kudos to you and everything Khan Academy is doing.

Is it mostly grant money that funds everything then?

<comment><AUTHOR> Sorry for not addressing that first time-round. We are funded by the Google and Gates Foundation grants plus private donations. As far as "most", I am not totally sure. I have very gladly stopped worrying about the particulars there as we've got some great folks (Sal, Shantanu, and Jessica) focused on making sure we're funded well enough to keep making progress at the rate we want. That frees up me and the rest of the developers to focus on building the product. Charmed life, eh?

</comment></comment></comment></comment></comment></comment><comment><USER26> I discovered Khan Academy about 1 year ago and since then the website has not changed that much, except for some polishing on the site. Here is a snapshot of the site in June 2010 [http://replay.web.archive.org/20100601053141/http://www.khan...](http://replay.web.archive.org/20100601053141/http://www.khanacademy.org/)

The site is currently quite hard to navigate around or search. Now that even talents like John have started to join the academy, I'm pretty sure, the site will definitely provide a better experience. Good for Khan, the academy and the education system

<comment><USER27> Just hope they don't "pull a Craigslist" and keep a crappy UI for the sake of nostalgia, then call it "minimalism".

</comment></comment><comment><USER28> Awesome to see someone this talented put his skills into a real, valuable product.

</comment><comment> hendrik-xdest It's a bad day for Mozilla. Resig and Dion Almaer announce their leave for KA on the same day.

</comment><comment><USER29> When are we gonna see more advanced math covered on KA? It would be great to see Fourier transform or even music theory!

<comment><USER30> Discrete mathematics is definitely what I've been waiting for.

</comment></comment><comment><USER31> voted without reading - and i'm even not jQ or John Resig fan.

</comment><comment><USER32> <http://twitter.com/#!/jeresig/status/65450991423733760> announcement on twitter

</comment><comment><USER33> Makes me wonder what this says about Mozilla. Perhaps not the exciting place it used to be 5+ years ago?

<comment><USER34> Given how exciting Khan Academy is, Mozilla could still be pretty darn awesome and not stack up.

<comment><USER35> Agreed. Mozilla may have helped change the browser landscape, but the Khan Academy could change the face of education in this country. Both worthy places to pour one's energy but I'd give the edge in excitement to KA.

<comment><USER36> >but the Khan Academy could change the face of education in this country.

It's not just one country. I sincerely can't express my gratitude enough for Khan Academy guys, their very rich educational materials have and are helping me tremendously in my education and my career. I'm from a developing country.</comment></comment></comment></comment>


How The SAFE Has Changed And It What It Means For Equity - commons-tragedy https://www.forbes.com/sites/forbesnycouncil/2019/01/16/how-the-safe-has-changed-and-it-what-it-means-for-your-companys-equity/ <comment><AUTHOR> YC announcement of change back when it was made: [https://blog.ycombinator.com/new-standard- deal/](https://blog.ycombinator.com/new-standard-deal/)

HN discussion at the time: [https://news.ycombinator.com/item?id=18095224](https://news.ycombinator.com/item?id=18095224)

<comment><USER2> Yup, I don't think is news to most founders and investors. Just a reminder that things are going downhill :(</comment></comment>


HealthCare.gov Sends Personal Data to Dozens of Tracking Websites - <AUTHOR> https://www.eff.org/deeplinks/2015/01/healthcare.gov-sends-personal-data <comment><USER2> This is pretty shocking. What is PII doing in the query string in the first place? Disclosing pregnancy status from an insurance application sounds like a possible HIPPA violation and runs afoul of various state laws around 'Insurance Information and Privacy Protection'. E.g [http://www.leginfo.ca.gov/cgi- bin/displaycode?section=ins&gr...](http://www.leginfo.ca.gov/cgi- bin/displaycode?section=ins&group=00001-01000&file=791-791.29). See Section 791.13(k). That's just CA law but many states followed with their own version. (IANAL)

I think the really big penalties come into play when medical information is 'personally identifiable'. Since this data is going to Google, Facebook, and Twitter (really?!) with 3rd party cookies, or even without, it would be hard to argue this data is not personally identifiable.

It's not like they didn't know they weren't sending this data out. Or perhaps the highly advanced debugging prowess of "Chrome Inspector" is beyond their pay grade.

Edit: Oh it's not even just Referral leak it's actually it the request in some cases, so blatantly intentional. :-(

<comment><USER3> > Oh it's not even just Referral leak it's actually it the request in some > cases, so blatantly intentional.

Be careful about throwing the term intentional around. There is nothing to suggest this is the case. It's just a shocking breakdown in security/testing processes and/or a bug. We see security/privacy issues everyday. They are almost never intentional.

<comment><USER4> > They are almost never intentional.

Somebody had to specifically code the application to concatenate into the string:

> smoker=1&parent=&pregnant=1&mec=&zip=85601&state=AZ&income=35000

<comment><USER5> Reading the example more closely, that's part of a URL:

[https://4037109.fls.doubleclick.net/activityi;src=4037109;ty...](https://4037109.fls.doubleclick.net/activityi;src=4037109;type=20142003;cat=201420;ord=7917385912018;~oref=https://www.healthcare.gov/see- plans/85601/results/?county=04019&age=40&smoker=1&parent=&pregnant=1&mec=&zip=85601&state=AZ&income=35000&step=4)?

Unfortunately, a quick Google search doesn't explain what the oref parameter does but from the name I'm assuming it's something like "original referrer".

You don't need malice to explain this – it's entirely plausible to imagine that some people wanted to track user activities and they had a staggering lapse in HIPAA auditing due to the rush of getting the site out and stabilized.

<comment><USER6> > it's entirely plausible to imagine that some people wanted to track user > activities and they had a staggering lapse in HIPAA auditing due to the rush > of getting the site out and stabilized.

Considering they spent 1.7 billion on the site, I simply cannot believe that they were so unorganised and lazy on their testing that they couldn't find this. Otherwise I don't know what to think anymore.

<comment><USER7> I don't think it's accurate to say "they spent 1.7 billion on the site".

I think the $1.7 billion figure comes from this OIG report [http://oig.hhs.gov/oei/reports/oei-03-14-00231.pdf](http://oig.hhs.gov/oei/reports/oei-03-14-00231.pdf)

However, the OIG report has a number of important caveats:

* The list of 60 contracts in the report includes contracts to support state websites and for programs unrelated to the website (for instance, I found an $85 million contract related to accountable care organizations, which doesn't seem to have any connection to the website).

* The $1.7 billion is not the amount expended, it's the estimated value at the time the contract was awarded if all the options are exercised. When you look at the individual contracts, this estimated value turns out not to be very useful. Some contracts had double the estimated expenditure, some had $0 expended. Looking at the total amount expended, you get a figure of $500 million.

So I think it's more reasonable to say that they spent $500 million on various projects to implement the law, including both the user-facing website and all the behind-the-scenes stuff.

</comment></comment></comment></comment></comment></comment><comment><USER8> _Spokesman Aaron Albright said outside vendors "are prohibited from using information from these tools on HealthCare.gov for their companies' purposes." The government uses them to measure the performance of HealthCare.gov so consumers get "a simpler, more streamlined and intuitive experience," he added._

It's one thing to send session length, general location, usage stuff like that to see where, for example, awareness campaigns might be needed. But really:

      smoker=1&parent=&pregnant=1&mec=&zip=85601&state=AZ&income=35000

That's a bit much! And I suppose DoubleClick is carefully siloing this information so it doesn't accidentally perform all kinds of analysis on it for comparison with its other huge databases? Perhaps they are barred from selling it wholesale to data brokers but I can't imagine they are unable to use it for plenty of their own purposes.

<comment><USER9> I'm sure you're right that the information is getting used by DoubleClick.

To the other point about this information not being appropriate for the purposes Albright mentioned: Isn't this exactly the information that a health insurance company wants to know for outreach? If I know that all the pregnant women in Tuscon are signing up but none from Pheonix, I suddenly know where to put my next billboard or field office.

If this was a private sector company, nobody would be surprised at collecting this data. It would also be a different story if the data was being stored and analyzed in house or even if the doubleclick request happened on the server side instead of the client.

I agree with the general sentiment that this is a privacy violation, but that's because of the way that the data is collected and who processes it, not the collection and use of the data generally.

<comment><USER9> Confused...

</comment></comment></comment><comment><USER10> Paging HN user brandonb and 'a bunch of other Google, Facebook, and Y Combinator alums' \-- did this exist while you worked on the site?

      > I've been working on healthcare.gov for the last few months

[https://news.ycombinator.com/item?id=7312442](https://news.ycombinator.com/item?id=7312442)

<comment><USER11> We weren't involved with this specific part of the site but folks are on it!

(I wrapped up my involvement several months ago, but others helping out with this open enrollment period.)

<comment><USER12> > folks are on it!

Am I correct in thinking that the cheery use of passive voice means you're under quite a serious NDA?

<comment><USER11> There is an NDA but I used "folks" since I, personally, have returned to the startup world and am not involved in the details of fixing this particular incident. But yes, rest assured that the people who currently work on healthcare.gov are busy testing a fix, which is why they're not posting on HN.

</comment></comment></comment></comment><comment><USER13> Give $563M to Accenture and you get some really shoddy work [http://www.healthcaredive.com/news/accenture-snags- new-5-yea...](http://www.healthcaredive.com/news/accenture-snags-new-5-year- healthcaregov-contract-for-563m/347935/)

</comment><comment><USER14> An additional problem, as I see it, is that the Obama administration made unambiguous assurances that no PII was being collected as part of Healthcare.gov's use of web measurement tools. Here's the excerpt from the privacy policy:

 _HealthCare.gov uses a variety of Web measurement software tools. We use them to collect the information listed in the "Types of information collected" section above. The tools collect information automatically and continuously. No personally identifiable information is collected by these tools._ [https://www.healthcare.gov/privacy/](https://www.healthcare.gov/privacy/)

Note the last sentence is in bold on the actual web page.

A Department of Health and Human Services organ called the Centers for Medicare & Medicaid Services is responsible for the site. An enterprising HN reader might want to skim through the CMS (very long) privacy impact assessment to see if there are any other incorrect claims about Healthcare.gov: [http://www.hhs.gov/pia/cms-pia-summary- fy12q4.pdf](http://www.hhs.gov/pia/cms-pia-summary-fy12q4.pdf)

It will be interesting to see if anyone gets fired as a result of this particular privacy screwup. The buck should stop _somewhere_ , right?

<comment><USER15> >A Department of Health and Human Services organ called the Centers for Medicare & Medicaid Services is responsible for the site. An enterprising HN reader might want to skim through the CMS (very long) privacy impact assessment to see if there are any other incorrect claims about Healthcare.gov: [http://www.hhs.gov/pia/cms-pia-summary- fy12q4.pdf](http://www.hhs.gov/pia/cms-pia-summary-fy12q4.pdf)

Is there any way to split this up so each person is responsible for a section? you'd miss a lot by missing context... but if the section readers bullet pointed everything, that could be combined into a larger context.

Or, in HN speak, we could crowdsource a real-world Map/Reduce job to support big data in the citizen-scientist.

<comment><USER14> I love the idea of a real-world map/reduce job. :) But before spending any time on this, please make sure it's the right PDF. It does mention Healthcare.gov, but only a few times, and I'm no expert on HHS organizational structure. Here's the full directory of PIAs: [http://www.hhs.gov/pia/](http://www.hhs.gov/pia/)

</comment></comment></comment><comment><USER16> Looks like a few of the tracking companies only just started to appear -

[http://builtwith.com/detailed/healthcare.gov](http://builtwith.com/detailed/healthcare.gov)

The only non-ad tool they added was the Twitter Platform to their homepage. Lots of data leakage points though.

</comment><comment><USER17> Isn't this a HIPAA violation?

<comment><USER18> No. I don't see any protected health information.

<comment><USER19> # of pregnancies is a violation. One could infer whether the individual is pregnant, has had a miscarriage or even an abortion.

</comment></comment></comment><comment><USER20> Don't blame the browsers for continuing to send Referer headers though. Because browsers take your privacy seriously.

</comment><comment><USER21> I'm wondering whose doubleclick account those ad dollars are ending up in.

<comment><USER22> Not ad account. I think doubleclick is used for surveys.

<comment><USER23> Nope. [http://en.wikipedia.org/wiki/DoubleClick](http://en.wikipedia.org/wiki/DoubleClick)

DoubleClick is a subsidiary of Google which develops and provides Internet ad serving services

<comment><USER22> I'm saying in this case. Doubleclick accounts are usually for ads.

</comment></comment></comment></comment><comment><USER24> This is certainly scary stuff, but I was a bit annoyed with the line:

"...consequences such as when Target notified a woman's family that she was pregnant before she even told them. "

I've heard this story referenced time and again with respect to motivating people to care about privacy and tracking. I'm all for privacy, but I feel like: (a) we should have more recent anecdotes about the consequences of tracking than a story from 2012, (b) the mechanism that Target used to infer this is far less intrusive (not making it OK) than what we see here, and (c) its really not strong enough an example.

Not that speculation is the way to go, but what about the possibility of someone being turned down for life insurance due to this information?

<comment><USER25> Well, it is a simple example and has the virtue of being true instead of the often quoted but misrepresented McDonalds hot coffee story. Simple examples showing a situation are best, and much like iOS bug statistics, the parties who would have the statistics on situations caused by tracking are never going to make them public.

</comment></comment><comment><USER26> They don't even get into the repercussions of loading externally-hosted JavaScript into a secure page.

We avoid this entirely (also hosting medical data), though it's been a bit of extra work to do so.

I'm sure Chartbeat, Mathtag, Mixpanel, Google, etc. are reasonably careful about their security, and of course they would suffer as well if one of the servers/scripts was compromised and the breach was made public.

But in short -- healthcare.org's security _relies_ on the idea that _none_ of these many 3rd parties will ever have a CDN server compromised, for example. Or (in other situations) have the NSA demand access.

It just takes one -- and then an "improved" script could be delivered to only clients visiting a single targeted site, or even specific targeted clients. The normal customer just sees the lock icon and can verify that there's a secure connection to the main host; but there are actually many other connections going on to other hosts, and any of them may provide a script that can access any sensitive data on the page.

</comment><comment><USER27> What else could one _possibly_ expect when an industry has succeeded at convincing the government to make buying their product mandatory?!

I know the EFF focuses specifically on informational issues, but stirring outrage over one abuse of a captive market when such abuses are _by design_ is a disservice to general sanity.

<comment><USER3> The ACA model in the US is very similar to what exists in many places in the world e.g. here in Australia. And it was driven from the needs of the government not the needs of the health care industry. Although they are a beneficiary. That said the model really does work.

The fact is that uninsured people has a devastating effect on the economy. It prevents movement of labour, affects productivity, promotion to higher socio- economic levels, prevents people starting businesses, affects crime and countless other social effects. You need to force people who don't think they need it to have it.

<comment><USER28> From experience, an Australian doesn't have the correct frame of reference to even engage in the US healthcare debate. I have tried to understand the issues many times but it comes from such a fragmented starting point it's difficult to understand unless you've been in it for a long, long time.

Your points about uninsured are valid, but it's much more complicated than just saying 'hey, you guys should insure everyone'. So I generally try and observe from the sidelines.

</comment></comment></comment><comment><USER29> Currently, [https://disconnect.me/](https://disconnect.me/) browser extension says [https://www.healthcare.gov/](https://www.healthcare.gov/) uses:

\- 0 Facebook, 3 Google, 0 Twitter

\- 0 Advertising

\- 6 Analytics: 1 ClickTale, 4 MixPanel, 1 Chartbeat

\- 0 Social

\- 6 Content: 3 Google, 3 Optimizely

</comment><comment><USER30> More government doing shitty things not in its charter. I'm numb to this abuse. Next up: increased taxes + inflation.

I hope I live to see the day that the laws are twisted and shredded such that all corporate-government data about every person is available for purchase. I'd love to have that detailed record of everything I've said, thought, places I've been, etc since ~Y2K. How cool would that be?

I've heard it said that future cultural anthropologists of the future will absolutely love mining the rich personal data coming out of this period of time.

<comment> at-fates-hands >>> I've heard it said that future cultural anthropologists of the future will absolutely love mining the rich personal data coming out of this period of time.

Former Anthropologist here.

While culturally speaking it will be interesting, up to a certain point in human history there has always been _physical_ things left behind by cultures to denote their existence.

As our whole lives have become digital, once the servers are gone, the pseudo physical evidence will vanish. One of my professors told me in passing in the early aughts that, "This generation (meaning the Y generation) will barely leave a trace of its existence in 200 years."

He inferred that once technology has evolved past our current rate of burn, the mechanisms by which we preserve our memories will be forever wiped out. He made a note of saying, "When was the last time you used something _physical_ to create, retain or share your memories?" When was the last time you printed a photograph? Listened to a music _album_? Once the devices by which we save our memories become obsolete, so does our existence.

It caught me off guard, and was. . one of those times where you stop and wonder what people will dig up in 2-300 years from now and discover about our civilization? Will it all just be zero's and one's on a server somewhere?

<comment><USER31> Couldn't you say that hard drives, SSDs, tape backups, etc are all still physical mediums? While these mediums lose data over time, forensics will still be able to recover partial data, similar to other physical mediums (pen and paper, photos, etc).

<comment><USER32> Those are usually destroyed when their useful life ends, exactly because someone might dig them up later and extract data from them. Large corporate data centers, for example, physically destroy hard disks and never allow them to leave the facility intact.

There will be hard drives left around by individual consumers, I suppose, but the vast majority of all those that exist today are likely to be deliberately destroyed. We're so good at copying and replicating data these days that we no longer rely on hard drives for data permanence over long periods.

</comment></comment></comment></comment><comment><USER33> If you're looking for a better place to go than healthcare.gov, give us a try at stridehealth.com. Bunch of ex-privacy folks and healthcare folks - can shop from your phone. Pretty shocking to see such a novice mistake by an org I think we were all expecting to take it up a level this year.

</comment><comment><USER34> Don't worry guys, Obama's friend's companies will use that information to sell you better products. It's for your own good!

</comment><comment><USER35> I heard something awhile back about the us government(NSA) leveraging the cookie in a way that they could use it as a surveillance beacon. I doubt there is any relation, but it makes you think a bit.

[1] [https://www.eff.org/deeplinks/2013/12/nsa-turns-cookies- and-...](https://www.eff.org/deeplinks/2013/12/nsa-turns-cookies-and-more- surveillance-beacons)

<comment><USER36> I am sure the NSA are involved with at least some aspect of all .gov addresses.

</comment></comment><comment><USER37> One of the heavily trafficked sites in India (Railway Booking) has been showing Google adsense ads. Someone is making a Million dollars a month in Government :)

[https://www.irctc.co.in/eticketing/loginHome.jsf](https://www.irctc.co.in/eticketing/loginHome.jsf)

536 Global Rank (50 in India): [http://www.alexa.com/siteinfo/www.irctc.co.in](http://www.alexa.com/siteinfo/www.irctc.co.in)

<comment><USER38> What does this have to do with the topic of this thread?</comment></comment>


Real VC Might Be The Safest Asset Class Today - <AUTHOR> http://www.readwriteweb.com/archives/real_vc_might_be_the_safest_asset_class_redux.php <comment><USER2> This article bugs me. First, the author's distinction between real and momentum vc is very retrospective. Especially with early stage investment, it's just not always clear who will be a 'real' investment vs. a 'momentum' vc. All early stage vc's are trend spotters who are trying to time their investments in companies to the market.

Second, there is no real analysis to support the headline. Even in bad economic times, I bet historically, traditional asset classes like equities have done much better than vc investments as a whole.</comment>


Yellow Cab, Long a Fixture of City Life, Is for Many a Thing of the Past - <AUTHOR> https://www.nytimes.com/2017/01/15/nyregion/yellow-cab-long-a-fixture-of-city-life-is-for-many-a-thing-of-the-past.html <comment><AUTHOR> "Today, there are more than 47,500 cars affiliated with bases operated by ride-hailing apps, of which more than 46,000 are connected with Uber, though they may be used for other services, too. In contrast, there are just 13,587 yellow cabs."

.......

"Many yellow-cab owners and drivers are struggling in a city with more transportation options than ever, including a new subway line on Second Avenue and the proliferation of Citi Bikes. The medallions that give cabs the right to operate have plummeted in value, going for less than half of the $1.3 million price recorded in 2013 and 2014, though industry experts have cautioned that their value was inflated."</comment>


Remote worker: Renting for 3 Months? - <AUTHOR> I'm moving to Texas, and it would be great to rent a place for 3 months to see if I like it before signing a lease. How can I find a place for 3 months? How can I make sure the place is good coming from another state (doesn't have bed bugs, the AC is good, etc) <comment><USER2> Extended stay hotels. Here is a comprehensive list of brands to check out. [1]

The standard hotel taxes sometimes drop off after 30 days. This depends on the local municipality though. You can also generally get a better rate by calling.

[1] [https://en.wikipedia.org/wiki/Category:Extended_stay_hotel_c...](https://en.wikipedia.org/wiki/Category:Extended_stay_hotel_chains)

<comment><USER3> I can't say what the laws are in Texas, but in several tourist spots anything less than 7 months is considered a vacation rental and is usually more expensive, due to tourism tax. It had never occurred to me that could apply to extended stays in hotels.

</comment></comment><comment><USER4> Texas is a big place. It varies a lot between El Paso and Nacogdoches in one direction and Presido and Amarillo in the other. Booking a hotel for a week or so would allow time to see options in person.

</comment><comment><USER5> No big advice for bed bugs or AC besides visiting (or hire someone to visit). For the 3 months portion, if you're looking near a college town, you could sublease from someone (search craigslist or local college Facebook groups)

</comment><comment><USER6> Aribnb, talk to the landlord and try to get a deal.

</comment><comment><USER7> Craigslist is a good resource

Looks like lots available in DFW area if thats where you're headed.

[https://dallas.craigslist.org/dal/sub/d/dallas- from-40-nt-21...](https://dallas.craigslist.org/dal/sub/d/dallas- from-40-nt-217-wk-868-mo-at/7181147312.html)

<comment><AUTHOR> Thanks! How can I make sure the WiFi is fast, doesn't have bed bugs, the AC is good?

<comment><USER7> Well I guess you could ask the landlord? I think you might want to look into a rental agency.

Bed bugs is a tricky one, maybe look into some traps, toss the sheets when you get into the room and look for blood spots(I'm sure there are travel blogs with more advice on this).

Wifi is probably decent most places, Texas is a populous state so there has been quite a lot of investment in connectivity.

As far as AC goes, Texas is warm but I was there in May a couple years back and needed to put on a sweater so I wouldn't make that a priority considering summer is almost over.

You could always get a hotel for the first week, then view a few places once you get to your town, this will allow you to check out the neighborhoods and find one that fits your lifestyle.

If you're moving to the DFW, they have a really good transit system with rail connecting the three major cities. I believe it was called DART or Dallas Area Rapid Transit.

Good luck!

</comment></comment></comment><comment><USER8> I'm in a similar situation and I found corporate housing to be a good option, they typically are fully furnished and have good wifi and other amenities necessary for remote work. A lot of them are very flexible these days given the lack of corporate travel.

</comment><comment><USER9> AirBnB (message them ahead of time, should be able to work out a special rate), long term stay hotels (e.g. Extended Stay America), or Craigslist.</comment>


Routine Traffic Stops Should Not Be Used to Fight Violent Crime - <AUTHOR> https://www.strongtowns.org/journal/2019/4/8/routine-traffic-stops-should-not-be-used-to-fight-violent-crime <comment><USER2> 'Officer: "So, what's the problem? Why are we in this situation?"

Young Man (voice cracking): "You. F---ing you!"'</comment>


Ask HN: How to Decode .exe Binary to Recover Source Code - <AUTHOR> Hello Hackers,
I recently came upon some school work of mine, code I wrote, from high school in 2001 as a sophomore.
For my high school CS101 class, I wrote a C++ game called Snake. The game was written using a graphics library called Allegro (https://www.allegro.cc/). Allegro was a lovely library.
It is still possible to download the original zipped binaries which I uploaded 19 years ago. They can be downloaded here: https://www.allegro.cc/depot/snake2
I also put them online here: https://github.com/natehouk/snake
(There is also a second game Mastermind available here https://github.com/natehouk/mastermind and here https://www.allegro.cc/depot/mastermind)
Unfortunately, I can not find the source code anywhere. I am very saddened by this. I thought it would be very fun to see code I wrote when I was 15, nearly 20 years ago. It would be especially fun to see how I've improved, or what neat tricks I came up with at that young age.
I have the .exe and the .dat data files and the original readme.txt. I have tried running my program on Windows 10 and with Wine. In both cases, the program crashes. I have tried all of the compatibility modes in Windows 10 and none of them work.
The year was 2001, so I believe we must have been using Windows 98 in the classroom, maybe Windows NT 2000? I can't remember.
I know that my program ran great back in the day. It even got 100,000 downloads off Download.com back then before cnet ruined them.
I want to play my game. What can I do to get my program running again? It seems like Allegro is barely supported these days. I think I need to try a native Windows 2000 install. Was it naive of me to think I would easily be able to run a program from nearly 20 years back?
What tools are available and what is state of the art for decoding a compiled binary back into readable source code?
Thanks for any info. <comment><USER2> A first step can be disassembling and then decompiling the binary. A good, free tool for this is Ghidra: [https://ghidra-sre.org/](https://ghidra- sre.org/)

It will not give you code that you can recompile, but it should be possible to understand and recreate the code based on the result of decompiling the software

An alternative approach can be to emulate the binary under e.g. qemu

</comment><comment> non-entity The easiest way to run it would probably be running an older windows version on a VM. Maybe not 2000, but something like XP might work?

I suppose you could always reverse engineer it worst case, but that's probably a much more work than you're looking to do, especially without any debug symbol info.

<comment><USER3> Yeah. I think around Vista something changed with compatibility. If I remember the more expensive version of Vista had a way to get a included XP virtual machine... so I think a VM might be the best idea.

Edit: oh Windows 7 includes a XP mode that uses a VM in seemless mode and already licensed bundled with your 7 license. [https://en.m.wikipedia.org/wiki/Windows_Virtual_PC](https://en.m.wikipedia.org/wiki/Windows_Virtual_PC)

Also surprised they did programming in high school, especially back then... I guess my school just sucked compared to others... there's some guy I used to talk to said their school used all iMacs while someone else has a robotics club! While we had old machines not even meeting the minimum windows specs...

<comment> non-entity > Also surprised they did programming in high school, especially back then... > I guess my school just sucked compared to others...

My HS didn't have programming classes either (although they were added the year after I graduated) and that that was I the 2010s. I took a networking course that would have yielded certs, but they decided to scrap that path when I was a senior.

</comment></comment></comment><comment><USER4> Unfortunately, obtaining the source code used to produce a C++ executable from only the executable itself is an unsolved problem and reverse engineering is a generally difficult and labour-intensive process. However, there are tools that will help to reduce the level of pain involved.

The Hex-Rays Decompiler for IDA Pro will produce a remarkably good result in functional terms, but its output won't closely resemble the code you remember writing.

Ghidra looks like a good open-source alternative, though I haven't tried it myself.

</comment><comment><USER5> What you're asking for is skill held by a well paid discipline within the practical arm of the computer science industry. In other words, some people spend their entire careers on reverse engineering compiled binaries. And there's a whole fascinating back and forth arms race between them and people who don't want their code decompiled.

</comment><comment><USER6> I don't have answers to your questions, but I can offer one piece of advice. The program is compressed with UPX, and you must decompress it before you decompile it.</comment>


How to Get a Killer Whale to Say 'Hello' - <AUTHOR> https://www.nytimes.com/2018/01/31/science/killer-whale-hello-mimicry.html?rref=collection%2Fsectioncollection%2Fscience&action=click&contentCollection=science&region=rank&module=package&version=highlights&contentPlacement=1&pgtype=sectionfront <comment><USER2> English is a terrible language sometimes because its semantically quite confusing.

"say" could mean "enunciate the sounds" (the whale is doing that) or could mean "speak, with intent and purpose and understanding of the words behind it"

I'm glad the headline posted here says 'get' because I don't think 'make' or 'teach' are the words you'd use.

If the Orca had been able to do this in the wild, I'd be more impressed. it would imply motivation to engage which I think is absent in a hand reared, tank reared beast.</comment>


Latest update to my friend's 19 year side project - <AUTHOR> http://pegwars.blogspot.com/2016/06/screenshot-progress-update.html <comment><USER2> Wow. He could probably make some good money off this as is (if that was his goal), but I imagine if he added VR support, he's probably get money from everyone that bought a headset.

Projects like this always ended up being more fun for me to play that the vast majority of released polished games. Part of that is probably seeing updates happen that actually change the game. There's something visceral about that feed of updates, and feeling like you're there as something is being made. You can do a lot to engage a user base that way.

<comment><USER3> Yeah, wow. I backed VoxelQuest which is a kinda famously failed project now that was just on HN today: [https://news.ycombinator.com/item?id=11904287](https://news.ycombinator.com/item?id=11904287)

Projects like this can be great because you have direct contact with the creator. That might also be a huge distraction to the creator...

It doesn't take much patronage to support an artist. Dwarf Fortress is fan funded. This is probably the original manifesto that started kickstarter + patreon etc.

[http://kk.org/thetechnium/1000-true- fans/](http://kk.org/thetechnium/1000-true-fans/)

<comment><USER4> I would suggest setting up a Patreon account and getting some recurring revenue that way. A few of the top paid Patreon's are working on games.

</comment></comment></comment><comment><USER5> For reference: [http://pegwars.blogspot.com/2010/03/what-is- pegwars.html](http://pegwars.blogspot.com/2010/03/what-is-pegwars.html)

Neat to see his project grow and evolve as he did for good bit of his life.

<comment><USER6> > Neat to see his project grow and evolve as he did for good bit of his life.

This genuinely makes me want to come up with some sort of long-term (life- long?) project. Like the Sistine Chapel... but not as good. :)

<comment><USER7> Maybe something like this? ;)

[https://en.wikipedia.org/wiki/Justo_Gallego_Mart%C3%ADnez](https://en.wikipedia.org/wiki/Justo_Gallego_Mart%C3%ADnez)

</comment></comment></comment><comment><USER8> Reminds me of Infinity by Ysaneya on GameDev.net -- he started building a space game engine back in 2004, and would regularly post updates over the years. Eventually it almost-launched as an MMO but apparently there was some kind of pivot recently.

[https://en.wikipedia.org/wiki/Infinity_(upcoming_video_game)](https://en.wikipedia.org/wiki/Infinity_\(upcoming_video_game\))

</comment><comment><USER9> Id like to play it just because this guy is actually living in that world for 19 years and its facinating

<comment><USER10> Am I the only one who finds it really hard to fathom that it's 19 years? Almost two decades. I don't think I can find a single device that I had 19 years ago, but this takes continuity and dedication to a whole new level.

<comment><USER11> I've still got a Casio QV-10 digital camera from 19 years ago (no idea if it works) but I suspect that's probably the only gadget I've got.

Garmin eMap from 1999 is probably the second closest.

<comment><USER12> My old man still has his first computer, a ZX-81.

Tried to get it working a few years ago, but couldn't get it to display on the TV. Wasn't sure if it was even powered on because the thing has no lights on it, it was prior to LEDs being commonplace. I didn't have an oscilloscope or the skills to debug it.

Having just finished off 4th year embedded systems I'm probably a bit more qualified to debug it now than I was in high school.

<comment><USER11> > My old man still has his first computer, a ZX-81.

And now I feel old because that was my first computer too.

</comment></comment></comment></comment></comment><comment><USER13> I'd be interested to know if the author followed the "alt.fan.elite" newsgroup back in the 1996-1997 timeframe. There were some discussions on the group at that time re: multiplayer online Elite-type games. (Specifically, I ended having a number of emails w/ a guy named Randall near Melbourne talking about game dynamics, etc, back in late 1996. I'm sure it isn't the same guy, but it brought back fun memories and caused me to dig out some old backups for a quick read today!)

<comment><USER14> Nope I'm not randall from Melbourne and I didn't follow all.fan.elite, sorry! I was playing elite on the zx spectrum around let's see, 1986? And then frontier and first encounters after that. In 96 that was the golden age of space sims, xwing and tie fighter...IWar, freespace, starlancer

<comment><USER13> My Elite experience was on the Commodore 64, but aside from that it sounds like we had a trajectory through subsequent titles that was similar. Your screenshots look great and I really enjoyed reading the entire blog.

</comment></comment></comment><comment><USER15> I'm a huge fan for space-based games and these screenshots remind me of Freelancer (2003). Really neat.

<comment><USER14> I love Freelancer! And the Descent series. Looks like the space combat genre is coming back at the moment, which is great ... it's been a long time!

</comment></comment><comment><USER16> Reminds me of the upcoming No Man's Sky on PS4

<comment><USER17> I noticed that too. Besides the Elite-like premise it has a similar pastel, day-glow aesthetic.

</comment></comment><comment><USER18> Really cool would be to have processes on planets (and stars) which would modify them. To be able to modify them at will and have modification persistent.

Probably quite doable.

<comment><USER14> Care to elaborate? I plan to have modifiable planets but stars? Sounds cool

<comment><USER19> I'm not sure if this is what you are interested in but here's a short summary of the variability of stars.

Stars in general are variable on a multitude of scales. The most popularly known cycle is the recurrance of sun spots, see e.g. the wikipedia page [1].

However, stars in general have their own 'life' from young to old. If you take a star like our sun, which has -- surprise, surprise -- one sun mass, it burns hydrogen to helium in a fusion process. Over billions of years it will deplete its hydrogen fuel and a core of helium will form. This leads the hydrogen fusion to move to the outer layers of the star which make it blow up. During this stage it will blow up like a balloon and have a cooler but very thin transparent surface. Hence the name of this stage: red giant.

During this stage, the sun's radius will become so large that it swallows the orbit of the earth. However, since its density is very low at this stage, the earth will keep orbiting inside the sun (though it's a bit warm then). Luckily we still have another 4 billion years or so until then.

When the sun depletes all of its fuel, it will collapse, and maybe (don't know about the current stage of research on that) a Helium Flash will occur where Helium fusion will occur for a brief moment.

During the collapse of the red giant the dense core will bounce back the outer layers and all what's left is the white dwarf.

It get's even more interesting once you take a look at massive stars which immediately start burning Helium (or even heavier elements). Their lifetime is much shorter than the sun's and they end up in different kinds of catastrophic events called supernovae, which leave high density cores behind. Those are either neutron stars, i.e. blobs of tens of kilometers diameter consisting ONLY of neutrons, or black holes.

If you want to model these lifetimes of stars in a crude way, I would start looking at Hertzsprung-Russel diagrams to figure out the paths which stars of different masses take [2]. From the main sequence to the terminal age main sequence, all the way to the red giant stage, possibly a helium burning stage, maybe a second red giant stage, and what have you...

Once you have a few paths figured out, you can toss a die for the initial mass of the star and then toss another one to find out its age. Then lookup the color, brightness, opacity and size.

[1] [https://en.wikipedia.org/wiki/Solar_cycle](https://en.wikipedia.org/wiki/Solar_cycle) [2] [https://en.wikipedia.org/wiki/Main_sequence](https://en.wikipedia.org/wiki/Main_sequence)

</comment></comment></comment><comment><USER20> I'd like to see a shores of hazeron clone with modern graphics.

</comment><comment><USER21> Looks really interesting. 19 years is an incredible amount of time.</comment>


Go-powered web-services with Rails - <AUTHOR> http://areyoufuckingcoding.me/2012/02/27/go-powered-webservices-with-rails/

<comment><USER2> So, in nutshell: Build your web apps in something hyper productive like rails to proof of concept them, then find the high load bits and replace them with a go service.

Seems like reasonable, if generic advice: prototype quickly, then go back and rebuild in something performant if its successful. Iterate quickly, etc. etc.

<comment><USER3> This has been the practice in Ruby for quite a long time (albeit without Go). Usually high load/slow areas are rewritten as a C module.

So yeah, sound advice but nothing revolutionary. Go looks nice though.

</comment></comment><comment><USER4> His meme-based blogging style is annoying, like reading the article of a 12 year old. Although the subject sounds interesting I didn't finish reading the article.

<comment><USER2> what?

If you didn't read the article, ffs, why are you commenting on it?

<comment><USER4> Because I think it can be done better next time.

</comment></comment></comment><comment><USER5> I've been writing a web app with Go for the past weeks, and for what I can say is that yes, Go has less magic in it, and if you don't do it right, you'll get a lot of duplicated code. It's not designed from the ground up as a web language so it might not be as suitable to write web apps using Go as other languages, but it's a real pleasure to write in Go.

<comment><USER6> _> It's not designed from the ground up as a web language so it might not be as suitable to write web apps using Go as other languages_

By that logic, Ruby shouldn't be suitable to write web apps either.

</comment></comment><comment><USER7> His basic point seems to be "use the right tool for the right job", which I think we all can agree with. I've been programming stuff in Go for about half a year now and I'd have to agree with the author - building a website in Go doesn't make much sense, for many of the same reasons building a website in c or java (for me the java process is too slow) doesn't make much sense. On the other hand, the concurrency model is excellent and for services, background processing, doing all kinds of intensive serverside lifting - i.e. traditional java application areas - Go, in my opinion, beats out java and is an excellent tool for the job.

<comment><USER8> My experience is the opposite. I build websites in Go. I find it about as easy as building in Python. Web programming is mostly about filling html templates with data and Go's built-in html template is excellent (on par with Django templates).

Comparing Go to C for web dev is ridiculous - no sane person would write the whole thing in C.

Even compared to Java Go wins by a huge margin when it comes to speed of development and conciseness of resulting code.

I haven't used use Ruby but writing web services in Go I'm as productive as I was in Python (using App Engine or Tornado).

<comment><USER9> I'd be interested reading further on this. Can I encourage you to post a blog about it.

</comment></comment></comment><comment><USER10> Why accuse all the MVC frameworks in go of copying rails? Rails and django came out at about the same time and since then a similar frameworks for languages like java, php, perl, C#, and groovy have come out.

<comment><USER11> And there were web MVC frameworks before Rails, for e.g. Struts (Java) & Maypole (Perl).

<comment><USER12> WebObjects in 1996

</comment></comment></comment><comment><USER6> _> I stubbornly believe that efforts to clone Rails in any other programming language (Go included) are just ridiculous._

Why? There are other languages that are just as powerful. From a social/community standpoint, Rails does have a big advantage of a large established community with very good dynamics and practices. Neither Ruby nor Ruby on Rails is the be-all or end-all of computation, however. Maybe _cloning_ Rails is ridiculous. What people should strive to do is _surpass_ it.

</comment><comment><USER13> Now that is one amazing domain.</comment>


The new Google Maps app for iPhone and iPad is here - <AUTHOR> http://google-latlong.blogspot.jp/2013/07/the-new-google-maps-app-for-iphone-and.html <comment><AUTHOR> Also includes interior maps for train stations and other buildings, including a floor selector.</comment>


Sharing images on Twitter - <AUTHOR> http://scripting.com/stories/2011/08/09/sharingImagesOnTwitter.html <comment><USER2> Looks good, yes, and not safe for work.</comment>


The Guardians of the French Language Are Deadlocked - <AUTHOR> https://www.nytimes.com/2019/03/03/world/europe/academie-francaise-france-deadlock.html <comment><USER2> As a french guy, I sense some kind of disdain for the Académie Française that I don't really get. The evolution of the french language is not dictated by the Académie, but rather by its use by the french people, and the role of the Académie is merely to decide what should or shouldn't be set in stone in the dictionary. And in fact the usage of the french language is quite diverse, even in France. You can have regional variation in words even in metropolitan France, but if you take into account oversea territories like french polynesia, Guyana or Mayotte it gets even more complicated. So yes, convenient english words that are widely used by french people on a day-to-day basis are not added right away in the dictionary and in fact the Académie is actively trying to find french equivalent for them that are coherent with the etymology of the french language, but it doesn't prevent french people from using them. So I get that the immortals don't represent the french society and the never have. But they do not really have any kind of political impact on the country, the are just the bookkeepers of the français.

<comment><USER3> I think English speakers just find it a bit strange because our own language is such a mess. In fact we don't even agree on how to spell basic words (maybe due to a deliberate political act by Noah Webster? not sure), and there is zero chance of international standardisation at this point, so we can't even imagine an official body that does this. Perhaps that's why some people seem to interpret it as "authoritarian". But in fact many other languages DO have a body like this, and I think it makes perfect sense. I'm not sure if any others have fancy swords and 17th century suits though...

<comment><USER4> But the Dutch have it as well and no one goes on and on about it.

<comment><USER5> Many native English speakers have a certain obsession with France and the French language that doesn't happen with other counties and their languages. It's really strange. For example, in the US, speaking French is considered a particular accomplishment and a sign of good breeding, much more so than with any other second language.

I'm not sure what it's about. Maybe a holdover from French being the language of the English aristocracy during the middle ages?

<comment><USER6> I think there are many reasons, including yours definitely true at least in the cultural unconscious in England. Other possibly more important reasons for Americans - whose white populations come from a wider cultural European base - includes the pre-eminence of French culture in the C17-C18th and through the C19th. Furniture, arts, music, food, wines and all sorts of things were particularly refined there, from before and especially during the courts of King Louis at Versailles through tothe golden decade in the late 19th century in Paris. Everybody who had aspirations to be cultured would speak French: it was the lingua franca after all! It was the language of diplomacy. Aristocratic Russians spoke French rather than Russian. I suspect in the Germanic states that was also this looking towards a rich and prosperous France as well, to the extent of invading it once they gaind some sort of cohesion and became a Prussian / German state in the late C19th. And remember that more white Americans come from Germanic stock than English stock, which is very readily observable in surnames and physiognomy.

I am not a historian and I'm quite happy to be corrected, but I'm suggesting these as factors.

</comment></comment></comment></comment></comment><comment><USER7> It's very anglo-american to take this so seriously. For us it's a club of old dudes who like to bask in past glories and write one of many dictionaries, that nobody reads anyway.

Everyone understands french evolves with usage and must take some influence abroad, and nobody ever refused a word because a 90yo grandpa was slow to add it to their unpublished dictionary...

</comment><comment><AUTHOR> The Académie earlier this month "voted by an overwhelming majority to approve a report compiled by three of its five female members that recommended ending its centuries-old official ban on feminizing the names of professions and trades."

<comment><USER8> It's interesting they're taking the German route rather than the English route which is to erode most feminine gendered trade words: waitress, stewardess, actress, governess, baxter, etc. likewise the male equivalent have become neutral so actor, governor, baker, waiter, etc don't only apply to men.

<comment><USER9> I wonder if the Académie is insisting on following correct etymology. A lot of people are saying 'docteure' as a feminised form of 'docteur'; yet, if you go back to the Latin 'doctor', derived from 'doceo' ("I teach"), and change masculine agent noun suffix '-or' for the feminine agent noun suffix '-trix', then the derived French form should be 'doctresse' (edit: apparently a word 'doctoresse' exists); yet, it's far more likely for the public to simply add an 'e' to the end of 'docteur', which would surely offend the sensibilities of the Académie.

On the one hand, the Académie could make a recommendation on such titles (and it may have done, I don't know) and those would be carried into the French public school curriculum, but the Office québécois de la langue française (OQLF) in Quebec often has its own, separate ideas about how the French language should evolve, and there could be two feminised terms for the same thing, differing based on the region.

Not to mention the other Francophone regions and nations whose curricula aren't tied to the French or Québécois ones.

<comment><USER10> This isn't snark, I'm honestly trying to understand: Why is what Latin did relevant for French in the 21st century? Didn't they branch like 1,500 years ago?

When the French created a new word for, I dunno, "computer" or whatever, they didn't go back to Latin roots to figure out what it should be...or did they?

<comment><USER11> I don't know French, but according to Wiktionary the main French word for "computer" is "ordinateur", which is:

> From Latin ordinator ("one who orders"), from ōrdinō ("to order, to > organize").

> In its application to computing, it was coined by the professor of philology > Jacques Perret in a letter dated 16 April 1955, in response to a request > from IBM France, who believed the word calculateur was too restrictive in > light of the possibilities of these machines (this is a very rare example of > the creation of a neologism authenticated by dated letter).

The older, presumably preexisting definition is "one who performs an ordination ceremony", which is entirely unrelated, so I'd expect that Perret did look back to Latin when coining it as a word for "computer".

Edit: I'm wrong, it's a bit more complicated than that. According to this source, the word was coined from a differently-spelled rare word, ordonnateur:

[https://blogs.transparent.com/french/the-origin-of- lordinate...](https://blogs.transparent.com/french/the-origin-of-lordinateur- computers-in-french/)

<comment><USER12> Spanish (in Spain) is El ordenador - I'm guessing mimicking the French?

Lovely comment on some of the different words for computer in a variety of languages:

[https://en.m.wiktionary.org/wiki/Talk:computer](https://en.m.wiktionary.org/wiki/Talk:computer)

<comment><USER13> To complicate things even further, although "ordenador" may be the official word in Spanish for "computer", it is merrily ignored in many countries, which simply will use the atrocious neologism "computador". I know, I do. :-)

<comment><USER14> But doesn't this directly follow the latin computare?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> I never got the hang of this kind of myopic, senseless traditionalism. If Latin didn't let himself be bastardised with the influences of Frankish and Gaulish there wouldn't be any French.

<comment><USER16> Most European countries have a similar language board, English is more an exception than anything else.

And there's not much Gaulish influence in French, here is the full (and small) list of words originating from Gaulish: [https://fr.wiktionary.org/wiki/Cat%C3%A9gorie:Mots_en_fran%C...](https://fr.wiktionary.org/wiki/Cat%C3%A9gorie:Mots_en_fran%C3%A7ais_issus_d%E2%80%99un_mot_en_gaulois)

<comment><USER17> I don't think any of those have so much pomp and circumstance about their functioning and composition, though.

<comment><USER2> Stop hating on our classy habit vert. French people like having a history, as complex, bloody and sometime shameful it is. We are an old country and we have traditions. The english people have their royal family, the US have their rusty nuclear warheads and we have the institutions de la république.

<comment><USER18> They all have rusty nukes shhhh.

</comment></comment></comment></comment></comment><comment><USER19> relevant to the discussion: [https://www.youtube.com/watch?v=2qT8ZYewYEY](https://www.youtube.com/watch?v=2qT8ZYewYEY)

</comment><comment><USER20> pathetic article. what's with this tone of superiority? I'm not even french and I had to stop reading it.

</comment><comment> enahs-sf Reading the title, I thought to myself, there's a dining philosophers joke to be made, but I can't seem to Sartre it out...

</comment><comment><USER21> > Actually, it is mostly old white men.

So racism is OK?

<comment><USER22> France is a white country, so I don't know what's so surprising about having only white people there. The nytimes is trying to apply American standards to everything.

<comment><USER21> I find American identity politics to be nefarious. And people in France are trying very hard to import them here.

</comment></comment></comment><comment><USER23> This is an authoritarian project. It attempts to impose authority in an area that operates fine or better without it, by people with no particular claim to authority in the matter beyond membership in their own club. How is France improved by having an official government dictionary? For the authoritarian it seems that the proper role of the state to reduce any form of uncertainty in life, and positive uncertainty is oxymoronic.

<comment><USER2> Not it really isn't. I think every european country has a similar institution. At least, italians (Accademia della Crusca) and germans (Deutsche Akademie für Sprache und Dichtung) do. I think, that's because european countries are fusions of smaller regions and kingdoms which had their own language each, and at some point in time it was necessary to have a unique language for the economic development of the country. But for the authoritarian aspect, you do not have any kind of punishment for not following the prescription of the Académie, you can speak french in whatever way you like as long as the people in front of you understand you. I don't get where you get your strong feelings against the Académie from.

<comment><USER24> The relevant entity for German is [1]. Apparently created after or during the struggle for an official reform of the language in the 90 and early 2000.

[1] [https://de.m.wikipedia.org/wiki/Rat_für_deutsche_Rechtschrei...](https://de.m.wikipedia.org/wiki/Rat_für_deutsche_Rechtschreibung)

</comment></comment></comment><comment><USER25> I laugh at this useless institution, but then I realize that many "real" institutions are probably just as useless and anachronistic as this particular one.

</comment><comment><USER26> Truly a very French bunch of elitist old farts, l'academie.

</comment><comment><USER27> The Latin language was destroyed by pompous academicians who refused to allow the language to grow organically. The Academie Francaise has set in motion the destruction of the importance of the french language, because if you don't allow flexibility in your language, eventually people abandon it. Dante's Inferno was i believe one of the first novels done in the vernacular Italian. They can claim they are protecting it, but it will be washed away like a sandcastle because they don't see the forces at work from their little chairs.

They won't even let words in like "Computer". or CPU. Sorry, but when was the last time anyone cared about computer research in the french language? They are crippling themselves by not adopting some english. The Japanese managed to adopt Elevator (e-re-be-ta), because didn't have the concept before Mr. Otis, so acknowledging inventions external to your country is part of not living on an island.

<comment><USER28> > _They won 't even let words in like "Computer". or CPU_

What do you mean? French has a perfectly acceptable word for computer ("ordinateur") and CPU is called CPU in French. Or _processeur_. Elevator is _ascenceur_ , and I don't see a problem with that?</comment></comment>


Interesting: Ruby+LLVM - <AUTHOR> http://llvmruby.org

<comment><USER2> Worth noting this is a Front End for LLVM in Ruby - not a Ruby interpreter... Still interesting though.</comment>


Myths about /dev/urandom - <AUTHOR> http://www.2uo.de/myths-about-urandom/ <comment><USER3> Why hasn't someone qualified re-written that unix man page by now? I've been reading cryptographers trying to explain all of this for a while now. I feel like that would help put a lot of this to rest and save everyone time.

<comment><USER4> It would have saved me a lot of time, that's for sure. And here I thought I was being responsible and informed by reading the man page.

<comment><USER5> Honestly, anyone who cares & can understand will look at the implementation of the two and grok it. Those who don't will screw up the rest of it anyway, and that will create more than enough trouble even with some helpful guidance. Best to have them fail in pretty obvious ways.

<comment><USER6> I would not classify the /dev/random failure modes as "pretty obvious".

<comment><USER5> I guess it is a matter of perspective. If you understand what you need for your cryptography, you'll know if you want /dev/random or not. The fact that it blocks is very, very well advertised and clear. The fact that the difference is that /dev/urandom won't block is also very, very clear. If you don't know which you want, I'd wager you don't understand your cryptographic protocol's needs terribly well, and are best off outsourcing that work to someone else.

<comment><USER7> Last time I tried using gpg on a VM it failed to work (literally would not do anything) because it blocked on /dev/random. Would you say that the gpg people should be outsourcing their work to someone else?

<comment><USER8> Things have improved a little on this front. It turn out gnupg was being a little gluttonous when it came to entropy:

"Daniel Kahn Gillmor observed that GnuPG reads 300 bytes from /dev/random when it generates a long-term key, which, he observed, is a lot given /dev/random's limited entropy . Werner explained that GnuPG has always done this. In particular, GnuPG maintains a 600-byte persistent seed file and every time a key is generated it stirs in an additional 300 bytes. Daniel pointed out an interesting blog post by DJB explaining that a proper CSPRNG should never need more than about 32 bytes of entropy. Peter Gutmann chimed in and noted that a 2048-bit RSA key needs about about 103 bits of entropy and a 4096-bit RSA key needs about 142 bits, but, in practice, 128-bits is enough. Based on this, Werner proposed a patch for Libgcrypt that reduces the amount of seeding to just 128-bits."[^1]

On a related not why are you generating keys on a remote vm? Its probably not fair to say that gpg "failed to work (literally would not do anything)." It was doing something, gnupg was waiting for more entropy. Needing immediate access to cryptographic keys that you just generated on a recently spun up remote VM is kind of a strange use case?

[^1]: [https://www.gnupg.org/blog/20150607-gnupg-in- may.html](https://www.gnupg.org/blog/20150607-gnupg-in-may.html)

<comment><USER7> Thanks very much for the updates on entropy requirements.

Re: "Why are you generating keys on a remote VM" \- prior to this, it hadn't occured to me I couldn't generate a gpg key on linode/digital ocean, VMs. I realize now that keys should be generated on local laptops (or such), and copied up.

Re: "Fair to say failed to work" \- It just sat their for 90+ minutes - <USER2> spent a couple hours researching, and found a bug (highly voted on) that other people had run into the same issue. But, honestly - don't you think that gpg just hanging for 90+ minutes for something like generating a 2048 bit RSA key should be considered, "failing to work?" \- I realize under the covers (now) what was happening - but 99% of the naive gpg using population would just give up in the same scenario instead of trying to debug it.

<comment><USER5> Yeah, the bug was really how it handled the case of waiting forever without telling you why. In GPG's defense, before it actually stars reading from /dev/random, it does give you all kinds of warnings that it needs sources of entropy before it can make any progress.

Hard to get that kind of thing right, but fundamentally it did stop you from making exactly the kind of terrible mistake that I was talking about. ;-)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Actually, the preferred and recommended way to get randomness on modern kernels is to use the new getrandom(2) system call, with the flags argument set to zero.

[http://man7.org/linux/man- pages/man2/getrandom.2.html](http://man7.org/linux/man- pages/man2/getrandom.2.html)

With the flags set to zero, it works like the getentropy(2) system call in OpenBSD. In fact, code that uses getentropy(buf, buflen) can be trivially ported to Linux as getrandom(buf, buflen, 0).

<comment><USER10> This is all fine and dandy for seeding a CSPRNG, but we still don't actually have a CSPRNG in the C stdlib or glibc. getrandom(2) seems to target exclusively getting entropy for seeding, looking at the man page ("These bytes can be used to seed userspace random number generators or for cryptographic purposes."). And of course, the syscall is very recent, introduced in Linux 3.17, coming after the kernels in Debian stable (jessie), which features 3.16, and CentOS/RHEL7, which features 3.10.

OpenBSD and NetBSD feature a ChaCha-based arc4random; FreeBSD and libbsd still seem stuck with RC4-based arc4random[1]. An equivalent for that is sorely missing on Linux. /dev/urandom requires messing with file descriptors, which you may run out of and may require error handling, plus all kinds of security precautions to make sure you're actually looking at the right /dev/urandom[2].

[1] [https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=182610](https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=182610) and [https://bugs.freedesktop.org/show_bug.cgi?id=85827](https://bugs.freedesktop.org/show_bug.cgi?id=85827)

[2] [http://insanecoding.blogspot.ch/2014/05/a-good-idea-with- bad...](http://insanecoding.blogspot.ch/2014/05/a-good-idea-with-bad-usage- devurandom.html)

<comment><USER11> There is an open request to add a posix_random (basically arc4random) to posix [http://austingroupbugs.net/view.php?id=859](http://austingroupbugs.net/view.php?id=859)

</comment></comment></comment><comment><USER12> The root problem is that cryptography is not usable without some understanding. In the latest days we developed an addiction for "best practices" like "use bcrypt", "use /dev/random" or alike which in the field of cryptography are not enough: understanding is the only possible path. Actually, this is true for most things, it just shows up more obviously in the field of cryptography because of the security concerns. So we should replace "use bcrypt" with "Read Applied Cryptography & other books".

<comment><USER13> The average guy doesn't have the time to read enough about cryptography to have the sort of knowledge you're wanting. This very article debates an understanding created by incomplete and poor cryptographic knowledge.

If there's anything I've learned by studying cryptography, it's that the average person needs to invest _significant_ resources to become a pseudo- expert in cryptography - all before they can make any meaningful decision.

Applied Cryptography is not a terribly good starting point for cryptographic understanding these days. That's just another facet of difficulty: where does one even start? Do you want a theoretical baseline understanding? Do you want the high-level, quick-and-dirty overview which only gives a summary? (That'll make it hard to make real, informed decisions...)

If we really want to make cryptography accessible to many developers, the best solution is for the cryptographic community to make our libraries and interfaces better. At the same time, there comes a point where a developer has to stop and say "this is beyond what is standardized in ${widely used library}; we need to hire a cryptographer." In that sense, we need to instill a better anti-crypto ethic.

<comment><USER12> Basically to become an expert cryptographer you need a math degree and ten years of experience, so this is out of question indeed. What I'm referring to is to get enough information in order to understand the big picture: what is a stream cipher, what a block cipher, a cryptographic hash function and its main properties, how many of those primitives are kinda equivalent sometimes and you can use one to create another, the tradeoff between speed and security (and how number of rounds effect the security of crypto building blocks), analyzing simple algorithms in order to _really_ understand why it is so hard for you to create something secure, secure PRNG generation and weak PRNG generation (and how to break a congruential linear generator), algorithms like DH, RSA, basic knowledge on number theory, and so forth. This will not make you an expert, but will give you enough understanding in order to actually undetstand _why_ a rule or a best practice is used and when it is safe or not to break it.

About starting point, this is incredibly sad but true: there is no Applied Cryptography of 2015. The book is at this point in some way outdated and no replacement exists, however what you can do is to read it, and then to read the documents that there are around to get updated information. Also there are now the online courses on cryptography that really help. This may look like an overkill, but at this point crypto is everywhere and is the foundation of most things secure, so it is a requirement of everybody involved with computer security.

<comment><USER6> Well, this is the point of nacl (and successors). You don't need to know that it's using a stream cipher. You only need to know you want to send a secret, and this is the function that does that.

<comment><USER14> How secret is it? How much effort do you want an adversary to spend vs. your intended recipient. How do you want to manage keys between yourself and the recipient? What is the size of the secret? How much do you trust the channels over which you are sending the message? Do you need to validate the identity of the secret's recipient? How many secrets do you need to send to how many recipients each minute?

All of these influence how the secret should be bundled up and sent, and it takes more than a library to pick the appropriate method.

<comment><USER6> OK, I admit, if you like you can make it much harder than it needs to be.

</comment></comment></comment></comment></comment></comment><comment><USER4> Thanks for this. Time to go fix my code[1].

[1]: [https://github.com/andrewrk/genesis/blob/0d545d692110d33068d...](https://github.com/andrewrk/genesis/blob/0d545d692110d33068dee36bbc2492d7aa8aa325/src/os.cpp#L47)

<comment><USER15> Since you're only targeting Linux, if you are fine with requiring recent kernels (3.17), you should probably use getrandom(2): [http://man7.org/linux/man- pages/man2/getrandom.2.html](http://man7.org/linux/man- pages/man2/getrandom.2.html)

</comment></comment><comment><USER16> I prefer to trust the NSA on these matters. They end up saying much of what the author has written, but they make it clear why you want to use one vs the other.

The excerpt below is from [https://www.nsa.gov/ia/_files/factsheets/I43V_Slick_Sheets/S...](https://www.nsa.gov/ia/_files/factsheets/I43V_Slick_Sheets/Slicksheet_RNG_IntroForAppDev.pdf) (which in turn also references [https://www.nsa.gov/ia/_files/factsheets/I43V_Slick_Sheets/S...](https://www.nsa.gov/ia/_files/factsheets/I43V_Slick_Sheets/Slicksheet_RNG_IntroForOpSysDev.pdf) )

Unix-like Platforms (e.g. Linux, Android, and Mac OS X):

Application developers should use the fread function to read random bytes from /dev/random for cryptographic RNG services. Because /dev/random is a blocking device, /dev/random may cause unacceptable delays, in which case application developers may prefer to implement a DRBG using /dev/random as a conditioned seed.

Application developers should use the "Random Number Generators: Introduction for Operating System Developers" guidance in developing this solution. If /dev/random still produces unacceptable delays, developers should use /dev/urandom which is a non-blocking device, but only with a number of additional assurances:

\- The entropy pool used by /dev/urandom must be saved between reboots. \- The Linux operating system must have estimated that the entropy pool contained the appropriate security strength entropy at some point before calling /dev/urandom. The current pool estimate can be read from /proc/sys/kernel/random/entropy_avail.

At most 2^80 bytes may be read from /dev/urandom before the developer must ensure that new entropy was added to the pool.

<comment><USER17> Maybe I'm just tired & not able to detect sarcasm right now, but isn't 2^80 bytes more bytes than are currently stored in the world? That's on the order of 10^24, which is something like 1 million exabytes, which is a million squared terabytes, right?

<comment><USER18> No, it's called being safe

And I wouldn't put it past them to have an attack (at least theorectical) that exploits this

<comment><USER19> There's safe and there's FUD. Nobody will read 2^80 bytes from urandom. You'll literally run out of time before that. It would take around 1,782,051,134 years to do on my system.

So if they write that there's a vulnerability after reading 2^80 bytes - that's great! We're secure. If they write that you must ensure to do something after 2^80 bytes - that's complete bullshit.

<comment><USER18> Yes, reading 2^80 bytes for a practical attac is impossible today (and also for the near future)

However, remember when attacks to 3DES, MD5 were only theoretical?

Also, you may not even need to read 2^80 bytes, there might be a (future) vulnerability that allows you to shortcut this.

<comment><USER20> The difference is that weaknesses were found in 3DES and MD5. Increasing computing power was not the main factor. "Only" being able to produce 2^80 random bytes is a known and expected limitation. Sure, the CSPRNG could in theory be found to have a weakness, but that has nothing to do with the 2^80 bytes and the same could be said for virtually any cryptographic algorithm.

<comment><USER21> What weaknesses in 3DES are you thinking about that yield practical attacks?

<comment><USER20> I am not arguing that there are; that was the parent comment. However, while the 3DES weaknesses don't yield practical attacks now, they still reduce the effective key length. My point was not that 3DES is different in that it is exploitable, but that it is different from the 2^80 limit in that the CSPRNG in that the later is not a result of a mistake in the algorithm's design but instead an expected feature. Just like the fact that any fixed-size key symmetric cipher is "limited" by that key size.

Now, if someone found a lower limit based on exploiting some weakness in the random number generation, the analogy with 3DES and MD5 would make more sense.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Why doesn't Linux follow FreeBSD and provide a single interface (under two names, maybe, for compatibility)? Is there any reason to use /dev/random?

<comment><USER23> Ego. They've put a lot of work into the entropy-tracking thing and they don't want to admit that it wasn't needed.

(Ego is the reason for a bunch of other security misfeatures in Linux. Securelevel comes to mind, where Linus explicitly said after fifteen years, okay, this was in fact the right model all along, you can merge it, just call it something other than securelevel so I don't have to eat my words about securelevel being a mistake.)

</comment></comment><comment><USER24> Is there a patch to make /dev/random behave like /dev/urandom? I've had at least some server software stall blocking on /dev/random, and I already build my own kernels, so incorporating such a patch is easy.

<comment><USER25>
      rm /dev/random && mknod -m 444 /dev/random c 1 9

<comment><USER26> this wont survive reboot, you need udev rules.

</comment></comment></comment><comment><USER27> Is there anyone that, with full access to the machine/kernel, has managed to predict the output of random/urandom?

I know that a PRNG is predictable if you know all the input variables, and the code for it is publicly available, but has anybody in practice been able to exploit that?

EDIT: that's an honest question. I'd like to read a paper about that.

</comment><comment><USER28> Interesting and edifying, thank you. I wonder how the recent 4.2 kernel release affects this: Linux 4.2 Released Improving Cryptography Options[1]

[1]: [http://www.linuxplanet.com/news/linux-4.2-released- improving...](http://www.linuxplanet.com/news/linux-4.2-released-improving- cryptography-options.html)

</comment><comment><USER29> Very interesting article. Clears up the preconceptions I had about using /dev/random over /dev/urandom ("it's more secure!") and explains why in very straightforward language.

</comment><comment><USER30> Java is known to read /dev/random when dealing with SecureRandom class. In particular it might cause extremely slow starting time for Tomcat on fresh virtual machine. There's parameter "-Djava.security.egd=file:/dev/./urandom" and I always felt unsafe using it. Thanks to this article, now I won't regret it even theoretically.

Fun thing is, if you pass "/dev/urandom" to this parameter, Java will read /dev/random anyway. May be that was a wise decision 20 years ago.

</comment><comment><USER31> This is my understanding: /dev/urandom is just a blind producer returning any number in some pool; /dev/random is a producer as well as an inspector, it returns the same number from the pool but it also has an extra eye on the source of that pool and refuse to work if it believes the source is of low quality -- here, not enough entropy.

<comment><USER32> The problem is that /dev/random is too paranoid. It refuses to work if there isn't enough entropy in the pool, yes. But when it produces numbers, it subtracts that amount from the supposed amount of entropy in the pool. Thus it will refuse to work again pretty soon in a lot of circumstances where it's still completely safe to proceed.

For a concrete example, you start out with zero bits in the pool. /dev/urandom will produce a predictable stream of bits. This is extremely bad. /dev/random will block. this is good.

Now you add 1024 bits to the pool. Both /dev/random and /dev/urandom will produce good numbers.

Now let's say you read 1024 bits from /dev/random. This will reduce the entropy counter back to zero. If you then try to read another 1024 bits from /dev/random, it will block.

But this is nonsense! Those 1024 bits you added before aren't depleted just because you pulled 1024 from /dev/random! It is perfectly safe to proceed generating more numbers at this point (or at least it's as safe as it was before), but /dev/random refuses to.

Many systems don't add entropy to the pool very quickly so it's entirely possible to "deplete" it in this way. Then your code using /dev/random wedges and you have a problem. However, few systems are ever in a state where they have zero entropy. Thus the advice to use /dev/urandom.

Ideally, you'd want a device which blocks if and only if the entropy pool hasn't been properly seeded yet, but which never blocks again after that point. Apparently this is what the BSDs do, but Linux doesn't have one.

<comment><USER33> "But this is nonsense! Those 1024 bits you added before aren't depleted just because you pulled 1024 from /dev/random!"

An observer of the produced random numbers can potentially deduce the next numbers from the first 1024 random numbers. This is the reason why /dev/random requires more randomness added -- to prevent the guessing of the next number.

<comment><USER21> No, they can't. That's not how crypto DRBGs work. If you could do that, you'd have demonstrated a flaw in the entire /dev/random apparatus, not a reason not to use urandom.

Think of a CSPRNG almost exactly the way you would a stream cipher --- that's more or less all a CSPRNG is. Imagine you'd intercepted the ciphertext of a stream cipher and that you knew the first 1024 plaintext bytes, because of a file header or because it contained a message you sent, or something like that. Could you XOR out the known plaintext, recover the first 1024 bytes of keystream, and use it to predict the next 1024 bytes of keystream? If so, you'd have demolished the whole stream cipher. Proceed immediately to your nearest crypto conference; you'll be famous.

Modern CSPRNGs, and Linux's, work on the same principle. They use the same mechanisms as a stream cipher (you can even turn a DRBG into a stream cipher). The only real difference is that you select keys for a stream cipher, and you use a feed of entropy as the key/rekey for a CSPRNG.

It's facts like this that make the Linux man page so maddening, with its weird reference to attacks "not in the unclassified literature".

</comment></comment></comment></comment><comment><USER34> Previously: [https://news.ycombinator.com/item?id=7359992](https://news.ycombinator.com/item?id=7359992)</comment>


Someone turned BrettKavanaugh.com into a resource for sexual assault survivors - sahin-boydas https://thenextweb.com/tech/2018/10/10/brett-kavanaugh-site-has-sexual-assault-resources/ <comment><AUTHOR> _We Believe Survivors_

Well, I believe evidence-based allegations.

To really understand the environment here in the US, think about the Salem Witch Trials in the 1690s. Mass hysteria, rules of evidence suspended, sentences mandated before trials took place, the rights of defendants to face their accusers denied.

The judge's fate will be determined by the prejudice each of us brings to his "case" and our subjective reaction to which of the two parties is the more "believable" \-- by which we mean that party that most accords with our prejudices. Judge Kavenaugh's fate will, thus, be decided by a popularity contest held during an era of feminine triumphalism.

<comment><USER2> In the Salem witch trials the accused were executed. This was a job application, not a criminal trial, and the worst thing that would happen to him is not getting a promotion. Even in a civil trial the burden of proof is just more likely than not. In a job application, it's "do I think I can get a better candidate or is this one good enough?" I've been on interview teams where someone got the thumbs down because they were qualified but a few of the interviewers thought they were kind of an annoying windbag. If Kavenaugh gave that performance at my workplace he'd get the boot at round one...."yup, that's it, just a quick chat. HR will get back to you."

<comment><USER3> Exactly. When did the process go from "Find the best America has to offer" to "shove this questionable guy through because we're tired of looking"?

</comment></comment></comment><comment><USER4> It opens with:

 _The start of Brett Kavanaugh's tenure on the Supreme Court may look like a victory for one interest group or another. But, more importantly, it is putting a national focus on the issue of sexual assault – and how we as a country can and should do more to prevent it and to support those who have experienced it._

I'm impressed. It's surprisingly classy.

<comment><USER5> I don't think it's classy. To me, the 'Fix The Court' link at the bottom implies the justice system is broken.

It's wrong that people think they should be able to put someone in prison, or even prevent their political appointment by slandering them with unproven allegations. This is the kind of attitude that leads to the excesses of Nazi Germany or Socialist Russia.

The Justice system as it stands protects everyone in America from arbitrary imprisonment.

<comment><USER4> I'm well aware they have an agenda. It's why I'm surprised. I was expecting something on par with SNL.

<comment><USER5> If liberals had stayed par with SNL, there wouldn't have been such an upwelling of anger over Justice Kavanaugh's confirmation hearings.

</comment></comment></comment></comment><comment><USER6> Good</comment>


Borders files for Ch. 11 bankruptcy protection - <AUTHOR> http://news.yahoo.com/s/ap/20110216/ap_on_bi_ge/us_borders_bankruptcy

<comment><USER2> I hope the San Luis Obispo store is not one of the 200 being closed. The service and selection has declined of late, but I still enjoy visiting this store and have spent quite a bit of money there over the years.</comment>


Apple's suppliers are polluting China - <AUTHOR> http://www.itworld.com/data-centerservers/198771/apple-suppliers-accused-environmental-damage

<comment><USER2> I know that the eco-group is trying to get publicity for a worthwhile cause and that it's easiest to do it by mentioning Apple, but it's misleading to think that if you don't buy Apple stuff, you're "clean."

One of the suppliers named is Kaedar Electronics which is a division of Pegatron, a South Korean company which is a spin-off of Asustek. Asustek still is Pegatron's biggest clients, but other major clients include companies like Acer and Toshiba.

Taiwan-based Unimicron is one of AMD's main suppliers for substrates, AMD gave them an award last year: <http://www.pcb007.com/pages/zone.cgi?a=58721>

Meiko Electronics of Japan is one of the biggest suppliers of electronics for solar panels as well as circuit boards for hybrid and EV vehicles.</comment>