Ask HN: Presenting or explaining past illness in a job application - <AUTHOR>

Hello. Throwaway profile here.
What's the best way to present a period of illness in job applications?
During my Batchelors degree I was horribly unwell. I was in and out of hospital with some life threatening stuff, and scraped my degree with very poor grades. I worked for a few years, quit to do a Masters degree, did that rather well, and am now applying for jobs again.
I like to be upfront about things, but I also don't like scaring people off. In five years or so I can probably leave any mention of grades off my resume, but at this point it would just look suspicious. <comment><USER2> Your Masters will appear first on your resume, so the recipient will see you are capable of getting good marks before they see your bad marks for your undergraduate degree. When you state the marks of the latter, perhaps include a sentence along the lines of, "I was seriously ill in hospital during this period, and so got uncharacteristically low marks." Any further explanation (which should not be necessary) can be left for the interview.

<comment><USER3> Do not put seriously ill anywhere on your resume.

So what if you got bad grades as an undergraduate? If you did ok on the masters, everybody will think that you was a lazy guy who's grown up since then. Also, if your grades where remarkably bad, don't put those in. People will assume they were average bad, now awful.

On the other hand, if you disclose you have had serious health problems, you raise a yellow flag. Does not matter if you have no long term sequels, if there is a suitable candidate with no yellow flag, H.R. is going to take the safe bet. You will not even get a chance to explain yourself.

</comment></comment><comment><USER4> Are you looking for a job in technology? They probably don't care about your grades at all. You may be overthinking this.

<comment><USER5> I agree. I never put my grades on my resume. It was what I did outside of school and how I interviewed that mattered.

Don't be ashamed of your illness. Be direct, honest and proud that you got a degree at all. You presumably came out of the illness stronger and with a different perspective on life. As someone who also went through illness in the past - there is something to be said about how such illness affects one's character. Use that to your advantage if they ask about your bachelor's degree.

<comment><USER6> Did you not put grades when you were graduating out of college? My boss considers it a big no when a recent grad refuses to put grades. I have seen that grades or even degrees do not matter when you claim experience and knowledge. But that seems not to be the case where your masters is a big talking point.

<comment><USER5> _Did you not put grades when you were graduating out of college?_

I think the top recommendations that were made to me about resumes were be specific with your accomplishments, don't lie, play to your strengths and don't have a $%!$ing typo. If you've done anything extraordinary put it on your resume. For instance I was a student senator and had done a lot of mountaineering - that was on my resume. Your job is to sell yourself and standout. So if that means leaving off average or poor grades - that's fine.

Here is my experience coming out of college. My first two jobs were while I was still in school.

My first "real" programming job was doing research on C# and .NET when it was still in beta. I attended OOPSLA that year and met the right people at the right time. Some people from the compilers team offered to keep in contact and I followed up on that to my benefit. I remember one of the guys from the C# compiler team was unemployed when he graduated (previous tech bubble). He wrote a java program to showcase his programming skills and it got him hired at Microsoft on the C# compilers team. Still the "place to be" when he was hired.

My second "real" programming job ended up being my own small business that was momentarily profitable. That was when some friends of mine said I should apply at a startup that they worked at in town. I applied and was hired. I worked there part time and eventually I was making more money doing that than running my business. After I was working full-time they didn't want me to finish my degree because it was getting in the way of work. The lesson there was as soon as your bosses know that they have someone that is competent everything changes.

On paper at the time I don't think there was a chance I would have had anyone choose my resume from a pile and call me up. Luckily I knew a lot of smart programmers that actively recruited me. Most hiring managers will contact you if they have a recommendation and legible resume.

When I interviewed at the startup I was woo'ing them with stories of my small business success more than they were grilling me. I had recently done research for the university and Microsoft in C# and since it was such a new platform I had about as much experience as anyone. When I asked for a salary they offered me $7k over what I asked for. (Ya that was an epic-fail on my part)

My next job was post startup acquisition (no worries I didn't have equity). My degree was a minor point because of all I had accomplished at the startup.

I have a number of friends that have really great traditional resumes. They are now all over the place. If I were looking for a full-time gig I'd start with them. Probably looking to get in on some contract work. Then from there investigate getting hired full-time. I think that is current path to most full-time programming jobs.

</comment></comment></comment></comment><comment><USER7> It would not look suspicious to leave grades off your resume. It's uncommon to place grades on a resume and employers would not blink twice at this information not being present. I graduated with a 3.8 GPA only a few years ago and do not put it on my resume.

<comment><AUTHOR> But that's different. If you applied for a job and in the process someone asks "By the way, what was your GPA?" and you tell them "Oh, 3.8" then it's fine. If you reply with poor grades, to me it casts things in a bad light as it looks like you're leaving off damaging information.

Maybe tptacek is right and I'm overthinking things...

<comment><USER7> It's pretty uncommon to list this info and grades don't matter. I really wouldn't worry about it much. I've interviewed at plenty of companies and been an interviewer at a couple of them (I'm doing an interview tomorrow actually) and never once have I heard anyone ask about grades.

Also, your resume is supposed to cast you in the best possible light. Once you get the interview no one will look at it. A resume reveals how good candidates are at self-promotion more than anything, so I skip right over it without even a glance and ask candidates questions which will reveal if they're bright and know how to write software.

</comment></comment></comment><comment><USER8> If you mention it at all, I suggest being bold - under a heading of 'Other Achievements' include a brief sentence about overcoming the illness - alongside any sporting success or open source work etc. This frames the illness as (ultimately) a success, rather than as a weakness. Hope you find the right job.

<comment><AUTHOR> Thanks. I'll think about that.

</comment></comment><comment><USER9> You finished your Master's. Your undergrad grades are irrelevant now.

</comment><comment><USER10> It may depend on the sort of jobs you're applying for, and there may be cultural differences. For the area I'm familiar with, high-tech non-defense jobs in the US, I'd say leave the old grades off. I've heard that in some other countries, there may be more emphasis on having followed the "correct" path.

I'm trying to remember if I've ever seen someone with an advanced degree put their bachelors GPA on their resume.

If someone asks about your bachelors grades (very unlikely), you've actually got a great story that proves your ability to achieve your goal (graduate from college) in the face of outrageous obstacles. I'd say that's a much more impressive achievement than most recent Masters graduates can point to in their undergraduate record!

</comment><comment><USER11> People who have done things do not need to cite grades on resumes, at all. They are a proxy for future doings among those who have not yet done.

</comment><comment><USER12> Your illness doesn't matter. Telling an employer cannot help you. You only need to convince someone you are the best person moving forward. Easiest way to avoid bringing the question is to leave GPA off resume. No employe should ask about health. If they ask about GPA, just tell them you had to balance abnormally tough family issues that are resolved and no longer a factor.

</comment><comment><USER13> A resume should play to your strengths, and not get too personal. If your grades were bad then, leave them off, but show how awesome you are anyway. If they ask at an interview, just be completely upfront about it. Say they were good in grad school, but bad in undergrad because you were sick.

</comment><comment><USER14> You know what the funny thing is? If you are up front about the fact that you have an illness it can be in fact beneficial for you. Down the line if your cancer ever resurfaces (I hope not) and you lose your job due to some insurance giant. Then that will be a bad place to be in.

So, on the other hand through disclosure (in the interview perhaps?) you can test the company's policy pre-emptively without going through significant pain during that time. It will be harder finding a job, but when you do find one it ought to be worth it.

However, this is a really dangerous line to walk and I really think that you need to move to a country in the EU. Over there, you will be protected in the work force and thanks to the health system things have a better chance of working out...

<comment><AUTHOR> Many of the jobs I will be applying for are in Europe, and as an EU citizen the insurance isn't an issue. But I am also applying to several in the US, so this is all quite helpful.

</comment></comment><comment><USER15> Do not mention your grades on your resume. About half the people won't even ask or care. The ones that do will ask and that is the time to explain what you got and why it was low.

When I was graduating they told us that if you got above 2.5 put it on there, below don't put it on there. Now that I've been out awhile I think that's probably a decent rule of thumb. Personally I don't put it on there even though I did fairly well.

</comment><comment><USER16> It depends on whether you are going through a recruiter or not. A recruiter can broach that topic a little more gently than speaking with your prospective employer. If that's not a possibility, leave the GPA off there and put a bullet with "medical leave: XXXX - XXXX". Your employer will ask, talk about it frankly at that time.

<comment><AUTHOR> Maybe I've just had bad luck, but in my experience recruiters have proved to be a layer of unwelcome misinformation.

<comment><USER16> Depends on the recruiter and industry. Its pretty easy to figure out the jokers from the professionals (simply by asking "Who is the hiring manager?" will a lot of times show you who is who). No doubt the big firms are typically loaded with jokers.

</comment></comment></comment><comment><USER17> doubt anybody really cares .. for all the places i've interviewed, nobody has really touched upon the gpa .. at entry level positions, HR uses a GPA threshold in job postings but I guess that too is just a formality.

</comment><comment><USER18> You question is missing a very important piece of information: What makes you think that past illness is something that'll scare off employers? In other words, what happened, and how did that affect you?

<comment><AUTHOR> Cancer, basically.

<comment><USER18> OK, that's hardly controversial. Why not just put it in there? Why would anyone think "he had cancer, he's unreliable"?

Why do you seems to think that makes your past murky? I mean, I don't envy you, it's a horrible disease, but it doesn't make your past murky.

<comment><USER19> Do NOT mention cancer to any potential employer unless you have to. Cancer doesn't just "go away". Any survivor will be on drugs for years and the threat of relapse is always there. In the eyes of anyone who is providing you with health insurance, it immediately makes you a liability.

<comment><USER18> No health insurance will cover anything for anyone who entered the scheme not disclosing a past treatment for cancer. Health insurance concerns do not go away (quite the opposite) by not disclosing cancer.

<comment><USER20> Disclose it when they ask for past medical history, then, not at a job interview. At that point, they've already hired you, and this becomes an annoying health insurance hassle and not a reason to not hire you. Why stack the deck against yourself?

</comment></comment></comment></comment></comment></comment><comment><USER21> I would suggest you do your best to just gloss over it without lying. I spent a LOT of time very ill. I was too ill to work right after getting my Certificate in GIS. My resume had a 50% call back rate but I was doped to the gills on prescription medication and tanked in every interview. During that time, I was very upfront about my medical crisis. I didn't get a single job offer. I can't prove that was why, but I can't help but suspect it either. The first interview I went to where I did not mention my medical situation got me a job. I just told them I was a former homemaker going through a divorce and did not elaborate on any additional details concerning my lack of prior work experience.

Since you have a Masters, it is more recent and will generally be weighted more in their mind. Lots of folks screw off during college when they first leave home and don't make the best grades. I would be inclined to offer no explanation whatsoever for the poor grades the first time around. If your performance later was better, let that speak for itself -- unless, of course, you are asked point blank. Then be honest.

I think mentioning your medical problem up front is problematic because it implies that it is still a concern. If it is in your past, then leave it there. Honestly admitting to a medical crisis in an interview if asked about the grades seems to me less likely to be problematic. Just answer honestly but minimally. Talking at length about it suggests it still weighs heavily on your mind and I think this implies that it could still interfere with your ability to work. If that is not true, then don't give it a lot of emphasis. LOTS of people have medical conditions. It generally doesn't merit mentioning on the resume.

Good luck with this.</comment>


Why you shouldn't buy an e-reader - <AUTHOR> http://reviews.cnet.com/8301-18438_7-20018620-82.html

<comment><USER2> I bought the Kindle app for my iPhone and now it's pretty much the only way I read.

Saving $2 for each new fiction "softcover" I want to buy? Fantastic.

Saving $5 for each new fiction "hardcover" I want to buy? Incredible.

Saving $15 off Coders At Work? Seriously? AWESOME.

Having my entire book collection with me everywhere, and being able to add to it at a moment's notice regardless of where I am or if I've vaguely close to a bookstore? So convenient, it makes paper books _wince_.

Seriously, there'e relatively few downsides. Comic books don't display well on my tiny phone screen, so I'm not there yet. And not all books are available yet in ebook form (Hell's Angels by Hunter S. Thompson wasn't, but Fear and Loathing WAS.).

But realistically, eBooks, e-readers, and the various apps that emulate them ROCK solid.

</comment><comment><USER3> tl;dr: Don't buy an e-reader, you will end up not using it.

But ironically the poll on that page doesn't support his argument.

As of right now (1331 votes) 66% of the e-reader owners voted for "I'm using it frequently", 22% for "occasionally" and only 12% for "never".

</comment><comment><USER4> This seems oddly similar to the digital photo frame fad from a few years back. They quickly became cheap enough for mass market consumption, but the quality just wasn't up to par for continued consumer interest. This made for easy gifts that were quickly "shelved".

Personally, I still love my Sony Reader PRS505 and I use it almost daily. It's been that way for a few years now.</comment>


Tonido Workspace - Alternative to Microsoft Groove - <AUTHOR> http://www.codelathe.com/blog/index.php/2009/03/22/tonido-workspace-alternative-to-microsoft-groove/

<comment><USER2> Microsoft _Groove_ , not Microsoft Google.

That would be an awfully dysfunctional relationship.

<comment><AUTHOR> Yeap. uncertain times. anything can happen.</comment></comment>


Ask HN: Should I pay Product Hunt to promote my newsletter? - <AUTHOR> I subscribe to the Product Hunt daily newsletter and anyone can sponsor a newsletter edition.
I have a weekly newsletter called Frontend Weekly at http://frontendweekly.co/ and I was wondering if it would be worth it to spend money to sponsor the PH Daily Newsletter.
Keep in mind that: - it's expensive to sponsor one edition. - I have been curating my newsletter as a fun side project but I think it has some growth potential (and possibly revenue potential).
Thanks. <comment><USER2> People still read Product Hunt?

...There's your answer. It's not worth it to invest with them. Try growing more organically on Twitter. Consider starting a YouTube channel too.

<comment><AUTHOR> I didn't know PH is not cool anymore :). I just get the daily newsletter to keep tabs on any new/cool products.

<comment><USER2> > I didn't know PH is not cool anymore

Well, they did get acquired by AngelList. PH isn't really seen as a credible source of cool products anymore since they supposedly can rearrange the top content based on who's paying AngelList the most money.

</comment></comment></comment><comment><USER3> It's hard to say without seeing the numbers, but I think you'd be better off finding a newsletter that is tangentially related and swapping links. Maybe a user experience or usability newsletter?

</comment><comment><USER4> How much does it cost to sponsor 1 edition?

<comment><AUTHOR> They sent me the info by email but I am not sure they would want to post it publicly here. Let me clear it with them first before I post it here. Thanks.</comment></comment>


A Tale of Two Newlines: Carriage Returns, Line Feeds, JavaScript Hair-Pulling - <AUTHOR> https://news.floobits.com/2014/04/27/a-tale-of-two-newlines/

<comment><USER2> I don't understand why tools view line endings as a "OS preference" and something that can be changed willy-nilly.

Memory usage, speed, even correctness can be affected by changing newlines if a language supports string literals that span lines.

And who are these users on Windows editing documents that need \r\n anyways? Apart from the built-in Notepad which handles \n uselessly, I'm coming up short on why anyone would care. It's not like the Windows tools (find, fc, and so on) are that popular.

<comment><AUTHOR> Apparently, our customers are the users who need carriage returns. Instead of telling them to fix their configs and remove CRs from their source code, we decided to make things Just Work™.

On Windows, it's not hard to get CRs in your source. With the default git config, cloning a repo gives you text files with CRLFs. Other source control systems do this as well. Many editors on Windows default to CRLF, but even those that auto-detect line endings won't help if your source control munges the lines.

<comment><USER2> Yeah, git's default config also corrupts files by playing with line endings. Meaning the hash of a file on my Windows disk is different than on Linux. Meaning my strings are now shorter/longer. It confuses me just as much in git.

I wonder what editors they're using on Windows that it matters. But good that you're listening to customers.

</comment></comment></comment><comment><USER3>
        "If the first argument to String.replace() is a string,
        only the first instance of that string is replaced. To
        replace all instances, a regex is necessary"

That's not that much advanced javascript knowledge.

<comment><USER4> It's not necessarily "advanced", but it is unexpected behavior I think. I've run into this same sort of issue myself. It didn't take ages to figure out, but it was annoying. It's one of those things that separates an experienced JavaScript dev from the rest.

<comment><USER3>
        "You could stare at that function for hours without seeing
        the problem. It requires knowledge of how JavaScript's
        String.replace() works:"

Okay, but "knowledge of how JavaScript's String.replace() works" is showing that the experience of those guys is not the greatest. I'm pretty sure every decent JS developer knows this after a short amount of time, because "String.replace" is used pretty often.

</comment></comment></comment><comment><USER5> OT, but near the top of your front page:

      "Floobits works pretty well most of the time."
      Matt Kaniaris - Co-founder, Floobits

Can I suggest you change this? Makes me think it's not ready.. and "pretty well" "most of the time".. don't think I would want my team using it. Lost time is expensive.

<comment><AUTHOR> I agree it's unprofessional. I put it there as a joke placeholder and forgot about it. I asked Christopher Groskopf if I could use [https://twitter.com/onyxfish/status/431567402497609728](https://twitter.com/onyxfish/status/431567402497609728), but then got distracted by the dozens of other things on my TODO list. Thanks for the reminder.

<comment><USER5> I liked the rest of your website. Looks like an interesting product. Groskopf's quote would be great for the front page.

</comment></comment></comment><comment><USER6> I really enjoyed reading this. <3 post mortems. Geoff and Matt are awesome (partly because they play foosball.)!</comment>


Blood Transfusion from Ever-Pregnant Females Associated with Mortality in Males - <AUTHOR> https://jamanetwork.com/journals/jama/article-abstract/2657377 <comment><USER2> This is an interesting study, and I highly encourage everyone to also read the accompanying editorial, which raises some important methodological shortcomings. See here: [https://jamanetwork.com/journals/jama/fullarticle/2657356](https://jamanetwork.com/journals/jama/fullarticle/2657356)

The reason this study was done because there has been a very well replicated association between the plasma (not red cells) donated from previously pregnant women and the risk of TRALI, a very rare but deadly transfusion reaction. After this association was made clear, blood banks no longer collect plasma from previously pregnant ("ever pregnant") women, and the overall rate of TRALI has dramatically dropped (from about 35 fatalities in the US per year to ~15).

Source: MD/lab medicine resident

<comment><USER3> Do you have any insight into why, when they were looking at men vs. two types of women, 88% of the blood donors were men? Seems like you would want at least 50% women.

<comment><USER4> I don't think an ethics committee would approve of exposing a study group to a known or suspected higher risk of death without significant safeguards.

Using a small sample exposed to the suspected risk and the vast majority not exposed sounds like responsible ethics.

It is not stated, but there should also have been additional safeguards and monitoring. It is normal for studies to be terminated early if they are found to expose participants to either too much danger or if the study group is found to be significantly advantaged (in which case, for example, the whole group is given the beneficial treatment instead of just the small study group).

50% may sound 'fair' or 'equal', but this is about researching ways of saving life, some social notion of fairness or gender equality is not relevant and, if this study is correct, could have caused excessive death. Is it worth people being killed to get the gender balance into the shape you prefer?

<comment><USER5> > Is it worth people being killed to get the gender balance into the shape you > prefer?

This is obviously a tough question to answer, and maybe the answer here is no. Further, I wouldn't say "worth people being killed" as much as I'd say it's "worth risking people dying". Obviously this is context sensitive and is different for each treatment and study.

Despite this, as the devils advocate, you could say that given that men and women can respond to different treatments in a range of ways, the ideal distribution would be diverse enough to accommodate for those differences, which would provide a better statistical subset and by extension producing "better" data. Same caveats apply, where you mentioned "too much danger" and if the study is "significantly advantaged". In short, it could be less about fairness (equity) or equality and more about collecting a broader or more diverse range of data.

<comment><USER6> Correct answer is always no. No one should be knowingly killed or endangered to suit a biased view.

</comment></comment></comment></comment></comment><comment><USER7> As a guess, a follow up study should maybe consider that chimerism is a factor. IIRC, a woman remains a chimera for about 27 (or 27.5?) years after giving birth (ie her blood contains DNA from the child she carried). So, you could look at data for female blood donors whose last pregnancy was more than 27 years ago and those whose last pregnancy was less than 27 years ago.

<comment><USER8> I wonder if that data is even captured in the donation process?

Aren't donations pooled? Can't imagine this would leave very many pools without a single ever-pregnant donor.

<comment><USER9> As far as I know only Plasma doses are pooled because of the washing process.

Pooling is also done for blood testing they'll pool samples from a batch together and if the pooled sample comes back positive they'll discard the entire batch of part of it if subpooling was used.

Red blood cells doses come from a single donor.

I'm not sure about platelets.

</comment></comment></comment><comment><USER10> Not completely surprised.

not exactly the same, but in rats young blood makes older rats more healthy and the younger ones less so due to stem cells: [https://www.nytimes.com/2014/05/05/science/young-blood- may-h...](https://www.nytimes.com/2014/05/05/science/young-blood-may-hold-key- to-reversing-aging.html)

(making the assumption more pregnancies = higher age)

<comment><USER11> If it was related to higher age, wouldn't blood donations from older males also be problematic?

<comment><USER10> yeah, but as far as I saw they didn't distinguish age at all. they did men, ever pregnant women, and non ever pregnant women.

<comment><USER12> Has anyone ever studied this stuff before? You think they'd have noticed that if true...

</comment></comment></comment></comment><comment><USER13> Should be able to detect some rogue protien.

</comment><comment><USER14> [https://en.wikipedia.org/wiki/Data_dredging](https://en.wikipedia.org/wiki/Data_dredging)

<comment><USER15> To be fair, the authors are open about the shortcomings:

> further research is needed to replicate these findings, determine their > significance, and define the underlying mechanism.

<comment><USER16> I don't know that the level of significance reported in the paper even justifies further research.

<comment><USER17> > To be fair, this is more or less "boiler-plate text" added at the end of > every research paper

There is usually something discussing future research needs, but it's not always oriented toward "replicate and determine significance".

Though something very much like the note on my this paper is common, for good reason, on papers reporting a novel, borderline significant association with no clear mechanism.

</comment></comment></comment></comment><comment><USER18> So there really is something about the blood of virgins?

<comment><USER19> I hate to break it to you, but never pregnant != virgin

<comment><USER20> Never pregnant is a superset of virgin. According to most

<comment><USER8> Welllll....take a gold star lesbian. She is technically a virgin if you measure virginity by penis-in-vagina sex. She still can become pregnant through artificial insemination. Plus the Virgin Mary!

<comment><USER7> Don't forget Schmi Skywalker. ;-)

</comment></comment></comment></comment></comment><comment><USER21> Please use the original title.

<comment><AUTHOR> I tried to, but the original title "Association of Blood Transfusion From Female Donors With and Without a History of Pregnancy With Mortality Among Male and Female Transfusion Recipients" was approximately double the maximum length allowed by HN. I actually spent about 10 minutes trying to figure out the smallest change that was still grammatically correct and fit the 80 char limit while being as accurate as possible.

That being said, if you have an improved version that fits, I'd be happy to support that.

<comment><USER22> Likewise. That was a particularly hard title to crack.

<comment><USER21> <title> says: "Association of Female-Donor Blood Transfusion and Recpient Mortality"

<comment><USER22> Probably better. I almost used it but thought people would complain about it burying the lede.</comment></comment></comment></comment></comment>


Linux.conf.au 2017 live stream - <AUTHOR> https://www.linux.conf.au/stream <comment><USER2> I can't believe this is the first I'm hearing of this, and it's in Hobart. Did they advertise it anywhere?

</comment><comment><USER3> I'm currently attending and it's an amazing experience!</comment>


The Shapes of CSS - <AUTHOR> http://css-tricks.com/examples/ShapesOfCSS/ <comment><USER2> The moment your code begins to look like this

       -webkit-transform: rotate(-70deg);
       -moz-transform:    rotate(-70deg);
       -ms-transform:     rotate(-70deg);
       -o-transform:      rotate(-70deg);

you know that it's time to either drop the vendor prefix or to hope that there will not be another browser vendor implementing the exact same functionality and again protect it behind a prefix.

I know that technically, the transform specs are not finalized, but considering _this_ kind of consensus (even IE seems to agree), would it even be wise to change the spec again?

<comment><USER3> Technically, browsers are supposed to drop the prefixes when the spec reaches Candidate Recommendation.

</comment></comment><comment><USER4> They had me at the heart but then the infinity blew my mind.

For the record it works in what's now the "old" Firefox 3.6 (Firefox 6 final is out in 4 days)

Everything made of triangles works in IE8 (ie. star and pentagon work).

Unfortunately IE6 does not support background:transparent but if you know what solid background color you do want, you can fake it.

If I remember correctly there is also a way to fake the transparency in IE6 with a chromakey and filter. You basically make the parts you want transparent a crazy color like bright pink and then have the filter make that color transparent. Almost not worth the effort anymore though.

<comment><USER5> Note that the boxes with the source of the css are editable. Makes much easier to edit out parts and see how they are done.

</comment></comment><comment><USER6> How much money would HN save in bandwidth from changing the voting arrow images grayarrow.gif and graydown.gif (both 111b) to two small triangles in CSS as shown in this story? Or would it cost them more to even change to the css-style arrows? Also -- correct me if I'm wrong here -- why doesn't HN use one sprite image instead of serving up the images everytime separately for each story and comment? Probably because it's cached the two small arrows from the beginning so there's very little resources used anyways?

<comment><USER7> They will lose money:

      #triangle-up { width: 0; height: 0; border-left: 50px solid transparent; border-right: 50px solid transparent; border-bottom: 100px solid red; }

is 143 bytes.

<comment><USER8> It would cut out two web requests too.

<comment><USER9> "data:" URLs are pretty good for this too, no web request needed. See RFC2397.

I've been using these a bit lately for little icons and such, I think its a cleaner approach than spriting in a lot of cases. I put a little script to generate data URLs up at <http://nick.zoic.org/art/etc/make-data-url.html>

How good is cross-platform Unicode support these days? I do like the idea of just using characters which look like icons, even if it does feel a bit like writing MS-DOS TUIs with box-drawing characters :-).

</comment></comment></comment></comment><comment><USER10> Can anyone explain the infinity sign? I can follow all of the other shapes.

<comment><USER11> It's two squares, each with three rounded corners and one point, rotated +/- 45 degrees to point at each other.

</comment></comment><comment><USER12> It reminds me about the importance of knowing geometry :-)

</comment><comment><USER13> Do the people who come up with this syntax spend their whole lives trying to make it as unintuitive as possible?

<comment><USER14> CSS is designed for typography and layout. It was never designed to render arbitrary geometric shapes - something like SVG should be used for that. This is just clever hacks pushing the box model to its limit.

<comment><USER15> I don't think that "it was never designed to" and what you should do with a technology necessarily go together. A lot of innovation comes from doing things with technology that it was not originally designed to do. You should be aware that you are beyond the intended purpose, but you should not let that stop you.

<comment><USER16> Yes, a thousand times yes. I assure you that in the 1970s engineers were telling each other that using 8-bit microprocessors to build "toy" computers was outside of their intended purpose.

</comment></comment></comment></comment><comment><USER17> The infinite shape is quite clever.

What I'd like to see is proper anti-aliasing. I'm obsessive enough that it prevents me from using CSS in such cases.

</comment><comment><USER18> Isn't this what SVG is for?

</comment><comment><USER19> Can someone explain the triangles?

I see what their doing, but why does it make the triangle shape? Shouldn't it just render as a square with different sized rectangular borders?

<comment><USER20> Here's a modified version of it: <https://skitch.com/timothee/fxnjf/the- shapes-of-css>

Basically, the triangle is made of _only the bottom border_.

The top border is of width 0px so doesn't show. The element itself is 0x0px so doesn't show either. The right and left borders are transparent so you don't see them, but their width of 50px gives the base of the triangle. (which is then 100px) Finally the bottom border is 100px wide which gives the height of the triangle.

Note that the trapezoid further down is the same thing with a width of 100px for the element itself, as if you stretched that triangle in the middle.

<comment><USER19> It totally clicked when I saw your example, thanks!

</comment></comment></comment><comment><USER21> Just one more thing to take away from photoshoppers. If you're a visual designer, I'd start learning to code.

<comment><USER22> It's a pity the syntax is so horrendous. After working on native mobile apps with real path support this is not appealing at all.

<comment><USER23> This is just a bit of experimentation. Not something with any significant practical benefit.

You just have to look at the code behind this - <http://nicolasgallagher.com/pure-css-gui-icons/demo/> \- for confirmation that this is not a viable solution for complex shape creation.

<comment><USER24> Wow, offtopic, but you have a beautiful site.

I'm in the midst of reading Robert Bringhurst's _Elements of Typographic Style_ and it's really motivating me to design my blog in a lot neater, cleaner, typographically-aware style. I think you've really nailed that. If you haven't read that book yet, I highly recommend it; I think you'd appreciate it.

</comment></comment></comment></comment><comment><USER25> Quote astonished to see that this works in IE9 (apart from parallelogram).</comment>


Skyscanner Travel Restrictions Updates - <AUTHOR> https://www.skyscanner.net/travel-restrictions <comment><AUTHOR> Don't know if you can travel to a country? You want to know when restrictions change an keep updated with Covid 19? Subscribe to country restrictions updates!</comment>


Visualizing Editor Trends in Wikipedia - <AUTHOR> https://cosmiclattes.github.io/wikigraphs/data/wikis <comment><AUTHOR> I've been working on visualizing editor behaviour on wikipedia for the past few months. The presentation below is a sneak peak on some of the graphs alongwith the explanation on reading them. They have some interesting findings.

The presentation - [http://slides.com/cosmiclattes/edit-activity-graphs- analysis...](http://slides.com/cosmiclattes/edit-activity-graphs-analysis#/) The project page - [https://meta.wikimedia.org/wiki/Research:Editor_Behaviour_An...](https://meta.wikimedia.org/wiki/Research:Editor_Behaviour_Analysis_%26_Graphs) The Source Code - [https://github.com/cosmiclattes/wikigraphs](https://github.com/cosmiclattes/wikigraphs)

<comment><AUTHOR> A screen grab of some of the graphs - [https://twitter.com/WikiResearch/status/644874872326254592](https://twitter.com/WikiResearch/status/644874872326254592)

</comment></comment><comment><AUTHOR> Some of the preliminary findings:

The monthly decline in active editors in the english wikipedia may be attributed to the old timers becoming less active. We see this across other languages too.

Only the articles in the (beginning - 2007) cohorts continue to see active edit activity.

Editor retention rates are much higher in languages like de(german), zh(chinese), ru(russian) etc.

zh(Chinese) shows an uptrend on many fronts. Active Editors, retention etc).</comment>


Bypassing SWD/JTAG Lock on NRF52 MCUs - <AUTHOR> https://limitedresults.com/2020/06/nrf52-debug-resurrection-approtect-bypass/ <comment><AUTHOR> Original title is "nRF52 Debug Resurrection (APPROTECT Bypass)" which I felt was less descriptive (most don't know what the APROTECT bit is).</comment>


The Great SIM Heist: How Spies Stole the Keys to the Encryption Castle - <AUTHOR> https://firstlook.org/theintercept/2015/02/19/great-sim-heist/ <comment><USER2> _" TOP-SECRET GCHQ documents reveal that the intelligence agencies accessed the email and Facebook accounts of engineers and other employees of major telecom corporations and SIM card manufacturers in an effort to secretly obtain information that could give them access to millions of encryption keys. They did this by utilizing the NSA's X-KEYSCORE program, which allowed them access to private emails hosted by the SIM card and mobile companies' servers, as well as those of major tech corporations, including Yahoo and Google."_

First, it came for the terrorists, and I did not speak out, because I was not a terrorist.

Then, it came for the muslims, and I did not speak out, because I was not a muslim.

Then, it came for the Dutch, Belgian, and German engineers, and I did not speak out, because I was not a Dutch, Belgian, or German engineer.

If you're an engineer, developer, sales staff, or pretty much anything else, and you work at a company that has something worth stealing, you should think about how this ends. If they don't come for you first, your personal life is now completely fair game for nation state attackers.

They will stop at nothing, they have limitless budgets, they will attack your private life, they will reflash the firmware in components of your personal devices, and they will stalk you. Even when you did nothing wrong, even when your employer did nothing wrong, even when your social graph is in no way linked to anyone who ever did anything wrong.

<comment><USER3> Just as important, if you're an engineer, developer, or mathematician who works for the NSA or a similar agency, you need to take a long look in the mirror and ask yourself if this is really what you wanted to do when you grew up.

<comment><USER4> What, work with some of the smartest people on the planet with a near-infinite budget solving the biggest big data problems out there whilst defending your country from turrists? Sign me up!

<comment><USER5> The smartest people on the planet are not working at the NSA. Most of what they're doing is just plain old data aggregation and analysis, with a side helping of large scale but ordinary hacking. The type that lots of teenagers have done.

From a technical perspective, the sort of research going on at Google (deep neural nets, etc) is in a whole other intellectual league.

<comment><USER6> Conspiracy theories aside, couldn't the NSA just draft Google?

<comment><USER7> I'd be stunned if they didn't have employees embedded at Google and other major technology firms.

<comment><USER8> It has been my assumption that Facebook's and Google's core network and security teams are each a large crowd of embedded spies working for various intelligence agencies.

Think about it: You're a NSA/Mossad/MI5 NetOps operative. You can have access to a lot of information without risking your life, get paid by your agency AND google/facebook. What's not to like?

<comment><USER5> Wouldn't work well. Way too many of these companies key employees are not US citizens and many aren't in the USA at all.

Google, for example, has a large security team in Switzerland, with quite a few German and British employees. The NSA sees itself as a military organisation, it is bound by military rules.

<comment><USER8> > The NSA sees itself as a military organisation, it is bound by military > rules.

What rules would that be? In the military, actively seeking (and using) information you have no right/classification to see is a serious offence. According to articles I've read, not a single NSA employee was disciplined for e.g. spying on their SOs or Exs.

Also: If the NSA doesn't have Swiss and German citizens working for it, it's not a very good intelligence agency. And we know for a fact that it is, at least as far as reach is concerned.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> Personally, the biggest take away to this is the invasive targeting of completely innocent and ordinary people simply as a means to get access to things the NSA needed (sim Card keys). We have concrete evidence they nailed peoples personal email accounts and social networks merely as a means to an get crypto keys in mass. Sure, the potential mass surveillance is exceedingly problematic, but thats mainly problematic because of the potential for abuse. Abuse that we either assumed would happen or already had, but as far as I know there was little direct evidence of.

The absolute lowest bar for surveillance seems to be that a government doesn't use it to intentionally target innocent people/ those not in the game (hell, lets lower it even further to be only people the government themselves believe are innocent).[0]

That potentially allows dragnet collection of data if no one looks at it. It might allow hacking just a company's servers to get access to third party data. It probably allows you to spy on foreign heads of state (even if it's a boneheaded move). But it damn well doesn't allow you to go through the personal communications of people who you know have done nothing wrong and aren't even working for someone who has.

[0] This is precisely the woefully low bar Obama has been espousing : "The bottom line is that people around the world, regardless of their nationality, should know that the United States is not spying on ordinary people who don't threaten our national security and that we take their privacy concerns into account in our policies and procedures,"

<comment><USER10> It's interesting because last I checked Obama/NSA were saying they don't collect content, only metadata (that harmless, _harmless_ metadata [1]). If that's the case, why were they so interested in the SIM key?!

[1] - [http://justsecurity.org/10311/michael-hayden-kill-people- bas...](http://justsecurity.org/10311/michael-hayden-kill-people-based- metadata/)

<comment><USER9> Because they were useful for targeted surveillance? Not that I agree with the means or the scope, but there's an above board explanation for the desire to get the keys . Suppose you have a handful of phones in Pakistan or Iran you need access to very covertly (e.g. some rogue guy in the ISI where getting caught snooping has major consequences). The least risky way to access his communications is to get the keys. The least risky way to do that is to get them from the broadest source possible(to obscure who you're really interest in) and the one most removed from your target. So there's a legit reason to want the keys, even if your only targeting a few legit targets.

But the means of doing so is truly questionable, even given all their assertions about trust us and we don't look at everyones stuff.

</comment></comment></comment><comment><USER11> In 2007 I worked with Gemalto when they ported a Java/PKCS #11 Chip & PIN implementation to the .NET Micro Framework/CAPI for Microsoft, who were using it for challenge/response authN on a remote access project for the UK Ministry of Defence. There was a case study of the project on Microsoft.com, but it seems to no longer be there.

Anyway, this sucks because the Gemalto guys I did this with were to this day among the best vendors I've ever worked with. Really awesome guys, _smart_ , and incredibly willing to share what they knew and did. And it's somewhat ironic that Gemalto are trusted by the UK MoD for sourcing their smart card components in Europe.

So much for keeping it local to avoid hacks.

</comment><comment><USER12> Personally, my biggest takeaway is that _anything_ centralized is compromised, period.

Any centralized system is such a juicy target that the NSA _will_ compromise it. The only way to avoid dragnet issues is to decentralize and force the NSA to expend resources at the edges.

This doesn't means that you can make an individual target secure. The NSA can always outspend you. But you can prevent the NSA from easily just vacuuming up everybody cheaply.

<comment><USER13> Agreed. I still wait to learn that AWS is compromised on a huge scale too. No words yet - mark this post and let's see and wait.

<comment><USER14> replying as breadcrumbs.

</comment></comment></comment><comment><USER15> >>The document noted that many SIM card manufacturers transferred the encryption keys to wireless network providers "by email or FTP with simple encryption methods that can be broken … or occasionally with no encryption at all."

If that's true, then NSA/GCHQ aren't the only people who could have grabbed a big pile of keys.

<comment><USER16> I can confirm this. In many cases these keys are exchanged over email with simple DES encryption and a key known to everybody in the business (pretty obvious key BTW). It really boils down to the security procedures in place between the SIM manufacturer and Mobile Network Operators.

<comment><USER17> I want to chime in to offer the counter. I used to work for Gemalto. I'm not exactly sure _which_ keys you are talking about, but when I was there Gemalto's standard practice for the transfer of the keys mentioned in the article--individual SIM embedded keys--was to use AllynisConnect (which I only mention because it's easily found on Google) to facilitate the transfer of individual SIM keys to the customer. Obviously I'm not going to comment on the details of the cryptography involved, but it was much more considered than "simple encryption methods or no encryption at all."

Notably this mechanism would not protect the keys against an attacker who was inside Gemalto's or the customer's secure network, as seems to be the case here.

I'd be interested in knowing which keys specifically you are talking about.

<comment><USER16> In many cases you have specific procedures in place for security-conscious MNOs, but some of these procedures are such a pain that you inevitably end up finding workarounds to get the business going, e.g. email or USB tokens between various people who are not supposed to have those keys. Of course security officers and other officials are not aware of this. Dig through any sales mailbox and you will find CSV files (usually called output files) containing Ki encrypted with simple DES. I let you ask around to learn which DES key is most often used. Disclaimer: this is not specific to Gemalto.

<comment><USER17> Unfortunately that is very possible, and of course I can't speak for other companies. I will say that Gemalto has internal access protection for these and other information.

Of course, there are lots of things I didn't have visibility on and it is possible that I am overly optimistic.

</comment></comment></comment></comment></comment><comment><USER10> This is exactly why Intel's upcoming SGX worries me greatly, too. NSA could get the "key" to all SGX machines and therefore to _all_ applications using SGX to secure themselves properly (ironically enough) [1].

Intel really needs to figure out how to protect the SGX system against such a key robbery, and not by promising to only give access to a couple of employees in the whole company who know a _very_ special hand-shake. Intel needs to modify the SGX system in such a way that you _don 't have to trust Intel_ (or anyone hacking Intel) to keep the key secure, even if that means the company not giving itself access to SGX at all (which includes not having the ability to update it).

[1] - [http://blog.invisiblethings.org/2013/09/23/thoughts-on- intel...](http://blog.invisiblethings.org/2013/09/23/thoughts-on-intels- upcoming-software.html)

<comment><USER18> You mistake the point of SGX. The point of is a reincarnation of treacherous computing. Intel SGX requires remote attestation. This means that YOU, the owner of the device, is not trusted. To have 3rd party keys would mean they would have to trust you. With trust in you, how could it be marketed to the copyright owners? The answer is that it cannot. The point of Intel SGX is to deny ownership of the device to its owner.

But yes, any situation like this where you cannot be trusted means a hacker can gain a higher level of trust than you if they break the security.

<comment><USER5> SGX does not require remote attestation. Just like all prior TC platforms, it offers remote attestation but there is no requirement that it be used.

By the way, very frequently the owner of a computer is not in fact trustworthy. Situations where that occurs crop up all the time in security engineering.

For example a big use of TC is making Bitcoin wallets that are secure against malware. There are other uses too, like safe outsourcing of private data storage/computation to the cloud.

<comment><USER19> Yup, cloud is a major motivation for SGX (see e.g. [https://www.usenix.org/system/files/conference/osdi14/osdi14...](https://www.usenix.org/system/files/conference/osdi14/osdi14-paper- baumann.pdf) for an example of how it might be put to use). I think it is good idea for making it more difficult for malicious insiders to mount an attack, but any claims of it protecting you from the NSA are laughable given Intel will probably hand over keys to them anyway.

</comment></comment></comment></comment><comment><USER20> What is problematic here is that the legitimacy of almost all information exchanged in a digital form has been lost almost entirely. How much longer must we presume ignorance in what is really happening? How much longer will the innocent be bullied through technological and psychological means to promote the interests of the current national security apparatus with interests entirely different than the rest of America/World? What happened to Aaron Swartz is only a taste of what is happening to the rest of us who believe these types of activities are unethical and a violation of constitutional law. Do we honestly believe that this isn't being used for insider trading, to capture sensitive medical information, and steal other trade secrets that should be protected by law? Wake up America. We need to stand up against this digital tyranny.

</comment><comment><USER21> How many silicon valley patriots would support this outrageous attack?

It was one week ago that Obama was arguing that this kind of activity is necessary.

[http://www.newyorker.com/business/currency/stanford-obama- ti...](http://www.newyorker.com/business/currency/stanford-obama-tim-cook- privacy-security)

This is not a republican/democrat problem. This is an institutional problem. We need comprehensive reform of both parties and it should be followed by a purging of the existing federal machine.

<comment><USER14> the call to revolution falls upon the deaf ears of the well-fed in the silicon valley, my friend.

</comment></comment><comment><USER22> Interestingly this is about Gemalto, a company with a remarkable history.

Remember times when the USofA wasn't adopting the smart card technology ? Well it had something to do with this chip technology (crypto) being a foreign technology which coincidently was the propriety of the French company Gemplus.

At the turn of the millenium an US investment funds (Texas Pacific Group) managed to find its way in Gemplus capital after a couple denials, which is the start what is known in France as l'affaire Gemplus. To summarize instead of helping to conquer the US market, TPG used its power to change the board of director (and choose Alex Mandl as the head), initiated rounds of layoff and moved the R&D to the US to take control of the sought after technology.

The whole thing is shown to be an operation of the C.I.A. through In-Q-Tel to take control of the chip card technology and possibly insert backdoors before exporting. Slow to react, it takes several years for the french government to create its own version of In-Q-Tel called "Fonds Stratégique d'Investissement" and try to reclaim Gemplus, now Gemalto, by becoming the majority stakeholder with 8% of shares in 2009, a move that happens too late and TPG having gotten what they wanted sells its share a year later.

</comment><comment><USER13> I always wondered if HSMs are at risk to be compromised at the core (read: the manufacturer) such as those frome SafeNet (in use e.g. with Box.com on their enterprise external HSM plan).

And guess what, Gemalto merged with SafeNet the other day.

[http://www.safenet-inc.com/SafeNet-Gemalto-Merger/](http://www.safenet- inc.com/SafeNet-Gemalto-Merger/)

Everything is compromised. Everything!

References:

[https://www.box.com/blog/breaking-the-last-barrier-to- cloud-...](https://www.box.com/blog/breaking-the-last-barrier-to-cloud- adoption-with-box-enterprise-key-management/)

[http://www.safenet-inc.com/data-encryption/hardware- security...](http://www.safenet-inc.com/data-encryption/hardware-security- modules-hsms/)

</comment><comment><USER23> This is yet another good argument for TextSecure and RedPhone, which don't depend on the SIM card encryption.

[https://whispersystems.org/](https://whispersystems.org/)

<comment><USER24> While certainly a step in the right direction, the lack of an open baseband remains a huge problem, even with TextSecure. Any smartphone has a whole separate OS running, with access to the system bus and memory, that we generally have zero visibility into. There could be exploitable bugs, there could be actual backdoors, and we just have no idea. If you truly want to secure data, you need to use an airgapped system with hardware that is much more open.

<comment><USER25> That should be a solvable problem, aren't there tons of operating systems professors and electrical engineers around in Europe that could in principle develop an open baseband chip and operating system? Germany and France should have an interest that their communication can't be trivially backdoored by the NSA.

<comment><USER26> Main issue is there really no specifications available on many things. Also it's will be nearly impossible to pass certification so no real manufacturer would use it.

If you want more details you may check OsmocomBB site and IRC.

> Germany and France should have an interest that their communication can't be > trivially backdoored by the NSA.

Nobody saying that governments don't have trusted hardware with only their own backdoors. In almost every country manufacturer have to provide source code and specs in order to pass certification so gov does have everything needed.

Though it's not help anybody else as it's will never be open.

</comment></comment></comment></comment><comment><USER27> At some point, people have to begin to realize that this has progressed past "looking for terrorists."

Statists are gonna state, I guess.

<comment><USER28> The article specifically cites the mobile phone networks of Iran, Yemen, Afghanistan, and Somalia as targets. One is a state sponsor of terrorism, the other three are places where the US is actively fighting terrorism.

<comment><USER29> You conveniently left out Iceland, from the very same sentence that is the source of what you listed. As far as I know, Iceland is innocent of terrorism accusations from the US. (OK, benefit of the doubt: maybe The Intercept added Iceland to the article later, or you genuinely didn't see it.)

Anyway, you really think the "bad countries" you named from a 5-year-old document are an exhaustive list of what they've got today? You think the agencies won't scoop up any other countries' keys, including the United States', just in case their metadata graphs later suggest sleeper agents in "the good countries"?

I'm too ticked to make a good argument about morality or lack thereof right now, so I'll just leave it here. They hacked and surveilled non-terrorists to get the keys, and got the keys of at least one "non-terrorist country" (Iceland), so no, I don't find your argument convincing, and I think the parent post's point stands.

<comment><USER28> From the Intercept article its not clear why this type of data was collected from an Icelandic carrier. The linked graph appears to show 100 IMSI's from Iceland, as opposed to 100,000 from Somalia* and tens of thousands from Afghanistan. It's possible that the Iceland data was acquired incidentally because it happened to come from the same sources that were sending data on more interesting countries. It's possible that there's something of value to be learned in Iceland. I don't know. The Intercept gives us very little context as to the actual products that the intelligence agencies produce. [Edit: Page 11 of this document indicates that the acquisition of keys from Iceland and Tajikistan was unexpected and that those countries were not targeted: [https://firstlook.org/theintercept/document/2015/02/19/pcs-h...](https://firstlook.org/theintercept/document/2015/02/19/pcs- harvesting-scale/)]

I don't dispute the fact that the US government has intelligence-gathering priorities that don't involve terrorism. I would argue that at least one reason terrorism is discussed is that there are diplomatic consequences to saying one spies on foreign governments. I also agree with the more cynical view, that terrorism is cited as a rationale because terrorism is scary and something opposed by everyone the US is trying to convince.

I believe very strongly that the world would be a lot safer if the US government knew certain things like the intentions of the Russian leadership and the capabilities of the Russian armed forces. Or the state of the Iranian nuclear program and that country's negotiating position. Or what exactly is happening on the ground in the midst of all the chaos in Libya or Syria or Yemen.

The answers to these questions will determine the fate of entire regions of the world.

*A subsequent document puts a later figure for Somalia at 300,000.

<comment><USER29> In the interest of the fuller picture, thanks for noting that Iceland and Tajikistan were incidental. I don't know that we have a definitive answer from these docs on whether those keys were even saved. Even if not, it's unsettling that an "automated process" turns up keys "not on the list of interest." The article even says the "system failed to produce results against Pakistani networks, denoted as "priority targets" in the document."

I don't know how far I'd be willing to go to effect a hypothetical, unknown increase in safety and control. I do know that the US government and its allies are destroying the reputations of innocent companies, the peace of mind of hundreds of Gemalto/network employees who will now be wondering if they were personally hacked and to what extent, and the human rights of privacy of hundreds of thousands of people who use SIM cards. Is it worth it? I guess we'll never know, and I don't think the spies can truly say either.

Maybe some of that falls on leakers' shoulders too, but in any case it's not very confidence-inspiring that lowly people like Manning and Snowden were able to steal what they did.

</comment></comment></comment></comment></comment><comment><USER30> How is snowden still producing high-level stuff like this?

Did he really steal info on that many headline-worthy stories all in one go, or does he have fresh sources?

Sometimes this feels like another instance of what I call the "weird al phenomenon", where any person who hears a silly parody of a pop song attributes it to weird al, because "wait, you're telling me there are other song parody writers?"

<comment><USER31> It's safe to assume that the vast quantities of documentation he liberated have enough newsworthy material in them to last those with access a very very long time.

<comment><USER32> Greenwald and Poitras have said this publicly many times. They have years worth of material to report from the cache of files.

</comment></comment></comment><comment><USER33> I think its safe to say NSA/GCHQ are not the only ones in the game who have hit this target.

<comment><USER34> On that note, I wonder if their compromising of these systems affords the target any sort of immunization from attacks by other actors.

It would make sense that NSA/GHCQ wouldn't want their foreign competitors to share in the prize, and it would also be congruent with their interests to not afford competing actors access to such a prize.

Then again, this notion is likely far too romantic. The reality is probably closer to one where foreign actors have compromised everything just the same.

<comment><USER35> Sometimes denying data to others is as good as advertising that someone else got there first. So you might want to leave the treasure trove in place so that nobody else figures out you have it.

Intelligence is wheels within wheels within wheels...

<comment><USER34> Good point. However, it might be possible to deny adversaries without alerting them to the fact that they were denied in the first place.

<comment><USER35> Depends how advanced the adversary is. It also depends on if you want to deny them, because you might learn something by watching what they do. Or you might feed them false data and see what happens.

Aren't mind games fun?

</comment></comment></comment></comment></comment><comment><USER36> Remember when hacking Sony was an act of war?

</comment><comment><USER37> I think one of the big issues here is that for an intelligence agency, good defensive security is essentially silent. There's not a lot of money or political capital in "nothing broke today."

On the other hand, good offensive capabilities, even if kept secret externally, are loud and flashy within the organisation, and come with lots of political capital beyond it.

Because of this asymmetry, I think it's almost impossible for an intelligence organisation to stop its "defense" mission being swallowed by the "attack" one. And so we all end up less free and less safe.

I do sometimes wonder what the world would be like if the NSA took it as its mission to secure the internet and chain of encryption, rather than constantly breaking it. If, for example, they used their resources to seek out vulnerabilities and exploits and fix them.

Maybe such a world is impossible. But I do think there's a valid space for a national cyber defense organisation that runs counter to this trend, that acts to shore up the infrastructure rather than constantly subverting it.

</comment><comment><USER38> I donate to the EFF whenever possible. What else can I do to fight these bastards? I think the NSA is a threat to humanity and I feel helpless.

</comment><comment><USER39> French press is trying to connect Gemalto and NSA. Common denominator is Alex Mandl. He's currently Executive Chairman of Gemalto. Previously, he was in Board of Directors of In-Q-Tel which is a CIA company.

</comment><comment><USER40> One notable line:

"GCHQ operatives identified key individuals and their positions within Gemalto and then dug into their emails. In one instance, GCHQ zeroed in on a Gemalto employee in Thailand who they observed sending PGP-encrypted files, noting that if GCHQ wanted to expand its Gemalto operations, "he would certainly be a good place to start.""

<comment><USER41> Does that suggest they have an exploit in PGP?

</comment></comment><comment><USER42> One key thing that stood out to me was this:

> [GCHQ operatives] noted that the use of PGP could mean the contents were > potentially valuable.

This good reminder that encrypting everything is important for security. Only encrypting valuable or sensitive information provides information to an attacker on where they should focus their efforts.

</comment><comment><USER43> Ironically Gemalto also tracks statistics on data breaches -- guess they ought to update their numbers?

[http://www.cso.com.au/mediareleases/21603/gemalto- releases-f...](http://www.cso.com.au/mediareleases/21603/gemalto-releases- findings-of-2014-breach-level/)

</comment><comment><USER44> Do they want me to be apathetic about the actions of our government? I'm getting close.

<comment><USER25> You should read "The Crisis of Democracy", in short yes, you are supposed to be apathetic, the people in power get uncomfortable quickly if you take an interest in what they do.

</comment></comment><comment><USER45> Since the US and British governments operate on the premise of invading the privacy of all citizens without warrant in order to prevent a handful of bad apples, should other countries consider a temporary blanket ban on all US citizens from visiting to their countries in order to make a point?

I know that only 4% of US citizens have passports, and most countries rely on US trade, but still it would certainly send a message?

Simplistic I know but somehow we need to voice our dissatisfaction with the way things are headed. Foreign citizens can't change US policy, only US citizens can vote out their corrupted system.

The privacy of non-US citizens is considered as fair game. We have no comeback presently.

<comment><USER46> >I know that only 4% of US citizens have passports

You're off by an order of magnitude. It's actually about 38% [0]. Bear in mind Americans even need a passport to travel to Canada or Mexico now.

I also do not think that preventing Americans from travelling abroad will improve their global perspective.

[0] [http://travel.state.gov/content/passports/english/passports/...](http://travel.state.gov/content/passports/english/passports/statistics.html)

</comment></comment><comment><USER47> Isn't the NSA breaking US law by hacking into a commercial entity's network?

<comment><USER48> Which is probably why GCHQ was the one doing the actual hacking. NSA just got a share in the prize.

<comment><USER49> That seems to be the real value in the Five Eyes network.

Each member can undertake surveillance of the domestic communications of the other members, thus absolving the own-state surveillance apparatus from claims of domestic spying. But the poisoned fruit may be (and appears to be) freely shared.

<comment><USER50> If I receive and use/sell stolen property, I've broken the law even if I didn't steal it.

I would think if anyone could work their way through the "standing" restrictions, it could be shown in court that the NSA violated the Constitution by receiving "stolen" surveillance data.

The reason why we have the 4th Amendment is not because the act of spying is feared (as egregious as that is), it's because of what the government might do with the results. So receiving the data violates at least the spirit of the constitution, and I would think the letter also.

<comment><USER49> Maybe. Seems to me that there's a bit of an issue with the general operating mode of an intelligence agency. I've said in the past that I wasn't generally overly concerned with stories such as the NSA's reported monitoring of German chancellor Angela Merkel -- which later reports suggest might _not_ have happened -- apparently they're not even totally up on which close national ally heads-of-state they're spying on. But keeping tabs on other countries -- even friendly ones -- yeah, that's part of the basic remit.

But an organize "we'll spy on yours if you spy on ours" arrangement, particularly with a "don't ask for it, we'll just give it to you" understanding. That's violating the intent of legal and constitutional protections every which way.

At the same time, if a talent scout in North Whateveristan gets handed a sheaf of goatskins exfiltrated from the local TCP-over-parchment connectivity provider, the legality of that data's acquisition shouldn't be a hinderence.

But if North Whateveristan happens to be a friend and we're concerned with that the goatskins reveal, then breaking that information to the government (or other friends in slow places) should be possible at _some_ level.

If there's a resolution by law in this, it's likely going to have to require explicit controls over how and when data of a given nation's nationals or residents is provided to that nation. And bars on mass transfers.

Perhaps mandating them _outside_ intelligence services through diplomatic channels?

At least that'll give Wikileaks a sporting chance.

<comment><USER50> > But an organize "we'll spy on yours if you spy on ours" arrangement, > particularly with a "don't ask for it, we'll just give it to you" > understanding. That's violating the intent of legal and constitutional > protections every which way.

That is exactly my point. And it's horrible, it's the government thuggishly wiping its ass with the Constitution. East Germany would have swooned in ecstasy at all the intelligence porn collected by the NSA.

</comment></comment></comment></comment></comment></comment><comment><USER51> the first line from the one-page-PDF source for the article is:

       "Billing servers to suppress SMS billing"

were the GCHQ risking bankrupting the government because of abusive SMS billing from the telcos?

[1] [https://firstlook.org/theintercept/document/2015/02/19/cne-a...](https://firstlook.org/theintercept/document/2015/02/19/cne- access-core-mobile-networks-2/)

</comment><comment><USER52> Sadly this would be an excellent application for the CFAA except that they agencies involved are immune from its prosecution.

<comment><USER50> Maybe so, but ...

> Additionally, the spy agency targeted unnamed cellular companies' core > networks, giving it access to "sales staff machines for customer information > ...

So these corporations had customers' personal data stolen. I believe they're obligated to inform those customers, and possibly other obligations. (No direct knowledge, just spouting off what I've read during the Target and Home Depot breaches.)

</comment></comment><comment><USER53> Gemalto doesn't just make sim cards. They also make OTP tokens - [http://www.gemalto.com/readers/tokens](http://www.gemalto.com/readers/tokens)

<comment><USER13> And HSMs since their merger with SafeNet.

</comment></comment><comment><USER54> And yet for some reason the idea that data should be separately encrypted at every protocol layer is something people fight.

</comment><comment><USER55> Shouldn't TLS/GPG/OTR/etc have our backs on this anyway (at least on the data- side of it)? I mean, they can now intercept and read any mobile data traffic, but that traffic usually has layer-specific encryption as well (eg: TLS for banking). Doesn't that cover us? Am I missing something?

</comment><comment><USER56> I'm wondering if this also involves stealing keys that secures the Gemalto AWS mult-factor auth devices.

</comment><comment><USER57> It doesn't justify the NSA/GCHQ's actions but the fact these keys could be stolen like that mostly means mobile communications were never really secure in the first place.

I am every day more appalled by the scale of the data breaches we learn about every week.

</comment><comment><USER58> I've always regarded encryption that is not end-to-end as a gimmick.

</comment><comment><USER59> Surely this has got to be illegal. When will the lawsuits commence?

</comment><comment><USER60> At this point, if you are surprised by this, you should not be working in the security field.

</comment><comment><USER61> So, should I get a new SIM?

<comment><USER13> You might start with asking your mobile operator how they react to this compromise.

</comment></comment><comment><USER26> Nothing new. At this point nobody should consider any closed source encryption like something even nearly trustworthy.

<comment><USER17> That has very little to do with this particular attack. The NSA did not attack the proprietary code, which uses standard, open, and publicly-known and documented cryptographic operations, by the way. They compromised the key custodians.

While I agree in principle about open source, using purely open-source software would not have provided any defence here.

<comment><USER26> > While I agree in principle about open source, using purely open-source > software would not have provided any defence here.

In open source software / hardware there wouldn't be "master key" that can't be changed and that have to be used by telecom's. Yeah of course no doubt NSA may penetrate in network of every of them, but it's would be a lot more costly.

<comment><USER5> No, really, this isn't about open source stuff.

Any architecture that requires pre-shared symmetric keys is going to have this problem. The fix is architectural, not open sourcing stuff. From what I understand LTE is significantly better.

</comment></comment></comment></comment><comment><USER7> Absolutely everything is compromised.

<comment> 0x5f3759df-i That is just the opposite argument of saying that nothing is compromised. Neither are correct.

</comment></comment><comment><USER62> At this point, we might as well just go back to landlines and fax machines.

<comment><USER63> Aren't those even easier to wiretap?

I believe (maybe I'm wrong here) that the word wiretap comes precisely because people could literally "tap" into the wire and listen everything.

Or did I miss the sarcasm?

<comment><USER64> The old technologies required more effort (somebody had to go physically tap the wire).

<comment><USER63> When I re-read the parent's post I thought to myself "of course he is being sarcastic!"

But then I saw your post and it made me think. And I believe you are onto something here.

I mean, sure, probably tapping one phone is much easier physically, just connect the wires and you're done. However the point you bring is game- changer.

In ye' olden days spooks were interested in certain persons only, but now it seems that we are all fair game, and so the "easy" way of wiretapping becomes incredibly hard when you want to spy on _everyone_.

It's basically an scalability problem then. Never saw it that way.

<comment><USER65> Except more and more, calls are going over VoIP, which is essentially never encrypted. Even calls from one landline to another, even to a neighbor, might end up on VoIP. And in any given call, there are probably multiple resellers. Each with full capability to intercept, redirect, modify, etc. any call. And tech support is often given access to capture any call, as a troubleshooting measure.

Even companies like AT&T, who you'd think with exorbitant prices would always pay for proper direct connections, actually try to find the cheapest bidder in any way possible. For some destinations, they might a list that's 20+ resellers deep.

In short, tapping major connectivity points is probably enough to capture a _lot_ of calls even if you place them from a landline. (Not to mention there's no real security mindset in telecom at all.)

<comment><USER66> That depends on what network you're using. If you're using a landline from the incumbent local exchange carrier, the probability of a local call going over voip is effectively almost zero. Likewise, for long distance carriers, AT&T, the ex-MCI networks Verizon owns, and the Sprint wireline long distance network (their mobile stuff goes over separate facilities; their long distance network, as well as most of the ex-MCI networks use a platform called the DMS-250, which is very much oriented to non-packet connectivity) generally don't use voip trunks for national traffic. Also, there is no least cost routing operation like on most of the smaller carriers, so there's no need to hit any sort of public network until it reaches the access tandem at your destination, at which point, it definitely isn't exchanged in any sort of IP format.

Internationally, it depends on what carrier they interconnect with and what they want. Generally speaking, I think Verizon will use more IP-based routes (usually to more expensive countries) then the other two.

By contrast, landline service coming from the cable company generally does go over voip, but only within their internal network. For local and inbound calls, it'll still hit some DSx trunks back to the phone network. 1+ long distance traffic, at least on Comcast, is definitely in IP format, and could very well even be hitting the public internet for least cost routing operations.</comment></comment></comment></comment></comment></comment>


Raspberry Pi 4 as a USB-C peripheral - <AUTHOR> https://www.hardill.me.uk/wordpress/2019/11/02/pi4-usb-c-gadget/ <comment><USER2> You can also do a USB client on a $1.50 AVR chip: [https://www.obdev.at/products/vusb/index.html](https://www.obdev.at/products/vusb/index.html)

Source: Compiled and connected a mouse/keyboard firmware running on an ATtiny861a using internal RC oscillator.

<comment><USER3> Why would you do that though when there are a gazillion Cortex-M chips available that support hardware USB? Fast USB and you don't have to use AVR.

Hell, Atmel even sells Cortex-M chips with High Speed USB-2 support (reasonably hard to find; most are only Full Speed).

<comment><USER4> Tool Familiarity?

I've been doing embedded systems large and small for decades but before this year, never put anything with an ARM into production.

AVRs are still my go to for most things because I know them well and have all the tooling ready to go.

</comment></comment></comment><comment><USER5>
      [R]ecent update to the Raspberry Pi 4 bootloader
      (...) enables data over the USB-C port

Am I reading this right that RPi4 has _five_ usable USB ports, i.e. unlike earlier models, port on bottom left of the board can carry data along with power? This is awesome!

<comment><USER6> USB-C includes a USB-2 management channel in addition to the high-bandwidth lanes. It is used for things like advanced power delivery negotiation. On the Raspberry Pi 4, the USB-C port has no high-bandwidth lanes, and it only uses passive power negotiation.

<comment><USER7> > USB-C includes a USB-2 management channel in addition to the high-bandwidth > lanes. It is used for things like advanced power delivery negotiation.

No, all the power delivery negotiation in USB-C, both the basic one using only passive resistor values and the advanced one using the USB-PD protocol, is through the configuration channel pins, which is a separate pair of pins completely independent from the USB 2.0 pins in the middle. (The configuration channel is implemented incorrectly on the Raspberry Pi 4, however; it shorts together the pins, while they should be separate, so it fails with advanced cables which use both pins; and when powered through a source other than the USB-C connector, it incorrectly sources 5V to the USB-C port even when it shouldn't.)

</comment></comment></comment><comment><USER8> Yay, that feature was previously only available on the Pi Zero. Does anyone know if this will work on older computers, using a USB A-to-C cable?

<comment><AUTHOR> Yep, should work fine with a USB-A to USB-C cable as well

</comment></comment><comment><USER9> Site is getting a bit slow - mirror here: [http://archive.is/3bp5L](http://archive.is/3bp5L)

<comment><USER10> cloudflare (22.214.171.124) is resolving archive.is to 127.0.0.5 ??

<comment><USER11> Archive.is doesn't like that cloudflare doesn't give them information about the subnet the query came from, so they give a bad reply to cloudflare. ([https://news.ycombinator.com/item?id=19828317](https://news.ycombinator.com/item?id=19828317))

</comment></comment></comment><comment><USER12> Fyi: USB-c in the rpi 4 is not standards compliant.

A new revision is underway, a fix is just using dumb cables.

<comment><USER7> Using dumb cables avoids one of the issues (configuration channel pins shorted together), but not the other one (sourcing power even when the configuration channel says it shouldn't source power).

That is, the workaround is both "use only dumb cables (which use only one of the CC pins)" and "never connect to a USB-C device which might source power while the rpi is being powered by something other than the USB-C".

<comment><USER13> > _" never connect to a USB-C device which might source power while the rpi is > being powered by something other than the USB-C"_

Wouldn't this actually apply to a lot of use-cases of the project in the linked blog?

The whole point is connecting the RPi as a peripheral of a laptop, i.e. a power-sourcing host. if you do that, you'll also likely be tempted to use an external power supply for the Pi as the USB's supply is limited. It's important to note that this will lead to problems.

</comment></comment></comment><comment><USER14> Is there anything like this that can act as gadget devices for more than one host? (So I can plug it in to 4 different PCs or the like)

</comment><comment><USER15> I fail to imagine a usw case for that. Could someone enlighten me?

<comment><USER9> ... build a smart boot device that provides a bunch of different CD images for BIOSes that don't do USB boot well

... build a safe password keeper that looks like a HID device

... do something interesting with USB-based gamepads to map those to keyboard keys for playing old DOS games

... make a connected USB storage device that offers some sort of additional sync services for the data stored on it (maybe over wifi?)

... make a network adapter that also acts as a firewall, or possibly links to tor/vpn/etc

... Something something MIDI over USB

<comment><USER16> > ... build a smart boot device that provides a bunch of different CD images > for BIOSes that don't do USB boot ...

There's an Android app for that, it's one of the biggest things I miss after switching to the iPhone.

<comment><USER9> That's awesome. Do you recall the name?

<comment><USER17> [https://play.google.com/store/apps/details?id=com.softwareba...](https://play.google.com/store/apps/details?id=com.softwarebakery.drivedroid&hl=en)

<comment><USER18> The last time i checked it needed gadget kernel driver support and root, a showstopper for me...

Apart from that, great concept: load your 5+ cd images onto your 64+ gb android and be done (win10, ubuntu, debian, grml, kali, bios update cd image, etc) and forget about your usb drive collection...

<comment><USER16> I thought modern android required the gadget driver anyway? I'm pretty I was able to use it without root but it was (supposedly) less reliable without it.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Literally converting it into a successful Mac accessory itself is a kickstarter gold!

</comment><comment><USER20> wonder if this would be a much better hw solution for TeslaUSB...

[https://github.com/cimryan/teslausb](https://github.com/cimryan/teslausb)</comment>


No Hope for Europe's Artificial Intelligence Sector - barry-cotter https://sifted.eu/articles/interview-kaifu-lee-artificial-intelligence/ <comment><AUTHOR> What does he mean 'no hope'. EU will issue laws and rules and regulations and will impose fines after fines. There would be structural funds, stimulations funds, and innovation funds, and government bodies and any-monopoly processings.

AI would be as much fun as anything for EU's overlords.</comment>


H.K.: 'We Let The NSA Leaker Go Partly Because The US Got His Middle Name Wrong' - <AUTHOR> http://www.businessinsider.com/why-snowden-wasnt-arrested-in-hong-kong-2013-6

<comment><AUTHOR> Remember how one of the suspected Boston bombers when to Russia undetected because his name was spelled wrong? Do we see a pattern here?</comment>


App Outlet: A Universal Linux App Store with Snaps, Flatpaks, and AppImages - <AUTHOR> https://app-outlet.github.io <comment><USER2> considering the problems with "app stores" , you may want to call it something else, lets say app repository, for example.

<comment><AUTHOR> I'm not the developer, just someone who found this through a blog post (on OMG Ubuntu). According to the GitHub repo, they intend to support installing and removing applications, which makes it similar to GNOME Software or the Snap Store app.

[https://github.com/app-outlet/app-outlet/pull/38](https://github.com/app- outlet/app-outlet/pull/38)

[https://github.com/app-outlet/app-outlet/issues/53](https://github.com/app- outlet/app-outlet/issues/53)

[https://github.com/app-outlet/app-outlet/issues/54](https://github.com/app- outlet/app-outlet/issues/54)

Right now, I have to search through both Flathub and the Snap Store to find sandboxed apps, and there is no central repository for all AppImages. A combined "app store" like this would save me some time on hunting down app listings.</comment></comment>


US Supreme Court will require electronic filings and post them free online - <AUTHOR> https://www.washingtonpost.com/news/the-switch/wp/2017/08/03/the-supreme-court-has-finally-embraced-the-21st-century/ <comment><USER2> This seems like an unmitigated good. The law, in all forms, should be freely and publicly accessible[1].

Part of me struggles with the abject misunderstandings about law I see in both the media and the public...legal jargon and process are inherently dense/anachronistic. That being said, this seems like an opportunity both for SCOTUS to role model transparency and to try and shorten the process by which the interpretation of the sacred texts are communicated to the people.

[1] this includes things like building codes and professional standards which while legally in the public domain are still claimed as copyright and sold by organizations like the American Society of Mechanical Engineers. The EFF has some resources on this: [https://www.eff.org/deeplinks/2014/01/law-belongs- public-dom...](https://www.eff.org/deeplinks/2014/01/law-belongs-public- domain)

<comment><USER3>
      This seems like an unmitigated good.

I agree that this material should be freely accessible. But I don't think it will result in unmitigated good. It will add fuel to the fire of academic legal discourse, which has been an increasingly destabilizing influence that has contributed to the politicalization and polarization of legal discourse and broader social discourse.

We'll soon see dozens, perhaps hundreds of academic papers purporting to apply statistical analysis and machine learning techniques to this new fount of material. This "data" will be used to support whatever pet theories the academics have concocted. Rather than make the law less opaque to the citizenry, this junk science will become fodder for broader social and political commentary.

Maybe improved access to the new filings will makes things better overall. Maybe the resulting fodder will make things worse overall. More than likely we'll just end up in a much more complex world heading down the same road we would have otherwise. In any event, I wouldn't call this unmitigated.

Note that my criticism is largely predicated on the fact that this is Supreme Court material. Neither academics nor social pundits have yet figured out how to mine prosaic material like building codes.[1] I wouldn't rule it out, but consider that this more prosaic material has at least as much raw substance as Supreme Court filings. The SCOTUS filings will be abused because of the meaning we imbue. You'll know all the academic papers coming out in the next few years will be bollocks precisely because, relatively speaking, these filings don't add much new substance overall. At best we should only expect this new accessibility to help budding Supreme Court litigators and other similarly niche domains. For more abstract domains the new material shouldn't move the needle; but it doubtlessly will.

[1] To be sure, there are papers that do mine this material. Their relative paucity is probably a testament to their quality.

<comment><USER4> Having access to raw data is bad because people could intentionally misinterpret it?

<comment><USER5> That's one way to misinterpret what wahern is saying ;)

Having access to raw data is not an _unmitigated good_ because people could (and will) intentionally misinterpret it.

It might be still be _good_ on the balance - but there will be a variety of other consequences, good and bad, intended and unintended. Wahern's point seems to be more that it's far too early to call what the balance of all those consequences might be, and that it's not even a given that they'll be more good than bad - nevermind to make the leap to assume they'll _all_ be good.

Cheaper than ever, barrier-free communication across the globe has it's advantages, for example - but this also leads to spammers and robocallers. I've wondered if some kind of small cost increase per call or email would help keep such things in better check.

<comment><USER6> [http://imgur.com/a/LbARM](http://imgur.com/a/LbARM)

<comment><USER5> "In better check", not "solve", for many reasons. And "wondered if", not "attempted to impose", for many of the same.

</comment></comment></comment></comment></comment></comment><comment> k-mcgrady OT: The Supreme Court in the UK has a YouTube channel [1] where videos of judgements are posted (usually very soon after they take place). I'd be interested to know if the SCOTUS has a similar service. I can't find it on YouTube but maybe they can be accessed elsewhere?

[1] [https://www.youtube.com/user/UKSupremeCourt](https://www.youtube.com/user/UKSupremeCourt)

Edit:

Thanks to the below commenters.

<comment><USER7> SCOTUS somewhat famously only allows audio recordings of proceedings.

[https://www.supremecourt.gov/oral_arguments/argument_audio/2...](https://www.supremecourt.gov/oral_arguments/argument_audio/2016)

[https://www.theatlantic.com/national/archive/2013/03/case- al...](https://www.theatlantic.com/national/archive/2013/03/case-allowing- cameras-supreme-court-proceedings/316876/)

<comment><USER8> Point for debate: Between the extremes of transparency and commodification where should we strike the publication balance?

e.g. If an organization/individual has ulterior motives (of fears) for testifying in a case other than the limited outcome of the legal question, it has the ability to sway their testimony.

</comment></comment></comment><comment><USER9> While this idea seems great, requiring court staff to submit pro se litigants' petitions may be a non-trivial burden. Something like 40% of federal appellate work is responding to (often meritless, often incomprehensible) pro se habeas petitions[0]. I wonder if a side effect of this is additional legislation intended to dampen that burden[1] at the expense of real human liberty. I hope not, but we should balance this issue and be cautious about chilling less fortunate peoples' access to these basic civil mechanisms.

[0] [http://www.lclark.edu/live/files/777](http://www.lclark.edu/live/files/777) [1] See, e.g., [https://en.wikipedia.org/wiki/Antiterrorism_and_Effective_De...](https://en.wikipedia.org/wiki/Antiterrorism_and_Effective_Death_Penalty_Act_of_1996)

<comment><USER10> I get the feeling that (if I understand this correctly) maybe by putting the petitions out into the open for the world to see (by making it easy for anyone to review online) will cut down on the meritless petitions. After all, it's one thing to throw shit against a wall to see if it will stick (especially if it's a wall in DC that very few people ever look at), and an entirely different thing to throw shit against every wall in the entire US to see if it will stick, and not come out looking like a complete jackass.

</comment></comment><comment><USER11> What will pro se prisoners do? I assume there's some provision for that. If not, they can't even appeal the rule itself!

<comment><USER12> > Parties representing themselves will have their filings uploaded by the > court's staff.

</comment></comment><comment><USER13> So SCOTUS runs its own system and the rest of the federal courts lock their public records behind the PACER paywall. Very consistent.

<comment><USER14> Its crazy to me that it is legal for there to be a regular fee for viewing a website per view.</comment></comment>


Ask HN: Favorite movies of 2018? - <AUTHOR> Any movie you would like to recommend worth watching during holiday. <comment><USER2> It's not a movie but I think a lot of people here would really like the Netflix show Pine Gap. It's almost like a political/espionage-y drama/thriller about an NSA ops base in Australia led by a joint US and Australian team. I'm not going to say much more than that without spoiling it or failing to do it justice, but I've watched it twice this last week..

<comment><USER3> How does it compare with the Australian _Secret City_ on Netflix?

<comment><USER2> I thought both were good, if you liked secret city you may possibly enjoy pine gap even more

</comment></comment></comment><comment><USER4> Pariyerum Perumal.

</comment><comment><USER5> Die hard</comment>


Honeypot code challenge - <AUTHOR> http://honeypot.softwareskills.se/#/landingpage/5587cf988a4c5edb08ffa049 <comment><USER2> I do like doing these things for fun. Unfortunately they restrict language choice. And the languages available, while useful, aren't fun. In other words, "Where the Haskell at?"

<comment><USER3> Exactly! Where is Haskell at??

</comment></comment><comment><USER4> Nice try future robot overlords. You have Ai, write your own code..

</comment><comment><USER5> I managed to get 845 on the first level, using horrible horrible hard coding.

Anyone do better? Or get a real dynamic solution?

<comment><USER6> I didn't beat your score on level 1, but I did create a dynamic solution in javascript. You can view it at [http://pastebin.com/wMVyqvz3](http://pastebin.com/wMVyqvz3) (copy and paste the code into honeypot and switch the language setting to js, obviously).

My script builds a map of the level as the robot drives around, using information from the lidar scans with each step. It can then use this map to seek out unknown areas, plan movements, detect enemy movement on all 4 sides, lots of things

The framework is relatively robust. Feel free to erase my `exports.update` function and write your own. As long as you use the custom tank.forward(), tank.shoot(), tank.turn_right() (etc) functions instead of calling their api, it will build a reliable map that you can reference for better decision making.

If you want to see an ASCII version of the robot's internal view of the map, change the `var verbose = false;` to true at the top of the script. But this tends to make my browser lag after the ~60th step. So much output! But it also gives you a step-by-step breakdown of the logic for why it's making each decision. Which is interesting to watch, and useful for debugging.

The whole thing is pretty messy. And I'd like to clean it up, but after 3 days and not getting anything else accomplished in my life (like work) I need stop for a while. It was a fun proof of concept for mapping.

</comment></comment><comment><USER7> Classic humans.

We are being overrun by robots! I guess we could build a robot tank to fight the robots...

</comment><comment><USER8> Python3 framework is broken: SystemError: E:Unable to read /etc/apt/apt.conf.d/ \- opendir (13: Permission denied)

<comment><USER9> Weird, at first it never seemed to run any code no matter what I put in (js/java/python/c++), but after a few refreshes it started to work for me.

</comment></comment><comment><USER10> There goes my weekend.

</comment><comment><USER11> Sounds familiar. Robocode, c++ robots, c robots?

</comment><comment><USER12> similar to [http://aisheep.com](http://aisheep.com)

</comment><comment><USER13> php, c?</comment>