Switzerland is the world's most competitive economy - <AUTHOR> http://www.swissinfo.ch/eng/wef-report_switzerland-is-the-world-s-most-competitive-economy-/42478248 <comment><USER2> It better be, given the cost of living and the salaries here… :-)

On a more serious note, although I have no idea how this report was produced, one might note that it was produced by the WEF (a business-friendly Swiss organisation) and that it may well be part of the ongoing political debate in Switzerland on how to implement the referendum result on restricting immigration.

I'm not saying it's right, wrong, objective, or not, I honestly have no opinion. Just providing some context.

<comment><USER3> Is the cost of living proportional to competitiveness?

Anyway, it seems like a mystery to me why tech firms like Google set up shop in small expensive Zurich instead of say cheaper, bigger Barcelona or Vienna, for example. I'd love to know what the incentives are for them.

<comment><USER2> Well, in Google's case, there's ETH Zurich. Just today, I saw in the newspaper (WSJ university rankings[1]) that ETH was rated top of the pops globally in computer science. (On a related note, I remember vaguely that Disney built a research lab here in Zurich just because of one professor and his team.[2])

Also, in the good old times (= before the rise of right-wing populism and the referendum) Google could attract good people from all over Europe here because in terms of living standard and salary, it could be considered a step up from almost anywhere else in Europe.

Plus the central location and the infrastructure.

I think in the grand scheme of things, Zurich/Switzerland has a lot to offer. I've always felt that people who argue against Switzerland only on the basis of the high salaries and cost of living are a bit like people who argue against Apple on the basis of "speeds and feeds". There's a lot more to being business-friendly than being cheap.

But yeah, who knows, all this may change now, as indeed the report warns. Openness is a pretty big deal for a small, open economy like Switzerland.

______________

[1] EDIT: Just checked again, it was the Times Higher Education World University Ranking, as _reported_ in the WSJ today. Direct link to table here: [https://www.timeshighereducation.com/world-university- rankin...](https://www.timeshighereducation.com/world-university- rankings/2017/subject-ranking/computer- science#!/page/0/length/25/sort_by/rank_label/sort_order/asc/cols/rank_only)

[2] EDIT: Got curious from writing this and landed on their homepage. Their first sentence starts with: _" Our lab in Zürich is perfectly placed for easy access to the Swiss Federal Institute of Technology Zürich (ETH)…"_ That kind of drives the point home, doesn't it? ;-) Source: [https://www.disneyresearch.com/research-labs/disney- research...](https://www.disneyresearch.com/research-labs/disney-research- zurich/)

<comment><USER4> ETH was also the home of Niklaus Wirth and all his research in safe systems programming languages with Modula-2(Lillith), Oberon(Native Oberon, EthOS), Active Oberon (BlueOS) and the commercial descendent Component Pascal.

<comment><USER5> In the 2.4kbps times (.br speeds at the time) I'd print the Modula-3 manuals and have fun at home. And then I discovered I was late to the party and things were slowing down for those languages.

I wish m3 had caught on. Really liked it.

<comment><USER4> I was lucky to still be part of the party and enjoy systems programming with Turbo Pascal (5.5, 6.0, 7), before I was introduced to C.

If you still would like to find Modula-3 related stuff, check [http://apotheca.hpl.hp.com/ftp/pub/DEC/SRC/](http://apotheca.hpl.hp.com/ftp/pub/DEC/SRC/) .

</comment></comment></comment></comment></comment></comment><comment><USER6> Could easily be true in some areas of the economy, because professionalism seems really strong there and core technology infrastructure is often ahead of surrounding areas.

However, my experience of living and working there suggests that it is very much not true in the areas I encountered: businesses cling to tradition and people prefer everything to be managed (contracts should be given to the "right" people, rules should be organised around what traditional groups want). By traditional I mean book sellers, grocers etc. You often get the feeling there is not much logic/forward thinking - only maintain what people are used to. Of course, that is a decision you are free to make, but not one that seems to tally with this article.

Designated innovation area seemed pretty dead. As a consumer the low quality of many companies' websites and ability to automate was quite surprising.

On the other hand, salaries are high almost all office jobs (debatable whether this makes sense for lower skill-sets, but nice if you live there) and it seems fairly easy to get a new job as long as you "fit" in the culture.

I can imagine that some of the big industrial tech and pharma companies are run a bit more aggressively. Finance didn't seem to be.

<comment><USER7> My experience of Switzerland is similar.

Things are very much done according to a formula. If you're an enterprise looking for a Java developer, only a guy whose CV says "Java" will do. C# is some other planet. I think it's a Germanic thing, they expect very specific qualifications. I remember meeting a guy who had a degree as a food chemist. I asked him what jobs he was after, and he said ... food chemist.

There is a startup scene in Zurich though. The tax rate is low, and people seem to have enough savings to give it a go, at least some of the young ones. It's not a huge number of people, but the Swiss are going about it in their own way, with a number "technoparks" and such. It's somewhat cosmopolitan in its outlook; people compare themselves to other startups around the world. Reasonable pay for such small firms, too. Came across more than one 6 figure job.

Salaries are high, but stuff is expensive, too. Daycare for a kid, at a public nursery, is CHF30K a year (USD is in the ballpark of CHF). I've met a number of Swiss people who'd like to have more kids, but it's just a lot of money to pay. A quite ordinary family meal at a restaurant can be 100. Buying the food from a supermarket ain't cheap, either.

I sometimes wonder whether GDP measurement is problematic. Quality of life doesn't feel like it's all that different between various industrialized countries, but the figures suggest they are. If stuff is expensive, that makes GDP higher. So a guy eating a $1 potato is enjoying a lower quality of life than a guy who paid $2 for his. This has implications for wastage, particularly when it has to do with large organisations such as government. Burn more money, get higher GDP. Tax rate also has implications. There's probably more black market business going on in certain countries, which also contributes to general welfare. But of course that doesn't go into official accounts, or at least it's quite hard to guess how much it is. Low tax places like Switzerland are more likely to have more stuff going through official accounts.

<comment><USER8> Salaries are high and daycare is expensive deliberately, or so I've heard. It's a cultural decision - they want women to stay at home with the children and raise them, so the salaries are calibrated to be high enough for a nuclear family. That's why you get things like schools sending children home at lunchtime or on Wednesday afternoons: the school schedules are deliberately set up to be incompatible with working hours, in order to reinforce traditional family setups.

Food is expensive in Switzerland partly because it imports a lot and the surrounding countries know that the Swiss are rich and thus not very price sensitive. I read somewhere that exactly the same kilo of parma ham that costs 10 EUR in Italy can cost 50 EUR in Switzerland simply due to being charged different amounts by the supplier. This is not helped by the fact that the domestic supermarkets have what amounts to a duopoly between Co-op and Migros, with other brands like Denner being owned by one of the big two. There's little price competition.

GDP is a disastrous statistic almost everywhere, not just in Switzerland. Politicians single minded focus on it is a classic case of "what you can't measure you can't manage" being harmful. The biggest problem is that GDP is trivially pumped by government borrowing and spending, hence the endless circular arguments in Europe about austerity and whether governments should try to spend their way to growth. It doesn't work - governments ideas for productive investments rarely go beyond roads and railways - but it can appear to work in the short run as spending splurges feed directly into the GDP.

<comment><USER9> > That's why you get things like schools sending children home at lunchtime or > on Wednesday afternoons: the school schedules are deliberately set up to be > incompatible with working hours, in order to reinforce traditional family > setups.

Just an anecdote: We are (expat) remote workers raising kids on the Swiss countryside. Our fellows haven't started school yet but we are really looking forward to having them come home for lunch. The motivation for the system may well be to suit traditional family setups, and make it hard for both parents to work in an office, but it also seems tailor made for self-employed people who work from home with a flexible schedule and want to spend time together as a family. (ask me again in a few years.)

<comment><USER10> Last time I tried to get a gig in Switzerland as a freelancer, they told me there is no such thing as a freelancer there, every one must be hired.

State mandates that. However, the tax is so low, that is doesn't really matter.

On the other side, the cost of living is so high (Zuerich area) so that it really worth it if you plan to _move_ there for the rest of your live.

<comment><USER11> _Last time I tried to get a gig in Switzerland as a freelancer, they told me there is no such thing as a freelancer there, every one must be hired._

That's absolutely wrong, you've been lied to. Which part of Switzerland was it?

<comment><USER10> That was Zuerich.

They told me, there is no such thing a service contract between an individual and a company. I must be either hired or I need to have my own company.

I am not inventing this, simply repeating what the companies said, and they really meant it.

<comment><USER7> That's totally wrong.

You can be a sole proprietor for basically nothing. There's also two forms of limited companies requiring 20K/100K of capital. The 100 is actually 50K because you only have to pay up half of it upfront.

I found quite often when the Swiss explain something, they explain it with a degree of confidence that is not merited by the actual facts. They cut a few corners here and there to make it easy to explain.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> I always feel like it is unfair how we place different European nations in same category as the US in these rankings or whatever, and for the US, we average over all the states in the US. As homogenous the US is, different states have different economies, different laws, in some cases, some slight but important cultural differences. Is it really fair to say have the US compete on terms of "competitiveness" or in other cases, happiness, education standards, with Netherlands, Switzerland, Sweden, or is it more fair to have them compete with California, Texas, New York, etc.

<comment><USER13> I was making this point a few weeks ago and after looking into it more, I still think it's a valuable point to raise, but the truth is more nuanced than I expected.

States in the US vary in nominal GSP per capita by only 2x — from Mississippi at $35K to Delaware at $70K. In the EU, it ranges from Bulgaria at €6K to Ireland at €55K. (This excludes DC and Luxembourg, which are outliers in many ways.)

In fact, even Mississippi, the poorest US state, is wealthier than the EU average (€28K, about $31K)! Only the wealthiest EU countries are wealthier than Mississippi: Luxembourg, Ireland, Denmark, Sweden, Netherlands, United Kingdom, Austria, Finland, German, Belgium, France. And of those, only Luxembourg and Ireland have a higher GDP per capita than the US average.

So the EU member states vary economically far more than the states in the US do, and the US is more easily characterized as a uniformly "high income" region than the EU is.

Mississippi's GDP per capita being similar to that of France, Italy or Spain is really hard to reconcile with the fact that many of us would love to live in the latter countries and couldn't be paid to move to Mississippi.

<comment><USER14> > Mississippi's GDP per capita being similar to that of France, Italy or Spain > is really hard to reconcile with the fact that many of us would love to live > in the latter countries and couldn't be paid to move to Mississippi.

Remember good GDP versus bad GDP; a traffic jam increases GDP, but isn't anything particularly worth buying. Accumulated capital (like Notre Dame and the Louvre) doesn't show up in GDP either, and if anything tends to lower it. There's a lot of bad GDP and not much capital accumulation in the US...

Climate also doesn't show up in GDP, now that I think of it, and I think that has a lot to do with the Mississippi situation. Who wants to live in hundred- degree heat with hundred-percent humidity?

<comment><USER15> "Accumulated capital (like Notre Dame and the Louvre) doesn't show up in GDP either, and if anything tends to lower it."

Notre Dame and the Louvre are a couple of the things that make Paris the single biggest tourist destination in the world, from which it derives a huge amount of GDP. The French tourist officials make sure to monetize the Louvre for all they can.

*

"Mississippi's GDP per capita being similar to that of France, Italy or Spain is really hard to reconcile with the fact that many of us would love to live in the latter countries and couldn't be paid to move to Mississippi."

No, it isn't, because people wouldn't love to move to France/Italy/Spain, they don't even want to. People say they'd love to live in Spain/Italy/France, but the fact that they don't reveals it's mostly cheap talk.

There are some exceptions in professions that make well above the average for these countries (also retirees, students). Europe is really very nice if you make well above the average, but this is not (by definition) the typical life in those countries. Very few Americans are excited by a 24k take home salary in a mid-sized French town, or 15k in an Italian formerly wealthy industrial city.

The vast majority of migration flows are up the GDP gradient.

<comment><USER16> "The French tourist officials make sure to monetize the Louvre for all they can."

The access to the Louvre (permanent collection) is free for :

everyone under 18 years old whatever the nationality,

every resident of the European Economic Area (31 countries) under 25 years old,

everyone under 26 years old whatever the nationality the Friday from 6 p.m. to 9:45 p.m.,

everyone the first sunday of each month between october and march and on july 14th,

other specific groups of people,

And it is 15€ for everyone else for a day. Not what I would call particularly excessive.

[http://www.louvre.fr/en/hours- admission/admission](http://www.louvre.fr/en/hours-admission/admission)

The Louvre still relies mainly on public subvention (102 M€ in 2015) tickets bring ~65M€, private subventions ~12M€. But yes it surely brings people and has a good impact on the local economy.

<comment><USER15> The benefits to French GDP are not mainly from the tickets, but from the tourism-related revenue (hotel stays, restaurants, flights, &c).

The official Paris tourist office has a picture of the Louvre on the top of its front page.

Let me put it this way: if I say that google monetizes its search engine as much as it can, I don't mean it charges you to search.

<comment><USER16> "The benefits to French GDP are not mainly from the tickets, but from the tourism-related revenue (hotel stays, restaurants, flights, &c)." yes, you can infer that from the last sentence in my previous comment, but still, they do not monetize it as much as they can because they could have decided not to make the entrance free for the youngsters and they would make more money even if the number of young visitors decreases.

The difference with the google search engine is if you are not willing to pay and so do not use the search engine then google won't make money at all from you whereas few people will decide no to go to Paris just because the Louvre entrance is not free.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> Not ranked so highly here: [http://www.doingbusiness.org/rankings](http://www.doingbusiness.org/rankings)

They get big dings for 'starting a business' and 'protecting minority shareholders'.

</comment><comment><USER18> Nobody mentioned yet the swiss apprenticeship system. Most young people make one and I think it is a main factor. The thing is the economy nearly always educates as much people as it needs. Within a 10 year range there should be always as much people as needed. So if one sector grows there are usually more available apprenticeships in that sector so that withing 10 years this hole should get fixed. Also I should mention that this is mostly good for the median person not for the top 1%.

<comment><USER19> what is good for the median person is also good for the 1%

</comment></comment><comment><USER20> Keep in mind, we have a company called "swissinfo" declaring that Switzerland has the most competitive economy.

Bias much?

<comment><USER21> You can argue against the WEF who created the study. But the newspaper itself is not declaring anything more than the study presents.

"Switzerland achieved its highest score of 5.8 out of 7 in the WEF Global Competitiveness Report 2016/2017"

</comment></comment><comment><USER22> A Swiss speaking up here. Switzerland economy is competitive because economy is very tough here due to the high Swiss Franc. Even local businesses compete with abroad. In Basel for example there's a tramway which crosses the border to Germany. Just behind the border there's a row of malls. It's crazy.

In other words, companies need to be exceedingly efficient, i. e. competitive, to survive.

This has been this way as long as I remember, that means for at least thirty years. And the hostile environment has only exacerbated massively in the last five years.

</comment><comment><USER23> And everyday I hear people saying that direct democracy can't work

</comment><comment><USER24> I will not be surprised. Switz is also easily among the top 10 most economically free countries in the world. Economic freedom, competitiveness and foreign direct investments are so well correlated with economic freedom.

Australia's ranking seems extremely puzzling though. The general perception is that it is very very competitive economy.

<comment><USER25> It is not that puzzling if you live in Australia and pay attention to the economy.

We have a residential real estate bubble that is worse than that of the US in 2006. Median house price to median income ratios in Sydney are worse than almost anywhere but Hong Kong. We have the highest per capita private mortgage debt of any country. This represents a massive unproductive overhead on the Australian economy, as the elevated cost of shelter flows into all other costs. Tax arrangements in Australia make leveraged real estate speculation more favourable than any other kind of investment, especially productive investment with any sort of risk attached. More than 50% of the existing mortgage debt is owed overseas via the big 4 Australian banks, so we are constantly exporting what wealth we have overseas as interest, so we can sell shitty houses built in the 1960s to each other for AUD1.2 million.

Many sectors of the Australian economy are filled by a limited number of participants (e.g. banking, supermarkets, hardware, telecommunications, petrol) who are most interested in rent seeking, and not interested in competing with each other.

The Australian economy has been a net importer of capital every year since the early 1970s, an almost ever year since post WW2. If you run a current account deficit so egregiously, the result is you sell off all your productive assets to stay solvent. This also means the pool of Australian capital available to invest in Australia itself is very limited. Australia has some of the highest immigration intake in the developed world, but no long term infrastructure planning to account for such population growth. Since most immigration increases the population of the large cities, the lack of investment in transport infrastructure is most apparent. We grow the economy by increasing the captias. Per capital net disposable income has been static or falling for the last 5 years.

Politically, Australia has been without vision for real economic development outside rewarding entrenched rent seekers for the last 20 years. We have not seen any significant increases in productivity over that period.

<comment><USER24> Yeah most of my friends in Australia barely afford the basic things that we take for granted in USA and that surprised me because their job seems to be almost identical to my.

</comment></comment></comment><comment><USER26> If this were true I'd expect them to have less generally mediocre datacenters and network carriers. They are markedly inferior to the US and most European countries, including much less wealthy countries.

</comment><comment><USER27> Anyone got a proper map over black fibre and the national grid of Switzerland?

Could it be possible that "google" simply wants to access the data inbetween germany, france and italy (etc)? Onyx is set up on route between Zurich and those nations..?

Zürich [url][https://sv.wikipedia.org/wiki/Z%C3%BCrich#Geografi[/url]](https://sv.wikipedia.org/wiki/Z%C3%BCrich#Geografi\[/url\]) Onyx [url][https://en.wikipedia.org/wiki/Onyx_%28interception_system%29...](https://en.wikipedia.org/wiki/Onyx_%28interception_system%29#Active_sites\[/url\])

</comment><comment><USER28> Am i the only one slightly concerned by the fact it is SWISS info dot ch reporting about swiss itself?

If DPRKinfo.kr would write DPRK is the best, we all laugh?

<comment><USER29> we all know that this report is a joke.

</comment></comment><comment><USER30> By competitive they must surely mean expensive and selective. Hahahahaaa

</comment><comment><USER31> Rest of the world can learn from [https://en.wikipedia.org/wiki/Cantons_of_Switzerland](https://en.wikipedia.org/wiki/Cantons_of_Switzerland)

</comment><comment><USER32> I have a few questions for Swiss expats.

Could you tell me about the Swiss culture--at bit? I know it's a huge topic. Just some of the differences you see between the Swiss, and say Americans.

I mainly interested in the Millenials.

What do they think of Americans?

Do they basically have the same hobbies?

Are their any stark differences in what they value?

Do they view Americans as spoiled?

Do they fear us?

This next question is very specific, and probally weird. I heard teens love 50's Cadilliacs. I love them too, but I heard they are more desired there, than in America? What is it about older Caddys?

Are their fashion differences? Here we have kids spending hundred of dollars on tennis shoes, specifically Nikes. Has that fad hit Switzerland?

Are women more, or less fashion conscience than Americans?

Just any insider observation?

I've been interested in Switzerland since I began Watch Repair a decade ago.

<comment><USER8> This is a weird list of questions. I am a migrant to Switzerland (trying not to use the word expat anymore).

Swiss people are not very different to Americans in what they value, what hobbies they have, etc. They are much less outgoing, however. In America you can walk into a bar anywhere, at any time, sit down and have a spontaneous conversation with the barman or strangers sitting at the bar. This _never_ happens in Switzerland. Do not expect it even if you speak good German. People in Switzerland keep to themselves. Because this makes it very hard to make friends there are a lot of "expat" events for immigrants to meet each other, and at these events you can go to a bar and start chatting to people of a similar age and background to yourself and make friends. This is how I made most of my friends: I have a few good Swiss friends, but overall most of my friends throughout my time in Switzerland were other foreigners.

Swiss people do not "fear" Americans, why would you have that idea? They do not spend a whole lot of time thinking about Americans in particular. The vast majority of people who live in the cities (and you want to be in the cities), and especially teenagers, do not own cars at all. Not only is there no need (public transport and taxis can get you everywhere) but there isn't usually enough parking and it's very expensive. People generally only buy a car once they settle down and move out of the cities.

People on the street in Switzerland tend to be well dressed and fashionable, and the women especially so. The high streets are dominated by fashion brands and shops. I can't compare this to the USA because I've only been to a few places there, but it's definitely a brand and fashion conscious place.

</comment></comment><comment><USER33> Interesting, can somebody remind me of these Swiss-based world changing startups that I somehow can't recall?

<comment><USER34> Startups are only a small part of the economy and majority of world changing stuff happens outside shiny startup world.

</comment></comment><comment><USER35> for a nation of 8 million...

</comment><comment><USER36> To mean, this sounds pretty meaningless. If true, I would take it to mean that if you start a successful business in, say, the USA, you are likely to face your most dangerous competition from Switzerland. Hardly likely unless you're working on something like watches or private banking...

</comment><comment><USER27> Anyway, it seems like a mystery to me why tech firms like Google set up shop in small expensive Zurich instead of say cheaper, bigger Barcelona or Vienna, for example.

The reason is simple: tax-evation and the like.

<comment><USER37> Thats a funny conclusion about Vienna because Austrian banks are great for tax evasion and pretty much reporting of anything.

Some jurisdictions market slight nuances in their laws to foreigners as a perk, and other jurisdictions simply have, and if you can read you can avoid the stereotypes.

<comment><USER38> FWIW you are an idiot if you use Austrian banks for tax evasion.

<comment><USER37> Now, yes

</comment></comment></comment></comment><comment><USER39> I live in Zurich. Due to the high-living standard, salaries, size, central location in Europe, Switzerland is probably the only country, where I'd like to live longterm. Yes things are expensive here but Swiss food is the cheapest in Europe, if you adjust for the average salary. I am trying to say: Buying power is huge. I am however unsure how long the Swiss can hold this high living standard.

You can read more in my blogpost "8 reasons why I moved to Switzerland to work in IT": [https://medium.com/@iwaninzurich/eight-reasons-why-i- moved-t...](https://medium.com/@iwaninzurich/eight-reasons-why-i-moved-to- switzerland-to-work-in-it-c7ac18af4f90#.978whnqsz)

Full disclosure: I am a part-time tech recruiter and well-connected in the tech-scene in Zurich and if you're thinking of moving here and getting a job in tech, feel free to contact me - you find my email address in my HN profile.</comment>


Show HN: Coworking Weekly, the first newsletter for the coworking industry - <AUTHOR> http://coworkingweekly.com

<comment><AUTHOR> Weekend hack ingredients:

* $8 themeforest theme + some elbow grease

* Mailchimp

* My existing knowledge of the industry

* Some copywriting coaching from Amy Hoy's 30x500 workshop

Inspired by @peterc's excellent work on Javascript Weekly, and my fast-growing personal archive of news stories on how the coworking industry is exploding around the world, I decided to launch a simple weekly industry newsletter focused on sharing the best news, stories, announcements, etc.

If you work at or run a coworking space, there will be stuff in this newsletter for you.

Disclosure: I founded one of the earliest coworking spaces in the country, Indy Hall, in Philadelphia.

<comment><USER2> Also wanted to ask you if you don't mind: how was Amy workshop?

<comment><AUTHOR> I actually helped create the original "Zero to Launch" workshop that became 30x500 with Amy. She's done a TON of work since I left so it's almost unrecognizable, other than the core expectations that the course will teach you to launch a product with customers - not just users, but paying customers - on day 1 or very close to it.

I've followed the workshop since it's been redesigned, read all of the materials, and am an active reader of the workshop's listserv. I can say with honesty - the experience is transformative and I'm not paid to say that.

I've watched so many "oh, shit, I get it now" moments on that it's inspiring.

Even better, I know this stuff and the students are well versed enough to teach _me_ stuff.

I have lots of biases for Amy since we're friends and collaborators but I can say with confidence: this course is worth 10x what she charges for it.

<comment><USER2> I'm on the same boat. I know a lot about the subject, but I'm always willing to learn. I think I'll take a look.

Thanks!

<comment><AUTHOR> The course is challenging if if you're knowledgable. Enjoy :)

</comment></comment></comment></comment></comment><comment><USER3> Coworking is absolutely on fire these days.

From May 2011 to November 2011 the total number of spaces worldwide grew from 820 to 1100 (according to DeskMag.com). Coworking movement is doubling every year.

I am opening a space next week )

<comment><AUTHOR> Looks like you're in Russia - whereabouts?

<comment><USER3> St. Petersburg

The site is in Russian, but you can use Google translate

<http://zonaspace.ru>

Translated name of our project is 'Action Zone'

<comment><AUTHOR> This looks awesome! I love the term 'education club' too.

Keep me posted on progress please - email@example.com

</comment></comment></comment></comment><comment><USER4> I am excited that Alex is curating coworking content for me. Alex/IndyHall is our inspiration for WorkHappy - <http://weworkhappy.com>

</comment><comment><USER5> I tend to not subscribe to these things unless I can read a sample newsletter to confirm it's reasonably useful to me. Consider providing a sample, and it doesn't have to be the most recent.

Good luck!

<comment><AUTHOR> As soon as edition #1 is live, I'll be publishing the archive.

Thanks!

</comment></comment><comment><USER2> Mind sharing which template did you use?

<comment><AUTHOR> [http://themeforest.net/item/land-ahoy-a-responsive- landing-p...](http://themeforest.net/item/land-ahoy-a-responsive-landing-page- template/1557262)

<comment><USER2> Thanks!

</comment></comment></comment><comment><USER6> Alex, Thanks for launching a newsletter like this. Great idea!

Robert Petrusz Bull City Coworking Durham, NC

</comment><comment><USER7> you're a man amongst men, alex.</comment>


Dopamine and Temporal Difference Learning - <AUTHOR> https://deepmind.com/blog/article/Dopamine-and-temporal-difference-learning-A-fruitful-relationship-between-neuroscience-and-AI <comment><USER2> I am currently working on my master's thesis on the topic of applying this type of knowledge to build a reinforcement learning system with spiking neural networks. The role of dopamine is crucial in learning.

By combining spike-timing-dependent plasticity (STDP) with the reward (R-STDP), it is possible to address the spatial eligibility trace (which synapse caused the reward?). However, the design of the reward/utility function is one core issue, where this paper probably advances the field. I am currently looking into ways to balance the reward. Without balancing each trial causes more long term depression than long term potentiation, so that after a while the end the network dies. A different reward function results in the opposite. Another issue is the distal reward problem: Which event correspondents to which activity? I would be very glad to discuss related questions or exchange ideas with other experts or newcomers to this growing field. My mail is in my profile.

This paper also got me thinking if this mechanism might explain why we enjoy listening to music. Music follows and breaks rules, which our brain continuously tries to predict and most of the time it succeeds.

<comment><USER3> > This paper also got me thinking if this mechanism might explain why we enjoy > listening to music. Music follows and breaks rules, which our brain > continuously tries to predict and most of the time it succeeds.

The link between predictability and art has been raised various times in the literature, even _before_ Schmidhuber, but he had particularly _interesting_ ideas about it: [http://people.idsia.ch/~juergen/beauty.html](http://people.idsia.ch/~juergen/beauty.html)

<comment><USER4> Great episode with Schmidhuber on Lex Fridman's podcast.

[https://youtu.be/3FIo6evmweo](https://youtu.be/3FIo6evmweo)

I'm coming at this from a career in infosec, never heard of the guy but really enjoyed his thought processes.

</comment></comment></comment><comment><USER5> Great blog post on great research. Worth reading in its entirety.

Summarizing at a very high level abstraction: This work compares a mechanism used for learning probability distributions of expected rewards in deep reinforcement learning systems to the dopamine reward mechanism in mice brains.

This passage near the end, in particular, caught my eye :

 _> ...our final question was if we could decode the reward distribution from the firing rates of dopamine cells [in mice brains]. As shown in Figure 5, we found that it was indeed possible, using only the firing rates of dopamine cells, to reconstruct a reward distribution (blue trace) which was a very close match to the actual distribution of rewards (grey area) in the task that the mice were engaged in. This reconstruction relied on interpreting the firing rates of dopamine cells as the reward prediction errors of a distributional TD model, and performing inference to determine what distribution that model had learned about._

In other words, mice brains seem to be using the same mechanism, and it appears we can decode the probability distribution of expected rewards learned by those brains by measuring only the firing rate of dopamine cells.

Very exciting!

<comment><USER6> Can we use brain scanners and ML to A/B test online lectures to perfection?

For example, you can show the top 20 Calculus 2 courses to groups of 50 people each, all dawning brain scanners, and create a "brain activation map" for each class from each professor. Among students of the top 10% of professors (as measured by exam results and brain activation), we can analyze the most engaging moments in each course, and hybridize them into a master course. Furthermore, we can analyze differential learning outcomes in males, females, students of different races, and K-clustered psychographic profiles (based on DMN activity and other neurological measures taken before the course).

If the learning outcomes are significantly different, then it may be more appropriate to create several different master courses for the people that showed different learning outcomes. A class can be recommended, Netflix style, based on your demographics, neural activation patterns, and learning velocity from past coursework.

Everyone would have the best Calculus 2 class, into perpetuity, after one cycle of experimentation and master class creation. The same can be done for all canonical coursework, from Kindergarten through the top undergrad majors to Med/Law/MBAs. The aforementioned learning outcome differentials would be lessened by the "no child left behind" effect of each kid getting a solid grasp of math and science early on with neurologically tailored coursework.

<comment><USER7> Why not brain scanners to optimize ads? Oh right they are :(

<comment><USER6> Neural marketing uses EEG headsets and eye tracking. I searched for EEG + focus detection, and found the 2018 study linked below. Excerpt: " the best obtained classification accuracies were 77% and 83%, respectively, using SVM binary classifiers." They used ML for attentiveness classification. I'm sure greater accuracy can be achieved with time, but that's a good start. It would be even better if we had wearable MRIs.

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6263653/#!po=0....](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6263653/#!po=0.675676)

<comment><USER7> Maybe instead, we just freaking shouldn't allow applications of this sort of research at all. This is stuff that would have been a scandal if the CIA did it, just because it makes money doesn't mean it's okay.

<comment><USER6> Don't get me wrong, I am not a fan of neural marketing. I just mentioned it in response to your comment, and only to indicate that the same scanning hardware can be used in the education space.

</comment></comment></comment></comment></comment></comment><comment><USER8> I can partly understand some this based on an EE101-level control theory, a High School level model of how neurons work, and 3blue1brown's intro to neural nets[1]. However, I have a strong personal interest in developing a much deeper understanding of dopamine neurons and their role in Executive Function.

Can anyone recommend a good curriculum which can take a random web developer from "Knows what a myelinated axon, a sigmoid function, and a feedback loop are" to having a solid enough background to dive into the research on this?

[1] [https://www.youtube.com/watch?v=aircAruvnKk](https://www.youtube.com/watch?v=aircAruvnKk)

<comment><USER9> Kind of an odd title and book, but I think it may do a good job of what you're looking for:

"Principles of Neural Design": [https://www.amazon.com/Principles-Neural- Design-MIT-Press/dp...](https://www.amazon.com/Principles-Neural-Design-MIT- Press/dp/0262534681/)

<comment><USER8> That looks like _exactly_ the sort of thing I'm after.

</comment></comment></comment><comment><USER8> This seems to so far only address learning in a context where the reward appears shortly after the behavior which caused it. That is valuable to understand, but seems like it fails to yet explain how Executive Functions work.

> What happens if an individual's brain "listens" selectively to optimistic > versus pessimistic dopamine neurons? Does this give rise to impulsivity, or > depression?

My intuition is that impulsivity would arise as a result of giving much greater weight to the signals of a very recently-trained network than to a less-recently trained network.

This all raises a few questions for me:

1) How does a brain _recognize_ reward in order to fire the signal which trains a dopamine network? It seems straightforward for the taste of food, a hug from a fellow-tribesman, or a bell from playing a video game for 5 hours straight (in a simulated Atari environment).

How does a brain recognize reward while it is (for example) writing a teacher- assigned essay for an unclear audience or a python program without Test-Driven Development?

What does the brain use as its leading-KPIs?

2) How does a brain select how much it listens to different networks which predict rewards from different actions so it is "robust to changes in the environment or changes in the policy". How does the brain adjust its attention in response to changing context?

<comment><USER10> Mere speculation but maybe there are multiplexed temporal-difference-ish networks that correlate different reward frequencies per basis (like the different x[k] for the Fourier transform of a signal x[n])

</comment></comment><comment><USER11> Is anyone else having problems with just getting a blank page when trying to load that site?

Or is it just me on iOS?

<comment><USER12> I hit this, and the solution for me was to turn off my content blocker.

<comment><USER13> "content" blocker :)

</comment></comment></comment><comment><USER14> Awesome work!!</comment>


ReDigi Used Digital Music Store - <AUTHOR> http://www.redigi.com/

<comment><USER2> I wonder where this website resided in, as many countries already made nearly impossible to bypass DRM'ish stuff legally for most of the cases, and also digital music are usually "licensed" instead of bought with a tangible CD without explicit licence. (You don't see the "read this EULA" on music CDs, do you?)

From their site, "ReDigi(tm) keeps you safe by managing the copyright obligations" ... "removes identified copies" ...

I am no legal experts could somebody tell me if this is in fact legal (or not challenged in court) to sell digital music [files] even you have deleted it securely from any of the devices you have access to, say at least in US? (disclosure: I am not in US)

</comment><comment><USER3> Very interesting.

What if, for the sake of argument, I wanted to sell my song for .01. Is that allowed or is there a minimum price to sell?</comment>


Ask HN: Do AI generated music/images/text get copyright? - <AUTHOR> I read from EU-law that to get copyright the art/content have to be created by a human. Does this make music from OpenAI free for all to use? Example: https://openai.com/blog/musenet/ <comment><USER2> The person who told the AI to create the music is the human that created it.

This is how all music copyright works in practice, since artificial methods of generating sound have been popular for over fifty years and humans who configured and used these artificial sound generators have received the same copyright protections as those who use traditional physical instruments.

The question you're asking is: How complex does the sound/music generation need to get before copyright no longer applies? And I'd answer that there is no ceiling, whoever configured and activated the process of generating the artificial output owns the output. The output's complexity is irrelevant regardless of if it is a simple tone generator or a complex AI.

There's no concept in law of Artificial Intelligence because it isn't distinguishable from existing methods of sound generation, just more complex version of the same. For example there's no self-aware or "alive" version of AI, and until there is I doubt we'll need any new laws to cover it.

</comment><comment><USER3> Even if it can't be copyrighted, what stops from claiming copyright on ai generated music if you can't differentiate between them?</comment>


Anti-vaccine advocates appointed to Minnesota autism council - <AUTHOR> https://arstechnica.com/science/2019/01/anti-vaccine-advocates-appointed-to-minnesota-autism-council-after-measles-outbreak/ <comment><USER2> Does there need to be something called "Minnesota autism council" at all?

<comment><USER3> > State senator Jim Abeler formed the MN Autism Council last fall to address > issues surrounding autism, including "treatment, educational options, > employment opportunities, independent living, and more."

Sounds like it, yes. What would you suggest? Abandoning them?</comment></comment>


Security advisory: Breach and Django - <AUTHOR> https://www.djangoproject.com/weblog/2013/aug/06/breach-and-django/ <comment><USER3> Correct me if I'm wrong, but it appears as though Django isn't the only framework/technology that is vulnerable to such an attack, they're just one of the first to provide a mitigation strategy (resulting in this post).

<comment><USER4> Any website that

      * Be served from a server that uses HTTP-level compression
      * Reflect user-input in HTTP response bodies
      * Reflect a secret (such as a CSRF token) in HTTP response bodies

is vulnerable, regardless of technology.

The mitigation strategies were given in the original paper[1], this announcement is just repeat of what's in there. That said, it's exactly the right thing to do, that's not a knock on Django.

1: [http://breachattack.com/#mitigations](http://breachattack.com/#mitigations)

<comment><USER5> > * Be served from a server that uses HTTP-level compression

this is the only must-have. Last 2 exist almost in every website (everyone needs a CSRF token, everyone reflects something somewhere)

<comment><USER6> From my understanding (which may be wrong...), the requirement of "Reflect user-input in HTTP response bodies" is actually pretty important. If the application only does this on POST requests, then it should probably be fine. Since an attacker cannot formulate a valid POST without the CSRF token (assuming the app is using CSRF tokens correctly), then there is no way for an attacker to get this attack bootstrapped.

If the application reflects GET request input in the response (eg `[https://domain.tld?q=ASDF`](https://domain.tld?q=ASDF`) results in some `value="ASDF"` being included somewhere in the response), then it is indeed likely vulnerable. This allows the attacker to simply continually change the value of `ASDF` as they guess and check for some secret on the page.

Of course, if your application is allowing untrusted POSTs to be made, then you will still have to worry about POST requests...

<comment><USER5> you're right, also, to make compression work, ASDF is not enough, attacker needs [https://domain.tld?q=value="ASDF](https://domain.tld?q=value="ASDF)

</comment></comment></comment></comment></comment><comment><USER7> Currently, the Django templating tag:

      {% csrf_token %}

...results in an insert like...

      <input type="hidden" name="csrfmiddlewaretoken"
        value="566e4606b2094c7c48e5d04b58236f51">

I suspect that the particular mitigation strategy the BREACH authors' describe as "Randomizing secrets per request" could be implemented by having {% csrf_token %} instead emit:

      <input type="hidden" name="random_data"
        value="91178a84e0bc6e08a2fda853eef2d2c8">
      <input type="hidden" name="csrfmiddlewaretoken_xor"
        value="e0b594e902c7fe6b1748d13aefaf63aa">

...where the random_data changes every response, the emitted csrfmiddlewaretoken_xor is the real token XORed with the random_data, and upon submission the server will again XOR the two values together to get the real CSRF token.

There may be other secrets that need protection in other ways, and maybe this would make any random-source issues more exploitable... but this would seem to protect the CSRF token, in a cheap and minimal way.

UPDATE: Thinking further, though, maybe the attacker can probe for both values at the same time, and thus determine the probability of certain pairs, and thus this only slows the attack? I'd appreciate an expert opinion, as this was the first mitigation that came to mind, and if it's wrong-headed I'd like to bash my intuition into better shape with a clue-hammer.

<comment><USER5> Your UPDATE is right, attacker can probe a..z 2 times, and just choose the letter that was compressed in both of them, ignoring random compressions

<comment><USER7> Thanks, but can you clarify... does that mean probing (a..z)×(a..z) (one pair per probe), so there's at least a giant increase in probing required per character? And perhaps even more each character in, since probing for the Nth character now requires (a..z)^(N-1) × (a..z)×(a..z) ?

(I'm guessing also, though, it may be possible to probabilistically probe multiple ranges of the secret at once... in a process that seems vaguely similar to forward-error-correction coding.)

</comment></comment></comment><comment><USER5> Offtopic: this is very simple mitigation for any website, requires JS: [https://gist.github.com/homakov/6147227](https://gist.github.com/homakov/6147227)

</comment><comment><USER8> So to be clear:

1) The attacker must be on the same network as you, or at least be able to detect how large the compressed and encrypted replies are.

If you are on the same network it seems to be there are far more MITM and whatnot attacks that are more likely to succeed, if you do not use HSTS (or secure DNS if that helps).

2) The attacker must be able to get your browser to rapidly generate many (how many?) requests from your browser to the site. It takes "30 seconds" they claim, but is that at a rate 100 requests per second?

3) Each request must carry something that will be reflected by the body of that particular page when it's rendered. I suppose it could be an error message or search string that's echoed.

It seems to me that unless you generate a CSRF token unconditionally on every page, the subset of pages that both reflect something with no protection (e.g. search results) and have a protected form (e.g. change my email address to XYZ) might be small.

4) The secret that can be extracted is what's in the reply body and not the headers -- headers are not compressed, since the TLS compression is now universally disabled post-CRIME.

Personally I use Referer header checking as well. IME all the browsers of my users do send them. So if you extract the CSRF token, it's useless by itself unless you also can make the browser send the right Referer header (and AFAIK, all the holes such as Flash have been plugged).

Other than that -- it seems that if you are normally generating e.g. a 32 byte CSRF key, you could interleave it with 32 bytes of good randomness per request?

<comment><USER5> >Personally I use Referer header checking as well. IME all the browsers of my users do send them. So if you extract the CSRF token, it's useless by itself unless you also can make the browser send the right Referer header (and AFAIK, all the holes such as Flash have been plugged).

do-not-use-referrer-as-csrf-protection.com

<comment><USER9> I'm sad that doesn't appear to exist.

<comment><USER5> The parent said "as well" but I'm still insisting it referrer must not be neither a whole nor a part of CSRF protection.

<comment><USER9> Sorry, I meant the specific domain you mentioned. :)

</comment></comment></comment></comment></comment><comment><USER10> Switch off all GZIP..? That feels very extreme, I'm sure there are better workarounds than that one.

EDIT: The following workarounds should be very simple to implement and seem like more viable alternatives for production?

      Length hiding (by adding random amount of bytes
        to the responses)
      Rate-limiting the requests

Mitigations 6 and 7 taken from [http://breachattack.com/](http://breachattack.com/)

<comment><USER9> I'm sure everyone is going to come up with workarounds that re-enable compression, but they'll be context-dependent and will involve code; in the meantime, the attack is straightforward and viable. Think of disabling compression as a stopgap.

<comment><USER11> Definitely think about it before just doing it though...

Disabling compression can break some apps. Especially when they rely on huge compression ratios for text (5-10 times ratio is common for with much json for example). So that is not an app agnostic work around. For example, a 100k of json request, can turn into a 1MB json request. The more data required to send, the more chance of error - especially on 3g/2g networks.

For many high end projects, just disabling compression without regard to testing or having an idea of what the application is doing would get you fired or taken to court.

Not only would this break apps, but it would also lose business in that there is evidence from Amazon and others that every 100ms extra latency can cost 1% in sales.

From SPDY whitepaper: "45 - 1142 ms in page load time simply due to header compression". Remember that headers use the upload part of the link... which means too many headers and you can saturate the upload, therefore making the whole internet connection stall for everyone using it. Common upload limits are only 5-10K/second, so excessive headers combined with many requests can easily DOS many internet connections.

I spend a lot of time optimising websites for these reasons, and disabling compression could add 20 seconds of load time for a good percentage of users.

So, for many apps, turning off compression is no solution at all. You might as well just disconnect your app from the internet - that will also give you a secure and broken app.

A proper risk, and impact analysis should be done first. Too often quick hot fixes to security issues just break things or even make things less secure.

</comment></comment></comment><comment><USER12> A few days ago, Meldium's announcement of a Ruby gem that provides an inexpensive partial protection (i.e. not disabling gzip) made it to the HN front page:

[http://blog.meldium.com/home/2013/8/2/running-rails- defend-y...](http://blog.meldium.com/home/2013/8/2/running-rails-defend- yourself-against-breach)

The two protective measures are masking the Rails CSRF token and appending a HTML comment to every HTML doc to slow down plaintext recovery. How easy is this to include in a Django plugin?

<comment><USER13> Is a partial workaround really better than a guaranteed workaround.

</comment></comment><comment><USER14> This would cause a big problem for us. we mobile web service serves around 3-4k concurrent requests on average. without compression our API would take 300% - 900% increase in the delay.

is there any alternatives ? would like to know what Cloud Flare would do as their CDN is based on compressed nginx responses.

<comment><USER15> As gzip compression only applies to the content of the page, not the headers, I would assume that prefixing your page with content that is variably compressible and of varying lengths would throw a monkey wrench in the attacks.

The compressed content of any part of a page very much depends on what came before it. Altering the content to include a script comment block full of random text and various common HTML and JavaScript elements (Markov chains anyone?) would definitely change how a page is compressed.

If the compressed length of the replies varies significantly with every request - even if the request content is identical - attacks like this can no longer reveal hidden information.

Edit:

You could improve this significantly by including false positive matches as well. If your HTML content has: csrf="45a7..." in it, you could hash that content into enough material to generate 19 or so identical looking code blocks embedded in a script comment. You've now provided a 95% chance they attack the wrong one / increased the number of attacks they'll need to try by 20x.

This method (minus the above part) would actually be cacheable by smart CDNs like Cloudflare.

<comment><USER16> Random padding can be averaged out. It increases the work factor of the attack, but not by much.

</comment></comment></comment><comment> z-factor The attacker has to be able to issue requests on behalf of the user with injected "canary" strings. I fail to see a practical exploit where one can do this and wouldn't have access to the secret in the response anyway. What am I missing?

<comment><USER9> Does any GET or POST URI endpoint in your application accept parameters? Do none of those parameters impact the output of the application? That set of circumstances is extraordinarily common.

<comment> z-factor The request has to be issued by the attacker from the victim's browser. If the attacker can do that, why is he unable to read the response to that request?

Edit: I think I can see a scenario where a third-party website does these requests via an <iframe> or an <img>. I'm not sure there's a way to do POST quite as easily.

<comment><USER9> Do you understand how CSRF works? Just think of it in terms of CSRF. Since the attacker is trying to infer page content, they don't care that the server rejects all the probing requests, so CSRF protection doesn't help you as the attacker carries out the BREACH/CRIME stuff. If the result of the attack is an inferred CSRF token, they then cap the whole exploit off with a (now working) actual CSRF attack.

<comment> z-factor I understand how the attack works, the question was about how a practical exploit would actually be carried out. I've figured out how one would issue GET requests from the right environment, but I don't know if the same is possible for POST.

<comment><USER17> It is just as possible. POST csrf exploits add between two and three minutes to an attacker to craft the request differently.

</comment></comment></comment></comment></comment></comment><comment><USER18> How about having the CSRF token change with each request? If it's encrypted/signed by the server for each request with a random IV then it would be different in each request. It would be a bit more processing on the server (decrypt vs just HMAC verify) but it would be completely different each time. It seems kind of belt and suspenders as you're encrypting data within an encrypted channel but I think it gets around this issue.

<comment><USER19> If the CSRF token changes with each page view then opening a second page (perhaps an explanation for a form field) in a new tab/window would invalidate the form in the original tab/window.

<comment><USER18> Not necessarily. The token can be used to simply verify that the request came from a legit page and not cross site request. The encrypted CSRF need only be verified by the server to see if it's not expired. The server can store the expiration in the CSRF token itself (encrypted and signed). It does not need to maintain a list of the CSRF tokens.

I wrote about this a little while back. Comments are here: [https://news.ycombinator.com/item?id=5971464](https://news.ycombinator.com/item?id=5971464)

<comment><USER19> Wouldn't the lifetime of the token have to be <30 seconds, according to the claims made in the paper?

<comment><USER18> I don't think so. Here's the snippet from the linked PDF[1]:

> DEFLATE [2] (the basis for gzip) takes advantage of repeated strings to > shrink the compressed payload, an attacker can use the the reflected URL > parameter to guess the secret one character at a time.

By encrypting the CSRF token (or any other "secret" data you want to roundtrip from server to client and back) with a random IV per request this wouldn't work. The value sent by the client would not be the same as the new token generated by the server (since each has a random IV). Even though the decrypted value of each token is the same, the values presented to the client in the response body are each different and not predictable (to the client).

[1]: [http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%2...](http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%20in%2030%20seconds.pdf)

</comment></comment></comment></comment></comment><comment><USER20> Has anyone looked at mitigating the attack by changing the behavior of chunked transfer encoding?

Chunked Transfer encoding is basically padding that a server can easily control, without having to change content or behavior of a backend application. A web server could easily insert an order of magnitude more chunks, and randomly place them in the response stream.

<comment><USER21> I'm not sure I fully understand the proposed fix here, how does it differ from the application simply including random chunks of data inside the response?

This area of things isn't my strong suite, but assuming that this is analogous to just adding random data to the response, I _believe_ that simply adding random data to the response can be worked around by doing more requests as using statistics to factor out the noise introduced.

If my understanding is wrong then excuse me :)

<comment><USER22> I have seen random workarounds at the app level as well, where the app adds a random length HTML comment on the end of the page.

But if random can be statistically removed, then they shouldn't add a random amount. Maybe just track the max size of the returned response and always add enough to reach that max size. Therefore the lengths of all the pages will always be the same. This is still better than turning off compression completely. A typical max for a detail page in an app might just be the size of the page plus 256 bytes per app output field.

<comment><USER20> You can basically add as many or as few bytes as you like, by abusing the chunk-extension in chunked encoding:

[http://tools.ietf.org/html/rfc2616#section-3.6.1](http://tools.ietf.org/html/rfc2616#section-3.6.1)

So you could make all http responses round into 128 byte chunks, by appending 1 to 128 bytes at the end of every response.

Effectively it gives you length hiding at an http layer; Still attackable.

</comment></comment></comment></comment><comment><USER23> So, it seems that even if I encrypt everything, a lot of information is still present in the _size_ of encrypted message; in case of VOIP, it's possible to guess speech that is being transferred over an encrypted transport, in the case of text, it's possible to figure out secrets if the attacker can modify an equally-sized part of the message.

Is there any general way of preventing this kind of attacks? Inserting random data could work, but it's distribution would have to be exactly right for the attack to be impossible over longer periods of time. For the BREACH case, we could solve it by not compressing user input, but what about the VOIP case?

Also, why does the site [http://breachattack.com/](http://breachattack.com/) says that "Randomizing secrets per request" is less effective than disabling compression?

<comment><USER24> > Is there any general way of preventing this kind of attacks?

Disabling compression is a 100%-effective countermeasure for compression oracle attacks.

> Also, why does the site [http://breachattack.com/](http://breachattack.com/) > says that "Randomizing secrets per request" is less effective than disabling > compression?

Putting random data in the server response will only slow down the attack. With enough requests, the noise from that random data will wash out.

Disabling compression will stop the attack cold. The whole thing is predicated on analyzing the size of the compressed text. No compression, no compression oracle.

<comment><USER25> How is it that random data would only slow it down? If I add a random field to my response of variable length, say, from 0 to 50, with completely random characters, it should completely throw off this attack. The length of the output will change from request to request.

I suppose, given infinite time, you could send the same request over & over and map the variance of content lengths, and get an idea of what the actual content length was before random padding? But the compression seems to throw that off even more AFAIK - because the data we pad with is random, it could very well accidentally compress well because of the rest of the data in the response, further throwing off any guesses.

Edit: From the pdf on breachattack.com:

      While this measure does make the attack take longer, it does so only slightly.
      The countermeasure requires the attacker to issue more requests, and measure the
      sizes of more responses, but not enough to make the attack infeasible. By repeating
      requests and averaging the sizes of the corresponding responses, the attacker can
      quickly learn the true length of the cipher text. This essentially boils down to the
      fact that the standard error of the mean in this case is inversely proportional to p
      N, where N is the number of repeat requests the attacker makes for each guess.

<comment><USER26> I think it is still discoverable because adding random data leads to the following two distributions:

Attacker gets secret wrong, page is size: original page + (zero to fifty) + length of incorrect secret Attacker gets secret right, page is size: original page + (zero to fifty)

With a sufficiently high number of observations the attack with the right secret has a mean value that is lower than the attack with the incorrect secret.

At least that's what it appears to me. I could be wrong.

</comment></comment></comment></comment><comment><USER27> I'm sure it will come, but I'd appreciate a layman's terms explanation of this. What is the threat, and how do you go about fixing things in Django?

<comment><USER28> Imagine you're going to send a compressed and encrypted message to a friend, and I (the attacker) can do two things:

1) Append a bit to the message before it is compressed and encrypted. 2) See the size of the final message.

So I start by appending the string "4179174b19e0cdc91bf4" to your plaintext message. I see the final encrypted message size is 500 bytes.

Then, I redo the experiment, but this time, I append the string "firstname.lastname@example.com" to the message. The final encrypted message size is now 480 bytes. The string I injected was the same size, but the compression worked better this time, and I can guess it's because the string I picked is redundant with something in your plaintext.

Mix in a bunch of complicated math and a bit of javascript, and you've got an exploit.

This threat isn't specific to Django: it's being billed as a TLS attack, but any encryption system that uses compression the same way is vulnerable.

</comment></comment><comment><USER29> This attack works very much like the game Mastermind. [http://en.wikipedia.org/wiki/Mastermind_(board_game)](http://en.wikipedia.org/wiki/Mastermind_\(board_game\))

<comment><USER30> That's true for almost all side channel attacks using user controlled input (eg. padding oracle attack).

</comment></comment><comment><USER25> Could somebody help me understand how this attack would be viable?

It seems like the attack has the following requirements:

      1. You want a secret that appears in the response body, like a
         CSRF token.

      2. The web server always responds with the exact same response
         for a request.

      3. The response body contains data that you send to the server,
         e.g. url params.

      4. The attacker has access to an environment where he can send requests
         under your browser session (otherwise, the user would be
         unauthenticated and there would be no secrets to steal).

Given (4.), how is this a real concern? If I, an attacker, am able to make 3000+ requests while logged in under your session and modify the request character by character pre-encryption, doesn't it logically follow that I have your cookies anyway?

<comment><USER8> The #4 is not that difficult without compromising the user's browser -- as long as the user can visit the site under your command or see some HTML under your commend you can make the browser do a HTTPS request to anywhere at all.

Maybe you buy some targetted ads served in an iframe. Maybe you send the user an email where his email server either always shows images, or you trick the user in clicking 'display images' with promise of kittens.

You won't be able to see the results directly, but if you can observe how long the encrypted responses will be, you'll know whether your reflected input could make use of the compression dictionary (meaning your reflected input matches the secret) or not.

I wonder if there is any way to even do this without the passive network snooping -- like some kind of internal browser stats API call that tells you # of HTTPS bytes transferred. It could be innocent enough so it's not protected.

</comment></comment><comment><USER31> Looking at [https://github.com/django/django/blob/ffcf24c9ce781a7c194ed8...](https://github.com/django/django/blob/ffcf24c9ce781a7c194ed8722b850e7873922f6b/django/middleware/csrf.py) I'm a little confused about how the csrf-token is generally used in Django -- but if I understand the code correctly, it looks for a cookie with the csrf_token, and compares that to a POSTed value (or x-header in case of an Ajax request).

If the system has a decent random-implementation there is no secret involved, just a (pseudo)random string -- essentially a csrf cookie is given the client on one request, and compared on the next request(s).

Is there any reason one couldn't simply use the rotate_token()-function on every (n) request(s)?

</comment><comment><USER32> Just to make sure I understand this correctly: is this only a security issue if you include sensitive information on a page by default?

For instance, if you had a search field, the contents of what users puts in that search field will not be compromised. However, if you include a csrf token with the search field form, that can be compromised since it will be there every time the attacker gets the victim to make a request.

</comment><comment><USER33> I've knocked up a package that provides CSRF token masking and length modification that may help mitigate this. If anyone wants to vet it and submit pull requests, you're more than welcome. [https://github.com/lpomfrey/django- debreach](https://github.com/lpomfrey/django-debreach)

</comment><comment><USER5> im a rabbit

<comment><USER34> To your second point, firstname.lastname@example.com. It's documented in a bunch of places; where'd you look for it? I'll add it there, too :)

To the first point, we believe that Django's CSRF protection is as strong as session-linked CSRF protection, and adds CSRF protection to anonymous users (users without a session as well). In other words, it's a design decision, one that we believe doesn't compromise CSRF protection. If you believe otherwise, please get in touch (see above).

<comment><USER5> 1) session and logged in/out user are two different things. Session is the way you store information about current user, no matter he is anonymouse or logged in.

2) I checked again for instance [https://bitbucket.org/](https://bitbucket.org/) \- edit csrftoken cookie to any, 123123 for example. Reload the page and if site keeps working - <USER2> Forcing with MITM will do the same thing using http: injector Set-Cookie

not only MITM, subdomains can do precisely same thing. Either bitbucked uses old django or django is vulnerable to it (which is, well, a severe vulnerability imo)

<comment><USER34> 1) I know the difference between sessions and logging in. I didn't say anything about logging in; I said that our CSRF protection protects users _without sessions_. Not all sites use sessions (some for performance reasons, others for privacy reasons); must those sites be vulnerable to CSRF?

2) First, you should report this to Bitbucket: [https://www.atlassian.com/security](https://www.atlassian.com/security). And c'mon, disclosing a possible CSRF vulnerability on a public board is kinda irresponsible. Is responsible disclosure not something you practice?

SecondI don't know what Bitbucket is running, exactly, and exrapolating from Bitbucket to Django is pretty lazy. Frameworks != sites. Once again, we've spent quite of bit of time validating the design and implementation of Django's CSRF protection, and we believe it works. If you find proof otherwise, can you _please_ send it to firstname.lastname@example.com, and not post it to Hacker News?

<comment><USER5> 1) only to make sure we are on the same page. Now I see - we have different understanding of "session".

>Not all sites use sessions (some for performance reasons, others for privacy reasons);

what kind of site doesn't use sessions? To track a user you need a cookie right?

2) Frameworks != sites. As I used to think, only framework is responsible for CSRF protection, hence I extrapolated. I sent it to security@ as soon as I found this email. I am trying to not proclaim anything but some websites from [http://www.djangosites.org/](http://www.djangosites.org/) are vulnerable.

</comment></comment></comment></comment></comment><comment><USER35> Disable compression altogether? That's craptastic.</comment>


Microsoft .NET CoreCLR is now running on FreeBSD 10.1 (amd64) - <AUTHOR> https://github.com/dotnet/coreclr/issues/793 <comment><USER2> Hey all, MS PR guy here (yes I know, cue* the cabbage throwing). Just wanted to let you know we made a subreddit, and MS will answer some questions around Build 2015 announcements next week (.NET, Azure etc). Feel free to post Qs there if you'd like: [http://www.reddit.com/r/Microsoft_Build/](http://www.reddit.com/r/Microsoft_Build/)

edit: cue _

<comment><USER3> Cabbage? How about a lot of praise instead? Because that's what I'd throw at you guys for doing what you're doing with .NET. I'm a .NET programmer by day, and Linux-fan (and user) by night, and I honestly can't wait until I can run an asp.net based mvc website on my Linux-based server (running Apache; I know it's not impossible now but it's not quite fully there yet, or supported by MS), and thanks to your efforts, that now feels like something that's maybe actually going to happen the way I hope it will. So huge thanks from me!

<comment><USER4> The only thing missing for the non-emacs only users is Visual Studio for Linux... Even if it's not open source... Cue cabbage from Stallman and GNU- Onlyists.

</comment></comment></comment><comment><USER5> Awesome.

As a Linux guy (and running a couple FreeBSD servers) in a Windows world and Windows shop, I'm glad to see these ports. I'd love to take our code and port it to different platforms, alas .. 'WinForms', 'WPF', 'WCF'.

Ignoring the UI part - there are no solutions as far as I'm aware (nope, Gtk# isn't one either) - what do people use as a WCF replacement? So you're developing a .Net app and need SOAP for one reason or another: What do you pick?

<comment><USER6> > So you're developing a .Net app and need SOAP for one reason or another: > What do you pick?

I haven't used it myself, but I've seen it mentioned several times, so I'll just throw it out there for visibility: [https://servicestack.net/](https://servicestack.net/)

<comment><USER5> Looked into that in the past, but that's a commercial project, right?

While the setting I'm looking at is commercial as well (a corporate product), the idea is a rogue "let's see if I can port that in my free time, because why not" project. No budget. No corporate interest.

And frankly, porting WCF services to SS would be a tough sell, if the former work fine and are 'free'/included, so I guess there's zero chance to upstream this, unfortunately.

<comment><USER7> ServiceStack v4 is commerical and really, really cheap. ServiceStack v3 is licensed under MIT (or BSD) and extremely mature, the community has taken over support and it has allowed Dennis to focus implementing features that $enterprise really care/need that the usual developer does not.

<comment><USER8> I don't understand what's up with the .NET community and the perpetuation of proprietary licenses for frameworks. I do not understand how developers can build on top of proprietary platforms.

<comment><USER9> I think you mean restrictive license. There items nothing wrong with corner case proprietary licences. What is every license before it is stamped 'open source' or 'free software' but a proprietary license? Many people consider copy left licenses more restrictive than your average commercial license anyhow.

<comment><USER8> No, I really do mean anything that is not _open source_ and I do not agree with you. For software development at least, everything is wrong with proprietary licenses that forbid _ANY_ of these freedoms: [http://opensource.org/osd-annotated](http://opensource.org/osd-annotated)

And any would-be license that isn't already stamped as open-source by OSI or as free software by the FSF is an instant red flag, simply because there are plenty of licenses available to pick from.

> _Many people consider copy left licenses more restrictive than your average > commercial license anyhow._

Even though some people might say that, that's only because they don't know what they are talking about. A license for proprietary software does not give you the right to fork. As a recent example for why that is important, ask the people that have invested in FoundationDB how they feel about that, then read the story of MariaDB on Wikipedia to understand the difference.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Feels like PG has to rewrite an article.

Microsoft woke from a coma.

[http://www.paulgraham.com/microsoft.html](http://www.paulgraham.com/microsoft.html)

<comment><USER11> Honestly, that kind of thing gets on my nerves. I guess I don't really care about computers in PG's view.

The reason that Windows sucks for most people is that IT departments suck. It's really something that has motivated me to find ways to stop the suck. There are lots of great innovations on the platform since Vista that just aren't used...It's like Windows admins are frozen in time somewhere around 2003.

<comment><USER12> Quite right, my home computers hardly had any problem, whereas the ones managed from IT, oh well....

I use Windows since version 3.0 where I configured my AUTOEXEC.BAT to boot straight into Windows, and after several detours with many UNIX flavours in the last decades, I have settled back in Windows as my main desktop OS.

</comment></comment></comment><comment><USER13> It would be nice to have both JVM and .NET CLR available on major unix like platforms.

<comment><USER7> That is indeed the goal and where the CLR is heading!

This work was done (almost) entirely without any MSFT involvement. Contributions were done by a bunch of guys affectionally called "the port team" whom you wouldn't want to meet in a (technical) dark alleyway ;)

@janhenke, @josteink, @ajensenwaud, @xied75, @kangaroo, @ghuntley, @qbit & @richlander (MSFT)

[https://github.com/dotnet/coreclr/issues/455](https://github.com/dotnet/coreclr/issues/455)

edit: Special shoutout to interoute.com and Paul Kelly whom comped the infrastructure needed for the team to collaborate on/test with FreeBSD, NetBSD and OpenBSD.

edit: Extra special shoutout to @kangaroo who was the first successfully merged pull request after MSFT open-sourced everything. His commits added support for .NET on OSX. He was awarded a custom, personalized/engraved scotch glass at the recent .NETFringe open-source .NET conference in portland a couple weeks ago.

[https://twitter.com/search?q=%23dotnetfringe](https://twitter.com/search?q=%23dotnetfringe)

<comment><USER14> Working with the "FreeBSD Port Team" was great. The team really lived up to the aspirational name. It would be fair to say that there were people from the port team on the repo and the gitter room ([https://gitter.im/dotnet/coreclr](https://gitter.im/dotnet/coreclr)) more hours of the day than not. Nice!

We gave @kangaroo a "port" glass to thank him for his OS X "port" and did it in Portland at the already mentioned .NET Fringe conference. We also gave him two bottles of port, one of which was "Washington Port" from Whidbey island (Whidbey being the codename for .NET 2.0). The engraving was done in the Microsoft "Garage".

We're looking forward to giving out a nice set of engraved FreeBSD port glasses once FreeBSD catches up to the OS X and Linux.

<comment><USER15> A BIG THANK YOU (MSFT and FreeBSD) to make this happen!

I've been a Java on Ubuntu/Linux for as long as my professional career but would love to see .NET becomes THE first class OSS enterprise stack on FreeBSD.

FreeBSD needs more LOVE from MSFT.

Having said that, I would love to see the .NET team produces something like Gradle/Maven (aside from the hatred toward Maven, NuGET is way behind and MSBuild reminds me of Ant thus NuGET + MSBuild combo is similar to ANT + Ivy instead of Maven/Gradle. And if you guys ever decided to adopt a scripting language for build, please, for the love of technology, do not use F# for the build scripting language like [http://fsharp.github.io/FAKE/](http://fsharp.github.io/FAKE/), just... not readable :)).

I cannot wait for the day when I can write a solid .NET GUI app or tools or Web-App for FreeBSD that looks nice and be productive with the tooling around it (unfortunately IntelliJ/Eclipse, Java, Maven, Tomcat/TomEE, Jetty, PostgreSQL/MySQL stack are still way too far ahead).

</comment></comment></comment></comment><comment><USER16> I'm curious, is there a reason to avoid using .NET for web services deployed on *nix?

I'm interested in using it, I love .NET as a platform, I just have this vague sense of worry that I can't quite rationalize. Mostly based on Microsoft's past performance with cross-platform efforts.

Thoughts? Is my gut feeling right or wrong?

<comment><USER17> IIRC, the stack was mostly proprietary commercial software. It was expensive to get started unless you use the dev edition, even then you need Window.

For me, the web development was too magic, way more so than RoR. I got an acquaintance that only do .Net. And he harps about how .Net got Razor and data base represented as object unlike open source. When I pointed out that Razor was just a template engine and that database thing is just ORM which many other MVC frameworks have he just didn't get it. He didn't get it's a template engine nor does he understand that it's an ORM. Magic! I also tried some .Net dev, and it's very magic in term of abstraction. The VisualStudio IDE is amazing and C# seems like a much better language than Java. But the ecosystem isn't as rich, Apache such an awesome organization but Oracle is very pushy.

The downsize for me is big, ecosystem. Most of the open source projects play very well together, C# is a newbie, I rather wait for it to mature within the open source space (including books and tutorials).

<comment><USER18> I feel like there's this stereotypical .NET dev in everyone's head on HN. Your friend, for example, didn't even know that Entity Framework was an ORM, and he likes "magic" and not understanding any lower level implementation.

That's too bad, because there are tons of sharp .NET devs who despise the concept of "magic" (and no, ORMs are not magic, and Entity Framework is fantastic) and who understand the abstractions that .NET offers. I would hesitate to write off all .NET enthusiasts as clueless less-than-hackers.

(disclaimer: Microsoft employee, nothing to do with .NET though)

<comment><USER19> One thing I find good about Microsoft's libraries is that for the most part they do a good job of working as magic and working with someone with understanding.

XNA is the example I always use. You can use XNA and make games without understanding anything about the graphics card but you can also dig in and write your own shaders and basically go however deep you want to/need to.

There are some things in .NET that do seem kinda magic, and razor is one of them. Not because it's a templating engine but just in how lightweight it is and how surprisingly decent intellisense can be with it. Most templating engines feel so verbose and ugly after working with razor.

<comment><USER20> Agreed on Razor... it's by far the best template engine I've used. It's a shame it's a bit of a pain to use outside of a web context (email templates, for example). Though I actually like using component-like systems more now (React, MercuryJS, RiotJS, Polymer...) with JS client and server.

</comment></comment></comment></comment></comment><comment><USER21> It's an interesting technical achievement and serious question without trolling - is there demand for running .NET apps on anything except Windows? If you're in the .NET world why would you want to do anything else?

<comment><USER22> I'm going to offer an anecdote that isn't technical.

Like it or not, but there is a definite stigma associated towards working on Windows. Developers on HN are surprisingly open-minded towards developing on Windows, but in the real world you'll find a lot of developers that look down on those that choose Windows as their development platform.

I've met a range of devs, from those working at startups, to people who work at Google, and many of them have been extremely dismissive of not just .NET, but those that work on Windows. I've worked at a startup using ASP.NET, but I reckon many C# devs would probably rate their chances of getting a job at a big tech company to be slim and none because they favour .NET. I spoke to some ex-Googlers a while back at an event, and I asked about the Google interview process. They asked me what language I coded in, and on hearing that my main language was C# they were less than favourable about my chances. It's a shame really, because I'd quite like to work somewhere like Google, but I wouldn't want to have to hide the fact that my strongest language by far is C#.

In my mind, bringing .NET to Mac and Linux will do something that we rarely see in the development world. The Windows world will be bringing something valuable to the Linux world. The best part about this for me isn't being able to use .NET on an OS that I'd love to learn more about, but not having that niggling doubt in my head about my choice of language/framework, and I reckon a lot of .NET developers, especially younger ones will feel exactly the same.

<comment><USER23> There are basic some things that make using open tools not work very well... the following 3 seem to bubble up and stop making lots of unix dev + python tools not work:

No fork

No ansi in terminal

Seperate Select for files and Sockets on Windows..

Fix those and I bet loads of the open source tools would start working, making Windows much more attractive to X platform devs.

<comment><USER22> In my eyes the problem is no longer technical, but cultural. There are a million things Microsoft could do to please developers on other platforms, but I just think that there's no changing some peoples minds. When people think of .NET developers, they think of a middle-aged man that works for a big company writing corporate code, and this is not the kind of developer that start-ups or companies like Google want in their ranks.

The moves that Microsoft are making will help validate those .NET developers that enjoy working on the framework AND want to feel like a part of the larger developer community. Technically, things will continue to improve under this direction, but what I really hope is that the per-conceived notions about .NET developers are laid to rest.

</comment></comment></comment></comment><comment><USER24> Could someone please explain how different this is from using Mono on Linux ? I mean internally that too would be running CoreCLR on the Unix-based system. Then what different did these guys accomplish?

<comment><USER7> Mono = LGPL and CoreCLR/.NET = MIT

Mono (aka Xamarin) are getting out of the compiler/language reverse engineering game and focusing 100% on mobile. They no longer need to clean room the MSFT implementation because the MSR license as a purple-pill. Now that Microsoft has relicensed under MIT developers are arriving in droves.

Advantages? .NET everywhere, SINGLE reference implementation/specification means no more bugs.

edit: You can see the transformation of Xamarin -> Mobile and replacing internal components from CoreCLR over at [https://trello.com/b/vRPTMfdz/net- framework-integration-into...](https://trello.com/b/vRPTMfdz/net-framework- integration-into-mono)

<comment><USER25> > purple-pill

What does this mean? Googling it led to interpretations that I doubt apply here... ><

<comment><USER26> I read it as an auto-corrected typo of "poison pill" :-)

[http://www.neowin.net/news/microsofts-net-poison- pill](http://www.neowin.net/news/microsofts-net-poison-pill)

This news, however, is a very positive step. Can't wait for Build next week...

<comment><USER27> I understood it as a halfway pill between the red pill and the blue pill from The Matrix, and subsequently got very confused. Looking at it as a typo makes a lot more sense!

</comment></comment></comment></comment></comment><comment><USER28> emmmm... I recall running .NET on FrBSD somewhere in 2003. It was thir first platform.

<comment><USER29> That was a Microsoft project called "rotor" [1]. It was a shared source .NET implementation on Free BSD and Mac OS X, but it wasn't licenced for commercial use.

Today's announcement is the real thing.

[1] [http://en.wikipedia.org/wiki/Shared_Source_Common_Language_I...](http://en.wikipedia.org/wiki/Shared_Source_Common_Language_Infrastructure)

<comment><USER7> Correct, rotor was a reference implementation shared by Microsoft when they released the CLR specification into the community. It was extremely, extremely basic and the GC was horrible. :-)

<comment><USER28> Weren't all VMs extremely basic back then? :-)

I was already using jails on FreeBSD for a while back then. Sometimes it feels like there's no progress in tech, except the widespread acceptance of and interest in technology

</comment></comment></comment></comment><comment><USER30> I prefer Linux but this is good news for FreeBSD. Too bad Microsoft didn't get behind .NET on Linux, FreeBSD, etc back in the early 2000's when a lot of us wanted to see that happen.

<comment><USER31> They actually did have a build that worked for FreeBSD. But politics made the license useless and they never "got behind" it.

</comment></comment><comment><USER32> Are there any micro web frameworks (think: Sinatra, Flask, Bottle...) for the .NET stack that run on Unix/Linux?

<comment><USER33> NancyFX already runs on Mono (officially supported by the project), hopefully it will run on CoreCLR once more of the API surface area has been covered (I wouldn't be surprised if it could run right now, as long as you have the correct dependencies in your project file).

</comment></comment><comment><USER34> Oh nice. I want to develop Android app on .NET!

</comment><comment><USER35> This is great! It isn't really-real(tm) until there's a PPA though.

Until that milestone is reached and it's hosted on a pretty web site, Microsoft should just focus their efforts on getting there.

<comment><USER36> I've never heard of it, but PPA apparently means a lot of things. [https://en.wikipedia.org/wiki/PPA](https://en.wikipedia.org/wiki/PPA)

What are you referring to?

<comment><USER37> I'm not sure if this is what was being referred to, but Ubuntu has PPA repositories [https://help.launchpad.net/Packaging/PPA](https://help.launchpad.net/Packaging/PPA).

</comment></comment></comment><comment><USER38> Maybe one day, we'll get a "Hey, sorry about that whole Kerberos Embrace/Extend thing we did", and Microsoft might get an actual bit of interest from *BSD land. Until then, we haven't forgotten.

<comment><USER39> You just have to get past it. Business is a rough and tumble arena, it's not a place where angels last long. What big tech company does not have a dark side or skeletons in its closet? Oracle? Facebook? Cisco? Google? Certainly none of them. But companies can atone for their misdeeds, learn from them, and become better corporate citizens. Focusing on vengeance and spite is not taking the high road. It's better to reward and encourage good behavior when it happens than to hold on to past misdeeds forever.

<comment><USER38> They embraced/extended Kerberos, breaking compatibility, and _we_ have to get past it? isn't that victim blaming?

When Microsoft actually atones, we can reward and encourage. until then, BSD users (and anyone who read a Halloween Document[1]) know Microsoft's gifts have strings.

1\. [http://www.catb.org/~esr/halloween/](http://www.catb.org/~esr/halloween/)

<comment><USER40> Bridge. Build one. Walk over it. Experience what's on the other side. It's wonderful.

<comment><USER38> the path we're currently walking is lit by the bridge Microsoft already burned. Atonement for the past should probably be asked for, rather than volunteered.</comment></comment></comment></comment></comment>