Please turn on two-factor authentication - <AUTHOR> http://www.mattcutts.com/blog/google-two-step-authentication/ <comment><USER4> Something Google could to do drastically improve the security of their two- factor authentication system is to add the ability to give more granular permissions with the application-specific passwords.

I have an application that only needs to send E-Mail through my GMail account (git-send-email), another that only needs to write to one specific GMail label (Android SMS Backup), and Google Chrome surely doesn't need access to _everything_. But you'd get full access to my account if you compromised any of these.

They already have this for the Connected Sites, Apps, and Services. I sent them a feature request for this a while ago but it hasn't been answered (and there's no way to view it online).

<comment><USER5> I didn't think Chrome any longer required an ASP?

<comment><USER6> It still does; I had to go through this yesterday. I don't mind Chrome so much _per se_ , but this also means you need an application-specific password for Chrome OS, at least for he initial sign-on, which I find oddly frustrating.

<comment><USER7> It does if you set up the sync account via the Settings page, but if you ignore the request to sign in, visit some Google page that requires login and log in, Chrome will produce a yellow bar at the top of the screen asking if you want to use that account for Chrome sync. Click yes and you don't need to sign in any further.

</comment></comment></comment></comment><comment><USER8> I was worried this would be a major pain when I enabled it, but I have to say, it has been much more painless than I thought it would be. Most of the time, I don't even think about it. Most of my consumption of google mail is through clients on my laptops, iPhone, or iPad. So in that sense, it's not much different from a regular password. The difference is that someone _else_ has a much harder time cracking my account. It's actually much less obtrusive than using lastpass (also highly recommended, but not as transparently usable).

That being said, two factor google auth wasn't going to save Matt Honan here. Identity, trust, and authentication on the internet are all built on a foundation of sand. We need a new model.

<comment><USER9> I used two-factor authentication for about a year, and I just got so sick of it. I had no issue with the whole logging in and using the time-sensitive code from my Android phone. It was the support for all the other Google apps that drove me crazy. I got really tired of needing to generate new temporary passwords for access through iCal, Mail, and I think even sites like StackOverflow. Perhaps I was at a point in life where I had too many new devices and changes going on.

It's the typical security vs accessibility trade-offs. Accessibility won.

<comment><USER10> Plus, don't the special passwords for specific apps (that don't use 2-factor auth) violate the whole point of 2-factor in the first place?

Now, you've got several passwords that work, instead of 1 and a keyfob. Ugh.

Edit: Apparently, you can't log into the web interface with those passwords. That's a step in the right direction, but still not fully secure.

<comment><USER11> The app-specific passwords are a feature and if you prefer the extra security over being able to use apps that don't support 2-factor, then you can choose not to use them, and get the full security benefits of 2-factor. It's just that, short of expecting every single third-party client app to implement 2-factor authentication or not allowing access to any that don't, there's no alternative to the app-specific passwords.

They are strictly better than using a single password for everything though, in that they are unique and strong (due to being automatically generated and 16 characters long), and easily revocable.

<comment><USER12> Non-web apps don't have a UI for two-factor. App-specific password is a compromise, which is vulnerable if someone steals your local installation of the client to get its keys.

<comment><USER11> Right. Did I say something contradicting that? Google could have decided not to offer application-specific passwords at all, but from any individual user's perspective, that's exactly equivalent to just not using them. At least having application-specific passwords gives you the option, and is at _least_ as secure as giving your master password away to every client application.

I suppose there is one possible negative consequence to users who opt not to use app-specific passwords: their existence alone removes some of the incentive for client applications to implement 2-factor themselves (which I don't know if Google even has an API for). And sure, it would be nice to have features like access control on a per password basis (e.g., so I could allow Pidgin to access only gchat, but no other part of my account). But the implication that the mere existence of application-specific passwords somehow makes Google's 2 factor auth useless is just wrong.

</comment></comment></comment></comment></comment></comment><comment><USER13> The reason I'm not using 2FA right now is twofold. First, because Google doesn't have half of their services using it for some undefined reason (for at least a year plus!). Also, the whole "app specific password" thing is a huge pain in the ass. (And appears to randomly stop working on say, IMAP mail).

Second, because the mobile authenticator is not feasible for me right now. I do a lot of android development work (well, mostly screwing around, but we'll call it work) on the side, with the result that I'm wiping my phone for romflashes at least once a week. Makes everything going through a mobile app a little useless.

I really wish Google would support a hardware token of some kind.

<comment><USER14> Yes, can someone explain why Google Chrome doesn't support 2FA on the desktop or iOS? It's bizarre.

(Well, I suppose it's tragically normal. I'm sure there is a corporate directive that says every Google service must support 2FA, but Chrome has an exception so they don't need to do it yet.)

<comment><USER15> Dunno about iOS, but Chrome does on the desktop; it asks you for an application-specific password when you turn on sync.

<comment><USER14> OK, but it should be asking your for an authenticator code instead. It uses this bizarre "normal password + app specific password" requirement that isn't used anywhere else.

<comment><USER16> Your data is encrypted with the normal password, so it needs it to decrypt the sync data. The App-specific password is used to log in to the server to GET the sync data in the first place.

<comment><USER13> So again, why not have the authenticator instead of the app password?

</comment></comment></comment></comment></comment></comment><comment><USER17> Am I the only person in the world who doesn't have a cell phone? It annoys me that the two-factor auth setups at sites (like Google) assume I have one and don't even have an option for "I don't have a cell phone, please stop nagging me about this."

<comment><USER18> Yes you are, and I suspect you know this. Even in most third world countries cell-phones are common.

<comment><USER19> Still, if I plan to use Google Authenticator, I don't want to give Google my phone number at all. When they insist to get the phone number from me, I don't like it.

<comment><USER20> I don't think you need to get them a phone number. I use Google Authenticator app on my iPhone, and didn't give them anything. It just scanned a barcode on a webpage IIRC.

<comment><USER21> The bar code was actually just a code to initialize the code generation (I think it is based on that randomly generated seed and the time, so that then server and client generate the same keys). You could have also typed in the code by hand.

<comment><USER20> You're absolutely right. My parent was talking about giving Google his/her phone number, which I was responding to :)

</comment></comment></comment></comment></comment></comment><comment><USER21> I'm always dumbfounded when these topics come up and a lot of people start saying how inconvenient it is, that it is all wrong. But these are probably the same people which later accuse Google that they didn't do enough to protect their accounts!

Yes, two factor authentication is a small hassle. Yes, two factor authentication requires a bit to set up. But do you realize how much actually depends on your email account being safe?

For one, how many times did you use Googles OpenID provider? Yes, that's your Gmail account! Or for how many services did you use your Gmail account as the email address? You know that password resets go to that account, right?

Don't do that? Maybe you use Google Calendar, then. So yes, there is actually a lot of sensitive data in there. If you don't believe me, try to get a hold of a friends calendar, and see what you can guess about that person just from the calendar.

Or should someone just post some slander about you on you G+ profile? Or buy some apps from the Android Market? Of course this things never happen to you...

So just take the time to, besides looking at the time or the latest message on your phone, open that stupid app and type that stupid code in! It's not THAT much work!

</comment><comment><USER22> Two-factor authentication improves security, but cannot solve the online security problem for most people, because the vulnerabilities are primarily CULTURAL: the average person does not understand the risks nor what they could do to ameliorate them.

Compare the attitude towards security that people have in the physical world with their attitude online. No sane person would ever want to use the same exact key to open their home, car, desk, safety deposit box, etc., because that would obviously be unsafe. Yet most people today will happily use the same easy-to-remember password for all online accounts without giving it a second thought.

Similarly, no sane person would ever lend their wallet and keys to a stranger, because that would obviously be unsafe. Yet most people today will happily walk into an Internet cafe or hotel business center and enter all their online credentials without giving it a second thought.

Providers of online services like Google, Amazon, Apple, etc. will find it difficult to solve the security problem until society has evolved its understanding of, and attitude towards, online security.

\--

Edit: softened the tone of the last paragraph to make it more accurately reflects my views.

<comment><USER23> I do agree with you on the key analogy but there's a security breach there as well. Most of the keys are generally found on the same keyring. So, in effect it's identical to using a single password.

<comment><USER22> That's true only to some extent: people keep on their keyring only those keys they need for daily use. Less frequently used keys (e.g., keys to a safety deposit box at the bank, keys to a home safe, keys to a second home) are typically stored in a drawer, a closet, or a safe.

Also, note that having different keys means one can give copies of different keys to different persons for different purposes -- e.g., copy of the home key to a baby sitter, copy of the desk key to a co-worker, copy of the home key to trusted neighbors.

People today intrinsically understand that they have to be mindful about whom they lend their keys to, who gets copies of their keys, and where the keys are stored.

<comment><USER24> On the other hand, typical house locks are (apparently) only locks by way of cultural convention.

(I say apparently because the ease of using things like bump keys is pretty widely publicized but I have never actually tried it myself)

<comment><USER25> Conventional locks _are_ far less secure than most people would realize.

That said, your house isn't directly connected to 2.26 billion people who can make hundreds (or thousands or billions) of bump-key attempts per second.

<comment><USER23> In that respect it's like a bcrypted safe with a 4 character password and limited bandwidth.

</comment></comment></comment></comment></comment></comment><comment><USER26> really surprised so many people that post here refuse to use google authenticator because its "annoying." is it a hassle? yes, but if you have ever had your email (and other accounts) compromised you understand why it is worth that small 5 second hassle when you login.

one feature that i cannot understand why it hasnt been implemented though is protecting the app itself with a password or pin. some people say to just protect your whole phone, but i dont really want to do that because to me that _is_ too large a hassle. if i lose my phone i can revoke access to my email and other similar apps, but not if the person that finds it opens up google authenticator (which shows the account the id is used for) and logs in to change the password before i have a chance to. even just allowing for it to display an account nickname instead of full login would be a huge step forward

<comment><USER27> It's not a 5 second hassle. I don't get a cell signal in the steel gymnasium even though the wifi works fine. I physically have to go outside to get a code every time I want to log in. And then if my phone is not working, or I leave it at home, I'm screwed.

<comment><USER28> FTA:

You can install a standalone app called Google Authenticator (it's also available in the App Store), so your cell phone doesn't need a signal.

Also:

You can print out a small piece of paper with 10 one-time rescue codes and put that in your wallet. Use those one-time codes to log in even without your phone.

<comment><USER27> Hm, can you generate new codes whenever you need to? It might be cool to use these 10 at a time as a one-time pad.

<comment><USER29> Yes, you can revoke those printed codes or issue more whenever you like.

</comment></comment></comment></comment></comment><comment> mike-cardwell Somebody should set up a website dedicated to listing organisations and what information is required in order to obtain access to an account at that organisation.

</comment><comment><USER30> Like the second class citizens of the web we are, Nigeria does not have 2 factor authentication.

Ghana, Pakistan, Iran, North Korea, Russia, all have 2 factor authentication. Why not Nigeria? This is just another example why being Nigerian is kinda hard on the internet.

<https://accounts.google.com/b/0/SmsAuthConfig>

[http://oonwoye.com/2011/01/23/life-as-a-second-class- citizen...](http://oonwoye.com/2011/01/23/life-as-a-second-class-citizen-of- the-web/)

<comment><USER18> > Why not Nigeria?

Can Nigerians use the Google Authenticator app?

If yes, then the answer is probably high SMS costs.

<comment><USER30> High SMS costs?

It is exactly why I put the range of countries above. Can we be in a worse situation than them all?

<comment><USER18> Then why? Lack of demand? Market not interested? Support costs too high?

</comment></comment></comment></comment><comment><USER31> All this talk about security and multiple authentication levels yet, your browser --if you use Chrome-- is the worst security leak in a persons digital life. It would take almost anyone a minute in front of a computer to fire-up Chrome and have every single login and password available in plain text.

I've written about this before and so have countless of other techies. A non- techie has not a single clue, making them perfect victims. Any number of scenarios can be imagined: From taking your laptop in for repairs/upgrades to someone gaining physical access to your machine for just a few minutes. And, just like that, your digital life is turned upside-down.

<comment><USER32> I think most people are aware that the passwords saved in their browser are, well, saved in their browser, and if someone unkind gains access to the browser they gain access to all the sites with saved passwords.

<comment><USER31> The point is that Chrome doesn't even make an attempt to slow down potential thieves. And, while I understand that absolute security is impossible, Chrome makes it so even a technology neophyte can steal your digital life with a few minutes of low-effort point-and-click action.

I use Chrome all the time. As a developer I am keenly aware of the issues and manage the risk. I will not allow anyone in my family to use Chrome because the potential security leak could have dire consequences.

</comment></comment></comment><comment> mike-cardwell I hear a lot of people advising to turn on two factor auth on Google because of this incident, but I haven't heard anyone say that we should be deleting our card details from Amazon. Well, I have, and you should too. Lots of places use the last 4 digits of your card as "authentication", and Amazon happily displays those details in your account.

<comment><USER33> Note that they had to break into the account in order to view those last 4 digits. You seem to be implying that they show them to anyone.

Either way, using the last 4 digits as 'security' is just stupid. You can get those from a receipt.

<comment><USER34> * Edit: Ah, technically they did break into the email account. The first time I read this I thought that they just had access to the account info page (doing things, such as purchasing or accessing account settings, requires password-entry by Amazon)

No, they did not have to break into the Amazon account.

[http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat- hona...](http://www.wired.com/gadgetlab/2012/08/apple-amazon-mat-honan- hacking/all/)

> _First you call Amazon and tell them you are the account holder, and want to > add a credit card number to the account. All you need is the name on the > account, an associated e-mail address, and the billing address. Amazon then > allows you to input a new credit card. (Wired used a bogus credit card > number from a website that generates fake card numbers that conform with the > industry's published self-check algorithm.) Then you hang up._

> _Next you call back, and tell Amazon that you've lost access to your > account. Upon providing a name, billing address, and the new credit card > number you gave the company on the prior call, Amazon will allow you to add > a new e-mail address to the account. From here, you go to the Amazon > website, and send a password reset to the new e-mail account. This allows > you to see all the credit cards on file for the account — not the complete > numbers, just the last four digits. But, as we know, Apple only needs those > last four digits. We asked Amazon to comment on its security policy, but > didn't have anything to share by press time._

<comment><USER35> _But, as we know, Apple only needs those last four digits. We asked Amazon to comment on its security policy, but didn't have anything to share by press time._

Wow. That's really bad. I mean, it's stupid that Amazon allows that sort of thing (and it sounds like they may be working to fix it). But Apple going off just the last four digits? That's straight up _retarded_. Why isn't anyone asking about Apple's security policies? Thank Sagan I'm not an Apple customer.

<comment><USER23> Why is it stupid for Amazon to show the last 4 digits? Let's say I have 3 cards on file. If I want to modify card #2 for some reason (billing address, expiry date) what do I do? Sure, I can look at the other details and take a guess, but we're on HN. On an average, the normal customer would get frustrated.

<comment><USER36> > Why is it stupid for Amazon to show the last 4 digits?

I think npsimons was saying that it is stupid for Amazon to let you add a fake cc number and than take over an account using that same fake number. Not that they show the last 4 digits.

<comment><USER23> Ah well, then I stand corrected. So, now the question becomes, should you be allowed to add credit cards over the phone? Or does it become, how long should Amazon wait until they accept the new credit card as a valid ID?

For the second question, I'd say Amazon should wait until the user "confirms" the credit card. That is to say, send the user an email stating "Hi! New credit card added to your account. Click here to verify".

<comment><USER36> They could do pre-authorizations on the card to make sure they are valid and match an address on file.

<comment><USER23> That's a good point. But wouldn't prepaid cards defeat this? I'm not an American so I don't know how the address verification on prepaid cards work.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER37> Is there a way to use a separate hardware device? Using my phone as the second factor is nice, but my phone is vulnerable to theft because of its value for resale.

A sealed gizmo that shows a number just looks like an el-cheapo souvenier. Without knowing my username and password too, it really is worthless.

<comment><USER38> The linked article mentioned this: [http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey...](http://static.yubico.com/var/uploads/pdfs/Howto_GmailYubiKey.pdf)

YubiKeys are relatively cheap and would provide a nice alternative to using a phone, IMO.

</comment></comment><comment><USER39> I'm sure someone is probably working on this, but what about a service that generates a one off seed for the second stage of auth, married with either a desktop or smartphone app for generating it for the user. Lose your phone/laptop/PC simply cancel it remotely so it stops generating, same as you would if you lost your bank card.

I'm sure I'm missing something, but I'm not sure what.

EDIT: I'll let the post stand but I need to read more clearly, I thought Google Authenticator was purely for Google services.

<comment><USER40> You can actually authenticate against the GA product from any system - hook it into PAM for sshd access, use it for another factor in OpenVPN, or even just wire it into Apache:

<http://code.google.com/p/google-authenticator-apache-module/>

</comment></comment><comment><USER14> >Reality: You can tell Google to trust your computer for 30 days and sometimes even longer.

How is that "even longer" part supposed to work? I have a desktop Mac that prompt me every 30 days to re-logon to GMail in Safari. Is there a way to add it to the trusted computer list?

<comment><USER41> The image linked from there says it's a new feature. I couldn't check it even by logging out of my account and logging in again (this doesn't deauth the computer? didn't know), so not sure if it's available for everyone yet.

</comment></comment><comment><USER42> I would add to that: Web developers, please implement two factor auth for your own apps as well. It takes minutes, literally, to add support for the Google Authenticator to your own app. I made a demo a while back inside of an hour. <http://dendory.net/twofactors>

<comment><USER32> That is very helpful. I'm going to be proposing this to work very soon thanks to you.

</comment></comment><comment><USER43> Two-factor auth gets old really fast when you have to use public computers in a setting like a college library. I had turned it on for a while, but turned it off when I had 5 minutes to print out a paper that I had emailed myself (yes, I still do that) and was fiddling with my phone to get the damn PIN. Never again.

<comment><USER44> Maybe it's just me but I only trust computers I control.

If you don't have root on a box, consider it pwn3d with keyloggers listening to every juicy password you type. Take that as your friend's laptop, a library computer or even your parent's Windows XP box...

Trust no one, Mr. Mulder.

/tinfoilhat

<comment><USER45> You trust computers you control? That's so cute.

<http://cm.bell-labs.com/who/ken/trust.html>

<comment><USER44> True, but you can only go so far down the rabbit hole until you think you've done enough due diligence to remove as much risk as you feel comfortable with.

</comment></comment></comment></comment><comment><USER46> I did this a few months ago, but I'm thinking of turning it off. I know it's trivial, but there's something deeply annoying about being dinged $0.20 a pop for the SMS message to get the code.

I'll have to see if I can set up the Google Authenticator; I hadn't heard of that before.

<comment><USER47> Even without GA (which, if you have an Android or iPhone, I don't see why you'd have to be without) $0.20 a month seems an incredibly small price to pay for the benefit of 2-factor auth.

<comment><USER46> I know, it's irrational, but it adds an extra annoyance factor, far more than it should. I mean, I spend far more every time I take the subway somewhere. Driving across the GW bridge costs $12, and I don't worry myself about that.

It turns into four or five SMS every month, when I usually average zero (various computers, various browsers, etc.) So suddenly, there's this line item where there used to be none. I can't explain quite why it bugs me.

In any case, I hadn't heard of GA before. I've installed it and life is good.

</comment></comment></comment><comment><USER48> It's a good idea, but it's not the weakest link in user security right now. It does very little to solve problems like Apple positively identifying people based on totally insufficient and publicly available information.

<comment><USER49> > It's a good idea, but it's not the weakest link in user security right now

I suspect Google is in a better position to judge how widespread account compromises are than you are. From my perspective, it definitely seems like security people are all saying that account compromises (keyloggers, phishing) have been the predominant threat for several years now because they're suitable for bulk attacks whereas social-engineering Apple is a more limited, if deeply disturbing, process.

<comment><USER48> >I suspect Google is in a better position to judge how widespread account compromises are than you are.

There are a couple of problems with that reasoning. First off, I don't see where anything Google has said contradicts my point. Yes, MFA is a good idea. But that doesn't mean it's enough to prevent attacks like the one in question.

Secondly, Google is not an unbiased source on this matter. For cloud services to succeed (which Google is banking on), it is very important that people perceive that they (the people) have some kind of control over their own security. It is reassuring to hear "here are some steps you can take to make yourself safer". It is terrifying to hear "your security ultimately hinges on the competence of some of the lowest-paid employees of the faceless corporations you rely on".

Both of those statements are true, but you're never going to hear the latter emphasized by Google or any other company heavily invested in the continued success of cloud based services. (Which is not to imply that they are dishonest; bias is usually as more about delusion than deception)

<comment><USER49> My point was simply that Google sees enough attempts to compromise Gmail accounts that I believe them when they claim widespread attacks using valid passwords are common enough that passwords are broken.

> Yes, MFA is a good idea. But that doesn't mean it's enough to prevent > attacks like the one in question.

It would have stopped this one, in several ways: according to Honan's writeup, it would have halted things at a key point in the chain of account compromises. Yes, it's true that you have to trust companies - but that's always been true, even 100% off-line, as any victim of identity theft could tell you. The key point is that having any sort of MFA schema would have contained the damage to one company, halting the cascade.

</comment></comment></comment></comment><comment><USER14> OK, so I turn on two-factor authentication for GMail, but...

1) I immediately have to create a application specific password to actually read my mail on my iPhone.

2) If anyone ever gets access to that secret password, or any of the others I create, they have full access to my email and any password resets they generate.

3) I will have no idea this is happening since I would expect my mail to access that app password daily.

So your fancy two factor authentication still ends up resting on one piece of secret info as the weak point. Am I missing something?

<comment><USER49> > So your fancy two factor authentication still ends up resting on one piece > of secret info as the weak point. Am I missing something?

Yes: that email password cannot be used to change your password, cancel your account, etc. and can be revoked easily without breaking anything else. This also means that you're not entering the password which can do all of those things on a daily basis, further reducing the odds of someone else being able to capture it even if they do manage the total local compromise or strong SSL MITM needed to get your ASP.

Security is all about incremental improvements, not silver bullets.

<comment><USER14> >This also means that you're not entering the password which can do all of those things on a daily basis,

Before two-factor, were you really typing in your GMail password on a daily basis?

I mean, I certainly don't deny that two-factor is much safer if you can actually use it, like on the GMail site. I just worry about the big holes that application passwords punch in that wall. All it takes is one application sending your password in non-SSL when you are connected to an insecure wi-ifi, and you are hosed. Is every Google login for every service SSL only?

<comment><USER50> Exactly. Let me know if you find an answer to this.

I have a policy where I will only add a generated application-specific password to really trusted applications (internal OS apps mail, calendar etc), and have gone as far as to sniff all traffic for each of these apps.

</comment></comment></comment></comment><comment><USER51> I've been avoiding doing this, and I'm not certain the reason is valid - <USER2> don't want Google to have my mobile phone number. Perhaps I'm being overly cautious, but the fact Google already collects such a huge amount of data on me, coupled with the increasing insistent requests to enable two-factor with my mobile phone number, has made me not do it. I got so sick of being pestered about it that I stopped using Gmail a little while ago.

<comment><USER52> You don't need to enter your phone number to use Google's two factor. You can use their smartphone application to generate codes. If you don't want to do that, the algorithm is free and open-source so you can probably find an alternate implementation that works fine.

<comment><USER51> As far as I'm aware, it's not available on Windows Phone 7.

<comment><USER53> Not GA itself, but there are compatible implementations: [http://www.windowsphone.com/en- US/apps/021dd79f-0598-e011-98...](http://www.windowsphone.com/en- US/apps/021dd79f-0598-e011-986b-78e7d1fa76f8)

</comment></comment></comment></comment><comment><USER54> Here's why I don't use two-factor authentication for my Google accounts.

It's not worth it.

I don't run a business. I'm not a celebrity. I don't keep confidential information in my e-mail. And I don't register all of my various accounts at sites around the web to just one e-mail address. If someone got access to one of my e-mail accounts it would probably be a general-use one, and quite honestly it wouldn't affect me much.

It's also annoying to have to verify every time I log in. I probably log in more often than most people. When my browser session ends, all my cookies, cache and history are erased (not because i'm paranoid, but to help guard against CookieMonster, history probing and similar attacks on sites that don't do secure browsing right). Even though it may only be occasionally, having to go find my phone to authenticate the login takes away from my browsing experience, and I don't find the tradeoff worth the hassle.

It doesn't help that Google's authenticator medium is SMS. As a hacker, I find there's way too many avenues to intercept the token (not the least of which is an already-logged-in Google Voice session!). I like the idea of using a YubiKey, but if I have to stick the device into my computer, it's annoying. I prefer plain-old tokens like RSA's SecurID or the PayPal token (I got mine when it was still only $5). But it's not automatic. I have to do a bunch of work to set it up, and i'm lazy.

At the end of the day, even once you set up two factor, a good attacker will _still_ get past it if they really want to. Separation of accounts will go a lot farther towards keeping your digital self safe than putting all your eggs into a two-factor single-account Google basket.

Edit: This post has encouraged me to pay the $20 for Bank of America's SafePass Card, which I consider to be much more secure than an app or sms.

<comment><USER28> Please, please, please, please RTFA before ranting.

SMS is not required (you can use the google Authenticator App).

The Authenticator app works just like a "plain old token".

Separation of accounts means squat if your passwords are intercepted. 2 factor auth requires physical access and reduces the possible pool of attackers from billions to hundreds.

<comment><USER55> You still need to hunt for phone (on top of that you must have one) to log in...

<comment><USER54> That, and I don't trust "an app." The whole reason I want a second factor is to get away from computers as primary authentication mediums, and a smart phone is a computer.

I don't think anyone realizes how much malware is in the Android marketplace. And that's beside the malware that vendors and carriers install on there by default. _Do not trust your phone._

<comment><USER56> The Authenticator app is open-source [1] and extremely minimal. It doesn't run with permissions to access any data on the phone, or even communicate over the network; all it does is read the system clock every 30 seconds and compute an HMAC.

[1] <http://code.google.com/p/google-authenticator/>

<comment><USER54> The app isn't what worries me, it's what else is running on the phone. Android malware comes in the form of a rootkit, usually, which means it has total control over your device.

Not scared? How about this article[1] from over a year ago, which details over 50 apps in the Marketplace using a rootkit which not only controls anything you do, but can download new code to keep changing at a whim?

[1] [http://www.guardian.co.uk/technology/blog/2011/mar/02/androi...](http://www.guardian.co.uk/technology/blog/2011/mar/02/android- market-apps-malware)

</comment></comment></comment></comment></comment></comment><comment><USER57> I really hope other services start offering it as a feature.

Namecheap, I'm looking at you. DNS web apps are a huge possible attack vector.

Also, RE the Google one time use passwords for POP/IMAP. They are all lower case, alpha/numeric, and 8 chars long.

How secure are they against brute force? Why wouldn't Google offer 16 char options, or even longer? Is 8 good enough?

<comment><USER58> the application specific passwords are 16 characters long. Four blocks of four lowercase characters.

I too would rather them be longer, and involve at least some numbers if not specials... but they're not THAT short.

<comment><USER57> Really? I was sure it was only 8 when I went through the process 2 weeks ago. 2 lots of 4.

Time to go and generate some new passwords!

<comment><USER20> Hmmm... I generated a batch about 2 months ago and another batch last week. In both cases, they were of the form

        llll llll llll llll

(l: [a-z])

<comment><USER57> Happy to stand corrected. My apologies all round.

Thanks everyone!

</comment></comment></comment></comment></comment><comment><USER25> Just answer me this: why does Google insist on using a phone for this?

Really: the company's got far too much personal information on me. Pick something _else_ I can use. An OTPG (similar to the RSA keyfob), say.

Added bonus: this gives a pathway for _other_ services to also offer 2-factor auth.

<comment><USER59> From what I understand, a phone number is close to a primary key to people in the US these days.

</comment></comment><comment><USER60> I did this but was expecting more from Google. As an example, it was easier to add two factor auth to my Blizzard account (and install their authenticator) than it was for Google. These are the steps for Google: \- Add mobile phone to account \- Enter code from SMS \- Generate random passwords for multiple apps which don't support two factor auth (this took awhile). \- I wasn't given any instructions on how to switch from SMS to Google Authenticator app so I had to search for those instructions and then set that up.

Granted Blizzard controls the entire experience, they're not dealing with 3rd party apps, but it seems like Google could make this easier. And once it's trivially easy to setup, then it can be made the default.

<comment> brown9-2 The difference is, as you mention, that for your Blizzard account there is one app that needs to be changed to use 2FA, whereas with Google you are using your account from dozens of apps that they do not control and that can not be made to support the 2FA login process. It's an unfair comparison.

</comment></comment><comment><USER61> Browser compromises are the one I worry about. A remote attack that reveals everything your browser has or knows.

I've been using 2 factor on google for a year or so now. It's not perfect - especially the ways it can be disabled - but it's better than the status quo for now.

</comment><comment><USER62> I'll propose a sideways solution: implement an "Administrator" mode on these accounts that requires separate authentication--perhaps enforcing two-factor authentication there.

There are many complaints about how Microsoft didn't protect Windows users enough because everyone had administrator access as a default. But isn't that the same problem with these Google and Apple accounts? With your standard account, you can change your password, delete all data, and do many other damaging acts.

I don't really want to enter in multiple pins/passwords each time I read email. But I would be more than fine doing so before being given the ability to damage my account.

</comment><comment><USER63> Quick question for all you security experts:

Which is more secure: LastPass with 2factor, or a gpg encrypted password safe on my home server accessed by a passphrase-locked rsa-encrypted key?

I've been trying to decide for the past few weeks. Copying and pasting passwords isn't as annoying as I thought it would be, and it seems like keeping my pwsafe locally reduces the attack vector of the LastPass servers.

Then again, it's in LastPass's absolute interest that my info never gets leaked, and they've built up a good reputation. Further, at a public terminal my usb drive would need to be connected while I unlock the key, thus possibly exposing my unencrypted key.

Any ideas?

<comment> mike-cardwell LastPass is only one persistent XSS flaw away from having your password store completely compromised. I found a non-persistent one last year which exposed a lot of information about you, but not your password:

[https://grepular.com/LastPass_Vulnerability_Exposes_Account_...](https://grepular.com/LastPass_Vulnerability_Exposes_Account_Details)

Specifically it exposed your email address, your password reminder, the list of sites you log into and the history of your logins, including which sites you logged into, the time and dates you logged into them, and the IP addresses you logged in from.

EDIT: I used to use LastPass but now I use a GPG encrypted file, which I sync between machines. I set up a simple helper script so I can just type for example "password facebook" at a terminal and it will do a gpg --decrypt on the text file, grab the facebook password, display it, and also copy it into my clipboard for ten seconds.

<comment><USER63> Thanks for the detailed info!

Combined with two-factor ssh auth[0] for using a public connection, looks my gpg file is the perfect solution.

[0] <http://news.ycombinator.com/item?id=3029680>

</comment></comment></comment><comment><USER64> Sigh, OK. I'm turning it on today. Was going to do it right now, but then I realized that I'm at Starbucks right now... probably not the best time to be messing with passwords.

</comment><comment><USER65> Do you trust the minimum wage customer service reps of your phone company to not be susceptible to social engineering?

Two factor-auth, via SMS, may not have saved Matt Honan.

<comment><USER66> Use the app, it's not vulnerable to such an attack.

Or buy a prepaid phone, and don't use the number for anything else.

</comment></comment><comment> T-R I use 2FA, but it's an absolutely frustrating experience. Most apps just don't support it. Google Music Manager requires a trip to accounts.google.com for a new App Specific Password every time I restart my computer, whereas Swiftkey just loses its ability to offer suggestions until I manually re-authenticate, which takes several minutes every time it happens, while I wait for an SMS and switch between apps.

<comment><USER36> Sounds like something is wrong with your computer. I set up Music Manager months ago on two different computers and they have been humming along fine ever since.

</comment></comment><comment><USER67> It seems to work well with Firefox and Safari, but I've found that two-factor auth doesn't work well with Chrome if you've set it to clear cached files (not cookies) on exit. For some reason, that setting causes Chrome to lose the 30-day permission, so every time Chrome crashed or I rebooted my machine, I'd have to go through the SMS dance. Doesn't happen with the similar setting in Firefox.

</comment><comment><USER68> Well I turned on two-factor authentication and then updated Sparrow (iOS and OS X) with the new password and everything was fine... Until the iOS version constantly kept telling me I had an incorrect password. I tried various troubleshooting tips online but to no avail. Until I can use this with everything I can't use it at all.

</comment><comment><USER69> The only time I regret turning on TFA is when I'm laying in bed with my laptop and my phone is slightly out of reach.

</comment><comment><USER70> turned it on. was so annoying that i removed google accounts.

</comment><comment><USER71> What's the status of Google's two-factor authentication with Sync (Exchange)? Last time I tried it was a mess and the added security was not worth the hassle of not having everything pushed and kept up to date.

</comment><comment><USER72> I'm glad this is on the front page again. I just set mine up. thx internet.

</comment><comment><USER73> is there an authenticator that can run on my computer? i see an android app - is there something similar that can run on linux?

or does that defeat the purpose because it's not going to be a push notification? (if so, anyway to fix that?).

i'm not normally mobile. if i _am_ travelling and need gmail, i will have my laptop. i don't have a smartphone and my dumbphone won't work abroad.

EDIT2: oops. ignore previous edit. that was using Google to connect to linux. Not vice-versa.

<comment><USER74> Here are a few implementations that supposedly run on Linux, but I haven't tried them yet:

<https://code.google.com/p/cuteauthenticator/>

<https://github.com/mclamp/jauth>

[http://blog.jcuff.net/2011/02/cli-java-based-google- authenti...](http://blog.jcuff.net/2011/02/cli-java-based-google- authenticator.htmllinus)

Also, Android can apparently be run in VirtualBox, but I haven't tried that yet, either:

<http://www.buildroid.org/blog/?page_id=121>

<comment><USER73> thanks.

the first link makes the valid point that it's not that smart to run this code on the same machine used to access the service (if that machine is compromised then the "two factor" aspect becomes a single, compromised factor).

so i guess maybe what i was planning is not so good an idea. on the other hand, maybe it's better than nothing.

</comment></comment></comment><comment><USER75> Question: How many designers/UX people were in the first meeting about two- factor authentication at Google? How many security engineers?

</comment><comment><USER76> I turned it on. Had been meaning to for ages, but never did. Thank you, Mr. Article Writer.

</comment><comment><USER77> I just turned two-factor authentication on and it forced me to set "program specific" passwords for like 10 different apps and seriously messed up my phone. I had to deactivate it. What's with the hassle?

<comment><USER24> For the second factor to mean anything, all the apps that don't support it need a password that has less rights.

Hopefully they figure out a nice way to make the rights more granular (so that a chat app can't mess with email or whatever).

<comment><USER27> Do those passwords have less rights? I figured that if _any_ of those passwords got compromised, you were screwed (until you found out which one and revoked it).

<comment><USER24> A little less. They can't be combined with the 2nd step verification to make changes to settings that require 2 step verification.

So instead of losing access to your account, you just lose all your email (yay!).

<comment><USER27> This has always been the part I don't like about Google's 2-factor auth. Right now, I have one strong password that would have to be compromised to access my email. If I enable 2-factor, suddenly I have (last time I tried it) about 20 new passwords, any one of which could yield access to my email. That does not really seem more secure.

<comment><USER24> I think the more important question is whether it is less secure. It does make it harder to seize control of the account (which might be a lame consolation, but backups are a good idea either way), and it is (potentially) more convenient in the event that one device is lost or misplaced.

Someone who previously always logged out might be exposing themselves to more risk by storing the app passwords, but I think that's about the only case where it is worse.

<comment><USER27> It decreases the severity of a breach but increases the likelihood. Per-app passwords can't be used to take over an account. But they can be used to read my email. I think just shifting the permissions a little so that I can "authenticate" without also giving out the creds to my email would be acceptable.

</comment></comment></comment></comment></comment></comment></comment><comment><USER78> How does it work with pop3/imap?

<comment><USER79> You can generate specific password for applications: [http://support.google.com/accounts/bin/answer.py?hl=en&a...](http://support.google.com/accounts/bin/answer.py?hl=en&answer=185833)

</comment></comment><comment><USER80> did it today :)

</comment><comment><USER81> I'm really frustrated with Google and this 2-factor authentication. They are in such a great position to really change the way in which people secure themselves and they've completely missed the trick [edit: FOR THE AVERAGE USER].

Google 2-step auth is very hard to use and for how hard it is to use it doesn't provide all that much protection. It protects against phishing (mostly) but not against someone who has your phone. Malicious ex-girlfriend trying to do you harm? Google 2-factor won't help you a bit as long as at some point she had access to your phone.

Any security improvement is better than no improvement so let's concentrate on the real issue which is ease of use.

1\. Google 2-factor auth requires application specific passwords are deeply confusing

I founded Clickpass and I can only just get my head around this. One password per application? This is a very confusing concept and very difficult for the average person to understand. There's no indication of whether you can reasonably create one password and reuse it in all your apps (which I think you can).

Application specific passwords are very confusing and not that much more secure than one revokable password for all applications.

2\. Application specific passwords are almost impossible to use on mobile apps

Ever tried copying a 12-digit long string into a keyboard which only shows you the last letter you entered and even then only for half a second? It's really hard. You can't copy and paste them and you have to have a computer nearby to do it (it's very hard to use the Google password-generator page on mobile)

Here is the list of the application-specific passwords that have to be individually entered (10+ characters each):

 _On my mobile_

\- iphone mail

\- iPhone Google account (through browser)

\- iphone work mail

\- iPhone (work Google account through browser)

\- iphone calendar

\- iPhone calendar (work)

 _DUPLICATE ALL OF THE ABOVE FOR iPad_

 _DUPLICATE ALL OF THE ABOVE FOR MacBook Air_

Switch on 2-factor auth and you immeidately find all these apps go dead until you do this. It will take you about 15m at least to do this and you'll have to do it again if you change your password or get a new device. You can't copy and paste because the Google auth-token page is unusable on moble.

 _What we need is easy, incremental security improvement_

The problem with Google 2-factor auth is that it was designed by security geeks. It takes 3m just to watch their setup video! The system needs to be designed by usability geeks and audited by security geeks.

2-factor auth is no use at all if it's switched off. Contrast my switched off 2-factor auth with my Facebook auth which texts me every time someone logs in from a new machine and you contrast a system which provides me with a bit more security (FB) and one which pertains to be secure (Google) but which adds nothing.

Google needs to rip the security guys out of their security team and put the user experience people in. End-user security is a UX problem and Google is in a powerful position to effect change.

[Edited above for (a little) brevity]

EDIT BELOW: for folks who feel this account is unfair:

I realise that if you keep a PGP encrypted file on another device that is necessary to do your password reset then yes, Google 2-factor auth is very strong indeed.

I also realise that you shouldn't tell someone your password. The point is though that resetting your password is something that only really needs your phone. The key elements to resetting your password usually involve sending a password or an out-of-channel token to another acccount. For most people that other account is their work mail or Facebook, both of which are usually accessible via their phone.

I'm not talking about the absolute strength of Google 2-factor authentication. I'm talking about how that type of process applies to the type of internet user who tries to log into Facebook through ReadWriteWeb:

[http://www.readwriteweb.com/archives/facebook_wants_to_be_yo...](http://www.readwriteweb.com/archives/facebook_wants_to_be_your_one_true_login.php)

<comment><USER82> > it won't protect you from someone stealing your phone and opening your > authenticator to login to your account

Why do they (and your malicious ex) know the other half needed to login - <USER3> password?

<comment><USER81> They don't need to know it. To reset your Google password you need your backup email account (Facebook / Work email ) or your telephone number or text. All of these are almost invariably accessible without further authentication via your phone. The protection that 2-factor authentication adds doesn't apply in the event that someone has the second factor. We're talking about the incremental improvement rather than the protection granted by your password.

</comment></comment></comment><comment><USER79> Done.</comment>


Ask HN: Are you using Elm? is the development active? - <AUTHOR> Hi, I really want to use elm.  But when I look at: https://github.com/gdotdesign/elm-ui I see that it was last updated at May 2017 .  And I really don't want to use a project which is not actively maintained.  What is your impression if you use it? <comment><USER2> Are you asking about elm-ui, or about Elm the language?

Elm libraries (like elm-ui) are generally very stable (thanks to the language guarantees), so the fact that it was last updated at May 2017 isn't necessarily bad. In fact most of the libraries, when they're published, they're done. (Sans occasional bugfix)

I don't know about this particular one though, it seems the author is focused on non-Elm things now: [https://www.mint-lang.com/](https://www.mint- lang.com/)

Elm the language is active, alive, used in production, the community grows, it seems that the alpha release of v0.19 will drop any moment... Things are looking pretty good!

(PS: The Elm slack - [http://elmlang.herokuapp.com/](http://elmlang.herokuapp.com/) \- is probably better place to ask Elm-using-people stuff :) )

<comment><AUTHOR> ok cool, i'm looking at elm-ui and I don't see they have for example: "alert" like: [https://getbootstrap.com/docs/4.0/components/alerts/](https://getbootstrap.com/docs/4.0/components/alerts/) . What do elm users who use elm do for alerts? I like the idea that elm is encapsulated and opinionated, i'm just trying to find my way around it and to understand how to work with it, any idea what users who use elm-ui package do for alerts? do they need it? use another component? external css? elm- bootstrap?

<comment><USER2> Not sure. Ask around (on the Slack) though! I'd use external CSS.</comment></comment></comment>


Chess World Championship 2012: A First Win - <AUTHOR> http://moscow2012.fide.com/en/live?g=20120520

<comment><USER2> ChessNetwork on YouTube has the most clear and concise explanations of what's going on. They're incredibly easy to follow even for patzers like myself: <http://www.youtube.com/watch?v=Zh9KTUiimzE>

ChessVibes has good summaries of the event with post-game interviews: <http://www.youtube.com/watch?v=kI7Jbf_Kkqc>

<comment><USER3> KingsCrusher + Chessexplained are also doing indepth analysis of every game: [http://www.youtube.com/watch?v=QZvOgTclCSM&feature=plcp](http://www.youtube.com/watch?v=QZvOgTclCSM&feature=plcp)

Sadly audio isn't great on this video but the analysis is still very good.

</comment></comment><comment><USER4> I've been following the match since it started and can't fathom what this has to do with hacker news.

Though I can't help but mention that interested parties would be much better served by the coverage at chessbase than the dry 'game-score+laconic-engine- commentary' as presented here.

</comment><comment><USER5> A general comment about playing Chess. I've been playing since I was a kid. I like the game. Well, sort of. I've probably logged nearly 10K games on the playchess server. One day, while having a conversation about Chess with another (older) engineer he made a comment that really stuck in my mind, he said: "All you accomplish by playing a lot of Chess is to become a better Chess player".

His comment had a point to it. The conversation took place while we were waiting for the results of FEA for a fluid-based thermal management system. Each run took 18 hours. It had been running overnight and we were about to get results. While we waited I fired-up a quick game of Chess and we started to talk about the subject once I was done.

His point was that, unless your goal is to become a world champion and somehow earn a living out of playing Chess the game can very easily become a huge waste of time. You don't learn anything more than playing Chess. It is false to assume that good Chess players are really smart people. Yes, they might have the ability to achieve deep concentration and focus on the game. One would be surprised to learn just how bad some really good Chess players are about other things in life.

I thought about this on-and-off for months. Nearly every time I thought about playing Chess his words played back in my head. My conclusion was to accept that he was right: There was no point to playing Chess beyond a level of entertainment.

In order to become truly competitive in Chess you have to become a human database. You need to study openings, endings, all sorts of mid-game permutations. You need to study your opponents' games and know how to counter some of their moves or approaches. In other words, you need to turn a fun game into a job. That, to me, turns a fun game into an ugly job. I have no interest in being that person.

This point got driven home as I taught my kids to play. I started one of them off when he was six. This was prior to my "revelation". Very soon he was winning local tournaments right and left.

As I understood what was happening I pulled him back a bit from this rather serious engagement with the game. To some extent he had already learned a lot of what the game has to offer: Considering your options; Patience; Planning; Concentration; Goals; Making choices; etc. His time would be far better invested on such topics as programming, music, even building cool things with Legos.

You can learn the basic real-world-usable lessons of Chess within six to twelve months of playing the game. Anything beyond that is just playing more Chess with no further lessons that apply to other aspects of your life.

I admire GM's at the levels seen in these championships. Good for them. It is their chosen profession and they excel at it. However, I am no-longer in awe of their mental abilities. What they have to become in order to play at these levels is, to me, the absolute opposite of what the game felt like when I was a kid. It was very cool to solve problems as they were presented and "fight the battle". It isn't cool to play against a database --or have to become one.

<comment><USER6> Indeed, but you can say this about pretty much any hobby.

What does playing Guitar get you beyond getting better at playing guitar? Snowboarding? Rock Climbing? Traveling the world? Building perfectly accurate models of 19th century warships?

There are a million things that people can take up a a hobby, and even dedicate their entire life to. All of them have your same points in common that, unless you manage to become one of the top 100 people in the world at it, it's not really going to ever benefit you beyond your own personal satisfaction.

And yet, I defy you to find a single person who doesn't have at least one of these time wasting hobbies. It's part of what makes us human.

My advice is to not sweat it so much and go play Chess if it makes you happy.

<comment><USER7> Snowboarding and rock climbing improves your health, so it's absolutely not wasted time. You get the benefit of doing something fun, while also making you a healthier person.

You're still right, though. Play chess if it makes you happy.

<comment><USER6> True, though there are better ways to improve your health if that's your goal.

If you want to be truly good at either one of those things (to the level that the grandparent talks about where he's a "walking database"), you're going to do all sorts of things that are not particularly beneficial to your health.

Next time you meet a _really_ dedicated snowboarder, have him do a couple deep knee bends and take a listen. If you ever meet me, have me show you my knuckles, which I can no longer straighten nor bend completely after 15 years of dedicated finger training for Rock Climbing. Watch me do a one-arm pullup, then laugh as I fail to run a mile because I'm not actually, in any normal sense of the word, in shape.

Pretty much all the hobies I mention above, and most you could think of, require you to specialize in ways that make them unsuitable training for the general case area in which they improve you. Just like Chess sorta makes you smarter and piano sorta makes you more dextrous, training for a sport just sorta makes you healthy. But mostly it makes you a better snowboarder, climber, etc.

</comment></comment></comment></comment><comment><USER8> I don't play chess or understand why this matters. What is going on?

<comment><USER9> They've drawn each game up till this win by Gelfand.

Beautiful mate at the end: Anand, the world champion, playing black, marched a pawn across the board, but Gelfand will checkmate in two moves regardless. The knight checks on G6, the King is forced to G8, then the Rook checkmates on G7.

Incidently, Kasparov just called out Anand as old'n lazy while visiting the match in Moscow. Gelfand came through candidate matches as a surprise challenger. He's been around forever in the top twenty.

<comment><USER10> Black could avoid the mate by sacrificing his rook with h1+, then promoting the pawn with a check, then sacrificing the new queen by taking the knight at e5. No point in that though. He has lost.

</comment></comment></comment><comment><USER11> While I don't know why the poster put this up, one could argue that hn is about learning from others opinions, victories and mistakes.

Here, we are given a chance to analyze two great chess masters and replay their strategic battle. What decisions made one lose? How is the strategic deployment of pieces similar to running a company? What attracts hackers to chess?

Or it could be that bunch of people on hn like chess, and this got voted up. Who really knows what fuels articles to the front page of this community?

</comment><comment><USER12> Perhaps because Chess is a fascinating thing for Hackers! I'm just a casual Chess Player and I play while I relax or get tense with work.

I don't really follow the championship but they were unable to win for quite a while, right? So, this is the first win. We'll have to watch how Anand comes back.

</comment><comment><USER13> HN may be interested to know that Anand is a brand ambassador for NIIT, a computer education company from India (<http://en.wikipedia.org/wiki/NIIT>). AFAIK this is the only brand he endorses.

</comment><comment><USER14> Really nice game. That's the sort of elegant finish I always hope for in my games.

</comment><comment><USER15> I've been playing too much shogi, all I want to do when watching this game is drop a pawn.</comment>


Ask HN: Feedback on an idea (OurBIGsong) - <AUTHOR>

Hi guys,
I've had an idea floating around my head for a couple of days that i wanted to share and get some feedback on.
What i would like to know is whether or not you think its 'feasible'.
And what you would do to improve upon it.
I am actually already working on it. But ive gotten a bit of a mixed bag when it comes to potential user feedback.
This is the smartest entrepreneurial community i know. So it is natural for me to also come here for some advice.
I appeciate any and all contribution and look forward to hearing your thoughts.
Here's the idea:
OurBIGsong.Com
A song that allows a couple to get a song personalized for them by independent musicians for specific functions like, wedding, reunions, anniversaries, etc.
The core concept is that we research the people (via their own input and their social online profiles) and give the musicians enough information to create a unique composition based on this information. <comment><USER2> It's a fun and unique concept, but I think the general public greatly undervalues what it takes to write, record, and produce an even half-decent song. That's going to make it very difficult for you to present a price that makes sense to people. (What sort of price did you envision?)

Also, this is obviously not very scalable. I think the target market is tiny, though, so that is probably not a big deal.

<comment><AUTHOR> Because it is a very small market i would price it at about $1,000 for a song. So it would be a niche product, but also a luxury one.

<comment><USER2> Sounds about right. I think it will be very hard to track down the market for this, though. Unlike commissioned visual art, these songs probably won't appreciate in value nor can they be hung out ad infinitum for the world to see. Good luck!

<comment><AUTHOR> Yep, very true. It is very hard to gage what the value is here.

I've still got work to do!

Thanks for the feedback. :)

I'll be sure to return the favour. Ping me anytime you need feedback. Email is on my profile.

Best,

Tapha</comment></comment></comment></comment>


A Facebook employee tied to Cambridge Analytica has quietly left Facebook - <AUTHOR> https://www.fastcompany.com/90231904/a-facebook-employee-tied-to-cambridge-analytica-quietly-left-facebook <comment> david-cako remind me if I ever quit a company that people are unhappy with to not do it "quietly". lots of yelling + property damage.</comment>


How to get Paul Graham to take you to lunch and review your start-up idea - <AUTHOR> If you're in the Bay Area, dying to sit down w/ Paul Graham, here's one quick and easy way to get what you want and help out a worthy cause at the same time.
Bing Nursery School, affiliated with Stanford University and 1 of the top ten nursery schools in the US, is holding its annual Autumn fundraising auction on Sat. Nov. 13, 6pm, to raise money for scholarship fund, helping poor families to send their kids to Bing.  Item #406 on the silent auction block is "Talk About Your Start-up w/ Paul Graham"!, estimate value is $500.  The starting bid however is around $10.  The auction is open to public.
Here's a partial description of the item: "In this amazing opportunity, Paul will take you to lunch and spend an hour talking with you about your startup idea, or help you come up with an idea that is suited to you.  Don't miss this once in a lifetime chance to help make your dream a reality!"
http://www.stanford.edu/dept/bingschool/giving_harvestmoon.html
Please help this worthy cause.  Bing is an awesome school and I wish every parent can send their kids to Bing.  Every year Bing staffs and parents put in so much efforts to raise around $300,000 so Bing can offer more scholarship to deserving families.  This is your chance to help and get some help for yourself.
http://www.stanford.edu/dept/bingschool/index.html
Disclaimer: I'm a Bing parent and volunteering on the Solicitation team for this Bing auction. If you need help in either attending or bidding, please contact the school or PM me directly.  Thanks.
More disclaimer: Paul Graham has nothing to do with this submission.
Add: if you want to bid and can't be at the auction, please contact Bing Nursery, they'll be happy to make arrangements for your bid. <comment><USER2> _1 of the top ten nursery schools in the US_

Ok, seriously, this is getting ridiculous. Who the hell goes across the country compiling a list of the top ten _nursery schools_? I'm not convinced that such ratings are useful for universities, never mind high schools or lower tiers of education. The concept of a top-ten list of preschools just blows my mind.

(I still think it's great that PG is contributing to this in such a unique fashion, though.)

<comment><USER3> Tangent: I don't know anything about early childhood education, but now I'm interested. (Also, I'm not implying anything of your post; I agree that the rankings can get silly.) Is there any data to suggest that preschool is, in fact, less important than university? It's easy to scoff at the notion that pre-K and K are significant, but I'd guess that some high quality nurturing at this age might be the requisite experience for success. We call them the formative years for a reason, right?

<comment><USER4> You're both off-topic and dead wrong. Don't you know there are tons of successful people who taught themselves everything from basic literacy to advanced sciences later in their life? Not even talking about "late bloomers", rather, people who lived illiterate well into their teens and twenties. How do you explain this ability to learn?

<comment><USER5> They're outliers? There are physical realities that happen to your brain that make it more difficult to learn as you get older. Now, I certainly recognize that many aspects of the current education system are overblown. But you're going to have a difficult time convincing me preschool is as dispensable as college.

<comment><USER6> > There are physical realities that happen to your brain that make it more > difficult to learn as you get older.

Only if you believe them. Sure, _everything_ gets harder as you get older, including the 'basics' (such as walking). But for some learning was never easy, always hard work. The difference age adds to that is just another hurdle to overcome.

The big trick is to never stop learning.

> Now, I certainly recognize that many aspects of the current education system > are overblown. But you're going to have a difficult time convincing me > preschool is as dispensable as college.

Attitude is the one thing that is in-dispensable when it comes to learning, all else - including age - can be overcome.

</comment></comment></comment></comment></comment><comment><USER7> Surely the type of people most likely to benefit from PG's advice are some of the least likely to have the disposable income to be able to spend (up to) $500 for his time?

That's 1/40th of the $20k most startups get from YC.

[I don't mean to detract from the good cause being raised for here - but I think society should expect people to give back to charity/good causes/etc proportionally to their wealth - surely most young startup founders that YC attracts are likely to have limited funds and putting everything into their startups? I guess I forget trust funds, "daddy's money" etc]

<comment><USER8> Up voted you because I agree that people who would really benefit this most likely don't have 500$ to spend.

However, you're implying the 20k$ startups get from YC represents all the value derived from being a YC startup. If I ever apply to YC, it will be for press coverage, the YC network and sound advice.

<comment><USER7> So, it's a bit of a long-running thing with me... that I continue to comment that YC = $20k + all the extra benefits.

The issue I have with YC is that I think the 'extra benefits' can be gained in other ways that doesn't require you to put a valuation on your company. I've been living here in SF for many years and I feel I have access to many of the 'extra benefits' YC gives through my own network (without having to take a specific route of funding)

</comment></comment></comment><comment><USER9> Link to donate directly (not related to the auction with pg):

[https://pgnet.stanford.edu/give/home?mop=CC&gfty=G&p...](https://pgnet.stanford.edu/give/home?mop=CC&gfty=G&pgnTPC=75&stp=98&gdso=5&tgso=6&cturl=close&olc=10969)

</comment><comment><USER10> You'd probably raise more money if this specific item was an online auction.

<comment><USER11> Yea if it were online I'd bid my life savings (around $60 at the moment).

</comment></comment><comment><USER12> Do people think that this auction will only fetch $500? I would have thought it will be bid up to several thousand..

</comment><comment><USER13> Not to take away from the cause, but I'm guessing if you emailed PG during a quiet period and offered to buy him a $500 lunch he'd take you up on the offer :-)

</comment><comment><USER14> I find a little childish the phrase: Take you to lunch, it sound very passive, like taking a dog for a walk.

It would be better something like: How to meet P.G. for discussing about your startup. Simple and effective.

<comment><USER15> "Take you to lunch" is a common phrase in American business (and social relations in general). The taker buys lunch for the taken.

The implication is that the taker is making life easy for the taken, all the taken has to do is show up.

<comment><USER14> Thanks for the information about this American business phrase. The implication on an invitation is that who invites is trying to sell you something (there is no free lunch in business).

<comment><USER15> Your correct that it is often a situation where the taker is selling. It can also be an expression of gratitude for a favor.

However, there is another business scenario in which a mentor uses lunch as the opportunity to schedule time with their mentee. Sharing a meal often provides a less formal setting and fosters the personal relationship.

This case appears to be a combination of the second and third scenarios.

</comment></comment></comment></comment><comment><USER16> If someone wants to bid on this item (or any others), he or she will need to attend or have someone attending bid on their behalf. The school will not be able to help remote bidders.

</comment><comment><USER17> Ask PG: PG would you consider a 10 minute phone call for a $100 donation of the charity of your choice? I can't fly out to Palo Alto.

</comment><comment><USER18> heh. in how many different ways is this rich people helping rich people stay rich?</comment>


NASA Data Find Some Hope for Water in Aral Sea Basin - <AUTHOR> http://www.jpl.nasa.gov/news/news.php?release=2014-050

<comment><USER2> dude, where is my water?

[http://en.wikipedia.org/wiki/Aral_Sea](http://en.wikipedia.org/wiki/Aral_Sea)

"Many of the canals were poorly built, allowing water to leak or evaporate. From the Qaraqum Canal, the largest in Central Asia, perhaps 30 to 75% of the water went to waste. Today, only 12% of Uzbekistan's irrigation canal length is waterproofed.

Of the 47,750 km of interfarm irrigation channels in the basin, only 28% have antifiltration linings. Only 77% of farm intakes have flow gauges, and of the 268,500 km of onfarm channels, only 21% have anti-filtration linings, which retain on average 15% more water than unlined channels."</comment>


The cult of Stanley Kubrick - <AUTHOR> https://www.economist.com/prospero/2018/12/10/the-cult-of-stanley-kubrick <comment><USER3> 2001 is a movie that my Dad and I have bonded over for some 15 years now. He was a scifi nerd in college when the movie came out and it's stayed with him ever since. As a child I unknowingly played with his model Moon Bus and PanAm Space Clipper, effectively ruining them, but he just told about the movie and wasn't even mad. Eventually when I get into films we watched his LaserDisc copy of the film and on every format since (except VHS).

Starting last Christmas, I started buying him the Mobius Models 2001 re- releases to replace the models I broke (He's getting a new Moon Bus for Christmas). Our highlight of the year though was going to the Smithsonian to see the IMAX restoration of 2001; it was like seeing the film all over again for the first time.

I'm incredibly fortunate to have been able to bond with father over the years around this special film. My dad is the stoic engineer type, but this movie is a window into him that I'm grateful to have. All this is to say that I'm 100% a Kubrick cultist.

(I took my wife to see a 70mm showing of 2001 in September and she just yelled at me "What the hell was that?!")

<comment><USER4> > (I took my wife to see a 70mm showing of 2001 in September and she just > yelled at me "What the hell was that?!")

Reminds me of taking a few of my friends to a screening of Blade Runner 2049. On the way there I was gushing about how the original Blade Runner is amazing and one of the pillars of cinametic sci-fi. After the movie was done I was going off on how this was an amazing homage to the original etc., one of my friends interjected with 'I don't understand what the hell did I just watch' and the others were just staring at me with this '???' look on their face. They even thought I pulled a fast one on them in saying that the original wasn't required viewing as the links are only tangential.

<comment><USER5> In contrast to the other comments about how 2049 was slow etc., let me say that I took my wife and daughter to see 2049.

We watched the original "Final Cut" Blade Runner a couple of weeks before 2049 and both wife and daughter felt that the original was slow but they respected the movie.

After seeing 2049 my wife said she enjoyed the movie better than the original but wished it could have been an hour shorter.

My daughter was ecstatic and said that 2049 could have been another hour even longer and she would have been happy. But my daughter is a cinematographer, so possibly that's partly why she loved it.

<comment><USER6> I thought 2049 was a wonderful, visually appealing film with a neat small story set in a big world. Which makes it a bold movie.

Sure, it was set in a universe we probably never thought to see again. The outset was flogging a horse I thought would have been better off stay dead. But in this age of huge stories - epics even - doing a beautiful, cruel, unforgiving _small, and slow-paced_ story takes some balls.

I wasn't entirely on board with how the universe had been treated, but even then, I liked it.

<comment><USER7> I have to agree and I think it's one of the areas that cyberpunk stories can really excel in. Telling a small story in a big world helps contextualize and ground the setting.

</comment></comment></comment></comment></comment><comment><USER8> Just want to say that Michael Benson's Space Odyssey[0], the oral history of making the movie, was the best book I've read this year. Kubrick somehow, through a lot of luck, determination, and frankly a hefty dose of delusional thinking, managed to gather the best minds of a generation to work on what basically amounted to a crazy art project. The book does a good job of impressing that for a lot of people involved it became the apex of their professional and personal lives. In the end, they made something that truly mattered and changed culture. I left the book wishing I got to experience something as intense as that. Most of what we do doesn't matter.

[0] [https://www.simonandschuster.com/books/Space- Odyssey/Michael...](https://www.simonandschuster.com/books/Space- Odyssey/Michael-Benson/9781501163937)

<comment><USER9> "Most of what we do doesn't matter"

One of the pernicious aspects of our culture of celebrity worship is that it leads to the feeling that if something won't be recorded in a book, or on TV, or in a movie, that it doesn't matter.

This is wrong, the instance to instance living of our lives matters, it all matters.

I've seen Space Odyssey a few times, its a cool movie.

How I treat the people I come in contact with today, will matter as much to their lives as how they spent 3 hours several years ago.

It all matters.

<comment><USER10> How I was treated by most of the people I have come in contact with over the past three months of my life will be forgotten over the course of the next three months.

I will never forget 2001: A Space Odyssey. And this is true for millions of people.

It doesn't have to have anything to do with celebrities or entertainment, but it's very hard and very remarkable to have a profound impact on large numbers of people. And it's exceedingly rare to do this unintentionally.

<comment><USER9> But it will have changed the quality of how you lived these 3 months,

The remembering isn't the important part, the living itself is the important part

<comment><USER10> If I die at age 72, the quality of any three particular months of my life represent less than a percent of my overall quality of life. An experience that I remember or that changes my life, or an invention that I use on a regular basis, changes my life _continuously_ from that moment forward.

</comment></comment></comment></comment></comment><comment><USER11> > In his films, Kubrick exists as a kind of deep state, while his fans are > conspiracy theorists.

I love Kubrick, but does anyone else grow a little tired of the legacy management around him? With each generation of film fan, he's become the go- to-guy to project this archetype of the cinematic Godhead onto. Meanwhile, scores of equally detail-focused and enigmatic auteurs of his era slip through the cracks (eg, Visconti, Antonioni, Bresson, De Palma, to name a few).

Kubrick's unparalleled achievement will always be becoming a film-artist on studio dime (he established himself just before New Hollywood took off - <USER2> had cultivated enough of a mystique to carry-on after it crashed in the early-80s). But plenty of his contemporaries exercised the same degree of control that this article talks about, yet they're consistently overlooked because Kubrick became this meme of the cinematic Übermensch.

<comment><USER12> But that's always how it works. A Kubrick, a Gates, a Bezos is one percent their efforts and virtues (without which there'd be nothing) and 99 percent being in the right place at the right time. Malcolm Gladwell (another example of this!) is glib but has talked about that in relation to the Silicon Valley titans: they were born at a historical moment, and were part of a small cohort (you mention four directors who didn't become 'Kubrick', not 4000) and among that cohort, their talent and effort lined up with good fortune.

You can say luck so long as you understand that ONLY luck won't get you this result. But among those with talent and determination, it's really fairly arbitrary who becomes the titans of art, industry, finance. You get good enough to meet the bar, and then it's up to Fate.

This is normal. It's more about what celebrity/stardom/ultimate merit IS, rather than what Kubrick is. It's a lot like internet virality. The pool of possibles is not large, but moderate: from that point onward it's luck and self-reinforcing prophecy. And again, you can't make a nothing into this sort of total winner because they must meet the bar first, they've got to earn their spot in the pool, but anyone in the pool would do as well.

<comment><USER13> Kevin Kelly has an interesting take on this in _What Technology Wants_ [1]. Essentially - that these sort of works were inevitable. If Kubrick, Gates, or Bezos hadn't made 2001, MS, or AMZ - someone else would have. Not _exactly_ the same thing of course, but something so similar as to fill the same spot in history. 2001 happened because 1968 was, in a sense, "ripe" for it. The book undoubtably explains it better. :-)

(Weird. This is the second book recommendation I've made on HN today... I swear I'm not a bot!)

1\. [https://www.amazon.com/What-Technology-Wants-Kevin- Kelly/dp/...](https://www.amazon.com/What-Technology-Wants-Kevin- Kelly/dp/0143120174)

<comment><USER14> I think yours is the sophisticated view of progress rather than the naive "great man" theory. I subscribed to the "great man" theory that the great man pushed society's progress. Now I think that it is society's progress that creates the great man.

We are taught to think that there was something special or even superhuman about newton, turing, etc. But the reality is that they were one of many highly intelligent people working on the same problems created by society's progress. Even if they didn't succeed or achieve, someone else would have. But humans have an innate myth making imperative and a desire to hero worship so we create heros. But reality and history is far more complicated than the idealized myths we create. Without newton, we'd still have calculus ( leibniz, et al ). Without turing, we'd still have computer science ( Church, et al ).

</comment></comment></comment></comment><comment><USER15> Having re-watched 2010 a couple days back, I'm again impressed by someone even attempting to make a sequel to 2001. It required a serious amount of courage (and a lot of arrogance).

2010 is not a bad movie, the same way its original material is not a bad book (unlike 2061 and 3001), but it's also no 2001 and doesn't come even close. The best scenes are exactly the Bowman appearance aboard the Discovery, which kind of follow from the hotel room scene from 2001 with long silences and a Bowman that's no longer human, but still remembers what human is.

Gone, unfortunately, are the distinctive flat square screens, the careful walks in zero gravity on top of velcro strips. Hyams and the actors certainly forgot the Discovery lacked artificial gravity in everything but the carousel (and propulsion would be a lot easier if we knew how to do artificial gravity everywhere). Quite frankly, the lack of attention to detail is a big turn off for me.

I'll certainly schedule a trip do London to visit it.

<comment><USER16> > "The essence of a dramatic form is to let an idea come over people without > it being plainly stated," he said. "When you say something directly, it is > simply not as potent as it is when you allow people to discover it for > themselves."

I watched 2001 with some friends on 1 January 2001. Unfortunately I picked the wrong group of friends, people who couldn't settle back into to the slow pace and no appreciation of mystery - they were constantly asking me to explain everything. Later that day I watched 2010 (by myself). That movie never raises a question that it doesn't answer within about 10 minutes.

<comment><USER17> Especially with editing styles in general being much more frenetic than they once were, 2001 is tough for a modern audience. And, if don't basically know the background plot, it's pretty inscrutable as it was at the time.

Don't get me wrong. It's on my best movies list. But it's going to be a bit tough for a first time, non movie buff audience today.

<comment><USER18> Popular audiences were just as baffled by 2001 when it was released as today.

Arthur C Clarke had written a narration explaining everything and was dismayed to discover, at the premiere, that Kubrick had opted to drop the narration entirely. Thank God Kubrick was calling the shots and not Clarke.

</comment></comment></comment></comment><comment><AUTHOR> Kubrick was also a fairly skilled photographer and contributor to "Look" \- a widely popular pictorial magazine that had a peak circulation of over 7 million copies. The Museum of the City of New York is hosting an exhibit of his photographic work entitled "Through a Different Lens". Unfortunately the exhibit ends January 6, 2019. There's also an accompanying book for sale.

[https://www.mcny.org/exhibition/through-different- lens](https://www.mcny.org/exhibition/through-different-lens)

[https://shop.mcny.org/products/through-a-different-lens- stan...](https://shop.mcny.org/products/through-a-different-lens-stanley- kubrick-photographs)

</comment><comment><USER19> An interesting case study that's recently had me revising my views on Kubrick's obsessiveness is one of his less-appreciated films, _Barry Lyndon_.

To reproduce the not-yet-electrified world of its 18th-century setting, Kubrick famously spent huge amounts of time on that project finding ways to shoot scenes using only natural light (see [https://en.wikipedia.org/wiki/Barry_Lyndon#Cinematography](https://en.wikipedia.org/wiki/Barry_Lyndon#Cinematography)). This went so far as shooting interior scenes set at night using only _candlelight_ , since that's how they would have been lit in real life. Cameras aren't really designed to work well with such low and inconsistent lighting, so he had to go to great lengths to get usable footage.

Ever since its release, the standard take on _Barry Lyndon_ has been that the results didn't justify all that effort. The unusually low lighting made scenes seem willfully obscure, like Kubrick was capriciously forcing the viewer to work extra hard just to keep up. This (along with a sadly weak performance by Ryan O'Neal in the critical role of the eponymous Barry) is a big part of why _Barry Lyndon_ has languished for decades in the "lesser Kubrick" bargain bin.

But a recent remastering has produced a 4K version of _Barry Lyndon_ , and I was surprised to discover when watching that version on a large TV that suddenly the film _popped_ visually in a way it never had before. Where before it had seemed dark and hard to watch, now it felt more like observing a great painting, with lots of subtle detail I'd never noticed before. And then I realized that all those years of bad feelings about _Barry Lyndon_ had come from watching it in low resolution on small screens, while Kubrick had been shooting for the big, bright cinema screen. I'd literally been watching the movie wrong all that time.

So it turns out Kubrick's obsessiveness in this case really did pay off. Those of us who'd only ever seen it on home video -- which is to say, most people -- just had to wait for the quality of the home viewing experience to catch up to his standards in order to see it.

<comment><USER20> I would agree that his films very much suit themselves to the silver screen, and watching them, e.g. on a laptop or computer-monitor sized screen is certainly not going to do it justice.

I was fortunate enough to catch many of his films during the Toronto International Film Festival during an exhibit. 'Eyes Wide Shut' was particularly fantastic.

</comment></comment><comment><USER21> If you're in Barcelona and even slightly intrigued by Kubrick's work I strongly suggest you spend an afternoon at the CCCB exhibition, the 6 euros are worth it: plenty of props, costumes, camera gear, some interesting documents as well.

<comment><USER22> Thanks, I'll definitely visit that exhibition next time I visit Barcelona :)

</comment></comment><comment><USER23> One of my favorite bars in Mexico City was this place that was sort of, Stanely Krubic themed. It was a weird but cool place.

They had a replica of the room from the final scene of 2001 Space Odyssey, in the back of the bar. You would go in there, lie on the bed. You could smoke a cigarette and enjoy your cocktail. It was so awesome.

<comment><USER24> Where, what was it called?

</comment></comment><comment><USER25> All about the fonts in 2001: [https://typesetinthefuture.com/2014/01/31/2001-a-space- odyss...](https://typesetinthefuture.com/2014/01/31/2001-a-space-odyssey/)

</comment><comment><USER26> I recommend anyone interested in Kubrick as a person check out the documentary Filmworker on Netflix, about his personal assistant Leon Vitali. (Warning that if you have a very black-and-white hero worship of Stanley, the film might disabuse some of your notions.)

Ian Watson, who was one of the writers who worked on AI, also wrote a bemused article about his experience working with Stanley:

[https://www.ianwatson.info/plumbing-stanley- kubrick/](https://www.ianwatson.info/plumbing-stanley-kubrick/)

</comment><comment><USER27> Stanley Kubrick movies reveal some new aspects each time I watch it.

<comment><USER28> All of the movies by him that I've watched are brilliant.

Dr Strangelove is my favourite movie. The Shining is excellent, A clockwork orange, Barry Lyndon, 2001, Eyes Wide Shut ...

He was also a fantastic photographer.

<comment><USER27> +1 for Dr. Strangelove. Amazing movie. Way ahead of its time.

<comment><USER29> If you enjoyed _Dr Strangelove_ , check out _Seven Days in May_. It's kind of like a serious version of the former, and was made right around the same time. I wouldn't call it a masterpiece, but it's still a good, and undeservedly overlooked film.

<comment><USER10> _Fail Safe_ is the serious version of _Dr Strangelove_ ; _Seven Days in May_ is a fictionalized account of the Business Plot.

</comment></comment></comment></comment></comment><comment><USER30> For those in the UK:

London Design Museum 26 April - 17 Sep 2019

General tickets on sale 1st Jan. Adults £16, Concessions £12 [1].

Such a shame to see yet another exhibition confined to central London. It's absurd that I can fly to Barcelona quicker, and for less money, than it takes me to have a day trip via train to London!

[1] [https://designmuseum.org/exhibitions/future- exhibitions/stan...](https://designmuseum.org/exhibitions/future- exhibitions/stanley-kubrick-the-exhibition)

<comment><USER31> I mean, depends where you are in the UK. I can train from London to Leeds for ~£25 if I book sufficiently in advance. On the day it's £120. (I hate this model of train fares with a passion, but it feels overstated to suggest that Barcelona is both cheaper and quicker when neither is true for me)

</comment></comment><comment><USER32> After watching 2001, I was completely underwhelmed. I felt like the kid in The emperor's new clothes that yells "Mommy, the emperor is naked". I later watched a 1 minute LEGO parody of the movie [https://m.youtube.com/watch?v=Sz4aQ2YbN-E](https://m.youtube.com/watch?v=Sz4aQ2YbN-E) and thought it covered all the basic themes of the movie in a minute instead of taking 2.5 hours.

</comment><comment><USER33> I liked the Rob Ager video 'the meaning of the monolith revealed', along with 'Kubrick's cover story'. Although these are paywalled video essays.

The $5 version is that the monolith is the movie screen, and that the movie and actors are becoming self aware that they are in a movie. The hints are all in the details, regarding camera angles, lighting, camera positions, and all the arrows telling people to tilt their view.

What really sells it is the documentary/advertisement on how Kubrick is raising money to make the film, and all the industry people he is tapping and getting money from. People really thought it was going to be a hard core 'done right sci-fi' movie, but if you look closer you can see how much of it is stilted, and done incorrectly even though they obviously could have done better.

TL;DR Kubrick played the 'space race propaganda' hysteria of the mid 1960's to finance and make his art house film about actors being aware of how they are making a movie.

</comment><comment><USER34> Paywalled.

<comment><USER35> [https://archive.fo/XpUA4](https://archive.fo/XpUA4)

</comment></comment><comment><USER36> I wonder if we'll ever see a sci fi movie as deep as 2001 again...

<comment><USER37> Maybe I should try the book. I like me some good sci-fi (the Hyperion series is probably my favorite read-wise). I've never gotten through the 2001 movie. Several goes at it. I literally pass out asleep. Maybe I need to try a morning viewing. I think of movies as entertainment. Trying to watch this one has become a chore.

<comment><USER38> This will annoy a lot of people, but: turn on the subtitles and turn up the speed. Large sections of it can be zoomed through at 4x or 8x speed, returning to normal once people are talking.

Large ares of it are basically "wow factor" shots which looked really impressive in 1968 and lack a lot of that to present-day viewers. Sometimes it feels more like an agonisingly slow pan across the concept art.

<comment><USER39> For the last part of the movie, sure, speed through.

In the early part, the slow pace of the journey into space heightens the sense of isolation. It's something a modern movie couldn't get away with, and is a unique part of 2001 that you should really experience.

<comment><USER40> I'm in my late-30s but I think I'm simply to young to appreciate the impact of the space imagery in '2001' because I grew up post-Voyager and came of age in the post-Hubble world. I'm a huge fan of Kubrick and I'm highly tolerant of slow pacing but '2001' just never really grabbed me.

<comment><USER41> I was enraged at Gravity's rendering of space, which at the opposite extreme of 2001's: a crowded backyard playground, with plenty of traffic and people wandering around and having a great time.

I believe space is black, silent, and immobile- though this might be just the lasting imprinting of 2001. I doubt you'd see anything resembling Hubble images up there.

<comment><USER42> To be fair to Gravity, low Earth orbit isn't exactly a great comparison to the interplanetary travel taking place in 2001.

<comment><USER41> Is it actually any different, if you don't look in the direction of Earth?</comment></comment></comment></comment></comment></comment></comment></comment>


Ask HN:  Computer science has a hidden agenda to kill religion? - <AUTHOR>

The invention of the internet and related technologies has had a devastating impact on religion.
One must wonder whether computer scientists at some point realized that this would be the outcome and actively worked to bring it about faster via their research.
Do you think this is the case? <comment><USER2> _The invention of the internet and related technologies has had a devastating impact on religion._

Really? The internet is a communication tool and as much as it enables atheists to communicate and be vocal, it is enabling religious people to do the same.

<comment><AUTHOR> It's pretty clear that one side is winning convincingly though.

<comment><USER3> This viewpoint is necessarily skewed by the communities one joins. If you spend time in atheism-focused or atheist-populated communities, it's only natural you would think atheism is the dominant viewpoint on the web. The converse is also true.

In any event, your proposition (that the internet was invented to kill religion) brazenly violates Occam's razor and, without a smoking gun, is very difficult to believe.

<comment><USER2> Yes and yes!

I have some very religious family members and friends and sometimes when I talk with them, you would think the internet = Jesus and nothing else (perhaps Facebook too). When I talk with other friends and the communities I frequent, it's atheism or you're a psycho.

</comment></comment></comment></comment><comment><USER4> I'm having a very hard time swallowing the pill that computer scientists, of all the things the technology can accomplish, would spend their time actively making it better just to piss of deists.

</comment><comment><USER5> Your question erroneously assumes a unity of purpose among computer scientists. Some may oppose religion and work to undermine it; others may not, or may not consider the effect as devastating as you suggest it is.

The internet seems to me to weaken religious institutions, but also to increase religiosity.

</comment><comment><USER6> Circa 1500, the debate in educated circles was whether the printing press had a hidden agenda to harm Catholicism. It did and it was glorious.

<comment><USER7> The most printed book in history is the bible... mind you, it's also the best weapon against religion, if you can just get people to read it.

</comment></comment><comment><USER7> You say that 'one _must_ wonder'... why? Why does this one particular field of knowledge need a hidden agenda to behave exactly as all other fields of knowledge, ie, incremental progress?

</comment><comment><USER8> Information is dangerous to institutions that rely on inflexible dogmas. Adapt or perish.</comment>


False CNN-porn report shows how fast fake news spreads - <AUTHOR> http://www.usatoday.com/story/tech/2016/11/25/false-cnn-porn-report-shows-how-fast-fake-news-spreads/94441324/ <comment><USER2> It is, more than anything, an advice to CNN e MSM that enough is enough. Nobody respects them more than what they give us.</comment>