SpiderOakONE – Zero Knowledge Cloud Storage - <AUTHOR> https://spideroak.com/solutions/spideroak-one <comment><USER2> Spider Oak - Please stop describing your service as "Zero Knowledge" unless and until you deploy a service that is actually is. E2E encryption great, but it is not the same thing.

<comment><USER3> SpiderOak founder here...

A few cryptographers have noticed SpiderOak's marketing term Zero Knowledge is inconsistent with the academic definition. Maybe it doesn't mean what we think it means[1]? SpiderOak was one of the first companies to use this phrase commercially and the need has only grown stronger.

At the heart of the issue is the difficulty for end users to decipher the terms cloud vendors use to describe their security. Doing so would require discrimination between transport encryption, data encryption, meta data encryption, encryption at rest vs. in motion, and then most importantly evaluate key management and access. This vocabulary is foreign to most folks. Vendors often exploit the inaccessibility of these topics to make a series of statements that, while often factually correct individually, together create a false sense of privacy.

SpiderOak launched a online backup product for Linux, Mac, and Windows in 2007. The competitors were companies like Xdrive, Mozy, Carbonite and SugarSync. Each claimed that customer data was fully encrypted. Even the most credible journalists writing for well funded publications with fact checking budgets were fooled and repeated these misleading claims to end users. [2]

In 2009 when Dropbox launched, they made misleading claims about the encryption of customer files and their internal ability to access customer's data or provide that data to 3rd parties, leading to a well publicized FTC deceptive trade practices complaint. [3] The deception had been so effective that leading software engineers were shocked to discover Dropbox had full access to the data they had stored online. [4]

In response to customer requests on one of their forums, Mozy explained why it would be "impossible" for a storage service to protect users' privacy by encrypting the file and folder names customers store in a way Mozy could not read. SpiderOak customers had benefited from the impossible for years.

Recently Slack made the unbelievable claim on Twitter that their service includes end to end encryption (it doesn't.) Perhaps they mean from your end to their end?

Lately there's a new phrase "customer managed keys" used by cloud providers, which sounds really great, but is typically just elaborate hand waving that ultimately allows the vendor and their staff the same level of data access as if it were not encrypted.

In 2007 we found ourselves frequently explaining "we don't know the names of your files, the names of your folders, the date they were created or last modified or accessed, their size, their checksums or hashes... in short we know nothing about your data except how much you store." We started using the phrase Zero Knowledge as a headline to this long explanation.

It's important to recognize that cryptographers already understand encryption and the terminology is intended for everyday folks. When I'm speaking with a technologist about how SpiderOak products work, I would typically use the phrase end to end encryption.

If we want to end mass surveillance, the only way this can happen is through viral adoption of end to end encrypted products and services. Great UX, education, and terminology are powerful tools, and unlike phrases involving the word "encryption", to my knowledge no company has yet been shameless enough to deceptively use the term Zero Knowledge.

[1] [https://www.youtube.com/watch?v=G2y8Sx4B2Sk](https://www.youtube.com/watch?v=G2y8Sx4B2Sk)

[2] [http://allthingsd.com/20080403/sugarsync-offers-the-best- met...](http://allthingsd.com/20080403/sugarsync-offers-the-best-method-yet- for-replicating-files/)

[3] [https://www.wired.com/2011/05/dropbox- ftc/](https://www.wired.com/2011/05/dropbox-ftc/)

[4] [http://tirania.org/blog/archive/2011/Apr-19.html](http://tirania.org/blog/archive/2011/Apr-19.html)

<comment> Ar-Curunir The issue is not you vs. other companies; it's you vs 25+ years of cryptographic literature.

> no company has yet been shameless enough to deceptively use the term Zero > Knowledge.

Except you guys? Why use the phrase "zero knowledge" when you fully know that it has a predefined meaning? Call it no information, no leakage, zero leakage, whatever, but why the one term that is already used to refer to a different concept?

I get that it's a sexy name, but that's why cryptographers use it to refer to a much cooler concept than mere encryption.

<comment><USER3> Thanks for the feedback. For what it's worth, we did try a bunch of alternative wordings, and Zero Knowledge was the phrase that non technologists found most accessible.

We prioritized making the explanation clear to non-experts vs. to the community of cryptographers.

<comment><USER4> I'd like to propose "Zero Access", as in zero access to the plaintext.

<comment><USER5> That's actually not bad. I was fine with SpiderOak going for a term that is simple, catchy, and easy to market. Zero Access is the kind of alternative that might work. That specific one might have a problem: send perception of user having zero access to their own data when most clouds constantly reinforce "access from anywhere any time."

You're thinking along the right lines. I think variations of the words safe and vault have worked for other companies, too, given people understand what they do. "Your data is in a locked vault that we hold for you while you keep the keys or combination." That sort of thing.

</comment></comment></comment></comment></comment></comment><comment><USER6> In addition to not being (fully) open source, something that also should be mentioned is, that if u use the mobile apps it unfortunately still isn't "zero knowledge" [0].

[0] [https://spideroak.com/manual/spideroak-on- mobile](https://spideroak.com/manual/spideroak-on-mobile)

<comment><USER7> _Until recently, mobile platforms were not capable of doing the on-device encryption necessary for SpiderOak 's Zero Knowledge implementation._

Anyone any idea what the issue is or was? What would prevents you from doing PBKDF2, RSA and AES [1] on a mobile device?

[1] [https://spideroak.com/manual/zero-knowledge- explained](https://spideroak.com/manual/zero-knowledge-explained)

<comment><USER3> It's mostly that the desktop app is Python and C, and there wasn't a clear path to make that same code base run on mobile, so the mobile app is just a reader.

However for Semaphor, our encrypted group chat and file sharing tool (akin to IRC, to Slack or HipChat) the internals are written in Go and it's the same code base on all platforms, including mobile. That source code is also published for security review. We plan to migrate SpiderOakONE to use that same stack so the mobile experience is the same as desktop.

</comment></comment></comment><comment><USER8> They've been around for a while and are highly regarded.

The one thing that makes their privacy weak is: The software involved in the encryption/password handling is not open source. We have only their word for it that they are not snooping or letting anyone else snoop.

If you're willing to do the extra work, you can get a cloud service like Dream Objects, and use software like duply/duplicity to store your files online and encrypted. You may lose some flexibility, though.

<comment><USER9> I tried spider oak a while ago, and I thought it was horrible in terms of ui, performance and bloat. I'm assuming they didn't change their stack/devs, so I will not even try this one.

<comment><USER10> I find that surprsing.

I've been using SpiderOak for years without noticing any bloat or performance issues with the background service. On the contrary, I was often surprised how little space I'm using in spite of the fact that they store multiple versions of my files. It doesn't hog memory or bandwidth or CPU at all.

The UI is indeed a bit weird and its performance can be erratic sometimes, but it gets the job done and has a lot of useful features.

Most importantly, SpiderOak has reliably protected me from losing data and I don't have to babysit it. It just works.

(I'm a happy paying customer. No affiliation with them whatsoever)

<comment><USER4> I used to be a paying customer (years ago, things may be better now), and I had many issues with CPU getting stuck at 100% for long stretches of time, or uploads/downloads would transfer a bunch of data, or would be slow, things like that.

Then, one day, my account got full, and I couldn't delete anything unless I got some more free space first (see the problem?). I believe support gave me a few extra GB just for the deletion, but that didn't work either and I decided to stop using the whole thing. That's when I switched to attic/borg, which is much superior for my use case (backups).

</comment></comment></comment></comment><comment><USER11> Whenever SpiderOak comes up I can't help but share my experience with them.

In February SpiderOak dropped its pricing to $12/month for 1TB of data. Having several hundred gigabytes of photos to backup I took advantage and bought a year long subscription ($129). I had access to a symmetric gigabit fibre connection so I connected, set up the SpiderOak client and started uploading.

However I noticed something odd. According to my Mac's activity monitor, SpiderOak was only uploading in short bursts [0] of ~2MB/s. I did some test uploads to other services (Google Drive, Amazon) to verify that things were fine with my connection (they were) and then contacted support (Feb 10).

What followed was nearly __6 months__ of "support", first claiming that it might be a server side issue and moving me "to a new host" (Feb 17) then when that didn't resolve my issue, they ignored me for a couple of months then handed me over to an engineer (Apr 28) who told me: "we may have your uploads running at the maximum speed we can offer you at the moment. Additional changes to storage network configuration will not improve the situation much. There is an overhead limitation when the client encrypts, deduplicates, and compresses the files you are uploading"

At this point I ran a basic test (cat /dev/urandom | gzip -c | openssl enc -aes-256-cbc -pass pass:spideroak | pv | shasum -a 256 > /dev/zero) that showed my laptop was easily capable of hashing and encrypting the data much faster than SpiderOak was handling it (Apr 30) after which I was simply ignored for a full month until I opened another ticket asking for a refund (Jul 9).

I really love the idea of secure, private storage but SpiderOak's client is barely functional and their customer support is rather bad.

<comment><USER12> I have been using SpiderOak (SO) for nearly 6 years. However, I have been keeping an eye out for a viable alternative as I feel SO is starting to be neglected. In the past year or so, SO has barely received any updates (apart from the occasional minor bug fix). Semaphore seems to be taking up all their dev time. This would not be such an issue if everything ran well.

SO has no UI means to control version history. In order to limit version history (for example, to hourly versions per day, then 1 per day for a month, then 1 per week indefinitely), I need to run a script to close SO and run SO with some command line arguments. Having this functionality available in the UI would be nice.

The SO UI is slow to use. Over 6 years I have accumulated a lot of files and whenever I goto the manage tab to browse my files, it can take several seconds each time I expand tree nodes. The UI also becomes unresponsive, making browsing files take a while.

Manually deleting files/folders/version history is an absolute pain. Often, when deleting a folder in SO, only some of the contents are deleted, taking multiple attempts to delete. In some cases the contents of the folder disappear, but it shows root locations of drives as contents of the folder. When deleting anything, the UI becomes unresponsive for upwards of 30s, often significantly more for large folders or many version histories. Even selecting multiple files can take several seconds where the UI is unresponsive, the more files you select, the longer it becomes unresponsive. This makes file management take forever.

If I move a file temporarily, SO assumes it has been deleted and moves it to the 'Deleted items' folder. However, when I move the file back, SO create a new version of that file, leaving all version history in the deleted folder. It does not recognise the files are the same. This means that if a file is created and deleted numerous times (compiling pdf, or binary), hundreds of files with the same name are added to the 'Deleted items' folder. SO should be able to recognise the files are linked (perhaps checking the similarity of the files, only rejecting a link if they are more than 75% different) and create version histories instead of new files.

There is also no way to delete items in the 'Deleted items' folder after a period of time (2 years for example). The only way to delete items is to manually do it or clear everything, which I don't want to do as there are version histories that should be linked to currently existing files in the 'Deleted items' folder. I have had to resort to once a year putting a movie on and just manually going through folders for a few hours.

I really like the idea of SpiderOak, but it really is a poor implementation and just an all round pain to use. In the past I havn't minded waiting for new features and fixes, but its been 1.5 years since the new UI and nothing much has changed.

EDIT: And just to prove my point, I just tried to deleted a folder in the 'Deleted items' folder. The first attempt deleted everything within the folder, but a 'c:/' item appeared inside it. So I deleted the folder again. Half the contents of the folder a level above it just disappeared. This has happened before.

I think I give up.

<comment><USER13> The thing is that there's nothing actually special about SpiderOak as a service. Since the data is encrypted end to end, the only special thing is the client and as you've pointed out, there's is terrible.

On that note, once I gave up on SpiderOak I went looking for alternatives and they actually exist:

\- Syncany: [https://www.syncany.org/](https://www.syncany.org/) \- Java based, works on Windows and *NIX, uses S3, Dropbox, Flickr, FTP, Openstack Swift, SFTP and WebDAV as backends.

\- Rclone: [http://rclone.org](http://rclone.org) \- Go based, works on everything Go supports, uses Google Drive, S3, Swift, Dropbox, Google Cloud Storage, Amazon Drive, OneDrive, hubiC, Backblaze B2 and Yandex.Disk.

Syncany at least supports limited file versioning but not as granular as you seem to be after. The upside is that unlike SpiderOak, Syncany is open source and you can contribute features you want. If you're only after backup, there's also Borg which might work for you: [https://borgbackup.readthedocs.io/en/stable/](https://borgbackup.readthedocs.io/en/stable/).

<comment><USER12> I looked at Syncany, but it looks like the project is dead:

> The core team of Syncany is on hiatus for an indefinite amount of time. Feel > free to do with the code what the license allows and encourages, but please > don't expect any maintenance. The team thanks everyone who has contributed > to Syncany in one way or another.

rclone doesn't really have the features i'm looking for.

I have however found Duplicati: [http://www.duplicati.com](http://www.duplicati.com), which looks like it might serve my needs.

</comment></comment></comment></comment><comment><USER14> @rarrrrrr - Do you have a more precise timeline of when the SpiderOak Notes App will be launched in 2017? Would love to try it out as I'm getting tired of various issues w/ Evernote and haven't been able to find a good alternative yet.

<comment><USER3> Thanks for asking! I'm really excited about a ZK note app!

We haven't yet determined the priority of this vs. other projects in 2017. If you haven't already, please signal your interest below[1].

So far it is a prototype, although it is based on the already proven code used in Semaphor[2], our encrypted group chat and file sharing application, so it's "just" a bunch of UI work now :-)

[1] [https://spideroak.com/about/noteapp- signup](https://spideroak.com/about/noteapp-signup) [2] [https://spideroak.com/solutions/semaphor/business/tour](https://spideroak.com/solutions/semaphor/business/tour)

<comment><USER15> At this moment I'm a paying user of both Evernote and Dropbox and I do not like how they are focusing on extra bells&whistles instead of investing time in their encryption methods to make my data more safe.

From a business perspective you can get the money that I give to Evernote and Dropbox if Spideroak offers competing products. And for me the advantage is that my data is more secure because of the zero knowledge(1) idea and I do not need to worry about wild ideas from companies think about employees reading my notes "to make my experience better". Yes I'm looking at you Evernote.

(1) until 10 minutes ago I did not know that zero knowledge had a specific technical meaning that is different than what Spideroak implements. And I even have Bruce Schneiers Applied Cryptography on my bookself. I'll need to read that again. Maybe it should be called "Full stack encryption" because it covers everything from data transport, to storage, to metadata encryption, etc...

</comment></comment></comment><comment><USER16> I've liked SpiderOak's focus on privacy and security, but find the pricing to be expensive at every tier, and the space available not in tune for my needs (a jump from 100GB to 250GB, which is kinda ok, and then to a whopping 1TB).

<comment><USER3> Thanks for your feedback.

Just as a data point for comparison, Dropbox charges $100/year for 1000 GB, but they don't do meaningful encryption, and therefore can de-duplicate your files vs. the files of all their other customers, which significantly reduces their storage costs (and allows for some entertaining information leakages!)

SpiderOak charges $120/year for 1000 GB.

Edit to add: SpiderOak deduplicates files within a single user's account (i.e. copies are free, and if you add another layer to a photoshop file and re-save, it won't take up the full space to archive both versions) but it is not possible [1] for us to deduplicate data across multiple users.

[1] [https://spideroak.com/articles/why-spideroak-doesnt- deduplic...](https://spideroak.com/articles/why-spideroak-doesnt-deduplicate- data-across-users-and-why-it-should-worry-you-if-we-did)

<comment><USER17> How do you "dedupe within a single user's account" without violating "zero knowledge"?

<comment><USER3> Great question. The database work is all done client side.

Here's an explanation of the architecture I wrote in 2009: [https://spideroak.com/articles/why--how-spideroak- architectu...](https://spideroak.com/articles/why--how-spideroak-architecture- is-different-than-other-online-storage-services)

</comment></comment></comment></comment><comment><USER18> Just wanted to drop a note here… I've been a long time user of SpiderOak and am really satisfied with it. A much better alternative to Dropbox and alikes.

</comment><comment><USER19> @rarrrrrr How many devices does this support. Can I add three devices in the same plan?

Can I sign up for 100GB first and then later upgrade to a higher plan seamlessly?

</comment><comment><USER20> I really want to use this, but the mobile app (Android) really lacks very basic functionality - uploading files.

I recently stopped renewing my Dropbox on an annual license and will switch once I find a good alternative..

<comment><USER21> The thing that keeps me on dropbox is the price. I can't find a provider of raw storage that charges less.

</comment></comment><comment><USER22> I have used them for some years and have 2 main issue:

Their servers are slow compared to other cloud providers.

You can't upload files using their ios or Android clients, they are read only.

</comment><comment><USER23> I don't have a ton of data in Dropbox but it's large and growing.

Any word if they're going to hook up a "import from Box/Dropbox" feature here?

<comment><USER3> SpiderOak can backup and sync arbitrary folders (including external drives, network volumes, etc.) So one migration path is just to select the Dropbox folder for backup by SpiderOak. (Or just move data from Dropbox folder to the SpiderOak Hive folder.)

</comment></comment><comment><USER24> Is this a new service they have launched? I mean what's bringing this on front page? I read the link but couldn't figure out.

</comment><comment><USER25> Years ago I attempted to use this but the linux client was unusable and buggy on Ubuntu LTS.

</comment><comment><USER26> does anybody know if www.sync.com is any better regarding their mobile apps ? They do also client-site,end-to-end encryption but their white paper only mentions their web-app which apparently does everything on the client.

<comment><USER27> You should also check out Tresor End to End Encryption [1] [https://tresorit.com/](https://tresorit.com/)

<comment><USER28> Disclaimer: This is a promotional post with an intention to pass on Reseller Discounts so that we have more individuals who can subscribe to secured cloud storage

As part of ensuring that our business clients have access to secured cloud storage services, we have initiated enlisting with Tresorit as Resellers and will be passing on discounts* to our clients. Interested individuals can procure the service at a discounted rate subject to the total number of individuals registering and converting as a paid users is 250 or above

Please leave your email id and we will contact you if we area able to enlist the required number of individuals

[https://goo.gl/forms/P7oEvaE5aTnLsFLn1](https://goo.gl/forms/P7oEvaE5aTnLsFLn1)

</comment></comment></comment><comment><USER29> Is there a full pricing overview available?

<comment><USER6> 2nd row on [https://spideroak.com/about/price- list](https://spideroak.com/about/price-list)

SPIDER OAK ONE PRICES

100GB - $5 monthly ($59/y)

250GB - $9 monthly ($99/y)

1TB - $12 monthly ($129/y)

<comment><USER29> Cheers.</comment></comment></comment>


Ask HN: why do you run this Linux distribution? - old-gregg

Howdy fellow Linux fans.
I'll be brief: what is the point of linux distros other than Debian-derived ones, Arch and Gentoo? Those 3 all have very distinct characteristics are are very different from each other, so...
I have a computer I can play with and I was thinking about tinkering with a new Linux distro just for fun. I've used Ubuntu, Gentoo and Arch in the past (settled on Arch and love it), so why would I want to try out SUSE, Fedora or Mandriva? Their descriptions on distrowatch are quite vague. <comment><AUTHOR> Just a thought. You might want to consider one of the BSD variants, just to explore a somewhat different system architecture.

For everyday use, I find Ubuntu good enough, although I do wish they'd break fewer things every six months. I suspect I'll eventually migrate my Arch usage from "tinkering" to everyday usage.

Another thought: Tiny Core Linux - a minimalist distribution that runs out of RAM. The ISO image is only 10 MB, and the design is based on only loading those applications you need when you're using them. There are tons of applications already packaged online, so many people find it sufficient as their everyday OS. Personally, I put it in the tinkering category like Arch because the design is based on a specific design attitude that's different from the mainline distributions.

</comment><comment><USER2> Fedora, unlike Ubuntu, has zero proprietary software in its repositories. It, however, has firmware included with it which is why it's not on the FSF's list of approved distros.

I have not tried SUSE or Mandriva, but both have different features other distros don't.

I like Trisquel, as it's 100% free-as-in-freedom and it looks really cool. :)

<comment><USER3> The reason you shouldn't really compare Fedora and Ubuntu, is that Ubuntu is a commercial distribution, while Fedora is not. If you want to compare, compare Ubuntu with RHLES or Fedora with Debian.

Like Fedora, Debian has no proprietary software in it (yes, there is non-free, but that one is not part of the distribution).

<comment><USER4> Ubuntu is no more commercial than Fedora.

1\. You don't pay money for it. 2\. The company behind it uses it to make money.

In Fedora's case, it's kind of a public beta of RHEL. In Ubuntu's case, Canonical provides support and professional services, although it's not profitable yet.

Also, Ubuntu comes by default with no non-free software. Although now I think there's an option in the installer to install MP3 and stuff that's restricted by patents. (not sure if it also installs non-free stuff like Flash).

<comment><USER3> Ubuntu comes with proprietary NVidia & ATI drivers, last I checked, along with a bunch of other things in restricted, which is part of the default install.

So yeah, Ubuntu DOES come with non-free software by default, and the restricted repo is part of the default sources.list, to allow you to install even more non-free software easily.

By commercial, I meant they're (trying) to make money off of it, which they certainly do. There's a whole lot of things built around the distribution (Ubuntu One, support, etc) that in my reading, make the distribution commercial, or at least heavily commercially backed (as opposed to being community driven).

</comment></comment></comment></comment><comment><USER5> Well, for one thing, RPM-based distributions are the leaders in the enterprise market. They are also the only ones, I believe, that actually make money. If you look at where the contributions to Linux come from, especially in the kernel, the employees of those distributions are contributing much more than those of the other distributions.

For instance, in 2009, the top Linux contributors were Red Hat (12%), Intel (8%), IBM and Novell (6% each), and Oracle (3%).

IBM offers, I believe, Red Hat and SUSE on its mainframes. Oracle offers their own version of Red Hat. So that's 27% of contributions to the kernel coming from companies focused on RPM-based distributions.

</comment><comment><USER6> As the others say have said. Depending on what your looking for will determine what is right for you.

I use Mandriva. I use it because it feels right for me.

Things I really like about it. 1\. Broke from Red Hat. 2\. KDE. 3\. It has a centralized and useful tool set for managing the system. 4\. It's packaging system is nice. 5\. <http://easyurpmi.zarb.org/> 6\. Power Pack has lots of goodies in it. 7\. etc,....

</comment><comment><USER7> I use Ubuntu on a daily basis, but I've tried Gentoo, Linux from Scratch and FreeBSD on VirtualBox.

In those, I was looking for the experience of building all these layers of software, one on top of the other, like a set of dominoes falling backwards in time. After a few hours, you get a giant, baroque, colorful picture of software tools which built itself, and it's for you to use. I can't think of any other professional discipline which allows you to do so.

</comment><comment><USER8> CentOS is a good choice if you want to run a server for commercial purposes. I use Fedora (its almost the same as centOS) for my development desktop as it mimicks my server setup. I tried Ubuntu for my server and it didn't work out to be that stable. However a couple of my friends in other startups found Ubuntu to be working fine for them on their production servers. Another distro I use a lot is Backtrack ;)

</comment><comment><USER9> It really depends on what you're looking for and looking to do. I personally prefer Ubuntu's LTS releases for day-to-day use, but for the production servers, I prefer stepping out of Linux and into FreeBSD. I've found it to be much more robust, while at the same time not holding you back to ancient software versions (like CentOS/RHEL).

Yet, it really comes down to your preference.

</comment><comment><USER10> Try out <http://gobolinux.org/>

\-- MV

</comment><comment><USER11> Fedora is great.</comment>


Analyzing the $5.6M Exploit and Cryptsy's Security Failings - <AUTHOR> http://earlz.net/view/2016/01/16/0717/analyzing-the-56-million-exploit-and-cryptsys-security <comment><USER2> Well, this is assuming the story given by Cryptsy is accurate; without a proper third-party investigation we should consider it likely that the coins have been stolen by the operators as an exit scam.

A sentence from the middle:

 _They didn 't care about exploits as long as they exited before the coin was worthless. This is a very common trope of the altcoin world._

When given a choice between painstakingly building a secure system, or throwing something together to make a quick buck from other gullible greedy people, it seems that everyone has chosen the latter.

</comment><comment><USER3> Does the very nature of "cold storage" mean they are not monitoring for dramatic drops over SIX months?

I mean they took their damn time emptying that thing out.

It's like robbing a physical bank one wheelbarrow load of cash at a time every day and no-one notices?

<comment><USER4> I think the attackers didn't take anything until 6 months after providing the malicious wallet code. Apparently they were making use of the exploit during that time, probably gathering information on how to get to the important "cold" wallets.

It may have taken them the whole 6 months to figure out how to do that, because I can't imagine them waiting once they had the info they needed; the risk of someone else stealing it first would have been very high. Cryptsy's always been sloppy. They had obvious race conditions in their trade execution, and people regularly complained about stuff like seeing their market orders matching against offers in the middle of the order book instead of the best price. It also used to be easy to end up with a negative balance in one currency (these are unleveraged spot trades mind you, we're not talking options or something). I really have no idea how they made it this long.

</comment></comment><comment><USER5> Lesson for people to never trust any service provider or wallets (hardware or software) other than deterministic wallets that could be fully reconstructed from a phrase.

Use any service or exchanges for trading only and then swipe funds back to your deterministic wallet after which destroy it, keeping the phrase printed on paper in the safety deposit box.

</comment><comment><USER6> Light on details here. Better operational security would have prevented this outcome for a time, but they had malicious developer(s) in their code. Game over.

</comment><comment><USER7> Are all of these *coins written in C? If you had a language not so easily obfuscated you could at least more readily find crap like this.

<comment><USER8> Writing it in Java or whatever other language doesn't help. All programming languages can be obfuscated as fuck if you want it. Java and other OO languages actually encourage the trend to wrap everything in dozens wrappers, singletons, factories and other stuff, where malicious code can be spread over.

<comment><USER9> > Java and other OO languages actually encourage the trend

Java, yes. Other OO - not so much. Java is getting better now, but, for a long time, it was simply a weak language, with primitive type system and lots of necessary boilerplates.

If you look at other implementations of OO, you'll see that the trend of "wrapping everything in dozens of wrappers and other stuff" is definitely not universal among them. Dynamic, reflective languages like Ruby and Python tend to have shallow class hierarchies and few wrappers; especially in Python, heavy use of inheritance and creation of classes for every little bit of data is considered un-pythonic. Then you have Smalltalk, which allows arbitrary code transformations on runtime, which further decreases boilerplate and makes a language more expressive. There's also Dylan and, of course, Common Lisp with CLOS. I'm working with StumpWM lately, a window manager written in Common Lisp - it does use classes and multi-methods, but very sparingly. WM is a piece of software, which is almost GUI only, and so in Java, you'd get a monstrous framework with myriads of classes and relations between these. In CL you don't need that at all - standard defuns and built-in data structures are enough for most things.

Anyway, Object Oriented Programming comes in various sizes and shapes, and it's unfair to see bad Java code as "representative OO" code. JavaScript is OO, Smalltalk is OO, OCaml is OO(/FP), and Julia is OO. Take a moment (more like a couple of years, but...) to look at them and try to compare the languages' object models and the common practice of writing code. You'll see something amazing, more than once, I promise.</comment></comment></comment>


Set Theory and Axiomatic Systems - <AUTHOR> http://0a.io/0a-explains-set-theory-and-axiomatic-systems-with-pics-and-gifs

<comment><USER4> Interesting that the first axiom he highlights is considered rather controversial. I only have a layman's understanding, but my sense is that the answer to "(If A is true) Do you believe not-not-A is true?" points to whether you subscribe more to classical logic or intuitionist/constructive logic.

<comment><USER5> It's double-negative elimination that does hold constructively, namely, not- not-A => A. In both classical and constructive logic, A implies not-not-A.

<comment><USER6> The double-negation holds in propositional logic (law of the excluded middle) but definitely not in constructive logic: You don't get that for free, you need a path from ~A to ~~A to A.

(And, refining the logical system to include bounds due to computational complexity, you need a path that is realistic in finite time.)

It also doesn't apply in Hegelian logic: ~A is literally everything that isn't A - and negating is likely undefined, since there is nothing in the universe that makes it necessary (regardless of sufficiency) for ~EverythingElse to necessarily mean that anything is left over, let along something as specific as A.

Unless A is somehow unspecific, in which case even ~A is likely defined and potentially meaningless.

I think the two worst intellectual holdovers in Western thought are Aristotelianism - and especially the law of the excluded middle - <USER2> Descartes' broader thinking - and especially his duality and "Cogito Ergo Sum": Both were really useful as developments in epistemology and logic, but both have outlived their then-value. We have moved on.

They are not even particularly useful as logical pablum for children, because it is too easy to assume forever that they are 100% reliable and valid - <USER3> are useful rules of thumb, they apply in many common, real world cases, but they are, logically, nothing more than extremely useful heuristics.

One can build vast systems with them, but one eventually hits Gödel and Aaronson, e.g., and one realizes the systems are built on less than sand.

Once one gets past them, one can begin to grok where mathematics and physics are now. But they are hard to break away from.

<comment><USER5> I'm a mathematician. I can't understand your post at all.

> The double-negation holds in propositional logic

Double-negation isn't a proposition, so don't know what this means. Double- negation elimination, that is, the proposition: for all A, ~ (~ A) -> A does not hold in constructive logic.

However, double-negation introduction, that is, the proposition: for all A, A -> ~(~ A) does definitely hold in constructive logic. Here is a proof in Coq:

Theorem A_implies_not_not_A : forall A : Prop, A -> ~ (~ A). unfold not. intros. apply (H0 H). Qed.

</comment></comment></comment></comment><comment><USER7> A small error I noticed:

After explaining the difference between subset and strict_subset, they claim that for all A

empty_set strict_subset A

which obviously fails when A is itself empty.

<comment><AUTHOR> Nice! I was just waiting for someone to point it out.</comment></comment>


Why Your Form Buttons Should Never Say 'Submit' - <AUTHOR> http://uxmovement.com/forms/why-your-form-buttons-should-never-say-submit

<comment><USER2> I can't believe that 16 years after forms first appeard on the web we're still having this discussion.

Using "submit" as your label? So are thousands of other sites. Your users won't be confused.

Using something more descriptive? That's fine too. Maybe it looks a little nicer and less generic. But it's not a usability problem.

Don't worry about this for a second. Instead focus on the real problems, like creating usable and accessible form fields with associated labels. Write easy to follow directions that explain which fields are required and what format you're expecting (or write better error handling techniques to accept a variety of inputs.) Write and _make visible_ appropriate error messages to help your users through the process so they don't make mistakes. Record the mistakes they make so you can use that data to engineer your forms in ways that reduce user errors.

There are so many other things worth your attention.

<comment><USER3> I totally agree. Using buttons with concise messages is best when they're used to access some functionality, but when submitting data the users have been clicking on submit buttons for more than a decade to do so. I'd even go on and say that in a lot of cases when you're submitting data, it's correct to use either simple actions as 'save', 'send', and 'submit' instead of 'Do the chicken dance when you click on this button'

Instead of worrying about submit buttons, which by the way generally exist a lone entities at the end of a form (which makes it's use even more obvious), worry about the actual usability of your forms and the logic behind the error handling.

tl;dr => In more cases than not it's more correct to use 'submit' as button copy than a more verbose counterpart when submitting forms.

<comment><USER4>
      > when submitting data the users have been
      > clicking on submit buttons for more than
      > a decade to do so

So you only want users on your site that have at least a decade of experience with the internet?

<comment><USER5> I don't understand why this got down voted. You can't assume that users will have experience with the internet. I work with a lot of people have little experience with technology and the internet and whose second language is English and they don't understand when they see "submit."

</comment></comment></comment></comment><comment><USER6> The trouble with putting the current task on the submit button is that the user is _already doing that task_ and they might think that the button is a link to start the task over, particularly if they clicked on identical text to get to the form in the first place. I have personally made this mistake while using some sites.

I try to include some context in the submit button but still make it clear that it will submit the form. Short, generic verbs seem to work well, like "Save", "Delete", or "Send".

EDIT: thinking more about this, I think what's important is to use a verb that _applies specifically to the form data_ as opposed to the whole task: You _send_ a reply, you don't _reply_ a reply.

<comment><USER7> Exactly, I've had this issue a few times and actually consider "submit"/"finish"/etc to be far more user friendly for this reason.

Presumably I already clicked something to the effect of "create user" to get to the form, and now I have to click "create user" again? What?

<comment><USER8> There's possible value is calling out the genericness of getting to the empty form vs the specificness of the submitting the data on a single instance of the form. "Create user" takes you to a form that has potential to be any user (because it's empty), "Create this user" finalizes the action based on the filled-in data on the form.

<comment><USER3> If you click on a link or button called 'Create a User' that that takes yo to a form, it would be almost universally more usable to have the button at the end say 'Save' instead of 'Create this user'. Verbosity is not always a good thing on the web.

<comment><USER9> I'm probably in the minority but when I see "save", I assume it's "saving my progress". In a user creation form, even just "create" is clearer than "save".

<comment><USER3> But then we're back in "is it telling me to create the user again when I already clicked the other button on creating a user on the other page?" territory. I think we should use whatever feels right and A/B test the hell out of it, but spend more time actually solving more substantial problems that the copy on a submit button.

</comment></comment></comment></comment></comment></comment><comment><USER10> Everybody already knows what I'm going to say but by golly _it is the right answer_ : test which one performs better for your site. 2 + 2 = 4, in the time it takes two highly paid people to debate "Submit!" versus "Sign up" you can have the A/B test already running and be back doing productive stuff.

<comment><USER11> A/B tests are only useful when you can gather statistically significant amounts of data from them. For a lot of small websites, or infrequently used features on larger websites, that is not the case.

<comment><USER12> Without statistically significant data, there is no hope for a statistically significant margin gain in the arena of form submissions. That is, why not just switch up the language? It's a trivial commit and will be an obvious change in conversions or no change. It would have taken less time to test than this comment to be written; just do it -- the parent comment's point.

</comment></comment></comment><comment><USER13> I think the analogy of "submitting a form" is perfectly reasonable to average folks. It's akin to giving a form to the receptionist at the doctor's office through the window:

1\. You get form, and go fill it out

2\. You bring back the form and hand it to the receptionist

3\. You get a range of responses ranging from nothing to a helpful answer.

Sounds exactly like an HTML form to me.

Is this the sort of parallel you want your users thinking of? Probably not, but it's also not some arcane terminology only programmers use either.

(edited for formatting)

<comment><USER14> It's still vague and doesn't tell the user what is DONE when you submit. "Save Changes" for settings, "Sign Up Now" for users joining a website, "Log In" to log into a website, "Reply" for replying to a comment ;-) Etc.

<comment><USER15> > _Sign Up Now_

ew, no. For me at least "sign up now" implies starting the sign up process. I would think "complete registration" or "create account" or "finish and create account" would be much better than "sign up now" _especially_ if you've previously used "sign up" wording.

<comment><USER14> Agreed, those are better, but the idea stands - tell users what they're doing when they click that button with the button text

</comment></comment></comment></comment><comment><USER16> I would argue that the "do something" button should focus more on where you are in the process than the process itself. The examples in the page all sound like the "start" step, instead they should reflect that they're finishing or moving the user on to the next step. "Submit" is generic, but at least sounds final.

The reality, though, is that we're all guessing. Unless you go to the effort to A/B test something like that, it's just voodoo.

</comment><comment><USER17> I received user feedback from a woman who said our submit button was "vile" and "sexist" because the label on it said "Submit". It took me a second to process. I can't imagine the emotions bubbling up inside her every day that she browses the web.

But regardless, we'll be changing the "Submit" button to "Sign In".

<comment><USER18> The classic is people fretting over master/slave nomenclature on hardware: <http://www.snopes.com/inboxer/outrage/master.asp>

<comment><USER19> Also "daemon." I can't remember which, but one of the "Linux distros for Christians" tried to remove references to daemons in the user interface and documentation.

</comment></comment></comment><comment><USER20> Read this somewhere:

The internet is like a dominatrix. Everywhere I turn it asks me to submit.

</comment><comment><USER21> This is an empirical question, and ought to be resolved by actual user data from a usability study.

</comment><comment><USER14> This harkens back to Windows vs Mac conventions for alerts (see [http://developer.apple.com/ue/switch/windows.html#designClea...](http://developer.apple.com/ue/switch/windows.html#designClearDialogs) )

<comment><USER22> I can't remember which dialog it is in Windows, but the most hideous example uses the standard Yes/No/Cancel buttons out of context but explains beforehand what each one does, like this:

      -To continue closing the program and save the document, click "Yes"
      -To continue working without saving, click "Cancel"
      -To save and then continue working click "No"

Which takes you five minutes to read and could have easily been replaced by set of a "Save and Close," "Save and Continue" and "Cancel" buttons.

<comment><USER23> For poor visual basic coders, it's easier to use standard dialogs than make custom ones. In the old days the Yes/No/Cancel text would be hardcoded into a specific dialog object.

</comment></comment></comment><comment><USER24> It's sometimes worthwhile to use boring, "wrong" default form elements, like when the browser will automatically translate their text labels into the user's preferred (i.e., non-English) language.

</comment><comment><USER25> ...unless of course you're running a BDSM site.

</comment><comment><USER26> [http://uxmovement.com/forms/best-way-to-align-buttons-on- for...](http://uxmovement.com/forms/best-way-to-align-buttons-on-forms)

In examples provided, 'submit' is used. "Never say 'Submit'" indeed.

<comment><USER27> It's a generic form in the example, so he used a generic submit button.

Without context, how are you supposed to say what the 'submit' button should be changed to?

</comment></comment><comment><USER28> I noticed <http://news.ycombinator.com/submit> said submit on the button too.

</comment><comment><USER29> I'd rather the submit button say "Submit" than have any "Reset" button anywhere. I hate it when I accidentally click those.

</comment><comment><USER30> Darn, I was planning on having a Submit! button for when I become supreme dictator. Of course I'd have my own website.

</comment><comment><USER31> Submit buttons are bad UI to start with. All content should be directly editable. You don't see a submit button on word processors.

<comment><USER32> People who use the web are used to have some sort of confirmation that their data has been safely squirrelled away somewhere. When I use sites that behave like this, I often find myself going back to the settings page to make sure my new settings have actually been changed, even though I understand the technology behind it.

<comment><USER33> I expect to see this change to match desktop expectations eventually, but I agree. Connectivity, and web apps themselves, can be unreliable, so it feels safer to see a new page load to confirm that our settings have been saved.

Additionally, many Windows apps still use OK, Cancel, Apply buttons in settings dialogs. The instant saving of settings is more of a Mac thing. Users are going to expect similar things from UI on the web, and the majority are probably new to the idea of no save/cancel choice.</comment></comment></comment>


In Letter to Jeff Bezos, Mom Says Alexa Has Ruined Her 6-Year-Old's Life - <AUTHOR> https://www.vice.com/en_us/article/4agaap/in-letter-to-jeff-bezos-mom-says-alexa-has-ruined-her-6-year-olds-life <comment><USER2> Why haven't the Alexa's of the world filled suit against Amazon over appropriating the name? They locked up the name once they selected it as the name the Echo uses. Seems to me that this is a class-action suit waiting to happen.

I had a similar issue. As a teen, a commercial used my name as part of their pitch. Within a few weeks of it running on television, I had people, kids and adults, repeating the commercial's key lines to me. It was cute once or twice but it quickly grew tiresome and irritating. People just don't understand how irritating it becomes. I was lucky since the commercial finally stopped running.

All the poor people that are named Alexa must be going nuts. I truly sympathize.

<comment><USER3> There was a guy named Michael Cialis who sued to prevent some pharma co from naming their erection drug "Cialis". He failed.

If you could sue a company for using your name, how would you show harm? Amazon wants people to _like_ Alexa and associate positive feelings with it. How can they stop bullies?

Alexa is a brand name acquired by Amazon in 1999, so these children are likely younger than the brand.

If they can sue, does that mean I can name my child Viagra and then sue whomever made that?</comment></comment>


US Army experiments with crowdsourcing equipment design - <AUTHOR> http://www.gizmag.com/us-army-crowdsourcing-design/29562/

<comment><USER2> Wow, because supporting that war machine is what the world needs.

<comment><USER3> Ironically, such 'war machines' are responsible for the device you're accessing this network on, and the network itself.

But yeah... it is a bit creepy.</comment></comment>


Interested in beta testing DropZap -- a novel Drop7 variant? - <AUTHOR> http://www.dropzap.com

<comment><AUTHOR> Send me an email if you would like to be a beta tester: firstname.lastname@example.com.</comment>


Long-Form Question Answering - <AUTHOR> https://ai.facebook.com/blog/longform-qa/ <comment><USER2> I'm not sure "we scraped ELI5"[1] is really such a substantive advancement of the state-of-the-art that it deserves such a large write up. The Stanford Question & Answer Dataset is much more carefully curated.[2]

ROGUE[3] and BLEU[4] are pretty meaningful metrics for translations and for fairly short answers that that really only be phrased one way. For example, "What is the biggest mammal?" should be answered "The Blue Whale." There is little room for ambiguity: the words "Blue" and "Whale" _must_ appear, as must the bigram "Blue Whale" for the answer to be correct. For a large or complex answer, the situation is different. Metrics based on word overlap like ROGUE and BLEU must either incentive memorizing the answer given in the training set (overfitting) or the inappropriately penalize semantically equivalent answers. For example, for the question "why is the sky blue?" if the algorithm produces "The sky is blue because Raleigh scattering off of water droplets preferentially scatters blue light at right angles. This is also why sunsets are red." and the answer on file is "light with long wavelengths passes straight through moist air, while light with short wavelengths tends to be deflected." Both answers are correct - indeed they are basically the same answer - yet they share so few words, bigrams, and trigrams that they would have to marked "wrong."

[1]: [https://www.reddit.com/r/explainlikeimfive/](https://www.reddit.com/r/explainlikeimfive/)

[2]: [https://rajpurkar.github.io/SQuAD- explorer/](https://rajpurkar.github.io/SQuAD-explorer/)

[3]: [https://en.wikipedia.org/wiki/ROUGE_(metric)](https://en.wikipedia.org/wiki/ROUGE_\(metric\))

[4]: [https://en.wikipedia.org/wiki/BLEU](https://en.wikipedia.org/wiki/BLEU)

</comment><comment><USER3> Am I weird for immediately jumping to conclusion that the first thing this will be used for is generating tons of rather low-quality content for "SEO" purposes?

</comment><comment><USER4> It's interesting to see the path towards increasingly sophisticated question in --> answer out. The way people do this is with dialogue, but that doesn't fit as easily into standard supervised learning with an easy-to-collect dataset.

If you asked me "What's a good restaurant nearby?" I wouldn't answer with a list of restaurants, I'd say "What kind of food do you feel like?" Seems like we aren't even working our way in that direction. Maybe the sample complexity of RL and language modeling needs to come down a ton first.

</comment><comment><USER5> I'm having the dickens of a time understanding who Facebook built this for. Marketers, right?

<comment><USER6> did you bother to read the article? It's in the very first line "To help advance question answering (QA) and create smarter assistants" \-- aka messenger bots / AI assistants / etc

<comment><USER5> Yes. In fact I did, yet I'm a mere passive user of FB and have never come across QA messenger bots on the platform before, who uses them? I presumed marketers and advertisers.

Is this presumption incorrect? I'm trying to understand who a potential/target/ideal user of this technology would be from Facebook's perspective-a few sentences about mobile users searching for songs but that's it. That doesn't seem answered in the article, I'd appreciate that in the place of snarky assumptions about my reading skills, please and thank you.

<comment><USER7> Messenger bots are of interest to marketers, but they don't really seem to use them too frequently. Customer support is a much more common use case from my observations.

All that said, even if it were marketers, it seems pretty clear _who_ this is being built for.</comment></comment></comment></comment>


How Identity Ages - <AUTHOR> http://aging.nautil.us/feature/214/how-identity-ages <comment><USER2> Although not the main point of the article, this stood out to me:

 _> >It's a story you've got about how you came to be, who you are, and where your life's going...Narrative identity is just as much about how you imagine the future, even though it hasn't happened yet, as it is about how you reconstruct the past. If I'm planning to be president of the United States, and I'm currently laboring in academia, well you're going to have to develop a way to connect up your past with your goals for the future._

Having recently past my 47th birthday, I've come to realize how important is the notion of building a "narrative identity".

It's one piece of advice I'd love to give my younger self, and am starting to gratuitously give to younger people I speak with – come up with a narrative you wish to be the story of your life, and then day in, day out, lay down the bricks that will build that narrative into a reality. Be aware of the connections you need to build now, which will become your past, to what you want in the future.

 _How we spend our days is, of course, how we spend our lives._ said Annie Dillard. Each decision you make, each project you start, each job you take – think of how it will impact the narrative you wish to build. Be deliberate about it. The small things you do each day, taken in aggregate, is what your life will be. Just like when kids make designs in freshly fallen snow, at the end of all your tramping, there will be a sketch, a print. Make sure it's one you'd want.

</comment><comment><USER3> I don't think it's right to say that people "just forget the negative stuff". To me, the difference in getting older is that I can assign meaning to my suffering. Whet you're suffering as a kid, it seems pointless and painful. As you get older, you have time to see others experience pain and also play through enough hypothetical scenarios that you can find meaning in your own suffering. This, I believe, is one of the secrets to being happy. It is why we often hear stories of resilient cancer survivors and mountaineers who never gave up. Finding purpose and meaning in your suffering is what makes it bearable. This is also a compelling argument for the merits of religion.

I don't think people "forget" pain. They just earn a perspective on the pain that doesn't cause them pain. Usually this perspective includes some link to the present in opposition to a potentially worse outcome which makes the past sound rosier to an outsider.

Tangential point: you don't always get credit for toking things seriously, but you do always get credit (in one form or another) for being lighthearted, and these two things are not orthogonal. I believe this is also why our narratives shift.

<comment><USER4> > As you get older, you have time to see others experience pain and also play > through enough hypothetical scenarios that you can find meaning in your own > suffering. This, I believe, is one of the secrets to being happy. It is why > we often hear stories of resilient cancer survivors and mountaineers who > never gave up. Finding purpose and meaning in your suffering is what makes > it bearable.

I think this is what the McAdams is describing when he speaks about "redemption stories".</comment></comment>


Google's secret about DART - <AUTHOR> http://nadirmuzaffar.blogspot.com/2013/08/future-of-google-dart.html

<comment><USER2> Short answer: No

Longer answer: The Dart VM would need to be adapted to battery powered devices as thoroughly as Dalvik. Android's runtime is not just for apps. Android's middleware layer runs mostly in the Dalvik VM. Implementers have multiple options for performance-critical code, including native code, relying on the Dalvik JIT compiler, and Renderscript.

Not impossible, but I don't see efforts in that direction. Then there are lesser details like adapting Dart to Android's security and IPC model, etc.

Until then, WAGs like this have the same credibility as predictions that Android will go JavaScript.</comment>


Master Password - <AUTHOR> https://ssl.masterpasswordapp.com/ <comment><USER2> First of all, this looks like an awesome and very well-thought-out implementation, and I'm sure it'll work well for some people!

That said, I actually made something very similar to this a while back. Now I use pass instead: [http://www.passwordstore.org/](http://www.passwordstore.org/)

The downsides I didn't think about, or didn't think would be as annoying as they were, until I started running into them in actual use:

\- The big one: change your master password? You now have to change _all_ of your passwords for every service you use.

\- Weird restrictions on password length or allowed characters? Okay, the app gives you options to generate a password with the required parameters, perfect! When you actually use this you realize that that set of parameters is a state that must be stored somewhere. Possibly your brain ("okay, when I log into gmail, I select 'phrase', but logging into Bank of America I have to use 'long'... or was it 'medium'?). This does not scale.

\- Need to change a password for a specific service? Again--this has a "site counter", that works... except now there's more state, and you need to remember to use "2" with "gmail" and "5" with "hn" and...

Of course, you could (and, didn't download to try, but it's possible the app does?) store those restrictions/site counters somewhere, but now you've lost the main benefit of doing this in the first place (stateless, nothing to sync). In the end, I decided that gpg encryption is secure enough for me.

<comment><USER3> Curious, have you used pass on Windows or Android? I'm thinking about getting a YubiKey Neo and switching from KeePass to pass since then I can use a second factor as my GPG key.

<comment><USER2> I haven't tried pass on Windows or Android, but I did write an (over- complicated, but it was partly for fun and I wanted to play with clojure/clojurescript) webserver exposing pass from a VPS:

[https://github.com/johnswanson/pass- server](https://github.com/johnswanson/pass-server)

I shut down the Linode it was on a while back and haven't gotten around to putting it back up yet, but it worked pretty well for me.

</comment></comment></comment><comment><USER4> It is important to note that there is a security flaw in this scheme that makes it strictly less secure than using a password manager with randomly generated passwords. All an adversary needs in order to generate _all_ of your passwords is your master password. Let's walk through the steps of how an adversary can brute force your master password.

First, they will need access to a hash of _one_ of the passwords you have generated. Say you use this application for every site you visit, and you have somewhere between 20-30 accounts. If only one of these companies suffers from a password leak, then the adversary will have enough information necessary to brute force your master password and generate your password for all other sites. This means that the sketchy site you created an account on to buy a phone case can result in an adversary gaining your well-protected bank password.

Once they have a password hash, they can brute force your master password in the regular way. All other inputs to password generation function are easily obtainable through minimal social engineering or guessing (your name, the site name, number of re-generations). I will note here that they did use scrypt, which makes brute-forcing more difficult (but not impossible). So, if you use a weak master password, not only is your password for the vulnerable site brute forceable, but all other sites you use in the present and the future will be compromised.

This scheme is not more secure than existing password management schemes (provided the password manager uses a good hashing algorithm for the master password like PBKDF2). It is strictly less secure because the security of all your passwords relies on the minimum security of all sites you use. It is also less secure because after a leak, an adversary can generate _future_ passwords.

This tool should be used with caution and with these facts in mind.

</comment><comment><USER5> This sounds like an excellent approach:

 _" Master Password is a stateless password generator. It doesn't store, collect or transmit any secrets. It makes them ubiquitously available, on- demand, depends on nothing but your private master password, and is fully open source."_

I wonder why it hasn't received wider attention since being released a year or so ago? The only real mention I found in a cursory search (outside of app store reviews) was here:

[https://pack.resetthenet.org](https://pack.resetthenet.org)

 _" Are you using the same password everywhere? If so, change it, starting with your email account. Use a tool like MasterPassword or write it down."_

<comment><USER6> > I wonder why it hasn't received wider attention since being released a year > or so ago?

I've seen a few people start developing this general kind of password system for their personal use, but they usually end up giving up after running into a few problems that make them realize that there are some annoying issues involved. That's what happened when I started doing one a few years ago, when I was trying to make something a bit more convenient than the classic encrypted text file full of passwords that I was using.

I took a similar approach, using a master password, something that should be per site (domain name), and a password version number as input to a key derivation function to get the password for the site.

That's where the first problem showed up. Where should I store the password version number? I didn't want to have to memorize what version password I was on for every site, so I'd need to keep it in a file somewhere, which I'd need to share between all my computers. (This was before I had any mobile internet devices, so I was only concerned with desktops).

And then I realized I needed storage for more than just the password version number, because I remembered all those idiotic password restrictions that so many sites like to use. Things would be a lot nicer if sites would just at least come up with a common format that they all accept in addition to whatever else they accept, such as 32 to 64 characters in [a-z0-9]. Then everyone using a password manager or password generator could use that format, and we'd all be happy.

But they didn't, so that means I'd need to store and sync some kind of formatting information for sites that cannot accept whatever my default generator format is. So, add that to the file that is storing the version numbers for each site that is past version 0.

And then I realized another issue. I have passwords I want to store that were imposed from outside. For instance I have a password share for the key to an encrypted database at work, made via Shamir secret sharing. I want my password management system to hold it for me, but not to generate it.

This could be dealt with. I could have had the password management system generate a password, and use that to encrypt my Shamir shared secret. Then I'd have to store that encrypted file somewhere that syncs to all my machines. It might make the most sense to build support for this into the password manager, providing a general "store a secret string" function, where it handles encrypting it and then stores it in the same place it is storing password version numbers and site-specific password formatting templates.

At that point, 1Password showed up in a MacHeist bundle, I gave it a try, and very shortly afterwards abandoned my password generator/manager development.

Master Password says it has password versions, password format templates to deal with idiotic sites, and storing imported password in the app encrypted using a generated password. What I did not see (I may have missed it) is an explanation of how this works if I have more than one device.

<comment><USER7> I went through the exact same process as you, even including getting 1Password from MacHeist. Are you me?

</comment></comment></comment><comment><USER8> This is incredibly similar to my side project Cassidy (except it's built on top of vault). Same idea though: master password + salt + site.

[https://cassidy.nicinabox.com](https://cassidy.nicinabox.com) [https://github.com/nicinabox/cassidy](https://github.com/nicinabox/cassidy)

<comment><USER9> Nice! The interface looks very nicely done. I like that you thought about syncing too. Except personally I don't like storing things on Dropbox but I guess it's just metadata too.

I haven't heard of vault, so I looked into it. It looks like it uses CryptoJS with 8 iterations on PBKDF2.

I wrote hash0[1], which is the same sort of master password + salt + site but syncs encrypted metadata with server of your choice.

I found that while working on hash0, that SJCL's[2] PBKDF2 is faster than CryptoJS's implementation, which means I can perform more iterations faster and get the same result. I switched from CryptoJS to SJCL, and have hash0 do 100,000 iterations instead of vault's 8.

      [1]: https://github.com/dannysu/hash0
      [2]: http://crypto.stanford.edu/sjcl/

<comment><USER8> Wow, that's really great to know! I'm going to check this out.

</comment></comment></comment><comment><USER10> Really great to see more open source solutions in this space, especially those attempting to tackle all platforms.

However, I can't help but feel a bit depressed by the state of even some of the most common projects, like GPG[0].

Another one that I truly fell in love with its simplicity and beauty -- Mitro[1] -- seems to be dying a slow death[2].

I know it shouldn't reflect on this project, and can only wish for its long- term success.

[0] [https://news.ycombinator.com/item?id=9003791](https://news.ycombinator.com/item?id=9003791) [1] [https://www.mitro.co](https://www.mitro.co) [2] [https://github.com/mitro-co/mitro/issues/123](https://github.com/mitro- co/mitro/issues/123)

<comment><USER11> I am still using Mitro and I really love it. I am pretty sure their company got acqui-hired by Twitter [0][1].

Sadly, the service might shut down before the end of 2015 because of time/money problems [3].

[0] [https://twitter.com/MitroCo/status/494891941352730624](https://twitter.com/MitroCo/status/494891941352730624)

[1] [https://twitter.com/TwitterEng/status/494895829556002816](https://twitter.com/TwitterEng/status/494895829556002816)

[3] [https://twitter.com/MitroCo/status/577435506524336128](https://twitter.com/MitroCo/status/577435506524336128)

<comment><USER10> That's exactly the depressing part I was talking about. It's a fantastic project, which is now open-source, but there doesn't seem to be anyone who would take over and support it longer term. Even though I believe there's a viable business there as well (As an end-user in a small company, we'd be happy to pay a monthly subscription for it, equivalent to or even higher than what we'd pay other solutions out there, e.g. lastpass).

It's fair to tell me "then why don't you contribute / do something instead of complaining?", but as much as I'd like to, it's got lots of moving parts and needs significant time and lots of different skills, or some form of backing to pay for those. Even if it can be turned into a solid business, it will still require resources to support - not just the technology, but marketing etc. So far, I haven't seen anybody picking this up, but I really hope someone will. It will be a great loss to see it die.

<comment><USER12> Does EFF or other non-profit organizations act as security nets for open source products and ensure that the software they endorse remains available to everybody?

</comment></comment></comment></comment><comment><USER13> Curious as to how PasswordMaker either uses weak crypto or "suffers from critical flaws". Master Password seems to be more flexible with features like password counter and a customizable password policy (this is especially cool if it is customizable per domain). Unfortunately for me iOS-only is a deal breaker. PasswordMaker has clients that run on everything. The two I use most are the "PasswordMaker Pro" Chrome extension and the PasswordMaker X Android app.

[https://github.com/passwordmaker/chrome- passwordmaker](https://github.com/passwordmaker/chrome-passwordmaker)

[https://github.com/eddieringle/PasswordMaker_X](https://github.com/eddieringle/PasswordMaker_X)

<comment><USER14> Why "iOS-only"? I've been using the Android version for a few months and it works fine: [https://play.google.com/store/apps/details?id=de.devland.mas...](https://play.google.com/store/apps/details?id=de.devland.masterpassword)

<comment><USER15> That is an unofficial implementation

</comment></comment></comment><comment><USER16> I'm using [SuperGenPass] for exactly same thing. I forked the project on Github so I'm sure that algorithm won't be changed.

[SuperGenPass]: [https://chriszarate.github.io/supergenpass/](https://chriszarate.github.io/supergenpass/)

<comment><USER17> Yeah, SuperGenPass has great integration too. You can run it almost anywhere, though you have to have some faith (there were proof of concepts against the earlier bookmarklet version, though I believe they've been mitigated by using an iframe approach now, but you're still running crypto in the browser–I probably wouldn't use it for anything genuinely sensitive).

Other 'problem' is that it uses a fast hash function. There was a fork going round that used bcrypt I think, I'm not sure what happened to that.

<comment><USER16> I'm using only mobile version which is a standalone page. I memorized the icon generated for my master password so I can spot if I made a mistake whilst typing.

I also use salted master password for each site, so I'm feeling safe at this.

Regarding "quick hash" or "slow bcrypt" \- it doesn't matter here. Bcrypt complexity is to prevent obtaining real password from it's hash. Here we're dealing with real passwords but not hashes.

<comment><USER17> > Regarding "quick hash" or "slow bcrypt" \- it doesn't matter here. Bcrypt > complexity is to prevent obtaining real password from it's hash. Here we're > dealing with real passwords but not hashes.

It does matter. If a website knows that you use SuperGenPass, they can conceivably guess your master password if it's weak as a direct result of SuperGenPass using a fast hash function to generate the site-specific password.

In a scheme like this, the "real password" _is_ the output of a hash function (albeit munged a little bit), so choice of hash function is important. I'm not a cryptographer, but really a key-derivation function seems like it would be a lot more appropriate here than a simple hash like MD5.

<comment><USER16> Still don't get it. Knowing that I use SGP gives attacker nothing. On each guess of master password attacker has to generate pass (quick, using hash) and then GO to website and try to login. And this is very slow compared to hash generation using bcrypt, SHA1 or even md5.

<comment><USER18> That's assuming every website you use with one of these passwords is secure. In practice sites get hacked, fail to enforce HTTPS, databases get leaked, etc.

<comment><USER17> > In practice sites get hacked, fail to enforce HTTPS, databases get leaked, > etc.

Exactly. The threat here is that a single SuperGenPass-generated site-specific is leaked somehow (if you use it for a lot of sites, one of them is bound to be storing a password in plaintext, or not using https, or whatever–or, for all I know, the OP is such an important target maybe someone specifically sets up a website to capture a sample site-specific password). Then, using that site-specific password, a determined attacker might be able to recover your master password and then _be able to login to all the other websites you use SuperGenPass with_. That's the danger of using a 'fast' hash function to generate your site-specific password.

<comment><USER16> Ok, I finally get your point, thanks for detailed explanation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> This is a pretty neat concept. I'm not sure if this is what its doing but it seems like it.

It seems your master password is like a seed for the encryption or something so that's why it can always be the same. If thats pretty much what it is its pretty smart and simple.

I also like the option for the account clues.

<comment><USER20> That's pretty much how 1Password works.

<comment><USER5> Master Password works very differently from 1Password, KeePass, LastPass, etc:

 _" Master Password is a stateless password generator. It doesn't store, collect or transmit any secrets. It makes them ubiquitously available, on- demand, depends on nothing but your private master password, and is fully open source."_

<comment><USER20> LastPass is definitely different, as it stores data on a server.

KeePass and 1Password, as I understand, use your master key to decrypt a file (local or in a cloud provider like Dropbox) that contains your password(s).

Master Password may be different than this - I don't understand how you can retrieve passwords without storing them, but I'm sure it'll become clear by researching it. I do want to be clear that 1Password isn't a central repository like LastPass, however.

(edit: I think I understand MP better, see below)

<comment><USER20> Ok, I get it - it doesn't retrieve anything. It basically hashes you a password using what is public and a secret (your password). I need to see if it's possible to change your password on a per site basis - it seems that would require changing globally (since you'll need to update the secret)

<comment><USER21> it has an additional counter that can be incremented per site

<comment><USER22> This seems incredibly awkward to me.

Several of the design goals for this app were to eliminate the need for sync, as you're able to fairly easily replicate the initial seeds/salts for password generation (your full name, your master password, and the site base domain).

I'm not really seeing any pros using this solution...

Con 1: You can't use any password you want (for whatever reason, be it stupid password security requirements, your boss gave you a password to use, you're not allowed to change something, the list goes on) Con 2: They focus on not requiring sync, and concessions were made for this (a bunch of defaults, as well as con 1 from above) when they really actually do require sync. The password counter and password type (strong, weak, etc) both need to be synced to actually derive a password.

If we're going to have to sync these to reliably store our passwords, then why not just go with an actual password manager without any of these arbitrary limitations?

I've been using 1Password and its been working out great for me. (Arguments may be made about its closed source, but KeepassX functions in a similar manner).

<comment><USER6> > Con 1: You can't use any password you want (for whatever reason, be it > stupid password security requirements, your boss gave you a password to use, > you're not allowed to change something, the list goes on)

It does cover that:

       My boss gave me this password to use...

       Master Password's generated passwords only work if
       you use the password generated for you. You cannot
       use a password somebody else gave you.

       Only - you can: Master Password implements a hybrid
       solution, allowing you to save custom passwords in the
       app. They are AES encrypted with your master key, but
       like all vault-based password managers, are not immune
       to loss if you ever lose your phone and backups..

Of course that introduces a vault and presumably a need to sync if you want to access that password from multiple computers or mobile devices.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> PasswordMaker [http://passwordmaker.org/](http://passwordmaker.org/) is most similar, but this has a coherent cross-platform implementation and better templating.

Downsides:

\- single point of developer failure (although open source, and specification- based)

\- lack of browser integration

</comment><comment><USER24> This is based on simpler tools like SuperGenPass

[https://github.com/chriszarate/supergenpass/wiki/FAQ](https://github.com/chriszarate/supergenpass/wiki/FAQ)

which credits my site

[http://angel.net/~nic/passwd.current.html](http://angel.net/~nic/passwd.current.html)

as "the original bookmarklet password generator". It adds some useful features, but loses the simplicity and transparency and real statelessness of a self-contained HTML/JavaScript form - and is less convenient for most uses than a bookmarklet.

</comment><comment><USER25> Great idea, but a total geek product. In terms of actual market success, that is, getting security to average people this is never going to work. Not only is there all kinds of language on the site that regular folk aren't interested in (text encodings, hashes, etc.), the very idea of having to remember a "password counter" is far too difficult for _anyone_. I've got hundreds of passwords (in a password app), and once even a quarter of those are incremented past 1 in the counter it's just a massive guessing game at that point.

</comment><comment><USER26> I've been using a password hasher for ages now. Just search for it on google apps or in the mozilla addons library.

</comment><comment><USER27> Great idea! And kudos for releasing it as free software.

But I don't see how "nothing to intercept" is a security feature. That means an attacker can start brute forcing just knowing the victims name instead of having to obtain the encrypted files first.

<comment><USER28> According to [https://ssl.masterpasswordapp.com/algorithm.html](https://ssl.masterpasswordapp.com/algorithm.html), Scrypt is used for key derivation. Scrypt is supposed to be very expensive to brute-force.

Quote:

The master key is a 64-byte secret key generated by performing expensive key derivation using the user's master password salted by their full name. It represents the user's global secret.

The purpose of this process is to deter any attempts at brute-forcing a user's master password from a known site password. The key derivation is done using the scrypt algorithm, which guarantees that the process sufficiently time- and resource-consuming to make brute-forcing an infeasible attack.

The key derivation is salted by the user's full name to prevent the generation of rainbow tables on the algorithm. This salt is not secret, and the user's full name is chosen because it is an input of sufficiently high entropy while being (hopefully) impossible to forget by the user

</comment></comment><comment><USER29> This is such an old idea but brilliant for those cross device fiddly little passwords - wish I had thought of it.

But, can you auto fill / paste the password? The UX for a phone is painful usually - downloading it so we shall see

</comment><comment><USER30> Cool idea! Reminds me of Passcode ([https://github.com/mdznr/iOS- Passcode](https://github.com/mdznr/iOS-Passcode)), which follows a similar model.

</comment><comment><USER31> Here's details of how the algorithm is implemented:

[https://ssl.masterpasswordapp.com/algorithm.html](https://ssl.masterpasswordapp.com/algorithm.html)

<comment><USER32> For low-security situations it looks good enough, but be aware that generating a password from full name + a memorable passphrase + site name + a counter is still pretty brute-forceable; the counter is presumably small (and hence adds little entropy), and American full names just add three fairly well- constrained words.

Also, isn't the counter a bit of state? Is the idea that the user has to remember it, or does the app remember it for him?

<comment><USER33> I believe that the use of scrypt is supposed to make this unbruteforceable.

</comment></comment></comment><comment><USER34> What if I need to change the password for a particular website (for example because it has been compromised and all its users were encouraged to change their password)?

<comment><USER35> I believe that this product has a "version" number for each site. So, the first password you create for twitter.com has a version of 0. If/when those accounts get compromised, you create a new password for twitter.com with a version of 1. The downside is that now you have to keep version numbers for each site somewhere, or change all of your passwords for everything. :(

<comment><USER36> Yes, the website is misleading when it states that "Master Password is based on a stateless algorithm which frees it from the reliance on storage of secrets", which is clearly not true. When you rely on people's brain for storage, not only it's not stateless, but you've just chosen quite an unreliable form of storage.

There's also the issue of the master password being compromised, which would requires users to change all their passwords on all their websites.

I'm surprised these "stateless" password managers keep being made. Either the creators really didn't notice the huge drawbacks, or they did but still want to get their software out.

</comment></comment></comment><comment><USER37> What about those who have multiple accounts on one site...?

<comment><USER14> Put "email@example.com" in the "site name" field. It's just a text field after all.

</comment></comment><comment><USER38> Why an app and not an open source code?

</comment><comment><AUTHOR> One very bad "oops" I've realized I made.

Show HN is meant for projects one has created themselves. This is not my project and I didn't read that guideline last night when I submitted. It's an interesting project that I stumbled upon last night and started using. I thought I'd "show (it to) HN".

Happy for a mod to edit the title. My sincerest apologies to the author and the HN community for my haste and any misunderstanding.

<comment><USER39> Thanks for letting us know! We've removed "Show HN" from the title.</comment></comment>


How do you learn Chinese online? - <AUTHOR>

<comment><USER2> There's a range of options out there. These are some of the ones I've used / encountered

\- from podcasts: Chinesepod \- eChineselearning: skype lessons \- Livemocha: connect with people from China and get them to help you out with exercises/voices \- M&MX: <http://www.mandmx.com> Awesome comics and learn Chinese blog posts \- Confused laowai: confusedlaowai.com

I'm also the founder of a mobile app called Mandarin Madness which helps you learn Chinese. Its a fun and engaging way to learn. Also, one of the most simple ways to start learning even if you are a beginner. Check it out here: <http://www.mandarinmadness.com>. I'd love to get your feedback! Contact me here: hello at nativetongue dot com for more info.

<comment><AUTHOR> I'll take a look. Thanks

</comment></comment><comment><USER3> English-Chinese dictionary: <http://www.chinese-tools.com>

Chinese idiom dictionary: <http://www.zdic.net/>

Chinese character stroke order dictionary: <http://www.visualmandarin.com/tools/chinese-stroke-order/>

Traditional to Simplified Chinese translator: <http://www.vifo.com.cn/fanti/>

Chinese pinyin romanizer: <http://translate.google.com>

</comment><comment><USER4> popupchinese.com

<comment><USER5> Just good,not perfect。

<comment><USER4> how would you improve it, honest question?</comment></comment></comment>


Dave Beazley: Putting all of my Past PyCon/IPC Presentations on Slideshare - <AUTHOR> http://dabeaz.blogspot.com/2010/09/putting-all-of-my-past-pyconipc.html <comment><USER2> Bravo David! David is a clear and insightful presenter of all things Python. His Python Essential Reference is just that, essential. I have six copies, two each of each of the three editions/ Three editions because Python is an evolving language which pays attention both to backwards compatibility and to occasional housecleaning to remove the accumulated cruft. <http://www.dabeaz.com/></comment>


Security Related Interview Questions for All Engineers - <AUTHOR> https://www.netmeister.org/blog/security-questions.html <comment><USER2> Would be good to add some in there about social engineering and what to count as suspicious. Otherwise a fantastic list.</comment>


Google Nexus 4 Actually Has an LTE Chip - <AUTHOR> http://www.ifixit.com/Teardown/Nexus+4+Teardown/11781/3

<comment><USER2> Plausible reasons have already been suggested somewhere else[1], in summary chipset makers are creating dual purpose chips with dies that support LTE, but have fuses burnt and a cheaper price tag to restrict their usage. Even if you could reverse the fuses, there is still a lack of hardware and calibration for it to be possible in the nexus 4.

[1] [http://www.reddit.com/r/technology/comments/13cods/nexus_4_t...](http://www.reddit.com/r/technology/comments/13cods/nexus_4_teardown_reveals_lte_chip/c72u8xm)

<comment><USER3> Also, much of the Nexus 4's design is reused from the Optimus G which has LTE.

</comment></comment><comment><USER4> it has an LTE baseband chip but no amplifiers for the LTE frequency bands, no matching antenna and no LTE royalties paid.

</comment><comment><USER5> and the 486SX had a math co-processor.

</comment><comment><USER6> Not like the couldn't release a model with twice the storage at the same price along with another model with LTE working. Maybe later, maybe not.

<comment><USER7> Perhaps they will sell a slightly more expensive model in a market where LTE support doesn't require the cooperation of the mobile operators, which is well ... most places outside Northern America.

</comment></comment><comment><USER8> From what I hear the battery life of the Nexus 4 leaves a lot to be desired, and LTE would only make that worse

<comment><USER9> Can anyone else comment on this? As mkuhn points out, reviews are very mixed.

Battery life would be the deal breaker for me.

<comment><USER10> I'm sure the reviews depend on cell signal strength at the reviewer's location. If you work inside a farady cage, the phone will melt itself trying to contact the tower. If you live on top of a cell tower, the thing will stay in standby for decades before the battery dies. Since most people are somewhere in between those two states, battery life gets mixed reviews.

<comment><USER9> But battery life never gets mixed reviews - apart from for this phone. What's the reason?

</comment></comment></comment></comment><comment><USER11> well at least now you can say your phone has LTE...

I hate verizon but I can't leave. I have a $10 unlimited data that can't be beat anywhere else :/ I love the Nexus 4 design too bad I'm getting my Droid DNA in a couple of days

</comment><comment><USER12> Don't get your hopes up. I doubt it will be getting LTE functionality in the future. They would've said so otherwise.</comment>


Lo-Fi Player - <AUTHOR> https://magenta.tensorflow.org/lofi-player <comment><USER2> There is a whole genre YT channels of this style of music, which all play 24/7

The most famous channel of it that I know of is ChilledCow: [https://www.youtube.com/watch?v=5qap5aO4i9A](https://www.youtube.com/watch?v=5qap5aO4i9A)

But there are others such as:

SynthWave: [https://www.youtube.com/watch?v=eVcMequS9vE](https://www.youtube.com/watch?v=eVcMequS9vE) [https://www.youtube.com/watch?v=p-Jdm0H-A9k](https://www.youtube.com/watch?v=p-Jdm0H-A9k)

NeoChill: [https://www.youtube.com/watch?v=kx63aT4UvDI](https://www.youtube.com/watch?v=kx63aT4UvDI)

And many more. Great background music for coding

<comment><USER3> Love synthwave, it is fantastic for focus and is very upbeat. Plus I dig the art style and the whole 80s neon motif in general. Good stuff.

<comment><USER4> Plus! It makes me set same goals in my life. I must now save up for buying a Ferrari Testarossa.

<comment><USER5> It's kind of a weird car.

[https://youtu.be/K1jB4vYji6A](https://youtu.be/K1jB4vYji6A)

Personally I would not buy it.

But some people may find the quirks of it charming I suppose.

<comment><USER6> Somehow I already knew it would be the Doug video coming into it, he is fantastic and such a great guy too!

However, the Countach is where it is at. [https://www.youtube.com/watch?v=cOQC24gAghE](https://www.youtube.com/watch?v=cOQC24gAghE)

<comment><USER5> Haha yeah that one is great :)

</comment></comment></comment></comment></comment></comment><comment><USER7> While this is cool I have a general question to people here:

How do other people here handle tensorflow as a python dependency? People use it like it's any other dependency, but it frequently adds unnamed amounts of dependencies, creates conflicts every now and then, is just massively huge and for the longest time of its 1.x existence was constantly breaking some PEP's causing problems with third party tools. It's kind of poison to custom docker files. How do you guys handle this situation? This isn't really my responsibility but whenever I deal with ML engineers doing tensorflow stuff I feel like I'm immediately also a plumber.

<comment><USER8> Python Virtual-env You create one new virtual environment for each different project, and you throw them away and build them up again once a problem appear.

<comment><USER9> Yep, always use Python virtual environments to manage dependencies. Here are my notes around that: [https://ketanvijayvargiya.com/notes/39-python- setup/](https://ketanvijayvargiya.com/notes/39-python-setup/)

</comment></comment></comment><comment><USER10> Very cool!

Does the Magenta project used here have models for musical instruments identification or can be used to create one? Does anyone have better suggestions for the identification of musical instruments from audio? I'm trying to solve the need gap -'Display musical instruments used in a song' posted on my problem validation platform[1].

[1][https://needgap.com/problems/151-display-musical- instruments...](https://needgap.com/problems/151-display-musical-instruments- used-in-a-song-visualization-music)

</comment><comment><USER11> Vibert is a badass! I met him through a friend last year and for every project released he has a trove of awesome demos lying around. Great work dude, excited to see what you do next.

</comment><comment><USER12> I absolutely love this! Pinning the tab immediately. Loving the positional audio when using headphones.

</comment><comment><USER4> The user interface kind of reminds me of Zak Makcraken and the alien mind benders by Lucas Arts. Very charming!

</comment><comment><USER13> Every time I see one of these projects, it gets me more and more excited about magenta/TF.js. I feel like we're just scratching the surface with these kinds of projects, and they're already awesome.

As someone who works on model serving infra, there are so many tricky problems teams run into around running inference that—at least in theory/in part—seem like they could be elegantly circumvented by running certain models directly in the browser. I really hope to see more development in this space in the coming years.

</comment><comment><USER14> Interesting gamification of music. Inherently inaccessible though, as will be most (pseudo-)AR that is coming up.

I prefer playing with the real thing, there is really nothing more fun then a hands-on synth: [https://www.youtube.com/watch?v=fr2s2Xsy6_4](https://www.youtube.com/watch?v=fr2s2Xsy6_4)

</comment><comment><USER15> I've been watching that "Loading…" for several minutes now.

Are there any browser requirements that Safari isn't fulfilling? An error message would have been nice.

<comment><USER16> I also had problems making it work in Safari. Firefox worked for me.

</comment></comment><comment><USER17> Been tinkering with this and it is a pretty solid focus stream! Bookmarking.

</comment><comment><USER18> TIL Muzak was founded in 1934.

</comment><comment><USER19> I love the concept and the user interface very much!

</comment><comment><USER20> Wow, that is a small font. Consider resizing for larger screens?

</comment><comment><USER21> Sounds great!</comment>