'Patient zero' in cyberattack on UN aviation agency was official's son (2019) - <AUTHOR> https://www.cbc.ca/news/canada/montreal/icao-patient-zero-cyberattack-whistleblower-1.5223883 <comment><USER2> From a CBC article linked in the story above: "This attack had all the hallmarks of a classic "watering hole" attack, in which hackers find a website that their targets frequent and infect it with malware in order to gain access to those targets. "

is there any more detail on the specific malware infection and if it was, in fact, a "watering hole" attack or if they simply don't have a clue how this happened and have called it this simply so there's a plausible explanation?

<comment><USER3> An earlier article says that watering hole attacks are a common attack method used by the group, but that they probably already had access to the network, just not to specific individuals computers.

[https://www.cbc.ca/news/canada/montreal/emissary-panda- chine...](https://www.cbc.ca/news/canada/montreal/emissary-panda-chinese- hackers-cyberattack-icao-1.5034177)

</comment></comment><comment><USER4> (From July 2019)

Looks like Vincent Smith (the whistleblower) was fired in Dec 2019.

[https://whistleblower.org/press-release/press-release-un- int...](https://whistleblower.org/press-release/press-release-un- international-civil-aviation-organization-fires-cyber-security-whistleblower- after-u-s-withdraws/)

<comment><USER5> _Those responsible for the termination decision include the two subjects of Smith's complaint, Secretary General Fang Liu and Council President Olumuyiwa Benard Aliu_

Of course, we've no idea of other personal and political dynamics between the complaint subjects and the whistleblower, but at least on this summary, something stinks.

</comment></comment><comment><USER6> " _Smith writes that he was told in a Feb. 25 email from ICAO 's chief information security officer, Si Nguyen Vo, that the laptop of a former ICAO IT officer, Maxim Aliu, was infected while he was on a trip to the agency's regional office in Beijing in 2010._

" _Maxim Aliu is the son of ICAO 's current council president, Olumuyiwa Benard Aliu, who was Nigeria's representative on the council in 2010._"

The "official's son" in the headline is misleading. This isn't the case of someone's child hosing up their laptop.

It may, however, be a case of nepotism and gross organizational idiocy.

<comment><USER7> It's not misleading at all. Mentioning "son" in this context was to imply nepotism, not to attempt to mislead the reader into thinking the son is a child.

<comment><USER8> After reading only the headline, I for one assumed it was the official's child, so it's at least somewhat misleading, perhaps not intentionally though.

<comment><USER9> At least personally, I generally don't assume son or daughter imply age. It's just the relationship. Here's an example headline where the son was almost 100 years old[1]:

> JRR Tolkien's son Christopher dies aged 95

[1] [https://www.theguardian.com/books/2020/jan/16/jrr- tolkiens-s...](https://www.theguardian.com/books/2020/jan/16/jrr-tolkiens-son- christopher-dies-aged-95)

</comment></comment></comment></comment><comment><USER10> Two systems of justice in many countries ... one for the have's and one for the have-not's.

In Massachusetts, Governor Charlie Baker's son was not even arrested:

[https://www.bostonherald.com/2019/04/05/da-rachael- rollins-s...](https://www.bostonherald.com/2019/04/05/da-rachael-rollins- slams-gov-baker-says-his-son-got-special-treatment/)

</comment><comment><USER11> Fucking up is one thing.

Getting involved in a coverup of that fuckup is quite another.

Gonna guess Prez Aliu never read his kid the popular bedtime story of Tricky Dick And The Cuban Thieves. That one ended in boiling oil too.

</comment><comment><USER12> Is a messed up and corrupt organization anyways.

Taiwan was one of the founders and replaced by China and Taiwan is forbidden to join the meetings. China is leading and they now have full control over the worlds flight data.</comment>


Show HN: Davine – An open-data social analytics site for Vine - <AUTHOR> https://davine.co <comment><AUTHOR> Hey HN. Slowly over the past year, I've built Davine on the Google Cloud infrastructure to allow Vine content creators to see where and how their profile has grown over time. Davine is just a side project I whipped up to get experience with Google Cloud and using Go for a slightly larger project than I typically was. I've learned do's and don'ts for next time, so I'm already happy with it.

The current idea was to be 100% open-data, open source, ad-free, open ops, etc. to build a following who would get use from the service. Then, introduce data analysis offerings and offer to watch detailed posts as well for a small fee to turn some revenue.

Let me know what you think or if there's any potential at making this thing self-sustaining enough to just keep it alive and worthwhile.

Thanks!</comment>


CNBC Debate on HFT: Michael Lewis, Brad Katsuyama et al [video] - <AUTHOR> https://www.youtube.com/watch?v=RcpmHyPD_PY

<comment><AUTHOR> Interestingly enough: BATS exchange had to issue a statement refuting what William O'Brien (global markets president, BATS) said during the heated debate in regards to how some of the company's exchanges price stock trades.

[http://blogs.wsj.com/moneybeat/2014/04/03/bats-forced-to- cor...](http://blogs.wsj.com/moneybeat/2014/04/03/bats-forced-to-correct- statements-by-president-obrien-on-how-its-exchanges-work/)</comment>


For every $1 of Bitcoin converted into cash, up to $25k of wealth is destroyed - <AUTHOR> https://greyenlightenment.com/for-every-1-of-bitcoin-converted-into-cash-up-to-25000-of-paper-wealth-is-destroyed/ <comment><USER2> This is horseshit analysis of an intriguing concept.

Markets create wealth out of thin air and can destroy wealth with nothing to show for it.

A lot of analysis of cryptocurrencies, stock markets and commodities wrongly assumes that if an asset's value increases $1 billion, then $1 billion more was purchased than sold.

But assets aren't bank accounts that store flows of money. Stuff is only worth what people will trade for it, so markets routinely create and destroy wealth independent of the money flows.

</comment><comment><USER3> Irrespective of whether people agree to the analysis or not, it is interesting that most replies focus on wealth destruction. All the while not checking the actual heading, which is:

"for every $1 of Bitcoin converted into cash, up to $25,000 _of paper wealth_ is destroyed"

So, the blog writer is aware of what wealth is lost and it might not be actual.

</comment><comment><USER4> Sorry but how is the wealth destroyed exactly? That wealth isn't destroyed, it's transferred to the earlier adopters who sold the crypto-asset for legal tender/currency. It's true that it's removed from the crypto-assets ecosystem, the losses falling on those at the end of the Pyramid-Ponzi schemes.

<comment><USER4> Thanks for the 2 downvotes strangers - curious why and what vested interest you likely have in crypto-assets structured as Pyramid-Ponzi schemes. Would love to get a qualitative response instead of quantitative downvotes, the whole point of conversation..

</comment></comment><comment><USER5> Extrapolations upon extrapolations proves nothing.

Furthermore, the author selects moments in time to illustrate losses. But take a one year or larger view, and one could argue that an enormous amount of wealth was created overall.

</comment><comment><USER6> Is there any actual proveable science or math behind this post, or did the author just pull these numbers out their arse? I'm leaning towards the latter, but I'm hoping someone more knowledgeable here can confirm.

<comment><USER7> "latter", not "later"

<comment><USER7> The mistake was corrected. Please stop punishing me with downvotes.

<comment><USER6> > Please don't comment about the voting on comments. It never does any good, > and it makes boring reading.

Also, you had downvotes before I fixed my typo (thanks btw!), so I doubt that had anything to do with it.

</comment></comment></comment></comment><comment><USER8> It isn't destroyed, it is a temporary price change on that exchange. What a terrible analysis.

</comment><comment><USER9> Yes, this is how markets work.

</comment><comment><USER10> This entire post reads as incorrect and misleading to me. Here are some examples that stood out:

>Based on the order book, instantly selling 100 Bitcoin ($1,000,000) on GDAX will cause the price to instantly fall about 1%.

This is very misleading. Although the price would be 1% lower for a brief moment, it would be brought back up by more orders from buyers and arbitrage bots. As sellers market sell into the order book, additional orders are placed, both on the buy and sell side. You cannot crash bitcoin that easily, but you can absolutely flash crash it and lose your money like an idiot as it goes back up instantly.

>GDAX is the biggest exchange by liquidity as measured by market order book depth.

This is very misleading. If you lower the price on one, the others need to follow, and arbitrage bots will assist in that. GDAX is nowhere near #1 on volume as you can see on [https://coinmarketcap.com/exchanges/volume/24-hour/](https://coinmarketcap.com/exchanges/volume/24-hour/). The author mentions this later however seems to conclude that it will only result in the price going down, instead of up.

>The recent $400 million Bitcoin purchase was likely done off an exchange.

There's no evidence that this buy actually occurred. People just noticed a wallet had many bitcoins sent to it, and news outlets decided to report it as 'Anonymous Billionaire Stocks up on Bitcoin', because that's what news outlets do.

>Overall, to reiterate, no one is making money with crypto currency anymore

This is obviously false. For every buyer there is a seller. Plenty of traders have had large short positions for a large duration of the recent crashes and have profited substantially. As far as Bitcoin goes, it's up 100% from where it was just awhile ago, at the bottom of this most recent crash. I'm not defending it as a revolutionary investment in 2018, but a LOT of people are making money here and will continue to do so.

>Maybe I'm being too hard on him, but analysts need to be held accountable for being wrong.

How would you prefer to hold them accountable? No analyst can be correct all of the time, it's unreasonable to punish them for their opinion or prediction being incorrect. No one is forced to invest based off of their advice.

The price of cryptocurrencies can be manipulated but not this easily. It requires substantial amounts of money. The largest buys and sells are OTC which don't affect the orderbooks. Just today Bitcoin has had over 6 BILLION USD in volume ([https://coinmarketcap.com/](https://coinmarketcap.com/)). Your 1 million USD does not matter and the market doesn't care about it. I understand the author has some negative sentiment towards Bitcoin either becuase he lost money on it or he's upset at others that made money on it or are otherwise too far on the hype train, but this post is still very misleading or otherwise just false.

</comment><comment><USER11> FUD much?

</comment><comment><USER12> someone failed thinking 101

</comment><comment><USER13> this is good for bitcoin

</comment><comment><USER14> Still hodling here</comment>


What Daniel Steigerwald would recommend instead of Angular.js - <AUTHOR> https://medium.com/este-js-framework/what-i-would-recommend-instead-of-angular-js-62b057d8a9e

<comment><AUTHOR> Posting because I found it interesting. Still forming opinions myself.

<comment><USER2> Would be nice to see some rationales. For example, you could npm install Mithril.js and get a lot of the things mentioned there without wasting time evaluating options.

The main criticism I have of that list is that he dismissively says "or anything else" (or drops a bunch of project names). Why should one pick Browserify or why should one pick Webpack or Duo or...? The paradox of choice is one of the main reasons people just go w/ Angular.</comment></comment>


Explanations of common Java exceptions - <AUTHOR> http://rymden.nu/exceptions.html

<comment><USER2> Unfortunately, there's nothing funny to see here, please move along.

</comment><comment><USER3> Most of the exceptions are funny enough on their own. Especially NullPointerException.

</comment><comment><USER4> oops. javadoc still can't catch typos:

Turn off your computer and go out and get som exercise.</comment>


How many of you have taken an Autistic Spectrum Quotient Test? - <AUTHOR> http://glennrowe.net/BaronCohen/AutismSpectrumQuotient/AutismSpectrumQuotient.aspx Some of my family have made comments about me showing traits of being higher up on the autistic spectrum than average. So I decided to have a quick go of an 'online test'... yes I know it's probably not very accurate and is no substitute to talking to a professional, I was just interested and not too bothered if I am or not.
I 'scored' a 33 which apparently puts me in the Aspergers range.
Would be interesting to see how many of you are also above average on the spectrum... <comment><USER2> A difficult test. Mixing positive and negative statements. You need to be autistic to get all answers right ;-)</comment>


Pain in fish - <AUTHOR> https://en.wikipedia.org/wiki/Pain_in_fish <comment><USER2> Unfortunately nobody will ever really know.</comment>


How Multi-Beam Flash Lidar Works - <AUTHOR> https://www.ouster.io/blog-posts/2018/11/8/how-multi-beam-flash-lidar-works <comment><USER2> This is a pretty incredible achievement. Be sure to follow the #3 "High quality ambient imagery" link too, if you haven't seen it before:

[https://www.ouster.io/blog-posts/2018/8/31/the-camera-is- in-...](https://www.ouster.io/blog-posts/2018/8/31/the-camera-is-in-the-lidar)

<comment><USER3> Relevant HN discussion about that post: [https://news.ycombinator.com/item?id=17896942](https://news.ycombinator.com/item?id=17896942)

</comment></comment><comment><USER4> > _And since we're asked about it occasionally, the lasers we use are well > under the eye safety limit and have been certified as Class 1 eye-safe > lasers by third party labs._

Oh geeze. I've never even considered the fact that there's a possibility looking at these cars might cause vision issues!

<comment><USER5> It might be fun to come up with the probability of a worse case scenario, like parked on the crest of a hill in bumper to bumper traffic.

Although probably not practical to worry about in reality, there is some probability that all 200 cars you could see shine their lasers directly into your eyes at the exact same time. There is some probability of accidentally receiving a momentary higher than safe combined pulse from multiple vehicles.

<comment><USER6> There are wavelength that are invisible to human eye, those are pretty safe unless the energy levels are high enough to burn a hole in your retina.

Then there are wavelength that aren't focuse by the eyes, the only way to get hurt with these if the energy reaches weapon-grade levels.

<comment><USER7> Actually, some non visible wavelengths are dangerous because they don't make you blink.

<comment><USER8> A lot of infrared lasers are dangerous because of this. Blink response is part of the reason visible lasers are classified differently than invisible lasers.

</comment></comment></comment></comment></comment><comment><USER9> A big accuracy problem with flash approaches is multi path interference.

[https://www.microsoft.com/en-us/research/wp- content/uploads/...](https://www.microsoft.com/en-us/research/wp- content/uploads/2016/02/chr_mpi_cvpr_15.pdf)

I wonder if Ouster is susceptible to this. There's no mention of it, but I imagine it will be a bigger problem as they add more lines of resolution.

<comment><USER10> This.

Through my work (shameless plug: www.dotproduct3d.com) I've assessed a fair number of "Time of Flight" 3D sensors (which also use flashes of IR light -- but aren't really time-of-flight but that's another story) and, while generally pretty cool, all of them so far have suffered more or less severe multi-path effects. Which is why stereo / structured light or single-point LiDAR are still better for a lot of use cases. I can't wait for these MPI problems to be finally solved.

<comment><USER9> It should be a smaller problem than with the Kinect. The Kinect is not true time of flight like you said, whereas ouster is. If you know when photons actually arrived you know the first light pulse you receive is the one you care about, and the later longer paths you can ignore. The Kinect conflates these.

So, I don't think it will be a problem for them but it is something they need to consider when designing their DSP.

<comment><USER11> This makes me wonder how any of these systems handle the reflective surfaces of cars.

So you hit a chrome bumper or maybe a glossy black point. The later pulses could arrive at a much higher amplitude.

<comment><USER12> They don't care about the amplitude, just the timing.

<comment><USER11> They're measuring the time to some amplitude at the sensor. There must be some amplitude threshold, otherwise would trigger on noise.

<comment><USER12> The reality is somewhat more complicated than that. Signal processing at this level is statistical in nature, so the threshold itself is effectively timing- driven.

Hard to explain in a few words, but the principle of the lock-in amplifier is a good place to start.

<comment><USER11> I still don't understand how there is no threshold based on amplitude (correlation or not). Something like mist would show up as a noise floor, a speck of dust (that hangs around for long enough) may be one peak, a mirror another, and an object seen in the mirror will be another. You will have multiple peaks that may stay around longer than others and, but there will still be peaks, one of them being the "true" surface.

I don't see how there is no threshold.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> What happens when multiple lidar devices start shooting laser beams at a scene? Will there be interference?

<comment><USER3> Compared to other sensors, lidars are not that prone to interference because:

* it only takes 1 microsecond to make a ranging measurement up to 150 m, so your detector is on for a short time

* lasers only illuminate a small spot, and the detector is also looking at a similarly small spot, so it is unlikely for two lidars to point in the same spot

Now, even if it does interfere, you may see a stream of random points pointed towards the interference source. This may happen if, say, you point a lidar directly at the sun, or if you have multiple lidars mounted on the same vehicle. Such random points are easily rejected as outliers and do not affect the vast majority of the scene. Most self driving cars (I hope) should have outlier rejection schemes that deal with outliers caused by this and other sources, such as snow, smoke, and so on.

For this reason we see many self driving cars bristling with a bunch of lidars next to each other with no problems. For example the Cruise/GM ones have five Velodynes on top.

<comment><USER14> There's a case for adding some jitter, maybe 10us, to the laser timing. That prevents any attacker from synchronizing a jammer. Common technique in military radars. If you can't synch, you can't present an illusion of something being closer than it is, and any return from a real obstacle will come in before a jamming signal from a further away transponder or mirror.

Active systems like radars have a "burn-through" short range - at some short distance, the sensing system overpowers a jammer. So if you're seeing junk at distance, but good signal at short range, you know you're being jammed and have to slow down.

Active jamming is not that effective against things that receive directionally, as people using car "radar jammers" near military bases sometimes discover. They show up on military radars as hostile targets. That's even filtering down to police LIDAR guns.

</comment></comment></comment><comment><USER15> I don't think 850nm is a good choice for LIDAR for several reasons. Firstly, the article talks about absorption but that's not the only phenomenon that they need to be concerned about. The other is scattering and 850nm will scatter from particulate matter in the air (like water vapor in fog) and suffer reduced range.

The 2nd reason why 850nm sources are not a good choice are VCSELs themselves. VCSELs are low power devices and always will be due to the narrow current aperture in their construction, you simply can't send much current through it because even at low currents the current density is already very high. The 850nm wavelength is also limited in how much output power you can get and still have an eye safe device. Additionally, VCSELs do not work well at high temperatures. Their LIV curve bends over meaning that the combination of reduced slope efficiency and self heating of the junction cause the output power to decrease as you increase current beyond a certain point.

Lastly, VCSELs are relatively noisy devices. VCSELs are not single spatial mode devices and there is mode partition noise caused by the sloshing around of power between the various modes. When combined with RIN, this places an Upper bound on the SNR of the system. Finally, if you are already doing photon counting, you're pretty much at the limit of this tech already.

To my mind, longer wavelength tech is more promising because it can use higher powers and still be eye safe, has better immunity to scattering in various atmospheric conditions which gives it longer range. Longer wavelengths can leverage technologies like silicon photonics to produce more advanced detectors (coherent detectors which will be more sensitive and improve range). Generally the lasers at these wavelengths are less noisy as they've been optimized for decades for use in long distance communication.

<comment><USER10> As far as I know detection SNR goes way down with longer wavelengths. I think luminartech.com claims that they have specific IP to make this work, but apparently it's a hard problem, otherwise everybody would be doing it already.

</comment></comment><comment><USER16> Really wish 3d lidar costs would come down. Everyone is designing for car performance and price points it seems. I have a ton of applications I could throw one of these on at 1k$.

<comment><USER17> If you don't need 3D, 2D LIDAR is pretty cheap right now: [https://www.adafruit.com/product/4010](https://www.adafruit.com/product/4010)

<comment><USER3> That one only has 12 m range. The 2D lidars from Hokuyo, SICK, etc with similar range to the Ouster OS-1 (which has 140 m range) cost thousands of dollars.

</comment></comment></comment><comment><USER14> Nice. Not really here yet, but the semiconductor physics sounds promising. The device they're actually selling is yet another spinning scanner, not a true flash unit.

<comment><USER18> What are your thoughts on Geiger LIDAR, ie Princeton Lightwave (which was acquired by Ford/Argo)?

<comment><USER19> SPADs (single photon avalanche photodiodes) _are_ APD's operated in Geiger mode...

</comment></comment></comment><comment><USER20> I'm curious how these systems would function against a malicious entity. For example, if someone flooded the sensor with laser light.

That sort of behavior might be made illegal (if it isn't already), but I'd be curious to know if self-driving systems have ways of dealing with it, or if they just shut down

<comment><USER3> It's pretty illegal to point lasers at vehicles. Many states and countries have laws against that. For example, in California,

California Penal Code Section 417.27

(c) No person shall direct the beam from a laser pointer directly or indirectly into the eye or eyes of another person or into a moving vehicle with the intent to harass or annoy the other person or the occupants of the moving vehicle.

<comment><USER21> It is illegal for a _laser pointer_ , where most people defer to the FDA definition of "... handheld lasers that are promoted for pointing out objects or locations."

There is already established case law around this, where larger hobby lasers intended for popping balloons and theatrical lasers are exempt.

You could build a large array of laser emitters intended to obstruct self driving vehicles (say you wanted to create a fake wall to prevent a car from driving the wrong way), and safely ignore these laws.

<comment><USER22> > It is illegal for a laser pointer, where most people defer to the FDA > definition of "... handheld lasers that are promoted for pointing out > objects or locations."

No the law in question defines the term, it doesn't defer to the FDA; Cal. Penal Code § 417.27(f): « _As used in this section, "laser pointer" has the same meaning as set forth in subdivision (c) of Section 417.25_ »

Cal. Penal Code § 417.25(c): « _As used in this section, "laser pointer" means any hand held laser beam device or demonstration laser product that emits a single point of light amplified by the stimulated emission of radiation that is visible to the human eye._ »

<comment><USER21> If you read the definition you just quoted at me, it is basically the same.

Any device that emits more than a single point of light, or is not hand held is not covered.

</comment></comment></comment></comment></comment><comment><USER23> super neat stuff, I visited their offices recently and was really impressed by what they were doing. From what I can tell, everything was done in house

</comment><comment><USER24> Is something like phased array lidar useful? The wavelength is so small I could see how the interference patterns might not be useful

</comment><comment><USER25> How dangerous are these lasers?

If hundreds of cars will have them, your eyes will be scanned multiple times per day.

<comment><USER26> Laser safety is a well known issue, IEC60825 offers mathematical models to calculate the safety category (e.g class 1/2) of a laser device, which are based on physics models of the eye from first principles and empirical data. There is nothing particularly special about LIDAR lasers that makes these models not valid as far as I know. Generally, there is a tradeoff between exposure time and intensity, so LIDAR systems have redundant hardware methods to ensure the pulse time is not exceeded.

Any laser product generally has to be tested to IEC60825 to check which category it fits within, under the safety rules of the jurisdiction (e.g. CE for EU, FDA for USA). This LIDAR system would have to pass that too, and it should be reasonably easy for them to check if it would when developing it.

<comment><USER27> The laser isn't tested to IEC60825. Instead the manufacturer (Oester in this case) would submitted information about the laser scanning system design to the FDA to get approved as a Class 1 device.</comment></comment></comment>


The height limit of a siphon - <AUTHOR> http://www.nature.com/articles/srep16790 <comment><USER2> A longer summary: the maximum height of a siphon pumping water, at sea level, predicted by barometric pressure is about 10m.

But the tensile strength of water is nonzero (a surprise to me) and that is enough to allow much higher siphons if you first remove dissolved gases from the water.

The paper speculates that several hundred metres may be possible, perhaps even more. The paper also describes an actual experiment where they showed that a 15 metre high siphon works in practice.

<comment><USER3> What are the practical implications of higher siphons?

<comment><USER4> IANA fluid dynamics expert, but it seems to me that for certain designs which move water by creating a lower pressure at some point inside of a pipe you've created a "siphon" in a general sense. If that's true, this could affect certain water pump and plumbing designs, albeit this degassing process may be prohibitively expensive.

<comment><USER5> Closed circulation central heating systems are degassed. Though, the water is hot there so boils much more easily. Maybe closed circulation cooling water systems...

</comment></comment></comment></comment><comment><USER6> Relevant xkcd what-if: [http://what-if.xkcd.com/143/](http://what- if.xkcd.com/143/)

<comment><USER7> Except he has gotten it wrong hasn't he?

Which I guess is why this is trending.

<comment><USER8> His note [5] links to [https://www.youtube.com/watch?v=8F4i9M3y0ew](https://www.youtube.com/watch?v=8F4i9M3y0ew) which is a demonstration of a siphon in a vacuum, so he's covered :)

<comment><USER9> But working "a little bit" as the note says is a good way off from working an order of magnitude or two better.

</comment></comment></comment></comment><comment><USER10> My summary: the limit is much higher than can be predicted by barometric pressure because of the tensile strength ("surface tension" of water)

</comment><comment><USER11> So this is why I couldn't siphon (gray) water from my bathtub on the third floor to water plants in the yard, not lack of moral fortitude. Great!

<comment><USER12> No, unless the water had to _rise_ 10m from your bathtub before descending. If it only had to rise enough to climb through a window before descending to your yard, then that is not enough to produce the problem in the article.

The problem described is that water cannot be lifted _up_ more than 10m (due to air pressure pushing on the bath side not exceeding the weight of 10m of water in the hosepipe), not pulled down on the far side.

<comment><USER13> yet but no..

1\. bottom of siphon outlet has to be sealed by the surface of water held in a container.. and

2\. and height of long side must less that atmospheric pressure in height from said surface of water

or water column on down side will break and draw will be lost

<comment><USER14> But the bottom side of the siphon doesn't have to be the bottom of the system. Run the tube up 1m to the window and back down out the window perhaps 3m to a bucket on the porch roof - an easy, simple, working siphon. From that bucket, you can use a regular positive-pressure bottom drain to go down as far as you like.

</comment></comment></comment></comment><comment><USER15> I love this classic science. Theoretically this experiment could have been performed in the 19th century!

</comment><comment><USER16> This is why water is pumped from below pushing up rather than pulling from the top. But perhaps this will open up new ways to make water pumping more efficient.</comment>


Show HN: Highscore.money – Pay your way into the highscore - <AUTHOR> https://highscore.money <comment><AUTHOR> A while ago I was thinking about how people spend a lot of their money on impressing others. Fancy clothes and jewellery, the red sports car, etc. Really all it is, is showing off how much money you've got to waste.

I like to make things more efficient, so I came up HIGHSCORE.MONEY – A public scoreboard you can participate in by simply paying. The more you pay, the higher you're place in the scoreboard.

Of course, it's a bit silly, but people can be silly at times so I figured I'd give it a shot and see what happens.

Curious to hear what the HN community thinks.

<comment><USER2> >A while ago I was thinking about how people spend a lot of their money on impressing others. Fancy clothes and jewellery, the red sports car, etc. Really all it is, is showing off how much money you've got to waste.

Except often "fancy" clothes simply fit better, are better made. Sports cars can be fun to drive. Those are certainly not a "waste" of money, assuming you have the money to spend, of course.

It's really not all that black and white.

I love the site though, clever.

<comment><AUTHOR> Valid points for sure. I should have worded it less strongly.

</comment></comment></comment><comment><USER3> Good work on setting this up.

I think I've heard of a similar concept before, but using t-shirts. Setup an "exclusive" t-shirt range, of nice cotton white t-shirts.

The t-shirt would include a picture/logo/design, which was $X - where $X was whatever amount you wanted to pay for the t-shirt.

So you could walk around with a t-shirt that said $100 - or you could walk around with a t-shirt that said $1,000,000 - and people would you know you spent $1m on that t-shirt...

<comment><AUTHOR> Haha yes I've had similar ideas before. The problem with that though is that they can be easily faked (e.g. anyone could design/print a $1,000 t-shirt). – It's also less like to go viral than something online. That said, I like how it brings the idea to the physical world.

<comment><USER3> Yeah - that's what I thought when I heard the idea as well - someone just prints the same t-shirt with $1b - and the concept it gone.

But your idea keeps it exclusive...

Good luck! :)

</comment></comment></comment><comment><USER4> Reminds me a bit of the old Million Dollar Homepage: [http://www.milliondollarhomepage.com/](http://www.milliondollarhomepage.com/)

<comment><AUTHOR> Yep. That was a great concept and one I wish I thought of myself. I've seen many copies, but they never take off because it's not original anymore and it's hard to get press coverage.

I hope HIGHSCORE.MONEY is different enough. We'll find out in the next 24 hours I guess.

</comment></comment><comment><USER5> The problem with this as gamification is that there is zero ability to play for less than the current high-score. That is a real problem: suppose 500 people were wiling to pay close to, but not over, $10, but hardly anyone was willing to pay over $10. If 15 people have paid $10 it now prices anyone wanting to pay up to $10 completely out of visibility. Since we said there were 500 such people, you lose $5,000 while making 15 * 10 = $150. That's a real design problem. Pay-to-play should give everyone something.

<comment><AUTHOR> Interesting perspective. Right now you can still get 'value' out of it by paying less than the #1 spot, since the first few spots are still highly visible too. That said, your logical reasoning still applies. I'm not sure what a better solution would be though. A leaderboard works because it's exclusive.

<comment><USER6> You could lower the current score by one cent every x seconds

<comment><USER7> that's a really cool idea.

<comment><USER8> The idea of a permanent score is what inspired me to pay, though. A steadily declining score doomed to fail wouldn't have felt nearly as cool.

</comment></comment></comment></comment></comment><comment><USER9> This is basically a pay-to-win game simplified down to the leaderboard.

I hate pay-to-win games. They do have an uncomfortable similarity to the real life though.

<comment><AUTHOR> Exactly. Thanks for putting it this way. I couldn't find the right words, but it's indeed the most stripped down version of pay-to-win.

</comment></comment><comment><USER10> I kind of hate this, but I still paid you $22 because it's actually awesome.

Nice one! Maybe donate the funds to charity?

<comment><AUTHOR> Haha thanks :)

I specifically chose not to donate the funds to charity, since I don't want to provide any value in addition to be being featured in the highscore list. Otherwise it would become about who's most charitable. An interesting too, but a different concept altogether and I'm not sure it's one that would work. (it's not ridiculous enough)

<comment><USER10> Seems like scores are not cumulative based on email.

:-(

<comment><AUTHOR> That's true. Is there anything on the site that indicates this? If it's unclear I want to make sure to clarify that.

The reason it's not cumulative, is 1) to keep things simple, and 2) I feel it's morally objectionable to add such a strong game mechanic as I imagine people would keep 'upping' their score in order not to lose their spot.

</comment></comment></comment></comment><comment><USER8> Just paid $30 to get Radio Silence to the top, out of pure interest in how much traffic that'd bring. Well played!

<comment><USER8> Aww, the link automatically points to the http version instead of https. No referral data in analytics.

Can we get a <meta name="referrer" content="always"> or maybe a way to edit the link?

<comment><AUTHOR> Thanks for the suggestion!

I added the meta tag and updated your link to HTTPS.

<comment><USER8> Thanks!

</comment></comment></comment></comment><comment><USER11> Reminds me of the $500,- BlackBerry clock app: [http://crackberry.com/500-desktop-clock-app-blackberry-i- was...](http://crackberry.com/500-desktop-clock-app-blackberry-i-was-dumb- enough-buy)

<comment><USER12> Anybody else remember the I Am Rich app for the iPhone?

[https://en.wikipedia.org/wiki/I_Am_Rich](https://en.wikipedia.org/wiki/I_Am_Rich)

</comment></comment><comment><USER13> I love this idea, it would probably look better if it was for charity though.

</comment><comment><USER14> This could be the new [http://milliondollarhomepage.com](http://milliondollarhomepage.com) of this decade.

<comment><USER15> Or social network for hi net worth individuals

</comment></comment><comment><USER16> I wanted to pay $0.01 to stay at the bottom of the list, but the minimum is $1 ... Sad :(

<comment><AUTHOR> Actually the minimum is $5. Because of the credit card fees and associated accounting work anything lower than that doesn't make much sense.

<comment><USER16> Got that ;) Was just looking for ways to "trick the system"™

<comment><AUTHOR> Haha love the creativity

</comment></comment></comment></comment><comment><USER17> I've paid a cent, and it threw an error in my face, and didn't show up :(

<comment><AUTHOR> When you enter an amount below $5 you'll get an error message telling you the amount is too low. You won't be able to enter your credit card details and thus won't be charged.

<comment><USER17> Unless, as I did, you mess with the JS a bit. I don't know if stripe allows you to set a minimum on their side, so perhaps there isn't anything you can do to prevent that. Anyway, enjoy my 1 cent :)

</comment></comment></comment><comment><USER18> I hope that the internet will meltdown once enough has been collected

</comment><comment><USER19> have you thought about adding a visits count? would give an indication of what you are buying...</comment>


BlackBerry PlayBook 7" tablet review - <AUTHOR> http://philip.greenspun.com/wireless/playbook

<comment><USER2> Should be titled - Why RIM is Dead.</comment>


*p+++=0x20, for when you are converting an uppercase string to lowercase - <AUTHOR> https://twitter.com/volatile_void/status/1112073387860549634 <comment><USER2> Back in the day we used to use OR 0x20 for tolower, and AND 0xBF as a quick toupper (straight up bit masking). It saved a bunch of clock ticks by not having to compare each character and jump past an ADD or SUB every time the letter was already in the desired state.

Of course you could XOR 0x20 if you wanted tO rEVERSE tHE cASE, but I'm not sure how useful that is.

</comment><comment><USER3> Assume ASCII characters: ORD('a') - ORD ('A') = 32

IF ('A' <= ch) & (ch <= 'Z') THEN ch := CHR(ORD(ch) + 32) END</comment>


The Drag Coefficient Scoring System: what size startup is right for you - <AUTHOR> http://www.humbledmba.com/the-drag-coefficient-scoring-system-how-to-de

<comment><USER2> I have to say, this is utter garbage. Or, it's an interesting concept poorly thought out and implemented.

You get "a point" for having a significant other or a serious relationship? Well, what if your significant other (like my wife) is a very smart person you can bounce ideas off of, and makes enough money on their own to pay all your basic bills and living expenses (also canceling out your +1 for a mortgage drag point)?

And you get 1 point for every 5 years after 20? Maybe make 30 the baseline there, but really that whole calculation is just off. When I'm hiring someone at a startup I tend to cringe at the 25-and-under crowd with startup stars in their eyes and no experience. THEY are drag on the organization because the majority of them don't know how to work independently and don't know what the company is supposed to look like in 5 years, so they lack a lot of vision and understanding (sorry if this offends anyone reading this, but I've always advocated that people get some real-company experience BEFORE joining a startup).

I can see how the kids thing might cramp things a bit (in theory I guess, I don't have any kids, so no real experience there).

I also wouldn't recommend that someone rush into their next venture after something else winds down or blows up (as the author of this article did). That seems like a great formula for making poor decisions, fighting some invisible ticking clock.

Ugh. I hope nobody actually takes this article too much to heart.

<comment><USER3> Yeah, but it's a cute way to kill time while awaiting Knuth's announcement.

<comment><USER4> Yep, same here waiting. To spice things up I decided to twiddle my thumbs backwards and count in multiples of 14.

</comment></comment></comment><comment><USER5> Based on people I've seen, I'd replace "1 point for every 5 years after the age of 20" with "1 point for every 3 years in full-time employment". I think a 25 year old newly minted graduate who is used to living a "student lifestyle" has far less drag than a 23 year old who has spent the last 3 years working full-time and enjoying money.

<comment><USER6> I don't get why drag is so proportional to age. Yes, older people have more drag (family, mortgage, etc.) but these factors are already accounted for. I am 40, so get a drag factor of 4 points right there, but do not own a home. Why should I get more drag than the 25 year-old mentioned in the article with a mortgage?

<comment><USER7> I'm also pushing 40, and part of my hesitation is the opportunity cost. Will I seriously regret foregoing a year of market rate salary during my peak earning years, when I only recently got a clue and started saving? I'm also less blasé about doing without group health insurance than I used to be, just from watching people age (and CORBA only lasts so long).

</comment></comment></comment><comment><USER8> For what it's worth, I had a 'drag' score of 7 when I founded my startup. Without a wife and a child to motivate me to try harder, and without 10+ years of experience in technology, I would never have been able to accomplish half of what I've done.

<comment><USER9> Interesting. I would like to know more about your accomplishments. I am pretty sure others here would agree. It's not every day that we find successful examples,and the general consensus has been that people over 40 are "not stupid enough". You can be a role model for us. At least to immigrants, it should be pretty comforting, considering the fact that it takes almost 10 years fo asians (esp Chinese and Indians, I am not sure what the numbers are like for others.) before they get a green card, and are free enough to move from one company/ city to another, without risking getting deported from US.

I am 26, and my professor was quite clear. He said you have maybe a couple of years when you can take all the risks and pursue your startup dream. (Yes, my score is 1 and I am still close to failing. How about that...)

Would really appreciate sharing your accomplishments to inspire and give hope to people, telling youngsters they have more time than they think they do, and more experienced ones the push they might need to make that jump.

<comment><USER8> I started my business on my own (and that's one of the downside of starting late, none of my friends where up for this kind of adventure, plus I'm an expat, so the people I knew and trusted best were 4k miles away), so I did everything myself: web development, graphic design, business, legal stuff, etc.. I'm by no mean an expert in any of these domains, but it's all stuff I've done at one point or another in my career. I build the thing, got customers, and was lucky enough to find a few good people to help me run this thing.

If you're going to wait before going on your own, just make sure you get the most out of your job. Avoid boring and routine stuff, venture out of your comfort zone, learn skills beyond your own specialty.

<comment><USER9> I don't think that starting late would have been your issue. Most people tend to avoid risks, and like to live easier life any given day. I am 26, and I asked my friends to join my startup when I was 25, still no one seems to want to take that risk. Also, location might be a big factor. Here in Dallas, Texas, not many people want to jump into startups straight away. In my case, the problem was also not so well defined, and there's not too many people working on this. Except some BIG corps.

I am also doing everything myself, until this point at least. i do have a co founder, but he is a busy man (Department head of CS form my university.)

I am also doing everything alone, that too on the side (I had to start doing a job some 6 months after starting my startup, due to financial and immigrations issues).

So, here I am , a 26 year old, immigrant startup founder, who doesn't know how to get more people (or if I want more people). I am getting to know and learn a lot more, and I am doing it very cheap. So successful or not, personally I think I will gain a lot. My question really was due to the fact that I might be failing soon enough, and more and more I see my friends and they all SEEM to be enjoying more and relaxing more doign their regular jobs. So, I am more afraid I might not be able to do more later on, and do any more startups if this one fails.

Somewhere in my head, at least I know one person who did it in his 40s. Gives me some level of confidence that it's not too late. Also, hearing all these stats about younger guys doing it and succeeding, Zuck and the likes, doesn't boost confidence either. Quite few times, I end up thinking, maybe this is it, after I am old, I might not be able to do it, since not so many people seem to be doing successful statups, or at least we don't hear about them much.

<comment><USER8> what are you working on?

</comment></comment></comment></comment></comment><comment><USER10> I'd subtract two points for every startup you've already worked in, especially the failed ones. Every time you do a startup it does get easier. I've met a few people in Silicon Valley who were shoulder deep in their thirties, with kids, and working at their fourth or fifth startup.

<comment><USER11> Then I come out negative!

</comment></comment><comment><USER12> He forgot at least one... In my case:

Medical Issues: +1 to +inf points, depending.

i.e., I have migraines, 5+ docs to see about them, lots of pills and meds to buy, etc. Definitely getting good use out of my megacorp insurance plan & psuedo-unlimited sick leave.

Ignoring the migraines, I only have 1 point in his system, but there's no way I could do a startup right now... I had more sick hours than work hours last week.

</comment><comment><USER13> If you have a spouse (+1), subtract two points if she has a good enough job to support both of you.

<comment><USER14> The trouble with a spouse is the amount of time and attention he/she takes up in your life. If your spouse is ok with not seeing you for long stretches then I agree with you. If he/she demands a lot of quality and family time, then +1 is perfectly appropriate.

<comment><USER2> It's deeper than that. Taking time off, clearing your head, and enjoying other parts of life can allow your mind to relax and will often lead to better overall productivity.

Everybody has this idea that for a startup to be successful EVERYBODY must be thinking/working only on that business for the 4 hours a day that they are not asleep. I do not believe that argument.

</comment></comment></comment><comment><USER15> Nice to know that age and experience count against you, as does the potential 2nd income that a spouse brings in.

</comment><comment><USER16> Subtract 5 points if you studied fluid mechanics and know what a drag coefficient really is.

</comment><comment><USER17> There's something about this approach I don't _want_ to grok. This would mean that if you are young with little experience, you live in an apartment and you're alone - you should be a founder, not a part of the "hiring wave" for a more mature start up.

This also means that a more experienced, successful, and wealthy man with a small family may too be old or have too many children to start his own company. Logic should suggest that its the perfect time, when you have 25 years of experience under your belt.

Personally, there should only be two real indicators of any size start up you take: 1) what do you feel you are capable of and 2) how far you are willing to go (whatever your priorities may be).

</comment><comment><USER18> This formula is for someone who has relatively little money. Don't discount the impact of built-up netegg or trust fund baby. People who have money don't have the financial pressure to hold a job and can pursue things interested them, like starting a company. And older people who have done well tend to have a large netegg to enable them to strike out, which explain the surge of entrepreneurship in 40's.

The formula is simple: incomings - expenses = netflow; if netflow > 0, you are good to go, else if netegg/netflow > years-of-comfortable-living, you are good to go; otherwise get a job.

</comment><comment><USER19> So how does the "5 points for every 5 years above 20" stack up against the fact that most successful founders are in their 30s?

Seems like a 20-year-old's idealised conceptions of founding start-ups.

</comment><comment><USER20> There is a second peak of entrepreneurship for folks in their 40's that this does not model accurately at all. Supportive spouse is a plus. Deep domain knowledge and rich social networks are both a plus that come with age and work experience. I agree with his advice to the newly minted MBA but I think his rules of thumb break down for older entrepreneurs.

</comment><comment><USER9> Score 1, Still feel like I am close to failing. I hope I was in CA, but then again, my problem was so peculiar, and so tough ( NP-Complete), it will probably take more time to build than it might require doing other parts of business. I certainly hope so. That making it work will pay off eventually. I like to compare myself to Google guys. Only in that they tok close to three years before the search engine was good enough to take investments. Of course, I think they were smarter, so does that give me more years to work on. I hope not..

:)

</comment><comment><USER14> A few more revisions: First kid: +2 Each additional kid after the first: +1 Single parent with weekday custody: +10

</comment><comment><USER3> I score an 11. Damn.</comment>


FoldingText – Plain text productivity for Mac users - <AUTHOR> http://www.foldingtext.com/ <comment><USER2> One of the developers of Foldingtext here. Man, I was blown away to find Foldingtext on the front page of Hacker News today :)!

We're working hard behind the scenes to release the next major version in beta. It'll add a bunch of things that we feel will take FoldingText to the next level. Follow us on twitter (@foldingtext | [https://twitter.com/foldingtext](https://twitter.com/foldingtext)) if you're interested to hear about FoldingText development.

P.S. For the Vim enthusiasts, I'm really pushing to get vim support in the upcoming FoldingText beta ;)

<comment><USER3> Vim support would certainly get me to purchase this. Are you planning on using nvim as a backend or are you going to roll your own emulation?

<comment><USER2> Emulation probably. Haven't looked into nvim as a backend, will check it out.

</comment></comment></comment><comment><USER4> FoldingText isn't really a "minimalistic live Markdown focus mode" app, it's a productivity app, closer to something like Emacs' org-mode. I have no doubt that org-mode _is_ more powerful, if you're already living in Emacs. (I can use Emacs, but I just can't get into it as a way of life.)

But FT isn't really being actively developed anymore, AFAICT. The developer switched from working on TaskPaper to FoldingText and then switched back to TaskPaper. Before TaskPaper he was working on WriteRoom, which _was_ a minimal Markdown app, and sometimes it comes back and sometimes it doesn't. TaskPaper is pretty neat, but when push comes to shove it could be implemented as an extension/package for nearly any competent text editor. (And in fact has for several, including Atom. Folding Text also existed as a plugin for Atom at one point.)

<comment><USER2> We're still working on FoldingText :)! However, a lot of that has been behind the scenes as we're working on a new version from the ground up. We're hoping to start private beta in a couple of months.

<comment><USER5> Would that be a paid upgrade? I like the idea of FoldingText, but paying twice would be a bummer :)

<comment><USER2> It will be a paid upgrade. I'm sure we can work out how to migrate our customers who have bought FoldingText recently, but, honestly, we still have to figure out these aspects. Right now, we're heads-down on getting the beta out :).

Also, while FT is in beta it will have a significant discount.

</comment></comment></comment></comment><comment><USER6> This looks like iA Writer meets org-mode. It looks nice but the platform limitation is a bit discouraging for those of us that work across multiple platforms on a daily basis.

<comment><USER2> Re: the platform limitation.

This is something we're trying to address with the upcoming beta. You can follow us on twitter: @foldingtext, to get news about the beta when we start rolling it out.

<comment><USER7> As someone who uses Windows at home, iOS to "run my life", and Linux at work, I'm very interested in things that can run across multiple platforms. And as someone who regularly uses Workflowy, what are some things that FoldingText brings to the table that WF doesn't? (aka: why might I want to switch if I were able to use it across the platforms I need to have available?)

<comment><USER8> Yes, very curious how this compares/contrasts with Workflowy. Cool app!

</comment></comment></comment></comment><comment><USER9> OT:

I'd be interested to know where folding editors first originated?

We have org-mode now of course.

My first encounter was 28 years ago now - December 1989 - an in-house editor called Teddy written by "Burkhard" that we had running on Vax - for Parasolid development in Cambridge, UK - think it dated from 1987 or earlier.

<comment><USER9> Then I remember David Lavender joining Parasolid in 1992 - not liking Teddy that much - a little bit of elisp later he had folds working in Emacs. *

So folds in Emacs date from at least 1992.

* It could occasionally create corrupt folded files though, which was annoying if he checked them in to the SCM.

<comment><USER10> Yes, 1992, by a classmate friend of mine Jamie Lokier!

[https://www.emacswiki.org/emacs/folding.el](https://www.emacswiki.org/emacs/folding.el)

</comment></comment></comment><comment><USER11> Really cool project!

I'm a heavy org-mode user but one of the disappointing aspects of org-mode is that non-emacs users have a tough time contributing to documents; especially if I use advanced features like org-babel, spreadsheets, and the like.

I hold out hope that one day there will be a standalone org-mode editor for non-emacs users.

Folding Text seems to have many of the same features... I might have to check it out. :)

<comment><USER12> What do you mean "non-emacs users have a tough time contributing to documents"?

I would be surprised if FT has more than, say, 10% of the features of org- mode. If you want to restrict yourself to the basics (e.g., the 10% that FT does) then org-mode is quite simple to use.

Of course, org-mode is in Emacs, and that will turn some people away. For others, the flexibility and power of Emacs may be the main draw. I myself am someone who migrated to Emacs from Vim, primarily because of org-mode, and I now use the Evil vim emulator, which makes things quite good.

<comment><USER11> > _What do you mean "non-emacs users have a tough time contributing to > documents"?_

If I use org-mode files for anything more than markup such as org-babel, ditaa, properties, spreadsheets, scheduling, etc it requires all of the org- mode baggage that only exists in emacs but is what makes org-mode more useful than markdown.

But even some of the more advanced org-mode features have to be manually managed if you're trying to contribute to an org-document project and are using something other than Emacs.

</comment></comment></comment><comment><USER13> Wow this exactly the app I want :) I've been using IA Writer for as long as I can remember as my developer todo app. Having some more developer oriented features in the same format is perfect!

</comment><comment><USER14> Currently in love with typora.io

Less features but an excellent markdown editor for Mac, Windows, and Ubuntu

</comment><comment><USER15> I'm using vim with text files already, and Pandoc for converting markdown into other formats as needed. Hard to imagine paying $30 for a worse editing experience that only works on Mac. Maybe I'm not representative of the target market?

<comment><USER16> You know this is Apple culture. Pay for crap you get elsewhere for free.

</comment></comment><comment><USER17> It's like org-mode for normies.

</comment><comment><USER18> Really neat, especially focus mode. I don't think we've problem space of note taking plus outliners yet, so anything with a new twist is welcome (and all the more so if it doesn't use any weird formats).

</comment><comment><USER19> This reminds me of TaskPaper, an excellent plain text todo list app for Mac that worked the same way. It's evolved since its early years, but you can still use the original v1 for free.

[https://www.taskpaper.com/](https://www.taskpaper.com/)

[http://support.hogbaysoftware.com/t/where-can-i-download- old...](http://support.hogbaysoftware.com/t/where-can-i-download-older- versions-1-2-of-taskpaper/1754)

<comment><USER20> After downloading FoldingText, the user guide states that the author of FoldingText also made TaskPaper.

</comment></comment><comment><USER21> This looks like a small sub-set of org-mode to me. I like their homepage design and the logo very much.

<comment><USER22> I watched the demo and realized I didn't know how to collapse all org branches but current, so I glanced at the documentation but didn't see it. That would frequently be useful to me. I suppose you could cycle global to collapsed and then reopen the current?

</comment></comment><comment><USER23> so.... org mode? but you have to pay for it?

<comment><USER24> not sure org mode is a superset of it, now it can and probably will absord the ideas demonstrated there; the timer thing was more than great.

</comment></comment><comment><USER25> Makes me think of the way Bear.app inplemented Markdown mode into its note taking experience. Looks similar.

<comment><USER26> Having compared the two, I prefer Bear. It's great; I highly recommend it. Looks good and has some thoughtful touches.

[http://bear-writer.com](http://bear-writer.com)

<comment><USER27> I had _huge_ problems with Bear. It repeatedly lost files and text and behaved in several other totally unacceptable ways. Have you ever had this problem with it?

<comment><USER26> OK, that's really good to know. I haven't had that experience but perhaps it occurs when syncing? I've never used that feature (don't need it; free is fine for me).

</comment></comment></comment></comment><comment><USER28> This app looks pretty good, but this thread got me looking into org-mode, which got me wondering if there was something similar for Atom. It turns out that there is Organized, which is pretty damn close.

In a world where there seems to be a new to do list coming out every week, I've never been able to simply replace a plaintext file. Organized gives a handy little sidebar with a todo list (simple do [TODO] blah blah) and also an agenda.

For relatively light / non-coders like me, who don't spend their day in emacs or vim, this looks to be the perfect solution.

[1] [https://atom.io/packages/organized](https://atom.io/packages/organized)

</comment><comment><USER29> It would be cool if this used MindNode documents as a backend. This way I get a org-mode like view of the notes in my mindmaps through FoldingText, while retaining the ability to view/edit mindmaps in MindNode.

</comment><comment><USER30> Love it. Use it daily. I even use it with iA Writer and nvAlt.

</comment><comment><USER31> I just use vscode with markdown preview. Similar experience

</comment><comment><USER32> Not sure how this is different from the million similar "clean minimalistic live Markdown focus mode" apps.

<comment><USER2> FoldingText is minimal only in terms of its UI. Behind the scenes, it parses your document, allows folding, focusing, builds an internal structure that can be queried using a query language based on XPath, and allows modes (think plugins) like todo lists, calculator, and schedules.

Would be happy to answer any questions you have, and FoldingText comes with a trial so give it a shot to see how different it is.

</comment></comment><comment><USER33> I wish the screenshots and video showed the window chrome. Is this a normal Mac app with normal windows, etc.?

<comment><USER34> [1] macOS app — [https://i.imgur.com/ioZyy4A.png](https://i.imgur.com/ioZyy4A.png)

[2] app tree — [https://pastebin.com/raw/URDzmRLJ](https://pastebin.com/raw/URDzmRLJ)

<comment><USER35> Thanks, from your second link it seems to use [https://codemirror.net/](https://codemirror.net/)

</comment></comment></comment><comment><USER36> Any similar alternatives for Windows ?

<comment><USER37> I built [https://fromscratch.rocks](https://fromscratch.rocks) which has a lot of the features, and is free :)

</comment></comment><comment><USER38> Hi, this is Jesse. I am original designer/creator of FoldingText. Mutahhir has since taken the project over while I continue to work on TaskPaper and WriteRoom. I see a number of FoldingText history questions. I'll try to answer all of those here.

The idea of FoldingText evolved from:

1\. Out of college I got to work on the Jazz ZUI (Zooming User Interface) toolkit and then build it's successor Piccolo. [http://www.cs.umd.edu/hcil/piccolo/](http://www.cs.umd.edu/hcil/piccolo/). For me this was a super cool project to work on. I liked to take notes and tried/build various ZUI notes apps. Great fun but I always ended up using plain text files on my desktop instead of fancy ZUI app.

2\. I gave up on ZUI for notes and decided instead to build Hog Bay Notebook, a Mac app for notes. Similar concept to Evernote (but a few years before I think). Database of text files with a full text index for searching. After a few years I was making my living selling this app, but I would still tend to go back to keeping my notes on desktop in TextEdit.

3\. Around this time [https://ulyssesapp.com](https://ulyssesapp.com) added "full screen mode" to their app. Was a popular feature, but Ulysses was a big app with lots of other features that I didn't really want. So I spent a week making WriteRoom 1.0. WriteRoom was a very basic text editor with one feature... that it could zoom into a nice fullscreen mode. It originated the term "Distraction free writing"... so yeah for that! :) This quickly sold better then my notebook program which had at that point I'd put years of work into.

4\. This lead me to the conclusion that there's a market and need for simple text based alternatives to "major" apps. Many people saw WriteRoom as a MS Word alternative, even though it was much, much, simpler.

5\. At the time 2005/2006 "Getting Things Done" apps were becoming popular, but they were pretty complicated. Lots of chrome surrounding a simple list of tasks. I created TaskPaper as a simple text alternative to OmniFocus. The original versions were just a little syntax highliting built into TextEdit. But over time I wanted a better solution for handling large complex todo lists and so started building in outlining and filtering into the app. After a few years the end result is that TaskPaper is an outliner data model presented/edited through a plain text editor.

6\. At this point we get to FoldingText. I didn't want to keep bolting features onto TaskPaper... I wanted it to stay "Plain text todo lists". But TaskPaper's underlying outliner model with a text UI seemed like it would be good a many other things. FoldingText was my attempt to generalize the outline mode/plain text UI into a platform that other's could extend. Along the way I decided to use Markdown as the plain text format that would define the underlying outline structure. I regret that decision. It added a lot of complexity (keeping markdown parsed into runtime outliner model) and made most people think of FoldingText mostly as a markdown editor. FoldingText become a good markdown editor, but the Markdown focus clouded the bigger goal for me.

7\. By this time there were 4 of us working at Hog Bay Software. Mutahhir and I worked mostly on FoldingText. And then Mac apps stopped selling so fast and we didn't' have money to continue. Hog Bay Software had to shrink down to only me again. And I didn't have resources to keep working on all the apps. So I've refocused to work on TaskPaper and WriteRoom again. While Muthahhir has taken over the FoldingText project and is working on a big release soon.

Along the way I've looked to lots of apps for inspiration.

Early outliners in particular. But while I like them, they are problematic on how constraining they are when editing... they are field based so you only edit one line at a time. That's why I prefer using the outliner data model, but presented as unconstrained plain text editor.

Besides the history described above FoldingText was most inspired by the Cannon Cat. Maybe not so much in every feature and implementation, but in the large idea of a text based user interface.

<comment><USER39> very interesting history, jesse. been observing your work for a long time. loved the reference to the canon cat (not "cannon"). also tickled by the idea of downloading a .pdf from "ftp.apple.asimov.net" with "jefraskin" in its name; 2017 giving props to the past. never really understood the benefit of "folding" per se, since anything not shown on the screen is "out of sight" anyway. albeit an outline view is great, especially when you can click into any section. nonetheless, love the fact that you (and others) continue experimenting with the plain-text writing interface. keep on keeping on.

</comment></comment><comment><USER40> "Free Download" \- but it is actually a time-limited demo, and has a $30 license. Dirty Pool. If I can't trust you to not bait-and-switch, I can't trust you.

<comment><USER2> Sorry, that wasn't the intention of that link, but I can see how it can be misleading. Will change it to 'Try for free' or something clearer, soon.

</comment></comment><comment><USER41> That looks really good. Already downloading to test it out.

</comment><comment><USER42> The price seems a bit steep. Is there support for copy-pasting images? Where are the timers as shown in the video?

<comment><USER2> There is currently no support for adding media to documents, as they're just plain text. It might be something we'll consider moving forward with the new version.

The timers can be started by using the 'schedule' mode. Just add '.schedule' to the end of a heading and then start adding time lines underneath. The video is getting dated now, time to re-record :)

</comment></comment><comment><USER43> Looks promising. How would one deal with attachments or images ? Is that possible with foldingtext?

<comment><USER2> Not yet, but hopefully we can add this ability moving forward with the new version.

</comment></comment><comment><USER44> What benefits does this have over Atom, Sublime and Textmate?

<comment><USER38> The intro video at [http://www.foldingtext.com](http://www.foldingtext.com) does a pretty good job of showing what's unique about FoldingText.

The apps you've listed all do "folding". But I don't think they can hoist/focusing a particular section. Or filter the view. Or have modes such as schedule mode. Also general the look/feel is quite different between the apps.

<comment><USER44> Thanks, I did watch the video but I just don't see it being any better outright. I'm only in a phone right now so I guess it will have to be a test drive to really see it.

</comment></comment></comment><comment><USER45> org mode + workflowy?

</comment><comment><USER46> Similar to this is the PlainTasks plug-in for Sublime.

</comment><comment><USER47> org mode cloned

</comment><comment><USER48> vscode + some plugin.

</comment><comment><USER49> Do you even emacs bro?</comment>


The Great Cryptocurrency Scam - <AUTHOR> https://www.forbes.com/sites/jayadkisson/2018/11/20/the-great-cryptocurrency-scam/#2a895620359f <comment><USER2> > Whatever else one can say that cryptocurrency has accomplished, it has been > one of the greatest destroyers of wealth in the financial history of > mankind.

I'm not going to argue that cryptocurrency prices are in a great place, they aren't.

In early January 2018 the combined market capitalization of the measurable cryptocurrency tokens was ~$825B. Today's market capitalization is ~$146B, or about $679B in "destroyed" wealth. If you take Bitcoin's price movement from $19783 to $4508 from the start of 2018 until today, in isolation, investors have seen losses of $266B.

This is a lot of money, no doubt, but you don't need to go too far for examples using commonly described "good" assets with similar losses individually (a la BTC) or in aggregate (all cryptotokens) on a far shorter time horizon:

\- Between October 3, 2018 and today, AAPL's stock losses have "destroyed" ~$262B in wealth.

\- FAANG stocks (Facebook, Apple, Amazon, Netflix, Google) have seen ~$822B in wealth destroyed as their stocks have fallen significantly from their high- water marks since the end of August 2018.

The ardent drum-beaters may say this is "good for Bitcoin" in some warped way (I don't agree) and I certainly can't argue that the current market outlook has many upsides, but hyperbolic criticisms aren't helpful.</comment>


Remote working: Is your Internet connection good enough? - <AUTHOR> https://medium.com/@mfornasa/remote-working-is-your-internet-connection-good-enough-7e5c8d4f59b2#.p98k5s7wk <comment><USER2> got a 30mbit VDSL connection and UMTS for safety.

But I'm also working from my GFs home (30mbit VDSL).

all connections have an uptime of 99% of the year. but since I'm not working 99% of the year and using different connections I never met any downtime.

<comment><AUTHOR> @k__: you're right, but the article does not consider the long-term downtime, which is a bit harder to measure (and it does affect the user-experience less than a 5% loss rate). The solution for long-term downtime is having a backup connection on a different medium and with a different service provider.</comment></comment>


Ask HN: How do you manage what you learn from books? - <AUTHOR> Basically, how do you keep track of what you learn from the books you read? Of course some general ideas become part of your brain, but how do you revisit them? Do you make summaries? Do you underline the book to reread only those parts? Do you keep categorized notes? <comment><USER2> 1\. l I use OneNote using a numbered hierarchical structure. You can use anything really, like the Dewey Decimal system, but in my case it just evolved into a 1000's section for the Sciences and Applied Sciences, a 2000's section for Business, Finance, etc, a 3000's section for Liberal Arts and finally a 4000 section for the Arts.

2\. After I've completed a book, I'll go back and type out the notes into OneNote, I usually have my raw notes (what I've underlined), my synthesized notes (the best of the raw notes), and then finally some kind of concept map for the overarching ideas.

3\. To completed notes I add a "#review" tag into the note and then every two weeks I'll do spaced repetitions on the notes. At some point I'll add a tag like "#long-term-review" and then only look at it every 6 months.

4\. Use physical books and use a pen, not highlighter. Physical books allow you to read faster and a hundred other things that would be too long to get into here, and pens are better because you can underline, circle words, and write in the margin all with one device.

5\. Learn how to distinguish good books from bad books. Bad books tend to have very "markety" like "How Anybody Can Be Creative!" while good books have more boring titles like "Reflections on Lateral Thinking" by XYZ University Press. Also University Press's are almost always a good buy. You will never find those books unless you look, consider the average marketing budget for a University Press book is about $5,000, but they're one of the best untapped resources for knowledge in the world currently. Amazing that they aren't more popular.

</comment><comment><USER3> I tend to keep linked notes (e.g., mind mapping).

In fairness, I'm bad at being consistent. But once you have a mind map or similar (generally with themes or topics as title) you have an exportable resource.

Once you have an exportable resource you can release the kraken (let slip the dogs of war?) and do whatever you want with it. Things like spaced repetition, reminders of things you haven't looked at or thought about over time, totally random, etc.

It's cool.

A "random" link from the past, or a book passage, or a note tree, or even just exploring a random path, might directly solve a current problem or push you to think in a different direction, or jog a thought pattern you didn't know you had.

<comment><USER4> What do you use to store your mind map? My preferred methods for notes are either outlines or mind maps (obviously related), and it would be nice to use mind maps for the top level topics but then those drill into deeper, more full notes.

<comment><USER3> A hacked version of FreeMind, although I may be switching, or releasing that version as a patch or new project.

I'm currently looking for a new solution that has the ability to add arbitrary back-ends to retrieve data, probably Electron-based.

</comment></comment></comment><comment><USER5> These days, I revisit the ideas in books by rereading them or by reading other books which contain related ideas. I didn't always do that, but I realized I enjoy reading and don't really enjoy taking notes, and anyway a thought provoking book changes the way I think and so the notes I take while reading will probably not reflect the way I think after I read. Besides, books that aren't changing the way I see the world tend to feel boring and probably won't get read.

Now I am not saying that this is the most efficient way to cram for a test. But I don't think I have any tests of the kind that can be crammed for coming up soon so I don't let the methods that are good for test cramming shape the way I read...but it took me some time to get to this point.

Good luck.

</comment><comment><USER6> I take skeleton notes of each book into Evernote. When I feel the urge to revisit the book, I look at the notes. It doesn't capture the emotions and examples, but at least I can refresh my memory on what the book was saying.

</comment><comment><USER7> Highlighting and writing inside of books is criminal. For every book I read I made a Google doc and write down key ideas in my own words. I try to review these docs periodically to keep refresh my memory.

<comment><USER8> It's only criminal if you don't own the book. If I bought the book with my hard-earned money, I can highlight and take notes as I please.

<comment><USER9> I use to not write in books, now I prefer a pencil to put dots or very small notes in the margins.

</comment></comment></comment><comment><USER10> I make flashcards in [https://apps.ankiweb.net/](https://apps.ankiweb.net/)</comment>


After CodeAcademy, Do This - <AUTHOR> http://www.codetuts.co/

<comment><USER2> I think, in theory, this is really neat. One of the things I struggle with when learning something new (especially something more involved), is finding a way to put it into practice.

With that said, I think there could be a bit more description, or perhaps some examples of what I'd actually be signing up for, and how it works.

As a bit of trivium, on Chrome on OSX, auto-fill for the email doesn't work properly, and while small, it might help get a tiny bit higher conversion if that was addressed.

<comment><AUTHOR> Thanks for your feedback. I'll fix the form in the morning but the conversion rate is pretty excellent at the moment, we're pushing 50% for some traffic sources.

I'll put the examples up also once we launch fully.

I hope you've signed up! I'm looking forward to having you on the course.</comment></comment>


Show HN: Mapping 17 years of US electric generation - <AUTHOR> https://electricitytransition.com <comment><USER2> Nice!

<comment><AUTHOR> Oh hey, thanks! I didn't expect anyone to see this post after it dropped off the "new" page...</comment></comment>


Europe's Other Crisis: A Digital Recession - <AUTHOR> https://hbr.org/2015/10/europes-other-crisis-a-digital-recession <comment><USER2> I'm so tired of this bullshit right wing propaganda. It's been going on for decades, and always uses the same formula:

1) Europe (a non-existent as a nation, even purely geographically it's blurry) is in crisis/dying/crumbling. Optional addition: because socialism.

2) The solution is to be like the glorious USA.

<comment><USER3> If you bury your head in sand that's exactly what you'll think. Try getting out of Europe more often and see what the rest of the world achieves in a year and then you'll come to the same conclusion. Even in case of already advanced countries like Japan, in certain sectors, they are years if not decades ahead of Europe.

<comment><USER4> As the op said, there is no "Europe" and talking about it as if there's a single entity is, to European ears, quite ignorant. Practically the only thing Italy has in common with Poland has in common with France has in common with Holland is that they're all very generally liberal democracies. Otherwise, on the spectra of backwater-to-scifi, honest-to-corrupt, socialist-to-capitalist, religious-to-secular, nationalist-to-egalitarian, dynamic-to-sclerotic, authoritarian-to-permissive, you will find everything in every permutation, somewhere.

I get that the US is big and diverse and dynamic. But the EU is far bigger (population wise) and far more culturally / economically / politically diverse.

</comment></comment></comment><comment><USER5> > By many measures, the UK is ahead of the others in terms of its digital > foundations and sophistication; for example, the proportion of retail in the > U.K. penetrated by B2C e-commerce is nearly twice the European average and > higher than even in the U.S.

UK has been doing well compared to others mainly because it's a fully English speaking country and the US already has a history with UK (sort of speak).

It's _natural_ for US companies to establish headquarters in "Europe" in UK first, before any other country. Personally, I do hope US companies consider countries where leadership doesn't favor so strongly mass surveillance and censorship, but either way it has little to do with policies and laws. The language barrier is a huge problem for an "EU single market". As the young generations grow-up with the English-speaking Internet, it will be less of a problem, but right now the language barrier is very much real.

<comment><USER6> And even in Germany, for the first time ever, the IT business is the largest business. Car manufacturing is down to #2.

<comment><USER7> How do they get the numbers. Are Banks that offer online Banking IT businesses? And everyone with a commercial website too?

<comment><USER6> No, they especially do not count stuff like online banking, but companies that directly sell or provide IT solutions, including software vendors, SaaS companies, Hosters, Internet Exchanges, etc.

This includes T-Systems, SAP, Hetzner, DE-CIX, etc.

I do not know if they counted smaller startups like Soundcloud.

<comment><USER8> Could you provide a link (German is fine)? I couldn't find something like that in the few minutes I searched.

<comment><USER6> It was something one of my professors showed in a lecture, and I can't find it right now on mobile (especially as I am busy printing a letter, buying stamps, etc to send the livecoding guys a C&D), but you might find some numbers on the BitKom site.

</comment></comment></comment></comment></comment></comment><comment><USER9> There are quite a few hurdles for small businesses and young startups in Europe to do business online:

* registration of a limited company is not that simple in some countries. UK is relatively easy, but in Germany you need to invest at least 25,000 EUR just to get started. Half of it upfront. Not to mention notary fees and other red tape.

* VAT is a huge pain since 2015, especially for digital goods and services. Look up VAT MOSS aka #vatmess

* language - if you want to cater to a wider audience, localization is still a major aspect and costs a lot in terms of development, content, support etc

* employment rules are usually much more strict. This is generally positive for employed individuals, but when it comes to a small business trying to work with freelancers (or freelancers themselves), they are massive hurdles. I'm familiar with IR35 in the UK, but there's pretty much the same thing here in Germany without having a fancy name... I'm pretty sure similar rules apply in other EU countries as well, but have no actual knowledge about other countries.

Source: being a small fish entrepreneur in Israel, UK and Germany.

EDIT I should also add currency support. Whilst the EUR covers a fair number of countries, there are still exceptions...

<comment><USER10> I incorporated in Berlin with 1500EUR. I got a shelf corporation, with the documents translated to English so I didn't need an official interpreter @ 150EUR per hour, and the notar costs included. Granted it isn't a GmbH but a UG, so I imagine for some industries that wont work; but for a boutique consulting firm it's been excellent.

VAT is a mess, though. definitely. but then you hire an accountant and you get VAT + all that other tax stuff "abstracted" away for a very reasonable cost.

<comment><USER7> Has someone incorporated in Delaware and Headquartered in Germany? We are talking small budget here. Is this a nightmare or could work in some instances? Taxes could be a problem I heard. I am working on a feedly competitor (with Popularity Sorting) and it would make sense to concentrate on the US Market first anyway.

<comment><USER11> Looking forward to seeing your beta product! Where can I keep apprised of your company's news?

<comment><USER7> Thanks. We will launch our beta on feedcred.com in the next weeks. But we haven't setup a dedicated blog or social media yet. I must admit registering a company and marketing are things I have to do my due diligence on very soon.

<comment><USER11> Good luck, it's a steep learning curve but well worth it.

Q: In function, how does the popularity-based sorting differ from feedly's current popularity algorithm?

<comment><USER7> Feedly doesn't really sort by Popularity. Instead they simply load ca. 20 entries and select the three most popular entries on the client side as Featured. That being said at scale you have to compromise one way or other.

The Idea behind my popularity algorithm is that I don't want to calculate what is popular among the Users of my service. Instead I want to estimate what is popular with the original User base of each Feed you subscribe to. I think the average User base of The New York Times is different from the typical reddit, twitter or facebook crowd. So this should be an interesting Differentiator.

<comment><USER11> I'm significantly more excited about your beta now that you've explained it. I think that's a unique and a potentially great way to do popularity ranking.

 _Fingers crossed that you 're also going to have an eye for security_

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> We incorporated our startup in the Netherlands because that's where one of the founders lived. It took a couple of months of sending various documents back and forth and required 18K EUR in cash (recoverable) as well as some non- trivial expenses for various fees. Fast forward a few years, we sold our app and liquidated the company. The amount we received in cash _before income tax_ is less than half of what was paid to us. I feel like I was working for the Dutch government this whole time. Obviously not happening again.

<comment><USER13> Then you weren't informed/advised properly, because it's possible much easier and cheaper, _especially_ for digital goods suppliers. But yes, if you naively follow the simple interpretation of the law and/or what the website of the tax office says, you'll get shafted.

</comment></comment><comment><USER14> Not about article itself, but design of the website made me consider if it's worth reading.

Fixed header and footer takes 25% of my screen's space and distracts greatly. If my screen would be somewhat smaller (e.g. 11-12'), first graph would barely fit in between header and footer.

</comment><comment><USER15> 4 websites deeper I finally found at least an outline of what are they actually measuring:

"Our data and insights are calculated and measured utilizing four drivers.

Digital Economy Driver - Demand Demand: covers consumer income and demographics as well as internet usage.

Digital Economy Driver - Supply Supply: focuses on technology and infrastructure and whether or not they can support digital commerce and transactions.

Digital Economy Driver - Institutions Institutions: accounts for government policy and access to trade.

Digital Economy Driver - Innovation Innovation: rates the environment for creating startups and the overall competitive landscape."

</comment><comment><USER16> HBS - Sullying the Harvard name since 1908

</comment><comment><USER17> Yet the UK PM is keen on making things much tougher for digital startups - [http://uk.businessinsider.com/immigration-cuts-will-hurt- uk-...](http://uk.businessinsider.com/immigration-cuts-will-hurt-uk-tech- sector-2015-10)

</comment><comment><USER18> Isn't this what Estonia is trying to solve with their e-residency initiative?

</comment><comment><USER19> The index's criteria...

 _...high levels of digital development are attractive to global businesses and investors and that their digital ecosystems are positioned to nurture start ups and internet businesses that can compete globally_

...is so nebulous and silly how could anyone take this seriously?

</comment><comment><USER20> The graph on HBR is a bit weird. Czech and Slovakia are just next to each other geographically (used to be same country), Czech are pretty far in terms of getting things done digitally and yet they are classed as rapidly receding, Slovakia is in the "slowly advancing" category. I'm sure there are minute differences between those countries but as vast as the graph portrays...</comment>


Researchers identify first flaws in AES - <AUTHOR> http://www.net-security.org/secworld.php?id=11474 <comment><USER2> I guess once SHA-3 is done, NIST better start research on the next symmetric cipher. The attack only knocks off two bits now, but attacks only get better with time.

Note that you should be using accepted standards for key management anyways. NIST believes that AES-128 has 128 bits of strength, and AES-256 has 256 bits of strength [1, page 63], which they find "Acceptable" until 2031 [1, page 65]; the catch is that any individual key should be expired after a few years. This is called a "cryptoperiod," and the longest they recommend using a key is five years [1, page 55].

By this standard, keep using AES-256, but change your keys every year, and be prepared to migrate to a new cipher at some point within the next decade or two.

[1]: [http://csrc.nist.gov/publications/drafts/800-57/Draft_SP800-...](http://csrc.nist.gov/publications/drafts/800-57/Draft_SP800-57-Part1-Rev3_May2011.pdf)

<comment><USER3> The total cost to the industry of adopting AES was enormous. That implies that deprecating it would at present impose costs that far outweigh the benefits, because replacing AES will be expensive, and there are at present minimal practical benefits to doing so. Remember, plenty of critical systems have been fielded that rely on RC4 and DES-EDE, both of which are also (for all intents and purposes) unbroken in their most common usage.

For Hacker News, the far more important thing to point out is that no matter what block cipher you use, you are _never_ going to get burnt by research like this, but you are _almost certain_ to be completely boned by implementation errors.

<comment><USER4> I would consider key management to be a greater problem than implementation, at this point. There are many verified, open-source, freely-licensed cryptography libraries out there. You shouldn't be rolling your own implementation.

Unfortunately, key management is still a difficult problem. Without secure keys, even the most secure encryption becomes nothing more than an inconvenience.

<comment><USER3> Everyone says this, because Applied Cryptography (not a good book) says it. But no, the problem of coming up with a good 128 bit or 256 bit key is not the hardest part of getting a cryptosystem working. Plenty of static-keyed systems, in which keys are more or less guaranteed to come from /dev/random, end up totally busted.

You seem to be thinking that when I say "implement", I mean, "building an AES core library from scratch". No. I mean properly _using_ a well tested, totally sound AES library in a way that doesn't leave your application totally boned.

<comment><USER5> I've seen a lot of broken key management. People using MD5(passphrase) ( _cough_ OpenSSH _cough_ ) as a key, people downloading public keys over insecure networks and not verifying them at all, people distributing secret keys along with software destined to be run on hostile systems...

I'm happy to say that systems which try to generate random passwords do tend to generate securely random passwords, though. /dev/random has been a huge help there.

<comment><USER3> You wouldn't want to leave anyone with the impression that they're mostly fine as long as their keys are securely generated.

<comment><USER5> No, of course not. That's why I work so hard to point out the ways that people get crypto wrong (and how to do it right).

I'm just saying that key management is absolutely not a solved problem yet.

<comment><USER3> Yeah yeah, not arguing, just wanted us both on the record on this point. Crypto: dangerous.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> Note: This attack requires a large amount of RAM. They may have saved a few operations, but they increased the total _cost_ by many orders of magnitude over a brute-force search because they need a larger machine.

Also note: An attack taking 2^126.1 operations to break AES-128 is not 2^1.9 times faster than brute force; it's 2^0.9 times faster than brute force. A brute force search on a 128-bit key takes _on average 2^127 operations_.

In short, this is definitely in the "interesting new method to explore" column rather than the "interesting attack" column.

<comment><USER6> _"Note: This attack requires a large amount of RAM. They may have saved a few operations, but they increased the total cost by many orders of magnitude over a brute-force search because they need a larger machine."_

Is this terribly relevant though? Deep Crack was a quarter of a million dollars (90s dollars) as I recall.

<comment><USER3> Yes. The entire concept of cryptanalysis revolves around cost factors. It is very relevant when a new avenue of attack costs more than brute force in its best known mode of implementation.

That doesn't make the research a dead end, but it further reduces the relevance of this work to engineers.

</comment></comment></comment><comment><USER7> Paper and slides: [http://research.microsoft.com/en- us/projects/cryptanalysis/a...](http://research.microsoft.com/en- us/projects/cryptanalysis/aes.aspx)

<comment><USER8> Ah!

Novel cryptanalysis technique reduces practical AES key length by about 2 bits.

<comment><USER9> Which is quite an achievement.

</comment></comment></comment><comment><USER10> Does anybody remember or have a citation for the story about how the NSA made some recommended changes to Rijndael, but nobody understood them at the time? This was back in the mid-90s, during the AES/DES replacement assesment and competition period.

It was then only years later that the NSA changes were understood to be strengthening the cypher against an attack type that was unknown to the public at the time, but that the NSA obviously knew about. I remember there were also suspicions that the NSA were attempting to weaken the algorithm, much as they did with DES.

It was the case that the NSA were always 10-15 years ahead of the public in crypto (or even longer in terms of the discovery of public key crypto). I wonder if their old proposed changes to Rijndael have anything to do with this, or if they knew about this type of attack but still recommended AES.

Apologies for being vague about the story - but I do remember those details. I can't recall where I heard about it.

<comment><USER7> You're misremembering, twice. There was a story about mysterious S-boxes selected by NSA for DES [http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27...](http://en.wikipedia.org/wiki/Data_Encryption_Standard#NSA.27s_involvement_in_the_design). Those S-boxes turned out to be designed to resist differential attacks, which were only known to NSA at that time. This doesn't count as weakening at all.

The difference between AES and Rijndael is only in that AES has a fixed block size of 128 bits and a key size of 128, 192, or 256 bits, whereas Rijndael can be specified with block and key sizes in any multiple of 32 bits, with a minimum of 128 bits and a maximum of 256 bits. ([http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#De...](http://en.wikipedia.org/wiki/Advanced_Encryption_Standard#Description_of_the_cipher))

</comment></comment><comment><USER11> Well, we certainly won't have to worry about it for _now_. But that doesn't mean we shouldn't worry about it, of course.

It's a ways off in terms of orders of magnitude for how fast our computers now, and I don't think computers will be growing at that rate in terms of power unless new breakthroughs are found.

<comment><USER12> If you couldn't crack it before, you still can't crack it now. This attack only makes it 4 times easier to break, not even an order of magnitude.

<comment><USER9> If you count in binary, 2 bits are two orders of magnitude.

</comment></comment></comment><comment><USER13> Don't panic yet. It still requires a trillion machines for billions of years to brute force.</comment>


Elon Musk Will Start Digging a Tunnel Under Los Angeles - <AUTHOR> http://motherboard.vice.com/read/its-official-elon-musk-will-start-digging-a-tunnel-under-los-angeles <comment><USER2> Isn't this a Boston Big Dig scale project? How will the exhaust fumes be vented? What about earth quakes? Seems to me this requires a year of planning and out just don't start digging next month as he tweeted.

<comment><USER3> Its quite clear that you don't just tell the public something the moment you start planning it. It's not as if apple announce a fancy new bit of tech then invent them.

He clearly has been planning it for a while.

</comment></comment><comment><USER4> I will miss Elon Musk when he becomes the president of Mars.

<comment><USER5> I hope he meets Benny there who has 4 or 5 kids. And two jobs.</comment></comment>