Servo Nightly Builds Available - <AUTHOR> https://blog.servo.org/2016/06/30/servo-nightlies/ <comment><USER6> It's amazing to see actual effort taking place to build a new browser engine from scratch.

I would say that since the late 90ies, there hasn't been a single new engine being made. Everything we have now is a development based on KHTML, Gecko, Presto or Trident.

By now, HTML and the standards surrounding it have become so big that starting from a blank slate nowadays is next to impossible. The existing engines have it much easier as they are allowed to grow with the spec, but a new engine has to do everything from scratch.

This makes it even more impressive to see how far Servo is already (yes. I know - there's probably some overlap with some existing Mozilla code, but still).

Huge congrats to everyone involved. We need unafraid visionaries like you people to actually move the web forward.

<comment><USER7> Edge is a new engine, too.

<comment><USER8> doesn't seem like it

[https://en.wikipedia.org/wiki/Microsoft_Edge#EdgeHTML](https://en.wikipedia.org/wiki/Microsoft_Edge#EdgeHTML)

> EdgeHTML is a proprietary layout engine developed for Edge. It is a fork of > Trident that has removed all legacy code of older versions of Internet > Explorer and rewritten the majority of its source code with web standards > and interoperability with other modern browsers in mind.

<comment><USER9> Sounds like it's based on Trident to me

<comment><USER10> Sounds like it's so rewritten compared to Trident, it's not even alike anymore.

<comment><USER11> The end result might look fairly different, but I'm not sure that 'forked-and- refactored' is considered 'new' by very many people.

<comment><USER12> "rewritten the majority of its source code _with web standards and interoperability with other modern browsers_ in mind"

I think coldtea is focusing on highlighted part. A rewrite like that might change so many behavioral aspects, esp user- or developer-visible, that it can be considered a new engine rather than mere clean-up of behaviorally-identical old one. I certainly reuses some code and techniques but differences might be major.

<comment><USER13> At the same time, depending on how the rewrite was carried out, it may be nothing like a completely new project. Rewriting function by function is different than rewriting component by component, which is also different than rewriting from scratch.

Rewriting function by function will give you largely the same program using largely the same algorithms, but possibly with more or less bugs, or cleaned up code.

Rewriting component by component will allow new ways those components are implemented, but the interface between components will likely be the same.

Rewriting from scratch could yield anything (servo could be classified as a way to rewrite gecko from scratch, I believe).

All of these could be said to have had the majority of their source code rewritten, but I would only really consider the last one to be "new" without knowing further details. Of course, the devil is in the details...

<comment><USER12> It's why I'm focusing on behavioral aspect: what does the software _do_? A browser fork that behaves very differently from prior one to point you have to change existing code to get same effect is essentially a new app at behavioral level. However, it might have same name and lots of same code inside. At that level, it's old code in an old app. We largely define our components by their interfaces and behavior. So that's what I'm focusing on.

<comment><USER13> Sure, but if it behaves significantly differently, then I think that precludes it from being a function by function rewrite. At the same time, a component by component rewrite _can_ be a complete rewrite (but it depends a bit more on the details, I think). If the mainly user visible portions are rewritten, but much of the utility code and other components are not, it may _appear_ behaviorally different, but but be largely the same code base. It's much harder to know, looking in from the outside.

For a simplistic example, say someone provides a "rewrite" of grep. Maybe the options are all different looking and sounding, so it may appear to be significantly different. But if the core of the matching algorithm and it's capabilities are largely unchanged, _is_ it a that much of a rewrite? To the outside user it may superficially appear so, but to someone comparing the source from before and after, there may be an entirely different opinion, and even that may change if you come from a context of focusing on a particular aspect.

As applied to Trident/Edge, we may have a case where the person speaking was involved in a project to rewrite one major component of the browser, and so is speaking in that context. Maybe that component is responsible for about 60% of the code and functionality, but it still relies on a quite a bit of largely unchanged additional libraries. It's very subjective as to whether you think that qualifies as a rewrite of the project, and depends quite a bit on what was not rewritten, and what you think of that code.

<comment><USER12> Re rewrite differences

Let's look at the grep example agsin. If it did same thing, but new interface, then it would be same thing because behavior is otherwise the same. Now, lets say you changed what pattern-matching itself produced where you no longer got the same results from same text. Matched totally different patterns unless you changed the text you are inputting to get same results again. And the interface was different. Is that still grep?

If he's talking one component, maybe not anything new underneath. He said the engine (rendering) would be more standards compliant and compatible with other browsers. That's basically what Opera and Mozilla did many years ago while IE didnt. If you blocked out the name, nobody using the browser would think they were using same app when they saw rendering hit those aspects totally distorting the presentation. Or had to redo their websites to display correctly. I remember reading many complaints from web developers about making stuff work with several, different engines whose rendering argued.

So, _if_ Edge engine is different enough to cause that, then it seems like a different engine at behavioral level given same input leads to different output that fails acceptance. Nobody would think it was same app unless the UI told them.

I mean, I still think sameness or newness is an open issue. Do we judge it be function and component as you added? Or interface and behavioral spec as I was looking at? One might also look at data formats. I think it will best to technically just compare in various ways to be accurate. Feature-driven development field probably has some insight into this. However, users will look at them as different, at least in a version since, if they can't do what they were used for or break compatibility. The two Python versions are possibly a good example.

<comment><USER13> > Let's look at the grep example agsin. If it did same thing, but new > interface, then it would be same thing because behavior is otherwise the > same.

That sort of depends on how you define "behavior". More specifically, if it matches something equivalent but different to regular expressions (even if it's just a character transliteration to regular expression syntax), then does the behavior change? Is _that_ still grep? Maybe, if grep decides the the "new grep2 have an easier to learn matching language". It's not like we haven't seen that before.

> I mean, I still think sameness or newness is an open issue.

Sure! The vast majority of cases it probably is an open issue, because different people have different criteria. I was just pointing out that the wording from MS doesn't necessarily imply a rewrite as many people might define it, because we have very little context to go on in the statement, and different people have different ideas about what _is_ the browser. The rendering engine? The UI? The JS VM? All of them combined?

I can totally see someone responsible for the rendering engine saying "we rewrote most of the source code" and the JS VM guys scratching their heads wondering what the hell they are talking about, because they definitely didn't rewrite most _their_ code, and they think their component is a significant portion of the browser...

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Happy to answer questions (when I wake up; getting this ready has been a lot of work, needless to say) :)

It goes without saying, but as this is the very first nightly (not by any means a full-fledged release), expect severe bugs, crashes, and missing functionality. Many of your favorite sites will be broken. Don't expect to use this as your everyday browser. We'd love feedback on what issues folks hit the most, so we can prioritize—especially if you're a Web developer!

<comment><USER15> > expect severe bugs, crashes, and missing functionality.

I really don't mean this in a snarky way: wasn't this kind of thing supposed to be obviated by the switch to Rust? It often seems that every other post about Rust on HN says that if it compiles, it works.

<comment><USER16> No language can fix missing functionality, that seems pretty clear.

Your compiler doesn't know what you're trying to do, so you can't prevent all bugs.

That leaves crashes, and ... well it may also depend on what you mean by a crash. The UI becomes unresponsive? Might have absolutely nothing to do with memory issues or even code written in rust. Maybe your rust code is fine but you're trying to open and write to the same file from two places which you don't realise because the users file system is case insensitive but you've only tested on a case sensitive one, etc.

It's also multi-threaded and while languages can significantly help improve the safety of multi-threaded code, I don't think anything can stop you from creating a deadlock or putting your system into an inconsistent state.

And finally, they may not even particularly expect those things, but putting out early nightly builds to a wider audience and expecting nothing to go wrong would be cavalier. A typical warning on many early releases is "don't blame me if this destroys all your files".

<comment><USER17> >Maybe your rust code is fine but you're trying to open and write to the same file from two places which you don't realise because the users file system is case insensitive but you've only tested on a case sensitive one, etc

That sounds too precise to be just an example :) We've all been there!

<comment><USER16> Haha, yes, this kind of thing has bitten me a few times. I remember getting SVN really confused where the server thought files were different but my machine thought they were the same (or similar). I think I had to make a whole new repo.

It's now on my mental list for "but it works on my machine", checking filenames and their cases.

</comment></comment></comment></comment></comment><comment><USER18> It's definitely slower to actually load pages — I'm guessing that there are still a lot of network optimizations that more mature codebases have accrued that Servo hasn't yet — but _holy cow_ are pages buttery smooth once they do load (and even while they're loading, which is unusual). Comparing Chrome and Servo in terms of UI jank felt pretty shocking, in Servo's favor. Kudos, it looks like Rust and WebRender have paid off.

Looking forward to seeing this evolve.

<comment><USER19> Yeah; we've mostly ignored the network stack.

So there's some extra copying in the IPC, and no speculative parsing, which can slow things down, among other factors.

Can be fixed, but priorities :)

<comment><USER20> I will absolutely love to contribute toward the network stack. Can you provide me any pointers?

<comment><USER21> Using pointers in rust is discouraged!

<comment><USER22> Do you have a reference for that claim? :)

<comment><USER19> _boxes kibwen_

</comment></comment></comment></comment></comment></comment><comment><USER23> Looking forward to using Servo one day, keep up the good work.

First thing I noticed almost immediately after launching is that everything breaks when dragging the window across monitors (that have different densities) - OS X. I dragged from my Macbook's display to an external monitor with a lower DPI and everything went huge and most of the UI got cut off. Dragging back to the Macbook display does not resolve the issue and instead introduces some weird redraw flickering with garbage data.

EDIT: Reported - [https://github.com/servo/servo/issues/12009](https://github.com/servo/servo/issues/12009)

<comment><USER24> you misunderstand if you think servo is scheduled for production and put peer pressure on the devs, but sure, firefox is great already, can only get better. Speaking of which, how are the memory requirements of servo, in relative terms, yet?

<comment><USER23> I don't know what you think you inferred, but please reread my comment carefully. I meant exactly what I wrote and nothing beyond that.

</comment></comment></comment><comment><USER25> Comparing this to early Mozilla/Firefox's history, the point where nightlies become available is really huge. Congrats to the servo team!

</comment><comment><USER26> Just opened up the MacOS build. It is pretty impressive! But the autocomplete is just awful. Typing in "[http://localhost:3000"](http://localhost:3000") at normal speed produced "[http:///localhost:300000"](http:///localhost:300000"). Especially while it's in such a primitive developer-oriented state it would be much more useful to disable that silly autocomplete.

Edit: Additionally, it doesn't yet support native keybindings like Command left-right or Alt left-right.

<comment><USER27> I doubt that there's going to be much effort into improving the HTML based browser that they're using as a shell to the engine outside of making sure you can go to a specific URL. Things like hotkeys and autocomplete are nice, but not really necessary for developing on Servo. I could be wrong on that though

<comment><USER28> The browser.html team works on the frontend, so they are very much interested in improving this. You're right that Servo devs themselves often use an even more stripped down test harness that you supply URLs to on the commandline, but that may change now that browser.html has gotten quite nice :)

</comment></comment></comment><comment><USER29> "Servo is a modern, high-performance browser engine being developed for application and embedded use."

Is embedded devices one of the goals around Servo? Do Servo have any embedded specific design goals? I'm interested to know which parts in Servo targets to embedded use. I can see that page says Android builds are coming soon. i guess that explains it.

<comment><USER25> Embedded in the sense that you embed a browser in another application, I think? Maybe IVE (in-vehicle entertainment).

<comment><USER30> > Embedded in the sense that you embed a browser in another application

Yes, this is it.

<comment><USER29> ah....the description is ambiguous then. Embed a browser in another application isn't very clear either. Is Servo like framework where devs can build apps on top (something on electron line).

Or is it really about embedding browser inside your application. That one can do today with QT framework where you can embed a browser inside your application. But QT itself moved from Qt WebKit to Qt WebEngine. So, 'embed a browser' in your application sounds old to me.

<comment><USER31> > "Embed a browser in another application isn't very clear either. Is Servo > like framework where devs can build apps on top (something on electron > line)."

"Embed a browser in another application" is perfectly clear. Servo is designed so that it can be linked with other applications, and displayed within windows that the host application controls.

WebKit is also embeddable in this way, but other browser engines are not as mature in this area. There was talk of Servo using the same API that WebKit uses for embedding, probably to help developers transition from WebKit to Servo:

[https://github.com/servo/servo/wiki/Version-0.1#embedding](https://github.com/servo/servo/wiki/Version-0.1#embedding)

"The proposed plan is to use WebKit's API as a template or copy it completely."

</comment></comment></comment></comment></comment><comment><USER32> Congrats on the release! Servo itself has been getting most of the attention in this thread, and rightfully so, but I just wanted to mention that I really love the progress the team has been making on the browser.html side as well!

It's great to finally see a browser UI built from the ground up on top of _standard_ web technologies _and_ with first-class support for vertical tabs to boot!

</comment><comment><USER33> It's already more nice than what I expected.

Some really minor bugs that occurred while using it a bit (OS X 10.11):

\- Scrolling when already at the end of the page sometimes makes a relatively big instant step (noticed this for instance on the hackernews startpage)

\- The tabs aren't cropped in tab view: [http://imgur.com/Q1Bxibo](http://imgur.com/Q1Bxibo)

\- Tabs don't keep at which point you have scrolled when switching tabs

\- After opening the address bar and clicking on the website again there's a short flicker.

<comment><USER19> Could you file issues for all of these (preferably with secreenshots)?

Thanks!

<comment><USER33> Reported all of them

</comment></comment></comment><comment><USER34> Congrats! Please note that Servo is a work in progress that is still lacking some modern browser security features, so enjoy responsibly.

See also [https://github.com/servo/servo/labels/A-security](https://github.com/servo/servo/labels/A-security)

</comment><comment><USER35> The OS X binary isn't signed, and the download URL is HTTP. Is there a version available on a more secure distribution channel anywhere?

<comment><USER19> We're switching the download link over to HTTPS.

Is there a reason the OSX binary needs to be signed? We don't do anything special.

Edit: HTTPS up: [https://servo- builds.s3.amazonaws.com/index.html](https://servo- builds.s3.amazonaws.com/index.html)

(This comment written in Servo :P )

<comment><USER36> The last few releases of OSX don't allow you to launch unsigned binaries without specifically disabling the check.

In the latest Sierra beta I've heard you can't disable the check without an involved workaround.

It's just OSX users being lazy ;)

<comment><USER19> Huh. I've only recently started using OSX, and I've had codesign issues when using self-compiled debuggers, but not when using things like servo.

Can it be signed by any old cert or does it need to be part of the trust chain?

<comment><USER37> Debuggers are special--the OS won't let unsigned binaries control other processes, no matter how they came to exist on your system.

Outside of that, Gatekeeper applies to executables fetched from the Web, can be disabled (harder on Sierra), and is easy enough to bypass--and you only have to do it once per executable. If signed, the certificate does need to be trusted to count--otherwise, it'd just be a fancy checksum.

<comment><USER19> Alright. This sounds like something we should be eventually doing. Not sure if we should prioritize it right now. GPG-signing the binaries for extra verifiability is another thing we could do in the meantime, though it doesn't fix the OSX issue.

</comment></comment></comment></comment></comment></comment><comment><USER38> Is there an article somewhere comparing how Servo and Chromium threaded compositing differ? I guess there is some work on Chromium side to render pages using multiple threads, but I couldn't find more information and how it compares to Servo's mechanism.

<comment><USER18> The compositing is very different: Servo does almost everything on the GPU in "retained mode" as opposed to "immediate mode," which is much faster and similar to how modern game engines work. There's a good talk here explaining it here: [https://air.mozilla.org/bay-area-rust-meetup- february-2016/](https://air.mozilla.org/bay-area-rust-meetup-february-2016/)

</comment></comment><comment><USER39> Freezes with github issues [http://i.imgur.com/bcSOoxc.png](http://i.imgur.com/bcSOoxc.png)

ERROR:js::rust: Error at [https://assets- cdn.github.com/assets/frameworks-6fe6a7604ec4...](https://assets- cdn.github.com/assets/frameworks-6fe6a7604ec4c2601272849e1b99a3a9aa12c79b3e25be0360f8d114768e7578.js:6:6359): history is not defined

</comment><comment><USER40> Is the scrolling behavior on OS X custom implemented, just like on Firefox? Imo it hits the uncanny valley unfortunately, especially for edge bounce back. Otherwise, excited to try this out more.

<comment><USER28> I think the browser.html team will be very interested in this feedback. I sat with them as they poured over Cocoa disassembly and source trying to replicate the behavior as best they could. We definitely have some things to improve. Because we are using our own rendering system to draw on the GPU, we can't use Apple's implementation of this stuff which requires buying into Core Graphics/Core Animation completely I believe.

Note that I don't think Firefox has overscroll at all, except maybe on mobile.

<comment><USER41> It's worth looking at WebKit's implementation: [https://github.com/WebKit/webkit/blob/master/Source/WebCore/...](https://github.com/WebKit/webkit/blob/master/Source/WebCore/platform/cocoa/ScrollController.mm)

</comment></comment></comment><comment><USER42> I know it's not the point, but having this publicly available in such a usable form - even with this bare minimum UI - is a huge milestone. A big barrier to adoption I hear from many potential users is, "Are there any big users of Rust yet? No? Why would we?" This answers that.

Half jokingly, all you need now is an emscripten target, so it can be run inside a browser, and anyone can try it out without needing to install an app :)

<comment><USER43> > all you need now is an emscripten target

The thing I love about the programming community is that even though that's clearly meant as a joke, someone'll make it happen, just to see if they can do it :)

</comment></comment><comment><USER44> When I run it, I first see a webpage loading then it suddenly disappears and the whole page becomes white. There is no UI, but when I hover over the white nothing, it appears as if the webpage is still underneath as the cursor behaves as it would if there were text and hyperlinks.

I am on Ubuntu 14.04, by the way.

Screenshot: [http://i.imgur.com/ixQj4sI.png](http://i.imgur.com/ixQj4sI.png)

</comment><comment><USER45> It seems Servo doesn't respect my keyboard layout. I use Colemak on macOS but when I go to type in google.com in the address bar I get t;;tuk.c;m.

<comment><USER14> This is pull request #11950. [https://github.com/servo/servo/pull/11950](https://github.com/servo/servo/pull/11950)

<comment><USER45> Ah, awesome. Thanks for finding it!

</comment></comment></comment><comment><USER46> How do you actually open the developer console? ;)

<comment><USER28> If you start servo with the devtools port on, you can use the Firefox tools to get a remote console. This may or may not be working well at the moment. The JS console.log stuff will get output to stdout or stderr when you run as well.

There are discussions underway about how to bring in other tools, and how to get stuff like this into Servo or browser.html itself.

<comment><USER46> Thanks! I guess I can use this to get my project working on Servo... ;)

</comment></comment></comment><comment><USER47> Congratulations, servo team. This is an exciting milestone. Getting all these eyes on servo is going to accelerate development even more.

</comment><comment><USER48> Now browsing HN with servo

</comment><comment><USER49> Is some HiDPI mode already available on Linux?

<comment><USER28> I don't think we do autodetection yet aside from what Glutin already does (which is very basic). But you can put Servo into a HiDPI mode manually with the --device-pixel-ratio=2.0 argument, and you can supply whatever ratio you like.

We do detect Retina on Mac and have system DPI awareness on Windows, so once we figure out what to do on Linux we can probably add it pretty easily.

</comment></comment><comment><USER50> Does not work on Fedora 23 due to mismatched libraries: servo requires openssl 1.0.0, while Fedora 23 has 1.0.2h.

<comment><USER51> I like how a few comments up you're saying how harmful Windows is and implying how easy it is to run Linux and Servo and here you are complaining about mismatched libraries.

<comment><USER50> It's looks like you are misunderstood me. Linux is great for development. It's free. It's made by developers and for developers. It has lot of development tools integrated into OS. You can tweak, modify, and debug just anything, including kernel. It well documented and has full sources. If you want to help Servo developers, Linux is great choice. If you want to USE Servo, then you need to wait until developers will release version for your platform, because it is not ready for end users. It is sad that I need to explain that on _Hacker_ News site.

</comment></comment></comment><comment><USER52> not working at all ./runservo (as per instructions)

thread 'main' panicked at 'Failed to create window.: OsError("GL context creation failed")', ../src/libcore/result.rs:785 note: Run with `RUST_BACKTRACE=1` for a backtrace.

./servo welcome to servo, than it changes to a white window

Debian 8

<comment><USER53> Most likely this is due to your system only supporting OpenGL version < 3.0. I had the same problem. Replacing '-w' by '-c' in the 'runservo' script might fix your startup problem.

<comment><USER54> This worked for me on Ubuntu 15.10 x64

</comment></comment></comment><comment><USER55> I started it and it worked, nice to see this progress!

Two things though: 1\. when I opened the tab sitebar clicking on a tab closed it. 2\. I cannot reproduce this, but servo hung when i closed the window, it stayed open, but did not rerender on resize. Using gentoo with Xorg, running dwm as window manager.

<comment><USER56> 1\. That is intentional UX decision. 2\. That is known bug, that hopefully will be fixed soon. [https://github.com/servo/servo/issues/11937](https://github.com/servo/servo/issues/11937)

</comment></comment><comment><USER57> Nice UI, and it runs pretty fast! Is it possible to enable WebAssembly? (running the MacOS binary)

<comment><USER14> Not at the moment. But watch this bug :) [https://github.com/servo/servo/issues/9232](https://github.com/servo/servo/issues/9232)

</comment></comment><comment><USER58> While there are still lot of work to be done on servo. I wonder if other browser engine be able to benefits from the research mozilla has done. Like Webkit / Blink.

Or will this require some major rewrite?

<comment><USER19> Depends on the architecture. But if the monolithic Firefox is trying to use servo components, I bet WebKit and Blink can too.

</comment></comment><comment><USER59> Congratulations on the release.

Running ./servo gives me this error.

"./servo: error while loading shared libraries: libEGL.so.1: cannot open shared object file: No such file or directory"

I guess it should be an easy fix. But if there are instructions to copy/paste that would really help. If someone has an answer, it would be great if you can please post it here.

Edit 1: I think the problem is because I am trying to run it on ubuntu 14.04 server. Also I am using xming and putty x11 forwarding. I installed libegl using 'sudo apt-get install libegl1-mesa-dev'. Now I am getting a new error.

Xlib: extension "XFree86-VidModeExtension" missing on display "localhost:12.0". thread 'main' panicked at 'Failed to create window.: NoAvailablePixelFormat', ../src/libcore/result.rs:785 note: Run with `RUST_BACKTRACE=1` for a backtrace.

So I ran with RUST_BACKTRACE=1 and this is the stack trace.

Xlib: extension "XFree86-VidModeExtension" missing on display "localhost:12.0".

thread 'main' panicked at 'Failed to create window.: NoAvailablePixelFormat', ../src/libcore/result.rs:785 stack backtrace:

       1:     0x55868358b56f - std::sys::backtrace::tracing::imp::write::h6528da8103c51ab9

       2:     0x55868359319b - std::panicking::default_hook::_$u7b$$u7b$closure$u7d$$u7d$::hbe741a5cc3c49508

       3:     0x558683592dff - std::panicking::default_hook::he0146e6a74621cb4

       4:     0x558683471857 - util::panicking::initiate_panic_hook::_$u7b$$u7b$closure$u7d$$u7d$::_$u7b$$u7b$closure$u7d$$u7d$::hc61828c8a9f6df01

       5:     0x558683578dcc - std::panicking::rust_panic_with_hook::h983af77c1a2e581b

       6:     0x5586835933e1 - std::panicking::begin_panic::he426e15a3766089a

       7:     0x55868357a63a - std::panicking::begin_panic_fmt::hdddb415186c241e7

       8:     0x55868359337e - <USER2>

       9:     0x5586835c997f - core::panicking::panic_fmt::hf4e16cb7f0d41a25

      10:     0x558681766ff0 - core::result::unwrap_failed::hd132ba2b7d75f379

      11:     0x558681765df4 - glutin_app::window::Window::new::h750be0f1f60f008a

      12:     0x558681764df0 - glutin_app::create_window::hae774cdda1762e66

      13:     0x55868170df45 - servo::main::h6924e5658370f6b5

      14:     0x558683592778 - std::panicking::try::call::h852b0d5f2eec25e4

      15:     0x55868359d5db - <USER3>

      16:     0x55868359d57e - <USER4>

      17:     0x55868359221e - std::rt::lang_start::hfe4efe1fc39e4a30

      18:     0x7fcc0d82eec4 - <USER5>

      19:     0x55868170cf09 - <unknown>

      20:                0x0 - <unknown>

Edit 2: I am not sure if this discussion belongs here. Let me know if I should move this somewhere else.

<comment><USER60> I get the same error, except that the library missing for me is "libssl.so.1.0.0".

That is on Fedora 23, and what's really strange to me, is that I compiled Servo about a week ago myself and that build works.

<comment><USER61> I get the same libssl.so.1.0.0 missing lib on F23 as well. I've tried creating a symlinked file... but it still doesn't work.

</comment></comment></comment><comment><USER62> I really hope the UI keeps being that simple. I like it a lot.

</comment><comment><USER63> It doesn't display web page properly: [https://i.imgur.com/VwBJqf7.png](https://i.imgur.com/VwBJqf7.png)

<comment><USER19> Could you explain what's wrong in that image?

<comment><USER63> Texts were streched in Servo (right) compared to Firefox (left)

<comment><USER19> Ah, I see. I suspect that's just servo picking a different font on your machine. It works for me.

We have some issues with choosing fonts IIRC.

</comment></comment></comment></comment><comment><USER64> looks good,

faced 2 issues,including one crash, have submitted tickets, already somebody responded to github issues that was quick.

</comment><comment><USER65> I really the tab interface. Is there a chrome extension that does that to chrome?

</comment><comment><USER39> Can we get rpi build, since you are advertising as browser for embedded use? :)

<comment><USER19> "Embedding", not embedded. Embedding means that the engine can be used within other applications, the way WebKit is often used for webviews.

I beleive Servo does work on a Pi, but probably not well.

<comment><USER14> In particular we haven't finished the GLES2 port of WebRender yet.</comment></comment></comment>


Ask HN: Insecurity as IT worker - <AUTHOR> Hello, some thing bother me. Please do not make any assumptions about me from the username.
I have been around IT +/- professionally for some 6-7 years including student work. My experience has been a lot of everything. Some electronics engineering, some embedded development, some simple web fronts and backs, some desktop UI, some server administration. For the last few years I have been working as "the technical one". Set up services, updates, applications, dig through logs/code to find technical reasons, prod things to move, clean/move/dig through data in DB or write offline script, write some integration middleware, maintain servers (10+ clusters of multiple VMs). A little bit of everything. Maybe rather close to what DevOps should be, or at least how I imagine the role.
Therefore, I am insecure. Time-wise I should have sizeable experience. I can drop into many non-purely-coding fields and have some idea what is going on. I can read documentation, StackExchange, Google. Though, browsing job ads make it look like that even junior programmer is required to have production scale experience with multiple frameworks, DevOps are required to have production experience with various monitoring/logging/orchestration/virtualisation/cloud-solutions/continuous-whatever systems. All I can say is that I am familiar with some tools and know the concepts. I know that I cannot drop into a role and magically make things work. It can take months to actually figure out and cram into my skull how various subsystems interact and interoperate, relations in extensive DB schemas, what actual developement/QA/deployment processes are. And I read online how person X just brushed over documentation and got things running solid, came to hackaton and developed out of thin air what startups with teams release crappy versions of in several months. And therefore I am feeling insecure and doubtful in the job market. How can I overcome this? <comment><USER2> Talk with other people in your field (real people, not cherry-picked histories that could be made up or at least heavily colorized), and _not only_ the ones that _talk_ at conferences. You'll realize that your peers know much less and are much less capable than you attribute to them.

> And I read online how person X just brushed over documentation and got > things running solid,

They didn't. It took them a significant amount of time, it's just very hard to record and later describe this process of trial, error, and backtracking. It's much, much easier to polish the procedure for final publication.

> came to hackaton and developed out of thin air what startups with teams > release crappy versions of in several months.

This "thin air" took significant amount of preparation. The hackaton product is bug-ridden, resource-hungry proof of concept that can't serve more than a handful users, crashes badly on slightly invalid data, and cannot be maintained in production (data backups? recovery after server crash? user management? logging? status monitoring?).

Not to mention that topics for hackatons are chosen specifically to suit well the form of making a PoC in two days. _Useful things_ usually do not fit this time frame.

</comment><comment><USER3> Job ads are a particularly annoying form of lie. Someone sat down and wrote all the things they wish one of their employees knew (but that they don't want to pay them to learn). It's not a very helpful source of information. Hackathons are a pretty bad source of information as well; they haven't taken the time to do any real engineering. Anyone can do a prototype in a weekend, but a prototype is not a product.

Instead of worrying about the job market, be a consultant. Talk to the people who actually care about the things you're going to develop, hammer out a contract with an estimate and a nice price tag, and then deliver it. That sets up a nice feedback loop: agreement, delivery, check, repeat.

Another thing to do is to specialize. The primary skill of a generalist is to learn continuously, and to learn whatever is needed to get the job done. This is a great skill, but it's a trap to only ever learn things shallowly. You need to learn at least one thing deeply so that you can become an expert in it. You'll be able to do more work in the same amount of time, while still delivering quality results. Since you'll be satisfied and motivated whenever you deliver quality work, this will go a long way to ensuring that you're satisfied and motivated all the time. Your level of security then becomes obvious, and you can stop worrying about it.

For example, my own speciality is Firefox. I don't know everything there is to know about Firefox, but I know a lot. Firefox Addons, Firefox embedding, desktop apps built using Firefox, even some of the internals. I take other work too, but Firefox is what I really enjoy; the other stuff is just to fill the gaps, keep me thinking, and provide a change of pace.

</comment><comment><USER4> Not an answer to your question, but just wanted to say I'm in a similar boat as you. I was working for a big tech company doing what I call a "non-core programming" \- analysis role. I was neither a systems programmer nor a math wizard. I knew enough CS background to understand the problem domain very well, and enough Python/stats/pandas/bash fu to arrive at useful answers. But, I didn't see a career in it. I'm now a sysadmin for a research centre and found my lost love for building and maintaining clusters. I don't know if I'd become as smart as some of the people I read about & admire on HN, but I stopped worrying too much and started focussing on the little things. I'm now designing a better version of our research cluster, learning a load of things along the way. Hopefully, once I'm confident enough in myself, I will work on my ideas rigorously and build useful products.

TLDR; I stopped worrying too much and trying to keep things simple, and learn. Don't quite know if my words will be useful to you.</comment>


Ask HN: HMAC Authentication? - <AUTHOR>

Hey guys,
Writing an API here. In the past for authentication,  I've had people include an Authorization: token token=blah in the header.
Since SSL might not be an option for some of our customers (yes, sigh), and to guard against replay attacks, we need to encode the token somehow.
I noticed amazon uses HMAC, so I set out to create something similar. No, I'm not trying to make my own crypto, I'm trying to use the cryptographic primitives as they were intended:
Authorization: hmac_v0
 time=urlEncode(iso8601(currentTimeStamp())),
 username=urlEncode(username()),
 nonce=urlEncode(base64(random(15))),
 sig=urlEncode(base64(HMAC("SHA-512", base64^-1(secretKey()), bytes(time+":"+username()+":"+nonce))))
Thoughts welcome! <comment><USER2> Amazon uses HMAC authentication because their API supports delegation: the owner of an API resource can craft HTTP URLs that non-owners can use to access the resource in limited ways.

Amazon's API thus needs the ability to create links with built-in integrity checks.

But that feature is a complication. If you don't need it, you should avoid it (for almost all APIs, YAGNI).

Furthermore, if you pay close attention to Amazon's own APIs, you'll see that they got bit for doing this: the canonicalization step they used to make semantically equivalent URLs share the same MAC was vulnerable to an attack that they later had to fix.

Using a library HMAC helps you here; at least you're not doing what Flickr did, and crafting your own hash MAC that Thai Duong will later document to be terribly vulnerable. But you still need to make sure that your HMAC library isn't timeable, and you'll also need to make sure that there aren't type confusion bugs that will make invalid HMACs compare true (I don't know what language you're using).

I'd avoid this altogether and just issue 128+-bit API secrets, like most APIs do.</comment>


Tomorrow, a 100 year old mysterious package will be opened in a museum in Norway - <AUTHOR> http://www.vg.no/nyheter/utrolige-historier/artikkel.php?artid=10060251 <comment><USER2> On front page already:

<http://news.ycombinator.com/item?id=4425989></comment>


Docker having its lawyers taking down the Docker font awesome icon - <AUTHOR> https://github.com/docker/docker/issues/18264#issuecomment-162934157 <comment><USER2> This makes sense from a trademark perspective, you either protect it or lose it.

However I think, particularly for a project that supposedly highly values open source, to go straight to lawyers is a very poor show on Docker Inc's part. An email referring to their guidelines or even chiming in on the project/issue thread on GitHub would probably have sufficed and come across much better from a PR perspective.

I hope this serves as a warning to others regarding exactly what kind of company Docker Inc is.

<comment><USER3> I am guessing the lawyer doesn't expect a lot of people to fight this (since few have the money to burn) but realistically the use of the Docker logo is likely nominative fair use[0].

> by which a person may use the trademark of another as a reference to > describe the other product, or to compare it to their own.

Since the Docker logo is being used to describe or in reference to Docker, it is likely a nominative defense could work.

[0] [https://en.wikipedia.org/wiki/Nominative_use](https://en.wikipedia.org/wiki/Nominative_use)

<comment><USER4> I don't think that's the issue. The issue is that FA designed their own "take" on the docker icon, which is different than the one docker uses. Your rights to manipulate someone else's trademarked logo are much more limited.

<comment><USER5> you might be right, but there is a lot of creativity out there surrounding logo manipulation. i've seen many variations of twitter, facebook, etc; to fit a given design.

IANAL, but if i was running a company and people were using their own takes on my logo to reference my product, I would be flattered more than anything. If they were using it as their own, I would certainly have a problem with that. I was under the impression that it was the latter that companies would need to go after in trademark abuse. Going after the former feels... needlessly abrassive, and can turn off formerly hard-won, die-hard users.

<comment><USER4> All those companies have very strict branding guidelines actually. I ran into this when designing a site for a corporate customer, we had to follow all the branding/logo guidelines in the little social "connect to us" section. [https://about.twitter.com/company/brand- assets](https://about.twitter.com/company/brand-assets) [https://www.facebookbrand.com/dos-donts](https://www.facebookbrand.com/dos- donts) [https://brand.linkedin.com/policies](https://brand.linkedin.com/policies) [https://developers.google.com/+/branding- guidelines?hl=en](https://developers.google.com/+/branding-guidelines?hl=en) etc.

</comment></comment></comment></comment></comment><comment><USER6> It sounds very much like Docker don't an unauthorised interpretation of their logo floating around. They do actually have a small icon which is used for their blog link at the foot of all Docker pages: [https://docker.com/sites/all/themes/docker/assets/images/soc...](https://docker.com/sites/all/themes/docker/assets/images/social/docker- blog-24.png)

<comment><USER7> That image isn't allowed to be used outside of Docker. FTA - [https://github.com/docker/docker/issues/18264#issuecomment-1...](https://github.com/docker/docker/issues/18264#issuecomment-159954856)

</comment></comment><comment><USER8> They should replace it with a penis.</comment>


Xinhua's first English AI anchor makes debut [video] - <AUTHOR> https://www.youtube.com/watch?v=GAfiATTQufk <comment><USER2> Interestingly, there are many Chinese videos on Youtube, discussing current events usually, which are not voiced by an actual human but by a synthetic voice.</comment>


SigSpoof: Spoofing signatures in GnuPG, Enigmail, GPGTools and python-gnupg - <AUTHOR> https://neopg.io/blog/gpg-signature-spoof/ <comment><USER2> I like how this vulnerability report gives a reasonable set of actions for mitigations:

For Users

        Remove verbose from gpg.conf, if you have it.
        Do not use gpg --verbose on the command line.
        Upgrade to GnuPG 2.2.8 or GnuPG 1.4.23
        Upgrade to Enigmail 2.0.7
        Upgrade to GPGTools 2018.3

For developers

        Upgrade to python-gnupg 0.4.3
        Call gpg with --no-verbose to disable the attack.
        Use a dedicated pipe for --status-fd, and do not share it with stderr.
        If this is not easy (or even possible) due to the framework or target platform, consider --batch --log-file FILE to redirect the stderr output, where FILE can be /dev/null, too. Thanks to Patrick Brunschwig for this idea!
        Or, the --status-file FILE option could be used to direct the status lines to a temporary file.

</comment><comment><USER3> I am pretty baffled by the fact that anyone relies on output parsing for verifying a signature. Is this common? I suspect that we will see more vulnerabilities like this in that case.

If one relies on a command line tool for doing this, wouldn't it be safer to have a command line switch which lets the program exit with 0 if the verification succeeds and another value if it fails?

Has anyone an elif what the fix would be? Just altering a switch (which I suspect) would be a band-aid, imho.

<comment><USER4> As already suggested output parsing here is necessary due to multiple possible outcomes.

I just want to add that if you have to parse command output, enforce the output format as well as you can. The --verbose bug really shouldn't have happened.

<comment><USER3> As I am mainly a Java guy it has burnt into me to never rely on _.toString()_ output for code flow. It seems to me that this is somewhat similar (or has the Unix world a gentlemans agreement that output has an API contract). I'd never touch anything where I couldn't enforce (preferably typed) output to rely on especially in a security context. I think I have already seen command line tools which can return structured content (json, xml) with a switch (I don't remember which, though).

<comment><USER4> > I have already seen command line tools which can return structured content > (json, xml) with a switch

That happens. It doesn't need to a standard format like that however. Some command like tools add a porcelain option that produces output for scripting (ie no ansi color codes, easy to parse, etc). That works well too.

</comment></comment></comment></comment><comment><USER5> I think it's worth mentioning that this is posted on NeoPG's site, which is a fork of GnuPG which seems to do really good work. I'm glad to see this happening since I'm using these tools and fixes are on the way :)

<comment><USER6> Specifically seems to be a fork providing a more concrete API, rather than GPG which has a CLI most people wrap.

Lots of bugs caused by that sort of thing, unfortunately it's all we have for GPG.

EDIT: It appears I was mistaken, the "GPGME" project also exists. I am not sure if that has some serious deficiencies that mean it's not used more often never the less, it's not the only option.

<comment><USER7> There is also GPGME.

</comment></comment></comment><comment><USER8> If I were tasked with adding signature verification to an application I maintain and could only implement it by writing my own parser for GPG output, I think I would decide that something is catastrophically wrong with that design and I cannot support signature verification for the time being.

Am I being naive here?

</comment><comment><USER9> Part 2: [https://neopg.io/blog/enigmail-signature- spoof/](https://neopg.io/blog/enigmail-signature-spoof/)

Part 3: [https://neopg.io/blog/pass-signature- spoof/](https://neopg.io/blog/pass-signature-spoof/)</comment>


UV Labs $100 Million Fund to Build New Online Learning Products - <AUTHOR> http://gigaom.com/2012/12/17/university-ventures-launches-uv-labs-to-bring-data-driven-services-to-higher-ed/ <comment><USER2> _"UV Labs will partner with universities and other higher education providers to build products addressing a range of issues, from accessibility to affordability to accountability."_

From that description it doesn't sound like a startup at all. More like a consulting company. Maybe it will be helpful in introducing the startups they are funding into universities and making it happen.</comment>


Use other DNS servers than your ISP's - <AUTHOR> http://www.chaz6.com/files/resolv.conf <comment><USER2> I see that Level 3 is on the list. Please don't use Level 3 DNS[0].

They have no obligation to provide DNS services except to Level 3 customers[1], they don't like providing those services, and they have been known to hijack DNS requests to inject ads and other services[2] for unauthorized users.

[0] [http://www.tummy.com/articles/famous-dns- server/](http://www.tummy.com/articles/famous-dns-server/)

[2] And if you're a Level 3 customer, you're probably not using this list

[2] [http://james.bertelson.me/blog/2014/01/level-3-are-now- hijac...](http://james.bertelson.me/blog/2014/01/level-3-are-now-hijacking- failed-dns-requests-for-ad-revenue-on-4-2-2-x/)

<comment><USER3> See this post, where the VP of Level 3 says they're providing open DNS: [http://blog.level3.com/level-3-network/a-flawed-study-of- cdn...](http://blog.level3.com/level-3-network/a-flawed-study-of-cdns-and- dns/)

The request hijacking briefly appeared earlier this year, but they seem to have stopped doing it.

</comment></comment><comment><AUTHOR> WARNING: This config file is not to be used as is. Read it attentively and only activate a handful of servers from the list.

</comment><comment><USER4> can someone explain why using your ISP's DNS server is not recommended as hinted by the submissions' title?

seems to me that it really depends on the service quality of the ISP. if you're lucky and have a good ISP, wouldn't using its servers be faster (less hops)? are there other arguments for using different servers?

<comment><USER5> EDIT: fixed DNS IP.

Technically, there may be an advantage to using a 'closer' DNS server with 'less hops', but many national ISPs don't push DNS servers to all POPs. DNS infrastructure at large ISPs tends to be heavily loaded and is scaled based on demand.

It's common, and many wifi routers do this for you by default, to run a local caching nameserver which uses some other ISP nameservers as 'forwarders'. You create less demand upstream as well as getting faster response if you do this.

Obviously you should also be concerned about creating load on DNS services provided by someone you have no relationship with. Some might even consider it rude.

In addition to OpenDNS, Google runs free DNS servers at 220.127.116.11 and 220.127.116.11, but obviously there are concerns with relying upon Google to provide all of the internet's infrastructure.

What we should really all be talking about is decentralized, peer-to-peer DNS, or a system of forwarders we all provide from places like Linode and DigitalOcean, both of which I've used to provide off-site secondary and tertiary DNS for large networks. We should be looking at NameCoin, not just leeching off some other random ISP.

<comment><USER6> 126.96.36.199 should be the second google ip address.

<comment><USER5> thanks, fixed.

</comment></comment></comment></comment><comment><USER7> Personally I think that the only reasonable choice for DNS is to use a local caching dns like unbound or dnscache.

<comment><AUTHOR> I concur, but this raises a quite serious issue due to the suboptimal DNS is designed. If it was a common and global practice and everyone on the the Internet ran his/her own local unbound dns cache, how would the root DNS servers fare with the additional load?

A better solution would be to have a distributed p2p DNS instead of the current one.

<comment><USER5> DNS is designed to keep the root server load relatively low, and before there were "ISPs", yes, DNS was designed for every "network" to have at least one DNS server. Before that, you see, everyone just exchanged copies of a massive /etc/hosts file.

Anyway, I am totally all for a distributed p2p DNS, at least as a replacement for root servers.

<comment><USER8> > Anyway, I am totally all for a distributed p2p DNS

DNS _is_ a distributed, p2p system. The ability to add records that can be globally retrieved is not ad-hoc, but you didn't mention that in your requirement. </obligatory_pedantry>

</comment></comment></comment></comment><comment><USER9> Doesn't have the Swiss Privacy Foundation servers. [http://www.privacyfoundation.ch/de/service/server.html](http://www.privacyfoundation.ch/de/service/server.html) 188.8.131.52, 18.104.22.168

Rough translation of the reason some of it is crossed-out: _Due to a software error, DNSSEC validation is currently disabled. The DNS server with the IP address 220.127.116.11 is (currently) no longer available. In the future, there will certainly be three servers again._

</comment><comment><USER10> One of the advantages of having a Linux front router on your home network is the ability to run your own caching nameserver for the whole network.

And if you install a VPN server there, and VPN clients on your mobile equipment, then you can also access that nameserver from anywhere.

</comment><comment><USER11> you can use namebench[0] to help decide which dns server to use. it will run speed tests against various servers and give you some insight into them.

[0] [https://code.google.com/p/namebench/](https://code.google.com/p/namebench/)

</comment><comment><USER12> One of the best approaches I know is to use something like dnscrypt with e.g. OpenDNS. It bypasses the DNS more easily by not using a typical DNS port

</comment><comment><USER13> And a list of servers supporting DNSCrypt, to authenticate queries and responses sent to the resolvers: [https://github.com/jedisct1/dnscrypt- proxy/blob/master/dnscr...](https://github.com/jedisct1/dnscrypt- proxy/blob/master/dnscrypt-resolvers.csv)

Some of these support DNSSEC and Namecoin.

</comment><comment><USER14> for verizon, replace the last octet with 14 to opt out of verizon's landing pages for unresolved domains.

[http://www.verizon.com/support/residential/internet/highspee...](http://www.verizon.com/support/residential/internet/highspeedinternet/troubleshooting/network/questionsone/99051.htm)

</comment><comment> X-Istence Great resource if you want to start a DNS reflection attack ;-)

Sorry, that's a terrible joke, let's hope people filter egress traffic with IP's that don't match their network from their ISP's.</comment>


Ask HN: Where can I find Web Developers / SEO Experts to hire?  - <AUTHOR>

I am looking to hire some people to work for my company, I need web developers/designers and SEO experts where is the best place to find them? <comment><USER2> Sometimes I freelance on oDesk.com. So you might check that out.

<comment><AUTHOR> Looked at oDesk.com I need my guys to be inHouse, actually come into the office day by day, any Ideas for that outside of normal job posting sites?

<comment><USER2> Well sometimes there are guys near your area. I think you can filter it by location. You can also post on Craigslist.</comment></comment></comment>


Life Hacking Habits of Highly Happy People - onreact-com http://www.marcandangel.com/2008/06/05/the-7-habits-of-highly-happy-people/

<comment><AUTHOR> i gave up on the site when noticed the sneaky "russian brides" link on lower right

<comment> onreact-com Ouch, I didn't even notice those crappy paid links before. Yeah, very bad style.

</comment></comment><comment> onreact-com Just reread the post after 15 months and it still amazed me. Especially the happy ending hack is of tremendous practical use.</comment>


Show HN: Logbuch – A Simple Multi Channel Logging Library for Go - <AUTHOR> https://github.com/emvi/logbuch <comment><AUTHOR> Hi HN! I've build a simple logging library for Go because I couldn't find one that actually logged errors to stderr instead of stdout. This isn't/wasn't possible with popular logging libraries I used at that time, like logrus for example. logbuch allows you to configure the output channel for each log level, provide structured logging and a rolling file appender. It's easy to extend, so feel invited to contribute.</comment>


Open source zero knowledge online office - <AUTHOR> I want to create an open source zero knowledge online office suite. Similar to google docs however all of the information on the site belongs to you. Would anyone be interested in something like that? Cheers for feedback. <comment><USER2> Look at [https://cryptpad.fr/](https://cryptpad.fr/) in this space.

</comment><comment><USER3> Yeah that sounds quite neat, although a massive task I'm sure.</comment>


Neither Fair Nor Accurate - <AUTHOR> http://www.rethinkingschools.org/archive/25_02/25_02_au.shtml <comment><USER2> Sadly the author is just defending teachers' unions without proposing anything better.

There's good evidence that value-added modeling works. Half the problems noted in the link are addressed directly by the modeling (the author is ignorant or misleading) and the other half of the problems noted aren't actually problems (the data being noisy, for instance, is not a real problem).

> On the surface, the logic of VAM and using student scores to evaluate > teachers seems like common sense: The more effective a teacher, the better > his or her students should do on standardized tests.

Au contraire, the logic of VAM is that the more effective a teacher, the more GAINS a student should make, year-over-year. The actual performance level of a student is unimportant and is factored out. That the author doesn't even grasp this point suggests that his criticism is not based on a particularly good understanding.</comment>


Comet – modern PHP framework for building fast REST APIs - <AUTHOR> https://github.com/gotzmann/comet <comment><AUTHOR> I've documented all benchmarks here: [https://github.com/gotzmann/benchmarks](https://github.com/gotzmann/benchmarks)

</comment><comment><USER2> When you say 'fast', it is fast compared to what?

<comment><AUTHOR> To any other API server written in "fast" in common sense language or platform like Go, NodeJS, Java, Net Core, etc.</comment></comment>


Ask HN: Y Combinator-esque program in Chicago - <AUTHOR>

Do any startup incubators or similar things to Y Combinator exist in Chicago? <comment><USER2> The first YC clone of all was in Chicago, actually. I think it's called Illinois Ventures 10. I'm not sure if it's still running. The site is still up:

<http://www.iventures10.com/>

<comment><USER3> For anyone thinking of applying, they're also probably the worst of the YC clones. I think all of the other ones probably add some value by the equity equation, but iVentures has been actively destructive by taking an unreasonable of equity and exerting ridiculous control.

Bad stories abound about them. On thefunded.com they have one astroturfed review and one negative review. I can verify that the anon posting here has the basis to accurately judge iVentures: <http://news.ycombinator.com/item?id=448466>

</comment></comment><comment><USER4> There are a bunch of people talking about this. The most promising stuff seems to be coming from Sandbox industries (i have spent a lot of time with them - so i may be biased).

There are also a bundle of VCs that are talking about this as well. If you want email/jabber me at email@example.com and i will introduce you to peoples.

</comment><comment><USER5> I know some angels in Chicago that are interested in starting an incubator program focusing on translational medicine startups. They have contacts and experience on the regulatory/testing end. Not sure what market you are specifically interested in, but feel free to email me.</comment>


If you're using Ruby trunk, regenerate your keys - <AUTHOR> http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=33633

<comment><USER2> A "counting bits" vs. "counting bytes" bug. Isn't crypto fun?

<comment><USER3> Software that doesn't work goes far beyond crypto algorithms.

<comment><USER2> That attitude is why we have so many crypto bugs. Crypto is (usually) software, and _no_ software works 100% of the time.

</comment></comment></comment><comment><USER4> How common of a practice is it in the Ruby community to run the trunk version? Is it mainly just developers, or is it pretty widely used in production/development environments?

<comment><USER5> RVM, which is a standard tool to manage Ruby versions, does expose trunk:

      mil:~ poet$ rvm list known_strings | grep ^ruby
      ruby-head
      ruby-1.9.3-rc1
      ruby-1.9.3-preview1
      ruby-1.9.3-head
      ruby-1.9.2-p290
      ruby-1.9.2-p180
      ruby-1.9.2-head
      ruby-1.9.1-p431
      ruby-1.9.1-p378
      ruby-1.9.1-head
      ruby-1.8.7-p352
      ruby-1.8.7-head
      ruby-1.8.6-p420
      ruby-1.8.6-head

However, in my anecdotal experience most people run patch releases.

</comment></comment><comment><USER6> Yikes, this seems about as serious as the Debian OpenSSL bug a while back: key generation appears to work, but produces easily broken keys.

<comment><USER2> This is nowhere remotely nearly as bad as Debian's bug, which broke the _underlying library_ underpinning most of the crypto on Linux, and broke _the most universally sensitive component of that library_.

<comment><USER6> Both cases cause key generation to produce weak, easily broken keys. I agree that far less software does key generation with Ruby than with OpenSSL, but that aside the severity of the bug seems quite similar.

<comment><USER7> While the effects caused by each bug might be on a similar level, I would argue that the fact that this particular bug was never released in a patch (I don't think I've ever seen anyone using Ruby trunk outside of those hacking the Ruby interpreter) makes it less severe.

</comment></comment></comment></comment><comment><USER8> Luckily, the set of people affected is actually the intersection of people running Ruby trunk and people using Ruby's libraries to generate keys.

</comment><comment><USER9> Could someone please explain to me what this code is doing in the Ruby tree in the first place?

My uses of OpenSSL in straight C don't involve performing this kind of bit twiddling, or really any bit twiddling, calculation, or manipulation at all. That's kind of the point of using OpenSSL.

<comment><USER10> Since the OpenSSL::PKey::RSA.generate method lets you generate RSA keys with a different exponent there is some manipulation needed between the ruby side and OpenSSL. From my understanding the code was part of a refactor to release the global interpreter lock, if possible, while generating RSA keys.</comment></comment>


Git dotfiles without the bloat (rake, yadr, make, kitchen sink) - <AUTHOR> http://blog.piasetzki.name/post/15190147170/git-dotfiles-without-the-bloat-rake-yadr-make

<comment><USER2> This really is super-simple, and I like that. However, it doesn't handle configuration files that don't go directly in your home directory, such as $HOME/.ssh/config. I wrote something a few weeks ago which does that while remaining conceptually very simple. You can get it at <https://github.com/sciurus/dotfile_management>

</comment><comment><USER3> Why not just have a git repo working copy in your $HOME directory? That way you can avoid any symlinking mess. The actual dotfiles are the ones from the working copy.

I used to do symlinking but found the working copy in $HOME approach much better.

<comment><USER4> That could work, but where would the .git/ directory be? If you have in $HOME/.git you are inviting disaster with an errant 'git clean...' command. If not you need to deal with managing the options/environment to make the git commands work (though that could be scripted).

I'm curious about this too since something dead simple (and reasonably idiot- proof) would be useful to me as well.

<comment><USER5> With * in .gitignore, you'd have to use '-x' with 'git clean' to delete everything. That's idiot-proof enough for me.

<comment><USER4> Do you intend to never use 'git clean -x...' anywhere in your home directory? when you run 'git <command>' git will go upward through the directory tree until it finds a .git directory. If you intend to run 'git clean -fx' in ~/foo/project/src but are instead in ~/foo/tmp/src/ (which is not a git repository) it will run that clean against all of ~/ instead.

Having ~/dotfiles/.git and aliasing a command that sets GIT_DIR=~/dotfiles/.git and GIT_WORKDIR appropriately would be safer.

<comment><USER5> I understand the .git search path, but I almost never use `git clean` in my projects (usually just `git reset --hard` or `make clean`), so I've never been too worried.

But your solution is definitely safer -- although I think you meant GIT_WORK_TREE, not GIT_WORKDIR, right? I'm going to switch. Thanks!

EDIT: Working nicely :) [https://github.com/nixme/dotfiles/commit/64486fe25e6750567a0...](https://github.com/nixme/dotfiles/commit/64486fe25e6750567a01cea49f527686c56ea365)

<comment><USER4> > I... usually just `git reset --hard`

This is still risky if your ~/.git had uncommitted changes. I'll admit to being a little paranoid but I spent enough time on the #git irc channel to learn that any advice that is potentially dangerous will _always_ be used in the dangerous fashion, often without knowledge of the risks. > although I think you meant GIT_WORK_TREE, not GIT_WORKDIR, right?

Yeah, brain cramp on that one, sorry.

</comment></comment></comment></comment></comment></comment><comment><USER6> Fails to delete symlinks to removed dotfiles. Doesn't support splitting dotfiles amoung multiple repositories.

I feel that the right solution to this is going to be vcsh.<https://github.com/RichiH/vcsh> No symlinks to dotfiles, all the files live in $HOME, but vcsh can be used to switch between accessing different git repositories that contain different of the dotfiles. <http://vcs- home.branchable.com/> has more.

(Also, rake? yadr? vcsh is a posix shell script.)

<comment><USER2> Sure it supports splitting dotfiles among multiple repositories. Just create multiple repositories and change the path in the post-commit hook. Deleting symlinks would be nice, but I'm not sure it's worth the complexity implementing it would add.

vcsh sounds like a neat system if you need to have multiple repositories with the same working directory, but I don't understand the advantages of this for managing your dotfiles. My eyes glazed over when reading about the proposed system in section 3.2 of the README.

</comment></comment><comment><USER7> I want to be able to manage other config files that aren't in my home directory at all. Some of them are even owned by root: httpd-vhosts.conf, /etc/hosts, php.ini... any good solution for that? I'm willing for it to be complex if it works.

<comment><USER8> Manage in what sense? If you're trying to sync. between multiple machines, one approach is to check in the /etc files in your home dir and symlink. Or are you looking for something else?

</comment></comment><comment><USER9> I can't see the whole line of the code.

<comment><AUTHOR> Fixed. It's also in the git repo.</comment></comment>


TSA Pressures Mainstream Media Not To Cover Story - <AUTHOR> http://tsaoutofourpants.wordpress.com/2012/03/08/breaking-tsa-threatens-mainstream-media-not-to-cover-story/ <comment><USER2> The term "security theater" has been tossed around a lot, but I think it's pretty clearly coming to that. Asking the mainstream media not to cover something like this is completely indefensible from a security standpoint - what, terrorists only learn about security flaws from TV?. It's pretty patently only about keeping their budget.

Also, just going to throw this out there, but it is fairly possible that the email is totally fake.

<comment><USER3> No. It's not "coming to that". We're well past the security theater stage, and into the nightmare stage.

Even hinting that any media not cover this or ANY story is so, so far beyond the purview of TSA that it is shocking (or should be shocking—it has become rather hard to be shocked by TSA) that they would even consider pulling this.

The Supreme Court should slap them so hard that their acronym gets mixed up. This is an outrage.

(edited to add snark) I thought of the perfect new acronym! STA: Security Theater Administration.

<comment><USER4> Hinting that media cover or not cover any story is so far beyond the purview of the TSA that no competent journalist would consider taking them seriously, making this a comparatively mild nightmare.

The Supreme Court can't "slap them" for anything; someone with standing would have to bring a case, and for that case to have merit, some journalistic outlet would have had to have its discretion _actually_ impinged by the TSA.

<comment><USER5> There might be a suit brought on behalf of one of these reporters and/or their employer arguing that the implication of consequences from such a powerful entity without a court order constitutes illegal interference with their business, possibly entitling them to some damages, and more importantly, establishing some very important precedent which might prevent the TSA from ever attempting such a stunt in the future. I could certainly see many lawyers salivating at the prospect of winning a suit against such a well-funded target, not to mention the notoriety such a contentious issue would bring them in any event.

<comment><USER6> You are not familiar with Sovereign Immunity. No lawyer in the world salivates at the thought of suing the federal government.

<comment><USER5> Maybe you're not familiar with the Federal Tort Claims Act, which provides a waiver for the federal government's immunity in the case that a federal employee has been shown to have caused wrongful damage.

<comment><USER6> I am familiar with the Federal Tort Claims Act. No reasonable person would consider your original claim a tort. Where are the damages from one government employee making a hollow threat? What specific expenses or losses did the newspaper incur because a federal employee made a threat?

Your case is weak, otherwise lawyers would be fully employed.

<comment><USER7> What if they suddenly find all of their reporters have been added to the federal no-fly list?

<comment><USER8> Then they would have a case. Also if if jackbooted TSA thugs showed up to burn down the newspaper building. But since no one has even alleged that any of these things have happened, can we skip the wild and crazy speculation?

<comment><USER9> Except what actually happens (Hello, PATRIOT act!) is that all the evidence of harm is secret, and so the Supreme Court refuses to grant standing to any injured party, and so discovery never happens and the evidence can never be brought to light and the harm never proven in court. This story has been repeated over and over since 2002.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Just want to point this out: "strongly caution" is what the TSA flak told the reporter (according to the reporter). That doesn't necessarily mean "don't report this or we'll send you to Gitmo". It most likely was expressed in the context of "you're going to look stupid/spread misinformation if you do."

I'm not saying the TSA flak won't be vindictive if a reporter covers the story. I'm just saying, there's not an immediate reason to jump to this conclusion. You don't get to be TSA flak by writing thinly-veiled threats that are easily retrieved through public records requests.

<comment><USER11> I think it's probably in the middle.

You have to remember that journalists rely on sources, and some of those sources come from government agencies. A strong caution contains an implied threat of non-cooperation, i.e. if you cover that story, we will be feeding other journalists more info than we feed you.

We've already been seeing this a lot with the current administration, regarding trying to ban Fox News from the press pool (ok, I am no fan of Fox News, and I was a fan of Obama in 2008, but COME ON). In context, this is a meaningful threat.

However, I wonder if the issue has to do more with the "get rid of the TSA" rhetoric in the post than it does with the security hole.

<comment><USER9> You need general, sure but the TSA management is not Apple, or even a politicians who uses media manipulation to win hearts and minds. It is just inept damage control trying to cover up corruption and incompetence.

</comment></comment></comment><comment><USER12> So, the US collectively pays for the TSA. The TSA takes your money, buys into the accountability of body scanners - somehow miss (then deny) the vulnerability – one a terrorist _could successfully_ overcome - and they're asking, what? That no one know about it? Are you serious? Like the TSA is a newb database admin that accidentally dropped the users table or something? The TSA is literally fucking with your lives and you pay for it and seriously being told to shut up about it in no uncertain terms. Yikes.

What gets me is that the person who pointed out this flaw _actually demonstrated it_. I shutter to think what would have happened to this information had he only provided anecdotal hypothesis.

</comment><comment><USER13> The TSA probably views its own mission as largely a propaganda mission. It's just creepy when we realize that it is trying to silence public debate.

The biggest oddity to me is that it's been over 10 years and this debate hasn't actually happened in the mainstream media.

I think one aspect of most orgs that have entrenched power is that they are always very deferent toward government. NPR is a great example... there is lots of coverage of various wall street schemes, mention of greed as a problem in the private sector, etc., but the underlying message in most of the stories is that government is beyond reproach.

<comment><USER14> I don't know if that's entirely true. NPR was really suspicious of the government before 2008. Then something changed.

<comment><USER15> Have some data to support your cognitive bias?

<comment><USER14> Not sure that data is available, but I was listening to NPR news during that time. I thought they did decent job of highlighting the poor behavior of our government. Then things changed (not government behavior, which is the same if not worse).

At the pinnacle of the credit crisis they started hating on the financial services sector. As if they had any idea of what credit derivative were. The "experts" they had on air seemed to have a textbook definition which would then be simplified by saying "It's basically gambling". Uhg.

At some point I realized that most of their "experts" (in all their coverage) were either working for the government, the Federal Reserve, or had financial ties to the government (grant recipients, lobbyist, etc...). I stopped listening around 2010 after I found myself yelling at the radio too often. Maybe things have changed.

</comment></comment></comment></comment><comment><USER16> The government supporting the TSA, despite its People pushing against it, is a prime example of _failure of democracy in the United States_. The People elected a government who does not what they want!

Some countries hold referendums to vote on controversial topics. It would be a great solution to hold one in the U.S. at the federal level asking a very simple question: "Should the TSA be shut down? Yes/No". Direct democracy at its best. Unfortunately the U.S. constitution does not provide for referendums at the federal level... <http://en.wikipedia.org/wiki/Referendum#United_States>

<comment><USER4> Be careful what you wish for. The capital-P people are just peachy with those machines. I traveled last week and saw nobody (other than myself) opting out. The people --- in the aggregate --- do not care about this issue.

Left to "democracy in the United States", a referendum that requested the elimination of the "opt-out" process in favor of 0.5s of wait time at the security lines would probably pass in a landslide. Thankfully, we're governed not just by a legislature but by a Constitution interpreted by a panel of judges with lifetime tenure.

<comment><USER17> I don't think your observations back up your conclusions with regard to public support for the machines.

The choice people have is between these scanners and a highly intrusive "pat down" which typically includes some TSA agent's hands on your junk. That's not much of a choice.

<comment><USER4> If you'd like to make that argument, you can, but it doesn't rebut the poll data that shows a clear majority of Americans favor the machines.

 _(I would prefer they did not, but you can't always get what you want.)_

<comment><USER18> Favor the machines over a pat-down. They would actually _prefere_ neither.

<comment><USER4> Sorry, this is wishful (I share your wish). The reality is, the polls aren't posing the either/or question. Respondents can favor the imaging machines _and_ reject the pat-downs. Here's a sample question:

        The Transportation Security Administration is increasing its use of so-called
        'full-body' digital x-ray machines to screen passengers in airport security lines.
        (Supporters say these machines improve the ability to spot hidden weapons and
        explosives, and reduce the need for physical searches.) (Opponents say these machines
        invade privacy by producing x-ray images of a passenger's naked body that security
        officials can see, and don't provide enough added security to justify this.) Which
        comes closer to your own view – do you support or oppose using these scanners in
        airport security lines?

You would find the actual breakdown of responses equally dispiriting.

Americans think the imaging machines are a good idea. Americans are unreasonably scared of threats to airplanes. That shouldn't surprise you, since Americans are also unreasonably scared of airplanes.

In any case, if this is a "failure of democracy", it is not a failure of the kind imagined by the root comment on this thread.

<comment><USER16> It is right that about half of the Americans don't fly very often and seem for the scanners according to some recent polls. My "failure of democracy" statement was exaggerated I think.

On the other hand, people who fly somewhat frequently seem to be almost all against them. The guy who published the video said comments against the machines on his blog outnumber 20 to 1 the people who support them.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> The story he's referring to is this one:

[http://tsaoutofourpants.wordpress.com/2012/03/06/1b-of- nude-...](http://tsaoutofourpants.wordpress.com/2012/03/06/1b-of-nude-body- scanners-made-worthless-by-blog-how-anyone-can-get-anything-past-the-tsas- nude-body-scanners/)

</comment><comment><USER20> So the TSA is "securing" airports by trying to keep vulnerabilities secret. Their thinking seems to be, "if no one knows where the open door is, no one will get in." Surely that will work out well. Not!

Bruce Schneier must be getting a kick out of this.

<comment><USER11> Indeed. Here's what I posted on Facebook (mildly edited for clarity) about the TSA's response (btw one of my Facebook friends is a TSA screener):

Some thoughts about this.

The main defense that the TSA offers over the body scanners in this regard is that it is somehow better/harder to circumvent than the metal detectors, and that it's only one part of a larger program using layers of security.

We can argue about the specifics but the idea of layers of security is one thing the TSA is doing right. One of my complaints about the body scanners is that they are not implemented in a way that makes full use of this (tandem to a metal detector, as separate layers, ideally in conjunction with behavioral indicators). But that's neither here nor there. I want to talk about testing.

As a software engineer, I know there is testing, and there is testing. Extensive pre-deployment testing is important. There can't be any doubt of that. However, it is also by definition incomplete. Stuff will always get missed. Real testing in a security environment involves the sorts of things that this video involves--- many people looking for ways to circumvent a given technology and doing so. A few professional testers will miss stuff because everyone has blind spots. This has to be an ongoing thing, and it has to rely on independent individuals not beholden to the organization ordering the testing.

In the computer software field, while the stakes are lower, we deal with a level of constant attack unmatched in any physical security field. A firewall in the rural US is under more constant attack than any US troops on any battlefield and I have logs to prove this, so in my industry we have had to find better ways of dealing with these problems than we see with the Department of Homeland Security today. While my life may not depend on my firewall holding up, my livelihood very well might, as does all of your credit card data depend on firewalls of places like Amazon.

The video I linked to yesterday, while I don't agree with all of the political remedies proposed is a solid example of penetration testing, and the sort that makes us more secure. We should no more trust the TSA with securing our airports than we should trust Microsoft with securing our data. Microsoft can't get there without armies of white-hat hackers reporting vulnerabilities before the bad guys find and exploit them. The TSA shouldn't attempt this either.

Just this week we saw a massive security hole discovered at Github, which many open source projects use. This hole allowed anyone who had an account (and anyone can sign up!) the ability to commit software changes to any project on the system. The severity of this problem was just unbelievable. In all likelihood this would have gone at least partially unfixed (given past attempts to get the software fixed) had it not been for one daring individual breaking into the system in a reasonably responsible (as far as we know, but if you use github, audit your code!) way.

But imagine if a bad guy did this? What critical systems would be vulnerable for years because of malware planted? The fact that it was reported in a public way after a previous fix was attempted and fell flat was a good thing.

I have been on the receiving end of accusations of fearmongering for exposing security holes (in software). The fact though is that this is usually the first step to getting the problem fixed. Whatever else is discussed, we need to keep that in mind.

The correct response should have been, "We are evaluating this report and, once we are finished doing so, will institute whatever corrective steps appear to be necessary to solve the problem." This is not it.

</comment></comment><comment><USER21> Though both the email and the blog response from TSA are incredibly unprofessional, the email is NOT intimidation or a "veiled threat", and exaggerating by claiming it is is not going to help a sane discussion about this issue. What do you think the TSA is "threatening" to do? They have no power over the media.

All the TSA are saying is "exercise caution with reporting on bloggers that make random statements because you can end up looking stupid". They're wrong in this case, of course, and most likely know they're wrong, but that doesn't make their statement be intimidation (nor should it be read as such). Let's stay reasoned and calm, people.

<comment><USER22> Is that what the TSA actually said, or just your interpretation of it?

<comment><USER23> _Wouldn't it be a shame if your shop got broken into, looted and set on fire?_

Is the above sentence a threat? Of course it is. Not literally (I did not directly say that I would send thugs to loot your shop if you refused to pay me protection money) but a _reasonable person_ would, more likely than not, interpret it as a threat.

If I did _not_ mean it that way but was so dumb as not to anticipate that you would read it that way, I would deserve to go to jail for extortion anyway.

And the TSA, by virtue of having the power to add people to the No Fly List without public scrutiny _and_ knowing of all the rumours of them having added people for political reasons, they should expect any "request" they make to be interpreted that way, and they should take extra care to ensure that it isn't.

</comment></comment></comment><comment><USER24> Overlay a thin layer of material over the metal plate (the dark/black region in the images) that has a regular repeating pattern (think checkerboard) that shows objects suspended beyond the body's silhouette.

Problem solved.

<comment><USER25> The problem isn't that this one particular technique exists. The problem is that the TSA's decision making process led them to spend billions of dollars a year against the advisement of the top security experts in the world.

For an organization who's sole purpose is the security of the American people, they're awfully bad at doing things that ensure the security of the American people.

<comment><USER26> A big problem with that procurement was the very close ties between former TSA director, Michael Chertoff, and the company that makes the full body scanners.

</comment></comment></comment><comment><USER27> Eagerly waiting for the Streisand effect

</comment><comment><USER28> FTA: "For obvious security reasons, we can't discuss our technology's detection capability in detail"

The only situation that would make this "obvious" is if the technology is inadequate. Basically by saying that, they're admitting to a large amount of security through obscurity.

Imagine a bank's website saying "For obvious security reasons, we can't discuss how our passwords are store in detail". Wait, why not? If the technology is adequate to the task you should be able to explain exactly how it works without compromising anything!

<comment><USER22> Can you cite a bank website where they DO explain how their passwords are stored in detail?

<comment><USER29> I don't talk to many banks about their password storage, but they all should.

<http://en.wikipedia.org/wiki/Security_through_obscurity>

</comment></comment></comment><comment> chao- What really has my interest is not the TSA's request/threat. That part is unsurprising. Instead, my mind ran through a few ideas about what a news story on this topic would entail. From the last time I bothered to watch CNN, I recall they've acquired a penchant for saying "And a viral video of [topic] is hot on the Twitters today!", showing the video, getting someone in-house to do surface analysis, reading off some Facebook posts, and cutting to commercial. Ideally, a reporter does their own investigation on the topic, either by contacting the TSA and arranging to film while testing the scenario depicted here, or by doing a more undercover verification ala the video itself.

I don't wish to be specifically judgmental of CNN, and I don't wish to over- analyze my mock-scenario. Instead I'm using the thought experiment of a news report on this topic to express frustrations with journalistic practices I have already seen elsewhere. It seems to me there isn't as much motivation on behalf of larger news organizations to put together a verified report, when you can replay something from YouTube and people will believe it much the same.

But maybe there are positive aspects? Crowdsourcing the genesis of news topics allows for a better breadth of topics, clearly. And I recognize there is a need for it in situations such as the Syrian unrest, Tibet, or any place that foreign journalists can't easily access. I get the feeling though, when I go to 'old' media, that I expect old media standards and practices. When I go to 'old' media and get a replay of internet videos followed by an equally-long segment of internet comments, I wonder why I'm not just browsing the internet for myself.

</comment><comment><USER30> Security through obscurity.

Doesn't work on the Internet. Doesn't work in real-life.

<comment><USER31> Passwords are Security through obscurity. That does not make them useless, just vulnerable.

<comment><USER32> A password is a best-effort attempt at implementing the theoretical construct of a 'cryptographic shared secret'.

Passwords are from perfect at that of course, but it's not correct to call them 'obscurity' either.

The distinction between security and obscurity derives from Kerckhoffs's principle. <https://en.wikipedia.org/wiki/Kerckhoffs%27s_Principle>

</comment></comment></comment><comment><USER4> They're allowed to say that. The media is allowed (encouraged; morally obliged, perhaps) to ignore them. Whether he's right or wrong (and _I'm sure he's right_ ), the bureaucracy would prefer to continue working towards their quarterly MBOs than to address another controversy. This is a non-story.

<comment><USER3> Completely absurd. The TSA is allowed to vaguely intimidate the media? I call bullshit. I know from reading hundreds of your comments that you are a reasonable man, so please explain where you are coming from on this.

<comment><USER4> The premise of your outrage is that the TSA has some authority over the media that they are abusing. The TSA has no authority over the media. The media routinely publishes terrifyingly sensitive government secrets over the direct and strident objections of the DoJ and gets hauled into court to defend itself. That the media has a pretty excellent track record in those courts is not so much my point as that the media has so much experience building that track record that only the dumbest reporter would give half a shit whether some TSA functionary "strongly cautioned" them not to run a story.

Since this observation isn't so much "insightful" as it is "completely obvious on its face", to me, Occam's Razor suggests that what the TSA was implying was that the guy was _wrong_ , and that his story was going to make the media look dumb.

Since I have never once seen anyone from the TSA land on the right side of an argument, from airport security to spelling and grammar, we don't have to argue about which one of us is more vehemently contemptuous of it, or, in this case, its argument.

</comment></comment></comment><comment><USER33> They're not really threatening anything, they're just asking "please don't cover this story". That's their right and it's not censorship unless the journalist faces consequences for covering the story (no future interviews, harassment by the legal system, etc.) It doesn't seem like any consequences are mentioned or implied, so this doesn't bother me. Of course the TSA doesn't want negative press. Would you?

<comment><USER34> No, they're _not_ asking _""please don't cover this story""_. They are _"strongly cautioning"_ them not to, which can reasonably be interpreted as a veiled threat.

<comment><USER33> A threat to do what?

<comment><USER34> _"I know where you live."_

What is that a threat to do?

How about, _"Be careful."_?

<comment><USER33> The government's powers are limited by the Constitution. Someone who threatens to follow you home and kill you, however, is operating in an environment without restrictions, and you might therefore worry that you're actually going to be killed.

"Prior restraint" is a well-tested concept and it doesn't do very well in court. And all the government has to harass you are the courts.

<comment><USER34> Just because you think that the only way the government is capable of harassing you is with the courts, does not mean that they are not capable of veiled threats. A threats are not limited to personal physical violence.

Though I of course strongly disagree with your premise anyway, _particularly_ when the governmental agency in question is the DHS.

</comment></comment></comment></comment></comment></comment><comment><USER35> This is insanity. I try to avoid flying as much as possible.

However, the whole controversy also seems to lack common sense. An easy "solution" to this whole problem is to ask people to go into the machine and do a 360 degree rotation before emerging on the other side. I'll call this the "Airport Dance" :-)

What? It's not like we aren't made to dance already!

<comment><USER36> The current arrangement subjects you to one short burst of radiation to take a static image, and it's enough energy to have some doctors worried. Multiply that up by however many frames you want to capture, and I don't think it would be "some doctors" any more.

Besides, I've got no idea if the machines in place have microwave units that can withstand a high duty cycle like that. I wouldn't be surprised if they can't.

<comment><USER37> Does anyone have some independently verified numbers for the amount of radiation that a FBS exposes a passenger to and how it compares to the amount of radiation exposure the same passenger would get from 3 hours in a plane? The TSA claims that the latter is significantly (like 100x) greater than the former.

<comment><USER36> There are numbers out there, but the problem isn't just the amount of energy, it's where it's concentrated. The theory goes that because of its very short wavelength everything that gets absorbed is concentrated in the topmost layers of the skin, so the energy density where it might be damaging is much higher than the absolute amount of energy might suggest.

From memory part of the argument was that the studies hadn't yet been done which might show whether this could be a health issue, so claiming the scanners were safe was at best premature.

</comment></comment></comment></comment><comment><USER38> I think the problem is just that the TSA is run by unprofessional people who clearly have no idea what they're doing.

</comment><comment><USER39> I hope the email is fake. Yet I would not be surprised if it wasn't. Most government employees I have met are not really that intelligent. Add that to a bit of power and little to no accountability and you have an instant recipe for disaster.

<comment><USER40> Sari Koshetz is the name of a TSA representative. Google her.

<comment><USER41> So?

Edit: Seriously, what does that prove? Someone faking an email can Google for TSA spokeswomen just as easily as someone trying to verify it.

</comment></comment></comment><comment><USER42> I remember before they were rolling out the scanners seeing a story run by the mainstream media about how congress had invested large amounts of money in the scanners before they realized how useless they were and now they were going to push really push hard for them to become the norm. I guess they succeeded. It sucks how in America a logical argument bumps heads with a touchy subject.

</comment><comment><USER43> Journalism has been called the fourth pillar of the government.

Its job is not to prop up the establishment, but rather to keep it responsible.

</comment><comment><USER44> Apperently Sari Koshetz doesn't deny anything

[http://www.popehat.com/2012/03/08/in-which-i-strongly- cautio...](http://www.popehat.com/2012/03/08/in-which-i-strongly-caution-the- tsa-to-snort-my-taint-and-probably-get-on-the-no-fly-list/)

</comment><comment><USER45> For someone who clearly values security, I am surprised to see him running Internet Explorer :-/

<comment><USER46> It's MS Exchange's web-frontend (OWA), which doesn't play nice with most browsers (last I checked it degraded into some "basic functionality" mode when using anything but IE, although that was a while ago). FourTen Technologies is his company and seems to be mainly a Microsoft shop based on their staff's skill set (ASP, .NET, COM, MSSQL, AD) and portfolio: <http://www.fourtentech.com/about/whoswho/>

Amusingly their portfolio includes a major project for the NYPD building a automated surveillance network designed for (amongst other functions) _"detecting unauthorized individuals in secure areas of the financial district"_ \-- <http://www.fourtentech.com/mcs-nypd.html>

</comment></comment><comment><USER47> Security by obscurity.

</comment><comment><USER48> "Totalitarian democracy is a term made famous by Israeli historian J. L. Talmon to refer to a system of government in which lawfully elected representatives maintain the integrity of a nation state whose citizens, while granted the right to vote, have little or no participation in the decision- making process of the government."

<http://en.wikipedia.org/wiki/Totalitarian_democracy>

<comment><USER49> See Also: <http://en.wikipedia.org/wiki/Managed_democracy>

</comment></comment><comment><USER50> The TSA might as well just move into Barbara Streisand's beachfront property if they are using these kind of tactics.

</comment><comment><USER51> I am outraged.

</comment><comment><USER52> Harassment and directly attacking Free Speech? ... but somehow I suspect that this was an employee independently acting stupid, and not an institutional policy.

<comment><USER34> Did you read the TSA's recent blog post about this? It displays exactly the same sort of attitude.

</comment></comment><comment><USER53> To play devil's advocate - he clearly has an agenda and his video is more long and boring political ramblings than something really substantial.

<comment><USER54> 1\. Anyone who says they don't have an agenda is lying. Everyone has their reasons for doing anything and everything.

2\. There is absolutely nothing wrong with having an agenda.

<comment><USER55> Adding to that:

If he makes a bundle of money in the course of defending our freedoms, then my hat is off to him. Bravo!

From an economics perspective, the fact that someone has turned a profit (in a free market) is _prima facie_ evidence that he has delivered something of value.

<comment><USER56> Or he's discovered a new kind of sucker, cf. homeopathy.</comment></comment></comment></comment>


Treating PTSD with Ecstasy - <AUTHOR> http://www.cnn.com/2012/12/03/health/ecstasy-ptsd-3/index.html?hpt=hp_c2 <comment><USER2> Commentary on the most recently published study of this treatment, previously submitted to HN and discussed here:

[http://www.sciencebasedmedicine.org/index.php/ecstasy-for- pt...](http://www.sciencebasedmedicine.org/index.php/ecstasy-for-ptsd-not- ready-for-prime-time/)

<comment><USER3> Here's the commentary:

<http://news.ycombinator.com/item?id=4837223></comment></comment>