Why aren't PGP and SSH keys popular as a second factor for authentication? - <AUTHOR> https://security.stackexchange.com/questions/127288/why-dont-pgp-and-ssh-keys-see-more-widespread-use-as-a-second-factor-when-authe/127310 <comment><USER2> I'd be wary of "proving one's identity" via (one of) one's SSH key by connecting to an unknown SSH host.

The main reason is a (maybe not on HN) little known scenario where the user has SSH key forwarding enabled, and the host they SSH to takes that forwarded identity and uses it to, say, fetch your private repos on github and the like.

[https://news.ycombinator.com/item?id=9425805](https://news.ycombinator.com/item?id=9425805)

[https://www.reddit.com/r/netsec/comments/3frnxb/my_ssh_serve...](https://www.reddit.com/r/netsec/comments/3frnxb/my_ssh_server_knows_who_you_are_seriously_try_ssh/)

I'd have _no problems at all_ signing a pgp message the likes of "I'm proving I am myself, and that you requested me to sign also with token QIMdoV76LIvymGvTxXEB8LkIIqfM4nEm5W"

<comment><USER3> This is pretty easily solved by using different keys for each service you wish to authenticate with (the same idea as using different passwords, basically). I already do this when pushing to GitHub over SSH versus SSHing into my own server.

<comment><USER4> This can become problematic if you're using an SSH agent and have 4+ keys loaded into it. The problem is that your agent will step through keys to try auth with, but most OpenSSH servers will reject keys after 3 failed attempts. This means that you also need to keep an up-to-date entry in ~/.ssh/config as to which key to use with which system.

<comment><USER5> Is there a way to specify the hashed key fingerprint (or a just-long-enough subset of the key fingerprint) instead, as you try to authenticate to a specific host?

Or an interactive key selection on the command-line? With a 'Remember my choice' option. These could be relatively easy UI enhancements for a command- line SSH agent.

<comment><USER6> With the agent the -i flag or IdentityFile config option is not honored.

You then must maintain different agents, one for each distinct set of keys you want to use. The ssh-ident package helps do this.

Or, you must insert a filter proxy between the real agent and the ssh client. The ssh-agent-filter package helps do this.

</comment></comment></comment></comment></comment><comment><USER7> There's a much more obvious choice: TLS with client certificates. It's already available in mainstream browsers.

The key question for all of these solutions is usability.

<comment><USER8> What if we had an web API for using client certificates? Would that help with usability?

<comment><USER5> Like, TLS client certificates? No. The TLS handshake needs to occur before any other content is exchanged. This is a user-agent problem to solve, not a code- executing-inside-the-user-agent problem.

If you meant some other notion of 'client certificates', that's called a password manager.

<comment><USER8> Thanks for the informative response. Can you express in some more detail the user agent problem we have?

<comment><USER5> Sure. The thread's origin refers to TLS. Like some others have said, this is a UI/UX issue, and the UI needs to exist in the browser/curl/httpclient, as that takes the role of the client in the TLS handshake. The existing UX for selecting -- and managing -- keys and certificates is bad, and the cognitive load of these to the user is high. We don't know what a good UI would looks like because no one has made one yet, but the competition is existing 2nd factors: hardware token generators, software token generators, confirmation emails, confirmation texts, etc.

I assume by Web API you meant some functionality hook exposed in the browser which the website/webapp can access, like WebRTC [1], or web workers and others [2][3].

The sort of API you entertain would be useful for application-level authentication, but from the perspective of the end-user, it would fulfill a similar purpose to password managers. Bootstrapping this identity to contain useful data is the biggest issue. There is a similar proposal by security researcher Steve Gibson called SQRL [4], which sends a site-specific public key to a website generated from a master key the app keeps. This scheme is pretty good but it's designed to mint uncorrelatable, anonymous identities, so you're not 'jdc' at HN and other places, but [RANDOM STRING] at HN, and [DIFFERENT RANDOM STRING] at some other site.

I am, however, curious how you'd envision a web app would hook into such an API, and what functionality it would offer.

[1] [https://developer.mozilla.org/en- US/docs/Web/API/WebRTC_API](https://developer.mozilla.org/en- US/docs/Web/API/WebRTC_API) [2] [https://docs.webplatform.org/wiki/apis#List_of_all_APIs](https://docs.webplatform.org/wiki/apis#List_of_all_APIs) [3] [https://developer.mozilla.org/en- US/docs/WebAPI](https://developer.mozilla.org/en-US/docs/WebAPI) [4] [https://www.grc.com/sqrl/sqrl.htm](https://www.grc.com/sqrl/sqrl.htm)

<comment><USER8> Okay that's plenty of background info. So why not expose something like p12U_ImportPKCS12Object() to the web? You could generate and store the key and cert on the user's mobile device and have an app for pushing the cert via Bluetooth (which has a web api). Let the user and web server app sort out what his handle will be. It can be treated as a separate problem (however interesting it might be!).

</comment></comment></comment></comment></comment></comment><comment><USER9> Because Google et al. want your phone number for certain commercial uses unbeknownst to you? Is it possible that personal information could be more valuable to these web companies than hex digits? Marketers cannot do much with a block of hex but they will pay for a working phone number. Collect enough personal information about people and in today's world you have a valuable company.

<comment> nommm-nommm Google requires a phone number to create an account nowadays no matter if you use 2FA or not.

<comment><USER10> Once you set up 2fa via their code generator, you can remove the phone number from your account.

<comment><USER11> Or use a throwaway phone number, then remove the phone number.

<comment> nommm-nommm They verify your phone number.

</comment></comment></comment></comment></comment><comment><USER12> If you loose your github 2FA, they will ask that you prove your identity by SSHing to some host and providing them with the token returned by that host

<comment><USER13> I had recently reset phone and had lost my 2FA recovery codes. This was how I was able to recover my account.

<comment><USER14> Take a look at Authy as a drop-in replacement for your Google Authenticator app. Codes are encrypted and stored on Authy's servers -- they can be re- synced to your phone after a wipe. There's also a Chrome plugin that syncs with the mobile app.

<comment><USER15> How do we know it's encrypted in a way they can't see?

<comment><USER16> The same way you know (or don't) that your existing OTP app is not uploading your secret key.

</comment></comment></comment></comment></comment><comment><USER17> You might find the SQRL system by Steve Gibson interesting.

[https://www.grc.com/sqrl/sqrl.htm](https://www.grc.com/sqrl/sqrl.htm)

Read the "What happened behind the scenes" box for the details. I think it's pretty clever.

</comment><comment><USER18> this is extremely important: just yesterday I forgot my phone at my university (luckily it hasn't been stolen) and realized that i was cut out of most services that use my phone as second authentication factor.

<comment><USER19> Get a pebble! You can have TOTP codes on your wrist where it's a lot harder to lose.

Presumably similar apps available for Android Wear and Apple Watch, but those are too smart for my tastes.

<comment><USER20> Kickstarter idea: a pebble, but just as a 2FA, on your wrist.

<comment><USER15> Wasn't there some RSA authentication fob you could attach to your keys a while back? It generated keys like Google Authenticator and worked without internet thanks to the magic of RSA.

EDIT: RSA SecurID[0]

[0]: [https://en.wikipedia.org/wiki/RSA_SecurID](https://en.wikipedia.org/wiki/RSA_SecurID)

<comment><USER5> RSA is the company, the RSA algorithm isn't involved in this product. It actually uses a TOTP [1], a variant of HOTP.

Here's the famous Blizzard authenticator in the manufacturer's original branding [2], from a competitor. There are others like this.

[1] [https://en.wikipedia.org/wiki/Time-based_One- time_Password_A...](https://en.wikipedia.org/wiki/Time-based_One- time_Password_Algorithm) [2] [https://www.vasco.com/products/two-factor- authenticators/har...](https://www.vasco.com/products/two-factor- authenticators/hardware/one-button/)

<comment><USER15> Right, my mistake. I wasn't sure when I was writing the comment. When I made the edit, I forgot to change the "magic of RSA" part

</comment></comment></comment></comment></comment></comment><comment><USER21> Convenient blockchain wallets, on the desktop and in the browser as extensions, will make this approach much more widely used by consumers.

</comment><comment><USER22> I was thinking about this yesterday. Other than PGP keys, what about cell phone numbers? Everyone collects email, but for real transactional services, a phone is better and an email doesn't matter.

</comment><comment><USER23> I am using duo security (duo.com) these days. Instead of having to type in a number, you just have to press confirm / deny.

</comment><comment><USER24> There was a ton of FUD around PGP and encryption export legalities and commercial use.

There was a window to make this stuff standard 20 years ago and we, as technologists, totally whiffed on it.

The "these are not web technologies" quip at StackExchange made me cringe for some reason. As if this has anything to do with web protocols.

For the sordid history: [https://en.wikipedia.org/wiki/Pretty_Good_Privacy](https://en.wikipedia.org/wiki/Pretty_Good_Privacy)

For yet another sadly ignored, co-opted, would-be-standard: [https://tools.ietf.org/html/rfc4880](https://tools.ietf.org/html/rfc4880)

<comment><USER25> Maybe – but I still think the problem with tools like PGP are the user experience, and not any underlying tech.

If you look at things like WhatsApp and iMessage, they give you the same kind of security in a completely transparent way. And I believe Whisper/WhatsApp also give you a cool way to verify keys in person (I believe they use QR codes?)

So public key crypto is here, and it's widespread. It's just not in the form of PGP, and that's because of the UX shortcomings of PGP.

On a side note, Keybase really is awesome – I have setup keybase and am hopeful for it, but I feel even in that case, if you try to do PGP, it feels a bit odd.

<comment><USER26> It's not just the UX. A very good example: what does "signing a key" mean? You've got public/private key pairs (both of which are called "keys" in some places), you have a master "key" and sub "keys". The master key is called "the key" but doesn't actually contain the sub keys (which are also called "keys". When you sign a "key" what actually gets signed? (Hint: not a key) Where does the signature go? Etc, etc, etc. The Open PGP protocol is just insanely complicated because it took many different iterations to get right and they didn't want to break backward compatibility. The documentation that tries to explain it is downright wrong because they don't want to go down the rat's nest that is the protocol. So even most technically savvy users have absolutely no idea what's going on.

Unfortunately, it can't really be fixed with UX, IMHO. I think we need to learn from Open PGP and design something that doesn't make people's heads (even programmers) explode.

<comment><USER25> Yeah honestly I'm curious as to why Keybase is using PGP – is it really that widespread, or is it that PGP is so hardened with time?

I know the keybase devs lurk around here.

Is there perhaps a way to use the Signal Protocol instead of PGP?

<comment><USER27> Idk about Keybase but I recommended GPG because it was one of only three or so tech the NSA couldn't break per Snowden leaks. They were smashing most stuff. So, my recommendation was modifying proven code to put a better UI on it that ignored most of the complexity to focus on just fundamental features.

Note: Keybase with with their own PGP implementation. Idk what its security is going to be like. I see why they'd use tech that's had years of auditing and attacks, though.</comment></comment></comment></comment></comment>


How to get $12 billion of gold to Venezuela - <AUTHOR> http://blogs.reuters.com/felix-salmon/2011/08/23/how-to-get-12-billion-of-gold-to-venezuela/

<comment><USER3> As a Venezuelan, this is terrible news. Forget economic consequences for a minute.

The corruption levels in Venezuela are incredibly high. Is widely known that the Chavez government has been one of the most corrupt government in Venezuela history.

What do you think is going to happen to this gold when it gets to Venezuela? (If it ever gets there)

I mean, I don't know the dynamics of this, but which authority is going to weigh the incoming gold? Who are we supposed to trust when every institution in the country is in Chavez hands? They basically say what they are told.

Also, our Central Bank does not have the physical capacity to store that much gold. Chavez already offered the basement of the Presidential Palace :S (which I have been to and is as a regular basement can be).

What about the cost of moving that quantity of gold? They are already talking about 40 trips. Yeah, that's going to cost, 400 million according to the article. Money that could be very well spent in say, hospitals: [http://www.noticias24.com/actualidad/noticia/302153/en- fotos...](http://www.noticias24.com/actualidad/noticia/302153/en-fotos-asi-se- encuentra-la-infraestructura-del-hospital-vargas/) )

As for the cash reserves: they are going to Russian and Chinese banks. Sorry to those that might be offended, but personally I have as much trust in these governments as I have in mine.

We have an election in 2012. If Chavez looses (or if he evens runs... he might die from his cancer before that, dunno), that gold is going back. More gold will be lost along the way.

What about the cash reserves? The new government will have to deal with Russians and Chinese institutions under a different premise, because the new government will be or will try to be very close with the US. I think we can expect things to get a bit rough and a lot of gold will go unaccounted for.

Sad news for Venezuela, once again.

<comment><USER4> _Chavez government has been one of the most corrupt_

Really? Venezuela should be a much richer country but was controlled by a cabal of wealthy families that siphoned the wealth off.

Since Chavez, the poverty rates are down and literacy is way up.

The gold move is a smart one. Control of actual gold bullion will be important as we go into these next tumultuous months.

<comment><USER5> Venezuela is one of the last remaining socialist dictatorships in South America. If you look at the other countries who rid themselves of dictators and turned towards market democracy the growth rates have been staggering.

South America is full of resources and natural wealth, and should be a very wealthy economy. The only thing holding parts of the continent back is the class warfare and old marxist/socialist governments.

Look at how well Chile (a benchmark for modern western markets via Milton Friedman et al) and Argentina (for a time) recovered. That is what Venezuela should also look like. I have never heard anybody argue for the South American style of socialist dictatorships and against the reforms that have been demonstrated in the other, successful, nations of the region.

See 'The Miracle of Chile':

<http://en.wikipedia.org/wiki/Miracle_of_Chile>

<comment><USER6> I didn't know there were other socialist dictatorships in South America. We've had many (right-wing) military dictatorships though.

I don't particularly like him, but I think it was inevitable that someone like him would show up given the history of economic inequality in the country. You have to realise that you can only tell people it's their fault for being poor for so long before they react.

<comment><USER3> Yet he tells those same people that the current government faults are cause by the previous governments. Funny since he has been in power for 13 years.

Current problems in Venezuela are the responsibility of this government.

I specially like when they says things like the fact that there are teenagers girls aged say 17, getting pregnant because of the lack of education in our school system. And yet nobody seems to realize that a 17 year old girl was 4 when Chavez got to power.

I tell you, the things us Venezuelans need to hear everyday... it makes you want to cry.

Incompetence at its finest.

</comment></comment></comment></comment></comment><comment><USER7> He's moving the gold because:

* He's worried that sanctions etc could freeze it

* He want's to be able to sell it without being clear about it (so he can buy the next election or make a personal nest egg with it).

Venezuela's bonds moved 50 basis points on this so the markets are obviously worried that the gold's going to start evaporating once it's under his control.

<comment><USER8> Rumors are that Chavez wants to confiscate/socialize the venezuelan gold industry => [http://blogs.ft.com/beyond-brics/2011/08/20/venezuelas- gold-...](http://blogs.ft.com/beyond-brics/2011/08/20/venezuelas-gold- reserves-no-place-to-hide-from-chavez/)

Foreign companies that would lose their mines would very likely try to get hands on the gold that's located outside of Venezuela (with a court order etc)...

<comment><USER9> The correct term is _nationalization_. As far as I'm aware, there have been many nationalized foreign companies in Venezuela but the owners are getting paid. Given that I haven't heard anyone complaining, the prices are probably fair. So, this is very far from confiscation.

<comment><USER10> That is so far from my general impression of the matter, I had to do some news searches to make sure I wasn't taking crazy pills. Fortunately, it seems I wasn't. "Companies are very afraid."[1] Here[2] we have a company whose oil rigs were " _nationalized_ " because they refused to do more work until they were paid the $49 million it was owed. Another article [3] indicates that Exxon-Mobil and Conoco-Philips _might_ get paid for their assets __four __years after nationalization.

[1] [http://www.washingtontimes.com/news/2009/may/12/nationalizat...](http://www.washingtontimes.com/news/2009/may/12/nationalization- continuing/)

[2] [http://www.reuters.com/article/2010/06/24/us-venezuela- natio...](http://www.reuters.com/article/2010/06/24/us-venezuela- nationalizations-idUSTRE65N0UM20100624)

[3] [http://www.stockmarketsreview.com/extras/venezuela_to_compen...](http://www.stockmarketsreview.com/extras/venezuela_to_compensate_american_oil_companies_for_nationalization_20110805_159386/)

</comment></comment></comment></comment><comment><USER11> If ever there was a clear example of why gold makes a terrible monetary base this was it.

And it seems to me that a lot of the reason for gold being worth a lot is countries just sitting on it. If they would sell it to people who would use it (for jewelry or active trading) the price would go down a lot.

And what is the point of just having lots of gold and never using it? It's just a big pile of metal, if it wasn't there would anyone notice the difference? (i.e. could I borrow it, then return it 100 years later? Would anyone notice?)

<comment><USER12> Actually, Chavez has already destroyed his fiat currency. What's a better alternative store of value than gold?

<comment><USER11> Oil would work. It has a large and liquid market. And they have plenty of it.

<comment><USER13> How would you store oil if you wanted to actually have possession of the asset? Barrels of oil in the basement seems pretty unreasonable.

<comment><USER11> The same way you store gold: You pay someone to store it for you. It's bigger so it's harder to store, but it's also harder to steal, so it needs less guarding.

I'm not suggesting it as currency, just if you need something to back your currency oil works a lot better than gold.

</comment></comment></comment></comment></comment><comment><USER14> Facing a similar problem, the Pentagon used 21 C-130 Hercules cargo planes to haul $12B to Iraq. Admittedly, the Pentagon only had to ship pallets of $100 bills, not gold bars.

Surprisingly, federal auditors are now suggesting that some or all of the cash may have been stolen, not just mislaid in an accounting error. U.S. officials claim often didn't have time or staff to keep strict financial controls, so millions of dollars were stuffed in gunnysacks and hauled on pickups to Iraqi agencies or contractors.

[http://articles.latimes.com/2011/jun/13/world/la-fg- missing-...](http://articles.latimes.com/2011/jun/13/world/la-fg-missing- billions-20110613)

</comment><comment><USER15> Charles de Gaulle did something similar in 1965, but he was importing gold from the US, not from England.

Argentina had a similar problem in 1946: its central bank "reserves" were actually held in trust by the Bank of England, in large part as a result of Argentina feeding England through the war, and England (as I understand it) couldn't come up with the cash. The eventual solution was to exchange the reserves for the British-owned railways of Argentina, which unfortunately couldn't be exported in trade to import the things Argentina needed.

I could be naïve, but I think keeping your central bank's reserves overseas in a possibly hostile country is a dumb idea. Chávez doesn't seem to have done a very good job at New-Dealing his country, but he does get some things right.

</comment><comment><USER16> Actually, the logistics (which the article focuses on) isn't as unique a problem as one might think. Australia alone produces about 300 tons of gold each year and I would expect most of it is exported.

<comment><USER17> But not in a single shipment. I don't know how much ships and airplanes leave Australia each day, but let's say it's 1000 (I guess the 2 or 3 main airports alone would do that, but let's say) and if each would take a kilo of gold with them, all produced gold can be send abroad. That's a very different situation from what Chavez apparently is trying to do.

<comment><USER18> I don't understand why this is such a big deal. The solution is right there in the article - send a few ships from the navy, like the Spanish treasure fleets of old.

If England doesn't want armed Venezuelan ships in their waters, use a freighter and escort it all the way back. Divide up the cargo between the ships if you're really paranoid.

The author is inventing a problem where none exists. Transporting large amounts of heavy cargo overseas is a solved problem.

<comment><USER19> Ordinarily, you'd want insurance on such a shipment. Even if you sent the navy, getting insurance for the transport between the bank vault and the armed ships could be an issue.

</comment></comment></comment></comment><comment><USER20> > It would take a little while, but eventually the gold would start trickling > in: if you're willing to pay a constant premium of 2% over the market price > for a good, you can be sure that the good in question will ultimately find > its way to your door

I'm not sure about the authors qualifications but why would I ever risk bringing a bar of gold to a Venezualan bank to earn 2% on my money?

I can get better rates in the bond market with much less risk.

Now if your willing to pay a 50% premium the I can see something working here

<comment><USER17> You get 2% _per year_ on the bond market, but you get 2% _instantly_ when exchanging in the proposed fashion. If you could traffic enough gold, let's say because you are a pilot and fly in and out of Venezuela 5 times per week, you can make a _bundle_ on a deal like this. (make a quick excel sheet - <USER2> can _double_ your money in 6 weeks when you can make an exchange like this 5 times a week! Beat that with bonds!)

<comment><USER20> Sure, but you're discarding all the other costs associated with bringing in gold, plane, fuel, security. These will eat up all of your profit.

As the article stated, 500 million for insurance on 12 billion in gold is allready over the 2% your going to earn. And that's before you factor in any security, borrowing/carrying costs, transportation.

I have done the numbers and you end up in the red on each and every transaction you do:(

<comment><USER17> That's not the point, you said 'I can get 2% on bonds' which is a completely nonsense comparison, that's what I was saying. You confused a 2% per year yield with a 2% per transaction yield.

And the hypothetical pilot that I used as an example doesn't have to pay any costs - he just puts a gold bar in his suitcase. With gold prices of 33k€ per kilo, he can (hypothetically) put a kilo in his luggage and make 660€ on each transaction, or start with whatever initial amount he can scrape together and double his money in 7 weeks.

(yes there are probably regulations on what pilots can do when on duty, and customs regulations etc, my point is that there are many people who can externalize the costs you mention and they can make a handsome profit. If I'm a sailor on a cargo ship, it would be easy to take 10 kg of gold and make 6600 euros on a shipment. Split that half way with whoever bankrolls it, and it's still a great ROI).

</comment></comment></comment></comment><comment><USER21> You can't eat gold, all this rant on gold is so stupid, the monetary value is merely historical. In modern economy only counts the real application of resources and nothing else. Nobody will ever introduce a new Gold standard, a resource is a bad idea for a currency. What if someone finds a gigantic Deposit or a way to cheaply produce Gold? The additional value over the real industrial utilization is a bubble, nothing else.

<comment><USER22> It is truly painful to read some of the misinformed posts on economic issues here.

Here is all you need to know:

\- Gold is money, and has been considered money by all civilizations on earth for thousands of years. \- Gold does not decay, rust, degrade, or decompose in any way over time. \- Gold cannot be printed, duplicated, or fabricated in any way. \- Gold, because of it's unique color and atomic weight is almost impossible to imitate.

Gold is real money that holds it's value over time. It is not in a bubble. What is happening is that the bubble of fiat currency is deflating against gold. Gold holds it's value in a remarkable manner over time. You will find, for example, that a fine tailored men's suit has cost about one ounce of gold for hundreds of years.

When you figure out the fiat currency is the real "stupid" you will probably wish you had some gold. But, by then, it will probably be too late.

<comment><USER17> "Gold is money, and has been considered money by all civilizations on earth for thousands of years."

Actually, no - the Inca's used textiles and animals for currency, and gold was used for ceremonial purposes (that last part iirc, it's been a few years since I was in Peru). The reason was that gold was plentiful for them, so its main reason for using it now and elsewhere didn't exist for them.

Apart from that, 'gold is money' doesn't even make sense. 'money' is something that has value, and 'value' is in the eye of the beholder. If you want to argue that gold has a longer historical track record as a holder of value than paper money or any other economic theory about gold, fine - but you sound like a crackpot gold bug, and if that is really the case, please take your intellectually dishonest nonsense elsewhere.

<comment><USER22> The Incas had vaults and palaces full of gold. Just because the peasants of Inca times couldn't afford any, and bartered with textiles and animals, doesn't mean the gold wasn't valued by the ruling class.

Please take your intellectually dishonest opinion somewhere else. The fact is that gold can be converted into any currency in the world, in any country in the world. I can walk into a bank in Zimbabwe with a gold eagle and walk out with several $trillion Zimbabwe dollars in fiat currency.

As we speak, Gold just reached $1900 USD an ounce today. Which would you rather have stuck in a safe back in 2009? A gold eagle, or a $1000 in US currency?

<comment><USER17> Inca rulers and the upper class used gold for decoration and to make things like tableware from - the point of this discussion is whether it was used as currency, which it wasn't. How are you going to call something a currency when it's only hanging on the wall of the upper 2% of society? I'm not sure what point you're trying to make, but you said that gold was used by all societies of the last 1000's of years as a currency, but it flat out _isn't_. _Most_ societies, yes, but not all - and that's important, because it shows that in places where there is a relative abundance of gold, it's not good as a currency (the non-use of gold in Inca times was not solely because of high supply, I'm not interested in arguing details on Inca culture and economics here because frankly I don't know much more about it than what a couple of tour guides told me).

 _Anyway_ , let's go back to 2007. A house in Phoenix that sold for 250k in 2004 just reached one million. Which would you have rather bought back in 2004? That house, or a gold eagle?

My point - it's easy to make a 'case' with perfect hindsight. There are several drivers to the current high price of gold; people diversifying their portfolios into precious metals, Chinese millionaire who have limited options for storing value, increasing demand from emerging markets for jewelry. That's not the point; the point is that you are claiming that gold has 'intrinsic' value ('Gold is real money that holds it's value over time.'). That's bullshit, plain and simple. Yes, gold has historically been a relatively constant value store, but there is nothing intrinsically valuable about it, and (the vast majority of) those claiming it is are alarmist nutcases with little grasp of economics.

</comment></comment></comment></comment></comment><comment><USER23> Use bitcoins? :-p

<comment><USER24> My first thought as well.

Bitcoin is often said to have many of the properties of gold, not least its scarcity.

But here is a clear example of how bitcoin trumps gold, people can move large amounts of bitcoin in a short amount of time with very little risk. Bitcoin users are already doing this.

[http://blockexplorer.com/block/0000000000022043f9ea2c298f338...](http://blockexplorer.com/block/0000000000022043f9ea2c298f3381c6ddd86b968271117dd55cb48ac297954c)

Total BTC?: 416300.33

At todays bitcoin market value that is 4,605,201.67 USD.

Still some way off 12 billion I grant you, but astonishing considering gold has been used as currency for thousands of years and bitcoin is less than 3 years old.

<comment><USER25> > But here is a clear example of how bitcoin trumps gold, people can move > large amounts of bitcoin in a short amount of time with very little risk. > Bitcoin users are already doing this.

I'd imagine that governments _like_ the fact that moving their gold is hard, slow, and risky.</comment></comment></comment>


Homeless Man Set To Launch First App After Just Weeks Of Learning To Code - <AUTHOR> http://designtaxi.com/news/361296/Homeless-Man-Set-To-Launch-First-App-After-Just-Weeks-Of-Learning-To-Code/

<comment><USER2> An inspiring story which reminds me of Scratch Beginnings[1][2].

[1] [http://en.wikipedia.org/wiki/Scratch_Beginnings](http://en.wikipedia.org/wiki/Scratch_Beginnings)

[2] [http://www.scratchbeginnings.com/](http://www.scratchbeginnings.com/)</comment>


At what point does the HN Karma becomes "just another number" for you - <AUTHOR>

I am a new user and every karma point I get, I keep coming back for more :). I was wondering if the veterans out here had similar feeling in their early days and once you cross a certain threshold, it is just another number. is it 1000 ? 5000? <comment><USER2> Karma stopped meaning something when I realized people can blindly submit an endless stream of shit from nice safe sites as soon as the stories hit their RSS readers and rack up far more than anyone can earn through normal use.

<comment><USER3> Some are not so blind - some people only post links to, say, theatlantic (see alexismadrigal) or outsideonline (see nbj914). Another one I saw had a history of posting only to one site, then a few months ago started posting links only to another site.

I'm assuming that making these links is job/career related.

</comment></comment><comment><USER4> After 500 points. At that level you can vote down worthless comments. Beyond that the number means nothing.

On the flip side it's been interesting to observe the reservations people have for voting something of interest up. I've posted stories and made comments that generate discussion but receive no votes. It's weird that people obviously read the comment or story, find it interesting enough to generate their own comment, but don't acknowledge that with a vote.

Why wouldn't someone vote a comment of interest up if karma has no value? It's an odd part of our human psyche. The unfortunate part is that voting is the sole method a site like this has for identifying the signal through the noise yet a large portion of the community is reluctant to participate.

<comment><USER5> There may be a simple, mechanical reason. I think there are quite a few people like me, who browse HN by scanning down a number of pages opening interesting subjects into new tabs until a considerable reading debt is built up. Why do I do this? Well, I do it everywhere it's possible, so I don't have to change context and wait for pages to load every few seconds. In addition, if you try to read each article when you encounter it, the HN page will expire before you get to the More button!

Consequently, when I read the articles later and find an especially worthy one, I sometimes try to page back in HN and vote it up. Frequently I don't find the story before I lose interest in the process. I could search, but a number of HN linkers have rewritten the title - a practice I know PG doesn't like, but people do it anyway - making search from the original back to HN more difficult. Lame excuses, perhaps, but I'm not likely to change my reading habits.

</comment></comment><comment><USER6> I think it should always be that. If you're easily addicted to watching small numbers go up perhaps you should spend your time jumping into a videogame (such as an MMO since you seem near inclined)but this is supposed to be a website for news and in the search for points people submit utter crap articles constantly.

When one ceases using the comment system as a filtering for interesting/uninteresting or relevant news and it becomes a status symbol you have completely lost the entire purpose of the system.

In the search for points you will abuse and ruin what the system was put in place to do.

</comment><comment><USER7> If you only ever submit your own content/projects then it defiantly is more than just a number :)

Submitting other peoples content would probably mean less to someone over time.

</comment><comment><USER8> >1</comment>


History of Clarus the Dogcow - <AUTHOR> https://512pixels.net/dogcow/ <comment><USER2> _Kare created several fonts for the system, all given names for world-class cities._

There's also a little more to this story, courtesy of Susan Kare herself at [https://www.folklore.org/StoryView.py?story=World_Class_Citi...](https://www.folklore.org/StoryView.py?story=World_Class_Cities.txt)

The fonts were named after commuter train stops in Philadelphia until Jobs decided they should be renamed after "world class cities".

</comment><comment><USER2> Susan Kare sells signed prints of Clarus on her website:

[http://kareprints.com/dog-cow/](http://kareprints.com/dog-cow/)

</comment><comment><USER3> Atari ST's TOS had it's own mascot, J.R. "Bob" Dobbs, in the high ASCII range of its system font: [https://en.m.wikipedia.org/wiki/J._R._%22Bob%22_Dobbs](https://en.m.wikipedia.org/wiki/J._R._%22Bob%22_Dobbs)

</comment><comment><USER4> I had a ton of fun with Cairo and my dad's ImageWriter II as a boy.

</comment><comment><USER5> It's a shame they removed the icon garden from Infinite Loop…

</comment><comment><USER6> Moof.

<comment><USER7> A now defunct Mac shop in Portland, OR (by OMSI) used to sell Moof T shirts with the dog cow on them. I wish I still had mine.

<comment><USER8> Recently the Iconfactory sold a batch of Moof t-shirts in the style of this year's WWDC [https://cottonbureau.com/products/w-w-dog- cow](https://cottonbureau.com/products/w-w-dog-cow)</comment></comment></comment>


Letters threatening genocide against Muslims, praising Trump sent to CA mosques - <AUTHOR> http://www.latimes.com/local/lanow/la-me-ln-mosque-letters-trump-20161126-story.html <comment><AUTHOR> Per HN guidelines: offered as an interesting article about the sociodynamics of racism and genocide (not "pure politics").</comment>


Ask HN: Should a hacker who wants to startup get some business role experience? - <AUTHOR>

I wish to startup in near future and I am good with web app development and  was wondering if some business skill experience is required. <comment><USER2> Well, as with everything, it really depends. But if you're going to do be launching a business by yourself, then hell yeah some business skills are going to be necessary. It is rarely the case that simply hacking together some web product will turn into a profitable business. In fact, if you take a look at a lot of the successes out there, I bet you'll find that the successful marketing and growth strategies were every bit as important as the actual offering, if not more.

</comment><comment><USER3> you should read: Micro ISV From Vision to Reality, Erick Sink on the Business of Software,

</comment><comment><USER4> 1) It is really hard to be a sole startup founder. I would advise against being a sole founder. 100% of 0 = 0. startups have binary outcomes (most of the times).

2) A product really doesn't mean anything unless it's a 1 in a million amazing. Marketing and growth strategies as xwowsersx pointed out is extremely important (you will not succeed without great strategy) and I would imagine if you are a sole technical guy, you don't have time to think about coming up with marketing strategies because you'll be busy developing.

3) You have to realize people are smart and people have domain expertise in their respective fields. I'm a business guy. I'm pretty sure that I can pretty much take any hacker and come up with case study after case study of various marketing, managing, growth, hedging strategies that's worked/didn't work. That would save you hundreds of hours and thousands of dollars in opportunity cost. But that's my expertise. That's what I'm supposed to be good at. And even though in 12 months, I could probably learn coding, I would be at best middle 50 percentile (probably not even there). So instead of doing that, I would easily give up a huge chunk of equity to bring in someone who is an expert in coding and managing development. That's because all I care about is winning and maximizing my chances to ensure a successful outcome. And along the way, I'd learn various part of tech end and vice versa.

4) Some would argue that business skill is easy to acquire. I would highly doubt that. Unless you are an exceptional outlier, you can't be good at everything and you're brain isn't designed to. A backend specialist who is amazing at UI/UX design who is creative to come up with awesome marketing strategies and knows how to manage a team through the ups and downs? I haven't met anyone in real life yet that can do that. I'm sure some of these tech billionaires are, but that's why they're billionaires.

What kind of business do you want to start? I have some ideas too if you want to trade notes / work on it together. Don't worry about getting business experience before starting. Get a good team. Then you'll learn on the fly. And for some businesses, you may be able to start without a business guy. For most, you'll need one whether to create the deck, go raise funding, sell customers, execute strategy, get PR, schmooze for connections, etc etc. I can help out on the business end. Btw. ideas mean nothing. Execution is everything. And marketing/sales execution is a lot harder than novice entrepreneurs want to admit.</comment>


PayPal gets simpler: lets you pay without leaving merchant sites - <AUTHOR> http://venturebeat.com/2014/01/13/paypal-gets-simpler-soon-you-can-pay-with-paypal-without-leaving-merchant-sites/ <comment><USER2> Paypal users (on the business site) owe Stripe an increasing debt of gratitude, since "We do what Stripe does 2 years after they do it" may just yet bring Paypal kicking and screaming into a modern UX. (I say that as somebody who likes Paypal, but certainly not for their technical agility.)

See: [https://stripe.com/docs/checkout](https://stripe.com/docs/checkout)

The last time they did paid Stripe the highest form of flattery was when they redid their API docs, which for literally over ten years were ponderous 400 page PDF documents that you had to get behind a login to find. You can find the new Paypal docs here:

[https://developer.paypal.com/docs/api/](https://developer.paypal.com/docs/api/)

If that looks a little familiar:

[https://stripe.com/docs/api](https://stripe.com/docs/api)

It looked even more familiar the last time I actually used the Stripe docs -- looks like Stripe has restyled since then.

</comment><comment><USER3> Looking at the screenshot in the article, it seems that the payment screen is embedded in a light-box, as opposed to a popup.

IMO this is not a good idea. You can't see the URL, so you can't verify that you're actually entering your credentials on *.paypal.com (without checking the page source, something an average user won't do). Opens it up to phishing attacks.

At least with the current flow (and for Facebook/Twitter/etc share dialogs) it opens in a popup with an address bar. Easy to verify you're on the correct site.

</comment><comment><USER4> Good step in the right direction.

What I'd _really_ like is the ability to say "Trust this store".

I buy stuff on Steam with Paypal all the time, and I honestly trust Steam to let me buy stuff for my account. If I could tell Paypal that so it wouldn't make me go via its web page every time I buy a game, that would be great.

<comment><USER5> I, for one, have been very happy, that when I start paying my shoppings in whateveritisthistime.com, that I am redirected to paypal.com with a green lock on address bar etc. But "Trust this store" would be a great idea for paying in some reputable sites I have personally chosen reputable.

<comment><USER6> Those were my thoughts as well. I hope there will be the possibility to get the normal redirect as well, I don't really want to enter my PP details on some random site.

</comment></comment></comment><comment><USER7> So, how would I be able to verify that what I'm seeing is actually PayPal's login form, and not some phishing page? I thought that's the reason for doing a full redirect. Or does this only work when you're already logged in on PayPal, and other than that you'd still be redirected?

<comment><AUTHOR> While it's a valid question, I suppose other payment solutions like Stripe Checkout ([https://stripe.com/docs/checkout](https://stripe.com/docs/checkout)) and Braintree.js ([https://www.braintreepayments.com/docs/javascript](https://www.braintreepayments.com/docs/javascript)) also work on a similar principle and hence pose the same vulnerability.

<comment><USER7> Apart from the "Remember me anywhere"-feature (which I wasn't aware of, is this a recent addition?), I think Stripe and Braintree.js are recognized by users as yet another credit card form, and not as a virtual bank with a private login the way PayPal is. Most users probably don't even notice they're not handing their CC info to the website, but to some third-party service instead. So they'd have to be comfortable with giving their payment details to the shop anyway.

If I chose PayPal however, which is marketed as a safe way to pay online, I don't want to have to put any trust in the site itself. That's why I want to be able to verify I'm actually entering my login details on PayPal's site.

</comment></comment></comment><comment><USER8> What would be better is if paypal would stop freezing businesses' account when they receive something as simple as a charge back. Paypal's main market is small businesses who can not afford the time or cost of setting up a merchant account. This is the same businesses who cant afford to have a large chunk of their fund frozen for months at a time while a tiny dispute is resolved

</comment><comment><USER9> PayPal gets rid of its only good feature. Am I missing something, or are PayPal opening the gates for hackers to inject malicious code into third party websites and steal user credentials? I'm making the prediction right now, that they'll quietly remove this security atrocity after the first year of exploits.</comment>


Ask HN: review my startup touchqode - source code editor for android - <AUTHOR>

link: http://www.touchqode.com
Touchqode is source code editor for use on your mobile phone. Its main idea is to let you think about and work on your code even if you are away from computer. It features syntax highlighting, code suggestions (autocomplete) and incremental search. We support Java (most mature), Python, C++, C# and Ruby (all have somewhat basic support). Touchqode has just been released in an early alpha version for Android and we are eager for your feedback. If you want to see it in action you can also check out youtube video: http://www.youtube.com/watch?v=O40QQnrNXUk
Thank you <comment><USER2> to be honest, as a developer i wouldn´t use it beause it´s so inefficient to edit text on touchscreens. if i wanna work on code or think about it, i mostly take a sheet of paper and write stuff down when i´m not at a computer. nevertheless i wish you guys all the best :)

</comment><comment><AUTHOR> clickable links: <http://www.touchqode.com> and <http://www.youtube.com/watch?v=O40QQnrNXUk></comment>


Threadripper 3960X Compiles Linux Kernel in Under 30 Seconds - <AUTHOR> https://www.phoronix.com/scan.php?page=article&item=amd-linux-3960x-3970x&num=9 <comment><USER2> I was compiling the kernel for my boxes for the most part of the 90's and 00's and the funny thing is a sub-60-second compile time was always possible with the "latest gear". Like a 100 MHz pentium. Of course the number of modules you want/need to compile has steadily increased but still funny to see someone impressed with a 30 second compile time 25 years later and with a 100x+ increase in CPU power :)

<comment><USER3> Everybody knows the REAL test is a FreeBSD 'make world' anyway :)

<comment><USER4> I used to think 'make world' on BSD was some big deal until I started to synthesize HDL code to bitfiles or GDS.

<comment><USER5> What is GDS in this context?

<comment> the-dude [https://en.wikipedia.org/wiki/GDSII](https://en.wikipedia.org/wiki/GDSII)

File format commonly used for wafer masks.

</comment></comment></comment></comment></comment><comment><USER6> Wow... I still remember recompiling the NetBSD kernel on my Amiga 3000 to tweak the timings on my Retina Z3. Took 14 hours to compile the kernel...

So if processors are now >1500x faster than they were in 1991, why is it that my Amiga 3000 has a faster, more responsive UI?

Why is it that an ssh session takes 8 seconds to establish?

Why is it that browsing a network share is 10x slower than viewing a file list was on a BBS?

<comment><USER7> Edit your sshd config and add useDNS: no to it, don't forget to restart the deamon.

Either way, I get your point, I remember programming in Delphi, compiling, chatting on IRC and browsing the net with a 56K Winmodem (all the modulation was software driven) with a Pentium 2 all at the same time, and now I can't even have and IDE and slack open at the same time.

<comment><USER8> I'm old enough to remember 14k, 28k and 56k modems - and while yh internet held great wonder, waiting for pages to load and files to download was _really_ frustrating.

Oh, and having to hangup so my parents could make a phonecall wasn't fun either!

This at least is something that has got orders of magnitudes better, and is very much noticeable. At times I still shake my head in wonder at being able to download a GB in less than 2 mins on a residential FttC connection.

</comment></comment></comment><comment><USER9> It is cool to see this level of parallelism coming to commodity hardware. 5-ish years ago a friend of mine had access to an experimental box one of the server vendors had made. Never went to production AFAIK. My memory is that it had 128 cores, 256 threads. One of the things we did on it, of course, was compile the kernel. I don't remember the exact numbers, but recall it being in the single digits number of seconds. This was done with just a ton of Xeon sockets.

</comment><comment><USER10> We need to move on from the Linux Kernel and start using "compile Unreal Engine" as a CPU benchmark.

[https://gpuopen.com/threadripper-for-gamedev- ue4/](https://gpuopen.com/threadripper-for-gamedev-ue4/)

<comment><USER11> That's probably a good point: the Linux Kernel is written using the C language. But C++ is a far more complicated language to parse and compile.

Unreal Engine, Firefox, Chrome... large C++ programs easily take an hour to compile on normal hardware.

With that being said: compiling for an hour is a huge hassle for reviewers. I think reviewers prefer benchmarks that complete in under a minute, rather than over an hour.

<comment><USER12> That's why I also use the LLVM compilation test (C++) and other workloads besides just the Linux kernel... But it seems the Linux kernel results are always what generates the most interest.

<comment><USER13> I would bet it's just familiarity. Most people that are interested in PCs have heard of Linux, and know that it has a Kernel. Or they even have already compiled kernels themselves. Whereas LLVM is more of a thing that is known to a subset of software developers.

I'm personally happy to see the LLVM tests, since it gives a good impression on what benefits software developer which work on big native code-bases can expect.

<comment><USER14> I think it's path dependence. The kernel has a large number of compile-time configuration options; back in the 90s, it was common to compile your own kernel, after tuning these options to your own particular hardware. It was also common to get new kernel releases (as a source code .tar.gz, or as a patch to the previous source code .tar.gz) directly from kernel.org, instead of waiting for the next release of the distribution you were using. So the time it took to compile a new version of the kernel for your machine was something many Linux users had experience with, and it was clear when a machine was faster (perhaps as a consequence of having previously compiled and installed a newer kernel!) because it took less time to compile the kernel. To turn that into a benchmark was just a matter of standardizing on a kernel release and a set of configuration options.

</comment></comment></comment></comment></comment><comment><USER15> It's a beast, but ... that's not a very impressive measure. Bellard strikes again -

From [0], in 2004: TCCBOOT is a boot loader able to compile and boot a Linux kernel directly from its _source_ code. It is only 138 KB big (uncompressed code) and it can compile and run a typical Linux kernel in less than 15 seconds on a 2.4 GHz Pentium 4.

[0] [https://bellard.org/tcc/tccboot.html](https://bellard.org/tcc/tccboot.html) [2004]

<comment><USER16> I would prefer gccboot (with gcc -march=native -mtune=native) though, because tccboot cannot optimise the output.

</comment></comment><comment><USER17> Reminds me when they built a (much older, smaller) kernel on a pSeries (POWER architecture) in under 5 seconds: [http://es.tldp.org/Presentaciones/200211hispalinux/blanchard...](http://es.tldp.org/Presentaciones/200211hispalinux/blanchard/talk_2.html)

Gosh, 18 years ago, now I feel really old :D

</comment><comment><USER18> If you want to keep these compile times, better not rewrite the kernel in Rust.

</comment><comment><USER19> i think this the script they use: [https://openbenchmarking.org/innhold/9a7355bdb73d85c9e044d02...](https://openbenchmarking.org/innhold/9a7355bdb73d85c9e044d020939c0ae9bcc1774e)

on vanilla head branch myn "time make -s -j32" took "0m56.226s" with 1950x

</comment><comment><USER20> Was recently googling what the Kernel guys were using out of curiosity. GKH mentioned that he had access to 32 core AWS instances for it....7 years ago.

Still...exciting times for consumers.

</comment><comment><USER21> Nice. How long to build Chromium?

</comment><comment><USER22> I don't really understand why this is newsworthy, so maybe someone could help me understand. It's a big, power hungry desktop CPU with incremental performance gains over the last generation.

Why is this important? Is there some kind of architectural breakthrough these CPUs are using? Are these CPUs recovering performance lost to Spectre/Meltdown mitigation?

<comment><USER23> This is a big power hungry desktop CPU with incremental performance gains with the x86/x64 instruction set _from someone not Intel_ and forcing intel to compete on pricing and performance.

Just that alone is newsworthy.

<comment><USER22> I think that's it: it's sort of an intel vs AMD interest piece. It's newsworthy in that it's a market signal, not a technology signal. The desktop CPU market segment is seeing a lot of transformation as secondary purpose built processors and SBCs become more and more of the market, so this is just sort of a fun puff piece.

Thanks for helping me answer the question.

</comment></comment></comment><comment><USER24> LLVM in under 2 minutes is way more impressive. That's a crazy CPU.

</comment><comment><USER25> discussion: [https://news.ycombinator.com/item?id=21628149](https://news.ycombinator.com/item?id=21628149)

Linux # Threadripper : [https://news.ycombinator.com/item?id=21628482](https://news.ycombinator.com/item?id=21628482)

<comment><USER26> I clicked to see discussion on the topic of the thread but you're linking to threadripper discussion. Disappointed in lack of linux kernel compile time discussion.

<comment><USER27> Not trying to be rude, but genuinely curious: what else is there to discuss?

Is this a new record, or just a record for the price point? What was the previous record? Will this have a large effect on how the kernel is developed?

For what it's worth, I understand how hard it is to focus on a project when compile times get more than about thirty seconds.

<comment><USER26> Was thinking people would talk about compile times with their hardware or experiences with intel vs amd etc.

It's just this title is very specific to compile time compared to the other being very general discussion.</comment></comment></comment></comment>


Announcing Kommons Beta - <AUTHOR> http://kommons.tumblr.com/post/1121571353/announcing-kommons-beta <comment><USER2> Interesting concept, but they're going to limit their audience to liberal U.S. residents by picking on Palin in the post there and here which is linked to in the upper right-hand side of the site: <http://kommons.com/questions/3>

I don't think that is helpful for getting more people interested in it. Celebs and others "blocking" questions is something that happens when anyone is trying to protect their image.

In addition, having a single list of questions and a Twitter-centric @(some_id) way of referencing people and other entities (corps, brands, etc.) seems limited. Why not have a search page that has mined names from Twitter, Wikipedia, etc.? Also, for the the selectbox currently being populated with suggestions in the upper-right, how do you determine how many of the multitude of people should show up? It would seem that eventually there will be too many to pick from that easily? I think a more advanced search is in order, and possible a dedicated page.

Finally, the name looks a little like Apache Commons was taken over by Russia. :) I say that somewhat jokingly, but remember the made-for-T.V. series "Amerika" in the 80s? All it takes is changing a C to a K and you have added a little cold-war Russia flavor, at least to older Americans that remember it: <http://www.imdb.com/title/tt0092316/></comment>


The UK Appoints a Minister for Loneliness - <AUTHOR> https://www.nytimes.com/2018/01/17/world/europe/uk-britain-loneliness.html <comment><USER2> Really great idea. The USA needs this badly - even for people currently in government.</comment>


The Size of the Human Radio-Broadcast Bubble in the Milky Way Galaxy - <AUTHOR> http://blog.jackadam.net/2011/the-tiny-humanity-bubble/ <comment><USER2> _This makes me feel small, sad, and alone._

One man's opinion.

For me, I am grateful I live in a time when I can use a human invention to view images, taken by another human invention, of galaxies 13.5 billion light years away that probably no longer exist and be educated enough to sit down and calculate in terms of miles just how far those specks of light have traveled.

Aristotle, Caesar, DaVinci, Newton, Kepler, Napoleon, Faraday and Einstein never saw what I have seen from my desktop.

Sad? No. Privileged.

<comment><USER3> I agree... but it also makes me yearn for what will be seen after I am gone. I constantly wish I could be frozen and woken up every 1000 years to see what else we have learned about the universe. The fact my glimpse into the cosmos is so fleeting does disappoint me.

<comment><USER4> <http://alcor.org/AboutCryonics/index.html>

</comment></comment></comment><comment><USER5> "Space... is big. Really big. You just won't believe how vastly, hugely, mindbogglingly big it is."

[http://en.wikiquote.org/wiki/The_Hitchhikers_Guide_to_the_Ga...](http://en.wikiquote.org/wiki/The_Hitchhikers_Guide_to_the_Galaxy)

And, really, this picture is just a fraction of a fraction of the down payment on the concept of _big_ : This is merely an illustration of how big one galaxy is. _There are eighty billion galaxies._ [1]

<http://en.wikipedia.org/wiki/Observable_universe>

\---

[1] Tune in tomorrow for a new estimate, of course.

<comment><USER6> I find that reading huge numbers doesn't get the true scale across. It helps to bring the relative scale down to human terms. There are 63,360 inches in a mile. There are about 63,240 AUs in a light-year. So if the Earth was one inch from the Sun, Alpha Centauri would be 4 miles away. In this miniature model, the speed of light is around 7 inches per hour, or 1 mile per year, and our fastest probes take 100 days to move an inch.

The galaxy sounds big at first, but only because our lives are so short. If we built Von Neumann probes we could take over the galaxy in a mere million years. That's nothing on a geologic time scale. The fact that the solar system has sat around for 4 billion years without being eaten by Von Neumann machines makes me pretty certain that we're alone.

<comment><USER7> _The fact that the solar system has sat around for 4 billion years without being eaten by Von Neumann machines makes me pretty certain that we're alone._

That's quite a leap you're making. One very strong counterargument boils down to simple economics: where's the profit motive in building a fleet of von Neumann probes to 'eat' every solar system in the galaxy? Who is going to pay for this effort, and what returns do they expect?

If it takes a million years to colonize a galaxy, then unless you plan to live for _two_ million years you aren't going to see the full fruits of your effort.

As a race our attention span seems to be narrowing. As far as I can tell, despite or perhaps because of recent advances in applied science, we're actually losing our propensity to engage in multidecade R&D projects. The next LHC-scale project is going to be an almost impossible thing to sell to the governments that will have to agree to finance it, and it would take years for us to return to the Moon if our survival depended on it. We are most definitely _not_ moving in a direction that will lead to the sort of expansionism you're talking about.

Edit: here's another thing, with regard to the absence of 'radio bubbles' from other civilizations. It's really, really dumb, from a technical perspective, to transmit RF signals that are distinguishable from background noise. It means you're wasting power and throwing away channel capacity.

Look at an HDTV transmitter on a classical spectrum analyzer sometime, and you won't see much in the way of coherent structure -- you'll just see a pedestal where the noise floor seems a bit higher than usual. This means that the 'radio bubble' is not a bubble, but two nested spheres with only about 100 light years of space between them. To observe emissions from an advanced civilization, we need to look at just the right time, between the development of RF technology and information theory. Otherwise we won't hear a thing.

<comment><USER6> I guess the inferential distance between us is too great. A world in which we colonize the stars is a world where we've fixed some of the problems today (aging, death, existential risks from various technologies). I assume humanity will change substrates to something that lasts a little longer than our current bodies.

 _where's the profit motive in building a fleet of von Neumann probes to 'eat' every solar system in the galaxy? Who is going to pay for this effort, and what returns do they expect?_

You only have to build one Von Neumann probe, and there's a massive benefit to taking over your light cone: You make sure nobody else does.

Even if million-year life spans are out of our reach, why does one have to live to see the full fruits of one's effort? The world doesn't cease to exist when you die.

<comment><USER7> _You only have to build one Von Neumann probe, and there's a massive benefit to taking over your light cone: You make sure nobody else does._

So this hypothetical civilization has conquered aging, death, and the drive for rapid gratification, but fails at elementary game theory?

<comment><USER6> There's no game theory involved. A million years is a blink of an eye on an evolutionary timescale. When the first civilization has Von Neumann machines, their closest competitor is most likely primordial goo. See <http://andabien.com/html/evolution-timeline.htm> to get an idea of how long it takes for life to evolve.

Even if there were multiple civilizations in a galaxy, a single "defector" civilization would have vastly more matter under its control than civilizations that did not use Von Neumann probes to expand. With such a huge advantage, they would quickly destroy all competitors.

<comment><USER7> _With such a huge advantage, they would quickly destroy all competitors._

Sorry, but I'm still not getting the 'advantage'. This strikes me as one of those games where the only winning move is not to play.

<comment><USER6> You don't understand how controlling a significant fraction of a galaxy's matter is advantageous?

<comment><USER7> No, but then I don't understand the imperial incentive, even here on Earth. I'm a fairly self-centered individual, and a lazy one at that... and as far as I can see, running an empire _always_ seems to be more trouble than it's worth. The whole history of the twentieth century can be written in terms of the world's great powers discovering this little tidbit of truth. I believe the first few decades of the twenty-first will see the US experiencing the same global comedown that Russia, Germany, and Britain have already undergone.

Fortunately, the loss of its empire is a process that always seems to leave the nation in question better off, at least in modern times. As I see it the only possible justification for total galactic conquest is self-defense: do unto others before they can do unto you, more or less as you put it. Any advanced civilization that _doesn't_ see that as a self-defeating justification is so different from my way of thinking that I couldn't possibly deal with them on any terms, offensive or otherwise.

Basically, what you're saying is that the only way to survive and prosper in the Universe is to be a murderous, psychopathic douchebag on a galactic scale. Not down with that, sorry.

<comment><USER6> Either you don't understand what I'm saying or you are purposely misconstruing my words so you can have a convenient strawman to take apart.

<comment><USER7> _The fact that the solar system has sat around for 4 billion years without being eaten by Von Neumann machines makes me pretty certain that we're alone_

Were these your words, or not?

You're projecting human flaws and attributes on an advanced race that would, by necessity, be almost nothing like humans. It simply does not follow that because the solar system has not (yet) been turned into grey goo, we must be alone in the galaxy.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> "Two things fill the mind with ever new and increasing admiration and awe, the more often and more steadily we reflect on them; the starry heavens above and moral law within. . . The former view of a countless multitude of worlds annihilates, as it were, my importance as an animal creature, which must give back to the planet (a mere speck in the universe) the matter from which it came, the matter which is for a little time provided with vital force, we know not how. The latter on the contrary, infinitely raises my worth as that of an intelligence by my personality, in which the moral law reveals a life independent of all animality and even of the whole world of sense--at least so far as it may be inferred from the purposive destination assigned to my existence by this law, a destination which is not restricted to the conditions and limits of this life but reaches into the infinite." (Kant, Critique of Practical Reason, 1788)

</comment><comment><USER9> Try this if you want to feel really small AND really big at the same time: <http://htwins.net/scale/>

WARNING: You may become nauseous, dizzy and afraid if you sit playing with this for too long.

<comment><USER10> The really amazing thing about that link is how much empty space we're made up of on an atomic and subatomic level.

<comment><USER11> On a subatomic (and subnucleonic) scale it's 100% empty space.

Fundamental particles are true point particles and no spatial extent has ever been found for them.

So it's not just a lot of empty space - it's nothing except empty space.

</comment></comment></comment><comment><USER12> Am I the only one that sits and thinks "wait, I can barely get my local AM station to come in clear enough to be understood - how could any signal possibly be distinguishable beyond 1 lightyear?"

<comment><USER13> No, and you're absolutely right, too. The human radiosphere might technically be 200 light years across, but that doesn't mean a meaningful amount of data could be extracted from it. Yes, we are putting out a steady hum of energy, but it's hardly announcing our presence. Were it not for high energy radar systems deployed on Earth, we could not even detect a civilization down here from any point in our own solar system, much less decipher any of the data being transferred. And as our civilization matures, the amount of energy radiated into space is actually shrinking.

That said, 200 light years is an enormous size. Everything that is large enough to take up more than one pixel on the map of our galaxy if freaking huge! People may disagree about the factual relevance of the radio bubble, but it's still immensely cool that we managed to project something this big out there into the world. Looking at this beautiful image of the Milky Way and seeing the unstable little flicker centered on our humble home, I can't help but wonder how many other radiospheres are out there and when they might finally overlap with ours (if they haven't already).

<comment><USER14> An intelligent race which knows anything about stars would note that Sol has a disproportionately large output in the radio spectrum. This would likely attract considerable attention and debate as to the cause. Careful analysis would reveal a very precise and regular Doppler shift lasting approximately 365.25 days...

</comment></comment></comment><comment><USER15> This kind of stuff always blows my mind away.

How insignificant we all are, in the grand scheme of things.

(Then my mind overflows when I ask myself the question of "what the hell _is_ the universe?")

<comment><USER16> I can practically give myself an aneurism thinking the following when contemplating how it all began:

Try and put religious arguments aside (while this will have some overtones) for a moment and work with me here and not throw the notion of time having no beginning or end which is equally frustrating to comprehend.

Reverse the creation story and you wind up at the beginning with light and darkness. Before light there was darkness or nothing.

But what was before the "darkness" or nothingness? The religious will say God whom has no beginning or no end, but how did God or energy pop into to existence if there was nothing?

Then, put yourself in God or energy's place... You are in a "space" with nothing around you... everything is void... Then where did "you" come from?

I know this is linear thought and time and the universe should not be considered in this way many in the field of science and mathematics explain... I understand the many dimensions that are possible and how time should be viewed, but it still doesn't answer the question of how something, anything came of nothing...

<comment><USER17> That's a limited viewpoint.

One idea is that time and space started with the big bang. So asking what happened before the big bang is somewhat pointless because causality did not exist. Things could happen without cause or consequence.

PS: Our preconception of how reality operates break down on the vary large, the vary fast, and the vary small. Trying think how things operate without matter, energy, space, or time is something of a fool's errand IMO.

<comment><USER18> Could you expand upon how causality can cease to exist or what would cause (heh heh) such a thing?

<comment><USER19> There is the concept of the heat death of the universe. <http://en.wikipedia.org/wiki/Heat_death_of_the_universe>

Essentially, as particles expand and spread out, the universe will reach a point where there is not enough energy localized in one area to support anything.

Of course this is just one theory. etc etc

</comment></comment></comment></comment></comment><comment><USER20> Pale blue dot feels like an apt comparison --> <http://en.wikipedia.org/wiki/File:Pale_Blue_Dot.png>

If you don't know yet, that's what earth looks like from just beyond Pluto's orbit.

Also interesting to note in these discussions is the Hubble deep field image. These 3000-ish galaxies are covered by a quarter at arm's length when you look into the sky --> <http://en.wikipedia.org/wiki/File:HubbleDeepField.800px.jpg>

We are indeed small and insignificant, but alone? Doubtful at best.

<comment><USER21> >We are indeed small and insignificant, but alone? Doubtful at best.

If we're the only (or even just one of few) intelligent beings (!) in the Universe then our significance is huge.

<comment><USER22> If we're the only intelligent beings in the Universe, then I argue that intelligence is overrated, thus our significance (except to ourselves) is negligible. Unless you go the route of arguing that without intelligence, there is no significance, and thus our self-significance is all the significance there is, in which case you're right - it's huge.

</comment></comment></comment><comment><USER23> "...there is an ever-expanding bubble announcing Humanity's presence to anyone listening in the Milky Way."

This 200ly sphere does not equal detectable radio signals from Earth. SETI is looking for radio signals from the stars, yes, but they are looking for a focused and high-energy attempt from ETs to contact someone by beaming at specific stars. Radio "leaked" from regular transmissions typically does not carry a signal over interstellar distances.

<comment><USER24> That's something I want to know. With the amount of energy given to our broadcasts, they surely would decay long before traveling any noteworthy distance. I'm curious as to what our most powerful broadcasts have been, and how far they'd travel before becoming unnoticeable. Especially, when compared to the amount of EMR released by neutron stars, pulsars, background noise, etcetera.

<comment><USER23> From the SETI FAQ: "Detection of broadband signals from Earth such as AM radio, FM radio, and television picture and sound would be extremely difficult even at a fraction of a light-year distant from the Sun. For example, a TV picture having 5 MHz of bandwidth and 5 MWatts of power could not be detected beyond the solar system even with a radio telescope with 100 times the sensitivity of the 305 meter diameter Arecibo telescope."

Now, the Arecibo message should carry over a couple of hundred light years easily, but it was transmitted for three minutes only, and if you miss it, you miss it.

<comment><USER25> Not if you have faster-than-light travel!

If they don't, it would seem pointless to contact aliens, by the time they send their ambassador on a multi-generational ship to Earth we humans may have already been extinct.

<comment><USER26> FTL is probably not ever possible no matter how technologically advanced a society may be as it would allow for the violation of causality.

<comment><USER10> You're assuming we already know everything there is to know about causality. It wasn't long ago that some people thought the sound barrier was insurmountable, or that trains would kill their occupants by going too fast.

<comment><USER6> FTL is equivalent to time travel into the past. If you have one you have the other.

People thought humans wouldn't break the sound barrier for engineering reasons, not because the laws of physics prevented it. And just because people in the past thought something was impossible doesn't mean it will one day be possible. 100 years ago, physicists thought perpetual motion machines were impossible.

<comment><USER27> Thanks for saying what I wanted to. Everybody who knows nothing about physics always brings up the "humans can't possibly travel faster than 25mph" thing when someone who does know talks about violating causality, but as far as I've seen it was only printed in a newspaper or two, not espoused by physicists. The speed of light limitation is a necessary part of one of the most precise and thoroughly tested theories of all time.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER28> I'd like to see this plotted on two dimensions, where the horizontal axis is the year, starting when radio emissions began, and the vertical axis is the number of non-sol star systems that are within the bubble at that time. Binary or trinary systems would count as 1 system, not 2 or 3. This function would obviously be monotonically nondereasing.

I wonder if wolfram alpha could rise to the challenge.

<comment><USER29> Using the NStED database of stars I find that there are 11,384 cataloged stars within a 200 light year bubble. I thought that it would probably follow an r^3 function but it appears that it follows something closer to an r^2 function - perhaps that is explained by the flatness of the galaxy or just noise? For example, within 20 light years there are only 77.

Stars by Distance: <http://dl.dropbox.com/u/3924269/plot_10956.jpg>

NStED: <http://nsted.ipac.caltech.edu/>

<comment><USER11> Yah, the galaxy is very flat. Depending on how you define the thickness (do you go by majority of stars, or include all outliers) proportionally the galaxy is flatter than a sheet of paper.

<comment><USER6> I don't think that's true. Other galaxies don't appear as thin or as flat as paper. (Examples: <http://apod.nasa.gov/apod/ap031008.html> <http://apod.nasa.gov/apod/ap020703.html> <http://apod.nasa.gov/apod/ap060612.html>) Typically they're about 100x wider than they are thick.

<comment><USER11> <http://www.astronomycafe.net/qadir/q546.html>

"....the thickness of the Milky Way is 50/100000 or 5/10000 of its maximum size making it flatter than a sheet of writing paper."

You can not calculate how flat something is by estimating from such a photo!

<comment><USER6> Wikipedia says the stellar disc of the Milky Way is 1,000 light-years thick and cites [http://imagine.gsfc.nasa.gov/docs/ask_astro/answers/980317b....](http://imagine.gsfc.nasa.gov/docs/ask_astro/answers/980317b.html) . The core is thicker. Even the image on the page you linked to shows an object that is much thicker than a piece of paper.

<comment><USER11> Did you miss the part where I said: "Depending on how you define the thickness" ?

The milky way does not have a clear cut end, so you need some kind of definition on where to stop, and there are many ways to do so.

And you should stop estimating thickness by looking at photos. Brightness often masquerades as thickness in photos.

<comment><USER30> Yes, there are many definitions. None of them, however, gives the result that the Milky Way is flatter than a piece of paper. Not even the (rather silly) one used by the author of the web page you quoted; his numbers are wrong.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Is the milky way really large or is 200 years a really short time?

Galileo was born only about 164000 days ( ~ 4 million hours ) ago.

And that's already over twice as long as 200 years.

It makes me sad when I think about how a life time is a mere thousand months.

</comment><comment><USER31> Even more discouraging than the size of the bubble is what the bubble's cross- section looks like:

[http://www.smbc-comics.com/index.php?db=comics&id=2004#c...](http://www.smbc- comics.com/index.php?db=comics&id=2004#comic)

</comment><comment><USER32> But maybe, just maybe, our industrial and scientific development is producing an occasional side-effect of some kind of as yet-unknown faster-than-light wave which has made it much further out, and significantly more advanced civilizations have the ability to detect it.

Sort of how an archaeologist can look at the surface of earth in a sat. photo and determine there was once human activity in a location based on ground disturbances, etc.

<comment><USER33> Of course, such a wave would be pretty bad news for a certain theory proposed by a certain Albert.

</comment></comment><comment><USER34> It would be interesting to know how much of the Milky Way SETI has scanned so far. In other words, if someone else out there was running their own version of SETI, how long before they would be likely to find our little radio broadcast bubble?

</comment><comment><USER35> This reminds me of the opening scene of "Contact" (1997), the movie adaptation of Carl Sagan's novel by Robert Zemeckis:

<http://www.youtube.com/watch?v=vGyq7d62oPQ>

</comment><comment><USER36> To put the blue dot in perspective, its unimaginably beyond the scope of our current technology to travel that far. Pluto by comparison is 13 light-HOURS away and it takes about 10 years to get there. At that rate, it would take approximately 150000 YEARS to reach the same distance to reach the perimeter of that blue bubble. And blue bubble is almost insignificant in relation to our galaxy, which is one of about 100 billion galaxies!

</comment><comment><USER37> Sadly, it would not be possible to discern manmade radio transmissions from further than a few light-days/weeks.

Also, as communication capacities increase, more and more of that is moving into cables and not radio transmitters. High-power Earth-Satellite and Earth- Earth transmitters are being replaced with low-power point-to-point wireless links. The power of radio traffic leaking off the Earth is not growing very much, if at all.

</comment><comment><USER38> To me this is really inspiring.

I look at that and think 'Wow, our presence is already felt that far/wide and we've barely started to walk'. Incredible.

</comment><comment><USER39> Oh, it's a blog entry! There really should be a noscript warning, I thought it was something like <http://www.phrenopolis.com/perspective/atom/> at first.

</comment><comment><USER40> Cool! .. and all this discussion reminds of a line from Calvin and Hobbes - "Sometimes I think the surest sign that intelligent life exists elsewhere in the universe is that none of it has tried to contact us."

</comment><comment><USER41> It's odd how you look at that and go "hunh" but then realize, wait a minute who took the picture of the Milky Way Galaxy?

It's a graphic of course but still you forget what you're looking at and how far away and how big it is.

</comment><comment><USER42> You should cheer up that we are living in the Slow Zone. That should make us unaffected by the "Straumli Perversion" and other Powers from the Transcend and messing with the Beyond for quite some time.

</comment><comment><USER43> Sure-fire way to feel small, sad, and alone: typekit.com

Seriously, the page was completely empty until I unblocked that scripts on that and his main site.

</comment><comment><USER44> Ugh, what is that horrible font? Whatever typekit.com is trying to do (in Firefox 3.6 on Windows 7) isn't very working...

</comment><comment><USER45> This makes me more hopeful of getting a response from other beings. Perhaps we're not so alone after all.

Relax, it's PhysEx.

</comment><comment><USER46> Some alien might think - hmmm.... Human Spam again :)

<comment><USER37> Spiced human ham would likely be incompatible with any alien metabolism.

</comment></comment><comment><USER47> Curiosity apart what good could it do us to discover or be discovered by aliens?

<comment><USER48> All in the name of technology..

Assuming no ETs exist within our 200ly bubble, if ETs somehow discovered our signal and made contact, our level of knowledge would jump a few centuries at least.

<comment><USER11> If there are no ETs within the bubble how can they discover the signal?

<comment><USER48> Sorry, I meant discover as in through our bubble's reaching them in the future (ensuring they're at least 100ly away).

</comment></comment></comment></comment><comment><USER49> Ha. So, we don't even rate a single pixel on the blank, white screen that is the Universe? Sounds about right.</comment>


What If? – this time by Mr.Holla - <AUTHOR> https://stories.shrikrishnaholla.in/what-if-1557e226c6d?gi=f58263dd7206#.eoqurrrpd <comment><AUTHOR> An awesome piece of imagination - must read. Written by one of my friends.</comment>


Xbox 360 Emulator Research Project - <AUTHOR> https://github.com/benvanik/xenia/ <comment><USER2> I wonder if we'll see viable emulators for PS4/XboxOne sooner than we did for the previous generation given that they are both x86-based (and the PS4 using FreeBSD as well).

The original Xbox hasn't seen a lot of emulation activity either -- I found that strange. It feels like we might lose an entire generation of games to bitrot.

<comment><USER3> I am more worried about some small but amazing Flash games. Currently it is still possible to play them in the browser, but what about in 5 or 10 years. I image there might be some kind of emulator which wraps tje flash player and the game in a single exe so it can be played independent of a browser.

<comment><USER4> Check out Shumway - it can play SWFs in the browser without using Flash: [http://mozilla.github.io/shumway/](http://mozilla.github.io/shumway/)

</comment></comment></comment><comment><USER5> This is way further along than I would have expected. There are some small games already playable [0]!

[0]: [http://xenia.jp/compatibility/](http://xenia.jp/compatibility/)

</comment><comment><USER6> Come help test demos from the marketplace - it's reasonably easy once you copy the content to USB. See [https://github.com/xenia-project/game- compatibility/issues](https://github.com/xenia-project/game- compatibility/issues)

</comment><comment><USER7> This is really cool, the fact that MS was able to build an 360 emulator that worked for xbone was really a huge engineering feat. Will be interesting to follow xenia's progress.

<comment><USER8> I believe that the xbox one doesn't emulate for backwards compatibility, instead it downloads a new version of the executable that was built for x86 and uses the game content from the original disks.

<comment><USER9> nope, the xbox one emulates the xbox 360 OS -- and the games themselves run inside the xbox 360 OS[1]

for the game, it's like running on a normal 360. and that's why things like multiplayer work. [2]

[1] [http://www.engadget.com/2015/06/18/xbox-one-backward- compati...](http://www.engadget.com/2015/06/18/xbox-one-backward- compatibility-how-it-works/)

[2] [http://www.xbox.com/en-US/xbox-one/backward- compatibility](http://www.xbox.com/en-US/xbox-one/backward-compatibility)

</comment></comment></comment><comment><USER10> Is this compatible with the Open Emu app?

<comment><USER11> No, but if it can run as an x86-64 OS X app then it can be ported without too much work.

Porting to an OE core is kind of invasive since it replaces the entire "app" part of an emulator including the event loop, sound output and windowing. So OpenGL renderers also have to be capable of rendering to a framebuffer and such. Also, the requirement for x86-64 is reasonable for OS X but excludes some Windows-based emu codebases, notably PCSX2.

</comment></comment><comment><USER12> why is it that we always need so much more CPU and GPU power to emulate an older, fixed, lower power requiring console?

<comment><USER13> [http://arstechnica.com/gaming/2011/08/accuracy-takes- power-o...](http://arstechnica.com/gaming/2011/08/accuracy-takes-power-one- mans-3ghz-quest-to-build-a-perfect-snes-emulator/)

This might be a good place to start, it's a long read but pretty interesting.

<comment><USER14> Note that in some ways, more modern consoles may actually be easier (or at least have different problems) - there are a whole bunch of abstraction layers that stop programmers from doing weird cycle-accurate tricks, and they don't have the development time for it anyway.

<comment><USER15> Modern may be "easier" because they are being built on top of hardware that is similar to what is found in modern consumer pc systems. That's no to say they are nessessarily the same but being x86 based means they have many of the same instruction sets.</comment></comment></comment></comment>


Why people hate phone companies - <AUTHOR> http://www.businessinsider.com/skype-iphone-dispute-precisely-why-people-dislike-phone-companies-2009-4

<comment><USER2> But the iPhone is only available on O2, why is T-mobile even getting involved?

PS T-mobile let me use Fring on their handsets, no problemo.</comment>


W&B Raises $15M for Deep Learning Experiment Tracking - <AUTHOR> https://www.wandb.com/articles/new-funding <comment><USER2> We use W&B a lot for our research projects, and it's been super useful and has pretty much replaced TensorBoard (TB) for us. The killer features on top of TB is the ability to track your experiments (without keeping track of your log files on your computer -- i'm quite organized but that's a losing battle), and the ability to share training runs within a team. We do a lot of distributed training as well, and the system metrics they provide automatically are great for ensuring you're making the most of your GPU/CPU/memory.

</comment><comment><USER3> I'm also a user of this product and it works great. It's very lightweight yet feature - rich which allows you to integrate the tools easily into your stack with minimal dependencies. What they've built is something that I always was lacking when doing experiments and tracking them manually. Most importantly they are really good people and love working with them because they really care about their product. I'm so happy to see this announcement and watch their success</comment>