Critical crypto bug leaves Linux, hundreds of apps open to eavesdropping - <AUTHOR> http://arstechnica.com/security/2014/03/critical-crypto-bug-leaves-linux-hundreds-of-apps-open-to-eavesdropping/ <comment><USER2> The vulnerability means that there is an ASN.1 certificate format you can use that will validate against any unpatched GnuTLS-using application, regardless of how you configure ciphersuites and negotiation. The bug isn't cryptographic. It's much simpler and more basic than that. My guess is that it's also been embedded in GnuTLS for longer than the SecureTransport bug had been.

For connoisseurs of bogus conspiracy theories, it's worth noting that the coding flaw that produced the bug is much more subtle than "goto fail", but the bug is equally simplistic. Where "goto fail" required a duplicate line, GnuTLS required only a single switched token; not only that, but the bug comes from a mismatch between two common C error checking regimes (a zero-return error and a negative-return error).

I think what I like least about the bug is that it was found by the GnuTLS maintainer, long after the code shipped. That's a signal of how much attention GnuTLS gets.

<comment><USER3> This is yet another nail in the coffin of Eric Raymond's irresponsible and fallacious "many eyes make all bugs shallow" theory.

[https://en.wikipedia.org/wiki/Linus's_Law](https://en.wikipedia.org/wiki/Linus's_Law)

Linus's Law as described by Raymond is a claim about software development, named in honor of Linus Torvalds and formulated by Raymond in his essay and book "The Cathedral and the Bazaar" (1999). The law states that "given enough eyeballs, all bugs are shallow"; or more formally: "Given a large enough beta- tester and co-developer base, almost every problem will be characterized quickly and the fix will be obvious to someone." Presenting the code to multiple developers with the purpose of reaching consensus about its acceptance is a simple form of software reviewing. Researchers and practitioners have repeatedly shown the effectiveness of various types of reviewing process in finding bugs and security issues, and also that reviews may be more efficient than testing.

In Facts and Fallacies about Software Engineering, Robert Glass refers to the law as a "mantra" of the open source movement, but calls it a fallacy due to the lack of supporting evidence and because research has indicated that the rate at which additional bugs are uncovered does not scale linearly with the number of reviewers; rather, there is a small maximum number of useful reviewers, between two and four, and additional reviewers above this number uncover bugs at a much lower rate. While closed-source practitioners also promote stringent, independent code analysis during a software project's development, they focus on in-depth review by a few and not primarily the number of "eyeballs".

<comment><USER4> To quote Theo De Raadt:

        My favorite part of the "many eyes" argument is how few bugs
        were found by the two eyes of Eric (the originator of the
        statement).  All the many eyes are apparently attached to a
        lot of hands that type lots of words about many eyes, and
        never actually audit code.

<comment><USER5> What a pointless and content-less rebuttal.

I mean shit, I don't need to be an aeronautical engineer or work in the FAA to say that several people investigating an airliner crash will be more effective than one single dude sifting through a literal field of debris.

ESR's quote _isn 't_ wrong (perhaps hyperbolic, but in spirit it isn't wrong). It's just an uninteresting observation. What do you do when something has you stumped at work? You ask the guy across the hall to look over your shoulder for a second... It's just common sense.

People simultaneously revere and hate the quote only because ESR said it. If Joe Shmoe had said it all those years ago, it would have just been met with "no shit" and never given second thought.

<comment><USER6> I think there's a point here. The point being much more people talk about many eyes than actually audit existing code. The fact is, there are quite a number of bugs that stayed in the code for a long time despite being not that deep. Maybe that says we don't have enough eyeballs, but most of people quoting that sentence quietly assume we do, equating number of participants in FOSS communities with number of people actually auditing the code. Unfortunately, the former is much bigger than the latter. We pretty much have the same situation as we have in science publications where a lot of results are not reproducible and a lot nobody even bothers to check for reproducibility, despite reproducibility being the basic tenet of open publication and peer review and being necessary to validate the result. Unless there's a reason to - e.g. an identifiable bug - not many bother to go back to existing code and check it for correctness.

<comment><USER5> The quote is hyperbolic for the "all", and should probably use the word "shallow _er_ ", but otherwise I don't see anything wrong with it.

 _" much more people talk about many eyes than actually audit existing code"_ is true of free software, but is also true of just about everything. More people think _" I feel comfortable crossing this bridge because plenty of engineers have looked at it"_ than there are engineers actually looking at bridges. I haven't read the quote in it's original context for several years, but I don't remember it conflating software users with software developers.

<comment><USER7> The difference is that engineers actually know how to build safe bridges. I feel (and am actually) safe living in a house designed by a single competent architect, but I am not secure using a TLS implementation written by a single competent programmer. The only way we have found to end up with reasonable secure code is to have it reviewed by a _lot_ of competent people.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Can we all finally accept the fact that what is most needed now is not a new whizbang but a comprehensive review of all of the core pieces of software that we depend on as a base for making new whizbangs?

How many critical and ancient bugs still remain undiscovered?

Everyday there is a new Telegram, Cryptocat, etc. all presumably being constructed on top of insecure libraries. What progress can we make with such shaky foundations?

There has been word that the Linux kernel devs are considering slowing new feature adoption for a time while focusing on bug discovery and elimination.

PLEASE, EVERYONE ELSE CONSIDER DOING THE SAME.

<comment><USER9> At a minimum, commonly used security packages should be reviewed and OS distribution maintainers commit to updating to latest versions of said packages regardless of the age of the OS.

For example, Ubuntu 12.04 LTS uses an older version of OpenSSH and OpenSSL. There should be no reason why Ubuntu (and others) can't commit to updating to the latest versions so that features in say OpenSSH 6.5p1 are avail. BTW, saying that you can compile and install this yourself is noted beforehand but honestly, how many people do that on a regular basis?

What I'm getting at is that security software can and should be held to a higher and current standard precisely because it affects so many other pieces of software in fundamental ways. It's not a big deal if the latest version of bc is not installed but it sure is if GnuTLS or OpenSSL is broken.

</comment></comment><comment><USER10> Commit introducing the bug:

[https://www.gitorious.org/gnutls/gnutls/commit/0fba2d908da6d...](https://www.gitorious.org/gnutls/gnutls/commit/0fba2d908da6d0df821991ea5fdbeeda0f4ff089)

<comment><USER11> Commit: #0fba2d9

"Improved the certificate generation stuff."

<comment><USER12> On one hand this makes me wary of the quality of GnuTLS source in general, and on the other I know I am guilty of similar commit messages.

</comment></comment></comment><comment><USER13> Disclaimer: My understanding of the goto fail bug is based on agl's writeup, and my understanding of the GnuTLS bug is limited to this article.

In both of these cases, it seems the code starts with the assumption that the cert is valid and then tries to find various conditions to invalidate it. Isn't that backwards? Why not start with an assumption that the cert is untrusted until you've proven otherwise?

<comment><USER14> This is an interesting question. I agree that invalid-by-default makes sense when reasoning about the higher-level system, but regarding the actual Boolean logic it seems that if a critical condition is broken the particular formulation will not make much of a difference.

Additionally, it seems that in certain situations having several plain-if conditionals set the valid state to `1` would be _less_ robust than having several conditionals set it to `0`. In the first case if any one of the conditions have bugs the false valid state can happen, whereas in the second case the last conditional to execute would have to contain the bug.

Can anyone else comment on this? Are there relevant theories and/or best practices which have been discussed in the security community?

<comment><USER13> What about several conditionals that set various elements of a struct to 1, and the cert is valid iff all elements are 1. At least that way a skipped check (i.e. goto fail;) wouldn't result in a false positive...

<comment><USER14> So basically abstract the details of each sub-condition from the final check that all sub-conditions are met?

That does sound like a good idea as long as the meaning of `1` and `0` do not get confused, and as long as we're not talking about some niche context where extra overhead for the sake of code maintainability would be a problem.

</comment></comment></comment></comment><comment><USER15> Is it that they just now started actually testing these implementations, for the first time? Even if you wouldn't follow TDD practices, it's obvious that anything that implements a protocol of some sort (particularly a security protocol), should be tested to actually follow that protocol. Isn't that common sense? What is going on?

<comment><USER2> TLS stacks aren't built with TDD practices for the same reason that the kernel TCP/IP stack isn't built with TDD: the things that go wrong in TLS involve the state machines of a distributed protocol and somewhat elaborate mathematical operations.

Read Schneier and Ferguson describing in _Cryptographic Engineering_ the steps required to validate a bignum arithmetic library. That's one of the smaller problems in getting a TLS stack right, and it's complicated.

If you demand that your browser implement protocols the same way ActiveRecord implements SQL join generation, you should just stop using browsers; _none_ of them are built the way you'd want them to be.

I have a hard time not being dismissive about TDD's role in improving systems software security. If you're going to propose a radical change in the way systems code is written (or, worse, hold systems developers to a nonexistent standard), be intellectually coherent about it: demand that security-critical code be implemented in a rigorous language, like idiomatic Haskell. Don't propose monumental changes that promise only that the resulting code will be asymptotically secure as Ruby on Rails.

<comment><USER16> That's not what he said at all and your comment dips into "the elite few know more than you do" territory, particularly with the unnecessary dig at Web development. His only mention of TDD was "even if you don't," yet you jumped on the acronym TDD and took him to task for it.

What I read him as saying (and agree with) is that he's surprised that GnuTLS isn't tested against known-bad certificates in a simple integration test that doesn't require a Ph.D. to set up, as you imply.

<comment><USER17> >What I read him as saying (and agree with) is that he's surprised that GnuTLS isn't tested against known-bad certificates in a simple integration test that doesn't require a Ph.D. to set up, as you imply.

Define "known-bad" in a general enough way that a specific test can be created to cover the entire range of "bad" certs. That's quite difficult, and, probably isn't realistically possible to go through all the "known-bad" if you want your tests to run quickly.

Realistically, all you can do is have regression tests to make sure that the found bugs aren't repeated in future releases.

<comment><USER16> My thoughts on this are more about the previous TLS disclosure, not this one, where an integration test that says "this invalid certificate should fail validation" probably would have caught it. But, this isn't my argument to make as I don't know enough about it, I just want to see the actual coherent argument made instead of a side tangent as we're seeing here.

<comment><USER2> What integration test? Writing that integration test implies that you know the bug is a possibility. Once you consider that possibility, a glance at the code tells you if it's there or not. It's not like this bug is likely to regress, either.

<comment><USER16> Again, I'm talking about the "goto fail" one, not this one, in which a simple test of the library against an invalid certificate would have caught at least one case that I recall. And I think it's pretty obvious that "you might erroneously validate a bad certificate" is a bug that's, you know, a given.

<comment><USER2>
        Feature: *Certificate Validation*
          In order to *keep NSA from reading my emai*
          As a *TLS X.509 validation library*
          I want *to never erroneously validate a certificate*

What are the "Scenarios"?

          Given: *???*
          And: *???*
          When: *???*
          Then: *the certificate should be rejected*

Remember, if we're switching topics to the "goto fail" bug: that bug didn't affect every instance of certificate validation. You had to be in a particular set of ciphersuites.

<comment><USER16> I spent a few minutes replying to your original comment, then you ninja edited in the closing paragraph and invalidated mine, so this is where I end the conversation. I can't reply to an ever-shifting comment with someone who reads what they want to read out of my comments and invokes the NSA for no reason whatsoever.

<comment><USER2> You'd be a happier person if you didn't assume people were editing their comments just to make you look bad. You can be assured that if I had seen you respond to something I'd written, I'd have noted where I added to my original comment.

But I agree that you & I are better off not discussing things.

<comment><USER16> I'm quite a happy person and thanks for the irrelevant concern trolling, based on a comment thread that's calling you out (do you always assume people that think you're wrong are unhappy or otherwise defective?). And no, I didn't assume those words you've placed in my fingers. I was, rather, annoyed that I invested a few minutes into a playing field that you'd already moved while I worked.

If you'd permit me a brief bit of my own concern trolling: I remember when I looked forward to reading your comments, several years ago. Now I see your nickname and say "bah, again?" What changed? Was it me or you?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER18> Patch fixing the bug:

[https://www.gitorious.org/gnutls/gnutls/commit/855127da290a2...](https://www.gitorious.org/gnutls/gnutls/commit/855127da290a280df839038671ae6aba01957736)

Basically, the code said

        bool isOk() {
            result = someCheckReturningNegativeOnFailure()
            if (result < 0) goto cleanup;

            cleanup:
                ...
                return result;
        }

The issue is that failure is communicated with a negative number in one case and 0 in another, and the wires got crossed.

<comment><USER19> Yeah. While they're at it, why not change every function to return "int". Then just cast to proper type at usage. /s (And no, bool is not the proper way to go either.)

But seriously, I'm amazed that code this critical uses sloppy typing. I mean, they might as well use Python ffs. Maybe it's historical burden?

</comment></comment><comment><USER20> This is not a bug that leaves "linux" open to anything. It's a GnuTLS bug, and you should be using openssl anyway.

<comment><USER21> Why should I be using OpenSSL other than this bug?

<comment><USER20> GnuTLS exists as a project almost exclusively due to ideology concerns -- people who prefer GPL do not like OpenSSL's license. That's not to say that technically-capable people are not behind it, but there are not as many as involved with OpenSSL. There are very few technical advantages to GnuTLS, and almost all of them have been transient (as in, certain protocols and ciphers have been supported in GnuTLS before other libraries). I do not have the time to go over _why_ other libraries occasionally lag behind GnuTLS, but I can specify, for instance, that OpenSSL code goes through a more thorough and lengthy review process before it gets 'shipped' (inasmuch as that term applies to not-for-profit software).

Code that supports GnuTLS can easily be made to support OpenSSL (or several other such libraries). It really is a matter of which license you prefer, and licensing should never be a consideration in security.

</comment></comment></comment><comment><USER22> Archlinux pushed the upgrade just 9 hours after the bug was fixed. Damn I love this OS.

<comment><USER23>
        root@teacup:/home/keith# apt-get upgrade
        The following packages will be upgraded:
          libgnutls26

Not quite 9 hours but fairly quick on gNewSense 3 as well, no doubt pushed through from Debian Squeeze.

</comment></comment><comment><USER24> So which projects actually use GnuTLS as opposed to OpenSSL (Apache, lighttpd, nginx) or NSS (Firefox, Chrome)? I'm aware of Debian linking some packages against GnuTLS to avoid the supposed GPL incompatibility issue with OpenSSL, but the only thing I've seen that explicitly uses GnuTLS is Emacs 24.

<comment><USER25> Apache can (and maybe should) use gnuTLS

<comment> josh-wrale Please expound on why you believe Apache 'maybe should' use gnuTLS.

<comment><USER25> Back when I still used Apache it didn't have support for TLS 1.1/1.2 due to the dep on OpenSSL and thus none of the better FS ciphers. So compiling against gnuTLS allowed for those. That's now been rectified.

</comment></comment></comment></comment><comment><USER26> Coming so soon after the Apple bug, it does make one wonder whether some or all of these are deliberate backdoors. Relevant musings by Bruce Schneier:

[https://www.schneier.com/blog/archives/2014/02/was_the_ios_s...](https://www.schneier.com/blog/archives/2014/02/was_the_ios_ssl.html)

<comment><USER27> Or the attention is now on "does your SSL cert handlying code have any shortcuts? Let's everyone double and triple check"

</comment></comment><comment><USER28> Just checked my Ubuntu boxes. Update has been pushed and is ready to apt-get.

<comment><USER29> Yes. For others:

1) consider installing the "unattended-upgrades" tool, to install security updates via cron. [https://help.ubuntu.com/community/AutomaticSecurityUpdates](https://help.ubuntu.com/community/AutomaticSecurityUpdates)

2) specific Ubuntu Security Notice on GnuTLS: [http://www.ubuntu.com/usn/usn-2121-1/](http://www.ubuntu.com/usn/usn-2121-1/)

3) List specific package affected:

dpkg-query -W libgnutls*

libgnutls-openssl27:amd64 2.12.23-1ubuntu4 libgnutls26:amd64 2.12.23-1ubuntu4

I'm on Linux Mint, and the above seem to show that I'm protected. Yay!

<comment><USER30> For Saucy, the fix is in:

.../ubuntu/+source/gnutls26/2.12.23-1ubuntu4.2

Yours is:

.../ubuntu/+source/gnutls26/2.12.23-1ubuntu4

See:

[https://launchpad.net/ubuntu/+source/gnutls26/2.12.23-1ubunt...](https://launchpad.net/ubuntu/+source/gnutls26/2.12.23-1ubuntu4.2">https://launchpad.net/ubuntu/+source/gnutls26/2.12.23-1ubuntu4.2)

</comment></comment></comment><comment><USER31> SSL fuzzing seems like it could be a really profitable area of research. I wonder why there aren't better conformance testing tools for SSL (other than SSL being kind of hideously baroque).

</comment><comment><USER32> Are all programs dynamically linked with GnuTLS, or are there packages that have to be recompiled separately? (On Debian/Arch)

<comment><USER33> I can't speak for absolutely every package but most if not all on Arch will be dynamically linked and shouldn't need to be recompiled. (The new version was released on Arch 3/3)

</comment></comment><comment><USER34> Linux? afaik I don't use any program that requires GnuTLS...

<comment><USER35> Are you sure? At least on Debian, GnuTLS is used by CUPS, exim4, cURL/GnuTLS, GnomeVFS, Gtk, NetworkManager, libvncclient, libvncserver, VLC, and wget.

<comment><USER36> Git and _bloody GnuPG_ are also on that list.

<comment><USER34> Oh.. well, it seems that Debian uses GnuTLS instead of OpenSSL, I was not aware of that.

In Arch Linux very few packages depends on GnuTlS.

</comment></comment></comment></comment><comment><USER37> Does this make anyone else's conspiracy antenna twitch a bit? The Apple one was only a little suspicious in that way. A bug in another major crypto library that weakens it in a very similar way makes it look a little more suspicious. Since this is OSS, the investigation of the source control logs will probably be a bit more public. I wonder if they'll find anything interesting.

</comment><comment> vezzy-fnord Makes me wonder how long this may have been used as a 0-day.

</comment><comment><USER38> I am not very familiar with low level C or the coding patterns used with it, so I must ask; why do we see goto statements in both of these recent bugs? As far as I know it's a bad practice overall, is there some specific reason for using it here?

<comment><USER39> C doesn't have exceptions, so goto is commonly used to emulate that style of programming.

<comment><USER40> It's not just that, it also doesn't have automatic destruction of objects, so any local array or structure containing a pointer needs to be laboriously freed by hand.

And in other words, nobody should be writing anything in C. Ever. The need to be compatible with programs written in C violates my rule against writing anything in C and is therefore not a valid reason to write crypto stacks in C.

<comment><USER41> You realize that most lower things are written in or base on C, right.

<comment><USER40> Yes I am fully aware of the sad state of our industry.

<comment><USER42> I'm curious, what do you propose the industry use?

<comment><USER43> Isn't Go designed to fill this niche? It's supposed to be a low-level systems language, but with "friendlier" features than C, and built-in concurrency support.

<comment><USER44> Go is advertised as a systems language but certain things like the lack of manual memory management say otherwise.

<comment><USER45> Before there was C, there was Pascal. You didn't have malloc in Pascal. At ETH Zurich the standard OS was written in Oberon: it ran directly on the hardware with a garbage collector collecting everything.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> Since 2005? 10 years long in production? And while the code is open, no-one ever seen the bug? Is that the power of open source??

</comment><comment><USER47> How many apps really use GnuTLS anyways? Apache doesn't by default. SSH doesn't. Are most RedHat installations therefore not really affected?

</comment><comment><USER48> That's a good hype for GnuTLS, but most of the packages that I know of uses OpenSSL - Apache, Nginx and so on. So it doesn't really matter.

</comment><comment><USER49> As someone who uses tends to compile most things against openssl, I was wondering if someone could answer how widespread gnutls usage is?

</comment><comment><USER50> But I thought open-source is immune to slip-ups like this?

/s

</comment><comment><USER51> Does anyone know if this affects any of the popular configuration management tools like Puppet, Chef, SaltStack, etc?

<comment><USER52> If you're on a Debian derivative, you can find out which _installed_ packages depend on an item with "aptitude why [foo]"

</comment></comment><comment><USER53> So I wonder where are all commenters blasting Apple for careless coding. Crypto is brittle.

</comment><comment><USER54> What's with the back button ARS? Helping me stay off hn?

</comment><comment><USER55> Is there a tool to check if you're affected?

</comment><comment><USER56> Windows is bound to be next.

#it_comes_in_threes

</comment><comment><USER40> Demand unit tests and comments. I mean, I was incensed by the quality of the Apple code, but this code is just as bad:

      * Checks if the issuer of a certificate is a
      * Certificate Authority, or if the certificate is the same
      * as the issuer (and therefore it doesn't need to be a CA).
      *
      * Returns true or false, if the issuer is a CA,
      * or not.
      */
      static int
      check_if_ca (gnutls_x509_crt_t cert, gnutls_x509_crt_t issuer,
                 unsigned int flags)
      {

Sure, returns "true" or "false" which are not things in C. This actually returns either 0 or 1. Many C library functions return 0 for OK and non-zero for error. This one returns 0 for error and 1 for OK.

Imagine you are reviewing the a call site of this code:

      if (check_if_ca(...)) {
        // CA is valid, proceed
      }

vs.

      if (check_if_ca(...) == 0) {
        // CA is valid, proceed
      }

To the reviewer who is accustomed to strcmp, either of these might appear to be fine, meaning that the reviewer (or even the author) has to carefully check the documentation of this function.

What else is wrong with this signature? For one thing it would be easy to swap the arguments around:

      if (check_if_ca(cert, issuer, flags)) ...
      if (check_if_ca(issuer, cert, flags)) ...

What's the difference? They both look reasonable. What are the valid/relevant values of |flags|?

Would it be easier to comprehend |flags| if it were an options struct, e.g.

      GNUTLSCertificateVerificationOptions opts;
      opts.set_allow_rsa_md2(true);
      ...
      cert.Verify(opts);

?

Would it be easier to verify the correctness of a call site of check_if_ca if it looked like this:

      if (issuer_cert.IsCA() || cert == issuer_cert) ...

Where are the unit tests. The unit tests should be right here in the lib directory as whatever_unittest.c, adjacent to the source file they are testing, so you don't have to go groping around in the tree trying to find the relevant test, if it even exists. By the way, I found no test that calls this function.

Basically this code has all the same problems as the Apple code, except for the mixed tabs/spaces stuff (as far as I can tell). It would be shameful for any professional programmer or organization of programmers to create this code.

<comment><USER57> > Sure, returns "true" or "false" which are not things in C

#include <stdbool.h>

Available since C99.

<comment><USER58> It's a strange thing, but C99 features seem very slow to catch on in the C community, particularly features conceived specifically to alleviate bad "C-isms". The only explanations I can think of are ignorance (not really an excuse after well over a decade) or possibly a subconscious fear that they somehow make a program "less portable", even though basically every compiler supports it (and besides, I've never noticed any aversion to trivial features like //-style comments).

[EDIT - maybe pride in the bad C-isms?]

<comment><USER59> This mostly due to slow support from the compiler people. 10 years after neither `clang` or `gcc` provide a complete C99 implementation [1].

[1] [http://en.wikipedia.org/wiki/C99](http://en.wikipedia.org/wiki/C99)

<comment><USER60> I think that's a bit dishonest -- the standard is almost entirely supported by GCC:

[http://gcc.gnu.org/c99status.html](http://gcc.gnu.org/c99status.html)

> C99 is substantially completely supported as of GCC 4.5 (with -std=c99 > -pedantic-errors used), modulo bugs, extended identifiers (supported except > for corner cases when -fextended-identifiers is used), and floating-point > issues (mainly but not entirely relating to optional C99 features from > Annexes F and G).

... and also by clang:

[http://clang.llvm.org/docs/UsersManual.html#c](http://clang.llvm.org/docs/UsersManual.html#c)

> The support for standard C in clang is feature-complete except for the C99 > floating-point pragmas.

Compiler/library support for C++ is much less complete(standards were published in 1998, 2003 and 2011, and none are completely implemented in any compiler) but that clearly didn't stop people from using C++. The reason is that the commonly supported subset was useful enough. The same is true of C99.

I think it was mostly Microsoft that was holding C99 adoption back by refusing to support it in their compiler suite (officially, they support C++ and C89/C90 only). That means you can't generally compile C99 code with the Microsoft C/C++ compiler, which meant you had to avoid either that compiler or (if you care about portability) the C99 standard. I don't think limited C99 support in GCC or Clang was a limiting factor to anyone in the past decade.

<comment><USER61> _Compiler /library support for C++ is much less complete(standards were published in 1998, 2003 and 2011, and none are completely implemented in any compiler)_

Clang begs to differ on that point [http://clang.llvm.org/cxx_status.html](http://clang.llvm.org/cxx_status.html)

and gcc claims to implement "all of the major features" so you may be right on that one [http://gcc.gnu.org/gcc-4.8/cxx0x_status.html](http://gcc.gnu.org/gcc-4.8/cxx0x_status.html)

At any rate C++11 features are quite well supported IMO. Even VC++ is catching up.

<comment><USER60> > Clang begs to differ on that point > [http://clang.llvm.org/cxx_status.html](http://clang.llvm.org/cxx_status.html)

Impressive! I see that exported templates got scrapped in the latest standard -- they probably never supported that.

In any case, my point wasn't that Clang was bad (I think Clang is very good) but that the few limitations that might exist in Clang or GCC are probably not holding back C99 adoption.

<comment><USER62> I'll just note, that after coming back to C after a while in ruby/python/ungh, perl land everything in C99 and C11 has been a welcome change.

Seeing lack of adoption to things like just stdbool.h or even C99 initializer syntax is somewhat amusing. I understand backwards compatibility and all but there seems a general unwillingness to abandon C89 which I can only think is due to the microsoft toolchain.

As to c++ support clang has been really spearheading the implementation of new c++ standards and last I recall they even found bugs or inconsistencies. It always pays to have at least one implementation before standardizing I think.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER63> So I guess the whole meme of "if the code was open to scrutiny, this bug wouldn't have happened" doesn't seem to be so valid now. There was legitimate outrage on Hacker News that Apple could allow such a bug, and that it was an indicator of the evil of closed source systems.

</comment><comment><USER64> After Apple and now GNU, henceforth no SSL distribution should be accepted at face value without proof of continuous automated testing results. Period. This is a scandal now.

</comment><comment><USER65> Is there a list somewhere of which applications use GnuTLS?

</comment><comment><USER66> Thou who reimplements code is doomed to reimplement bugs as well.

</comment><comment><USER67> Choose OpenBSD for your Unix needs. OpenBSD -- the world's simplest and most secure Unix-like OS. Creator of the world's most used SSH implementation OpenSSH, the world's most elegant firewall PF, and the world's most elegant mail server OpenSMTPD. OpenBSD -- the cleanest kernel, the cleanest userland and the cleanest configuration syntax.

<comment><USER68> unfortunately, it is as performant as a pig in winter mud.</comment></comment>


FDA permits marketing of brain-wave test for ADHD - <AUTHOR> http://www.fda.gov/NewsEvents/Newsroom/PressAnnouncements/ucm360811.htm

<comment><USER2> Or not, apparently.</comment>


Ask HN: What tool do you use for Code Analysis? - <AUTHOR> Trying to find a simple tool with a nice UI that can handle a large PHP code base. Tried CodeClimate, Codacy, and Scrutinizer. None did so well with my code base with 15+ minute analysis. Are my expectations too high in terms of speed? <comment><USER2> At Codacy, for your type of code base we usually recommend to use our on- premise version. It's much faster, easy to install and to use. Don't hesitate to contact us if you want to try it out.</comment>


Is Software Set to Replace Sports Journalists? - <AUTHOR> http://singularityhub.com/2009/11/09/is-software-set-to-replace-sports-journalists/

<comment><USER2> Good Lord, I should hope software does replace sports "journalism". Pick up a major city's paper. Read the first section. Then read the sports section. The quality of reporting is so low as to be laughable, but the sports section IS EVEN WORSE.

Don't even get me started about tee vee sportscasters. What a pack of toadying, cliche-spouting ex-fratboys. Feh. The closest these empty suits get to reporting is when they state the scores. After that, they depart Reality Station.

<comment><USER3> _The closest these empty suits get to reporting is when they state the scores._

This strikes me as standing up in the middle of the play and shouting "That so-called Romeo is really Steve! What is this twaddle about Juliet?! Steve isn't even interested in women!" I mean, I sort of get where you are coming from, but I think your understanding of the purpose of the exercise is so at odds to everyone else's that it makes it difficult to engage.

Sports are a form of performance entertainment, and the sports section of the newspaper is an extension of the performance.

</comment></comment><comment><USER4> I got bored a few lines into the generated article - it reminded me somewhat of a book report a kid might write. There was no drawn-out arc to the story; each sentence or two was correct and complete, but didn't flow that well into the following or previous ones. It was as if there were a bunch of bullet points that were joined together into a "story", which is, I suspect, similar to how it was created.

When I read sports, I want to read passion. If I just want the bare facts about what happened, I'll read the boxscore - which tells me what the details are. For an actual article, I want emotion, I want character, and I want some feel about the game itself.

If you ask me what the largest threat to professional sports journalism is, it's semi-pro local sports blogs. Guys (and it's mostly guys) who write passionately about their local team, and have a depth of knowledge about it that surpasses most general sportswriters. It's similar to comparing writings about small web businesses between SitePoint and 37Signals - in both cases you've got one author that investigated it (but also writes on other things), and one that lives and breathes it. The latter, almost always, will provide a more compelling story.

</comment><comment><USER5> The sample is pretty good. If I were an ambitious sports journalist, I would use Stats Monkey to generate an initial boilerplate article of a game (drudgery anyway if a computer can do it) and use all the time I saved to do actual in-depth, behind-the-scenes reporting (i.e. my real job).

So perhaps we can combine automation with an investigative human element to more efficiently achieve a better product?

</comment><comment><USER6> The idea is even more interesting if you apply it to areas that professional journalists might not already cover, like little league or even high school games.

In fact, if I ran a fantasy baseball league I'd be beating down their door. Every league would love to have their own private newspaper adding color to each game and extolling the wisdom of the team managers.

</comment><comment><USER7> It gives a readable account, but still needs some work. Compare the auto- generated article to ESPN's account: <http://sports.espn.go.com/mlb/recap?gameId=291011102>

Also, how did the auto-generated article get quotes from players?

<comment><USER8> You know what, it's not really _that_ much better. It's better, but it's not so much better that I can really tell that one is written by a computer.

If you factor in the costs, time to market, and other factors, I can easily see the automated version winning out in the long run.

I'm sure similar comparisons were made between robots on factory lines and people as well, but the cost differentials really push toward automation. Perhaps robots will write the initial article and then hand it off to a person for the flair.

<comment><USER7> Really, you can't tell? To me the difference in quality is really far apart. Just look at the first paragraph - which one makes you want to read more?

"Things looked bleak for the Angels when they trailed by two runs in the ninth inning, but Los Angeles recovered thanks to a key single from Vladimir Guerrero to pull out a 7-6 victory over the Boston Red Sox at Fenway Park on Sunday. Guerrero drove in two Angels runners. He went 2-4 at the plate."

versus

"Torii Hunter emerged from the visitors' clubhouse at Fenway Park to spray champagne over the fans and family gathered there. Erick Aybar did him one better, handing over bottles of bubbly to those who came from California to see the Los Angeles Angels go for the sweep. History gave no reason to hope for such a celebration."

<comment><USER6> I agree. I don't follow baseball, but I'd imagine there's just as much, if not more, story in the unmeasured events between the plays as there is to be told when they occur.

I do follow pro cycling, however. And even if riders' exact position and biometrics throughout a race were recorded, analyzed, and commented on by such a program, the resulting story could be accurate yet would likely be utterly boring compared to an experienced commentator's narrative of the facts combined with the less quantifiable atmosphere of the course, the conditions, and the crowds.

</comment></comment></comment></comment><comment><USER9> AI is not known for its abilities in creative writing

</comment><comment><USER9> No.</comment>


New Evidence Suggests Satoshi Nakamoto Is Paul Solotshi - <AUTHOR> http://cryp7o.me/pujs9 <comment><USER2> No doubt posted here many times but if you haven't read it "The Mastermind" is absolutely brilliant.

[https://longform.org/posts/the-mastermind](https://longform.org/posts/the- mastermind)

</comment><comment><USER3> Seems like someone could compare the source code of e4m and satoshi's code, to look for similar stylistic things?

</comment><comment><USER4> Is it possible the coins are....lost entirely?

<comment><USER5> Yes, of course it is. The harddrives may be lost, real Satoshi may have died etc.

</comment></comment><comment><USER6> How credible is this?

<comment><USER7> Credible as National Enquirer alien autopsies.</comment></comment>


Ask HN: interested in a SF East Bay HN meetup? - <AUTHOR>

I was wondering if there would be any interest in a HN meetup in the East Bay (Berkeley-Emeryville-Oakland area)
Please upvote and/or comment if you are interested.
Not quite sure where it could take place, but feel free to offer suggestions as well. (I'm thinking more of a happy-hour kind of thing) <comment><USER3> Any one of Berkeley, Emeryville, or Oakland would be great!

In Berkeley there's:

\- the new David Bower center (aka The Hub) in downtown

\- Caffe Med on Telegraph near campus is pretty spacious

\- the 2 story Starbucks on Oxford & Center in downtown

Emeryville is kind of limited:

\- Peet's on Bay Street seems roomy

Oakland:

\- A'Cuppa Tea on College & Alcatraz is bigger than the average local coffee shop, open late, and has free Wifi

I'd also be happy to put you in touch with someone in Startup @ Berkeley for more help and ideas.

<comment><USER4> I'd also vote for Philz Coffee towards the north end of Berkeley, I've worked out of there whenever I'm not meeting down @ YC in mountain view. The coffee is fuel for me (other than cheesily being motivated by happy tweets from fanvibe users =)

If it's a late night gathering, I love going to the Pub in Albany/North Berkeley. Awesome atmosphere, awesome belgian beers. Pretty cool people there too. it's well lit, no music, so it's easy to talk and hang out in.

<comment><USER5> The Pub is great, North Oakland here.

</comment></comment></comment><comment><USER6> <shameless plug>

The Hackers and Founders SF meetups are right across the bridge on Pier 38 in Dog Patch labs. Our next one is the 29th: [http://www.meetup.com/Hackers-and- Founders/calendar/13712630...](http://www.meetup.com/Hackers-and- Founders/calendar/13712630/)

</shameless plug>

<comment><USER4> Dogpatch is an awesome space. I've worked out of there for awhile now, even did a code competition there last year for the RailsRumble.

The Hackers and Founders meetup is fun. I went to the first one that happened at DPL. The keg is a nice touch to the DPL events.

</comment></comment><comment><USER7> The Trappist in downtown Oakland is a great spot. Its about 4 blocks from the 12 street BART.

<http://www.thetrappist.com/>

</comment><comment><USER8> We could meet up tonight. A bunch of East Bay redditors are getting together tonight at Jupiter in Downtown Berkeley, right next to the BART stop. Some people will be getting there around 8:30pm and people will be trickling in all night. I'll be the nerdy looking 24 year old bearded Indian kid. Email me if you want my phone number.

There's also an AVC meetup tomorrow in Berkeley. <http://www.meetup.com/AVC/11501/>

<comment><USER9> Right now it seems I'm the only person besides the creator signed up for the AVC meetup <http://www.meetup.com/AVC/11502/>.

<comment><USER8> Looks like a dupe. Yours ends in 11502, but 11501 has a few signups.

<comment><USER9> Weird, those pages looked really different before... I think.

</comment></comment></comment></comment><comment><USER9> I made a Google Group to coordinate <http://groups.google.com/group/east-bay- hacker-news>

<comment><AUTHOR> Thanks!

It'd be a good thing for people to join this group, if anything so that we don't need to pollute HN with threads about this. (and future events)

Once something is decided we can just post a Tell HN about it.

</comment></comment><comment><USER10> I'm interested. Berkeley / North Oakland preferred, but anywhere nearby would be fine.

</comment><comment><USER11> Sounds good. Anywhere in the East Bay is fine but Oakland or Berkeley would be ideal.

</comment><comment><USER12> Berkeley / Albany / El Cerrito

<comment><USER4> randall you live in the area too? commute to sf daily?

<comment><USER12> Yeah, I work @ justin.tv

<comment><USER4> Awesome, I've yet to meet any of the Justin.tv guys in person.

</comment></comment></comment></comment><comment><USER13> Looks like we have a time setup for Wednesday @ 7:30pm - <USER2> <http://groups.google.com/group/east-bay-hacker-news> for more details...

</comment><comment><USER14> Berkeley.

The new philz on shattuck and cedar is also nice

<comment><USER9> I'm there now! Email me if you want to meet up. </old_school_loopt>

<comment><USER4> I've been going to Philz a few times a week when I'm not down in Mountain View =) It's a really cool spot, park on lincoln during the week for 2 hours of free parking. Open till 9pm too, and good amount of space in the back.

</comment></comment></comment><comment><USER9> I'm a member of Berkeley Coworking, at Ashby & Shattuck. It's a good place for meetings. There'd be no need to buy coffee, but cafes nearby if you wanted to.

</comment><comment><USER15> I'll be living in Berkeley starting in August. I'm up for meeting anywhere, but don't delay the meetup on my account.

</comment><comment><USER16> tomorrow (Sat, 10:30AM) i'll be at Eastbay ruby meetup at UC-B:

[http://www.meetup.com/EBRuby/calendar/13618932/?a=nr1p_grp&#...

</comment><comment><USER17> I would definitely like to join. What about some night next week?

</comment><comment><USER18> Albany, for the win.

<comment><USER19> YES. I just recently graduated from AHS. Albany is great.

<comment><USER4> congratz! i also graduated from AHS, but back in 2001 =X I'm old.

</comment></comment></comment><comment><USER20> I'm in San Ramon.

</comment><comment><USER13> Berkeley here, up for a meetup in the area

</comment><comment><USER21> Oakland here

</comment><comment><USER22> Berkeley! This sounds great.

</comment><comment><USER23> Berkeley.

</comment><comment><USER24> Berkeley.

</comment><comment><USER25> Danville</comment>


All paid targeting options available on social media platforms - <AUTHOR> https://www.notion.so/Targeting-Explorer-7e283ffd84d242abbbfce67476878d0f <comment><USER2> Damn this site sure does not want to let you use the arrow keys on your keyboard to scroll the page. It starts highlighting individual lines instead and completely consumes home/end.

<comment><USER3> That's because it's an app, not a site [0]

As @jklinger410 mentioned, it's a combination of notes, to do, personal wiki and other stuff.

[0]: [https://www.notion.so](https://www.notion.so)

<comment><USER4> im not sure UX criticism is irrelevant if the subject is an "app" or a "site".

<comment><USER5> It does when the criticism is "web application with its own keybindings doesn't behave like a document."

Like if this was a Google Docs link I don't think you would flinch at the idea that arrow down moves the cursor instead of scrolling the page.

<comment><USER6> What is the point of an arrow key highlighting individual blocks if the individual blocks aren't editable and don't have any actions associated with them?

I don't know much about Notion, but if it's trying to be a platform that allows you to share notes and documents, its keybinding ought to be rethought. These are really bad shortcuts for a document presentation platform.

And if it's not a document presentation platform, the author shouldn't have used it that way.

If someone linked me a document that was a read-only Excel file where every paragraph was a different cell, I'd complain about that too -- because the content doesn't fit the medium it's posted in.

From a content perspective, this is a document masquerading as an app. What about this page is an app? I can't edit it, there aren't any dynamic calculations happening, the data isn't clearly separated into a table format. When I click to expand a section, I get a loading icon... and then pure text pops up that could have just been embedded into the page from the start. There's nothing that distinguishes this from a normal webpage except that the shortcuts are unintuitive.

</comment></comment></comment></comment></comment><comment><USER7> Having worked in ad-tech for the past 5 year or so, this is a pretty awesome list.

I think that there's still a lot of confusion and opaqueness when it comes to targeting and advertising -- the platforms (GOOG/FB/SNAP/etc.) make it purposefully confusing imo. There's probably some kind of start-up idea here (marketing/targeting for regular folks).

<comment><AUTHOR> Just having all the targeting options under one dashboard is already a very significant improvement in the strategy step that any PPC manager must think about.

All the stress and energy spent going back and forth between ad platforms really only favors the installed players.

</comment></comment><comment><USER8> Just wanted to chime in that Notion is amazing and completely solved my needs for: notes, to do, personal wiki, link storage, etc.

I hadn't even thought of using it as a public web page. Even better!

<comment><USER9> Notion is great, but I cancelled my account immediately after finding out they use fullstory. Yes I can opt out, but the risk is too high for private notes, especially when using different browsers or multiple machines which I often do.

I should say that I have nothing against fullstory, we use it for our own saas application.

Edit: typo.

<comment><USER10> I don't know about fullstory, what is wrong with it?

<comment><USER11> I'm not sure either. I searched and found this, and now think the issue is with the level of tracking.

[https://www.wired.com/story/the-dark-side-of-replay- sessions...](https://www.wired.com/story/the-dark-side-of-replay-sessions- that-record-your-every-move-online/)

</comment></comment></comment></comment><comment><USER12> I manage millions in ad spend. Targeting with individual, manual options is not efficient for most advertisers. Most performance advertisers target using lookalikes and algorithmic targeting based on optimizing for conversions.

<comment><AUTHOR> This is 100% correct, but this list is more about knowing if some ad platform can be a good place to launch ads to a cold audience (that are more targeted for the product) - because, after a while, every single one of the 6 ad platforms allow for lookalike audiences and those will be much more profitable.

</comment></comment><comment><USER13> It's missing "Show HN" in the list, surely this story also counts as a targeted ad?

</comment><comment><USER14> LinkedIn supports Age and Gender demographics? That's something I'd like to learn a lot more about.

<comment><AUTHOR> Not for job offers, as that would break Federal law - but for all else, it's good to go (but very ineffective just by itself).

</comment></comment><comment><USER15> If you think this is bad... social has very very weak targeting compared to open web. (DSPs like google's dv360 and the trade desk).

google 'oracle data directory' :)

<comment><USER16> From my experience social, namely the largest one - Facebook - delivers way better results than any solution from DSPs.

People forget that the medium itself is important, not just the data.

(Let's not forget that the data directory reach, from the first page of search results has the reach of part of US Households, it doesn't have the global reach a social network like Facebook has).

So I disagree: some social platforms have great targeting compared to open web.

</comment></comment><comment><USER6> Pretty interesting guide. I'm looking forward to digging into this.

I really appreciate you putting the time into building it and sharing it, info like this is hard to find.

<comment><AUTHOR> Thanks Dan and if you need any help finding targeting options or using the knowledge base just email the address in my profile.

</comment></comment><comment><USER17> Hey Louis - how to get in touch? Impressive guide and would like to learn more about what you do -

<comment><AUTHOR> Sure aresant, just email the address in my profile - thanks.

</comment></comment><comment><USER18> This is great by why in the world have you hijacked the back/forward buttons?

</comment><comment><USER19> Good job, but what about retargeting?

<comment><AUTHOR> I'll probably do it in a version 2.0 of my knowledge base, but almost every platform offers the exact same type of retargeting, so it's not that insightful.</comment></comment>


3d running horse simulation using particles - <AUTHOR> http://empaempa.github.io/GLOW/examples/complicated/ <comment><USER2> I'm seeing nothing except the background and the logo & links in the top left on both Chrome (27.0.1453.110 m) and Firefox (21.0) on Win8 64bit.

Console:

GLOW.Attribute.constructor: Unreachable attribute? Please activate GL.drawArrays or split into multiple shaders. Indexed elements cannot reach attribute data beyond 65535. GLOW.js:67

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveUniform: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveAttrib: index out of range empaempa.github.io/:1

<comment><USER3> Same, latest chrome gives me:

GLOW.Attribute.constructor: Unreachable attribute? Please activate GL.drawArrays or split into multiple shaders. Indexed elements cannot reach attribute data beyond 65535.

GLOW.js:67 .WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveUniform: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveAttrib: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveUniform: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveAttrib: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveUniform: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveAttrib: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveUniform: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveAttrib: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveUniform: index out of range empaempa.github.io/:1

.WebGLRenderingContext: GL ERROR :GL_INVALID_VALUE : glGetActiveAttrib: index out of range empaempa.github.io/:1

Doesn't work in latest FireFox either (downloaded just now)

<comment><USER4> Running great on Chrome 28.0.1500.36 beta, Linux 3.8.13 with AMD catalyst version 12.6. Also working in Firefox 21.0, albeit with about half the fps.

</comment></comment></comment><comment><USER5> Turning the web, the only viable cross-platform solution, into something that works only for a certain OS / browser / graphic card combination is a bit unfortunate.

<comment><USER6> There are other cross-platform solutions, and insomuch as GLOW is advancing the state of the art in cross-platform-foot-shooting, it mostly treads a path already well bloodied by the limping of oh so many plugins and browser DOM/Styling quirks.

Isn't it fortunate that we're finally seeing proper 3D graphics being brought to "the only viable cross-platform solution"? How exciting will it be when it spreads to more OS / browser / graphics card combinations and approaches ubiquity!

</comment></comment><comment><USER7> Click to change the animal. Anybody recognizes the 7th one?

<comment><USER8> Seal: [http://empaempa.github.io/GLOW/examples/complicated/Complica...](http://empaempa.github.io/GLOW/examples/complicated/Complicated.js)

</comment></comment><comment><USER9> Working for me in Firefox (latest version) on Mac, though I don't much see the point of it...

<comment><USER10> May I ask why you need a 'point' to something like this? It's pretty and the technology behind it is pretty cool.

<comment><USER9> Well, it just seems like "yet another technical feat that doesn't mean all that much"... There have been many posts like this over the years and I was just expressing that I'm at a loss as to why they're all that attention-worthy at this point.

Anyone (smart) can put together a neat demo that does something different. If they had, let's say, built a whole game with this, I'd be more inclined to be impressed! But yet another toy proof of concept? Meh. I mean, it's cool, but...

Perhaps I'm just overly blasé today...

</comment></comment></comment><comment><USER11> Diden't work in my Chrome. Running latest version. Did only see the background, logo and links in the top left corner. Shortly after the PC become super slow for about 10-15 seconds, then the browser closed the tab.

Chrome version 27.0.1453.110 m on Windows 7 64 bit with 8 gb ram and a Nvidia GetForce 8600 GTS 3d card.

</comment><comment><USER4> Not sure if this has been posted here before, but this is also a really cool WebGL demo:

[https://www.shadertoy.com/view/ldl3zN](https://www.shadertoy.com/view/ldl3zN)

Everything is done in the fragment shader, no vertex data is used at all.

</comment><comment><USER12> Hmm - doesn't seem to work for me in Chrome OR Firefox. Am I missing something?

<comment><USER13> Doesn't work for me in Chrome. Firefox displays a moving square made of triangles and "particles".

</comment></comment><comment><USER14> Working in latest Firefox Dev on Ubuntu. I suspect it needs some new features not in stable builds yet.

Edit: And it's really interesting too. It's great to see particle effects starting to speed up in browsers.

</comment><comment><USER15> This is from 2011, part of the building of the ROME ([http://ro.me](http://ro.me)) WebGL demo.

</comment><comment><USER16> Works beautifully with Chromium 25.0.1364.160 on Ubuntu 12.04 (25.0.1364.160-0ubuntu0.12.04.1)

</comment><comment><USER17> Doesn't play with Chrome running in a VM. Worked fine with Chrome 27.0.1453.110 for Mac.

</comment><comment><USER18> Firefox had a problem and crashed ... version 24.0a1 (2013-06-10)

</comment><comment><USER19> Doesn't work in latest Firefox on Windows 7.

</comment><comment><USER20> Beautiful, but really hurt my head!

</comment><comment><USER21> Works fine in Safari.</comment>


Mass Incarceration: The Silence of the Judges - <AUTHOR> http://www.nybooks.com/articles/archives/2015/may/21/mass-incarceration-silence-judges/ <comment><USER2> We all know what ultimately needs to happen.

Marijuana needs legalized. Minimum sentencing guidelines need to be replaced with maximums. For-profit prisons need to disappear. More work needs put into counseling and mentoring at-risk youths.

But how do we get there? Do we find another politician to hang our hopes on? Last time I voted for someone campaigning on Hope and Change we saw more civil rights disappear than ever, and Gitmo is _still_ running.

<comment><USER3> Why use Gitmo as an example when there are plenty of other areas where you can bash Obama, like continuing many of the Executive Order programs? At least he genuinely tried to shut down Gitmo and was blocked from doing so.

I think believing a single person/president/whatever can fix all problems is wishful thinking, and indeed a system in which that was possible would likely not be a democracy.

Start by blaming all the representatives who pushed for or voted against ending the programs you don't like, and voting accordingly. Look at the voting histories of candidates rather than what they say. Look at who funds the candidates , not at what the candidates say. Actually, listen to everything other than what candidates say during election season; the game is set up in such a way that you will always be disappointed if you simply believe what is said, no matter the candidate.

<comment><USER2> There are plenty of other examples where he's let me down, and plenty of good he's done, but the fact remains that Gitmo is still running.

He's literally the leader of the armed forces, he has all the power he needs to shut that place down any time he wants.

<comment><USER4> This is factually and legally incorrect. The President cannot use any federal funds to modify the prison at Gitmo, or to transfer prisoners. This was part of the budget in I believe 2012, and has been every year since. (Should you need citations I will find them when I return home later.)

Point is that shutting down Gitmo was something the Administration attempted to do and that Congress forcefully blocked.

<comment><USER5> The POTUS has, and I quote, the following:

"The President...shall have Power to grant Reprieves and Pardons for Offences against the United States, except in Cases of Impeachment."

Article II, Section 2, Clause 1

They are detainees of the USA. He has full power to bestow each and every one of them a full unequivocal presidential pardon for all crimes accused and committed against the US. No if's, and's, or but's.

<comment><USER6> Extremes should not be remedied with extremes.

<comment><USER7> You're right. Those presidential pardons are reserved for important people.

<comment><USER8> Side note: Presidential pardons are the ultimate answer to any argument for "torture the terrorist to stop the nuclear bomb" scare-stories.

If you aren't willing to gamble that you'll need/get a Presidential pardon, then you clearly don't know enough to justify what you're about to do to the suspect.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I just watched a local news story (FL) about a vacationing couple that got caught having sex on the beach. They're looking at _serious_ prison time, possibly 15 years (they had just been convicted and were getting ready for the sentencing phase of the trial). And of course, they'll both have to register as sex offenders for the rest of their lives.

WTF? I would have expected a fine and _maybe_ some community service. The prosecutor was practically gloating: "We want people to know we take this sort of behavior seriously."

<comment><USER10> People seem to forget that bad prosecutors are a local issue, and as such, if people were involved more in their local government, they can have a say in these matters.

<comment><USER11> People seem to forget that prosecutors tend to reflect the attitudes of the voters in their districts.

[http://www.huffingtonpost.com/2014/07/22/florida-couple- sex-...](http://www.huffingtonpost.com/2014/07/22/florida-couple-sex-beach- video_n_5609350.html) ("This time, Emily Hall, a concerned parent, called police. According to a probable cause affidavit, she told cops that she became 'very upset' because her 4-year-old daughter 'witnessed the couple having sex.' She wasn't alone. Six witnesses filed complaints against Alvarez and Caballero.")

<comment><USER12> Granted this shouldn't have taken place on a public beach but I still do not understand America's prudishness when it comes to sex. It's like they've never seen and fantasized about it before.

<comment><USER13> There have been cultures that are prudish about sex for thousands of years. If you can't understand them, it says a lot more about you than it does about them.

<comment><USER14> Why attack someone who admits not understanding something? And really, since you seem to think it says something about the parent, why not just say what you think it says?

One could also say (without actually saying anything) that your comment says a lot more about you than it does about the parent.

</comment></comment></comment></comment></comment></comment><comment><USER15> prison population by type of crime (2012):

        violent: 47.7%
        property: 17.1%
        drug: 20.5%
        public order: 13.8%

"public order" includes drunk driving, weapons possession, and prostitution. Source [http://felonvoting.procon.org/view.resource.php?resourceID=0...](http://felonvoting.procon.org/view.resource.php?resourceID=004339)

Recidivism rates (2005):

        violent: 71.3%
        property: 82.1%
        drug: 76.9%
        public order: 73.5%

Source: [http://www.nij.gov/topics/corrections/recidivism/Pages/welco...](http://www.nij.gov/topics/corrections/recidivism/Pages/welcome.aspx)

<comment><USER16> For prostitution the U.S. ought to follow the Swiss (I think) model: to sell is legal, to buy is criminal, for the reason that the buyer inherently victimizes the seller.

Drugs? I suppose some form of regulation would be better. Governments get scary when they attempt to legislate morality. Drug use is immoral (IMO), but perhaps it shouldn't be illegal.

<comment><USER17> >for the reason that the buyer inherently victimizes the seller

you'll have to explain here, because it seems to me that under a legal regime, a prostitute making a clear decision to sell sex is no more a victim than the owner of a convenience store deciding to sell slurpees.

<comment><USER18> It's contentious— there is certainly a class of sex worker who is empowered and fully in control of the economic transaction being carried out. But there are also many, many who are trapped and not making their own decisions, especially when drugs are part of the picture.

<comment><USER19> Ban an entire market because sometimes the sources of labor are repugnant?

What percentage of the market has to be drugged-out sex slaves (often imported from some other countries, if the horror stories are true) before it's acceptable to shut down the whole market by criminalizing it?

Does criminalizing the market help those drug-addicted sex slaves, or does it make their situation worse?

<comment><USER20> Criminalizing the market us why its run by the same groups that run the illegal drug trade and why the people working in it often feel they have no recourse against abuse -- it is, in other words, the reason why there are drugged out sex slaves. If it was legal, well-regulated, with effective workplace protections, the character would be radically different.

</comment></comment></comment></comment></comment></comment><comment><USER11> [http://www.nybooks.com/articles/archives/2015/may/21/mass- in...](http://www.nybooks.com/articles/archives/2015/may/21/mass- incarceration-silence-judges).

The author, Jed Rakoff, is a prominent federal judge in New York. It's good to hear him speak out on the issue.

</comment><comment><USER21> The prison companies are probably bad actors that should be disbanded; their assets liquidated & distributed to the wrongly incarcerated & taxpayers.</comment>