Stanford Encyclopedia of Philosophy shows a higher-quality internet is possible - <AUTHOR> http://qz.com/480741/this-free-online-encyclopedia-has-achieved-what-wikipedia-can-only-dream-of/ <comment><USER3> This article says that the SEP is more comprehensive and more authoritative than Wikipedia. I agree that it's more authoritative, what with it being written by authorities in philosophy. But "more comprehensive"...?

Wikipedia is extremely broad. According to the article, the SEP has 1500 entries. Each of those is no doubt better than an individual Wikipedia article (more cohesive, more in-depth, etc), but I bet there's two orders of magnitude more Wiki articles on philosophy (nevermind _other_ topics!). It no doubt has much wider coverage. How's that for "more comprehensive"?

I guess I'm just complaining about stretching a word to mean something more specific than it usually means. I think of comprehensive as including both in- depth focus and wide-ranging reach. So when the article counts only one of those aspects, and omits the other from the checklist, it feels like cherry- picking the outcome.

<comment><USER4> Comprehensive within the field of philosophy? Yeah, I think that can be achieved. Wikipedia articles on core philosophical articles are often not much more than stubs - certainly the SEP examples seem more coherent and well structured. I don't think there will be more than 1500 articles better than C-class in Wikipedia's Philosophy category.

<comment><USER5> SEP articles are definitely better-structured, especially the ones on general overview subjects. I think that's a general property of the respective authoring models. Wikipedia is good at specific articles on well-defined subjects, while the general overview articles often range from incomplete to haphazard. An encyclopedia written by individual expert authors is better at crafting long overviews, which often require subjective and carefully curated synthesis of material.

But I use them both, for different things. The general overview articles are much better at SEP than Wikipedia. But Wikipedia has a lot more narrow articles, on subjects that SEP doesn't cover at all, or mentions only in passing in one paragraph of an article. For example, a huge number of short- to-medium-length biographies of historically important philosophers (SEP instead has a small number of quite lengthy biographies).

I do wish something like SEP existed in more other fields. I don't know of anything like it for computer science, for example.

<comment><USER6> Sometimes I find Wikipedia's "haphazard" articles are actually a _benefit_ , because in practice they often seem to end up covering a subject from multiple angles, with lots of examples etc.

My impression is that in many cases this is because there were multiple major authors without a master plan for writing the article, so they ended up sort of putting it all in.

For someone (like me!) who's struggling to grasp a subject, seeing a subject described from multiple points of views, targeting varying levels of expertise, can be immensely helpful.

A traditional encyclopedia article, on the other hand, is probably more likely to be well-structured and comprehensive, but ... I think can be harder to grasp for someone that's not quite up to the material.

It may be kind of ugly, but the "Just throw it all in!" approach does have some real merit...

</comment></comment></comment></comment><comment><USER7> My thesis (physics) intersected with some elements of philosophy in the context of quantum physics, and I googled (using this verb as an alternative to "blundered") upon some SEP entries on the subject. They were emphatically _not_ up to date with what was cutting edge in my field, but what they were was tremendously well researched and in-depth reviews of the foundations. They clued me in to some sources that I never would have considered looking at otherwise, and those sources turned out to be some of the most fascinating reading material I came across in my research.

Sometimes it's really hard to figure out what you _need_ to read have a good basis in a new field. If the SEP has pages on it, they're a damned fine place to start.

</comment><comment><USER8> TL;DR: Crowdsourced content systems can have only 2 of the 3: Authorartive, Comprehensive, Upto date. Systems like Wikipedia and Stackoverflow miss either one or more of these characteristics. The article claims to have found the "solution" to this problem which is simply having experts for high level areas who invite experts for sub-areas to create the content.

I don't know why authors think this is different or novel or scale to something akin to Wikipedia or Stackoverflow. In a way, the article doesn't even look honest as it cherry picks examples on SEP that look great and examples on Wikipedia that look bad to justify its grand claims.

<comment><USER9> Exactly.

The article overall is biased towards authority of some elite "experts" over more democratic, collaborative, community-driven work.

Sketching SEP as the only hero that saves internet from being an information junk while calling rest of the internet as, "thrash leap" is just grandiose. The Internet is full of examples that show "quality" content _is_ possible. And why is the obsession over "quality" content? The internet is _not_ supposed to be only restricted to use of "information retrieval".

In the article, Wikipedians are called, "non-experts", while there are many experts in their field who also contribute to Wikipedia. Speaking of which, why not suggest those "elite" authoritative authors to contribute to Wikipedia?

It is also claimed that, "The internet should look more like the SEP." What? The internet is basically an extension to our capabilities of communication. And how we use it reflects our communication habits. Saying "the internet should be more like SEP" is like saying everyone should communicate informative encyclopedia entries to each other in their daily lives. Variety of other uses of internet, and thus communication, is ignored. The article fails to recognize the value of "piles of opinion, speculation, and misinformation", which eventually make up the "quality" content that it advocates. In fact, as human beings, we are _supposed_ to have all that "speculation", "opinion", and more importantly, "fun".

<comment><USER10> While I unhesitatingly concede that the article is biased in favour of expert editors, I think you slightly miss the point with the following remark:

> In the article, Wikipedians are called, "non-experts", while there are many > experts in their field who also contribute to Wikipedia. Speaking of which, > why not suggest those "elite" authoritative authors to contribute to > Wikipedia?

The problem is not that experts don't contribute to Wikipedia. The problem is that you usually don't know whether or not an expert wrote whatever you are currently reading. What makes SEP different to Wikipedia is that you know exactly who wrote the article (it even gives you the author's email address) and that you know for sure that that person _is_ an expert in his/her field. That is a guarantee that you simply do not have with Wikipedia and many other Internet knowledge resources. This is not to say that all information on Wikipedia is bad, it simply says that you can't have a guarantee.

This, of course, is not only Wikipedia's greatest flaw, it is also its greatest strength. The Wikipedia model sacrifices authoritativeness in favour of being up to date and comprehensive (in the sense of covering all subjects). And that is a valid trade-off for a site that wants to be a knowledge base for the whole world.

The SEP will never reach the size of Wikipedia, but then again, that is not its goal. Its aim is to be an authoritative source for academics in the field of philosophy. Within this well-defined field, it aims to be comprehensive and up to date. It caters to the needs of scholars, who need something (or rather somebody, a physical, known author) that they can actually cite in their own work. Wikipedia can never give that, and neither should it, for then it would no longer be Wikipedia.

Lastly: although I completely understand your criticism of the all- encompassing claim that "the Internet should look more like the SEP", I'm sure most people would agree that it wouldn't hurt to have a few more places around that you know you can trust for serious information. And incidentally, that is just what the author is arguing, if you hadn't taken his subheading out of context ;-)

</comment></comment></comment><comment><USER11> > Speaking of holes, the SEP has a rather detailed entry on the topic of > holes, and it rather nicely illustrates one of Wikipedia's key shortcomings. > Holes present a tricky philosophical problem, the SEP entry explains: A hole > is nothing, but we refer to it as if it were something......If you ask > Wikipedia for holes it gives you the young-adult novel Holes and the band > Hole.

This is plain dishonest. Wikipedia has dozens of pages on holes, some of which are cultural items and the author cherry-picked two in order to make his point: [https://en.wikipedia.org/wiki/Holes](https://en.wikipedia.org/wiki/Holes)

Moreover, the SEP's description of a hole is so arrogant and condescending it's painful:

> Naive, untutored descriptions of the world treat holes as objects of > reference, on a par with ordinary material objects....

Spare me.

<comment><USER12> Well, "naive" is a term of the trade. So "holes" are a potential problem for nominalists, philosophers who want to claim that only specific objects - <USER2> chair - exist. Calling a position that is not influenced by the last three thousand years of meta-physics 'naive' seems to be entirely justified, just as there are naive accounts of physics and computer science.

<comment><USER11> How exactly is _naive_ a term of the trade in philosophy? You, and the article in question, seem to be using it in a way that any grade-schooler would recognize.

I'm not aware of any "naive accounts" of physics or computer science. You might be thinking of "naive algorithms" and "naive approaches" but in those cases the word has a specific meaning which doesn't fit in the context of the above quote.

<comment><USER12> 'naive' means unsophisticated, so in a certain way it is compatible with the meaning a grade-schooler would recognize. However philosophy often is concerned with the meaning of words and so the naive understanding can define the boundaries of an acceptable theories.

<comment><USER11> After re-reading your comments and the intro to the holes article multiple times I'm only convinced that the SEP has a horrid writing style.

The world has moved on from this type of grandiose intellectualism for a reason.

</comment></comment></comment></comment></comment><comment><USER13> As I moderate an interfaith discussion group I was looking for a way to better use the Stanford Encyclopedia offline (printed or as searchable archive) like wikipedia has and found these tools:

* Create Offprint pages [https://github.com/jgm/sep-offprint](https://github.com/jgm/sep-offprint)

* Latent Semantic Indexing [https://github.com/skywalkermml/LSI_on_SEP/blob/master/proje...](https://github.com/skywalkermml/LSI_on_SEP/blob/master/project_link_and_instructions.pdf)

* Quest for making an ePub [http://www.mobileread.com/forums/showthread.php?t=183269](http://www.mobileread.com/forums/showthread.php?t=183269)

* RSS feed generator [https://github.com/21zhouyun/SEOP_RSS](https://github.com/21zhouyun/SEOP_RSS)

* Mobile apps There are an iOS and Android apps, but I'm not sure if they can be used offline

* Reddit SEP bot autolinking relevant articles [https://github.com/AFFogarty/SEP-Bot](https://github.com/AFFogarty/SEP-Bot)

===

Anybody know what happened to the branched Wikipedia projects that were started because of the editorial quality issue discussion almost 10 years ago like Citizendium? What others were there? How do they compare with the SEP and Wikipedia or Encyclopedia Brittanica or the IEP [http://www.iep.utm.edu/](http://www.iep.utm.edu/) on philosophical topics now?

</comment><comment><USER14> Something tells me that the S.E.P. does not draw a much higher proportion of female contributors than Wikipedia. For one thing, it wasn't mentioned in the article, and I have the feeling it would've been.

This is important because it tells us that the differences between S.E.P. and Wikipedia have only to do with subject matter and not procedure. Obviously trolls aren't interested in philosophy. But philosophy, much like Wikipedia, has a big problem with outreach to women.

Also, you know what's better than complaining about a lack of Wikipedia articles about female novelists? Writing one. You know what makes a better story than an empty complaint? The story about what you were about to reply what you thought was going to happen: the story about how your article was rejected by the editors. Of course you're just lazy and avoid effort by assuming it won't work. If you actually write such an article and see it deleted you'll have a leg to stand on and people will want to hear you (also, you can always preserve your hard work in your user-page).

<comment><USER15> You are making an argument from silence. "Of course you're just lazy and avoid effort by" expressing that feeling and not doing research. The list of authors for each topic is available at [http://plato.stanford.edu/contents.html](http://plato.stanford.edu/contents.html).

Looking at the "A" list, and using gendered assumptions about first names combined with a few bits of searching: Likely male: 98, Likely female: 16 Unknown: 1. That's ~14% female.

Quoting from [https://en.wikipedia.org/wiki/Gender_bias_on_Wikipedia](https://en.wikipedia.org/wiki/Gender_bias_on_Wikipedia), "between approximately 8.5 and 16 percent—of Wikipedia editors are women"

So overall, you are right in that it does not 'draw a much higher proportion of female contributors than Wikipedia.'

From [http://www.uh.edu/~cfreelan/SWIP/stats.html](http://www.uh.edu/~cfreelan/SWIP/stats.html) (or [http://lemmingsblog.blogspot.com/2007/04/apa-report- status-o...](http://lemmingsblog.blogspot.com/2007/04/apa-report-status-of- women-in.html) ) we see that "21% of employed philosophers are women". These numbers are for the US. A review of some of the authors shows many come from places other than the US, and some are retired, so this 21% isn't a perfect reflection of the available author pool.

It does suggest that women are underrepresented compared to the available author pool. To point out though, the relative under-representation is larger for Wikipedia. The Wikimedia Foundation is aiming for 25% female representation.

If S.E.P.'s percentage were 35%, would it be indicative of over-representation of women as editors? If Wikipedia's were 35%, would it be indicative of under- representation of women as editors?

<comment><USER16> Do we know what percentage of the employed female philosophers would ever be interested in writing for S.E.P., and what percentage of women in general would ever be interested in writing for Wikipedia? This is an important variable for judging whether under-representation is a real issue or not.

<comment><USER15> I don't see how that can meaningfully be determined.

[https://en.wikipedia.org/wiki/Gender_bias_on_Wikipedia#Poten...](https://en.wikipedia.org/wiki/Gender_bias_on_Wikipedia#Potential_remedies_for_gender_bias) has a long section about possible reasons for why females might not be participating, and ideas for how to improve the situation, with the explicit belief that higher levels of female participation will lead to a better Wikipedia.

Thus, is the "percentage of women in general [who] would ever be interested in writing for Wikipedia" using the current Wikipedia as the baseline, or some hypothetical best-of-all-possible Wikipedias?

In either case, how do we even go about determining that percentage?

At best this would be a latent variable which depends very much on the model you have. While important, it may be very hard to determine. (Eg, 'happiness' is an important variable, but unlike money, it's hard to measure accurately.)

My model in this case is that the editorial population will be similar to the reader population, but lagging by about 10-20 years.

</comment></comment></comment></comment><comment><USER17> Seems like a nice place to read and learn about Philosophy.

Reading it feels more like an old school physical Encyclopedia (e.g., no hyperlinks or people having discussions publicly about the editing process to confuse and concern you). Instead it has just what you need from the one person that knows everything about the thing you are reading about who is the only person with any business writing about it in the first place.

<comment><USER18> It's a fantastic place to learn about formal logics and type theories, too.

</comment></comment><comment><USER19> Scholarpedia is set up in a similar fashion. Each article has a recognized expert in its field assigned as a currator. It is certainly not comprehensive though.

[http://www.scholarpedia.org/article/Main_Page](http://www.scholarpedia.org/article/Main_Page)

</comment><comment><USER20> [https://news.ycombinator.com/item?id=10005709](https://news.ycombinator.com/item?id=10005709) is related.

</comment><comment><USER21> > Any errors reflect poorly on the contributors, and someone who spots a slip- > up can talk to a real person about it—neither of which is true with > Wikipedia.

Maybe I'm not understanding this statement properly, but Wikipedia has a history page and uses version control so all content can be blamed to someone. And there is also a talk page to bring up issues.

<comment><USER22> > so all content can be blamed to someone

Do you know how hard it is to track down who authored a particular word in an article? You literally have to click next, next, next over and over and manually scan the diff for your change.

A binary search sometimes works, but if there is an intermediate version that removed and re-added your search term you can fail at that if you get unlucky.

<comment><USER21> By binary search I'm assuming you mean via the "Revision history search" tool that can be found in the history page right? Yeah there are a bunch of cases where it doesn't work so well, especially if the change happened hundreds of revisions ago, but like you said you can always resort to looking at individual diffs.

Regardless, someone can be held accountable for the edits, it's just a matter of having to do more work because of the multi-contributor nature of Wikipedia. And in 90% of the cases, the offending statement is the last edit made; people and bots are usually really good at watching pages and recent changes for vandalism.

</comment></comment></comment><comment><USER23> It's interesting that philosophy, unlike most other disciplines, has been so good at this. It's not purely the Stanford Encyclopedia of Philosophy, either. There's another encyclopedia founded at the same time (both 1995), the Internet Encyclopedia of Philosophy [1], with a broadly similar mission and also quite a lot of good articles (though fewer than 1500). And there's an excellently organized, continually updated bibliography of philosophy papers, PhilPapers [2]. It's run like the original Yahoo, a big directory with manually curated topic areas. In computer science, we haven't managed to build resources like these.

[1] [http://www.iep.utm.edu/home/about/](http://www.iep.utm.edu/home/about/)

[2] [http://philpapers.org/](http://philpapers.org/)

<comment><USER10> As a cynic, I'd say they have nothing else to do ;-)

On a serious note: thumbs up! When are we going to get one in CS or Biology?

</comment></comment><comment><USER24> They could really use a bigger line height on their texts. It's hard to read with lines close to each other.

Did some tests with the browser dev tools and found that 1.8em instead of 1.4em for the body tag do wonders.

<comment><USER25> Academic journals, at least in philosophy, tend to have fairly small line heights. Drafts, on the other hand, are almost always double-spaced.

I wonder if this affects the editors' perception of what a good line height for authoritative documents might be.

</comment></comment><comment><USER26> > _It now contains nearly 1,500 entries, and changes are made daily._

I tried a few entries, it covers history well, but entries about modern philosophy are very biased.

<comment><USER27> modern or contemporary? Please explain the bias you find in the articles. Having majored in philosophy and used this site extensively I don't recall finding any bias.

<comment><USER28> SEP does seem to focus much more strongly on analytic philosophy than continental, although that's arguably a bias of the entire discipline.

Jean-Luc Nancy, Gianni Vattimo, and Luce Irigaray are all missing, for instance.

[https://en.wikipedia.org/wiki/Jean- Luc_Nancy](https://en.wikipedia.org/wiki/Jean-Luc_Nancy)

[https://en.wikipedia.org/wiki/Gianni_Vattimo](https://en.wikipedia.org/wiki/Gianni_Vattimo)

[https://en.wikipedia.org/wiki/Luce_Irigaray](https://en.wikipedia.org/wiki/Luce_Irigaray)

<comment><USER29> They also don't have Kripke, Putnam or Fodor. I dare say that going by relative prestige in their philosophical cultures, Kripke is a more startling omission than any of the three you mentioned ([http://leiterreports.typepad.com/blog/2015/01/most- important...](http://leiterreports.typepad.com/blog/2015/01/most-important- anglophone-philosophers-1945-2000-the-top-20.html)). That's not a point about merit, btw, just about who people would write about if personal articles showed favoritism.

I wonder if there's a tendency to not write articles on living philosophers (as opposed to some particular aspect of their work).

Still, I do suspect there is less work on 20th century Continental philosophy (so far as that's a well defined thing).

</comment></comment></comment></comment><comment><USER30> Does the SEP have any sort of bearing on the relative trashiness of the rest of the internet? Does any individual site have an imperative to influence the morality of sites it hyperlinks to? Is there some litmus test inbound links must pass before they can be included? And do digital content producers owe allegiance to this unwritten set of dicta invisbili? Or is their obligation solely to economic optimization and a greater global prosperity, where a rising tide lifts all boats?

Yes. It's true. I've been spending way too much time on SEP ;)

Although I for one would love to see a ClickHole-esque style parody of plato.stanford.edu. "Knobe lifts the veil executives behaving badly, and you won't believe what happens next!"

</comment><comment><USER31> The author seems convinced that the SEP is the best and everything else sucks. But the SEP has obvious flaws: articles updated at most once every four years, authors consist only of academics, everything is subject to a central editorial control.

<comment><USER32> Your first complaint ("updated at most once every four years") is fine, except that it's not that big of a deal for a 3000 year old field. As another comments stated, topics that are changing rapidly are updated more frequently.

But your second and third complains are about _process_ rather than _result_. What exactly do you think could be better about the SEP if they had non- academic authors? Or decentralized control? Not in a hypothetical world where the editors are evil, but in the real actual world?

I think the answer is "not much, and lots would be worse", because those properties are key to the SEP's success. This is different than Wikipedia, which has a much broader mission and would be crippled by these restrictions.

<comment><USER31> Good point---for philosophy, the slow updates aren't a huge issue. But the article seemed to be holding up the SEP as a model for other endeavors, and this seems to limit its usefulness in many other areas.

The centralized, academic nature of SEP is fine for them, but it must result in a sort of elite bias. In my mind, that's a kind of limitation. I actually prefer the Wikipedia approach or something along those lines, which I do feel is often effective at capturing various viewpoints.

Ultimately, there exists no one perfect approach to online encyclopedia compilation. Pros and cons all around.

</comment></comment></comment><comment><USER33> The Oxford Dictionary of National Biography ([https://en.wikipedia.org/wiki/Dictionary_of_National_Biograp...](https://en.wikipedia.org/wiki/Dictionary_of_National_Biography#Oxford_Dictionary_of_National_Biography)) follows a similar model to the SEP to deliver on the comprehensive/authoritative/up-to-date trifecta. Unfortunately it's paywalled, unlike SEP, but it's certainly the best biographical encyclopedia I know of because of this.

</comment><comment><USER34> I have what might be a "free startup idea". Go ahead, run with it.

If you pay a very modest sum (annoying payment system, not smooth as top of the line systems) to join "the friends of the SEP", you can become a human drone emulating Amazon's kindle system where you download PDFs by hand for you to maintain and view by hand on your ebook reader or whatever, and they email you if an article on your watchlist is later updated so you can pull your new updated copy (seriously, not a joke). It is a 1980s to 90s era manual labor workflow.

Someone/something should USEFULLY middleman and publish to amazon kindle for SEP. Handle aggregation of small articles into texts (the whole thing? or themes? or by letter?), handle the periodic download and release process, basically the content provider gives them a copyright release and in trade 90% or whatever of amazon revenue goes back to SEP. Can it be automated in bulk so it doesn't have to be done by hand? Probably. Are there sites other than SEP who could expand into this? Probably.

See thats how to find a startup idea. I looked at downloading pdfs from SEP, said to myself, "what a manual PITA that needs to be automated away", figured other people and places could benefit by a little automation...

This idea would never be a billion dollar unicorn, but the general concept of a "non-technologically obsolete middleman who actually provides real 2010s era value in the book publishing industry" isn't all that far fetched of an idea and would probably run a profit.

That could pivot later into "and this is how a REAL 2010s era book publisher works" perhaps including paper products, who knows. Or other forms of digital content. Not having the legacy would seem to be a benefit for a new publisher...

<comment><USER35> I could be completely wrong about the scope of this project, but that sounds more like something a Stanford computer science intern could bang out pretty quickly as a school project and less like an idea for a separate company.

</comment></comment><comment><USER36> Are there any differences between the models of Scholarpedia and SEP?

</comment><comment><USER37> need some more automatic daily titbits and in the line words

like a wikipedia board</comment>


Do you think it is fair to pay $10 to solve this problem?  - x-code https://bountify.co/N

<comment><AUTHOR> Sometimes it looks complicated, but if you already worked with something like that, it is an easy task, maybe just some lines.

People answers questions in StackOverflow for free, so sometimes $10 is a good reward. I don't know the answer to this bounty, so I will not use my time to learn omniauth and answer the question, it is not worth $10.

</comment><comment><USER2> Well, you're free to decide, aren't you?</comment>


Ask HN: Do you procrastinate on (important) phonecalls too? - <AUTHOR> Imagine you need to
- schedule an appointment at the dentist - call a customer to inform them about a delay - or even just call your mom
I often find myself to move it to "I'll just do it tomorrow" for a few days/weeks in a row.
Is it just me or do you know this too? <comment><USER2> I really don't like talking on the phone, especially to strangers, but even to my wife. I used to even hate ordering pizza and in college I would ask other people to call for me. I think it's a function of introversion. I can expend energy on people but my store is limited, so I save it for important face-to- face interactions with my wife and kids.

</comment><comment><USER3> Yes. I hate making phone calls. But I am okay with voice messages via Whatsapp.</comment>


The Founder's Journey: SaaS vs. Marketplace Revenue Models - <AUTHOR> https://rapidly.co/blog/founders-journey-saas-vs-marketplace-revenue-models/ <comment><USER2> There is no such thing as SaaS business/revenue model. SaaS is a software- based _product delivery model_. What the author of the linked post had in mind is _subscription business /revenue model_. Such confusion in terminology stems from the fact that the overwhelming majority of SaaS platforms use subscription business/revenue model. I thought that it is quite important to clarify this distinction.

<comment><USER3> >Rapidly has a distinct business model in which we have two streams of revenue: our SaaS subscription and our marketplace.

<comment><USER2> A single mention of the word "subscription" in the text versus a multitude of times mentioning "SaaS business model" and "SaaS revenue model" indicates that the post is, at the very least, seriously inconsistent from the terminology perspective.</comment></comment></comment>


How SendGrid Built Its Developer Evangelist Strategy to Reach Critical Mass - <AUTHOR> http://firstround.com/article/How-SendGrid-Built-a-Developer-Evangelist-Strategy-to-Reach-Critical-Mass

<comment><USER2> Wasn't it a SendGrid developer evangelist who got a programmer fired from his job because he had the bad luck to sit in the row behind her at a Python conference?

She overheard and misunderstood some dumb joke he made about "forking code", took his photo, used Twitter to "out" him for sexism and he got fired.

I don't know what their "evangelist strategy" is, but I always remember that incident when someone suggests SendGrid, it revealed a pretty nasty attitude towards developers, so, I deploy Mandrill instead.</comment>


FTC Cybersecurity oversight: Industry groups wary, are you? - <AUTHOR> http://www.csmonitor.com/World/Passcode/2015/0828/Why-industry-groups-are-wary-of-stronger-FTC-cybersecurity-oversight?cmpid=TLS

<comment><AUTHOR> New court ruling has some concerned of over regulation.</comment>


It's Nearly Impossible to Get Rid of Data on Amazon's Cloud - <AUTHOR> http://www.arstechnica.com/business/news/2012/03/moving-data-into-amazons-cloud-is-easygetting-it-out-not-so-much.ars

<comment><USER2> This is a terribly misleading headline (as is the article headline).

> the limits in moving data out of Amazon have much to do with the ability of > Azure and Rackspace to accept incoming data.</comment>


Third-Party Audit of Rustls - <AUTHOR> http://jbp.io/2020/06/14/rustls-audit.html <comment><AUTHOR> Some quotes from the report's conclusions:

"the team of auditors considered the general code quality really good and can attest to a solid impression left consistently by all scope items."

"was consistently well-documented and readable, demonstrating that security processes are ingrained in the development and documentation processes"

"Both from a design point of view as from an implementation perspective the entire scope can be considered of exceptionally high standard (...) no directly exploitable weaknesses could be identified."

"It appears to have been developed with all previously known issue-types in mind; furthermore, its missing support for insecure or outdated protocols and primitives indicates a security-conscious development approach."

"the developers of rustls have an extensive knowledge on how to correctly implement the TLS stack whilst avoiding the common pitfalls that surround the TLS ecosystem. This knowledge has translated reliably into an implementation of exceptional quality."

"The developer's intent to provide a high-quality TLS implementation is very clear and this goal can be considered as achieved successfully. (...) Cure53 had the rare pleasure of being incredibly impressed with the presented software."

</comment><comment><USER2> I especially liked the: "We couldn't reason about this. So we rewrote it."

Thankyouthankyouthankyouthankyou.

I have this discussion _all the time_ and I can't get people to see the issue.

<comment><USER3> > There are two ways of constructing a software design: One way is to make it > so simple that there are _obviously_ no deficiencies, and the other way is > to make it so complicated that there are no _obvious_ deficiencies. The > first method is far more difficult.

-Tony Hoare, from his Turing Award lecture

</comment></comment><comment><USER4> > TLS-01-004 - Data Truncation in DER Encoding Implementation (low). This > finding rightly points out a function in rustls that produces incorrect > output when applied to an X.501 Name that is larger than 64KB. While that's > an exceedingly unlikely case, and the bug does not cause unsafe operation > (but perhaps connection failure), the function has been corrected to produce > valid output for all inputs.

The ISO 7816 smartcard standard uses this same ASN.1-based scheme for command and reply encoding. I found a memmove overflow and a separate off-by-one bug in Yubico's PC/SC library, and an off-by-one bug in the Yubikey 4 firmware, all related to their handling of this encoding.

It's possible that the Yubikey 4 bug could have been leveraged into an information leak, a buffer overflow, or some other exploit of the firmware.[1] The firmware was calculating a command reply length based on what the proper, compact length of the object should be, not the _actual_ length of the stored object with malformed internal encoding, leading to corrupt reply chains. But I never explored it. I'm not an exploit developer, and didn't have time to go down that rabbit hole. I only discovered the bugs tracking down a bug in my own PC/SC library. It turned out I was generating an overlong encoding ({0x82 0x00 0xff} instead of {0x81 0xff}) for an object, tickling the Yubikey 4 issue. Yubico quickly fixed their library, but the engineer resolving the ticket downplayed the firmware issue, which seemed far more concerning as it suggested bug-prone buffer management techniques in the firmware.[2] (Indeed, it suggested that the firmware reused the buggy library code.) I haven't gone back to see what happened with the firmware since then.

Anyhow, paying attention to small encoding and decoding issues like these are important--the details always matter. "This couldn't possibly lead to an exploit" are famous last words.

[1] Hopefully not a leak of the key itself as I presume it was inaccessible to the firmware, but who knows--it's a black box.

[2] IIRC, their argument was garbage in, garbage out (GIGO), which is a dangerous misapplication of that principle. A malformed object should never result in malformed, corrupt responses by other layers of the protocol stack. In fact, the GIGO principle usually implies the opposite--that the behavior of other layers of the stack is invariant to bad data, not conditioned by it.

EDIT: Looking at my Git logs it seems my code was never buggy. My library couldn't read back some certificates generated by another, third, project and written to the card using the Yubico SDK. That third project was generating the over long encoding, and in the process of tracking down the root of the issue I stumbled upon the Yubico bugs. IIRC, that third project was never reading back the certificate as they had a very convoluted scheme for 2FA and client-side SSH X.509 certificates that relied heavily on the bespoke behavior of their client-side Go daemon.

</comment><comment><USER5> This is really exciting! Many popular Rust libraries support switching between rustls and openssl for their TLS needs and it's much easier to do cross- platform builds with rustls.

</comment><comment><USER6> > After spending thirty days on the scope in late May and early June of 2020, > the team of auditors considered the general code quality really good and can > attest to a solid impression left consistently by all scope items. > Naturally, this is partially thanks to the usage of Rust as the preferred > language for the entire implementation of the rustls project.

</comment><comment><USER7> The finding in TLS-01-003 is surprising to me, mostly because it presupposes a lack of sophistication among users of this library who are also using X.509 NameConstraints. From RFC5280:

      For example, a name constraint for "class C" subnet 192.0.2.0 is represented as the octets C0 00 02 00 FF FF FF 00, representing the CIDR notation 192.0.2.0/24 (mask 255.255.255.0).

As they mention in the findings:

      Typically, subnet masks should be contiguous and the presence of a non-contiguous mask might indicate a typo (such as 220.127.116.11 vs. 255.255.255.0), or potentially an attempt to bypass an access control scheme. Therefore, it is recommended to treat certificates containing non-contiguous subnet masks in their name constraints as invalid.

This seems to run counter to the intent in the RFC. By allowing for a four- octet subnet mask, instead of simply an int to represent the a contiguous CIDR mask, the RFC authors may have intended that more complex IP-based NameConstraints could be constructed. This certainly would make a huge difference for something like an intermediate (CA:TRUE), where it becomes much more economical to specify a sparse mask for a highly templated network. Think certs for network equipment or VoIP phones with regular, repeatable IP addressing across many locations/networks. E.g., a VoIP provisioning system that has an intermediate issuing CA with the following NameConstraints: IP:172.16.0.0/255.255.1.239.

If any change comes from this specific finding, I would hope that it's simply a flag to allow or disallow the use of discontiguous masks. I do understand that this is specific to WebPKI; having said that, if a client is implemented using rustls (with these recommendations enabled) and it happens across a perfectly valid certificate issued by an intermediate with a discontiguous mask in the NameConstraints, presumably it would fail or otherwise break. And yes, I have previously configured precisely this in an intermediate CA.

<comment><USER8> Leaving aside the question of whether other software will work reliably with non-contiguous subnet masks (which led to this recommendation), in general, most software does _not_ deal well with NameConstraints. Some libraries ignore it, some libraries fail hard if a constraint exists, and in general, I'd expect a certificate chain involving NameConstraints to be poorly supported at best and insecure at worst.

I _wish_ that NameConstraints were better supported, to make it easier to support intermediate CAs; for instance, prove you own example.com and you could then have a CA restricted to *.example.com. But right now, that just doesn't seem feasible.

<comment><USER9> I spent significant effort writing the name constraint implementation in mozilla::pkix (used by Firefox) and by webpki (used by Rustls) to fix this situation. The result is summarized by Netflix:

> The result was that every browser (except for Firefox, which showed a 100% > pass rate) and every HTTPS client (such as Java, Node.JS, and Python) > allowed some sort of Name Constraint bypass.

\- [https://netflixtechblog.com/bettertls-c9915cd255c0](https://netflixtechblog.com/bettertls-c9915cd255c0)

Since then, Google Chrome has implemented and deployed a new certificate processing library on some (most?) platforms it supports, and I bet they have similar or better name constraint support. I believe Apple has also improved their implementation.

> I wish that NameConstraints were better supported, to make it easier to > support intermediate CAs; for instance, prove you own example.com and you > could then have a CA restricted to *.example.com. But right now, that just > doesn't seem feasible.

Since the aforementioned improvements have shipped in production browsers, it is much more practical, from a technical standpoint, to do that. The real problem now is browsers' CA policies. As I understand it, they do not want you to be able to get your own name-constrained intermediate CA certificate. The CA that issues you the intermediate CA certificate would be on the hook, with the consequence of being removed from the root CA programs, if you issued a malformed certificate. And there are other issues with the policy. I hope there are improvements to the browsers' CA policies to make this practical, but I wouldn't hold my breath.

<comment><USER8> Thank you for working on this!

> Since the aforementioned improvements have shipped in production browsers, > it is much more practical, from a technical standpoint, to do that.

What about non-browser HTTPS/TLS libraries? Even if browsers support it perfectly, this doesn't seem like something CAs should start deploying if widely used libraries have problems with it. And based on the test results from BetterTLS, it looks like widely used libraries still have problems with it.

Also, the BetterTLS article gives an example of a NameConstraints for "192.168.0.0/16"; I don't think that's something a public CA could reasonably issue, for a variety of reasons (conflicts with routers, IoT devices, and many other things). We need some reasonable solution for "local network" devices, and in particular for devices where a user may be able to get hold of the private key, but in the meantime I don't think publicly valid IP-address certificates make sense.

> The CA that issues you the intermediate CA certificate would be on the hook, > with the consequence of being removed from the root CA programs, if you > issued a malformed certificate.

Given that today, such an intermediate CA could be used for arbitrary MITM, that's entirely understandable. If there are additional constraints that an intermediate certificate needs to have, we need to have enforcement mechanisms to support such policies, so that an intermediate CA _can 't_ create certificates that may lead to MITM or similar attacks.

\- Root CA policies for proving access to (star).yoursite.example such that you can get an intermediate CA.

\- Root CA policies for the valid duration of intermediate CA certificates (no longer than X, no longer than the proven ownership of your domain...). This already constraints the valid duration of certificates underneath the intermediate CA.

\- Policies for requiring Certificate Transparency (e.g. any such intermediate certificate still has to use CT logs, such that individual certificates must appear in the CT logs to be considered valid). This _could_ be done by policy in browsers, such that any CA opting into issuing intermediate CA certificates must use CT for _everything_ ; that's where we're going for all CAs anyway.

\- Do we have mechanisms to ensure that an intermediate CA can't issue another intermediate CA certificate?

\- Policies for wildcards underneath intermediate CAs. If you have an intermediate CA for (star).yoursite.example, under what circumstances can you issue a wildcard certificate underneath it, and for what domains?

\- Under what circumstances should you be able to get an intermediate certificate for something like (star).yoursite.internal? Should you, or should all names chain up to a domain you prove ownership of (e.g. (star).internal.yoursite.example)? There's potential value in internal-only domain names, and this would reduce the scope of attacks (preventing the intermediate CA from issuing certificates for your public site), but ownership issues might become tricky.

\- Related: Today, if you want to MITM example.com, you need to get a root CA to sign your certificate. If example.com obtains an intermediate CA, it's potentially easier for an adversary to somehow obtain a certificate for example.com or www.example.com signed by that intermediary, depending on example.com's infrastructure. (It's also potentially easier for an adversarial jurisdiction to force example.com to surreptitiously mint a certificate; CT would help there, but this still seems like substantially more attack surface.) Is there some way we can make that less likely and more difficult as an exploit vector?

\- Policies for the duration of certificates underneath intermediate CAs.

\- Policies for handling revocation of certificates underneath intermediate CAs.

\- Policies for the use of dedicated HSMs for intermediate CAs. Should we make that a policy requirement?

\- Eventually, when NameConstraints becomes not only usable but best-practice for intranets, browsers and libraries could start defaulting to only loading certificates from the system certificate store iff they have NameConstraints that meet some appropriate policy.

</comment></comment></comment></comment><comment><USER10> "There were two informational and two minor-severity findings."

They found a few small issues but nothing horrible

</comment><comment><USER11> I wonder, with deprecation of TLS 1.0 and 1.1 support being planned, whether Firefox can adopt rustls in favor of NSS.

<comment><USER12> It's probably still missing a lot features NSS supports and Firefox needs for backward compatibility and enterprise use-cases. As far as I know NSS does slightly more then "just" TLS.

Also rustls not supporting certain legacy/less secure settings can be a problem. Generally its a good idea, but sometimes you have to things like the "communicate with embedded hardware which can only do that probably backdoored eleptic curve in hardware and is too slow to do other curves in software" situation..

Through for a very high amount of use-cases this doesn't matter and rustls feature set has everything you need.</comment></comment>


The ReactOS team wants your money - <AUTHOR> http://www.neowin.net/news/the-reactos-team-wants-your-money

<comment><USER2> In my opinion the best way to contribute to ReactOS is by buying a copy of Crossover Office or Crossover Games. Besides actually getting something immediately useful, you're directly contributing to the development of WINE. ReactOS uses WINE for most of its non-kernel code.

<comment><USER3> The funding is to pay for full-time ReactOS development. Wine might be involved to a degree, but surely putting money directly into ReactOS is the best option.

</comment></comment><comment><USER4> Serious question: If Oracle wins their lawsuit and the court rules that APIs are indeed patentable, what prevents the ReactOS team from being sued into oblivion by Microsoft?

<comment><USER5> Or for that matter, WINE?</comment></comment>


The 3 Categories of SD-WAN Revealed – Learn How to Choose - <AUTHOR> http://www.bigleaf.net/the-3-categories-of-sd-wan-revealed-learn-how-to-choose <comment><AUTHOR> Bigleaf founder and CEO here, glad to answer questions.</comment>


Scheme hits the App Store - <AUTHOR> http://www.ventonegro.org/2009/10/scheme-hits-the-app-store/ <comment><USER3> MIRROR (site appears to be down):

I believe I have got the first Scheme application past Apple review into the iTunes App Store. It is yet another Reversi clone, called Reverso. It is a combination of 90% Scheme and 10% Objective-C, written with Gambit-C Scheme. James Long has already shown how to compile Gambit-C for the iPhone, and I started from there. My Scheme code is compiled to C by Gambit and later by GCC to produce native ARM code, bundled in a static library, which is ok with the iPhone SDK license agreement. The Objective-C then calls the library as a pure C library. The Scheme code deals with position evaluation, alpha-beta pruning, transposition tables, move legality, different strategies and so on. The Objective-C code deals with sound, animations, GUI, user preferences, basically everything that calls the iPhone OS API. Reversi was chosen because I like strategy games and it is much more algorithmic than artistic, and I am no artist.

The performance of the code is excellent. I used some Gambit-specific declarations, only fixnum arithmetic, pre-allocated a large heap, and called the garbage-collector every time the user needed to think. The search is not memory intensive, but the transposition tables are. I did not write a specific hash function but relied on Gambit-C's table type. The boards used during search were retrieved from a pool (the newest Gambit-C has made subu8vector- move! a public API), so they did not put pressure on the garbage-collector. In the end it was a very successful experiment. Developing with Scheme is orders of magnitude more productive than with most other languages. Gambit-C is also one of the best Scheme compilers out there, and made my job a lot easier.

<comment><USER3> LINKS:

Reverso: [http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftwa...](http://itunes.apple.com/WebObjects/MZStore.woa/wa/viewSoftware?id=334979538&mt=8)

Gambit Scheme: [http://dynamo.iro.umontreal.ca/~gambit/wiki/index.php/Main_P...](http://dynamo.iro.umontreal.ca/~gambit/wiki/index.php/Main_Page)

James Longster - Scheme on the iPhone: [http://jlongster.com/blog/2009/06/17/write-apps-iphone- schem...](http://jlongster.com/blog/2009/06/17/write-apps-iphone-scheme/)

<comment><USER4> Correction: That should read 'James Long' instead of 'James Longster'.

</comment></comment></comment><comment><USER5> I have no idea why everyone wants to get around objective-c, it's really not complicated to learn.

<comment><USER6> Because dictionaries, object-arrays, strings and other fundamentals are way more verbose than they should be:

someDictionary["bla"][3] vs. [[someDictionary objectForKey:@"bla"] objectAtIndex:3];

someDictionary["bla"] = 5 vs.[someDictionary setObject:[NSNumber numberWithInt:5] forKey:@"bla"];

"%@ - %@" % (date, name) vs. [NSString stringWithFormatString:@"%@ - %@",date,name];

Smalltalk is a lot better than objective-c even, because you can define binary & unary operators with singular symbols to make a far more concise syntax. You think you have done alot of work sometimes in objective-c when you find out that you were just extracting some values out of variables and putting it into this or that dictionary or array.

</comment></comment><comment><USER7> Good news to hear. Objective-C is alright as a language, but I'm excited to hear about some of my favorite languages running on the platform, like this Scheme and Smalltalk (<http://isqueak.org/>). I suppose I have no excuse to NOT make an app in my spare time anymore...

</comment><comment><USER8> how is Gambit compared to Chicken?

<comment><USER4> In what respect?

Benchmarks by Marc Feeley of Gambit: <http://www.iro.umontreal.ca/~gambit/bench.html>

<comment><USER8> In general. Who has the best performance? Who has the best ffi support? The most and best library support? Does anyone have a success story (case study)? Does anyone offer a painfree setup? Chicken is BSD, while Gambit i GPL - <USER2> chicken maybe preferred for its less restrictive lisence?

<comment><USER9> Personally, I think chicken is the least interesting of the 3 (bigloo, gambit and chicken) scheme->c compilers.

Bigloo has the best FFI, hands down, it's simple, it offers mapping, and doesn't require you write chunks of C for each definition. It's also slightly easier to call from, and embed in, C, in my experiments.

Bigloo has better potential performance, due to the strict typing abilities.

Gambit has the best performance, this is probably debatable though, at least according to the benchmarks I've seen.

Gambit also has the best portability, bigloo and chicken only 'mostly' work on win32 - bigloo's socket support has some annoying bugs on win32, for example, and I've had problems with chicken even compiling properly on win32, often failing to find compilers, etc.

Whether Chicken or Bigloo has the best built-in module system is debatable, personally I'd prefer bigloo's over the two. Gambit's lack of a built-in module system is offset by 'black hole' which is progressing nicely, and is possibly better than both bigloo's and chicken's, in the long term.

License wise, Gambit is dual (LGPL and Apache), Chicken is BSD and Bigloo is LGPL. All are pretty much equal, really, from an end-user's point of view and none of them should impart any restrictions on any programs you create with them, as far as I can tell.

Edit: I knew I forgot something, I didn't mention the '4th' option - JazzScheme. Which is really just a version of Gambit with an integrated IDE, a module system similar to bigloo's, and a bunch of pre-built library mappings (Gtk, OpenGL, and a bunch more, iirc). It has potential, but for me, I don't like to have to use a provided IDE, I prefer emacs, and the 'command line' version of jazz isn't really finished yet.

<comment><USER8> when I play around with Gambit (gsi) I often end up with bus errors. This implies the word: 'half-assed' to me. So that is directly annoying and will guaranteed put new users off. Crashing is never good.

<comment><USER4> That's extremely surprising. I'm sure the maintainers would be eager to hear about your experiences. Care to provide example code which triggers a crash with a little detail about version and platform?

The best place to post would be the mailing list [1] or the bug tracker [2].

[1] [https://webmail.iro.umontreal.ca/mailman/listinfo/gambit- lis...](https://webmail.iro.umontreal.ca/mailman/listinfo/gambit-list)

[2] <http://www.iro.umontreal.ca/~gambit/bugzilla/>

<comment><USER8> 3> (define x (lambda (y) (* 2 y))) __* WARNING -- defining global variable: x 3 > x Bus error

Gambit v4.5.2 OSX 10.5

Of course, I do know that x should not be evaluated. For that have to type (x 3). But its still annoying, and very unnecessary. In DrScheme/PLT I get a: > x #<procedure:x> Explicitly telling me its a procedure.

<comment><USER4> I've reproduced your crash. The issue is that you're using define within a nested REPL, which isn't supported [1].

However, a segfault is really not acceptable. I'll file a report for this.

[1] [http://www.iro.umontreal.ca/~gambit/doc/gambit-c.html#Debugg...](http://www.iro.umontreal.ca/~gambit/doc/gambit-c.html#Debugging)

Relevant section: "Note that some special forms (define in particular) can only be evaluated in the global interaction environment."

<comment><USER9> I'm fairly sure that the nested repl 'define' being allowed at all is a fairly recent change, I seem to recall just getting an error when trying to define in a nested repl in 4.4.x.

<comment><USER4> Right, it looks like a regression in 4.5.*. 4.4.4 is fine.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER4> Most important software launch of the week.</comment>


Pi is Wrong - <AUTHOR> http://www.math.utah.edu/%7Epalais/pi.pdf <comment><USER2> When I read this article a while back the part that impressed me was how in intuitive radians become:

      2/3 * NewPi = (2/3's around the circle in radians).

It is a much more intuitive way to think about angles. Ask a third grader, how much cherry pie is missing. "About a two-thirds" they will say. They don't mention PI, and right now no one does. This is the way people think about angles naturally. NewPi makes this more intuitive by allowing you describe angle as a number between 0 and 1 (which is usually the way to go, see splines, animation, etc). 0.25NewPi just makes sense. It is a fourth of a circle, and this way of thinking would help kids understand radians instantly.

Probably the only drawback is when doing wicked tricks on a snowboarding game such as SSX. Doing a 1080 just sounds cooler then a 3, but which is more intuitive?=)

<comment><USER3> You can do this with regular pi; you only need to use diameter-ans instead of radians. You can do it without a pi at all; there's an actual (used) unit called the "cycle". 1 Hertz is defined as 1 cycle/second.

The only problem with these units is that, like with degrees, d/dx sin(x) != cos(x). It messes with calculus.

<comment><USER4> Not true. Calculus would be the same (a radian is a radian). sin(pi + x) != cos(x) in the new system, though.

<comment><USER5> Chain rule: Let x be angle in radians, y be angle in diameter-ians (2pi) x = 2y d/dx sin(x) = cos(x)

d/dy sin(y) = d/dx sin(2 _x)_ d/dx (2x) = 2 cos(2x) = 2 cos(y)

It's the same reason why you use radians for angles in calculus: degrees mess it up.

[http://en.wikipedia.org/wiki/Trigonometric_functions#The_sig...](http://en.wikipedia.org/wiki/Trigonometric_functions#The_significance_of_radians)

<comment><USER6> What? sin(x) is still sin(x). Just because we have a different value for pi doesn't mean we have a different sin function. sin(6.28...) = sin(6.28...), etc., etc.

Crucially, we still have exp(x + iy) = exp(x) * (cos(y) + i sin(y)), because we haven't changed the definitions of any of these functions. If we did change the definitions of sin and cos, that'd really be a bummer, you're right.

We still measure angles in radians. No diameter-ians in sight. Our old x or new y (notice, those have the same value) is just a different fraction of newpi than it is of oldpi, is all.

It amazes me that amalcon's being voted up and aston is being voted down. People clearly aren't thinking it through for themselves.

<comment><USER3> _Just because we have a different value for pi doesn't mean we have a different sin function._

Which is exactly what I just got done saying that I'm not saying. Reading comprehension, much?

To be entirely clear: All I was saying is that the reason we use radians in the first place (instead of, say, cycles) is that it fixes calculus. It has little to do with 2pi. It only relates to the comment it was said in reply to.

<comment><USER6> > _Reading comprehension, much?_

Yes, I've re-read your original post 4 times, and your intended meaning is quite confusing, because you're talking about a different way of changing our notation than the link is, but without clearly stating that, and your notation change, which you criticize, is something of a non-sequitur in context of the parent comment and the article, as far as I can tell.

Thus, you seemed to be implying† that the new definition of pi results in messing up calculus. To clear things up: "We could measure angles in any arbitrary units we want, but using radians makes calculus work, and if we're using radians, the circumference is 2 pi of them, which is why pi as a unit is not ideal, and newpi = 2*pi would be better. If we wanted we could have an angle of pi 'diametrans' in a complete circle instead, using our existing definition of pi ~ 3.14, but that would be stupid, because it would break all kinds of symmetries in calculus."

†: This is apparently a misinterpretation though (mine and also aston's, who wrote "a radian is a radian"), and you don't actually mean to be implying that.

<comment><USER3> Fair enough, I suppose.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> The pdf claims that for simplicity sake, the constant pi should have been a factor of two larger.

Reminds me of electrical engineering "mistakes" such as the convention establishing electrons as negatively charged; or the ohm being very small/amp being very large compared to everyday usage.

<comment><USER8> Whole amps and handfuls of ohms aren't _that_ rare, they actually match pretty well to what comes out of the wall socket. And that 1.8v or 0.85v or whatever it is these days space heater that runs your computer takes really quite a lot of amps.

<comment><USER9> On the other hand, Farads or Teslas...

<comment><USER3> Coulombs are my favorite, because it's the fundamental amount of "something" (as opposed to "something per time") that most of these can be traced back to:

Ampere = Coulomb/second

Farad = Coulomb/volt

</comment></comment></comment></comment><comment><USER10> Well, next monday we can celebrate 6/28 as 2pi day or proper pi day... Just in time article.

<comment><USER11> So you're going to celebrate refactoring a mathematical constant to give a neater presentation on a day chosen based an apparently illogical ordering scheme for dates.

That has to class as irony.

Out of curiosity: Does anyone here genuinely believe that Pi should be the circumference÷radius and hold that dates should be written Month/Day/Year ?

I've heard one reasonable defence of American date ordering based on actual priority of information (roughly: "you want the month first to broadly narrow down the locus but the year will be assumed"). But I still go with English or just [truncated] ISO dates.

<comment><USER12> I use UNIX time. So there.

<comment><USER11> I suggest you wait until Wed 8 Feb 2169 01:15:07 GMT+0000 (BST) to celebrate

</comment></comment></comment></comment><comment><USER13> the idea may seem trite, but the pedagogical motivation for making certain symmetries more apparent in mathematics is sound.

on an unrelated note, when will the scribd links switch to html5?

<comment><USER14> I think any pdf link says scribd, even if it's not. Not sure why.

<comment><USER15> The [scribd] isn't a comment, it's a separate link -- you can click on it to view a broken version of the original document.

carterschonwald is commenting that the Scribd link uses Flash, rather than the recently released HTML5 Scribd implementation.

<comment><USER14> Jebus, I never noticed that. Thanks!

</comment></comment></comment></comment><comment><USER16> Same thing happened with the gamma function. MathOverflow:

[http://mathoverflow.net/questions/20960/why-is-the-gamma- fun...](http://mathoverflow.net/questions/20960/why-is-the-gamma-function- shifted-from-the-factorial-by-1)

</comment><comment><USER17> Unfortunately the article is down at the moment, but there's a beautiful identity that suggests that maybe pi/4 is a constant of nature, not pi:

pi/4 = 1 - 1/3 + 1/5 - 1/7 + 1/9 - 1/11 ...

That's arguing from pure mathematics. Judging from the comments, I think the article argues (from kind of an engineering point of view) that 2pi would be more convenient.

<comment><USER18> e^(pi*j)=1

<comment><USER17> It's -1 actually, and I might just as well write:

e^(i pi/2) = i

e^(i pi/4) = sqrt(i)

both of which are arguably even more expressive.

</comment></comment></comment><comment><USER19> Old news. This ranks up there with the fact that it was a bad idea to use base 10 instead of base 12. Absolutely and utterly true, but completely not worth the switching costs.

<comment><USER20> Can you provide a reference for this? I'd like to know the reasoning.

<comment><USER21> A slight tangent, but I recently ran across a fascinating theory on the origin of base-12 systems. If you use your thumb as a marker, you can touch four finger joints on each hand for a total of 12 positions. I tried it and it's a surprisingly natural way of keeping count. Here's the source paper:

[http://www-groups.dcs.st-and.ac.uk/~history/HistTopics/Babyl...](http://www- groups.dcs.st-and.ac.uk/~history/HistTopics/Babylonian_numerals.html)

<comment><USER22> If you use the tip of each finger as well, you can count in hex to 0xff with two hands ;)

<comment><USER23> You can count to 1023 in binary using both hands.

</comment></comment></comment></comment></comment><comment><USER24> Very interesting article.

On a related not, check out the book "Negative Math": [http://www.amazon.com/Negative-Math-Mathematical-Rules- Posit...](http://www.amazon.com/Negative-Math-Mathematical-Rules- Positively/dp/0691123098/ref=sr_1_1?ie=UTF8&s=books&qid=1277192051&sr=8-1)

This book builds up a mathematics in which multiplying two negative numbers gives you a negative, not a positive. The results are very interesting, particularly this: _There are no complex numbers_. The root of -1 is -1.

This is another example of something you never think to question, you always assume is "just the natural way", but which was a somewhat arbitrary choice and can be changed.

<comment><USER25> It's also inconsistent if you assume that multiplication is distributive over addition:

(-1 + 1) * -1 = -1 * -1 + 1 * -1 = -1 + -1 = -2

or

(-1 + 1) * -1 = 0 * -1 = 0.

<comment><USER24> Your'e right, but you don't have to assume that multiplication is distributive over addition. You can build math without that assumption. It gets weird, but it's very interesting to see that so many things we take for granted about mathematics are really just conventions.

<comment><USER25> Very true, but I like my numbers to behave like... well, numbers. You can define consistent algebras but I'd argue with you if you tried to call them numbers.

</comment></comment></comment></comment><comment><USER26> I seriously have always suspected this. If you're going to use a value to represent the perfection of a circle, why not take the derivatives of its properties (area, then perimeter, and once more) until you get a constant? 2pi is that constant.

</comment><comment><USER27> One of my math professors pointed out that to be consistent, "π, φ, χ, ψ, ξ, and ι" should actually be pronounced "pee, fee, khee, psee, ksee and ee-ota," which I found kind of funny and fascinating. Of course, common convention beats out pedantic propriety and rightly so, I think. This sort of thought- provocation is quite valuable nonetheless, if for no other reason than to keep us aware of that about which we do not readily think.

<comment><USER28> That's exactly how we pronounce them in Bulgaria (neighbor of Greece).

</comment></comment><comment><USER29> When I saw the host and title I was concerned it may have been a rehashing of this urban legend - <http://www.snopes.com/religion/pi.asp>

Relieved to see it was actually this article, which I've actually referenced a number of times in discussions with engineers to make myself sound like I know more than I actually do!

</comment><comment><USER30> Posted to mathoverflow: [http://mathoverflow.net/questions/29070/is-defining- a-consta...](http://mathoverflow.net/questions/29070/is-defining-a- constant-2pi-more-elegant)

<comment><USER31> I find your downvotes and the rejective spirit over there puzzling. (Perhaps it's just to overflow ;)

</comment></comment><comment><USER32> What about the fact that sin and cosine have such elegant Taylor series expansions if you use radians?

In radians, sin = x - x^3/3! + x^5/5! - x^7/7!...

In 'Double radians', we have a 2^n factor in front of each term.

<comment><USER33> No they wouldn't. This article is not talking about redefining what 1 radian means.

</comment></comment><comment><USER34> Even worse, in physics h-bar = h / (2 * pi).</comment>


Tips for stable and portable software - <AUTHOR> https://begriffs.com/posts/2020-08-31-portable-stable-software.html?hn=3 <comment><USER2> I've currently involved with a system, written in C, which has been going for 30 years: GAP - [https://www.gap-system.org](https://www.gap-system.org)

While I write a lot of C, I immediately disagree with the idea that C has a "simple (yet expressive) abstract machine model". Every so often we find a bug which has been present for over a decade, because some new compiler has added a (perfectly legal by the standard) optimisation which breaks some old code.

Picking one example: in the "old days", it was very common (and important for efficiency) to freely cast memory between char, int, double, etc. For many years this was fine, then all compilers started keeping better track of aliasing and lots of old code broke.

Also, while POSIX is a nice base, it stops you using Windows, and also almost every non-trivial program ends up with a bunch of autoconf (which has to be updated every so often) to handle differences between linux/BSD/Mac.

Also, definatly don't distribute code where you use flags like '-pedantic', as it can lead to your code breaking on future compilers which tighten up the rules.

<comment><USER3> -pedantic only enables warnings, it cannot change the meaning of code; not even on newer compilers.

<comment><USER2> You are right, I mis-remembered what the flag did, sorry.

I've seen projects with -pedantics -Werror, which are particularly annoying (-Werror in general to be honest, I understand why people might want it for CI of course).

<comment><USER4> I like using -Wall -Wextra -Werror for code under my control, but I would disable that flag if distributed as a library to others.

</comment></comment></comment></comment><comment><USER5> This article certainly rings a bell, as I started rewriting my personal projects to C in the last year, precisely because I wanted to make them decades-proof. I still use the same vimscripts I wrote in early 2000', I want the same thing for all my tooling and apps.

I'm not sure it makes sense professionally, though, as most codebase won't survive a decade : after three years, the dev team will turn over, and the new team will want to rewrite everything from scratch. Or start rewriting parts of the exisiting system in a new language, until it ultimately eat it up. It may be related to the kind of companies I work with, though (very early stage startups).

Regarding interfaces, I think the author could have gone a step further. There is actually a standard and portable interface system: html/js/css. If you write a dependency free web app using things like webcomponents and other standard techs, you know it will stand time, and it actually matches all the reason why the author want to use C : standard and multiple implementations.

<comment><USER6> It's highly dependent on the domain.

If you're in a web startup, software won't last 3 years, the next team will systematically rewrite.

If you're in the bank, logistics, defense sector, it's very likely the software will go for a decade, as long as it's not killed the first or second year for being a pet project (initial manager left) and having no customer.

<comment><USER7> > If you're in a web startup, software won't last 3 years, the next team will > systematically rewrite.

I have an old man rant about that actually... that rewrite is typically unnecessary if you actually use discipline when developing and learn how to read code.

I once took on a CakePHP 2 app and another developer asked me how in the world I got into, and understood, the framework so quickly. My secret? I read the CakePHP 2 source code. So many developers learn how to do that very well.

<comment><USER8> > that rewrite is typically unnecessary if you actually use discipline when > developing and learn how to read code

"But developers that can exercise discipline and know how to read (and modify) code instead of rewriting cost so much money..." is what you'll typically hear in response to this.

It's cheaper (and often faster) to have cheaper, less disciplined, less experienced developers rewrite something multiple times than it is to have more expensive, more disciplined, more experienced developers write something and maintain it. It's also harder to keep the more experience developers because most developers I work with start looking for another job when their project goes into maintenance.

The typical "we never have enough time/money to do it right the first time but we always have to make the time/money to do it twice" situation.

<comment><USER9> > It's cheaper (and often faster) to have cheaper, less disciplined, less > experienced developers rewrite something multiple times than it is to have > more expensive, more disciplined, more experienced developers write > something and maintain it.

I can't believe this. I've seen the sheer difference in speed and maintainability a single solid web developer can deliver in a framework they are familiar with versus teams of more Jr developers who spin their wheels for weeks. Rewriting when you don't even understand the starting point is always a waste of money.

> It's also harder to keep the more experience developers because most > developers I work with start looking for another job when their project goes > into maintenance.

This certainly resonates though. I've been that developer more than once.

<comment><USER7> > I can't believe this. I've seen the sheer difference in speed and > maintainability a single solid web developer can deliver in a framework they > are familiar with versus teams of more Jr developers who spin their wheels > for weeks. Rewriting when you don't even understand the starting point is > always a waste of money.

I agree completely.

It can be quite shocking just how much damage a poor developer can do to small to medium companies. I know of 1 company that's holding on for dear life right now because they lost their biggest client due to a very poor developer they had employed. I told them 6 months before this all happened to get rid of him, but they didn't. And Corona is just making it that much harder for them to find new work.

</comment></comment></comment></comment></comment></comment><comment><USER10> > Tips for stable and portable software

I think a more accurate title would be "Tips for stable and portable C programs"

<comment><USER11> The author lists a number of languages considered stable, C being one of them because of widespread support and portability. Java isn't portable for example because it depends on the JVM (and I know GraalVM is a thing but will you still be able to use it in ten years?).

<comment><USER10> Show me a JavaScript developer that cares deeply about POSIX or the operating system they are running on.

And what about Windows? It is still used on 80% on all computers? So why is POSIX essential?

<comment><USER12> Haven't done much work with servers I take it.

Almost any OS running on a server is going to be POSIX, probably Linux or BSD.

</comment></comment></comment></comment><comment><USER13> This is mostly good advice. I don't love configure scripts, I don't agree with the heavy reliance on POSIX if you intend to be compatible with Windows, and I don't love the fact that the author recommends third party data structure libraries that they haven't actually used. For container libraries in C, you really have to use them to get a feel for their usability (this sounds like a tautology but it's not.)

I disagree strongly with one recommendation. This is just an example, but it holds for larger API design in general:

> we could add a fallback to reading /dev/random. [...] However, in this case, > the increased portability would require a change in interface. Since fopen() > or fread() on /dev/random could fail, our function would need to return > bool.

No, definitely not. It is dangerous to expect the application to sanely handle the case of randomness being unavailable when it is never going to occur in practice. On all POSIX platforms, /dev/random exists and will block until sufficient entropy is available. Something would have to go seriously wrong for this to fail. This is so rare that any error handling code for it will never be tested. The most likely outcome of forcing the caller to handle it is that the return value is ignored or improperly handled and the buffer is used uninitialized, leading to a security vulnerability.

My recommendation instead would be to error check your fopen() and fread() calls within get_random_bytes(), and print an error and abort() if they fail. This way if someone's system is improperly configured and /dev/random doesn't work the program will just crash. Same goes for macOS's SecRandomCopyBytes() and Windows' half a dozen calls to use an HCRYPTPROV. This way you still return void and there is no danger of callers improperly handling errors.

In general, unless you're writing safety-critical software, it's fine for your code (or even library code) to abort() in these sorts of exceptional situations when there is no reasonable or safe way to handle the error. If someone truly wants to handle the error, they can just not use your API and do it manually.

</comment><comment><USER14> From the title, I was hoping to hear about software systems that have powered infrastructure for decades, but unfortunately it was more of a programming language analysis strategy.

</comment><comment><USER15> Hm, decades is not that much, most enterprise code fits into that. But how about 200 years?

It is about people. Documentation, paper trail why some decisions were made, archiving build tools, VMs, dependency source code..

Also C, POSIX and Motif are terrible choice for their fragmentation. Java is very booring, but compiling and debugging 20 years old code is very common.

</comment><comment><USER11> I'm currently "betting" on Go for making a back-end (just a REST API + sqlite database) that will last a decade; I'm betting on the tooling to stay backwards compatible or with minimal changes in the codebase; I'm betting on the readability of my own code for the next decade, and I'm betting on the language + tools to continue to be developed whilst sticking to their original goals.

Generics is going to be fun.

<comment><USER7> > I'm betting on the tooling to stay backwards compatible or with minimal > changes in the codebase

This is actually why I'm pretty bullish on things like RoR, Laravel, et al.

The sheer speed at which they go to a new version that breaks BC is actively making the web less secure. I've lost count of how many times I've found a new client with this software that's been working for years but suddenly broke, only to realize it's on an OS that's EOL, using a version of the framework that's EOL and a version of the language that's EOL. And now it's my job to bring it up to speed.

And typically the hardest part of that? The 3rd party dependencies that are either abandoned and don't support the newer versions of anything, or have moved onto Python 3 and no longer support Python 2.

It's why I vastly prefer something like asp.net core. I know in 5-10 years the code will probably just work with the latest version, and if there's an incompatibility, it's going to tend to be relatively small.

<comment><USER16> > This is actually why I'm pretty bullish on things like RoR, Laravel, et al.

Do you mean bearish? I think you do as I was confused for about half of your comment before I realised

<comment><USER7> Sorry, you're correct. I meant bearish.

That's what I get for posting pre-coffee :(

</comment></comment></comment></comment><comment><USER17> Seems like good advice. I'd add another one that seems completely obvious, but some sloppy developers ignore it: avoid undefined behaviour. If you're going to work with C, you need to know about undefined behaviour and take it seriously.

<comment><USER18> If it were so easy, there would be already specified a subset of C without undefined behavior and you could be able to automatically check your code against it.

<comment><USER17> My point was only that C programmers should be keenly aware of the pitfalls of undefined behaviour, rather than blithely ignoring it. I've been surprised by the sloppiness of some developers on this point.

> a subset of C without undefined behavior

There are various projects out there that let you produce C code guaranteed to be free of undefined behaviour, but they're not 'quick fix' solutions, so they're not widely used.

[https://www.eschertech.com/products/](https://www.eschertech.com/products/)

[https://github.com/zetzit/zz](https://github.com/zetzit/zz)

[https://blog.regehr.org/archives/1069](https://blog.regehr.org/archives/1069) (ctrl-f for _actually_ )

<comment><USER18> What does "keenly aware" even mean? For example: any time I add or subtract two signed ints, undefined behavior can happen. Now what. Must I pepper the code with bounds checks (which are prone to UB too if not done carefully)?

Anyway, any complicated thing that can be easily ignored, inevitably will be.

<comment><USER17> > What does "keenly aware" even mean?

Keeping the threat of undefined behaviour in mind, and taking steps accordingly, rather than complacently ignoring it. C is a highly unsafe language, and the programmer shouldn't forget this.

> any complicated thing that can be easily ignored, inevitably will be.

The demonstrable inability of C programmers to write correct code is a strong argument against the widespread use of C. Even old languages like Ada show that you can use a language _much_ safer than C and still achieve solid performance. Languages like Rust are making further progress on having safety, performance, and programmer-convenience, all at once.

If you use an ultra-safe language like verified SPARK Ada, the language doesn't even _allow_ you to, say, forget to check whether a denominator is zero, or to forget to protect against out-of-bounds array access.

> Must I pepper the code with bounds checks (which are prone to UB too if not > done carefully)?

Not necessarily; a tool can help check for undefined behaviour. Static analysers, GCC flags, and tools like Valgrind, can automatically check for out-of-bounds array access, divide-by-zero, or attempting to dereference NULL. [0] Adding your own runtime assertions isn't a crazy idea though, especially for dev builds. If this were the norm in C programming we'd have fewer security vulnerabilities.

C lacks the kind of runtime checks that are 'always on' in languages like Java and C# (out-of-bounds, divide-by-zero, etc). That's not because such checks don't apply to C code, it's because of the minimalist C design philosophy. You have the option to add your own checks, or use tools to do so automatically, but if you develop without any checks anywhere you should expect to have more bugs. Java added them for a reason.

The C++ language has a somewhat different design philosophy, but it's the same reason its _std::array_ class-template has both a runtime-checked _at_ member- function, and an unchecked _operator[]_. It would be against the design philosophy to force you to pay the runtime overhead for checks, but it gives you the option.

> which are prone to UB too if not done carefully

What kind of error do you have in mind here?

[0] [https://stackoverflow.com/a/44820924/](https://stackoverflow.com/a/44820924/)

<comment><USER18> For example checking for signed overflow must be done carefully:

[https://stackoverflow.com/questions/3944505/detecting- signed...](https://stackoverflow.com/questions/3944505/detecting-signed- overflow-in-c-c)

"Design philosophy"...oh please! C was designed for transistor- and memory- scarce microcomputers. Nowadays there is defacto supercomputer in every phone and runtime bounds checks are cheap. Moreover, allowing CPU to know the size of memory chunk pointed to could enable optimization which would make the code actually faster (not even talking about security benefits). But you C programmers insist tooth an nail against that...

<comment><USER17> > For example checking for signed overflow must be done carefully:

Right, but we're talking about a simple bounds check. There should be no need for any arithmetic, just comparison.

> "Design philosophy"...oh please! C was designed for transistor- and memory- > scarce microcomputers.

Right. Hence its design philosophy.

> Nowadays there is defacto supercomputer in every phone and runtime bounds > checks are cheap.

Cheap, but perhaps not cheap enough to dismiss entirely. Bounds checking costs a few percent of performance [0], enough to put some people off in some domains such as in the kernel.

It's a pity C makes it difficult to automate just about any kind of check. Checking whether a pointer overruns a buffer that was returned by _free_ , for instance, requires quite a bit of cleverness, as the system has to track the size of the allocated block.

You have to rely on optional compiler features, elaborate static analysis tools (often proprietary and expensive), and dynamic analysis tools like Valgrind. Ada on the other hand enables all sorts of runtime checks by default, but it's easy to switch them all off if you're sure.

> CPU to know the size of memory chunk pointed to could enable optimization > which would make the code actually faster (not even talking about security > benefits)

What kind of optimisation do you have in mind? Pre-caching?

> But you C programmers insist tooth an nail against that...

'Fat pointers' of this sort have been tried with the C language [1] but I can't see the committee adding them to the standard. Part of C's virtue is that it's extremely slow moving.

I'm not advocating continued widespread use of C though. I hope safe-but-fast languages like Rust do well. We all pay a price for the problems associated with C and, perhaps to a lesser extent, C++. For what it's worth I haven't written serious C or C++ code for a long time.

[0] [https://doi.org/10.1145/1294325.1294343](https://doi.org/10.1145/1294325.1294343) (An old source admittedly)

[1] [http://libcello.org/learn/a-fat-pointer- library](http://libcello.org/learn/a-fat-pointer-library)

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> That forceinline definition is just tip of the iceberg. It's so hard to define in a way that works with different versions of GCC, -Werror, instrumentation, MSVC, and profiling. If you care about portability, consider just not caring and using static. Too much special casing code can actually make it harder for people in weird environments to use your code, since something is going to break it, and reading past the ifdef soup becomes the biggest obstacle.

</comment><comment> iso8859-1 Really weird that he recommends Motif. Motif is not comparable to Web/Gtk/Qt since it has only the most primitive widgets, and no 3D support.

I would propose doing a web-app if you really care so much about compatibility. Web also allows for more custom widgets.

<comment><USER20> Is Motif actually available on modern Linux systems? And is there a Windows port as well?

I find it difficult to believe that Motif is actually that portable.

Web apps are only as portable as the browser features they use, and the browsers available for the platform. A primarily backend-rendered app, with minimal Javascript is much more portable than the average SPA app.

<comment> yjftsjthsd-h > Is Motif actually available on modern Linux systems?

[https://www.archlinux.org/packages/community/x86_64/openmoti...](https://www.archlinux.org/packages/community/x86_64/openmotif/) lists as being updated 2020-01-05, and [https://sourceforge.net/p/cdesktopenv/wiki/SupportedPlatform...](https://sourceforge.net/p/cdesktopenv/wiki/SupportedPlatforms/) claims that CDE supports a rather lot of platforms (which implies motif), although I'll grant that most of those probably haven't been tested in a while.

</comment></comment></comment><comment><USER21> One day, maybe when I am retired, I am going to develop a programming language-agnostic algorithm specifying language with which you can generate code for programming languages ;-). A kind om Mathematica, but than for software.

<comment><USER17> > programming language-agnostic algorithm specifying language with which you > can generate code for programming languages

That's just a programming language tailored for transpilation, no?

Theoretical computer science shows us there is no 'one true representation' for algorithms.

<comment><USER21> I have to admit that I was little joking about this. But I do think it is possible to specify an implementation of how a complex operation can be achieve by combining more primitive operations. With digital computers, data is usually represented by certain representation of bits. An operation is usually defined on these kind of representation. Think for example of an operation for adding two numbers in a certain representation, resulting in a result with a certain representation. In computers, two most primitive adding operations are usually adding modulo some power of 2. But with these, we can implement adding for much large numbers (also using other kinds of operations and/or intermediate storage).

</comment></comment></comment><comment><USER22> Obligatory mention of Ten Years Reproducibility Challenge [https://github.com/ReScience/ten-years](https://github.com/ReScience/ten- years)</comment>


Communcations of the ACM - 50th Anniversary Issue (Free) - <AUTHOR> http://mags.acm.org/communications/200801/

<comment><AUTHOR> Of particular interest to me was the article on MapReduce, written by the Google engineers who developed it.</comment>


Al-Qaida said to be changing its ways after leaks  - <AUTHOR> http://hosted.ap.org/dynamic/stories/U/US_NSA_SURVEILLANCE_AL_QAIDA?SITE=AP&SECTION=HOME&TEMPLATE=DEFAULT&CTIME=2013-06-26-03-27-41 <comment><USER2> Gotta love this bit:

 _The officials wouldn 't go into details on how they know this_

C'mon guys, put a _little_ more effort into your disinformation campaign! I mean, even Bloomberg carried this the other day:

U.S. Surveillance Is Not Aimed at Terrorists [http://www.bloomberg.com/news/2013-06-23/u-s-surveillance- is...](http://www.bloomberg.com/news/2013-06-23/u-s-surveillance-is-not-aimed- at-terrorists.html)

C'mon! [http://www.youtube.com/watch?v=S5BMQ- xpTog](http://www.youtube.com/watch?v=S5BMQ-xpTog)

<comment><USER3> What part do you find hard to believe? That a spy agency might have access to information that you do not? Or that spy targets would not make use of leaked information about how the spy agency operates? Or that a spy agency might not want to tell you how it acquired some information?

<comment><USER4> There is quite a big difference between what a spy agency might have access to and what it releases in an AP article. The latter is motivated by self preservation. Truth, when it happens, is a coincidence.

</comment></comment></comment><comment><USER5> Let me guess, they no longer sign emails with "Death to America"

And this _" The officials spoke anonymously because they were not authorized to speak about the intelligence matters publicly."_

Shouldn't that be "traitorous leakers"?

<comment><USER6> Definitely. By letting al-Qaida know that we know that they know that we're spying on them - irregardless of the PR benefits for the NSA - these rogue leakers have caused irreparable harm to our nation and will certainly be pursued with as much vigor as Mr. Snowden /hamburger

</comment></comment><comment><USER7> Not unexpected from the US government, claim Al-Qaeda is benefiting from the leaks without offering any sort of proof beyond conjecture...

I'm sure that, prior to the leak, terrorists were having Skype conferences from their living rooms, while posting their activities on Facebook and exchanging bomb recipes on Gmail....

And then of course, the Boston bombing suspects were identified to the US government by Russian agents, and they couldn't prevent that attack. Either the NSA, CIA and FBI are staffed by imbeciles, or someone's lying to the people...

</comment><comment><USER8>
       It is the first time intelligence officials have described which groups are
       reacting to the leaks. The officials spoke anonymously because they were not
       authorized to speak about the intelligence matters publicly

Ooh. Gonna be holding my breath waiting for the Obama administration to diligently find these leakers. Unless -- and I'm sure this is coincidence -- prosecutions are correlated with in what light leaks frame the administration? Nah, couldn't be.

</comment><comment><USER9> So now that The Terrorists are changing it up, might as well dismantle the surveillance state, huh? What good does capturing all this data do if they're not going to get anything useful?

The cognitive dissonance required to justify these programs is just staggering.

</comment><comment><USER10> I honestly wouldn't be surprised if the source of this article originally said "People on the internet start using encryption and other privacy-protecting techniques to keep their communications secret from the NSA" and the media spun it to be "[Al Quaida/Terrorists] on the internet start using encryption and other privacy-protecting techniques to keep their communications secret from the NSA" because that gets more eyeballs.

</comment><comment><USER11> Love the propaganda.

</comment><comment><USER12> My high school pot dealer refused to do any deals over the phone. I highly doubt terrorist plots were being hatched over Skype.

</comment><comment><USER13> And anyone who is now suddenly communicating differently is flagged as a posible terrorist, or at least someone who has something that needs investigating. Watching the progress of communication patterns changing must be fascinating. If the alternate forms of communication are also compromised that'll be even better.

Action and reaction.

</comment><comment><USER14>
        [...]the NSA will catch up eventually, he predicted, because there are only
        so many ways a terrorist can communicate. "I have every confidence in
        their ability to regain access."

So now NSA is the injured party?

<comment><USER15> Al-Qaida don't need to communicate: read the Qu'ran; if you believe it says take up arms then you're in; no need to e-mail anybody.

<comment><USER15> Allah don't have cell phone; use prayer rug.

<comment><USER16> Especially if it's this man's rug:

[http://www.leonardcarr.com/the-story-of-the-locksmith-a- trad...](http://www.leonardcarr.com/the-story-of-the-locksmith-a-traditional- sufi-teaching-from-idries-shah/)

</comment></comment></comment></comment><comment><USER17> Abhorrent conduct can also have benefits: News at 11.

When the CIA stopped(?) waterboarding suspects, I bet they got fewer terrorism leads, too.

There are some lines we never should have crossed.

</comment><comment><USER18> Even Al-Qaida is trying to discredit his move ?

<comment><USER19> Al-Qaida is not a person. Either you accidentally used the wrong pronoun, or perhaps you're confused as to what Al-Qaida refers to.

<comment><USER20> He may have been making some kind of joke based on the way they treat Al-Qaida like it is some kind of centralized entity and how everyone involved acts the same way.

<comment><USER19> Actually, judging from his comment history, I'm just thinking English may not be his first language.

<comment><USER18> Indeed.

</comment></comment></comment></comment></comment><comment><USER21> I just wish our local terrorists, the US Government, would do the same.

</comment><comment><USER15> Why no body post on al-qada facebook page no more?

</comment><comment><USER22> AP - The Official NSA Public Relations Organization

Yeah, Al Qaeda didn't know that NSA listens and reads to their communications. That's why Bin Laden used couriers to personally deliver thumbdrives and had no telephone or internet.

<comment><USER23> True, but it would likely be impractical to use couriers to communicate between Al Qaeda H.Q. to any Al Qaeda cells in the U.S., or even in an adjacent country.

<comment><USER22> But Snowden offered them nothing new, so they must trying to avoid detection as much as they can.</comment></comment></comment>


How to learn machine learning in a week - <AUTHOR> https://medium.com/@oslokommuneper/machine-learning-in-a-week-a0da25d59850

<comment><USER2> Awesome, I've bookmarked it. Thanks!</comment>