jwfxpr

I have friends who work in the IT section for an under-resourced cultural institute focused on the preservation and recording of disappearing cultures and ethnic groups, including the preservation of speech and utterances in languages that now have no living native speakers. They discovered recently, to their alarm, that the only surviving copies of some recordings were now on old 3½ and 5¼ inch floppies that had somehow been stored without accurate cataloguing. They are struggling to find equipment that can 1) read the discs, 2) interface with the disc drives, 3) tell them what is actually on each disc and what file formats are in use (they have good guesses, but no certainty) and 4) find software that will be compatible with those formats.

They have neither the skills nor budget to do in-house nor outsourced forensics for this. At this point they don't even know what exactly might be lost to humanity's knowledge, and the descendents of these people, forever.

Broadband without wires? Preposterous.

There is, as of me writing this, only one reply to the original post in support of its complaint — mine. Perhaps those willing to post comments here should consider also posting them there.

How is that not 'very few people' in a sample that includes the population of the Earth?

Honestly I just feel like you may have wielded judgement too hastily at the expense of your sense of wonder and shared joy in someone exploring territory that is well trodden only to relatively few. Very few people have a solid grasp of musical theory. For most people, scaling what may to you be barely the foothills of knowledge is a great and challenging experience, and I think it should be celebrated.

And sure, perhaps you and I can easily distinguish the subtle difference between 'Musicians always use chords' (obviously wrong) and 'Musicians always work, individually or together, within a key, which is an abstracted but well-defined set of tones that can be combined in time series or simultaneously to produce an inexplicably pleasant experience in the listener, by some neurological magic that has never been adequately explained' (non-obviously correct) but y'know what, I actually am willing to let little gems like that slide because they're adequate approximations of the truth that allow good folks to proceed on a journey that may one day lead them to, just maybe, have the arrogance required to belittle the uninitiated.

The author clearly and good-humoredly declares that he comes with no knowledge of music or music theory at all, and is clearly documenting his process of coming to grips with enough of those basics you may have known as a 6 year old with 1 year of experience, and is attempting to do so in order to do something interesting. So perhaps 'wrongness' is far less important to this than 'interestingness' and, though I am a multi-instrumentalist myself and know music well, I'd like to thank him for attempting to learn what he needed to to attempt this interesting thing. I really enjoyed the read and intend to have a little play with the data.

Manifest destin-E.

Firstly, I really appreciate the thoughtfulness and thoroughness of the reply, you've clearly invested significant thought into these issues, which in and of itself is a good sign.

Secondly, I do agree that the threat model for 2FA lacks concise definition, I've had the same thought. It certainly does make it harder to think through how to balance the convenience-security tradeoff. I suppose the resolution to that is to acknowledge that ontologically the threat model may in fact attach elsewhere, and that the specific detail of the implementation choices within a 2FA framework (hard/soft tokens, time dependent/use dependent, etc etc) should be selected based on what threat model you are addressing. So for your implementation, I would think it speaks to the dominant use-case and its dominant threat model: an individual user's myriad personal accounts, and prevention of fraudulent access. (Unless your expected use case is within an organisation's authentication framework, in which case I'm sure you'd have policy-defined software behaviour set by administrators.) In other words, I expect your typical use case is more worried about opportunistic remote attacks (after, say, stale logins and passwords being breached, or successful phishing attack) than anything targeted, and so physical access by a skilled attacker is not considered a strong threat (though 2FA has a role in preventing opportunistic physical access as well, especially when used in financial transactions). I'm sure you've given that all a lot of thought too, so consider my thoughts only for what they're worth!

> This is obviously bad, but also obviously out of scope for 2FB.

Is it though? Let's assume that the malware functions outside the browser. Are you sure your extension cannot identify a QR code, identify that it is a valid seed for 2FA, and capture that information before the page finishes rendering, before the malware would have a chance to 'see' it? You could still offer your user the chance to display it if required. I honestly don't know enough about browser extension design to know if that's feasible, but if your app could in fact present a strong mitigation against a pre-installed malware attack then, my friend, you'd have hugely contributed to your user's security.

> Also, users who are (rightly) concerned about malware on their devices will have the option to explicitly not treat the laptop as a trusted device.

This is an excellent concept, and sounds well executed. I'll have to give 2FB a try by the sound of it.

> One huge benefit of 2FB being a web extension is that it can help prevent a user falling victim to a phishing attack.

This is a good benefit that I hadn't considered.

> Finally, I am curious which specific portions of NIST 800-63B are you referring to in your comment?

The new advice on memorised secrets is laid out in 5.1.1 and subsections[0], with important discussion and rationale in Appendix 1[1]. It differs significantly from what is widely presented as 'best practice'. Though advice on memorised secrets is probably out of scope for 2FB.

Am happy to discuss in email anything you like on this, I'll flick you a quick message.

[0]https://pages.nist.gov/800-63-3/sp800-63b.html#-511-memorize... [1]https://pages.nist.gov/800-63-3/sp800-63b.html#appA

IANAE in identification & authentication systems, but doesn't using a browser plugin for the 'something you have' portion of 2FA negate the principal benefit — that which, the algorithm/app/token providing the OTP is inaccessible to an attacker with access to the primary login interface? Let's say I'm following accepted best practice (ignoring for a moment the current NIST 800-63B draft[0] and its aggressively divergent recommendations about remembered secrets), and using unique, randomly generated passwords for every single account authentication. Being a human, I need a software-based password manager to enable this. This is installed as an extension in my browser. Excellent, so far I have followed the 'best advice' as it's universally given.

Now I have more best practice advice, and I establish 2FA for accounts that support it. Aaaaand then I install another (your) browser extension.

Have I not simply made the entirety of these security precautions vulnerable to a single vector of attack at this point? I grant there's a limited version of this risk if I have, say, LastPass and Authy both installed on the same mobile device (for the record I do not), but the colossal attack surface on a desktop/desktop-browser/human-user/intentionally-minimised-interactions-and-decision-points combo gives me cold sweats.

[0]https://pages.nist.gov/800-63-3/sp800-63b.html

This gets into slightly pedantic definitional arguments, but broadly speaking the assertion is true that all known earliest writing systems were logographic (where a character represents a word, not a sound), though it is also true that no 'pure' logographia has ever been known to exist (except for an artificially constructed language called Toki Pona[1] from c.2001 that's barely worth mentioning). In practice, all known writing systems have some level of phonemic association to characters along with the ideagraphic, be it using a special subset of characters for phonetic representation or by associating the actual utterances of the words with their ideagrams.

Examples of writing systems that used characters primarily to represent sounds did come later, though similarly, it is difficult to argue that any known language is purely phonetic. As a simple example in English, take '&' — though it is not a recognised letter, neither is it punctuation, and it is unarguably a glyph in the English writing system about which one could debate whether it is ideagramatic or logographic. (But I digress.)

There are many types and varieties of phonetically representative writing systems — most of the earliest, like Linear B, are Syllabaries[2]. The earliest known surviving examples date from the mid-15C BCE, written forms of Mycaenian Greek[3].

Fully segmental writing systems (please distinguish 'fully' from 'purely', as elaborated above) are definitely younger than the rest. The earliest examples of these are often abjads and abugidas, which either eschew vowel representations or form consonant-vowel digraphs respectively[4].

The Phoenician alphabet, or more correctly the Proto-Canaanite script that was used by the Phoenicians, is the earliest surviving example of a segmental writing system — it is an abjad of which the earliest surviving examples are from roughly 1000BCE[5].

The earliest preserved writings that aren't just numbers date to about 3100BCE in Sumer[6], so predate preserved phonetic (excluding syllabic) writings by about 2000 years, and are in the order of 5000 and 3000 years old, respectively. So it's a big stretch to call it a 'recent invention', but certainly not as ancient as logographic or mnemonic writing systems.

[1]https://en.m.wikipedia.org/wiki/Toki_Pona

[2]https://en.m.wikipedia.org/wiki/Syllabary and https://en.m.wikipedia.org/wiki/Linear_B

[3]https://en.m.wikipedia.org/wiki/Mycenaean_Greek

[4]https://en.m.wikipedia.org/wiki/Abjad and https://en.m.wikipedia.org/wiki/Abugida

[5]https://en.m.wikipedia.org/wiki/Phoenician_alphabet

[6]https://en.m.wikipedia.org/wiki/History_of_writing

To be fair, it makes no predictions that the global population of fish will be >0 in 2100.

Having lived all over the world and choosing to live in Aus now, it's most definitely a price worth paying ️

It's not exactly a low-cost build, but Tabletop Simulator has very acceptable RPG mods in the workshop, and is compatible with PC gaming VR gear if you've got a bottomless budget.

My gaming group has used TTS + Skype to regularly bring in a player who moved intercontinental and keep the campaign going.

Some shameless self-promotion, please. Link?

This looks really interesting — the only reason I don't run more games more often is the time burden. At a glance it appears to be focused on the various D&D editions + Pathfinder, and was published pre-5th (though I can't find a publication date on the site).

Is it generalised/generalisable enough for use with other source material and RPGs? In other words, is it D&D specific?

> If you don't count the _____ that [survive] today, _____ has killed almost all its [members].

Aside from the logically redundant phrasing, this seems to me a fair description of how selective pressures lead to evolution in populations.

Yo yes, good point, Google does make efforts to ensure that their population of products thrives, evolves, and adapts.

> I didn't find the reply especially convincing, or the arguments for the likelihood of small numbers raised in the main essay.

The author isn't trying to convince you of her counterargument to doctrine. The author is trying to convince you to be less convinced by hand-waviness in lieu of rigorous deduction. The author doesn't even believe that inflation is incorrect, nor does she claim to believe MOND over standard dark matter models; she is pointing out that taking one good, well-evidenced, well-reasoned theory and using it as a prop to chock up a piece of shaky, though attractive, supposition is bad science. She's pointing out that even highly regarded thinkers can allow simplification for the purpose of communication and impact to erase complexity in reasoning and teaching.

So yeah, her arguments may not convince you. She's not trying to convince you, she's trying to show you reasonable doubt. Different standard of evidence.

Neither. If any of us curl/wget/whatever that file, we gain no usable, plain text, human information. We then have to, manually, notice the redirect, take a manual action to follow up, and then those two further objections would apply. Why implement a text file spec that doesn't serve a text file? Even if all your text file contained was "Please see http://linkedin.com/example” it would be a correct implementation.

> If it would work, and the cost benefit ratio were there, people would adopt it quickly. That's what happens with just about everything else.

Great point! Just like:

* Betamax * HD DVD * Minidisc * Hoverboards * IPV6 * DNSSEC * PGP & PKI * Linux desktops * Dvorak keyboards * The metric system * Decimal time * [flavour-of-the-month programming language] * [flavour-of-the-month database] * [flavour-of-the-month cypher] * ...

The factors that influence the proliferation of a technology are wildly divergent from the criteria 'works well, cost/benefit'. I'm not even sure those are weakly correlated proxy indicators of technology uptake.

(2011)

I was impressed by a 25% return rate, and then I saw Tokyo's 60%.

Why are we not funding this??

Really whipped the llama's ass?

'Discourage', obviously, is distinct from 'prevent'. But those checks were enhanced in the wake of the scandal, and it is based in large part on the strength of those enhanced checks that this conclusion about the underpinning validity of LIBOR has been drawn.

We can all agree, though, that the next iteration could do more to stop manipulation and fraud.

I was thinking the exact same thing while reading. And while holidaying in Bohemia earlier this year!

Because OpenVPN is a VPN technology (and client) that can be used for secure connections, rather than a subscription VPN service.

Unless you mean Private Tunnel VPN, their VPN subscription product? It's one of many, many products not reviewed here.

Who is your target market?

I have used both personal VPS hosted and commercial VPN systems at various times (I currently use a commercial VPN to anonymize some traffic sometimes and bypass national-level censorship).

In my understanding of the various pros and cons of those two options, I'm not sure I grasp the core value proposition that this offers. Why do I want: A) A server with fewer (one) unique user(s), and therefore traffic that is much easier to analyse; B) A service with a single static IP and geolocation; but which C) I am trusting a third party to administer.

I seem to be seeing a service which offers me the biggest drawbacks of both sides. Am I missing something?

I agree so much. I almost stopped reading when I realised his first complaint about PIA was their name was too long for his off-the-shelf CSS.

It's a struggle to keep the criticism of this site constructive.

You'll find this extensively discussed in a number of other HN threads: https://hn.algolia.com/?query=china%20vpn&sort=byPopularity&...

Hope that helps!

> That's unacceptable for a privacy company.

Why?

The fact of a connection being established in port 80 is to do with how TCP/IP works. You aren't even claiming to understand what protocol is in use on port 80, not to mention whether the data is in the clear, what it is for, etc. This isn't analysis, it's... something far short of analysis that I can't think of a kind name for.

Since the entries on the site are ordered top-to-bottom based entirely on his subjective rating, ignoring the objective criteria, the list absolutely rates Vype higher, in both a figurative and literal sense, and in a way that implies that his 5-star ratings are far more important than the objective criteria.