Hacker News new | past | comments | ask | show | jobs | submit | more norrius's comments login

It could work... If you want to set minimal system requirements to visit your website.

It will also annoy users of password managers with auto-filling capabilities. "password" is normally used for actual passwords.

Besides, nothing stops the attacker from replacing your code with a faster implementation.


There are password hashing algorithms out there (like bcrypt) that specifically take a long time to compute using the fastest method that we can think of.


I shouldn't have named it "password". The idea was all the form fields are hidden and the process is transparent to the user.


> When I first heard about the quantum search algorithm I thought it [O(sqrt(N)) run time] sounded impossible. I just couldn’t imagine any way it could be true.

It's curious to hear this from Nielsen himself. Personally, learning about Grover's algorithm was when I realised why "if you're not surprised by quantum mechanics, you cannot have understood a thing" (attributed to Bohr, I think).


What is a quantum computer? https://outline.com/9SVe9h


This is often paired with Feynman's "Nobody understands quantum mechanics."


Was that meant as a joke or am I completely missing the point here? Mathematics provides plenty of tools to work with infinities. In plural, because there are quite literally infinitely many different infinities, which we know thanks to maths.


I think generally having time-accurate flags and names would greatly improve the look of the chart. It is just weird having modern flags for the Axis countries in WW2, white-blue-red for the USSR (that's not even the Russian flag at the time), and so on.


For whatever reason, the link does not work for me. Google's cache doesn't seem to provide a copy, so here's one from the Wayback Machine:

https://web.archive.org/web/20180420113021/http://pub.gajend...

To the topic, I think this quote from the article is very important to note here: “Of course, I do not do all of this every day, but I have done all of it at one time or another and most of it regularly.”

It is nice to have an idea of how you write a parser for a language, but I do not believe the author advocates for being able to write one of the top of your head. Same with most other points.


Indeed. What on Earth is “bzzrt pop ffssssssst”? Am I missing something? Google does not help at all.


It's a joke. The joke is that RSA seems familiar, comfortable. Except actually there's a bunch of super subtle ways to mess it up, like padding, or primegen bugs. The bzzrt pop is just a reference to all of the exceptions and caveats, which all sound like arcane incantations instead of straightforward recommendations and are therefore no longer in this document.


Percival 2009 is http://www.daemonology.net/blog/2009-06-11-cryptographic-rig... - the actual summary recommendation is "Use RSAES-OAEP with SHA256 as the hash function, MGF1+SHA256 as the mask generation function, and a public exponent of 65537. Make sure that you follow the decryption algorithm to the letter in order to avoid side channel attacks."

I assume the misquote is making fun of how long that description is compared to, like, "Use 256-bit AES keys." or "Use OpenSSL." (What specific thing in the decryption algorithm should I be making sure I don't misread in order to avoid side channel attacks?)


That, and the fact that nobody who uses RSA appears to follow that recommendation --- by far the most common RSA construction is (broken) P1v15 padding.


> WTFPL not allowed. We also do not allow contribution to projects under the WTFPL.

I am assuming this does not apply to personal projects, but then why would you contribute Google code to something that you cannot use anyway due to licensing issues?


Google's contention has always been that there is no such thing as a personal project. You can fill out a form to officially get permission to have a "personal project", however, but I doubt many people want to deal with the bureaucracy.

You will notice 6 missing years in commits to my personal github. That is why. Every "personal project" I did ended up in the Google repository instead.


How do they justify that belief? If something is done outside of work hours, not using a work computer, then how would they have any claim over it whatsoever?


It is a widely held belief that writing computer code is an intellectual and creative endeavour (IIRC codified so in European law or something†), therefore it is not tied to a specific timeframe within which you work: you are very much able to think about and solve a work problem under your shower, that's why the corresponding intellectual property of that solution is owned by the company you work for, independent of the time of day you thought about it.

So to cover that, typically law basically defaults on granting your company IP rights on anything you create anytime while you're an employee, and should there be need to challenge that, it's up to you to uphold in court that project X has nothing to do with your company business or tech, or to ensure beforehand that your contract has special provisions granting you IP rights in known situations.

† At the very least this is also the basis as to why software is not patentable in EU, unless they are an integral part of a very concrete process that itself solves an issue (e.g say you invent an industrial process that allows you to synthesize molecule X more efficiently, and that process involves a bit of code as an integral and required part of said process because it is deeply tied to it in a fundamental way, then that precise bit of software can be covered by the patent of the process)


To extend let's change the field a bit: Imagine you are a scientist working in a lab, employed to develop new technologies. One day you're falling in the shower and scribble an idea for a flux capacitor. Could you patent it? Or the company? What if it happens in the office? If that makes a difference: How to prove? Most employment contracts (at least the ones I have seen) make the assumption clear, that all results of "software development" are treated as work for the company. Many companies than have ways to allow hobby projects info uelds different from the actual work (while that definition is quite unspecific and has to be decided case by case)


From what I have seen, a lot of companies have very restrictive IP clauses in employment contracts (at least here in IE).

The first draft of my current contract wanted a claim to all creative work produced, at all hours, on any equipment, in any medium. (e.g. the copyright on a photo I took on holiday would technically have been owned by my employer.)

They also wanted me to give up all "moral rights" which meant I could not say I created anything I did while being employed, and more worryingly, I could not say I didn't create something that the company said I did.

That clause got removed pretty damn quickly.


By paying you for it.


So if you do some volunteer work on a weekend for the web site for a non-profit (say a community center you're a member of). Does that mean that Google doesn't allow that? Does this clause cover any creative work (such as a unique desk that you designed for your home lab)?


This is surprisingly normal. A majority of programmers have contracts that vaguely specify ownership over everything you produce. It's why "personal github as CV" is such a terrible idea.


Interesting. By that do you mean that you chose to release your personal projects under Google or that your personal projects were useful to Google and hence you got their official blessing on them?


The bureaucracy is actually pretty lightweight now. I did it a while back and it only required < 10 min to fill out a web form.


What do you mean fill out a form? There is a clause in the work contract?


There is a clause in the work contract that claims that Google has ownership of all your IP relating to Google's current or planned businesses. Given that it's Google, that's... a very broad category.

You can apply (the process is described on the same website as TFA) to have Google declare that a certain project definitely is not one of their businesses and therefore not covered. You could also make your own judgment, but (having talked to a lawyer about this when considering a Google offer) my impression is that that is a very bad idea and you should go through the process.

(I only know about the US-but-not-California version of the contract; it might be different in other jurisdictions.)


I think that laws should feature these extremelly large fines to companies for keeping clauses in contract that are already known to be in conflict with existing laws.

A very large number of contracts will be so much better and more slim, and a lot of people will not be harrassed by scare tactics.


Isn’t this explicitly illegal under CA law or something?


Not to my knowledge. California generally forbids noncompete clauses. They don’t forbid “we own everything you write while employed by us” clauses.


It's not just because they can't use the code, it's also because WTFPL doesn't include some very important things for a license (like a warranty disclaimer), meaning just contributing to the code could get you into legal trouble.


So basically WTFPL-licensed code is as good as not licensed at all, which is a nono?


That seems to be the general consensus among a handful of legal people I talked to when the whole left-pad thing happened (which was WTFPL licensed).


That's what I'd expect legal people to say about a license that every layman can understand and that makes their consulting mostly unnecessary.


The legal system and lawyers aren't just some kind of conspiracy that only exists to funnel money into their system, they solve a very real purpose.

"Do what the fuck you want" isn't even a good sentence, let alone a statement on what you can do, how your liability is limited, rules on naming and attribution, etc...

Questions like "Can I use this without attribution?", "Can I hold you liable for the code you wrote?", "Will you charge me for using this code?", "What does the license cover? (documentation? just the program? just source code?)", and "Who owns the copyright for this work?" are not answered by the license, leaving them all up in the air.

I'm not going to use code that someone can attempt to charge me for using later, and I'm not going to contribute to code that can cause me to be sued for my contributions not working.

I get the want for simple licenses, but I feel that licenses like MIT or Apache2 are simple enough to be understood by most people, and they fulfil all the checkboxes of a real license.

It's especially telling that the WTFPL contains a clause which calls out a lot of this information for the license text only (must be distributed verbatim or have the name changed, all are permitted to distribute it, and a copyright for the license text).


The answers to those questions seem pretty clear to me

Just do what the fuck you want with everything in the repo. No copyright, if you want to say that you created the code and rebase all history, it's also your right. Feel free.

And it seems kind of obvious you can't hold the author liable for any trouble (though I don't know anything about law so maybe it's more complicated than it looks). Also it says in the FAQ that you can just add a warranty clause if you need one.


>And it seems kind of obvious you can't hold the author liable for any trouble

But legally it's not obvious. I'm not a lawyer, and I don't pretend to understand all of the concepts, but I believe there is a concept of "fit for purpose" where unless you specifically say otherwise, it is assumed that your "creation" will do what it says it will do, and if it fails to do that in a way that harms someone, you can be held liable. A company that makes ladders can't claim it's not their fault that it collapsed unless they put in very obvious and clear wording that the ladder has no warranty or purpose and they can't be held accountable. Similarly, your code that pads strings on the left is expected to do so, and if it doesn't and that causes harm to someone, then they could claim that you are liable for at least part of those damages.

Also, there is no such thing as "no copyright" in many parts of the world. IIRC in the US EVERYTHING has copyright automatically and until it expires, even if it's not declared. You can't "give up" your copyright, all you can do is license it. Again, i'm not a lawyer, but this is how I understand the system works.

Answers to those questions may seem obvious to a layperson, but they aren't to a legal system. And choosing to not participate in the legal shit doesn't mean you are immune to the law.


If it were a conspiracy to fuel business, I'd expect them to say use it then unpick the mess when someone brings a legal action.

It's just too vague to be useful - legitimate questions such as "does it cover code only or documentation as well?", or "is the author disclaiming any warranties or liability that may be implied by the law?" are left unanswered.

There seems little reason to use it over e.g. MIT or FPL-1.0.0, both of which accomplish similar ends and are quite readable without introducing a bunch of uncertainty for both parties.

https://opensource.org/licenses/MIT https://opensource.org/licenses/FPL-1.0.0


You are making an ad-hominem argument against legal people. It's a fallacious form of argument.


It's about as bad. The linked article goes into some detail about the parts that are missing for it to be a meaningful, useful license.


WTFPL can include a warranty clause (see [0] «Why is there no “no warranty” clause?»)

Also, the Google guidelines consider that WTFPL is recognised as open source by OSI, yet there seems to be some opinion from FSF people that it is free software (see [0] «Is the WTFPL a valid license?»).

[0]: http://www.wtfpl.net/faq/


Guess nothing I release will be used at Google. Oh well, none of it is particularly good or relevant anyway. Funny though, because they are doing exactly the opposite as what the license allows them to do.


I guess this is a case where the intent of the license might be obvious, but the legal details of the license not worked out well enough. I really don't understand why people, who basically want to open their sources to everyone, don't just take one of the more established licenses for that purpose, like MIT/BSD.


Because it's an intentional thumbing-of-nose at licence wankery. WTFPL is a statement that "do what you want and stop being so precious about it".


Proper licensing of software is a technical requirement, if you want your software to be used. The technicalities of the law might be unneccessary complex, bizarre even in some cases, but thats how the law is. We programmers are not goint to change that. So, if you really don't care, just take the MIT license, which is about the simplest of the widely used licenses. With that license, anyone interested has a clear base to use your software. Unless of course, you don't intend to share your software for real in the first place.


Your original comment said you "didn't understand," not that you "didn't agree." The former prompts a very different answer than the latter, but you're acting as if you said the latter.

To understand it, all you need to do is understand that some folks take actions based on ideological beliefs, often to the exclusion of pragmatism, knowingly or not.


No, it doesn't. I really do not understand why one thinks this is a good idea. Yes, people are free in their beliefs and expression. But if they try to do this with a nonstandard license, it only means, that the software is effectively not published as open source.

The technicalities of the law are very complicated. Tiny mistakes can render a license unusable or just invalid. So, the best advice I can give any author is to stick to one of the well-known license, as this makes it very likely that the software can be used by others.


> I really do not understand why one thinks this is a good idea.

You really don't understand that sometimes people act idealistically, often to the exclusion of pragmatism? What don't you understand about it?

Please consider that not everyone has the same life priorities as you.


WTFPL is essentially an ideological stance against the concept of intellectually property. To use the software you have to partially reject the importance of license compliance.


They're doing exactly what the license allows them to do: WTF they want. Which in this case, is not deal with it.


Are quaternions more smooth and connected than complex numbers? My understanding was that higher-dimensional hypercomplex numbers tend to lose useful structure. I'm also curious what being connected in this context means.


I'm still having trouble wrapping my head around how complex numbers are an improvement over the reals. >.<


Maybe it would help to think of the turing machine as analogous. Many programming languages are Turing complete, you can express any computation in any of them, but some languages are more expressive than others and let you reach and work with ideas you wouldn't conceive in a less expressive language.

Lots of things in math are similar. Simon Altmann's Icons and Symmetries makes a case that using representations with insufficient symmetry impeded our learning of the laws of magnetism.


Complex numbers are a particular 2d slice of 2x2 matrices that happen to capture rotation and other periodic phenomena very well. If you are trying to solve some problem that you suspect to involve periodicity, focusing on complex numbers helps you get there faster.


You can use complex numbers number to represent higher dimensional objects using only primitive operations, scalar values, and an imaginary number for each dimension. However, computing with these values is significantly more challenging that real vectors. This book on 'Geometric Algebra' starts to explain: http://www2.montgomerycollege.edu/departments/planet/planet/...



They have some pretty useful properties. For example every polynomial of degree n has exactly n complex roots and if a complex-valued function is differentiable wrt a complex variable then it's also infinitely differentiable and analytical.


The idea sounds great, but the app description definitely should have mentioned what languages are available. I spent five minutes fighting with the faulty OAuth only to find that German is not offered.


Sorry about that, I really should keep an updated list of supported languages with the call to action download at the bottom of the article. Thank you for bringing this to my attention.

I'm looking to support German the first half of this year. It's currently number 2 or 3 on my new language priority list. If you'd like to get an email when it's available, there is a form at the bottom of the homepage that let's you fill out what language pairs you're interested in.


I would make that form a bit more visible. If I wouldn't have read this comment I would have left the website and didn't come back.

Looks like a great app; while I'm learning german I will definitely sign up when it becomes available.


It is stated clearly on the front page (through a list of flags)


Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: