You can effectively achieve the same result with this simple operation:
hash = sha256(current_time());
for i := 0; i < n; i++ {
hash = sha256(hash.append(current_time()))
}
This is because the number of nanoseconds between hashes is actually itself variable, and this is true for physics reasons that are basically beyond the control of any attacker trying to manipulate your entropy. If your time() function has a resolution of nanoseconds, you only need your loop to iterate about 50 times to get a cryptographically secure amount of entropy. If your time() function has a resolution of milliseconds, you need to let this run for more like 20 milliseconds, and if your time() function has a resolution of seconds you need to let it run for more like 5 seconds.
The reason I like doing it this way is that it happens entirely in userspace, it's genuinely a secure method of generating entropy, and it has no dependencies on potentially buggy firmware or microcode outside of the time() call, which is both fairly narrow, fairly heavily used (meaning a bug is likely to be discovered during testing, as the implementation is likely heavily scrutinized), and also fairly easy to test independently - just look at the number of nanoseconds that elapse at each consecutive call to sha256(current_time()) and verify that there's some statistical variance. The above suggestions are assuming about 2.5 bits of variance between calls, meaning there should be a range of at least 20 nanoseconds between your slowest and fastest hash call. This has been true on every CPU I've ever measured, including microcontrollers.
This comment demonstrates everything that's wrong with people trying to be clever and rolling their own crypto.
The security of your system depends on time() providing enough entropy, even though that's not what it's designed to do. It's built on top of the wrong primitive from the start.
> The reason I like doing it this way is that it happens entirely in userspace
On Linux this is often true, but there is no portable way to get the current time that is _guaranteed_ not to do any system calls.
> If your time() function has a resolution of nanoseconds, you only need your loop to iterate about 50 times to get a cryptographically secure amount of entropy.
You haven't proven that at all. It's easy to imagine that on a CPU running at a fixed frequency the interval between reads is constant, so if anyone knows (or can guess) the start time the resulting seed is entirely predictable.
This is completely independent of timer resolution. You seem to realize that as you were writing that:
> just look at the number of nanoseconds that elapse at each consecutive call to sha256(current_time()) and verify that there's some statistical variance
Oh yes, because evaluating the quality of a random number generator is such a trivial thing to do, it's not like there is decades of research behind it or anything.
And assuming you are able to verify the statistical variance: are you going to put that logic in the loop, making it significantly more complex?
Or are you going to do this test on your machine and then ship your code on the assumption that if it works on your machine, it will work everywhere else, too?
> if your time() function has a resolution of seconds you need to let it run for more like 5 seconds.
So not only is it insecure, it's agonizingly slow by design. Why do a system call that takes milliseconds at best, when we can run a loop in userspace for 5 seconds?
All this just so you can avoid writing the obviously correct oneliner:
if (getentropy(&seed, sizeof(seed)) != 0) abort();
The point is this: Getting micro-timing won’t give us as much entropy as we want, but it will still give us entropy. So it’s a perfectly good yet-another-source of entropy to feed in to an entropy pool (such as the input to a XOF).
If those Coldcard devices had used this code as one source of entropy, and this source of entropy was the only entropy still working, they never would had been compromised.
(I won’t update my 18-year-old PRNG to use this code, of course, since that code is now 18 years old and there are no known weaknesses in said code)
Actually, it gives you as much entropy as you need, just increase the iterations. That guy's output is shockingly consistent, so to be conservative maybe we say 0.2 bits of entropy per iteration. So just do 1000 iterations. That's still only going to take a few milliseconds even on embedded hardware.
EDIT: I reviewed his code, and he's not hashing between calls to check the clock; the hash call itself causes the CPU to heat up in arbitrary ways which changes the timing between hashes and introduces more entropy; removing that call basically entirely defeats the idea behind the technique, these results are fully invalid.
Hold on I have to go edit the rest of my responses because I just assumed you wrote the code correctly; you did not.
You are not hashing between calls to the timer. The sha256 hash itself is responsible for doing physical things to the chip (heating up some parts unevenly during the hashing computation) which introduces meaningful entropy between calls to the current time.
You can't just do calls to clock_gettime(), you have do an actual sequential sha256() call between them. Please run this code again and tell me what results you get.
You're missing the point, which is that although timings may vary on the system you are testing on, there is no system guarantee from hardware _or_ software that this always happens.
Case in point:
> The sha256 hash itself is responsible for doing physical things to the chip (heating up some parts unevenly during the hashing computation)
Some CPUs do thermal throttling, others run at a fixed frequency or are so underclocked that thermal throttling doesn't kick in during your 50 iterations. This is exactly the source of randomness that is just not guaranteed to exist across systems.
-----
> You can't just do calls to clock_gettime(), you have do an actual sequential sha256() call between them. Please run this code again and tell me what results you get.
OK, I'll humor you, but to reiterate: it isn't really my point.
Here it's mostly the first few iterations that are slow, the remaining ones are both fast and surprisingly consistent (the value 289 appears six times for example).
It's more obvious if you run it a few times in a row:
The loop timings are quite consistent at least on a single system. That's a problem if an attacker is able to run the same program on the same system to establish baseline timings.
If I estimate the entropy as the logarithm of the difference between maximum and minimum I get only 146 bits of entropy in this case. Technically above your standard of 128 bit, but my point was: nothing guarantees you get even this much entropy on a less noisy system.
This also shows the problem with your "just run more iterations" advice: in the above sample, the first five columns provide 24 bit of entropy per column, and the remaing 45 columns only 2.6 bits. So adding more iterations at the tail end wouldn't double the entropy obtained.
The reason that you get 3-4 bits of entropy per hash is because of the fundamental nature of CPUs. In addition to having considerable professional experience with cryptography, I also have considerable professional experience with hardware; hardware is fickle as hell, especially when your transistors are tens of nanometers large. Every time you flip a bit, you expend some energy, which heats up the chip, and the heat changes the timing of the next clock cycle. Chips are composed of literally billions of transistors, and each one is going to have a different temperature, because clock cycles last less than a nanosecond (well, embedded hardware is slower but the same idea still applies reliably) and that's not enough time for temperature deltas to dissipate across the chip.
Hashing is particularly chaotic because it lights up a different set of transistors on each clock cycle, which means the hotspots on the chip are being jerked around. Some transistors are going to light up 5-10 times in a row, and others are going to be idle 5-10 times in a row, and then randomly that changes. And all of this changes the number of picoseconds that it takes for a clock cycle to complete, which means that each clock cycle is genuinely going to take a different amount of time to complete, and stuff like temperature throttling is completely not at play whatsoever, because we're not talking about chip-wide temperatures, we're literally talking about temperature deltas between transistor a and transistor b.
That makes it a really wonderful source of entropy for cryptographic applications, because the CPU clock is so critical that it's almost never buggy (especially relative to other components that provide entropy), it's also almost impossible to manipulate reliably by an attacker (unless the attacker has an exploit that allows them to set the value of the clock directly - which is possible, but it's a very narrow surface area relative to other entropy sources), and you can completely take advantage of this entropy entirely in userspace, which once again heavily minimizes attack surface area and exposure to bugs.
I have searched far and wide for a CPU that does not reliably generate entropy using the iterated-hashing-against-the-clock method, and I have not found a single example of a CPU that consistently takes the same amount of time to complete a hash. And the reason isn't implementation, the physics of CPUs simply insist on introducing entropy when trying to repeatedly hash something quickly.
You don't need 256 bits of entropy, you only need 128.
I have tested this method on over 100 different CPUs and I have never seen such consistent output. I'm genuinely surprised to see that you only hit 92 bits of entropy, but that can trivially be fixed by doing 10x the iterations. 500 iterations is still going to put you under a millisecond of cost.
And, for what it's worth, code I've actually shipped has combined the above technique with Fortuna, and has typically targeted 2000 bits of entropy rather than 128 (for security buffer).
EDIT: I reviewed his code, and he's not hashing between calls to check the clock; the hash call itself causes the CPU to heat up in arbitrary ways which changes the timing between hashes and introduces more entropy; removing that call basically entirely defeats the idea behind the technique, these results are fully invalid.
---
I updated the code to insert the hash call, this is what I got for his original code on my machine, and the updated code with hashing on my machine (and the difference is cryptographically meaningful):
The increase in calculated entropy comes from the first iteration being slower than the rest, but that's a bit misleading, because the first call is always going to be slower.
Can you run the program 10 times and show me how much variance there actually is in the first column? Because if all the values lie between (say) 756000 and 757000 that's actually just 10 bits of entropy, not 19.5, and if the same applies to the other values, you're much closer to the original 90 bits.
I ran it 500,000 times, discarding the 10% most entropic results ... in the hopes of arriving at a relatively conservative estimate for the amount of entropy you actually get from each iteration. Here's the prompt I used to generate the code: https://chatgpt.com/share/6ab2df4a-7f94-83ea-aecf-1bb57c4838...
And here are the results of running that code:
=== No hashing ===
Clock resolution: 0.000000001 seconds
Clock reads: 500,000
Second-difference outcomes: 499,998
Retained outcomes: 449,998 (90.000%)
Average Shannon information: 1.755579 bits/retained outcome
Marginal min-entropy estimate: 1.339460 bits/retained outcome
Lag-1 conditional min-entropy: 0.960079 bits/retained adjacent outcome
Conservative descriptive proxy: 0.960079 bits/retained outcome
Proxy scaled per clock iteration: 0.864067 bits/iteration
These are empirical timing statistics, not a proven entropy rate.
=== One SHA-256 between clock reads ===
Clock resolution: 0.000000001 seconds
Clock reads: 500,000
Second-difference outcomes: 499,998
Retained outcomes: 449,998 (90.000%)
Average Shannon information: 4.205076 bits/retained outcome
Marginal min-entropy estimate: 3.610848 bits/retained outcome
Lag-1 conditional min-entropy: 3.351217 bits/retained adjacent outcome
Conservative descriptive proxy: 3.351217 bits/retained outcome
Proxy scaled per clock iteration: 3.016082 bits/iteration
These are empirical timing statistics, not a proven entropy rate.
------------
As GPT helpfully points out, this isn't a proven guarantee, but a reasonable estimate is somewhere between 3 and 4 bits of entropy per hash. That means 50 is actually enough, though if you want to be conservative I don't think there's any harm in doing 500 or even 5,000 instead of 50. And, if you are going to be using this in a hostile environment, it doesn't hurt to also add a fortuna-like accumulator that resets your entropy every once in a while.
I said this in another reply as well, but the reason that you get 3-4 bits of entropy per hash is because of the fundamental nature of CPUs. In addition to having considerable professional experience with cryptography, I also have considerable professional experience with hardware; hardware is fickle as hell, especially when your transistors are tens of nanometers large. Every time you flip a bit, you expend some energy, which heats up the chip, and the heat changes the timing of the next clock cycle. Chips are composed of literally billions of transistors, and each one is going to have a different temperature, because clock cycles last less than a nanosecond (well, embedded hardware is slower but the same idea still applies reliably) and that's not enough time for temperature deltas to dissipate across the chip.
Hashing is particularly chaotic because it lights up a different set of transistors on each clock cycle, which means the hotspots on the chip are being jerked around. Some transistors are going to light up 5-10 times in a row, and others are going to be idle 5-10 times in a row, and then randomly that changes. And all of this changes the number of picoseconds that it takes for a clock cycle to complete, which means that each clock cycle is genuinely going to take a different amount of time to complete, and stuff like temperature throttling is completely not at play whatsoever, because we're not talking about chip-wide temperatures, we're literally talking about temperature deltas between transistor a and transistor b.
That makes it a really wonderful source of entropy for cryptographic applications, because the CPU clock is so critical that it's almost never buggy (especially relative to other components that provide entropy), it's also almost impossible to manipulate reliably by an attacker (unless the attacker has an exploit that allows them to set the value of the clock directly - which is possible, but it's a very narrow surface area relative to other entropy sources), and you can completely take advantage of this entropy entirely in userspace, which once again heavily minimizes attack surface area and exposure to bugs.
Here, we see, running it on Windows, at least 1 but of entropy per clock_gettime() call. For people who argue kernel entropy is somehow more secure, perhaps they should become familiar with how kernels before Linux 5.6 or so on some devices had issues where (u)random wouldn’t provide enough entropy to be really secure (people would use haveged to make sure they had enough entropy).
Depends in what trust do you have over your hardware/OS. If you assume the hardware is potentially backdoored, and the OS is proprietary, or even if open could have malware/rootkits that can thinker around the random number generator, the solution of using a sole implementation inside the program (assuming the sha256 function is inside the program itself) maybe better.
Sure an infected system may as well fake time values, but that is much more difficult and it's possible to detect from a userspace program. For example you mention to use getentroy, but on a compromised system you know how easy it is to change something that is implemented in a system library (e.g. libc) or even if you read /dev/random directly without passing from the libc how easy it's to make it read whatever you want?
To me that is not that bad implementation, in fact it's an implementation that is used in a lot of security software (including GPG, not as the sole source of course but as one of many).
If you cannot trust the platform you're running on, all bets are off. There is a reason so much effort is put in TPM and remote attestation and so on.
A compromised kernel doesn't even have to fake any data. It can just read the generated seed directly from user space without the program ever knowing about it.
> Sure an infected system may as well fake time values, but that is much more difficult
clock_gettime() just reads a value that the kernel has set, so that's not particularly difficult to fake.
If you're thinking of using RDTSC instructions directly, that's of course not portable, and at that point you might as well call RDRAND directly, which is at least designed to provide random data.
> it's possible to detect from a userspace program.
There is no detection that is guaranteed to work on a compromised system.
And whatever detection you have in mind to make the algorithm resistant to tampering was _not_ part of the original for-loop. You cannot claim the for-loop is superior to just calling getentropy() because it "can detect" clock tampering, while handwaving away the actual code to detect this clock tampering.
> it's an implementation that is used in a lot of security software (including GPG, not as the sole source of course but as one of many).
It's fine if you use it as a strictly additional source of entropy, but then the whole argument that it is superior because it avoids syscalls goes out of the window, because you're doing strictly _more_ work.
The strength in this method is that it has the littlest possible surface area for upstream bugs to compromise your final entropy. Because, in the applied world, upstream bugs in "secure" system RNGs have been the cause of stolen crypto and other critical security compromises on numerous occasions.
And, I agree that if the system is compromised to the level that the attacker can control the output of the timer, it's probably compromised to the level that the attacker can just read your generated entropy straight from memory.
The point here is not to be fast, it's to be protected against implementation bugs on systems that weren't designed by security professionals.
> Because, in the applied world, upstream bugs in "secure" system RNGs have been the cause of stolen crypto [...]
You mean javascript libraries that do a bit of Math.random() and a miniscule amount of mixing, that had been widely considered poor practice for years while old bitcoin wallet generator websites were burning users with it?
Has any actual serious CSPRNG exposed bitcoin wallets?
This is the one I'm referring to, it used some very dumb `Math.random()`-with-unverified-incantations code that should have been obvious if anyone had just looked at it. This one is responsible for the majority of hackable bitcoin addresses. It's really embarrassing that this kept going until 2020.
(At one point this would have been a tricky situation, though, because around 2009-2013 when bitcoin wallets were first being generated in web browsers, Internet Explorer didn't provide a CSPRNG API. Because of the prevalence of IE, an in-javascript CSPRNG would have been justified as a fallback if it had proper cryptographic mixing of mouse input entropy and perhaps timing execution jitter entropy as well, along with good entropy estimation to decide when enough seeding has been performed to start generating keys. Some wallet websites actually did mouse entropy collection at the time (e.g. https://www.bitaddress.org), but often with dubious mixing. Might have been best to just ban Internet Explorer.)
> Libbitcoin / Milk Sad (2023)
Mersenne twister... likewise should have been identified as not even remotely correct. Not a serious CSPRNG at all. Similar to the CryptoJS case.
> Trust Wallet Browser Extension (2023)
Also Mersenne twister, similar to the CryptoJS case.
> Trust Wallet iOS / Trezor Library
Time-based seeding, with an exceptionally weak PRNG with only 32 bits of state. Similar to the CryptoJS case.
> Android SecureRandom (2013)
This is a buffer bug that caused existing seed data to be overwritten by newer data rather than correctly appending it. The serious cryptographic primitives weren't broken, just the input. But it is genuinely scary. Unlike the other examples, it wasn't immediately identifiable because it gave the appearance that a CSPRNG was being implemented, and being a platform API it is just as scary as the Debian bug in 2008.
> There is a reason so much effort is put in TPM and remote attestation and so on
If you trust TPM not to be backdoored... come on, you don't think the NSA or who else has put effort in getting a backdoor inside? They even tried to put one in Linux and it's documented, never the less in anything proprietary...
> It can just read the generated seed directly from user space without the program ever knowing about it.
Not that simple: it has to know exactly where in memory it's stored, and that requires understanding of the source code of the program that is encrypting data. That is not of course a simple task if someone wants to write a malware that just "steals" encrypted data from any software just by looking at the network traffic, like you would do if you compromise the RNG of the OS.
> clock_gettime() just reads a value that the kernel has set, so that's not particularly difficult to fake.
You can sample the call millions of time and understand if the value is truly random or there is a pattern. It's something detectable. Software like GPG that doesn't trust what the OS gives you already do that (as well as combining multiple entropy sources).
> It's fine if you use it as a strictly additional source of entropy, but then the whole argument that it is superior because it avoids syscalls goes out of the window, because you're doing strictly _more_ work.
Avoiding the syscall could have other benefits, not only performance. For example: a program making that syscall may be flagged by a possible backdoor as a process with something interesting in it, and thus a potential spyware may be interested in take, for example, the memory image of that program and send it to a remote system for it to be analyzed. The fact that the reading of the current time doesn't pass from a system calls means that it's not possible to identify that process as "some process that uses cryptography and thus has something interesting in it to hide".
“Software like GPG that doesn't trust what the OS gives you already do that”
Exactly. The people who are so adamant that one shouldn’t roll their own crypto are people who think we should just blindly trust the kernel to always return secure random numbers which haven’t been backdoored.
Now, in the real world, if they control the kernel’s RNG, they control a lot more than the RNG so any protection is an illusion. But blindly trusting a kernel’s RNG is something that makes some people understandably uncomfortable.
The decision I made to include a secure random number generator as part of my code in 2007 was the exact same decision DJB made to include a secure random number generator with his code in 1999, and it’s a decision I stand by: It never has had a known security problem, the FUD claiming otherwise isn’t backed up by evidence, and it makes a lot of sense in cross-platform code which targets embedded systems.
Any good crypto library will have a solid secure random source that usually combines entropy from multiple sources with a provably secure hash based mixing scheme.
Hardware RNGs can be one source, but no single source is trusted, and they're all combined in a way where even an intentionally malicious source is lost in noise and cannot actually determine output.
Yeah, this comes off as a “they already are on the wrong side of the secure hatch” kind of attack. A malicious hardware device with physical access to a victim’s computer can do a lot more than generate malicious entropy.
It’s like the attacks I occasionally see which are like “once we have administrator, we can attack the process because of this insecurity”. Well, yeah, but once we have administrator, we can read the entire memory of the “vulnerable” process and completely control its output too.
I’ve seen in the real world attacks where things were insecure because the PRNG wasn’t given enough entropy (CVE 2008-0166, Coldcard, etc.). I’ve never seen real world attacks where a PRNG was insecure from getting too much entropy.
That's exactly the challenge though: "any good crypto library" - there is a long history of meaningful security breached (like stolen crypto tokens) due to bugs in an upstream library, especially when using things like embedded code, alternative operating systems, newer programming languages, etc.
The value of the iterated hashing method is that it is dead simple and has little dependency on potentially buggy upstream code; it works even in very lightweight environments designed by engineers with no experience in security.
The reason I roll entropy in userspace is because there's a very long history of "cryptographic" libraries getting it wrong (see the parent article for an example). Crypto tokens stolen because the underlying call to the web browser entropy only had 32 bits of actual randomness. Crypto tokens stolen because the underlying embedded system (like cold card) turned off some security critical features to improve performance and power.
Pretty much the only thing you can control when shipping software to many devices is that it runs on a physical CPU and has a timer. Every other RNG assumption over the decades has shown that sometimes someone upstream gets something catastrophically incorrect.
I wouldn’t trust it as a sole source of entropy, but it can be one of multiple entropy sources to feed in to an XOF to get secure numbers.
The nice thing about using multiple entropy sources with a secure XOF is that the resulting entropy is at least as strong as the most secure entropy source given to the XOF.
TL;DR adding a compromised source of entropy to a pool of already secure sources of entropy can catastrophically compromise the final result.
It's better to source entropy from a smaller number of harder-to-compromise sources.
That's why I like the iterated hashes method; the security surface area is both very small and highly likely to be well tested.
>>>what I'm advocating here, for security reasons, is a sharp transition between
* before crypto: the whole system collecting enough entropy;
* after: the system using purely deterministic cryptography, never adding any more entropy.<<<
Which is exactly how a XOF should be used, and how I used the XOF in my code. A malicious source of entropy will need to perform 2^n operations to control n bits of the XOF’s output, and that’s assuming the malicious entropy source somehow perfectly knows the other entropy the XOF is using.
Yes but why introduce complexity and room for error when something that's extremely basic is also sufficient?
The point here is to eliminate surface area for mistakes, and an XOF has a much larger and more complex implementation than iterated hashing against a timer.
I know that there's a really strong culture in the software world around downvoting anything that looks or smells like "hand-rolled cryptography", but this is my actual profession and specialization within the software world, and most of what I'm seeing in this thread is knee-jerk reactions to an unexpected technique rather than careful intellectual commentary and consideration of the merits of the technique.
I am happy to have a discussion with you at the deepest technical levels of applied cryptography, this is not something I blindly made up on my own. I'm well studied in the field and can readily defend this technique.
I wrote this elsewhere but I felt it was worth saying again. "9x smaller" is an idiom, much like "spill the beans" or "it costs an arm and a leg".
Idioms don't have to make literal sense or be linguistically/mathematically correct to be useful. All that matters is that other people know exactly what you mean when you say it.
And, pretty much universally, if I tell someone "the compressed file is 10x smaller than the original", they are going to know what I mean is that the byte size is 10% of the size of the original.
That makes it an idiom that is perfectly okay for everyday use.
It's an idiom, much like "you are pulling my hair". Are you actually pulling my hair? Of course not; taken literally, many English phrases make no sense. But they are common elements of the language and everyone understands them, so they aren't problematic.
This is the same. Taken literally, "9x smaller" is nonsense, but everyone who hears that phrase knows exactly what mathematical operation you are referring to, thus it's a totally acceptable way to express that you mean to say 11.11% as large.
I get that the political system could be better, but having been to places that actually are not governed by the rule of law, I can assure you that the US is doing quite well on that front. When there is actually no rule of law, consequences include:
+ entire regions / areas where merely visiting those areas invites a highly non-trivial (think, more than 10% chance) chance of being kidnapped or murdered
+ every neighborhood and business has substantial, often military-grade private security
+ if credit exists at all, it exists outside of any formal banking structure and will have interest rates that are north of 30% APR, sometimes north of 100% APR. I've genuinely seen interest rates on credit as high as 2% *per day*, and these are rates that the local population is willing to pay for certain short term expenses (like food)
+ families that maintain good social relationships with the local police/militants/whoever-has-guns live substantially better lives than people without good social connections to the local authorities.
+ Travelers are told on repeat: "it's really not safe here for non-locals, you should stay inside and also reconsider being in this part of the world at all"
+ If the travelers are there for business reasons, they are probably assigned 24/7 armed guards (as many as 4 guards per traveler, each guard carrying full-auto weapons) by the locals, provided for free.
And while the US maybe has a neighborhood here or there which might be like this, every part of every major city in the country has more rule of law than the above.
You will never convince those who think the US is a state of lawlessness that the US is (mostly) a lawful, free and prosperous place. They literally cannot comprehend what living in a corrupt and mostly lawless society is like. They've never experienced anything even remotely close to it. It's like someone who grew up in the tropics and complains that they're "freezing to death!" because it's 50F. Someone from the arctic tells them about what real cold is like... they literally cannot understand.
> They literally cannot comprehend what living in a corrupt and mostly lawless society is like.
I doubt that most Americans comprehend what is living in a well managed citizens-first country were people are represented and many laws are passed just because the working class wants them.
If you compare the USA with the worst places on earth, then it is a good place. I hope that Americans aim higher and want to compare themselves with the best places to live in the world.
What you describe is a goal we should absolutely strive for - and one we are clearly falling short of. At the same time it's foolish to describe the US as being on the opposite side of the spectrum. I dare say it's even dangerous, as it encourages a sense of hopelessness and disregard for laws and civility.
> it encourages a sense of hopelessness and disregard for laws and civility.
That is true. I hope that people sees my comment as a push to do better, not a reason to give up. Things are never perfect, anywhere. And that's why we should continue pushing for more equality, defending the environment and making better the live of working class people.
that's funny, i see hope (reproductive futurity/the child; see edelman, hocquenghem) as what keeps us under the yoke of capital and oppression, and a disregard for laws and civility as a brief act of jouissance and a moment out of time where one could experience actual freedom and liberty. positive nihilism as a praxis that rejects all external constraints, imposed social mores, authorities, etc. it's only dangerous if you're currently benefiting from the various systems of oppression the hold up capital and civ.
I usually compare the US to Switzerland. I live in Boston, but was born in Lugano (southern tip of Switzerland).
Switzerland has an excellent quality of life, far better education system, remarkable stability, and amazingly good healthcare. The companies pay people well, give them adequate time off, and has 16+ weeks of maternity leave.
There are some pretty significant downsides in Switzerland, too. It's highly conservative, hard to make friends with the Swiss, and fairly expensive, depending on where you live.
We live in Boston because of family. It's a decent enough place to live, and from my perspective, just about the closest that the US gets to Europe.
Denmark's been in the top 3 of the "World Happiness Report" since the report started, the rest of the Nordic countries are always near the top of the list, too. Finland has been ranked the happiest country in the world 9 years running.
That seems like a good place to start looking.
(commissioned by the UN, polls are run by Gallup, report is put out by Oxford, and the editorial board is multinational and doesn't have any Nordic nationals; seems reasonably unbiased to me)
It wasn't easy for me to interpret these rankings though, or how they came up with the life evaluation score. More explanation around that would have been helpful. The column headers have hover-descriptions, but they don't really say how the values were calculated.
Anyway - it does seem that Scandinavian countries are well represented at the top. That's not too surprising. Costa Rica at #4 is very unintuitive to me. Viet Nam at #1 for freedom is REALLY surprising to me, having visited there a number of times and having many Vietnamese friends. Likewise, The United States at 104 on freedom seems very weird.
No you got it wrong. Many of us understand it very well, some of us even come from such places.
The thing is, bar for success is simply higher than what US provides, and its not even that hard, just behave like a decent human being. The thing US provides if you don't have US passport is... not worth commenting on.
Americans always fail to comprehend that outsiders judge them by how they act outwards to citizens of other countries.
Precisely 0 of your presidents were ever punished for any action against citizens of other countries, despite starting aggressive wars, breaking peace and massacring people, or helping genocidares and war criminals escape justice, attacking international institutions that try to prevent that, etc.
>Precisely 0 of your presidents were ever punished for any action against citizens of other countries
How many presidents were EVER punished for actions against citizens of other countries, unless other countries forced the president's country to do this (for example by winning a war)
> Americans always fail to comprehend that outsiders judge them by how they act outwards to citizens of other countries.
Americans are not their government. Judging individuals based on the actions of their government is the type of ignorant behavior that breeds exactly the type of tribalism corrupt government officials are able to thrive in.
Rule of law is when laws as written by legislators are executed by the government as written and, when appropriate, judged by the judiciary as written, and at each step the words as written supersede the whims and feelings of the people involved. It doesn't imply that the state can't do anything meaningful because it's so hamstrung.
Statements like "the US does not have the rule of law" are laughable Reddit-tier comments that just make me sad for the current state of HN.
The president and his cronies are openly immune to any recourse from the law at the moment. They are doing widespread and overt corruption and insider trading on a daily basis on scales that have never been seen in human history before. There is not any attempt at stopping that by any organ of government.
Separately, internal security forces have been killing citizens without any cause nor investigation after the fact, in contravention to all of the supposed "rights" those citizens were once said to have.
These are the things the rule of law is about. It is meant to be a higher power than any individual, no matter their position.
The U.S. does not have the rule of law any longer. It's best to look the truth in the face rather than hide from it.
Mostly you should assess rule of law by threat to you and people you know and not by what it seems like other people are able to get away with.
Yes, a big part of the idea is that laws are meant to also apply to the powerful, but it's difficult to accurately assess situations that are far away from you.
What a nonsensical statement. From a distance it’s pretty clear that there is no rule of law anymore in the USA. Yes, it’s partially functioning, but that’s not the rule.
If you're a cop, ICE agent, your neighbour is black, you're a US diplomat's wife (one of which murdered a young man here in the UK and ran away with no consequence, and the American state refused to send her murdering arse back), or you have enough money, by the looks of it you could do that without consequence.
I’m more inclined to agree with you, but the replies to this did strike me as darkly funny. These exceptions for the chosen in-group are some of the hallmarks of fascism, and this administration has leveraged several other popular tropes as well—fetishizing Greek/Roman mythologies, hobbling academia and the press, ethnic cleansing, Christian Nationalism, revisionist history, idolatry, eugenics, etc.. Fascism is a term I would have called absurdly exaggerated just a few years ago, but to the extent that the President and his administration are the leaders in both policy and diplomacy, I think it’s probably fair to level a judgement that their behavior is the contemporary set standard for the United States. This is a fascist country right now.
But I agree with you that nuance-free oversimplifications are likely unhelpful in any meaningful discussion.
These things don’t usually happen overnight, and for the vast majority of the public it will never be directly visible. It’s not like someone flips a “Anti-Antifa” switch and a bunch of ultra-starched uniformed troops start goose-stepping through Toledo. It’s a developing series of dynamic events, many of them will seem rational, justified even, but the result is concentrated executive power, a toothless legislature, a complicit judiciary, and a pliant mainstream press. I’m sure there are lots of people who will recognize these for what they are: an alarming number of dominoes falling towards a totalitarian dictatorship.
However the United States is a big, complex beast of a country, and the judiciary has not been fully captured, and neither has the legislature. All we need to do to stop this creeping authoritarianism is show up in-force and vote overwhelmingly against it this November. They will obviously try to confuse the issue with any close calls, and use such opportunities to assert dominion over local/state governments. We cannot let that happen. The best way to avoid such a scenario is to show up strong enough to make the results beyond question. That’s the ultimate test that we are still a nation of laws, and I am cautiously optimistic.
What? No. Rule of Law should be assessed by how well the law applies to everybody. The wealthy often get away with serious law breaking in the US, the poor are hammered down with the law over petty crimes. That is defying the Rule of Law any way you try to look at it. The whole point of The Rule of Law is to prevent unfair application of the law to benefit the few over the many.
It takes months or years for courts to intervene and even then they often set aside rulings because they expect appeals. All the while the abuses continue. How many years do you suppose we'll have to wait to see the Trump family subject to tax law?
> It takes months or years for courts to intervene and even then they often set aside rulings because they expect appeals.
Interesting. Again, how do you reconcile that theory with the with the large number of court cases involving Trump's specific actions that managed to make it all the way up to the Supreme Court, leading to many clear rulings against Trump, all within the first year and a half of his current term?
U.S. democracy is still very strong and freedoms are protected, when compared with with other superpowers like China, Russia. My personal metric for comparison is: in those countries if you would make public jokes about the leader of the country to a large audience, at best you would end in prison, at worst you and your family would be death.
Dictators expect that people fear them, they control by fear and terror. If you can make jokes about leaders you show that you don't fear them, you show that they don't control you.
But the increase in corruption in US goverment indicates slow progress towards authoritarianism. This can be slow process, it can take years or decades, as was seen with Hitler and Stalin.
ICE excessive force use, encouraged by Trump and welcomed in large part of US population, could be the next step. This piece by the German Lutheran pastor Martin Niemöller describes the progression of authoritarianism:
First they came for the Communists
And I did not speak out
Because I was not a Communist
Then they came for the Socialists
And I did not speak out
Because I was not a Socialist
Then they came for the trade unionists
And I did not speak out
Because I was not a trade unionist
Then they came for the Jews
And I did not speak out
Because I was not a Jew
Then they came for me
And there was no one left
To speak out for me
No, momentary abuses of power do not mean the US has no rule of law. The law is what put Trump in office in the first place.
If you aren’t glued to the news and doomscrolling you wouldn’t know anything about Trump and ICE. Day to day for nearly everyone is exactly the same rule of law where you can call police for a murder and roving gangs can’t setup shakedown checkpoints.
> Day to day for nearly everyone is exactly the same rule of law where you can call police for a murder and roving gangs can’t setup shakedown checkpoints.
Is that your threshold for "rule of law"? And I'm sorry, but what separates ICE from a roving gang setting up shakedown checkpoints, and executing at point blank range with no repercussions dissenters?
That’s how the US got here in the first place. Not much of what the president and his friends and family are new to the US, now its more daring and freely talked about and normalized, like in a state where there’s no rule of law. You don’t need to be glued to doomscrolling to learn that a government is turning laws to punish terrorists inwards but you need to be glued to something to know its been in the making for over 20 years.
Excuse me. The law(14th Amendment section 3 specifically) clearly prohibited Trump from being eligible for federal office. That the Supreme Court abrograted state's rights to run elections free of federal interference, not to mention the lack of recusal given the blatant conflicts of interest, is a separate matter altogether.
> If you aren’t glued to the news and doomscrolling you wouldn’t know anything about Trump and ICE.
This is such an outrageously privileged and out-of-touch statement. Maybe YOU wouldn't know about Trump and ICE if you didn't read the news, but that's your personal microcosm. Please be more mindful about damage and harm done when you're ascribing your personal worldview onto others' actual reality.
When the president can just pick the judges he wants and then have them change laws that have existed for decades on a whim, any kind of meaningful rule of law is absent.
Reddit-tier comment, says the guy whos never had his face smashed into the hood of a car by a sheriff deputy. We got something in the US and it often wears robes and badges, but it's not law written by legislatures.
Does anyone remember when you posted on a place like Something Awful or Facepunch getting banned for a day for saying something so fucking stupid you needed to learn a lesson? No? Anyone?
The quality of the posts in Reddit grew worse and worse. To the point that I stopped visiting it frequently and my use of hacker news grew and grew. Exactly the same thing is happening to hacker news. I guess as it's reverting to the mean.
There's still reasonable civil debate here. But recently I was surprised to be called a fascist for pointing out the Nazis were national socialists. The poster included comments like "don't engage with this person he's obviously x y and z." I'm starting to see this kind of nonsense more and more on hacker news.
When you can't trust your highest court is impartial the whole system is untrustworthy. Unfortunately the US system is designed in such a way that the highest court can't be trusted (life terms, appointed by the sitting president).
> the highest court can't be trusted (life terms, appointed by the sitting president)
Do you really think that judges that have to run for reelection every few years can be more trusted to rule on cases fairly, according to the law, rather than bending to popular whims?
Supreme court justice positions should be limited to around thirteen (or some other prime number) years and should have mandatory cognitive capacity tests given yearly that are videotaped and broadcast live. The tests should be written by a nonpartisan panel of doctors chosen randomly from an applicant pool like a jury and refreshed every five years.
Look at the UK for a much better system. It's got problems too but there's no concept of stacking the court in your favour because you were lucky enough someone died while you were in power.
The US just has a bad system. It’s easily influenced by money and politics and that’s exactly why the rest of the world considers the US a ruled by money instead of the law.
You really think someone who didnt speak for decades and gets rvs for gifts and cannot be taken out of office cares about anything other than the soft power social system hes in? Whose wife sent texts about jan 6th insurrection? Bad faith be bad faithing
Low standards for you doesn't change the higher standards the US is designed to have. People voted very badly by not rejecting republicans. That does not mean those who did not should give up on restoring higher standards. States do have powers too.
Man while reading your points i was thinking your last sentence will be a sarcastic note that implies that these points all do actually apply to the US. Of course the US as a whole is not comparable to other parts of the world where these points absolutely apply but points 1,2,4 and 5 seem to apply to a significant extent.
What parts of the United States can you visit which have a >10% chance of being kidnapped or murdered? That means for every 100 visitors, 10 people don't come home. I honestly don't think that applies to a single neighborhood in the entire country. If murder/kidnapping rates get remotely close to that high, the FBI steps in.
I also can't think of any US cities where neighborhoods have military grade armed security. Sure, there are places where every local business has an armed guard, but that's not really the same as hiring a trained private militia. The armed guards are for protecting against petty theft, not for protecting against organized crime.
On point four, I'm not sure if there are places in the US where minorities need to maintain relationships social relationships with cops as a survival mechanic, but it certainly doesn't apply to most cities, and I don't think it applies to anyone who is white.
On point five, I don't think you understand. There are parts of the world where having white skin will get you, quite literally, reminders every 15 minutes "hey it's really not safe for you here, do you want to hang out inside my shop while I call you a taxi?" No part of the US is like that for travelers. I know there are occasionally ICE raids that make the news, but "hey you strictly cannot be outside without a local chaperone" is just not a thing in the US.
this sounds like an absolutely wholesome story where multiple strangers donate their attention and time to help somebody who was not a victim in any way but just merely lost.
I wouldn't want my wife lost in Compton either but if the good guys outnumbered the bad guys by Inf% then it must not really be that bad. What would happen if it were Kinshasa instead of Compton.
Point 1: I said "to an extent" but i concede that it is nowhere close to 10%, but isn't murder state law? The FBI does not step in for that or does it? And the homicide clearance rate has dropped to 50% (72% in 1980) in recent years, for half of the murder nobody is ever held accountable.
Point 2: I was thinking that the most heavily armed private citizenry counts as "private security". More guns than people. Also far more private security guards than cops. To me that is exactly what "private security everywhere" looks like.
Point 4: To be honest i think point 3 actually applies to any place anywhere. Someone who knows the local police gets away with far more shit in my small german village. But "doesn't apply to anyone who is white" clearly is a sign of lack of rule of law. Laws should be race-independent and statistics show that in the US it's anything but.
Point 5: No chaperone-level warnings, but the UK, Canada, Germany, Australia, Japan all issue standing travel advisories about US gun violencem, the UK literally tells citizens "try not to walk through quieter areas alone, especially at night." And there were recommendations i got against business travel to the US especially with company issued equipment.
I mean, man, currently the US is not looking good from my point of view.
I have a bunch of american friends who say immigration and everything else is ruining Germany. But looking at the stats it's looking quite okay:
Germany vs US:
- Murder: 0.91 vs 5.7 per 100k
- Rape: 14 vs 40 per 100k
- Violent crime overall: 253 vs 380 per 100k
- Murder/homicide clearance: ~95% vs 50%
- Private security guard to police ratio: 0.9:1 vs 1.9:1
- Police killings: 10 vs 1100 per year
- Incarceration rate: 67 vs 600 per 100k
The highest incarceration rate in the developed world, ~4% of the world's population, ~25% of its prisoners. Are Americans just incredibly prone to being criminals? No. The crime rates above show the violent crime gap is ~1.5x, not 9x, and property crime is comparable or even lower than Germany's. ~95% of convictions are plea bargains extracted under threat of a "trial penalty", hundreds of thousands sit in jail pre-trial because they can't afford cash bail, and sentences run far longer for the same offenses. The US locks up 9x more people because it chooses to, not because Americans are more criminal. A state that imprisons its own population at Cuba and Rwanda rates while half its murders go unsolved, sells bail to the highest bidder, and runs on guilty pleas instead of trials. I would not correct anyone if they told me the US was not governed by the rule of law.
I do like the idea of forcing due process to access an encryption key. I'm not sure if that idea is compatible with current law, but it seems just at the very least.
I just wrote a utility to rip all comments out of the code. Now the code is fully uncommented and it has saved lots of input tokens and also lots of meandering because the model is no longer getting stuck on bad ideas it told itself about.
Besides technological progress which has nothing to do with this effect and would have happened anyway, what's the value that we didn't have 30 years ago?
It’s so incredible to me that now we have a chat interface we can ask about anything in any language and get really great answers, something literally considered science fiction a few years ago, and people still act like that is no big deal at all. No value in something like that! Don’t tell me it’s inaccurate, I strongly believe it’s way more accurate than if you could ask an expert in each topic , which of course you couldn’t and even if you did, you would most likely not want to since you would get a lot of “you don’t actually want that, you want this unrelated thing, trust me I am better than you”. Just remember StackOverflow (depending on how young you are perhaps you never even heard of that given how much AI has eclipsed it)!
>It’s so incredible to me that now we have a chat interface we can ask about anything in any language and get really great answers, something literally considered science fiction a few years ago, and people still act like that is no big deal at all.
Because the importance of this is all about perspective. It wasn't like these systems created this information out of thin air. They were trained on something. That means the answers they are giving you have been available for decades. You just needed the know-how to find that information and synthesize the answers yourself. To many of us, it's like going from the old physical card catalogs to a modern digital system that would have seemed like sci-fi to a prior generation too. It's definitely more efficient and easier to use, but people acting like it's revolutionary seem to be suggesting that the old system didn't exist or wasn't usable with a little effort.
> You just needed the know-how to find that information and synthesize the answers yourself.
So easy , right?? No one needs a machine that can do that automatically over huge amounts of data and that can clearly communicate results in a way the user can clearly understand in their preferred language!
> I strongly believe it’s way more accurate than if you could ask an expert in each topic
You can believe anything you want.
I can also believe that the only thing that has gone up in the last 30 years is billionaires' worth, and amount of idiots saying things they don't know anything about.
I strongly believe this. Don't tell me it's inaccurate.
The meaningful comparison is that technologies are not industries. What even is the internet industry? There was a brief time in the 1990’s when that was a thing, just like AI will be subsumed as a technology in actual industries in the next decade.
reply