Products I Wish Existed - <AUTHOR> http://blog.eladgil.com/2020/01/products-i-wish-existed-2020-edition.html <comment><USER2> +100 "I would love to see the following analysis: A map of repetitious tasks, spreadsheets, and manual data extraction by function in the Fortune 500. Budget breakdown of current software spend, by function, by line, in the Fortune 500. A view of what Accenture, CapGemini, and Deloitte keep building over and over for large enterprises. Undoubtedly a subset of these custom consulting projects can be turned into SaaS software. A tougher analysis to do is to ask what internal software projects various tech companies are working on. If you can get the list from 3-4 companies, you will undoubtedly see a few internal tool or product examples that should be built as a SaaS product for everyone."

<comment><USER3> >Global 2000 company IT needs.

Splunk is a good example of this. I've worked at several public and private muti-billion dollar orgs, and they all rant and rave about how good Splunk is over whatever else they were using.

So, build more splunks. Maybe something that aggregates monitoring multiple servers. A plug and play Status Dashboard for a company's internal apps. Like this: [https://www.google.com/appsstatus#hl=en&v=status](https://www.google.com/appsstatus#hl=en&v=status)

<comment><USER4> If you knew the technologies/software that Fortune 2000 companies are spending the most on, you should build complementary products, or similar things that solve the same problems those products are solving?

<comment><USER3> I think there's value in both. Consider Duo. They took a common problem - authenticating servers and services with 2FA - and made it easy to add to existing infrastructure. There's not really a consumer use for this product, aside from maybe a VPN, but there's absolutely a huge demand for it in business.

I worked on many CRUD apps that had say 4 different groups of users. We made a library / system for determining what "level" a user is, based on what Active Directory roles the user is assigned. In the application, you can show or hide components based on this level. Making some sort of middle-ware that abstracts things for developers, so they don't have to think about things like AD, is a huge area of opportunity.

<comment><USER4> There's no way to determine the total spend for specific software/technologies for Fortune 2000 companies (unless you can somehow survey them, or have an insider).

So what proxy method would you use to determine that Fortune 2000 companies are spending twice as much on Splunk as they do on New Relic (for instance)?

</comment></comment></comment></comment></comment><comment><USER5> #2. I've had an idea I've mulled around for a couple of years now about a new social network. One which limits your 'feed' to 25 friends and that is it.

25 might even be too high (or potentially too low; the number is arbitrary), but the general idea is that in your life there are only a handful of people who you should really care to keep tabs on. You can "friend" more than 25 people but you can only see the activity of 25 of your friends and the others are relegated to essentially being contacts.

I remember about two years ago Facebook was getting into a lot of trouble due to the amount of negative mental impact it had/has on its users and they did a study which found social media can have a negative impact on its users unless the user only follows a small circle of real-life friends and interacts with those people online. I don't have a source to this; I'm willing to accept there isn't real _evidence_ behind this claim.

Anyway, I'm surprised social media has been around this long, has been the subject of such controversy and there haven't been any or many real, impactful changes to the nature of it. Facebook and Instagram are, in my opinion, trying to be too much. They want to combine personal and public spaces. This, of course, works from a business perspective. But what are the long-term consequences of these products on our mental health and society?

We need a new social media focused on personal, tight-knit groups of people and interests. One that makes this the focus and doesn't stray for the purposes of profits. And, if that's not feasible in an economy that demands growth, we need better legislation demanding certain consumer protections are created for this sphere of products.

<comment><USER6> Can't that be achieved by simply Facebook offering an option for feeds of manually created group by you? Like you create a group called closefriends where you add your close friends and family upto 25 members. Then a feed for those people only shows up?

Almost similar to where each user is a subreddit and you create a multireddit.

<comment><USER7> Facebook is a video game where you honor the groupthink for max followers and upvotes; something like the 25 followers can be emulated but if you're the only person playing the new game, its not going to be a fun game because everyone else will have higher scores due to no made up limitations.

</comment></comment></comment><comment><USER8> >What would be a network which allowed for more thoughtful discourse? Or at least the ability to more actively mute topics, threads, and groups of users while surfacing better content algorithmically?

I would be interested in a parliament-like protocol for discussion, structured debate and reaching consensus.

We currently have tools for proposing changes to text documents (such as pull requests) which could be applied to a community rules/laws or values system, but we don't have anything that can debate the changes, log objections, track resolutions and compromises in a structured way.

I've seen places where community decision making is emergent (e.g. autobans when a users reputation drops below a certain threshold or votekick in games) but nothing that formalises the process, allows review of results, links decisions to overarching principles (or notes where a principle has _not_ been followed due to circumstances).

<comment><USER9> To add to this concept, it would be great if the elements of a quality argument[1] (i.g. Claims, Counterclaims, Reasons, Evidence, etc.) were built in. Also people could flag a comment (or parts of it) with a specific logical fallacy[2].

It would help guide people into arguing more fruitfully and better digesting what they read.

1\. [https://study.com/academy/lesson/parts-of-an-argument- claims...](https://study.com/academy/lesson/parts-of-an-argument-claims- counterclaims-reasons-and-evidence.html) 2\. [https://yourlogicalfallacyis.com/](https://yourlogicalfallacyis.com/)

<comment><USER10> It would be great to show arguments as processes (data, model(s), evaluation/claims), and other arguments as specific problems with the process (logical problem, bias, low quality data, bad statistics, etc..)

Ultimately everyone should be able to agree on the data, the model and the evaluation separately. The differences should boil down to differences in personal assumptions (different Bayesian apriori distributions, eg. different morals, worldview, thresholds for things, etc.)

This should lead to questions about stuff that is either subjective and thus people can agree to disagree, or to simpler objective problems. (For example that data collection methodology leads to higher uncertainty than claimed, hence the whole argument becomes inconclusive.)

</comment></comment></comment><comment><USER11> > NoCode/LowCode (letting anyone build an app with a spreadsheet as a database > representation)

AirTable has made huge inroads here. I'm also building something in this area ([https://lightsheets.app/](https://lightsheets.app/)), turning slightly back towards spreadsheets instead of databases but then building enhancements and modern integrations on top. I think there's still lots of potential in this area, despite spreadsheets being 50 years old.

<comment><USER12> Airtable did some great work on the UX. Introducing people to table schemas with typed columns is pretty awesome, and the creative way they've leveraged that with the little tab that comes out of the side for either a nice view over the data (e.g. a map for an address column) or for showing Pivot Tables/Aggregations. They deserve some design awards for those ideas.

But it's not a great alternative to a DB. It's really expensive per seat (twice the cost of Google Apps and you only get one app). The row limits on tables are too low. And I'd really like native webhook support to ingest row updates.

I'd be very interested an Airtable clone that I can run locally on-top of Postgres or Mongo or something like that. My main use-case would be to replace expensive-to-build internal CRUD apps that really should just be spreadsheets but require bespoke integrations with other internal systems.

<comment><USER13> Airtable has done a great job with their UX!

I've started working on a similar platform where the goal is to make building CRUD apps wildly simple. The plan going forward will be to layer on more sophistication after the core foundation is extremely solid.

The platform uses Mongo for the dynamic data tables which is a game changer for tools like this. Postgres jsonb data would also work, but Mongo just feels more natural to me.

I've named the platform Webase. Check it out here: [https://www.webase.com](https://www.webase.com)

Note: this is very basic currently but consistently getting better!

<comment><USER12> Hey I made an account but only see

> You have not created any apps yet.

with no way to create an app that I can see

</comment></comment></comment></comment><comment><USER14> #4 is a no-go in my book.

Things like Ring, Nextdoor, and Facebook already exist. Nextdoor and Facebook are riddled with inanity, from political rants to dumb jokes to hoaxes to common scams to law enforcement rants.

I don't want more information from my neighbors -- 99% of it is garbage. I want highly-filtered information. Basically, a neighborhood watch but with an aggressive spam filter. Right now I glance at the various neighborhood feeds with one eye closed, sifting through the intense stupidity, trying to capture valuable intelligence.

Of course, all of this may be a dumb corporate-run idea and maybe people should really focus on forming good relationships with their neighbors in meatspace and talk to them in person aka HUMINT.

<comment><USER15> The "SaaS-ification" of security cameras should also worry us. Ring — not its customers — controls the videos taken with their cameras, creating a video surveillance network that the police can access without needing a warrant. They've partnered with 400 police forces to give them access to that data [1]. Although they claim to let customers deny police requests for footage, their terms of service allow them to hand video over to police if they deem the request "reasonable".

And it's not just Ring customers that are affected, it's anyone in the general vicinity. If your house is in the field of view of a neighbor's Ring camera, you're being surveilled too.

[1] [https://www.washingtonpost.com/technology/2019/08/28/doorbel...](https://www.washingtonpost.com/technology/2019/08/28/doorbell- camera-firm-ring-has-partnered-with-police-forces-extending-surveillance- reach/?arc404=true)

<comment><USER16> > Although they claim to let customers deny police requests for footage, their > terms of service allow them to hand video over to police if they deem the > request "reasonable".

Defining what is a "reasonable government request" is a valid question, but it's really just not that high of a bar to get a records subpoena/search warrant for video like this. Courts sign off on those routinely, so I don't think you can really expect Ring or any company that holds your records to deny police requests for very long.

The system they have seems pretty balanced. The police look at the ring website to see who has cameras (they could figure that out by walking the neighborhood), they ask for the footage (instead of knocking on the door), they get turned down (or not), they get a warrant, the footage is released. Ring is reducing the overhead of asking somewhat, but they're not enabling mass surveillance or building AI systems that track suspicious people across multiple ring devices.

Is there something I'm missing here? If you record video of your front yard, and the police want to see it, they have a right to, subject to the normal judicial review.

<comment><USER17> > Is there something I'm missing here?

Yes. If Ring had even the _barest_ shred of ethics, they would client-side encrypt the videos stored in their cloud. It would use no extra space. The user would have to explicitly approve the decryption and sharing of videos.

But they don't, because being able to access and datamine those videos is a huge money-maker for them.

Ring is terrible, but their engineers willing to implement this corporate surveillance state? They're the worst. They wield their software skills as a mercenary would a weapon against innocents. I seriously cannot even comprehend how they sleep at night and look at themselves in the mirror in the morning.

At least folks over at Apple are sane and are making sure that HomeKit surveillance videos are client-side encrypted.

<comment><USER18> And then the second someone lost their phone, their camera becomes worthless and they can't view their videos.

The average user can't be trusted to manage client-side encryption keys reliably.

<comment><USER17> No? You can derive a key from a password.

</comment></comment></comment></comment></comment></comment><comment><USER19> Products I'm glad do NOT exist:

 _4\. ADT 2.0: Digital neighborhood watch._

Ring is gross enough, thank you very much.

<comment><USER20> It already exists in apps for nosey neighbors like Nextdoor

<comment><USER21> Aka: "I see a suspicious looking Black Guy in our suburban neighborhood. It looks like he is breaking into a house by using a remote to open a garage door and driving in."

<comment><USER22> Yeah, my Next-door has a lot of that. They aren't that obvious though. I like to call them out.

"I saw a suspicious man walking down the street!"

"What made him suspicious?"

"He just doesn't look like he belongs here."

"Why?"

"He's black"

"Being black isn't suspicious"

I then I get an email from Next-door about my comments being reported!

</comment></comment></comment></comment><comment><USER23> About new social networks, I am building one that I am calling _" a quiet social network"_.

Copy/pasting from my landing what it means:

A personal journal and a social network that will provide a quiet space to reflect about yourself and also to nurture your long term relationships with the people that you care about.

 _Why "quiet"?_

Because this social network won't have the frenetic rhythm of news and updates of all other social networks.

A quiet space is just as quiet as the quietest sound. Quid Sentio is being designed so you will only listen to your voice and the voice of your close ones. A digital space to cultivate conversations more meaningful than the loud noise of social media and more long-lasting than the unsearchable small talk of instant messengers.

Quid Sentio is for you if you want to...

Avoid the deafening rumble of the crowds. You will only see public entries from people that have both being included in your list and included you in their list. No stranges following you (or even knowing you have an account).

Avoid the tiresome grumble of the acquaintances. There will be no way to search for people on the site or to see a list of your friends' friends. Also, there will be a limit of people you can add to your list without reciprocity, so no way to spam everyone in your contact list.

Avoid the popularity contests of perfect lives. There will be no way to like entries, only conversations. Also, there will be no way to share content outside of the list of who posted. So no way to go viral and no instant rewards.

Avoid the manipulative tricks of addiction dealers. All the design decisions above already point to a social network with less activity. Adding to that, you won't see any advertising on the site, so there is no incentive to keep you aimless wandering around here. Stay as long as you need to connect with your family, your close friends, and yourself. Then leave.

Avoid the news, the memes, the FOMO. As the posts all follow the same design of journal entries, with no images and no special treatment for external links, you will probably won't see much news or click-baity articles, unless a close friend wants to comment on them. Also, no company accounts either.

If you are interested: [https://www.quidsentio.com](https://www.quidsentio.com)

<comment><USER24> Your web site isn't loading at all for me. Glancing at the console it looks like you have a timeout error, and the loading gif just runs forever.

Chrome Version 79.0.3945.88 (Official Build) (64-bit)

<comment><USER23> Thanks! If it is the same bug that I experienced, if you refresh the page it will probably work.

I am a 3-week vacation right now, away from my development laptop, but I will investigate this bug better and solve it once I'm back

</comment></comment></comment><comment><USER25> I can't say as I like his take on the longevity industry. It is the take that will produce few meaningful advances, the "looking under the lamp because that's where the light is" way of approaching life. Just more marginally better drugs that do a little bit more than those of 10 years ago.

Sadly investors probably care very little from a financial position as to whether a drug works or not, as their exit usually happens somewhere between trials at Phase 1 and Phase 2. Earlier in the longevity market because it is hot.

I've put together Request for Startup lists for the longevity industry for the past few years, based on fairly detailed insight into the state of the science.

[https://www.fightaging.org/archives/2019/02/request-for- star...](https://www.fightaging.org/archives/2019/02/request-for-startups-in- the-rejuvenation-biotechnology-space-2019-edition/)

[https://www.fightaging.org/archives/2017/12/request-for- star...](https://www.fightaging.org/archives/2017/12/request-for-startups-in- the-rejuvenation-biotechnology-space-2018-edition/)

[https://www.fightaging.org/archives/2016/12/request-for- star...](https://www.fightaging.org/archives/2016/12/request-for-startups-in- the-rejuvenation-biotechnology-space-2017-edition/)

Because things move slowly in biotech, just about everything in these documents except for more senolytics is still valid.

<comment><USER26> Love your blog! Recently got interested in longevity research, as I was surprised how much closer to reality it is than I imagined, and also as a possible future industry to work in, and your blog has been one of the best resources to both get up to speed on the topic and also keep up to date!

As you are as familiar as few people are with the topic, I'd like to ask you for some advice, if possible: What do you think is the best way for someone like me (currently biochem undergrad, with ~7 years broad software engineering experience), to have an impact in the field?

<comment><USER25> Any bio* field can lead to working on treating aging; at undergraduate level you have tremendous flexibility as to which direction you take. For now build connections. Go to the conferences where industry meets science and meet people (Undoing Aging, Ending Age-Related Diseases, Longevity Therapeutics, Longevity Leaders, etc). Figure out who the people are you'd like to work with. Either for the corporate path of interning with companies working on aging, leading to a scientific position with one such company, or for the academic path of postgraduate work with a research who is doing something in aging that you find interesting.

<comment><USER26> Thanks for the response!

</comment></comment></comment></comment><comment><USER27> I fail to see how TikTok is a "good reminder for the generational turnover of social products". Has an entire generation passed since Vine or Snapchat? If anything it's proof that securing an early lead in a new form of media (short form video in the aforementioned cases) doesn't guarantee success even for a generation. My takeaway is that young people are increasingly mercurial and disloyal. Chasing their attention seems like a recipe for disappointment.

<comment><USER28> The lifecycle of a social media should be measured by some % of pairs of children and their parents both using it. It's an instant buzzkill.

<comment><USER29> And businesses.

This rule still holds true today. When I talk to people in their 20s and younger these days about Facebook, for instance, the near universal reaction is "Facebook is for old people and companies". They're all using something else.

</comment></comment></comment><comment><USER30> Purple Air hits on a bit of the neighborhood pollution sensor idea: [https://www2.purpleair.com/](https://www2.purpleair.com/)

I've used their API to look at California wildfire data.

<comment><USER31> Their API is great. I found their site a little slow for something I want to check regularly so I built a faster one based on the API:

[https://aqi.today](https://aqi.today)

If there's a PurpleAir sensor near you, it will show you the reading instantly. It also updates the favicon so you can leave it open in the background and check the reading just by glancing at the tab.

<comment><USER32> This is great! saved to home screen on iOS for convenience

</comment></comment></comment><comment><USER33> > What would be a network which allowed for more thoughtful discourse

We used to have this and it was called forum (phpbb and such). They have been oblitared and we moved to Facebook apparently leaving our brains behind.

In reality we are victims of armies of psychologists optimizing for engagement.

I have the feeling forums will come back though.

<comment><USER32> We didn't leave our brains behind, this is just the internet without heavy handed moderators keeping subforums organized, discussions on topic, and putting the brakes on flame wars. Of course things crash and burn in an environment of total anarchy like what is seen on social media websites, image boards have taught us that decades ago.

<comment><USER33> Yes, we didn't leave our brains behind. The environment in modern social media rewards the wrong type of interaction.

</comment></comment></comment><comment><USER34> #1. Trinet for full-time remote/distributed workers. I've spent countless hours researching Global PEOs and reviewing their often poorly written contracts. If a reputable service existed that allowed us to hire in any country without having to form our own corporate entity in that country, we'd be ready to sign yesterday. Unfortunately, all existing services are either:

* Too new (There are promising upstarts, but they usually don't operate their own entities and it seems risky to route all our IP ownership assignments through a tiny company)

* Too expensive (massive markups on what should be a standardized service)

* Too incompetent (One PEO sent us a contract for a Canadian employee that assigned their IP in accordance with US law. It's facepalm-bad sometimes).

<comment><USER35> What does PEO mean and what existing services have you found?

<comment><USER34> PEO stands for "Professional Employer Organization" and is an American term for a company that serves as the legal employer for the people you want to hire. For example, see [https://justworks.com/](https://justworks.com/). When an employee joins our company, they legally become an employee of JustWorks, but we're the practical employers. It's purely a legal relationship.

This is welcome the USA government because they know these companies help us achieve compliance better than we could on our own. JustWorks has been great, but only employs people in the USA. When we want to employ someone outside the USA, we therefore need to find a "global PEO." These companies are sometimes called "Employers of Record."

Popular Global PEOs are:

\- Globalization Partners

\- Elements Global

\- Capital GES

\- Pilot.co

\- Lots more.

But it's a highly fragmented market and has been a pain to engage.

</comment></comment></comment><comment><USER36> While only a footnote, I like the nod to nuclear energy.

I remember in the 1950s, there was a Popular Mechanics cover touting nuclear as a coming technology to power homes and even cars.

Imagine the next Tesla-like company offering to install a small nuclear reactor in houses. Like solar, you can sell electricity back to the grid, charge your electric car with it, literally use it to heat your water....

Also might be a very attractive option to going off-grid.

<comment><USER37> Yes, absolutely.

Today's modern reactors are night and day compared to Chernobyl/Fukushima era reactors - they're not even comparable. They're fail-safe rather than fail- deadly, and are much more compact and efficient, with better controls and containment. The size of the reaction chamber is basically that of a household washing machine.

I'd gladly live next door to a modern plant.

<comment><USER38> Sorry for being pedantic, but do you mean fail-secure? Fail-safe = things inside the area can get out on failure. Fail-secure = things cannot get out i.e. catastrophe is contained (though people inside may die).

I don't know much about reactor design, but I don't think I'd live next door to a fail-safe plant, but please correct me if I'm misguided because.

<comment><USER39> In general, fossil kills 4-6 million people per year from air pollution. Nuclear has killed ~4000 total, ever. So nuclear plants are very, very safe compared to normal energy alternatives.

Fail-safe just means that if equipment breaks or a human does something wrong, the plant goes to low power and passive natural-circulation systems kick-in that keep the low-power shutdown mode from going to temperatures high enough to break the radiation containment structures.

</comment></comment></comment></comment><comment><USER40> I'd love a service that puts me in touch (for a fee) with an engineer/someone above level 1-2 support from Google/Amazon/huge corps

When dealing with companies that are above a certain size, it takes days or weeks to get to someone that can fix issues, but if you're lucky and you have a friend that knows someone who works there he can expedite your ticket. This service would work like that, a friend that puts you in touch with people hired at big corps.

I'm aware this service would have a number of potential issues, such as how to get employees on the platform without annoying their employers, or how to prevent abuse/bribes, but if somebody find a way..

<comment><USER41> That seems like a nice idea to develop as a side hustle. Not sure if it would be so much of an issue, as websites like [https://www.teamblind.com](https://www.teamblind.com) exist. I'm more worried about the user acquisition tbh

</comment></comment><comment><USER42> "A view of what Accenture, CapGemini, and Deloitte keep building over and over for large enterprises. Undoubtedly a subset of these custom consulting projects can be turned into SaaS software."

I love the idea of figuring out how we can stop reinventing the wheel. Too much of this work really has no benefit to society yet keeps getting done, over and over. I wish for a way to pull the brakes and re-evaluate what it is that we are all doing exactly, and for whose benefit.

</comment><comment><USER43> > 1\. Trinet for full-time remote/distributed workers.

[Boundless]([https://boundlesshq.com/](https://boundlesshq.com/)) is a startup that is tackling this exact problem through automating the entire "employe(e/r) of record" process.

<comment><USER44> Co-founder of Boundless here, thanks @hailpixel for the shout out.

AMA! Here's a link to my soundcloud, we're hiring, thanks for coming to my TEDx talk.

We _are_ hiring though.

<comment><USER23> Any jobs page? Couldn't find it on the site linked above.

I am frontend developer looking for a remote position

<comment><USER44> Drop me a mail: email@example.com

</comment></comment></comment></comment><comment><USER45> The author seems to have put more thought into what _can_ exists, as opposed to what _ought_ to exist.

<comment><AUTHOR> This is purposeful. These are just some products I want.

There are a lot of things that _should_ exist but are harder to do: -Safe, cheap nuclear power -Longevity drugs (I am involved with two companies in that area) -Independent journalism school/foundation -Pioneer on steroids (how to identify and nurture the top global talent for every area of human endeavor) -Etc.

But that is perhaps another post / different topic.

<comment><USER46> I think GP's point is that some things on that list _ought not_ to exist. Personally, I have some reservations about the neighbourhood watch thing.

<comment><AUTHOR> Ah - you are right. Thanks for catching the misinterpretation on my end.

</comment></comment></comment></comment><comment><USER47> Products I wish existed: a cure for neurological disorders like ALS, MS, Parkinson's, huntington's disease, small and large fiber neuropathy. There's nothing. Absolutely nothing out there to help people survive these widespread diseases.

</comment><comment><USER27> Hard Disagree on "subscription only" "network driven" security cameras. I have no interest in sharing when I come and go from my house with the entire world, let alone all the employees of a corporation like Amazon.

</comment><comment><USER48> > 7\. Software-only defense contractor.

Yea, I keep thinking of doing this but there's so much red tape in starting a defense company, it's seriously daunting. I'm a software developer in the defense industry, btw.

> ...be focused on a more SaaS-centric software-driven model...

Actually, I think the time may _finally_ be right for something like this in my industry.

<comment><USER49> Take more normal stuff that exists and host it in FedRAMP and DOD IL4+ environments. I work for a DOD contractor and we can only use a few SaaS solutions, most are not secure enough. We have to host most stuff in-house and it's becoming harder to find software that we can either host in-house or is of a security level approved by the gov.

<comment><USER50> We specialize in helping organizations seeking FedRAMP accreditation. [https://stackarmor.com/solutions-2/devops/](https://stackarmor.com/solutions-2/devops/) Please reach out if interested.

</comment></comment></comment><comment><USER51> None of these are particularly interesting to me. Seems like an observation- based list, based on what's currently trendy.

</comment><comment><USER52> #2. With Discord, I would love to have it move in the other direction, from being a game-centric network to more of interest-centric network. Parts of this already exist — there's a way to search through open invite communities — but it's not as explicit as I'd like: most of times to find a niche discord group, you first have to visit its respective subreddit and find the invite link beneath all the clutter. Sometimes, there isn't even a direct subreddit: to find a summer intern group, I had to dig through numerous threads of r/cscq. The downside of this type of network is moderation: subreddits now can self moderate but with chat, it's higher volume and no filter by upvoting enabled.

<comment><USER53> I've wondered about this as well. Discord should realize it's main appeal is not hosting gaming communities. It's providing a good and very customisable textchat environment (way less limiting than let's say slack) with easy voip and that all across platforms (browser, desktop, mobile, etc) I'm curious how large of a share of the servers is in no direct way gaming related.

As far as the rest goes I've wondered about as well. I'm part of a Discord that has no subreddit, yt or twitch channel is not a gaming community coming from some game or the like. It has a focus in that it's Eurocentric tho there's plenty of people on it from the US and the rest of the world but the only way it has survived for bout 2 years now is by being welcoming and a very broad catch all community with channels for cooking, politics, tech, memes, etc ([https://euro-lounge.eu](https://euro-lounge.eu)) I've encountered other ones that survived but they tend to be part of some big crosslinking groups and seem void of community feel with a shitload of people 99% of which don't say anything. Meanwhile more interest-centric communities just die if they don't have an area like a subreddit to pull people from. I've encountered numerous disappointing graveyards like that.

</comment></comment><comment><USER54> "Unlike Palantir, which seems to have a services-centric model, this new company would be focused on a more SaaS-centric software-driven model."

I thought Palantir was extremely software-driven. Could someone clear up what the above sentence means?

<comment><USER55> Palantir does really well for what they do, but this article is as true today as it was in 2016 in terms of what they are [https://simplystatistics.org/2016/05/11/palantir- struggles/](https://simplystatistics.org/2016/05/11/palantir-struggles/)

They're almost just a consultancy.

</comment></comment><comment><USER56> There are biotech startups working on all of those already

There are a couple interesting gene therapy companies workout on hearing (akuous and decibel among others). Lots of ophthalmology gene therapy companies also, as well as more traditional companies. Hair regeneration has been a popular area of research for a while

Most companies work on biomarkers as part of the drug dev process. However building a business around just biomarkers is hard -- you need to develop your own drugs based on those biomarkers. Diagnostics is really tough bc reimbursement and pop health is tough bc incentive alignment is nearly impossible in many contexts

<comment><AUTHOR> Which of these do you think are farthest along?

Gene therapy seems to be working a little bit in ex-vivo approaches (you take cells out, modify them, and put them back in, largely in the immune system) but progress elsewhere is very limited.

<comment><USER56> Re akuous and decibel, I don't know too much about their programs

Re eye diseases / blindness, there is at least one approved gene therapy for a form of congenital blindness, luxturna: [https://www.fda.gov/news- events/press-announcements/fda-appr...](https://www.fda.gov/news-events/press- announcements/fda-approves-novel-gene-therapy-treat-patients-rare-form- inherited-vision-loss)

the eye is one of the areas where gene therapy delivery is currently feasible. other areas include the CNS using AAV9. Perhaps the most impactful gene tx yet approved is Avexis' Zolgensma (Avexis was acq by Novartis for $8-9B in 2018). Zolgensma is a potential cure for spinal muscular atrophy, the leading genetic cause of infant death. Zolgensma did $160M in its first full quarter on the market

Other areas where we will likely see approved gene therapies soon include blood diseases like hemophilia, beta thalessemia. In addition to blood, eye and motor neurons, the liver is a popular target for gene therapy as all of these tissues are easier to deliver gene tx to with current technology

Delivering gene tx to other tissues is not really feasible as far as i know at this point

</comment></comment></comment><comment><USER57> For #2, the fediverse is lively and growing every day.

One of the easiest ways to join is through a mastodon[1] instance. Alternatively, there are other[2] clients available.

I know many of these are similar to existing social networks, and thus might not be different enough to fit the criteria of the article. But the federated aspect of it-- seeing small pocket communities form-- adds something to it.

[1]: [https://joinmastodon.org/](https://joinmastodon.org/) [2]: [https://fediverse.party/](https://fediverse.party/)

</comment><comment><USER58> Products I wish existed:

1) Dynamic relational databases. They wouldn't be too different from existing RDBMS, unlike the "noSql" products, yet allow dynamism. [https://stackoverflow.com/questions/66385/dynamic- database-s...](https://stackoverflow.com/questions/66385/dynamic-database- schema#46202802)

2) A GUI-friendly and desktop-friendly http-based markup standard for "productivity" and CRUD applications. HTML/DOM/CSS/JS keeps sucking for that, after 2 decades of trying. Focus a standard on GUI's and only GUI's so that it's done right for once. Java applets & Flash failed because they got feature-happy, making them buggy and security risks.

3) A hybrid file system and database to serve as intranet CMS's. One should be able to put documents into a folder and have the folder automatically be displayed in a "nice" listing or menu of links (to view or open documents), along with folder tree navigation features. Additional attributes could allow finer control, such as document synopsis, author name or ID (cross-reference), and thumbnails or icons. As things are now, one is pretty much forced to use either a file system or a CMS for many intranet-ish things. Merge the concepts.

</comment><comment><USER59> >2\. New social network

This already exists, in the form of private group chats. I am part of a few GroupMe and Snapchat group chats that function similarly to how social networks "should".

I have an idea in this space- I'd like to implement a new webview or theme for Twitter that shows the most recent posts last, similar to how a DM functions. Once you scroll to the bottom of the list, you are done. No new content. Could alleviate some of the addictive features of the current methods.

</comment><comment><USER60> Not a pharmacological intervention, but I'm currently in the process of building out a newsletter for "longevity basics": [https://pareto.substack.com/](https://pareto.substack.com/)

I feel like too many people have gotten caught up in fringe science practices and "biohacking" the basic information that will keep us healthy and living long has been drowned out in the noise.

</comment><comment><USER61> " function that dramatically improves lots of people's quality of life. Examples would include eyesight and hearing. For example, many people start to get blurry vision in their 40s, due to a variety of factors including the mix of proteins in the lens of the eye causing hardening and potentially the muscle holding the lens aging. Could a simple approach like rapamycin droplets in the eye reverse aspects of aging and therefore eyesight? "

Yeah, I've heard about the protein buildup problem for twenty years now. Hopefully, someday...

Here's an August 2000 article from the NYT that discusses the problem:

[https://www.nytimes.com/2000/08/08/health/reading-glasses- as...](https://www.nytimes.com/2000/08/08/health/reading-glasses-as- inevitable-as-death-and-taxes-or-are-they.html)

Well into the 21st Century, and I must say I'm a little disappointed. After that second DARPA Grand Challenge, I'd have said "no way we don't have self- driving cars by 2020"

<comment><AUTHOR> It is surprising how little has been done here. A failure of the pharma/academic model perhaps. I am going to write more on why biotech does not innovate as much as it could, in another post.

</comment></comment><comment><USER62> > More RPA and NoCode.

Noooooooo! _sadface_

Interestingly, this kind of mess probably keeps ~50% of us programmers employed. So ... yeh.

</comment><comment><USER63> Correct me if I'm wrong, but No 5 already exists?! I'm from Europe. I have an app on my phone that shows me the pollution in the city I am. I check on it every time I'm in different places. It's called AirVisual. I installed it from google play, I have android.

<comment><USER64> I think he means a much more granular pollution map than what's available at the city level. Something like being able to get accurate pollution data at sub-kilometer precision, especially in suburb areas where monitoring stations tend to be sparse.

<comment><USER65> There is a project in Germany which collects the data of stations you can build yourself with an esp8266 and a sensor. [https://luftdaten.info/](https://luftdaten.info/)

<comment><USER66> Thanks for the link.

Users outside of Germany already use it. I think I will participate. For some time I was thinking about an amateur network of air pollution sensors, that seems to be it. Is there something with more reach in Europe or at least Poland (where I'm at)?

<comment><USER65> Yes I just realized that it's already in use outside of Germany as I visited the website. I will set it up myself as well.

</comment></comment></comment></comment></comment><comment><USER67> There's an unmet need in social networks for "identity verified and protected", wherein the social network proves to a reasonable^ degree of certainty that you are who you say you are, and then you are permitted to maintain an anonymous identity (which you may end and replace with a new one at any time).

^ Notarization, at $25/each, would be sufficient. Bank account verification and credit card verification would not be sufficient, nor would "upload a photo of your ID". There's no sidestepping the "human being evaluates your actual identity documents" stage.

</comment><comment><USER68> #4 is disturbing.

Humans in large swaths (most?) of the world live without stealing from one another.

Safe communities are not built on policing and monitoring (or guns), they're built by people who have basic communitarian values, basic education, who are conscientious, honest etc..

Obviously, macro issues are important (jobs, economy, credible judicial/civic systems) and that's part of the equation.

But none of this is new, it's downright ancient - and I'm wary to think of any technology that can be directly applicable. We have to raise our kids well, and there won't be any software to do that for us.

<comment><USER69> Defense contractors and longevity are also disturbing. Rich pervert vibes. The latter always reminds me of Jeffrey Epstein wanting to cryo freeze his head and penis (LOL) and Larry Ellison's foundation dedicated to longevity — "namely, his": [https://youtu.be/bNfAAQUQ_54?t=993](https://youtu.be/bNfAAQUQ_54?t=993)

</comment></comment><comment><USER70> Elad Gil is a really smart investor (his list of Unicorn investments is probably larger than any other angel), but -- with the exception of (11) and (12) -- this doesn't strike me as a very ambitious list.

<comment><AUTHOR> Agreed on not crazy ambitious for most of these. Honestly, this really is just a list of products I would like to use (with 1 or 2 exceptions).

There are a lot of things that _should_ exist but are harder to do: -Safe, cheap nuclear power -Longevity drugs (I am involved with two companies in that area) -Independent journalism school/foundation -Pioneer on steroids (how to identify and nurture the top global talent for every area of human endeavor) -Etc.

But that is perhaps another post / different topic?

What else would you add?

</comment></comment><comment><USER71> I want a single service I can plug a bunch of creators and/or genres/interests into and get alerted about available new content. I don't care about book tours or interviews or someone leaving the band or twitter drama. Just tell me when one of my favorite authors releases a book for sale. Tell me when the album is out. Tell me when the game is on Steam. I don't care about your broken Kickstarter promises or your development updates or your Hugo Award nomination or that you've begun recording your new album.

<comment><USER72> [https://docs.aws.amazon.com/AWSECommerceService/latest/DG/It...](https://docs.aws.amazon.com/AWSECommerceService/latest/DG/ItemSearch.html) would be a good place to start

</comment></comment><comment><USER73> I would like to see security get into guarding the entrances of convenience stores using AI. If someone could potentially robbing the store, wearing a mask or carrying a gun, why should the door remain unlocked?

Lock it, alert a human at the company to review the situation and either open the door for them or call the police. Loop in the clerk if the network goes down.

Also, along these lines, created an AI doorman for a building, with a similar review process. Have the residents also help with reviews if the network is done.

</comment><comment><USER74> Infer from the most secret corporate software projects problem commonalities and build a huge company devoted to these is not a realistic product proposal.

</comment><comment><USER75> Here is the archive.org link since it seems that the website has been hugged to death:

[https://web.archive.org/web/20200107003015/http://blog.eladg...](https://web.archive.org/web/20200107003015/http://blog.eladgil.com/2020/01/products- i-wish-existed-2020-edition.html)

</comment><comment><USER33> > 1\. Trinet for full-time remote/distributed workers

Dao software such as Aragon and Daostack may be the ones which make this real. A lot of the complexity in running distributed teams is connected to the sorry state of international payments. A vast majority of the potential employees is simply not able to participate to the global economy today.

</comment><comment><USER76> It would be interesting to know which bits would be out-of-scope if we tried to build the Young Lady's Illustrated Primer right now.

The nanobots binding to a single-child, definitely... and the audio dictation from real actors, probably. There's not too much of a stretch between the rest and reality. Is there?

</comment><comment><USER77> Eldertech ideas would be a welcome addition to this list. Gil might say that Eldertech is a specific vertical under the RPA/NoCode category, but I'd argue that it's a large enough market unto itself that will become more relevant after 1 or 2 generational shifts.

</comment><comment><USER78> Pollution tracking would be greatly appreciated. Maybe we could catch methane leaks faster, or respond more quickly to fires. Google backed firefly (the one that puts the billboards on top of lyfts and ubers) has air quality tracking; it needs more scaling.

</comment><comment><USER79> For social networks, Manyverse is an interesting new player. It's p2p with no central server, and the app is open source.

[https://github.com/staltz/manyverse](https://github.com/staltz/manyverse)

</comment><comment><USER80> I actually have the High Growth Handbook written by the author of this article, but had no time to start reading it. Does anyone here have an experience with it, is it worth picking up asap?

</comment><comment><USER81> What does the author mean when he says 'black sun-like VR network'?

Googled and couldn't figure it out. Hoping it's a reference to some good sci- fi I haven't read.

<comment><USER82> [https://en.wikipedia.org/wiki/Blaxxun](https://en.wikipedia.org/wiki/Blaxxun)

</comment></comment><comment><USER83> #4: vivint smart home already has #4, including an app called streetwatch which does the multi-camera with neighbors grouping.

#10: a mouse is a mammal. perhaps author meant apes?

<comment><AUTHOR> Thanks - #10 was a typo. Updated to "human". :)

</comment></comment><comment><USER84> Check for the latest biotech [https://www.neuralink.com/](https://www.neuralink.com/)

</comment><comment><USER85> I feel like more and more of our life is what "product" we connect with and use. I kinda want to opt out.

</comment><comment><USER29> I wish there was a genuinely excellent, highly configurable, and privacy- supporting browser.

</comment><comment><USER86> > 5\. Neighborhood (and corporate?) pollution sensor networks.

purpleair seems to do much of this.

</comment><comment><USER87> Are there other rundown like this? I appreciate the concept more than the content.

<comment><USER88> Less focused on business ideas and more on digital tools, but I wrote something similar a month or so ago:

[https://jborichevskiy.com/posts/digital- tools/](https://jborichevskiy.com/posts/digital-tools/)

<comment><USER89> Link to HN discussion at the time: [https://news.ycombinator.com/item?id=21659876](https://news.ycombinator.com/item?id=21659876)

</comment></comment></comment><comment><USER90> For #4 I have had good experiences thus far with Simpli Safe.

</comment><comment><USER91> I just love the Green Atomics rebranding idea

</comment><comment><USER92> Look at useparagon.com for #9

</comment><comment><USER93> > 4\. ADT 2.0: Digital neighborhood watch.

That this is not only a market, but a "wish" which seems to get traction even here on HN confirms to me that the old joke "1984 is not a manual" is more relevant than ever, and scarily not only in regards to the usual suspects, corporate and nation states, but people themselves.

Can anyone explain to me why _anyone_ would advocate a profit-driven, systematic eradication of soul and character around each and every human residence?

Why would you trade the vibrancy of your young urban block or the sense of trust and community in your suburb against prevention of low-impact black-swan events like serial packet thiefs?

Why would you surrender your home, not only your safe haven in life but also your gateway to low effort exploration of your surroundings to wide-spanning AI surveillance and automated purge of any nuisance?

Maybe I am just weird or out of touch but I can absolutely not get in my head how people surrender to such a dull dystopia based on an apparent fetish for weaponized gossip and abnormal levels of fear of petty crimes...

<comment><USER94> I agree with your overall point. However:

 _> low-impact black-swan events like serial packet thiefs?_

I live in Seattle. Package theft is a white swan event here. Everyone I know has had packages stolen. Most people are forced to come up with some strategy to deal with it: get things shipped to work, use Amazon lockers, get a camera on your porch and make sure to bring the package inside as soon as it shows up, etc.

You are right that materially it is a low-impact event. However, psychologically it isn't. It _sucks_ having shit stolen from in front of your own home. It immediately undermines that "sense of trust and community" you mention. My home no longer feels like a sanctuary, and random people ambling down my street no longer feel like friendly neighbors. Any of them could be a thief scoping out porches and the evidence is clear that at least _some_ of them are.

It is a maddeningly disempowering feeling to _know_ that I am unable to prevent someone from stealing shit from my own property. Worse, I know the police won't do a thing about it either. I literally have video of the dude grabbing shit off my porch, but can do nothing about it.

I think it is that feeling of helplnessness that leads people to buy security systems.

<comment><USER93> Fair enough, but as you literally state yourself, the security system _does not even help_. I repeat, it does nothing.

> I literally have video of the dude grabbing shit off my porch, but can do > nothing about it.

The only thing all this security theater does is aiding super convoluted scenarios where your neighbors system informs you to take your package in, if you have one currently out, and are fast enough, and are at home. In the long run, all this does for prevention is creating an arms race easily won by covering up your face and randomizing routes as the thief...

So: Make a startup selling big-ass secure post boxes. Minimize crime by, you know, education and financial aid. Kill this excessive package-delivery culture which is super damaging anyways somehow. Make the police force more efficient. Make small package-taking centrals. Whatever. I understand. But this cloud-based security is the absolute worst thing you can do.

edit: spelling

<comment><USER94> _> but as you literally state yourself, the security system does not even help. I repeat, it does nothing._

My first sentence said I agree with your overall point.

In my case, the main reason we have the cameras is because my wife felt they would help her feel more secure. They have been somewhat useful and/or worthwhile for other things:

* We can see who's at the door and ignore them if they are solicitors.

* When we're not home and someone knocks on the door, we can respond to them since the camera also has a speaker. When our friends dropped off a few Christmas presents while we were out at dinner, it was cool to be able to say thanks right then.

* On the off chance a more serious crime is committed, we may have footage of it. The police don't care about package theft, but they are likely to investigate trespassing, breaking and entering, etc.

* Sometimes we see bunnies and baby raccoons meandering around the alley, which is always cute.

I'm not a big fan of the system, but it is occasionally handy or rewarding to have access to a live camera around my house.

</comment></comment></comment></comment><comment><USER95> > The rise of machine learning and machine vision as analytical tools opens up > the door for a new contractor to emerge to challenge incumbents, and also to > provide new applications not available in the pre-ML world.

Actually, I was thinking of building detection system for taking down protests. Currently, government has a need to identify muslims, illegal immigrants and violent college students. Looking at whatever video is there, it seems you can find them with 60-70% accuracy. For taking down protests, I figure something like automated human warnings or high intensity sound could work. It can generate list of people found and match them against existing database, give proximity of where they might live. Long term, you can track movements and other uniquely identifying data. All stored in cloud so for every camera you install, accuracy should improve.

I wonder if some kind long range radar would be able to detect protestors like activities.

For the attention economy, someone needs to build a prioritization system. Something that can jam all notifications and only allow higher priority ones to go through, scheduling, hiding things I probably don't care about.

example - taking care of unread emails by building a sorted list of them and removing junk based on how you interact with top ones.

> Digital neighborhood watch

Could be useful for various purposes like keeping away people on restraining orders with facial recognition, it should notify police with proof or observing fires, violence, and keeping away certain people you don't want near you.

Human sounding warnings will scare off a lot of low noisy actors.

Edit: Surveillance state = bad. I get it. I am against it too but are you not minority when most of your country doesn't care?

If there is a market need for a product, what do you use for determining whether it is correct or not. You can kill people with knives or ropes (more people killed than security cameras) but that doesn't make those two unethical or wrong to supply. You can defer to legality but that is not a good vector probably. Ethics are subjective and based more on intentions than other variables.

Just a genuine question, what if you are minority in a democratic state? Should you have power to impose your will on others despite whatever _they_ voted for? If someone is harassing me, I can legally remove him. Harassing someone is wrong but what if protests turn into harassment or destruction of your private property, should you use legal system to stop protests? Should you think about the whole country of billion when making a decision that is against you in terms of favorability?

Is selling anything to state a crime now that they can use for violence or suppression of protestor? What makes detection systems so bad compared to other things people call 'ethical'?

</comment><comment><USER96> >Nuclear is a strong potential solution for climate change but is politically unpopular. Could something be done to address this

No. There are no political champions for nuclear, and most environmentalists are actively hostile to it. And to be fair, starting reinvestment in nuclear infrastructure in light of how inexpensive natural gas is, would be expensive. Nuclear also doesn't play well with solar and wind, while natural gas is a perfect complement to renewables.

</comment><comment><USER97> I'm building two social networks and you are gonna L-O-V-E them.

> Taaalk (originally launched in 2016)

A place for online publicly available conversations. For example:

i) How to play chess [https://web.archive.org/web/20160427044603/http://taaalk.co/...](https://web.archive.org/web/20160427044603/http://taaalk.co/taaalk/chess/robert- heaton-josh-summers)

ii) Value Investing [https://web.archive.org/web/20160427023909/http://taaalk.co/...](https://web.archive.org/web/20160427023909/http://taaalk.co/taaalk/investing/value- investor-josh-summers)

> Nerdverse.xyz

A url only social network (a bit like HN, but with more content and discussions with people you know - you're only allowed to talk after you have been introduced to, and accepted by, the owner of the group). All chats are publicly available to read, but you can only participate after an introduction.

Please signup to my beta list: [https://docs.google.com/forms/d/e/1FAIpQLScnuDIskbCAabMtGHQd...](https://docs.google.com/forms/d/e/1FAIpQLScnuDIskbCAabMtGHQd-K7rghfzSCjIbxp14Cf7_IcaTYYqFQ/viewform?usp=sf_link)

Thanks for reading</comment>


Suggestion: Improve Hacker News algorithm to serve Europe better - <AUTHOR>

I have a relatively simple suggestion which I think could make hacker news better for some of us on the other side of the pond:
The problem: During the awake hours of Europe, since there is less traffic, it is harder for an article (even though it's buzzing, relatively to the traffic) to move around the front page. This is a shame in my opinion
My suggestion: Why not either change the rules depending if we're simply on pacific time or 9 hours appart. But then that's just custom for Europe. How about inducing an hourly traffic variable in there? <comment><USER2> >During the awake hours of Europe, since there is less traffic, it is harder for an article (even though it's buzzing, relatively to the traffic) to move around the front page.

My experience has been the polar opposite. I've had a number of posts sit on the front page for hours. One of my most recent posts drove massive traffic to our blog and sat on the front page for over 8 hours.

</comment><comment><USER3> If we want Europe to be served better, then disallowing articles behind paywalls would be the best option to make me happy. Most non-americans won't have a membership to the Wall Street Journal or the New York Times. That would make me much happier than an algorithm change. But the powers that be have stated that this just won't happen.

<comment><USER4> Most Americans also don't have subscriptions to those sites. It's been stated many times that the way around paywalls is to search the article on Google and click straight from the results. That's how I get around the restrictions.</comment></comment>


Ask HN: How to start learning Machine Learning in 2019? - <AUTHOR> <comment><USER2> You can start Coursera prof Ng course on machine learning to test waters if you don't know anything about machine learning.</comment>


Ask HN: Hosting Services - <AUTHOR>

The Short: I need a hosting service that knows what the hell they're doing, and that includes password management.
The Long: I recently (tonight) had to cancel my subscription to VPSLink since they can't manage passwords in an intelligent way. (Hint: If your response to a password bug is "Make your password shorter" then screw you.) I need some insight into the best hosting services. I need control over my server, I need to be able to upgrade when I'm ready for more, and it needs to be within the right price range.
What does Hacker News suggest? <comment><USER2> Linode.

</comment><comment><USER3> AWS, GAE, Heroku, Linode, Slicehost, Rackspacecloud seem like viable places to start. Heroku is more rails focused - so you can save your time looking at them if non-rails project.</comment>


Linux page table isolation is not needed on AMD processors - <AUTHOR> https://lkml.org/lkml/2017/12/27/2 <comment><USER2> Did he know it would blow up in a few weeks? [https://www.fool.com/investing/2017/12/19/intels-ceo-just- so...](https://www.fool.com/investing/2017/12/19/intels-ceo-just-sold-a-lot- of-stock.aspx)

<comment><USER3> What's the connection?

<comment><USER4> Here is some more context - [http://pythonsweetness.tumblr.com/post/169166980422/the- myst...](http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious- case-of-the-linux-page-table)

The connection between the linked article in this comment and the linked page for this post is that there is a potentially huge bug that will be made public soon and it just affects Intel processors, not AMD - hence the large sale of stock by the Intel CEO.

<comment><USER5> Not sure if it makes any sense and even logical to compare the market before and after Intel's floating point bug was uncovered a decade ago. My bet is this current bug won't shake Intel's stock price much.

<comment><USER6> If the workaround being deployed now causes a 30% performance hit in real world usage, even just for some cases, it could hit Intel way harder than fdiv.

A lot of people on Intel will suddenly lose a noticeable amount of performance. Conversely, if your Intel based VMs lose 25% performance, you are now booting up and paying for 20% more VMs for the same load.

</comment></comment></comment></comment></comment><comment><USER7> Was the connection with speculative execution already being discussed openly? I know about [https://cyber.wtf/2017/07/28/negative-result-reading- kernel-...](https://cyber.wtf/2017/07/28/negative-result-reading-kernel- memory-from-user-mode/), but not about anything between that and 28 Dec suggesting someone made it work and that's the reason for KPTI.

If it wasn't in the open, seems...not ideal embargo-wise for AMD to leak it there. Though no one's in that thread complaining about the disclosure, so maybe they either think that part is already known to anyone looking closely, or just don't think it's a very big piece of the exploit puzzle (like, finding the way to get info out a side channel was the hard part).

<comment><USER8> It wasn't publicly acknowledged but people figured it out already. Take a look at [https://news.ycombinator.com/item?id=16046636](https://news.ycombinator.com/item?id=16046636) (both the article and the comments) for example. This wasn't going to stay secret much longer.

<comment><USER7> That post is a couple days after the 28 Dec AMD commit, though. Curious if it was _already_ discussed since that would mean no way what AMD said is how people figured it out.

my123 does point out that the author of the speculative execution blog post is first in the KAISER paper's acknowledgments, and looks like the paper was presented at a July conference, so that's an earlier clue out in public, for what it's worth.

</comment></comment></comment><comment><USER9> This is going to have dramatic effect on the cloud computing market. It might make sense to make sure any VMs you run are on AMD processors or it can really hurt your performance and basically cost you more to do the same workload.

It also seems, from early benchmarks, this can slaughter performance with databases.

<comment><USER5> Why are people insisting this affects cloud computing market? I am not sure if this bug is absolutely limited to cloud instances.

<comment><USER10> The bug affects transistions into kernel mode. Virtual machines have one extra transistion. A read() call in the guest calls the guest OS which calls the host OS.

<comment><USER5> You are referring to the slow down and hence the extra slow down for calling an extra syscall?

If so, then isn't it technically correct that the bug will affect regardless of virtualization or not, but heavier penalty for VMs?

</comment></comment></comment></comment><comment><USER11> This feels like a big FU to Intel. I've heard this patch can slow down programs like du by 50%. Does that mean AMD is going to find itself running twice as fast as competitors?

<comment><USER12> I think the du case was an outlier. Normal workloads shouldn't be so heavily affected. I am expecting a few percent loss on most programs though. It's basically a larger penalty for making a syscall, which was already a fairly slow operation so performance minded people avoid them in tight loops. It will be bad for people who need to do lots of fast I/O I suspect.

<comment><USER13> Sounds like servers handling lots of small UDP packets would be hit pretty hard.

<comment><USER14> Applications like this where the syscall overhead (and latency) starts to be a significant factor in processing time and latency have moved to userland drivers anyway:

DPDK for 10-100 Gbps networking: [https://dpdk.org/](https://dpdk.org/)

SPDK for NVMe storage: [http://www.spdk.io/](http://www.spdk.io/)

The queuing and balancing stuff the kernel does makes sense for spinning rust harddisks and residential networking, but when the underlying hardware is so fast that _nothing is ever queued_ , really what are you doing. At 100 Gbps line speed, a 1518 byte packet takes all of ~ 120ns to transmit, or about 360 clock cycles for a 3 GHz processor.

<comment><USER15> > Applications like this where the syscall overhead (and latency) starts to be > a significant factor in processing time and latency have moved to userland > drivers anyway:

I would personally think that is worse, though please correct me if I'm wrong. The userland driver will run with an isolated PT like any other userland process won't it? If so, it will suffer the same slowdown that every other process now has every-time it has to communicate with the kernel, which I would think would be a lot for a driver.

<comment><USER14> It's counter intuitive at first, but the key to understand how this works is that while you can use an MMU to assign chunks of physical memory to a process, you can of course also just use the MMU to assign the memory mapped IO registers of say a PCI express peripheral to a process.

That is in a nutshell what a "userland driver" is. It's not too far removed from poking the parallel port at 0x378 on your DOS computer :)

</comment></comment></comment></comment></comment></comment><comment><USER16> All Intel CPU's are affected, mitigation syscall overhead increased by 50%, and none of AMD CPU's affected? I would say this could be an indicator to short INTC and long AMD...

<comment><USER17> Short INTC maybe but I am not sure this means that AMD will increase in value over the long run as a result of this one incident.

<comment><USER18> I think it will because it shows the downside of a monoculture. Hence big purchasers of CPUs will want to diversify. Also good for ARM vendors I suppose. Disclosure : bought AMD this morning before headlines saying "Buy AMD, short INTC" appeared.

<comment><USER17> Has there ever been a precedent for this? When there were major bugs in Intel CPU's (or drives, or RAM, or motherboards) did the likes of Amazon and Google invest in diversification? And has it affected stock prices meaningfully? My guess is that they'll see this as just another one off issue that can be fixed with software, then move on. For a large enterprise, monoculture that works is actually better than diversification.

When you think about your own workstation, it's not a big deal to build an Intel or AMD system. But when you buy 100k motherboards and spend the time adjusting your tooling to those, from packaging to power, to cooling, to support, to OS code, etc. and then you on a whim decide to get another 100k motherboards of a different architecture, you spend a non-trivial amount of time and money to support those as well. Again, if AMD provides better hardware, it's absolutely worth it. But I personally wouldn't do it based on this bug.

I don't own shares of either AMD or Intel.

<comment><USER14> I checked the stock of Intel during the FDIV bug (1994/1995) where they had to go as far as recalling the affected processors at a cost of $500M in January 1995 and there was basically zero effect. By the end of 1995 the stock had actually pretty much doubled in value..

<comment><USER19> I personally think FDIV made Intel money, it told the world how important Intel was. It wasn't just the calculator sitting on some trader's desk. It _ran_ the stock market and the stock market responded.

</comment></comment></comment></comment></comment></comment><comment><USER20> Essentially looks like Intel compromised (whether intentional or not is a different point) the design to get the speed boost that gave them the lead over AMD for the past decade. Will be interesting to see how all this plays out.

<comment><USER21> > Essentially looks like Intel compromised (whether intentional or not is a > different point)

If it wasn't intentional, then it wasn't a compromise. So it's not a different point.

</comment></comment><comment><USER22> So first they bring a DLC concept ("unlock features by spending money") to their enthousiast platform, and now this?

Having a hunch Threadripper will sell extremely well amongst PC enthousiasts this year...

<comment><USER23> I'm curious what you are referring to re: the DLC concept? Did you mean this thing?

[https://en.wikipedia.org/wiki/Intel_Upgrade_Service](https://en.wikipedia.org/wiki/Intel_Upgrade_Service)

Seems like that was discontinued a long time ago (2011) so was wondering if there was something more recent that happened?

<comment><USER24> Probably the paid hardware RAID unlock key.

<comment><USER25> Has Intel _ever_ had hardware RAID? They have firmware RAID, but that's quite different.

<comment><USER26> They actually DID have hardware RAID controllers, but not like you're talking about.

</comment></comment></comment></comment></comment><comment><USER27> At the meta level this is just a special case of "complexity is evil" in security. CPUs have been getting more and more complex, and the relationship between complexity and bugs (of all types) is exponential. Each new CPU feature exponentially increases the likelihood of errata.

A major underlying cause is that we're doing things in hardware that ought to be done in software. We really need to stop shipping software as native blobs and start shipping it as pseudocode, allowing the OS to manage native execution. This would allow the kernel and OS to do _tons and tons_ of stuff the CPU currently does: process isolation, virtualization, much or perhaps even all address remapping, handling virtual memory, etc. CPUs could just present a flat 64-bit address space and run code in it.

These chips would be faster, simpler, cheaper, and more power efficient. It would also make CPU architectures easier to change. Going from x64 to ARM or RISC-V would be a matter of porting the kernel and core OS only.

Unfortunately nobody's ever really gone there. The major problem with Java and .NET is that they try to do way too much at once and solve too many problems in one layer. They're also too far abstracted from the hardware, imposing an "impedance mismatch" performance penalty. (Though this penalty is minimal for most apps.)

What we need is a binary format with a thin (not overly abstracted) pseudocode that closely models the processor. OSes could lazily compile these binaries and cache them, eliminating JIT program launch overhead except on first launch or code change. If the pseudocode contained rich vectorization instructions, etc., then there would not be much if any performance cost. In fact performance might be better since the lazy AOT compiler could apply CPU model specific optimizations and always use the latest CPU features for all programs.

Instead we've bloated the processor to keep supporting 1970s operating systems and program delivery paradigms.

It's such an obvious thing I'm really surprised nobody's done it. Maybe there's a perverse hardware platform lock-in incentive at work.

<comment><USER28> > It's such an obvious thing I'm really surprised nobody's done it.

IBM AS/400 for about 30 years now.

<comment><USER29> Tao/Intent/Elate (which I think is defunct nowadays) would also qualify, and I'd argue .NET on Windows with the GAC would, too (although there'll be a legitimate argument about whether that's "simple and closely models the processor").

<comment><USER30> Tao is long defunct, yes (went under a decade ago). It turns out that people don't really want a runtime-portable OS/apps (IIRC the biggest takeup it got was as a Java runtime for mobile, because the competition at that time was all interpreted). There was no security model in VP, though -- single flat address space and bytecode could turn any integer into a pointer and dereference it (loads just got translated into host cpu load instructions), so there was no isolation between processes or between processes and the os.

<comment><USER31> AS/400 and descendants have a security model, but they rely at least partially on a trusted runtime code generator (and, transitively, trusted boot). The systems have HW assist to tag real pointers, but that's mainly for performance reasons. Pointer validity checks are performed in software (or they were until ten years ago), automatically inserted by the bytecode translator. If you subverted the code generator, your malicious code could get a bit further by forging pointers.

</comment></comment></comment></comment></comment><comment><USER32> I have to wonder:

Can intel release a drop in CPU that will avoid or mitigate this issue?

The infrastructure investment in intel cores is huge, if a drop in replacement lets me minimize downtime, re-gain performance and is "cost effective" compared to a cost prohibitive replacement does this result in intel having a sales INCREASE where it replaces bad silicon?

I don't know enough about this issue to speak to the issue either way, but I would love to hear if this fix is possible/viable.

<comment><USER33> I wonder if this can be fixed at firmware level. (I frankly have no idea how deeply configurable Intel cores are.)

<comment><USER34> For years, Intel and AMD processors have supported patching using microcode updates. Until we know the embargo is lifted and we know the full extent of this vulnerability, we won't know if that would be possible.

<comment><USER8> Based on the fact that kernel patches are going in it's reasonable to assume this means it can't be fixed with a microcode update. Otherwise, Intel would issue a microcode update and the Linux kernel wouldn't be accepting this patch set as a mitigation for this issue (which is all this patch set is, it has no other benefit to the end user than fixing this bug).

<comment><USER35> It depends on how long it takes for Intel to go through all regression tests for all affected platforms. If it takes several months to complete, a countermeasure in the kernel update may still be the better stopgap.

Or maybe it could be that Intel privately disclosed already that no backport will be done to firmware of older CPUs, in which case the kernel update is the stopgap for newer generation and the solution for older generations.

<comment><USER36> They knew of the issue since June. Now that the patches are out it'll be hard to regain the performance. I doubt they are able to issue a microcode update within the following months. Otherwise large clients such as AWS would have implemented that instead.

</comment></comment></comment></comment></comment></comment><comment><USER37> Wouldn't this kind of issue validate the ideas of microkernel-based OSs, where kernel and user spaces are already completely separated?

BTW, removing the kernel from the non-privileged address space seems like such a great idea (which is not a new one at all) the whole thing should probably should have some hardware support to be made fast.

<comment><USER38> > Wouldn't this kind of issue validate the ideas of microkernel-based OSs, > where kernel and user spaces are already completely separated?

I don't think so, but it depends what you mean.

Kernel space and user space being separated isn't specific to a microkernel. The only reason the kernel is mapped in to each process is to avoid the TLB flush during syscalls. The pages themselves aren't actually accessible unless you're running in kernel mode (well, unless you're using hardware affected by this bug). So, in a non-broken system, kernel and user spaces are separated, even with a monolithic kernel (Linux).

> BTW, removing the kernel from the non-privileged address space seems like > such a great idea (which is not a new one at all) the whole thing should > probably should have some hardware support to be made fast.

For the most part, I agree. However, it really shouldn't be necessary if the virtual memory protection did what it was supposed to do. Mapping the kernel in to the process address space and using the page protection flags is an optimization that is perfectly legal from an architectural standpoint.

If you can't rely on the page protection flags to work, then you really can't rely on any other hardware feature to work either.

</comment></comment><comment><USER39> Given Intel's dominance of the server market does this mean that datacenter computational capacity will see an overnight ~5% drop?

Is there enough spare capacity to cope with this? Will spot-instance prices go up? Will I need more instances of a given type to run the same workload?

<comment><USER40> Given what's been disclosed so far it seems an exploit using rowhammer techniques would be unlikely to work with ECC RAM. Consumer systems will be screwed unless a tolerable microcode update is released.

<comment><USER41> I don't think this issue is related to rowhammer. I think people have been speculating about rowhammer because it's a famous hardware bug, but none of the details of page table isolation seem to align with a rowhammer-based attack.

<comment><USER40> This enables the first step in a rowhammer attack: identify the privileged address you want to target.

<comment><USER41> Oh, are you thinking the KASLR bypass is actually the main problem, because it allows targeted rowhammer? I'm not sure if that's really true, since a KASLR bypass would give you a virtual address, and rowhammer would care more about physical addresses.

But in any case, the KASLR bypass is not the main vulnerability here. KASLR is widely seen as too leaky to be really useful. Linux would not rush out a >5% performance hit just to fix one of the many leaks.

</comment></comment></comment></comment></comment><comment><USER42> All that I've read about this so far seems to indicate that it's only a way to bypass KASLR... which is itself not really a problem, but there must be something more to it. Given that it doesn't affect AMD, perhaps it's related to Intel ME?

<comment><USER16> The growing consensus is that someone managed to make this work: [https://cyber.wtf/2017/07/28/negative-result-reading- kernel-...](https://cyber.wtf/2017/07/28/negative-result-reading-kernel- memory-from-user-mode/)

Reading kernel memory from user mode = reading cached disk blocks, cached credentials and anything else, by simply running javascript on a web browser.

KASLR bypass is just a small bonus.

<comment><USER43> It is that.

The author of that blogpost is mentioned in Acknowledgments on the Kaiser whitepaper. :)

<comment><USER42> Interesting. I can see it being a concern in shared environments (hence all the cloud providers are quite scared), but unless there's another part about being able to _modify_ kernel memory, IMHO it's not such a big deal for the typical single-user personal computer.

I wonder if there are other (non-x86) CPUs that do similar speculative execution affected... the general ideas behind it don't seem to be specific to x86.

<comment><USER38> > IMHO it's not such a big deal for the typical single-user personal computer

IDK. If this means that some JavaScript from a website can read my kernel's memory, then it seems like a big deal.

<comment><USER42> All the more reason to keep JS off by default...

...but the blog post above shows that you need to execute instructions that (try to) access kernel addresses, and have a handler in place to catch the inevitable exception. That doesn't seem like code a JS JIT could generate.

You might be thinking of that JS RowHammer demonstration, but that was using regular memory accesses and not with the specific kernel addresses that you need for this.

<comment><USER17> Sorry that train has left the station. JS is now a part of the web. The advice to keep JS off by default is a lot like saying "turn off your Wi-Fi by default" and "don't use a computer." People that do it occasionally experience an exaggerated sense of smugness when a particularly nasty bug is discovered, but then they go back to leading a much more difficult online life than the rest of the world.

<comment><USER44> there's a subset of the web that still remains a hypertext document database (the 'web 1.0' if you will) instead of becoming an application delivery platform (web 2.0, i hear it's almost out of beta). going JS-less on wikipedia is possible and not at all a bad experience.

<comment><USER17> Sure if you limit your life to Wikipedia that's fine. Hell, you don't even need an internet connection for it. Just download it all once in a while. But the rest of us like using places like Amazon, Slack, Google Maps, etc.

I fully support not making content delivery rely on JS. But I disabling JS because it can be used for intrusive ads is a lot like taking the wheels off your car because it can take you to the mall where you might see big for sale signs and annoying sales people. Effective, but stupid.

<comment><USER45> > But disabling JS because it can be used for intrusive ads is a lot like > taking the wheels off your car...

You should try it sometime. Selectively enabling JS will be annoying at first, but as long as you save your preferences, the web will soon become a much less terrible place, and you'll rarely have to tweak your config. This approach won't work for non-techies, of course, but it's not much of a hardship for someone vaguely familiar with how the web works. Amazon, for example, works fine with a bit of JS not including amazon-adsystem.com.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> Is this issue only of concern for Intel with Linux? What about OSX, BSD or Windows?

<comment><USER47> Reports are that Windows is also getting an update for this; see refs to recent NT kernels here: [http://pythonsweetness.tumblr.com/post/169166980422/the- myst...](http://pythonsweetness.tumblr.com/post/169166980422/the-mysterious- case-of-the-linux-page-table)

and the original source for that report: [https://twitter.com/aionescu/status/930412525111296000](https://twitter.com/aionescu/status/930412525111296000)

OSX and BSD variants are an interesting question...

</comment></comment><comment><USER48> Data structures stored in kernel space, such as llds [1], will not incur the overhead of the TLB flush/load.

I suspect that storing data in the kernel space in order to avoid maintaining a large application PD will become the norm, whereas in the past it has been reserved for use cases like search engines with massive in-memory trees.

[1] [https://github.com/johnj/llds](https://github.com/johnj/llds)

</comment><comment><USER49> Would it be possible to slow down segfault notifications to mitigate the attack? For example, if the segfault was not on kernel space, halt the application for the time offset of a kernel read. In this way all segfaults would be reported at more or less the same time and the attack could be avoided.

Are there any sane apps that depends on timely segfault handling and thus might be affected by such a workaround?

<comment><USER50> It's not timing the segfault delivery itself, the idea is to time another read of your own address space after the fault to see if it's been prefetched or not.

Maybe you could CLFLUSH on segfault delivery though.

<comment><USER50> Turns out "maybe" is "not" \- if you put the faulting read at a mispredicted branch target, you don't take the fault.

</comment></comment></comment><comment><USER51> I sometimes wonder if verifying properties of the code we run wouldn't be smarter than relying on hardware isolation. Or at-least in addition to hardware isolation, so that there is two layers.

By verify I'm thinking NativeClient-like or JVM isolation.

Obviously, it would entail complete OS rewrite, or maybe partial...

<comment><USER52> You can't do secure computation on a CPU that is insecure in this way. The insecure CPU will ignore any abstractions you create in software.

</comment></comment><comment><USER53> Lol. Was already very happy with my ryzen 1800 bought a couple months ago. Even more happy today.

</comment><comment><USER54> How does all this affect everyday regular users?

<comment><USER40> Soon, malicious JavaScript will be able to own your computer.

<comment><USER54> Don't most of them do that already?

<comment><USER55> Right now, they just own you and your data. With this, they will own your machine.

<comment><USER56> Pretty extraordinary that a user's most important files (their documents and whatever else is in their home folder) are accessible to any app at any time. Why are we still using this outdated security model? On Windows, I could download an .exe and it could upload the entire contents of my Dropbox without even prompting for elevation or anything. Kinda scary when you think about it.

<comment><USER57> > Why are we still using this outdated security model?

Because it's convenient. The alternative would be something like flatpak's portals, which funnel everything through a few standardized dialogs; but how would you for instance use them to implement a media player application which scans for mp3 files, reads their tags, and presents them on a list? A "select a directory" portal dialog either would not allow for a recursive scan, or risk a non-technical user selecting their home directory, and either way would be a strange interruption in the workflow. (I understand, however, that Android has done precisely that for removable SD cards...)

</comment></comment></comment></comment></comment></comment><comment><USER37> Would it make sense to switch core at the same time the context is switched between user and kernel? The hit with cache is already there and, if one could go back and forth to already primed caches on different cores, at least some of the performance issues would be mitigated.

</comment><comment><USER58> Is there anything that an end user can do to mitigate the performance impact?

<comment><USER59> Switching to AMD or not upgrading your kernel are the only options I can think of.

</comment></comment><comment><USER60> Slightly better link: [https://patchwork.kernel.org/patch/10133447/](https://patchwork.kernel.org/patch/10133447/)

</comment><comment><USER61> I thought it was clear that this patch only applies to AMD. However, reading the comments here confuses me. How's does the performance on Intel drops with this?

<comment><USER62> No, other way around. The patch which decreases Intel performance has already occurred. This patch AMD saying "we don't need this, so we're disabling it for AMD CPUs."

</comment></comment><comment><USER63> I can't even imagine how large the bug bounty can be for the researcher who created the PoC.

</comment><comment><USER64> old news. [https://cyber.wtf/2017/07/28/negative-result-reading- kernel-...](https://cyber.wtf/2017/07/28/negative-result-reading-kernel- memory-from-user-mode/)

<comment><USER21> This isn't about the original vulnerability. It's about the linux kernel disabling the fix patch (and the performance hit) for AMD processors.</comment></comment>


A creative, non-legislative way to get guns off the street - <AUTHOR> http://www.slate.com/id/2217117/

<comment> patrickg-zill This was tried back in the days of the Clinton administration with Smith and Wesson.

<http://clinton4.nara.gov/WH/New/html/20000317_2.html>

The rest of the gun-buying public declared a "S&W Death Penalty" and stopped buying anything from S&W.

Smith and Wesson nearly went bankrupt and the British company that owned S&W sold it off for a pittance to a small American gunmaker.

<comment><USER2> Yeah that's what I was thinking about as I was reading the article, too. Maybe Spitzer should have spent a little less time with his mistresses and a little more actually understanding the firearms industry in the U.S.

First, there are a lot of companies that sell exclusively or almost- exclusively to the civilian market, or are kept alive in between periods of major government purchasing by the civilian market. E.g.: Bushmaster, who is almost certainly one of those companies that Spitzer would like to punish, doesn't shy away from military/LEO orders but is primarily a civilian arms company.

Given the choice between relatively consistent sales on the civilian market or feast-and-famine by selling to the government (who can inundate you with orders one year and leave you with nothing the next), it wouldn't surprise me if some manufacturers just turned down government orders if they came with too much red tape.

The net result of Spitzer's plan might be a decrease in the number of suppliers willing to deal with the government, rather than the civilian market; it might also cause companies to split off rough parts production and have the finish work done by separate companies -- one for the government and one for the civilian market.

Of course, if such a scheme keeps people like Spitzer occupied and from making a real mess, more power to it. Gun control isn't a vote-getter because, for a great many people anyway, it really isn't a significant or pressing problem.

<comment><USER3> You really would think he would know, especially considering his previous (totally failed and backfired) attempts at gun-control. [http://www.nytimes.com/2000/03/30/us/gun-maker-s-accord- on-c...](http://www.nytimes.com/2000/03/30/us/gun-maker-s-accord-on-curbs- brings-pressure-from-industry.html)

</comment></comment></comment><comment><USER4> There is a cognitive gap here:

 _Those of us who were in law enforcement in New York City in the late '80s and early '90s remember how drug dealers pioneered the use of 9-mm guns. We heard over and over from our friends in the police department that they were outgunned, that their service revolvers were no match for semi-automatics in a shootout. So what did the police do? The New York City Police Department finally bought 9-mms, too. It was a classic arms race, with the gun manufacturers in the economically enviable position of selling bigger and better guns to both sides._

So the proposal, then, is to restrict the government from escalating the arms race by either creating policies or internal politics in such a way that the police can't purchase the weapons that they otherwise would?

"Police friendly" arms manufacturers would continue to sell guns that they think the police want. They're expensive, dated, and proprietary. This is roughly analogous to the state of government tech procurement before the large push for open systems. They will always be behind the curve because they will have no market for their innovative designs since their hands will be tied compared to "police unfriendly" manufacturers.

The police were behind the 8-ball because they failed to innovate. If you take the divisive stigma of firearms out of the picture and look at it as a strategic game, it seems obvious to me that messing with the incremental demand of one (albeit large) customer isn't going to bend the industry to your will.

 _The Obama White House recently made it clear—abandoning a campaign pledge—that it won't push for a legislative ban on the sale of assault weapons. Yet a series of provocative recent events has revived the gun debate: the international tension arising from Mexican drug gangs using guns purchased at American stores, the 10th anniversary of Columbine, and a Supreme Court case invalidating a District of Columbia law prohibiting the possession of guns at home._

Let's enumerate these events:

1) A foreign country has problems sealing its borders at both ends. Drugs on the south and firearms, allegedly, on the north. It's interesting to point out that the automatic weapons that the Mexican gangs are using are incredibly hard to find in stores here -- they're not the guns you buy at a rural Wal- Mart. It also conveniently ignores the elephant in the room -- pervasive corruption of Mexican officials.

2) Tenth anniversary of a tragedy. Referring to Columbine as a "recent" event is incredibly disingenuous.

3) Supreme court case invalidating an unconstitutional law. The letter of the law was upheld but you'd endeavor to attack the spirit of it?

This is a shameful attempt to take Obama to task on, frankly, a minor component of his platform at a time when he inherited a complex and severe economic mess unheard of in generations, if ever.

</comment><comment><USER5> Ok this is a not-so-serious solution Chris Rock proposed to the problem. Potentially NSFW.

<http://www.youtube.com/watch?v=xr8PQDoZXSo>

<comment><USER6> It wouldn't work anyways, people would just make their own bullets.

<comment><USER7> That video proposed knives for guns. A less "cowardly" way to kill. I like it better than the expensive bullets bit.

</comment></comment></comment><comment><USER8> how about disarm the police and legalize all now prohibited fun-time activities which the american puritanical streak requires we punish and extirpate ...funny how an ex-cop thinks the WAY cops buy guns can change the game, totally retarded</comment>


Beginner's Guide to Sales - <AUTHOR> https://strideapp.com/beginners-guide-to-sales/ <comment><USER2> Pretty neat split of chapters. Could have been a bit more visual though!</comment>