Why Raspberry Pi Isn't Vulnerable to Spectre or Meltdown - <AUTHOR> https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable-to-spectre-or-meltdown/ <comment><USER2> This is great, but remember that it covers Meltdown, not Spectre. Meltdown is the more immediate disaster, but Spectre is the more batshit vulnerability. You _really_ want to get your head around:

* The branch target injection variant of Spectre if you want to get a sense of how amazing this vulnerability is: you can spoof the branch predictor to trick a target process into running arbitrary code in its address space! This is crazy!

* The misprediction variant of Spectre if you want to get a hopeless feeling in the pit of your stomach, since the implications of mispredict are that certain _kinds_ of programs are riddled with a new kind of side channel we didn't really grok until last week, and no upcoming microcode update seems to be in the offing.

You could probably use the same Python conceit to illustrate the other two attacks; someone might take a crack at that.

(I'm not disputing that the R-Pi's aren't vulnerable to Spectre).

<comment><USER3> This covers both Meltdown and Spectre.

> Both vulnerabilities exploit performance features (caching and speculative > execution) common to many modern processors to leak data via a so-called > side-channel attack. Happily, the Raspberry Pi isn't susceptible to these > vulnerabilities, because of the particular ARM cores that we use.

The reason why Spectre is not a problem is because there is no branch predictor in these simpler arm cores. Instructions are processed in parallel when possible, but not before dependencies, including branch decisions.

EDIT: under "What is speculation?" branch prediction is described. Then in the conclusion: "The lack of speculation in the ARM1176, Cortex-A7, and Cortex-A53 cores used in Raspberry Pi render us immune to attacks of the sort."

<comment><USER4> There is almost certainly a branch predictor even in these simple ARM cores.

<comment><USER5> There's no reason to predict a branch if you're not going to execute speculatively.

I need to re-read the papers but I think the real problem isn't even speculative execution but allowing speculative cache changes.

The notion that "gadgets" didn't even need to return properly was both amusing and eye opening for me. It doesn't matter because the result will be flushed anyway! ;-)

<comment><USER6> In an in-order CPU, you can still use a branch predictor to predict what to fetch and decode, so that you don't stall waiting for instruction fetch to finish after you resolve the branch.

In practice, advanced in-order designs contain more local reordering mechanisms, e.g. in the load/store unit, but they lack the unified global abstraction of a reorder buffer. The most successful timing attacks involve a mis-speculated load, so they wouldn't apply to these mechanisms, but it's not completely out of the question that they are also an effective side-channel.

</comment></comment></comment></comment></comment><comment><USER7> This is a good overview of modern, superscalar, out-of-order, speculative CPUs that literally any programmer could easily understand. Recommended reading for every single engineer in the whole world (who doesn't already understand this stuff from reading source material e.g., Google Zero post).

<comment><USER8> Non-engineer here, this bit is key right:

> However, suppose we flush our cache before executing the code, and arrange > a, b, c, and d so that v is zero. Now, the speculative load in the third > cycle:

> v, y_ = u+d, user_mem[x_]

> will read from either address 0x000 or address 0x100 depending on the eighth > bit of the result of the illegal read. Because v is zero, the results of the > speculative instructions will be discarded, and execution will continue. If > we time a subsequent access to one of those addresses, we can determine > which address is in the cache. Congratulations: you've just read a single > bit from the kernel's address space!

To my understanding it is that saying that by...

1) ...flushing the cache so you have a 'clean' state, you can get...

2) ...the speculative execution to 'pull in' to cache the address user_mem[x_] but...

3) ...the particular address that's pulled into cache, 0x000 or 0x100, is determined by whether...

4) ...the illegal read of kern_mem[address] 8th bit was a 1 or 0...

5) ...which you can then subsequently determine the value of by...

6) ...timing how long it takes to access that user_mem[x] address once again and...

7) ...thereby leaking the value of kern_mem[address]...

So you still have to perform some logic on the result of the speed of the access to the secondary address read right?

If read of 0x000 is slow you know kern_mem[address] was a 1 and if fast kern_mem[address] a 0, and if 0x100 is slow you know kern_mem[address] was a 0 and if fast that kern_mem[address] was a 1?

Is that correct?

If it is it seems that timing is the key right, and actually the clever leap of creativity in completing the exploit, at least to my untrained mind.

Please do correct anything I've got wrong, I'm not an engineer/developer!

<comment><USER9> You're exactly correct. This is why the browsers decreased timing resolution in javascript so that you couldn't time memory accesses accurately enough to tell if the address was cached or not.

<comment><USER10> Does that mean -another- slight performance drop ???

<comment><USER11> Not in general.

Consider an Olympic 100 metre sprinter. Today we time this event very accurately, I think it's to one hundredth of a second, using sophisticated technology.

But even if the judges used a much less accurate mechanical stopwatch, Usain Bolt wouldn't actually be slower, we'd just be less confident of how ridiculously fast he is.

In some special cases, timing things very accurately might be essential to a use of Javascript, but I can't think of any examples off the top of my head.

<comment><USER12> gotta get that sweet rollover effect right to the 24th decimal baby

</comment></comment></comment></comment></comment></comment><comment><USER13> I understood everything up until the "suppose we flush our cache before executing the code" part which is probably the most important part.

There was a comment below the article that explained this part a little further:

> Imagine the value at the kernel address, which gets loaded into _w, was > 0xabde3167. Then the value of _x is 0x100, and address user_mem[0x100] will > end up in the cache. A subsequent load of user_mem[0x100] will be fast.

> Now imagine the value at the kernel address, which gets loaded into _w, was > 0xabde3067. Then the value of _x is 0x000, and address user_mem[0x000] will > end up in the cache. A subsequent load of user_mem[0x100] will be slow.

> So we can use the speed of a read from user_mem[0x100] to discriminate > between the two options. Information has leaked, via a side channel, from > kernel to user.

[https://www.raspberrypi.org/blog/why-raspberry-pi-isnt- vulne...](https://www.raspberrypi.org/blog/why-raspberry-pi-isnt-vulnerable- to-spectre-or-meltdown/#comment-1375375)

<comment><USER14> Yes, that is the _this is left as an exercise for the reader_ part of the explanation. (-:

The remaining part is to iterate the process over all of the bits in the word, using different bitmasks. The resultant set of 0 or 1 results for each bit yields the complete word.

Then one iterates _that_ whole process over all (useful) words in (mapped) kernel memory.

<comment><USER15> Thanks, this was the missing piece in my understanding. I was wondering how only knowing only 1 bit would be useful. Suppose the attacker wants to read this entire address (0xabde3167) using this method. Is it guaranteed that over multiple runs, this address would be the same each time at that point in execution?

<comment><USER16> It is certainly possible that the memory the exploit is trying to read might be changing under its nose. An actual implementation of the exploit would need to account for that.

</comment></comment></comment></comment><comment><USER17> Ok I think I understand the subtleties of these attacks now. But: _can anyone tell me why the accessibility check for protected memory doesn 't happen before the cache loads the contents of RAM?_ If that happened then none of these attacks would be possible.

I got my computer engineering degree in 1999 and ended up going the computer science route making CRUD apps all day. I feel in my gut that some engineer, somewhere, MUST have asked this question at one of the big chip manufacturers.

Am I missing something fundamental? Is the access check too expensive? If it isn't, then can the microcode be updated to do this, or is caching/accessibility checking happening at a level above microcode? If that's the case then it would seem that pretty much all processors everywhere that do speculation without protected memory access checks are now obsolete.

<comment><USER18> > can anyone tell me why the accessibility check for protected memory doesn't > happen before the cache loads the contents of RAM?

From what I understand, it does happen on AMD, which is why AMD CPUs are not vulnerable to the more dangerous Meltdown attack (any code reading kernel / hypervisor host memory).

Intel / ARM delays the checks until later, to the time when the speculated instructions are actually finalised and make their results available. This is faster, and loading some memory into the cache is normally invisible to the unprivileged code. The checks would still be done when actually reading that memory. But nobody spent enough time considering the timing side-effects of the cache.

Now even if the protected memory reads are fixed by the OS updates - then it still leaves the Spectre attack - code running in a process reading all of "its own" memory, regardless of any software sandboxing. This means that all sorts of sandboxing methods for javascript interpreters, bytecode interpreters, plugin architectures, etc are insecure. And the OS patches can't help here, because the sandbox isn't in protected memory.

<comment><USER17> Thank you, that was a succinct explanation of the difference between AMD/Intel and the order of speculation and protected memory access check for the Meltdown attack, and makes it easier to understand:

[https://en.wikipedia.org/wiki/Meltdown_(security_vulnerabili...](https://en.wikipedia.org/wiki/Meltdown_\(security_vulnerability\))

I see now why the Spectre attack is so serious (reading out of bounds within the same process memory). I feel like there may be ways to catch unallocated memory access similarly to how protected memory works. But, that wouldn't help reads from allocated memory in runtime environments like for Javascript (where separate scripts in the same process space aren't meant to see each other's data). This is clearer to me now:

[https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...](https://en.wikipedia.org/wiki/Spectre_\(security_vulnerability\))

Going forward, we may have to assume that security is only possible with true process isolation. For example this might put pressure on OSs to fix their slow context switching implementations to encourage the use of processes instead of threads. Beyond that, I can't see any easy way to fix the situation and am highly skeptical of things like compiler fixes, because there will likely always be another way to abuse various instructions to read outside memory boundaries.

<comment><USER19> The slow context switching between processes has nothing to do with OS implementation. True context switching involves a page table flush. This is slow due to caching, independent of the OS. The only thing the OS can do is tell the processor which parts not to mark dirty, but -- as these attacks show -- this can expose vulnerabilities.

</comment></comment></comment></comment><comment><USER20> With all the news about these attacks lately, this is one of the best posts I've seen in explaining to less knowledgable people how exactly speculation causes a problem.

One question I still have that gets glossed over is how timing of instructions is captured.

<comment><USER21> in order to exploit it from a script running in a web-browser: there's a high- resolution timer in javascript. This one is limited to 5 to 20 us resolution to prevent such attacks.

Recently a shared-memory extension has been proposed. one javascript thread just increments a counter in the shared memory, functioning as a clock for the other thread.

In both cases, (Spectre) attacks can be prevented by browser updates, so any performance impact is not system wide.

This is different from Meltdown, which (only?) affects intel. That one requires kernel changes which cause system-wide performance degradation.

<comment><USER22> > This one is limited to 5 to 20 us resolution to prevent such attacks.

* make such attacks more difficult.

<comment><USER23> Impossible. This attack relies on detecting the timing between a cache hit and miss. If your clock resolution is larger than a cache miss then you can't differentiate the two events and so no information is leaked.

<comment><USER24> Not quite. An instruction that takes 1us is much less likely to start and end in a different 20us clock cycle than a 10us instruction. Simple repeated sampling combined with statistics still yields a timing attack. It'll be slower and less deterministic, but it's still a problem.

</comment></comment></comment></comment></comment><comment><USER25> The cores in (all versions of?) Raspberry Pi _do_ speculatively execute. It's just that the window of opportunity is tiny - just a few cycles (and maybe up to twice that many instructions) - and there's (probably) no way to get an indirected side-effect.

I wouldn't write off the ability to get a useful side-effect signal. The variants widely documented are not the only possible methods of inducing speculative side-effects.

<comment><USER26> Yes, the Raspberry Pi will issue loads before the branch resolves. But usually a processor's pipeline won't be laid out in such a way that the AGU won't have time to pass an address to the load pipe before the branch resolves and squashes the load. The Cortex A8 was an interesting exception but it was pretty deeply pipelined compared to most in order cores.

</comment></comment><comment><USER22> > The lack of speculation in the ARM1176, Cortex-A7, and Cortex-A53 cores used > in Raspberry Pi render us immune to attacks of the sort.

I didn't check, but these will almost certainly have branch prediction. What they probably lack is a predictor advanced enough to speculate on indirect branches, which AIUI is the primary vector of Spectre.

<comment><USER27> Branch prediction alone is insufficient. Speculative execution alone is insufficient. You need speculative memory loads for _any_ of these attacks to work.

The Cortex-A53 branch predictor [1] does prefetching to keep the core fed. This ensures that the instructions are ready for decoding, but has no architectural effects beyond the L1 instruction cache, which is already a well-studied timing sidechannel.

[1]: [http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc....](http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0500d/CJHEICEB.html)

<comment><USER28> What about the fact that these instructions might get partially executed in the pipeline before the branch gets resolved and the pipeline flushed? If a mis-fetched instruction can reach the LSU stage before the pipeline gets flushed, it might serve as a speculative memory load...

<comment><USER27> They're not partially executed. The branch predictor only fetches instructions. They might be _decoded_ , but it's not an out-of-order processor-- pipeline stages only proceed if the previous phase is correct.

Here's the Cortex-A53 pipeline: [https://www.anandtech.com/show/11441/dynamiq- and-arms-new-cp...](https://www.anandtech.com/show/11441/dynamiq-and-arms-new- cpus-cortex-a75-a55/4)

It's an in-order CPU, so that "issue" phase (pipeline step 5) stalls until the instruction pointer is resolved. Instructions must be issued to the "AGU Load" functional unit, which is what actually performs the read and pulls data into the cache hierarchy.

Note also that a single speculative memory load is insufficient for Spectre. You need _two_ speculative memory loads.

</comment></comment></comment></comment><comment><USER29> I was _already_ on the lookout for a small ARM-based mini PC, just for doing financial transactions and record-keeping. Now that seems more pressing but I don't know of any such thing in existence.

I tried doing that on RPi 3, but the IO seemed not up to the job -- the CPU appeared to be just about tolerable, but using micro SD as a disk was too slow and prone to failure (I'd have tried an external USB disk but I believe the problems were in part because of poor I/O bandwidth). Other single board machines seemed to have better provision for disks that are up to the task I had in mind, but lack software support, so that I had little confidence in security updates, for example.

If somebody sold this I think they'd have my money tomorrow:

* An ARM mini-PC

* With a decent security update team behind it (probably the hard part?)

* That will let me run some basics: for me, a Unixy OS with Chrome/Chromium, emacs, ledger and python, without a big effort to install those and keep them up to date

* Ideally without too much anti-commodification BS (from my customer perspective) so that hardware can be swapped out if needed

Does anything like that exist?

<comment><USER30> SD cards are optimized for sequential IO (reading/writing photos, video, music). For an OS root partition, random IO is much more important for general use. If the root partition is mounted from an external USB drive with higher random 4K IOPS benchmarks, IO performance should be greatly improved.

</comment></comment><comment><USER31> This is a fantastic read. Timing attacks are insidious and tend to crop it in the oddest places. I first learned of them when learning how to securely compare strings (used a lot with passwords). A naive implementation means that you can easily guess if a character is correct depending on how fast the compare function returns.

<comment><USER32> You shouldn't be comparing plain text passwords anyway. You should be using a secure password hash, such as bcrypt, sure, you should use constant time comparison, but in this specific case, it won't really make you vulnerable to use normal comparison.

<comment><USER16> Normal comparison is bad even if you are comparing hashes. Letting the attacker figure out the password hash allows them to attempt to crack the password through an offline brute-force attack running on GPUs.

<comment><USER33> I don't understand how this can be an issue. This is usually what happens:

> User enters password > PW gets hashed > Hash gets compared to the DB

I don't know of any same system that would allow you to compare a hash to a hash? Unless you have access to something you shouldn't, in which case it doesn't matter anyway, because you can probably just read the hashes.

<comment><USER34> If the user knows exactly how the hashes are generated (I believe a random salt would prevent this), it could still be used to better target an online bruteforce, though other defences such as rate-limiting should still kick in.

If, say, you submit a password with a hash that starts "b94", if the database doesn't use a constant time comparison, you can use the timing to figure out that the stored hash also starts with "b94" (statistically, given network etc. delays involved), meaning you can pre-filter your submitted guesses (i.e. bruteforce offline and only submit guesses that start "b94").

It's definitely a edge-case thought (and probably not worth worrying about unless you don't salt/rate-limit requests). I also don't know if the number of requests needed to determine the timing would actually be less than just making random guesses outright (intuitively it seems so because even if it takes a lot of requests it shrinks the search space at each step).

</comment></comment></comment></comment></comment><comment><USER35> This article wonderfully explains a complex context without losing a lot of relevant detail.

</comment><comment><USER36> > In the good old days*, the speed of processors was well matched with the > speed of memory access...Over the ensuing 35 years, processors have become > very much faster, but memory only modestly so: a single Cortex-A53 in a > Raspberry Pi 3 can execute an instruction roughly every 0.5ns (nanoseconds), > but can take up to 100ns to access main memory.

In real-world terms, what's the fastest processor we could build today whose execution speed is reasonably matched to it's main memory access speed (so it doesn't need caches, etc)?

I could imagine that a processor, with a simple design that closely matches a naive model of how CPUs work, would be very useful for high-security applications. It would be much easier to reason about up-front.

<comment><USER26> The problem isn't really the speed of the memory but its size. The planar nature of memory and the speed of light impose a latency of access on a pool of size N proportional to the square root of N. The L1 cache on your CPU has kept up in speed with the processor and is the same size as the memory computers had when computers could access their main memory quickly.

<comment><USER22> The latency of DRAM is mostly governed by Dennard scaling ("regardless of transistor size, power density remains the same"), because it means that making cells smaller reduces the available charge currents for bit-lines and the like proportionally, so only a small latency advantage can be gained.

</comment></comment></comment><comment><USER37> I enjoyed reading this a lot. I wonder why the developers decided to allow reading kernel-memory in the first place. When a scalar processor reads kernel memory, it crashes. When a speculative processor reads kernel memory, it relies on the assumption that the read is never committed to prevent leakage. It takes no expert to realise this is a potentially dangerous decision (and, as becomes clear now, is only valid in the absence of a cache).

To me it would make a lot more sense to use a special value to indicate the read did not succeed and propagate this value until it is time to crash. I guess this introduces some overhead (e.g. reserve a special value); but are there any other drawbacks?

<comment><USER38> This is the part I don't understand. How is the processor able to read a cacheline from a protected memory page without crashing (even if it was speculative and wouldn't happen in the idealized execution due to branching).

<comment><USER39> Because in the Intel design, for memory reads issued by speculative instructions, any "access denied" results are also delayed until the CPU control unit determines the instruction that issued the read should really have been executed.

But the actual read from is allowed to occur, even if the "access denied" signal is given. Which allows the read to effect the state of the data caches. This was likely done this way as a performance booster, because this would allow speculative instructions to also perform cache pre-fetching during their speculation window.

That seems to be why AMD CPU's are immune to Meltdown. AMD's design prevents the read from occurring when the "access denied" signal appears, so the cache state is not effected, so there is no side channel to detect.

<comment><USER34> > But the actual read from is allowed to occur, even if the "access denied" > signal is given. Which allows the read to effect the state of the data > caches. This was likely done this way as a performance booster, because this > would allow speculative instructions to also perform cache pre-fetching > during their speculation window.

Why is this? Is it because the CPU doesn't know ahead of time what is valid (because it depends on the "outcome" of instructions in flight), or is there something I'm overlooking?

<comment><USER39> Well, if you try to put yourself in the mindset of a CPU designer, without extensive cryptography experience [1] to be fully aware of timing side-channel attacks, you would see the speculative execution memory reads as harmless. If the predicted path is wrong, you'll reset the CPU state (cpu registers) so the running program sees nothing different. And if you skip running the reads through the full memory protection gamut (you still _have_ to do the address translation) during the speculation window you'll save a few cycles on the reads, and maybe a tiny bit of power. And in the case that the predicted path was correct, any "access denied" signals need to be delayed until the accessing instruction would commit anyway (to maintain proper sync with how the signal works, in that it indicates which instruction took the memory access fault, so you can't raise the signal until you know for sure the instruction would have executed). And if you see the reads as harmless (because they are thrown away if the speculative guess was wrong) then you might also see them as "free" cache pre-fetch instructions (because they do pre-warm the cache when the speculative path is the correct path).

In the end the result is a confluence of several different topic (speculative execution, data caching, high resolution timers [although these can be simulated with a plural CPU system]) that each in isolation is all but harmless, but together emergent behavior appears that was not immediately apparent from each one viewed individually. I.e., without caches there's no side channel to monitor. Without speculative execution there's no way to trick read a bad address and avoid taking a memory access fault. Without high enough resolution timers it becomes very hard detecting the time difference between a cache hit and miss.

[1] a reasonably safe assumption - most CPU architecture designers are not cryptographers, and most cryptographers are not CPU architecture designers, and most timing side-channel attacks have historically been against crypto. algorithm implementations.

</comment></comment></comment></comment></comment><comment><USER40> The best explanation of Meltdown I've read.

</comment><comment><USER41> The best comment made on that blog post was by Eben himself:

"One almost wishes that they'd stuck with the original name for the KPTI patchset: Forcefully Unmap Complete Kernel With Interrupt Trampolines.

[https://www.theregister.co.uk/2018/01/02/intel_cpu_design_fl...](https://www.theregister.co.uk/2018/01/02/intel_cpu_design_flaw/) "

Now that's funny!!!

</comment><comment><USER42> I've been wondering (and haven't seen it addressed anywhere) if these attacks could be used to get the private key out of game consoles. These days I would assume not - that the key would be in a secure enclave - but the current generation of consoles are a few years old now and maybe that's not the case.

<comment><USER43> The private key used to sign code? No, that wouldn't be in the console at all.

<comment><USER44> I imagine they mean the decryption key (rather, the 'private, encryption' key).

</comment></comment></comment><comment><USER45> Off topic, but I haven't seen this discussed anywhere yet. My understanding is that font files can contain complex instruction sequences to control exactly how a font is rendered. I believe Windows implements a kernel space VM to execute these instructions. I know variants 1 and 2 did not necessarily require eBPF but that it made the attack simpler because the desired instruction sequences could be injected directly into kernel space (rather than finding existing sequences in the code base). It seems that in theory font rendering could serve a similar function on some platforms.

</comment><comment><USER10> Now... I am interested in assembly :D Any recommendations ???

Really awesome explanation

<comment><USER46> I highly recommend [http://www.nand2tetris.org/](http://www.nand2tetris.org/) and the The Elements of Computing Systems book [https://www.amazon.com/Elements-Computing-Systems- Building-P...](https://www.amazon.com/Elements-Computing-Systems-Building- Principles/dp/0262640686/ref=ed_oe_p)

<comment><USER10> Thanks :)

</comment></comment></comment><comment><USER47> Hey, what about Intel Xscale processors like the PXA2xx series ?

These do have Dynamic branch prediction/folding afaik and may be affected ?

Does somebody have a spectre.c tuned for generic armv5tel for example?

Current versions of spectre.c, like this one [https://gist.github.com/LionsAd/5116c9cd37f5805c797ed16fafbe...](https://gist.github.com/LionsAd/5116c9cd37f5805c797ed16fafbe93e4) still contain "_mm_clflush" and therefore do not compile on ARM at all.

</comment><comment><USER48> Fantastic read. Before reading the article, I assumed there were many HN readers who were extremely proud about their Raspberry Pi being invulnerable to Spectre or Meltdown

</comment><comment><USER49> I've done some cursory searching and not found anything, so I'll ask here: what mechanism is used to measure how long it takes to access a specific address in memory?

I assume there is some way to tell the CPU "when memory location X is read, store the current time in register Y" or some such thing. Could anyone share what that mechanism is?

<comment><USER50> Elsewhere in the thread, someone asked the same question and got an answer: [https://news.ycombinator.com/item?id=16080230](https://news.ycombinator.com/item?id=16080230)

<comment><USER49> Thank you for that link! I'll write out the conclusion I came too from reading those comments:

Instead of measuring the literal time interval between instructions, the number of cycles between two points is measured (using the RDTSCP instruction).

</comment></comment></comment><comment><USER51> How many RPi users are using this board to run untrusted code?

The RPi may mitigate risk of these attacks simply in the way it is used.

Perhaps hobbyists use it to run their own small programs, not random third party Javascript in an enormous web browser from some corporation.

</comment><comment><USER52> None of the RISC-V chips are either:

[https://riscv.org/2018/01/more-secure-world-risc-v- isa/](https://riscv.org/2018/01/more-secure-world-risc-v-isa/)

<comment><USER53> ...nor are 486s, 386s, AVRs, 8051s, and a bunch of other low-performance in- order CPUs.

There's also this... [https://groups.google.com/a/groups.riscv.org/forum/#!topic/i...](https://groups.google.com/a/groups.riscv.org/forum/#!topic/isa- dev/JU0M_vug4R0)

<comment><USER54> That's a little unfair, the RISC-V design is intended for both low power and high power applications, in implementation is has the potential to be comparable to the Pi 3's Cortex-A53. Where as the two 86s you mention are very old slow CPUs and the other two you mentioned are 8bit microcontrollers.

</comment></comment></comment><comment><USER55> What would finally bring this all together to me would be an example of a real world attack that would be carried out using these methods on some target, perhaps with an implementation.

<comment><USER41> Since it was an industry effort to find the flaw, and they are vulnerable to the threat they've exposed, it would seem at odds to their interests (and my own) to provide you or anyone else with an example of how to exploit it.

And I'll offer that if you're not capable of demonstrating it after reading Eben's description of how it works than there is no good reason for you to have an example handed to you.

If you think you are capable I'll offer your time would be better spent working on fixes.

</comment></comment><comment><USER56> Didn't ARM say the Cortex A53 is vulnerable to Meltdown?

<comment><USER57> According to [https://developer.arm.com/support/security- update](https://developer.arm.com/support/security-update), the Cortex-A5 _7_ is affected, but the Cortex-A53 isn't.

<comment><USER58> A Google Project Zero member said that they got Meltdown working on a Cortex-A53.

</comment></comment></comment><comment><USER59> Does anyone expect bug revelations after this to be less worse, or is there still a chance there could be vulnerabilities that are worse than these?

<comment><USER60> It's hard to imagine something worse to be honest. These vulnerabilities basically amount to ripping away the entire veil of protections at every level that we've built up over the years.

Future vulnerabilities that I could imagine being "worse" would be either encryption vulnerabilities or signals level vulnerabilities.

</comment></comment><comment><USER54> Technical details aside, I find it quite amusing that the hardware in my pi zero is more secure than my desktop that is two orders of magnitude more expensive

<comment><USER61> And yet, my abacus is even more secure ;-)

<comment><USER62> Only if you wear gloves while using it and shake it after finishing a calculation.

<comment><USER63> Been reading Cryptonomicon, have we?</comment></comment></comment></comment>


The Bitcoin affair: Craig Wright 'to move' Satoshi coin - <AUTHOR> http://www.bbc.com/news/technology-36193006?hn <comment><USER2> "Step right up, step right up, ladies and gentlemen, see a genuine Satoshi coin MOVE before your very eyes! Yes, Craig Wright the Marvelous will MOVE one of the TRUE Satoshi coins! A sight never before seen, never to be seen again! Step right up, only a tuppence to see the great Craig Wright..."

</comment><comment><USER3> If he was satoshi he would just sign a message with the genesis block's private key saying so. He wouldn't announce that he's going to move an early coin on the bbc. It's simultaneously the most convincing proof and the easiest proof to do.

In my eyes, he's a fraud until he does it.

<comment><USER4> Why though? What does he gain from all this? (I agree it's all a total scam)

<comment><USER5> All will be revealed in due time</comment></comment></comment>


Ask HN: Is Sun part of binary star system? - <AUTHOR>

I stumbled upon this theory and the evidence supporting it. Hard to ignore it completely, considering we are constantly updating our place in the Universe century after century. A binary star would explain a lot about climate patterns that fluctuate approximately every 20,000 or so years.
Evidence: http://www.binaryresearchinstitute.org/bri/research/evidence/lunarcycle.shtml
What do you think? <comment><USER2> I've read a discussion or two on the subject by amateur astronomers far more knowledgeable than myself.

The clear consensus was that it's quite unlikely.

As I understand it, the general reasoning is that multiple star systems, even those which are quite far apart by multiple star system standards are still so close together that if we had a partner in even the high end of that observed range it would be easily detectable. Also, if the partner were so far away as to be hard to detect it would be exceptional and have an orbit in the hundreds of thousands to millions of years, not a mere 20,000.

</comment><comment><USER3> This is psudeo-science bunk.

Their papers are non-existent, their sources jokes and the whole thing is based in religion. You need evidence for your claims, especially when they fly in the face of all of modern cosmology.

<http://en.wikipedia.org/wiki/The_Holy_Science>

<comment><AUTHOR> I don't know. I'm a skeptic of most things but this seems plausible to me.

[http://www.space.com/5037-nasa-baffled-unexplained-force- act...](http://www.space.com/5037-nasa-baffled-unexplained-force-acting-space- probes.html)</comment></comment>


Is it OK to steal "Downton Abbey"? - <AUTHOR> http://www.salon.com/2012/01/27/is_it_ok_to_steal_downton_abbey/singleton/ <comment><USER2> A. Copyright infringement is not stealing.

B. The internet thrives precisely because it is transnational. This allows for quality programming to span the world.

C. There is an international market for current episodes of popular TV shows. There is such a large market that people are willing to commit copyright infringement.

D. Just because your business model doesn't adapt to the market, does not automatically mean that your business model deserves protection in the market.

E. Media content creators have long protected their international licensing agreements with anti-customer technology like DVD Regions.

F. At the end of the day, the customer doesn't care. They will find a better product in the market.

G. It's my experience that people who pirate out of this frustration, are happy to pay when it is available. The person who pirated the Christmas Special would have paid money to see it, it was just not available at any price.

<comment><USER3> OK, copyright infringement isn't stealing. It's copyright infringement. And copyright infringement is illegal.

I am sorry that some people are "frustrated" because they cannot see their favorite programs at the same time that people in other parts of the world can see them. But what a remarkably morally shaky ground upon which to break the law! My great-grandfather stole food once; his father died when he was eight, and his mother couldn't support the family. Today, people steal--sorry, copyright infringe--Downton Abbey because they can't wait to find out whether Lady Mary is going to marry Matthew.

<comment><USER4> Morality and legality often intersects, but one does not imply the other. In other words, that something is legal or illegal doesn't make it moral or immoral.

It does not follow from your ancestors hardships that downloading a TV show is inherently immoral, any more that is follows it is moral.

What I consider very interesting in the discussion of the morality of downloading TV series in particular is in the comparison with DVRs:

Legal: DVR'ing a free-to-air broadcast TV show and skipping the commercial breaks.

Illegal: Downloading the same TV show, with the commercial breaks edited out.

The only substantial difference in the two scenarios is timing - whether you will be watching a Christmas special at Christmas or in May, two years later (as is more often the case with US shows in Europe).

Further noting that the the fact these TV shows airs on such a long delay reflects the practicality of how the TV show market work, not some particular desire of the copyright holder, what is the moral principle being breached here?

<comment><USER5> Just to further underline the divergence between morality and legality, it's worth noting that under current copyright law, it is illegal in the United Kingdom to record (i.e. 'DVR') any television broadcast.

It is also illegal to rip a copy of a CD you own to listen to on a computer or copy to a portable music player...

<comment><USER6> In the Netherlands, making a copy of copyrighted material is legal for personal use. There's a levy on blank media such as DVD-Rs which is shared between copyright holders.

</comment></comment></comment></comment></comment><comment><USER7> _"If they aired a day later," she says, "illegal pirating would be going on."_

Probably, for different reasons, but likely not anywhere as near as it is today. If you knew stuff would be on in the UK on Th night, and you could see it uncut and unreformatted 26 hours later, you'd be far less likely to have initially bothered to go search it out.

I submit that the awareness and convenience of online 'piracy' of TV shows has been driven, in large part, by the frustration people felt by knowing they'd have to wait months in the first place. Now that there's a whole generation of people who already know how to 'pirate', they're not going to turn back (certainly not without a fight - SOPA, etc) but the content industry has themselves to blame for this again.

We gave up on BBC America back around 2004/2005 because they insisted on showing repeats instead of decent shows, and not explaining themselves. There was one week where they showed a combined 96 hours of "ground force", "changing rooms" and one other insipid home reality show. _96 hours_ of repeats of just 3 shows. Meanwhile EastEnders was scaled back and they showed less of that, and kept falling further behind. Eventually, after about a year or so of EastEnders in 2004, in to 2005, they started showing repeats of EastEnders from 2004 _in place of the then-current episodes_. It was as if they thought people wouldn't notice (or care) about getting repeats of a year- old ongoing soap episode. We quit even trying to support BBC America at that point, and turned to full scale torrents of any UK shows we wanted.

In the absence of being able to simply pay a UK TV license fee directly to the appropriate office, we'll just pirate. I realize that $300 still wouldn't cover all the potential ads and such ITV gets, but it'd be a strong start.

Make the BBC channels, ITV, and a couple other UK channels available as a UK package on DirecTV or Dish, charge $49/month, and I'd _happily_ pay, assuming they were uncut feeds.

<comment><USER8> > _Make the BBC channels, ITV, and a couple other UK channels available as a > UK package on DirecTV or Dish, charge $49/month, and I'd happily pay, > assuming they were uncut feeds._

From the other side of the pond, I'd like to repeat that sentiment in reverse.

Please don't forget, Americans, that we have just the same problem waiting for American shows, which there are many more of, and therefore also many more great shows.

American sport TV is generally already great from the leagues themselves, with MLB TV, NFL GamePass and whatever the names are for NBA/NHL... but general entertainment/drama/comedy/etc, it's pirate a few hours later or a long, long wait.

<comment><USER9> I disagree. I don't own a TV anymore, and probably never will.

I want to pull up the shows I want, when I want, and watch them where I want.

To do this, I rely on the following services, in order:

1\. Hulu (I'm happy to deal with ads)

2\. Network streams (ditto ads)

3\. The Pirate Bay (when not available through other means)

4\. Another site dedicated to current/past British TV

Re #4 - there's no way, just no way I'm going to wait months to watch a show on PBS that aired on the BBC/ITV/Ch4 yesterday.

IMHO, the most lucrative path for the industry to follow would be a subscription model that's tied to usage.

* Users buy credit, and that credit is used as they download content.

* Current content is more valuable - so the current season of a series costs $X/GB, last season costs $Y/GB, etc.

* Every channel/network is in business for themselves (e.g. cut out Apple/Amazon/DirectTV altogether)

I'm not holding my breath for that scenario though.

<comment><USER8> 1\. Hulu isn't available in the UK 2\. Neither are (legal) streams from US networks

</comment></comment></comment></comment><comment><USER10> The same problem of course exists for all us non Americans. Most American TV series air months or years later, if they air at all.

I would love to be able to watch the latest and greatest in entertainment within a day of it airing but that is not possible to do with legal means so 'everyone' turns to piracy.

<comment> cf0ed2aa-bdf5 Exactly my thoughts.

I'm German so even if my favorite shows finally made it to Germany after years they are usually butchered by a sloppy at best dubbing. If I insisted on English audio I'd have to wait another year to buy the DVDs.

I would love to watch my favorite show with ads or even pay for some of them to be able to support them but unfortunately that's just not possible as of now.

<comment><USER11> Same here, I don't watch dubbed television shows/movies. The only alternatives are TNT and FOX atm, at least with sky you have dual audio.

<comment><USER12> Oh, God, the German dubs for Star Trek: The Next Generation were _horrible_ \- they sounded like the same guy did everybody's voices (OK, except for Troi, fortunately).

And I'll never forget the debut of the Cosby Show in Germany and wanting to show my college friends this show I really liked - and realizing that without Bill Cosby's voice, it was utterly, hopelessly worthless. Not the first time Germans looked at me like I was crazy, but it was a formative experience.

</comment></comment></comment></comment><comment><USER13> I pirated Downton.

I pay for BBCA; moreover, when stuff is available on iTMS I buy, even when I buy the premium cable channel it runs on, even when it's available on VOD, even (for instance, with The Sopranos) when I own much of the physical DVD media for it! I've spent many many hundreds of dollars on iTMS for content that I already had legitimate paid-for access to.

This is of course rationalization; the BBC is entitled to monetize their content however they see fit. That's capitalism. I rely on congruent norms, contracts, &c to make my living, and so do you --- even if you don't sell your own software directly, your wages are effectively subsidized by the defensibility of IP; we are all of us in the business of selling content for (on the face of it) unjustifiable premiums.

But whatever, I'm human. This is perhaps a good reason for media companies to stop doing region encoding and staggered releases and such; it socializes people to piracy. If you've even got me torrenting stuff, you're probably doing something very wrong.

<comment><USER14> Sorry to be terribly pedantic, but the BBC does not run or produce Downton Abbey. Downton Abbey airs on iTV in the UK.

<comment><USER13> That's not pedantic at all; it undercuts part of my rationale for pirating it!

</comment></comment></comment><comment><USER15> It's interesting that this topic is something article worthy to the US; I'm not taking a swing at the US or salon.com. But as someone from the UK, this is the norm for a good majority of TV shows. I'd even make the assumption that if someone told me they can't wait for the next episode of a TV show; that they're waiting for it to become available online for download

<comment><USER16> Yep, USA welcome to what Hollywood does to the rest of us.

</comment></comment><comment><USER17> A friend of mine works in BBC sales. He tells me that selling rights for their TV shows to channels in various countries is highly lucrative for the BBC.

He also tells me that he understands this model won't last much longer. But until then, for economic reasons, the BBC doesn't want to make it too easy for you to watch their content directly in your non-UK country without going through a local channel.

<comment><USER18> International sales, distribution, and licensing has been a major cash cow of the TV industry for decades. It works in the other direction, as well, i.e., from the USA to the UK (and to other countries).

Your friend is correct in that the appeal of this cash cow is why the industry will fight tooth and nail before they have to put her out to pasture. The model is going to become irrelevant sooner or later, but for the time being, it's still paying off handsomely. It will go, but it won't go quietly.

<comment><USER19> The crazy part is that they could replace it with a new cash cow by simply charging for convenient access. Not only that, but you could deal with fewer middlemen, get more control over your own product distribution.

</comment></comment></comment><comment><USER20> The irony is that if ACTA passes we'll probably have to VPN INTO China to freely watch delicious delicious western TV shows on PPStream and the likes.

</comment><comment><USER21> The topic reminds me of a presentation by Mark Pesce: <http://www.youtube.com/watch?v=LxCoCTc3T5Q>

In it he talks about how piracy has helped some shows, and alternate forms of publishing (physical media, online). Keep in mind that he's speaking from an Australian viewpoint and the economics are slightly different in this case mostly discussing content produced for another market... But it could be good stuff for you Kill Hollywood thinkers.

</comment><comment><USER22> Is it illegal to purchase a VPN account in the states and pay for a Netflix subscription?

<comment><USER23> You would probably need a credit card tied to a us-based address as well.

<comment><USER24> Nope.

</comment></comment></comment><comment><USER25> In markets where even a delayed rebroadcast is vanishingly unlikely, online streaming is absolutely thriving. For example, a whole lot of anime hits Crunchyroll and Hulu before the fansub groups ever get a crack at it. These sites and a few others are also expanding into live action Japanese and Korean TV.

However, I think this only works when there's very little competition (from broadcasters) for individual shows. The BBC is probably in the worst position possible for an attempt to move to this model due to interplay between company-wide policy and the negotiating power of its international counterparts. Previous agreements with cable companies can't help much either.

</comment><comment><USER26> Now you know you see a franction of the problem most Europeans face.

All our american (TV) content comes in 3-6 month delays. The fact HBO has decided to scrap their online distribution is just beyond me.

</comment><comment><USER27> I pirate Top Gear. BBC America butchers the hell out of the program. For starters, because they can't be bothered to secure music rights worldwide, they replace all the well-chosen, synchronized music with awful public domain stuff. Assuming we're all uninterested and intolerant, they often cut out the guest interviews, despite the usually witty banter being enjoyable on its own. Finally, in the ultimate insult, before every ad break they actually _show you the punchline to the next segment_! They literally ruin each and every show, segment by segment!

If I'm watching BBC America, it's because I want to watch _the BBC_. I don't want to watch some watered down, Americanized version. I truly don't whether they hired dumb Americans, or they're just snobby Brits who think Americans are too dumb for their shows. Either way, it's insulting and not very entertaining.

So, I can't speak for Downtown Abbey, but if it's treated anything like Top Gear, I can't imagine why they would think we'd want to watch their delayed, edited, watered down slop.

Incidentally, I have looked into legal channels for purchasing Top Gear and they're _all_ edited. The only one that, I think, is legitimately original is the British-release of the DVD, but I'm pretty sure that I would be _technically committing a crime_ by bypassing region limitations on those discs.

So, is it legal? No. Is it morally correct? No. Is it okay? Yes, in my book, because the value I place on the original, unmodified, timely content outweighs the legal and moral argument against pirating it.

<comment><USER28> Hear hear! I'm a huge fan of Top Gear. I even had a subscription to the magazine (shipped from the UK) before it got ridiculously expensive.

Downloading is the only way I can watch it. Years ago, before I got rid of cable, it wasn't on BBC America. Now that it's available, in a horrible edited form, I don't have cable.

I've considered watching it on iPlayer via VPN but AFAIK the quality is much lower. Plus this would actually put the BBC in a worse position, having to pay for bandwidth I'm otherwise using from fellow enthusiast sharing the file.

I would pay if there was a way to legally watch it online, preferably in HD and close to the original release date.

</comment></comment><comment><USER29> Is it OK to steal content from Hacker News? Is it OK to republish someone's blog post under your own name? Is it OK to steal free coupons from your neighbors' mailbox? Is it OK to steal free phones provided by phone companies (mostly feature phones) ?

If your answer to any of the above is Yes, you probably will think that stealing "Downtown Abbey" is OK. Otherwise, think really hard and try to explain the difference.

<comment><USER30> What does "steal from HN" even mean? The blog example isn't valid: nobody is taking shows and putting their names in the credits (at least, pertaining to this conversation). Coupons and phones are physical items that have very different rules and mores associated with them.</comment></comment>


Amazon Acquires LoveFilm, The Netflix Of Europe - <AUTHOR> http://techcrunch.com/2011/01/20/amazon-acquires-lovefilm-the-netflix-of-europe

<comment><USER2> For all the Americans (and probably Europeans, I think LF is mostly a UK company) it's important to bear in mind that LoveFilm ain't Netflix.

On the other hand; it's the best we've got.

I have a love hate relationship with them - the selection is pretty good and the service is fine (with only a few hiccups which, given the state of our postal service is probably understandable). Although; their main UK depot is about 40 miles from me, and I have heard people out in the wilds have some issues.

On the down side the online streaming catalogue could be expanded (5,000+ films, but not always the latest releases) and I tend to have trouble getting popular disks (sometimes they seem to send me random disks from my list for no apparent reason).

I've been waiting for series 3 of Battlestar Gallactica for about 3 months now... :P

I'm pleased Amazon are buying them, that's a positive move IMO. Their easily one of my favourite companies and seem to manage to let their acquisitions flourish rather than die off. So... looking good :) (and if LF eventually merges into my Amazon account, win :D)

LF made a statement here btw: [http://www.lovefilm.com/features/detail.html?editorial_id=32...](http://www.lovefilm.com/features/detail.html?editorial_id=32329)

EDIT: their recommendations engine is pretty dire as well incidentally, that is probably the main difference from Netflix

<comment><USER3> I signed up for Lovefilm earlier this month for the film streaming. I searched before hand and they had a nice film selection so I figure I'd go for it, if it sucked I could cancel. I signed up for the best plan that had streaming included (had no intention of doing postal DVDs) and found the following:

\- The only films you can watch for free (after you've paid the monthly registration fee) are from before 2007, even though their entire catalogue contains _newer_ films and it says "Your package includes unlimited online viewing" and "With access to 5,361 watch online titles" on both the sign up pages and in my account.

\- After paying £4 for a film (Inception) which I expected to be included in the first place (a pipe dream I guess) I load it up... it's 360p at best, full screening makes it unwatchable.

\- I figure if this is the state of it and I have to pay for shitty quality films I may as well go out and but the DVD, which I wanted to avoid... so I decided to cancel my account to find it's impossible to do online, you have to phone up... it was 4am, they were closed.

Terrible experience, but the joke is on me I guess, I didn't realise I could buy/rent films on iTunes so I'm doing that now.

<comment><USER2> Yeh... it leaves a lot to be desired (another "this is not netflix" situations). Particularly the streaming quality, which is why I don't bother.

I'm on the "three disks at home" package which apparently lets me watch about 4,000 of the streamable ones for free. In the past on cheaper accounts I got less I think.

In my experience the "top" recent films are always pay-for, and the lesser known ones are free. I personally don't mind that because I've always enjoyed indie/arthouse cinema :)

Definitely do not think it is worth it for streaming only.

</comment></comment></comment><comment><USER4> This is weird. Amazon Germany used to operate a "Netflix" offering which they sold to LoveFilm in 2008. I was actually a customer and canceled at that point, LoveFilm's site was just terrible.

So now they are buying back what they partially sold in 2008?

<comment><USER5> Amazon sold it's DVD rental services in Germany and the UK to Lovefilm for a 48% stake in the company. Today they acquired the outstanding 52%.

</comment></comment><comment><USER6> The Netflix of europe? I'm european and I've never heard of LoveFilm before...

<comment><USER7> Netflix of UK would be far more apt.

I see on their website that they have versions for Germany and most of Scandinavia, but I have no idea how big they are there, and that's a far cry from the whole of Europe anyhow.

<comment><USER8> I'm in Norway, and a film buff, and I've never heard of them before. If they've done any marketing at all, it has managed to escape me-- which seems unlikely.

So my guess is: not very big in Scandinavia.

<comment><USER9> I'm in Sweden and I've heard of them but never used the service. I think they had some commercials on TV a few years ago.

</comment></comment></comment></comment><comment><USER10> LoveFilm also white-labels its service. List here:

[http://en.wikipedia.org/wiki/Lovefilm#Operate_rental_service...](http://en.wikipedia.org/wiki/Lovefilm#Operate_rental_services_for_other_companies)

It would be interesting to know what proportion of LoveFilm's business is under its own brand, versus under these other brands, and whether amazon will continue to white-label the service long term.</comment>


Go's work-stealing scheduler - <AUTHOR> https://rakyll.org/scheduler/ <comment><USER2> The original design document for scheduler [1]. The author Dmitry Vyukov is famous for lockfree data structures implementation.

1\. [https://docs.google.com/document/d/1TTj4T2JO42uD5ID9e89oa0sL...](https://docs.google.com/document/d/1TTj4T2JO42uD5ID9e89oa0sLKhJYD0Y_kqxDv3I3XMw/edit)

</comment><comment><USER3> One missing piece for me: How does the Go scheduler ensure it won't end up fighting the underlying OS scheduler? Are thread-affinity APIs enough?

Does the scheduler have any awareness of NUMA or NUMA-like topologies (I'm thinking here of hyperthreading) that could influence scheduling decisions?

<comment><USER4> An interesting tidbit from the Erlang world: We have CPU affinity controls (erl(1) options +sbt {db,tnnps}) which will spread schedulers (Erlang's name for a P) over a NUMA-like topology and keep track of the relative price of handoff/stealing between CPUs. Another option defines if you want load compaction and load balancing (+scl, +sub). Some workloads are more efficient if you can keep the work mostly on a few cores rather than spread the work over all available cores in the system because communication will be faster that way. If one core can process all work and get back to an idling state quickly, it usually beats spreading the load out due to caching.

For some workloads and hardware configurations, the gain from doing this is quite high because you can avoid schedulers jumping between cores and in the process destroying cache layers and TLBs.

OTOH, when running in a typical cloud environment, you are at the mercy of the underlying hypervisor and thus your load profile is different. In that case, affinity has little to no effect.

</comment></comment><comment><USER5> Go's work-stealing scheduler is crude in comparison to Doug Lea's, which is a work of artful mechanical sympathy: [https://github.com/netroby/jdk9-dev/blob/master/jdk/src/java...](https://github.com/netroby/jdk9-dev/blob/master/jdk/src/java.base/share/classes/java/util/concurrent/ForkJoinPool.java#L173)

<comment><USER2> Seems like a reasonable take on Java Fork-Join shortcomings [1]. One of them is exceeding complexity which of course is very popular in Java world and the comment shows how Go version is 'crude' so apparently not good enough.

"The F/J framework classes -

1) have many, many levels of inheritance,

2) nested classes on top of nested classes,

3) instance variables used directly by other classes (known internally as "representation-level coupling among classes"), code from the Hackers Delight without comments about what it does,

4) homegrown deques and queues instead of standard Java™ Classes, and so much more."

1\. [http://www.coopsoft.com/ar/CalamityArticle.html](http://www.coopsoft.com/ar/CalamityArticle.html)

<comment><USER6> These are arguments against the implementation, not the actual utility of the framework. One can have ugly internal implementation (which sometimes is unavoidable because you're solving hard problems), but clean interfaces. Regardless, Doug Lea anticipated these complaints in the comments to his code:

         * Style notes
         * </comment></comment></comment><comment>=====
         *
         * Memory ordering relies mainly on VarHandles.  This can be
         * awkward and ugly, but also reflects the need to control
         * outcomes across the unusual cases that arise in very racy code
         * with very few invariants. All fields are read into locals
         * before use, and null-checked if they are references.  This is
         * usually done in a "C"-like style of listing declarations at the
         * heads of methods or blocks, and using inline assignments on
         * first encounter.  Nearly all explicit checks lead to
         * bypass/return, not exception throws, because they may
         * legitimately arise due to cancellation/revocation during
         * shutdown.
         *
         * There is a lot of representation-level coupling among classes
         * ForkJoinPool, ForkJoinWorkerThread, and ForkJoinTask.  The
         * fields of WorkQueue maintain data structures managed by
         * ForkJoinPool, so are directly accessed.  There is little point
         * trying to reduce this, since any associated future changes in
         * representations will need to be accompanied by algorithmic
         * changes anyway. Several methods intrinsically sprawl because
         * they must accumulate sets of consistent reads of fields held in
         * local variables.  There are also other coding oddities
         * (including several unnecessary-looking hoisted null checks)
         * that help some methods perform reasonably even when interpreted
         * (not compiled).

I find the "Calamity" article disingenuous. If you read more of the comments, Lea clearly explains the source of many of his data structures and gives an overview of how it all works.

<comment><USER7> The article was written in 2010 just before the release of JDK1.7. The above comments are for the JDK1.9 release in late 2017. Doug has had some time to improve his comments. Perhaps you should look into the calamity part 2 article to see how well this "framework" with it's internal structure problems performs in JDJ1.8 streams.

</comment></comment><comment><USER8> > Each M should be assigned to a P. Ps may have no Ms if they are blocked or > in a system call. At any time, there are at most GOMAXPROCS number of P. At > any time, only one M can run per P. More Ms can be created by the scheduler > if required.

So if every new Goroutine I spawn does an I/O operation that takes long time to finish, the scheduler will essentially spawn the same number of OS threads because every other one is blocked and no 'spinning' thread is available? If so, creating new OS threads seems like a lot overhead comparing to run a single thread in an event loop.

<comment><USER9> That's only happening for IO operations which get really blocked on syscall level, which means no async version is available. For the most important IO operations (sockets) the asynchronous variants are used internally. Which means if a read/write can not be performed immediately, the goroutine will register at the netpoller component (which is a wrapper around epoll/kqueue/iocp for IO status updates) for IO status updates, and then the goroutine will yield and wait until IO becomes possible again. The current thread can execute another goroutine until then. This means for goroutines blocked on network no extra OS threads are required. For other blocking OS operations (maybe file IO) extra OS threads are required.

</comment></comment><comment><USER10> Tensorflow has the same thing from Eigen

</comment><comment><AUTHOR> there is also this paper: [http://supertech.csail.mit.edu/papers/steal.pdf](http://supertech.csail.mit.edu/papers/steal.pdf) which also describes something similar.

<comment><USER6> For interested readers, there's a bunch of papers on the Cilk runtime's work- stealing scheduler. The paper signa11 pointed to is one of many. They are classics in the runtime literature. Other two great papers are "Cilk: An Efficient Multithreaded Runtime System" by Blumofe et al., PPoPP 1995, [http://supertech.csail.mit.edu/papers/PPoPP95.pdf](http://supertech.csail.mit.edu/papers/PPoPP95.pdf) and "The Implementation of the Cilk-5 Multithreaded Language", Frigo et al., PLDI 1998, [http://supertech.csail.mit.edu/papers/cilk5.pdf](http://supertech.csail.mit.edu/papers/cilk5.pdf)

</comment></comment><comment><USER11> >if not found, poll network.

Does this mean network IO is only performed when there are no idling goroutines? That can't be right... what am I not understanding, here?

<comment><USER12> I don't know if the article is accurate or not, but I think you do have it backwards from what the article says.

I think it says that network IO is only performed where there are no runnable (not idling) goroutines.

<comment><USER13> The author of this article is part of the Golang team ([https://github.com/rakyll](https://github.com/rakyll)). I guess the correctness of this article is ok.

</comment></comment></comment><comment><USER9> > Ps may have no Ms if they are blocked or in a system call.

Is it really this way or the other way around? I would have guessed threads which are blocked in a system call are represented by an M which is not currently scheduled by the scheduler, which means that M isn't assigned to a P.

<comment><USER14> I'm not super sure what was meant here, but I could add one point of info, FWIW: Go is creating extra OS threads for blocking system calls. In fact, sometimes more than one thread per such (for taking care of stdin and stdout, I think).

I have been able to create at least 4999 go-routines with blocking system calls though (Two OS threads were created per go-routine / syscall), so not a problem you will run into quickly.

<comment><USER15> _FWIW: Go is creating extra OS threads for blocking system calls._

One point for house Go!

</comment></comment></comment><comment><USER16> Interesting!</comment>


Ask HN: Declining the job offer after accepting - <AUTHOR> I recently interviewed with major tech company and accepted their offer. Company has already started visa transfer. I like the company, compensation and perks. However just few days back a friend of mine pitched an startup idea to me and I  feel strong inclination to join his startup. Now I have to decline offer which I already accepted. I know it is unprofessional but is there a right way to do it ? <comment><USER2> Is there a right way? Not really. When you decline post acceptance the company will create a record of this in their applicant tracking system (its a data base) and they will never offer you a job again (because they aren't sure you're going to take it even if they did). The recruiter(s) you worked with at that company are probably contractors. They will move around to other companies in their careers, if you are the in the unlikely situation where you are interviewing at a company and suddenly they decide not to proceed. That could be why. Generally recruiters work with thousands of people, but only a small number of them actually accept an offer and then later just back out. If you are fortunate and don't have a very unique name then it might be a problem but, if there are very few engineers with the same name it can be a bigger problem.

If you are exceptionally unlucky and you decide to not work at this major tech company and then your friend who pitched the startup can't come through. You are doubly in trouble (can't go back and don't have a job) not to mention a partially transferred visa.

The smart thing to do is to take the job at the Major Tech corp, spend a couple of years saving some money and learning what you can, and _then_ joining your friend with the startup if they still look like a viable offer. That strategy maximizes your future value. You have additional work experience, your friend knows that you will stick with your word even when you might not want to, and you will have a bit more knowledge of how well your friend can put together a startup or not.

<comment><USER3> None of the "good" startups that I know would ever blackball someone for declining an offer after accepting.

I agree with the other commenter - to people reading, this does _not_ apply in many places. Maybe in massive bureaucratic old-school tech firms, but not younger ones like Airbnb etc.

<comment><USER2> I appreciate you not deleting your comment (so far I've seen two).

It is completely legit to see it differently and to have a completely different experience. All I can relate is what I have seen in the last 25 years in the Bay Area. Having seen the effect in action early in my career (both people opting out after they said they would and other sorts of moves which affected relationships) I sought to understand it and came to my current appreciation of the various points of view.

Before I posted I had checked in with a friend of mine who is a contract recruiter and they seemed to feel my understanding of the situation was both correct and that this effect is fairly universal. It doesn't mean that it is of course. The next time you have a chance to talk with someone, in a safe and informal matter, who is in the hiring 'food chain' of something you consider "good" startup, ask them what they think. Nothing feeds a discussion like good data.

</comment></comment></comment><comment><USER4> Don't worry about it. You won't be the first nor the last person who changes their mind on a job change, and I promise they have had it happen before. To retract your acceptance you should just need to terse but professional. The general format would be:

\- A sentence indicating you're withdrawing your acceptance of the offer.

\- One or two sentences explaining you have an unforeseen unique opportunity. No need for great detail.

\- One or two sentences thanking them for their consideration, and hope for future opportunities together.

That's really all there is to it. A professional company that values it's people will understand that these things happen in life and will not hold any thing against you.

<comment><USER5> And don't wait around too long. Try to send the email as soon as you know for sure you're not taking the job, so that they can get back to searching and don't spend too much time and resources getting ready for you.

<comment><USER6> And tell them you're letting them know you're conscious of their efforts and are informing them ASAP.

</comment></comment></comment><comment><USER7> I was working on a startup and we were out of money. I applied for and found another job and let the founder know. On the Sunday before I was to start at the new place, we secured another round of funding, so the first thing I did on Monday was report to my new job and the second thing I did was resign from that job.

New boss was pissed, but it was the right call for me (and I couldn't have done it any earlier).

In your case, I'd give careful thought to the visa issue; I wouldn't sweat it on behalf of the major tech company at all. They've no doubt had worse behavior from candidates and they'll survive the loss. You probably won't be blackballed at that company, but do expect a question about it if you do decide to apply later.

</comment><comment><USER8> As a hiring manager I never take it personally if they decline the offer before the start date. There are a few that never mention it till the starting date and at that point feel they were just hanging on for a better offer and wasted my time so personally would never hire them again in the future.

<comment><AUTHOR> Thats great to know. I am planning to also call the hiring manager and explain myself.

</comment></comment><comment><USER9> I don't know you, but I strongly feel that you are making the wrong decision.

Let's go over the points...

Your friend pitched a startup idea. Based on your wording, it sounds like it is more an idea than an actual company. Either way, unless your friend's startup has the legal resources to sponsor a H1B visa and the financial capability to pay you a prevailing wage, you run the risk of not being able to transfer your visa. The government agency can reject your visa transfer, as well.

By declining the offer, you are putting yourself in jeopardy of losing your ability to work in the country.

I assume you are not married, but for the sake of this response, let's assume you are. What would your wife think about this? Don't be so selfish, imagine that others would be affected.

You are assuming that you will be able to work at the startup legally (H1B transfer). I don't believe you can assume this. Does your friend even know what is involved in sponsoring a H1B? Major tech companies have dedicated departments for managing the H1B process for their employees.

Good luck!

</comment><comment><USER10> If you have visa issues... how is your friend's cool startup going to help?

Visa issues even pre-trump were hard.

Does your friend have funding?

Does your friend have market validation?

What will happen to you personally if the startup fails - like so many do?

</comment><comment><USER11> Do it ASAP. Details are mostly unimportant, but be honest.

The more time and money they spend on you before you tell them, the angrier they'll be. They may already have grounds to sue you, although I've never heard of a company doing that in such a situation.

<comment><AUTHOR> Thanks.I plan to do it on Monday

</comment></comment><comment><USER12> How can you join a startup (idea stage) on an H1B? Cause make sure you can actually work legally for that startup before doing anything. Technically, you can't unless the startup is already established.

<comment><AUTHOR> My plan is to join the startup in 4-5 months time frame and only then initiate my H1B transfer. Till then ill continue with my current employer. Any idea on what USCIS looks for in H1B transfers ?

<comment><USER12> Then it's a no brainer. Start with your new employer, then apply to your friend's startup whenever they're ready. So you don't miss an opportunity with the big company. You can transfer your H1B as many times as you want as long as you have at least 6 months remaining on it. They will use premium processing, you can be done in 15 days. Then if you're into your first 3 years on your H1B, they will be able to extend it for 3 more years during the transfer.

<comment><USER8> I thought USCIS stopped premium processing earlier this year due to backlog.

<comment><USER12> You are right. The suspension also includes h1b transfer too. I wasn't aware of that.

<comment><USER13> There is an option called "bridge petition". More risky, but doable.

</comment></comment></comment></comment></comment></comment><comment><USER14> If you need a visa to work it's probably safer to go with the bigger company. Does your friend realoze they'll have to apply for your visa?

</comment><comment><USER15> No judgement here. I suggest you check yourself out to make sure this isn't about fear, cold feet, etc.

</comment><comment><USER16> I did that once. I had asked for a raise and didn't get one. I let my boss know I'd be looking elsewhere. Still didn't get one. Found another job and accepted it and quit the old job which promptly resulted in an offer of a large raise on the old job - larger than the salary at the new place. The old job was right next door to me and the new one across town.

I went to the new place with a huge gift basket and apologized and explained that I wouldn't be starting after all because I got a counter offer I couldn't turn down. They looked stunned. I left. I worked at the old place another several years and ended up rising to Director of Operations before leaving to work on my own company. I still feel bad about it but it was the right decision overall.

</comment><comment><USER17> I would suggest you keep the job and work on the startup in off hours. Until you have a good idea of how viable the startup will be, just stick at the big company

</comment><comment><USER18> If you really want to go with the startup, I recommend offering to pay back the money the tech company is spending on doing your visa transfer. This might keep a thin bridge alive between the two of you. Also, make sure the startup knows what is involved in doing a visa transfer, GC after that etc. Good luck!

</comment><comment><USER19> Renege as you see fit. The employment offer was at-will, right? I accepted and then turned down employee #5 at a multi-billion dollar company and never regretted it and it has never been an issue.

</comment><comment><USER20> I would do the big co whilst moonlighting and only after funding comes in jump ship esp. considering the visa.

</comment><comment><USER21> Do it quickly. rip off the Band-Aid

</comment><comment><USER22> Have you signed a contract?

<comment><AUTHOR> I signed the job offer. There is no legal obligation in the offer letter to join.

<comment><USER22> In that case you are free to leave. You'll dissapoint them, but I think many outfits would do the same to you if circumstances changed before the contract was signed.</comment></comment></comment>


Show HN: A Web-to-RSS Parser in Common Lisp - <AUTHOR> https://bitbucket.org/tux_/rssparser.lisp <comment><USER2> This is far from ideal (and a bad idea in general):

      (load "~/quicklisp/setup.lisp")

      (ql:quickload '(:datafly        ;; for database access

                      ;; WEB SERVER:
                      :hunchentoot    ;; for providing a web server
                      :cl-who         ;; for building the HTML output
                      :parenscript    ;; for the avoiding of the horrible JS syntax
                      :smackjack      ;; for AJAX requests
                      :lass           ;; for building the (S)CSS styles

You should not use Quicklisp to silently install dependencies as part of your normal operation sequence, because:

\+ It imposes its own view on how libraries are retrieved, stored, managed and updated.

\+ It is vulnerable to man-in-the-middle attacks.

\+ Used in this fashion, it effectively becomes part of your program. The more people that do this, the more ingrained it becomes.

\+ Plenty of us do not use Quicklisp at all, preferring other management schemes.

A better scheme for your project would be to have an install-deps-via- quicklisp.lisp script file, that pulls down and installs the dependencies via Quicklisp, for those that want to go that route and also a README that lists all the dependencies (associated github repos or homepages) . That way you decouple normal execution from dependency installation and those of us that do not use Quicklisp are satisfied.

<comment><AUTHOR> Thank you. But what would be the preferred way to load the installed libraries then? (Sorry, I rarely read style books.)

<comment><USER3> One can use quicklisp bundles so that the user doesn't have to install quicklisp and download dependencies themselves

[https://www.quicklisp.org/beta/bundles.html](https://www.quicklisp.org/beta/bundles.html)

<comment><USER2> Again, these are not ideal for software distribution in the general case (but can be useful for certain cases, so fine as an extra option).

Do you see many Python projects being distributed as virtualenv tarballs which quicklisp bundles may be seen as the equivalent to?

Let me present a sane scheme for dependency management, in terms of software distribution:

\+ Create an ASDF system definition.

\+ Create a README and list all dependencies with links to the code, version requirements (if any) and other notes/gotchas. This is useful to have regardless.

* Optionally, create a install-deps-via-quicklisp.lisp script that pulls down given dependencies via quicklisp.

* Optionally, create a quicklisp bundle.

Quicklisp (and the way quicklisp does things) should never be forced on the user. Don't get me wrong, it simplifies dependency management and has made things easier for newcomers but it compromises on other fronts and is not (and should not become) the standard way of managing dependencies in CL-land since a lot of its design choices do not mesh well with many real-world scenarios. Always leave a fallback.

<comment><AUTHOR> I'm officially too dumb for that.

        (loop for system in (list "sxql" "cl-ppcre" "dexador" "clss" "plump" "plump-sexp" "datafly" "xml-emitter" "local-time" "hunchentoot" "cl-who" "lass" "smackjack" "parenscript") do (asdf:load-system system))

I get a load of warnings about "redefining functions". Rather annoying...

<comment><USER2> You do not need to explicitly load them, ASDF will do it for you. You do need to declare the dependencies though.

Here is an example (example.asd)

      (defsystem :example
        :name "Example"
        :description "Example."
        :author "foo@bar"
        :serial t
        :license "BSD"
        :version "1.0"
        :depends-on (:sxql :cl-ppcre :dexador :clss :plump)
        :components ((:file "packages")
                     (:file "file1")
                     (:file "file2")
                     (:file "file3")))

You don't need to specify .lisp extension for files. Your packages.lisp may be:

      (in-package #:cl-user)

      (defpackage #:example
        (:use #:cl #:sxql #:cl-ppcre)
        (:export #:*global-symbol*
                 #:exported-function))

Then you can load your system through ASDF, including all its dependencies, like so:

      (asdf:oos 'asdf:load-op :example)

This assumes that example.asd is inside a directory that can be found in:

      asdf:*central-registry*

<comment><AUTHOR> Ah, I see, thank you. So I'll have to "install" the script into the registry before being able to just "use" it? :(

<comment><USER4> The easiest way to do it is to create a .asd for your project and then symlink or copy your project into ~/quicklisp/local-projects (i.e. the folder "local- projects" in the same directory as setup.lisp). Then, either run (ql:register- local-projects) or restart lisp and then do (ql:quickload :my-project) to load it.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I am still amazed sometimes how naturally Lisp handles data and code. You can just represent html with css and all as a nested data structure and use it when you need it. It does look or feel weird to have that next to your business logic.

<comment><USER6> This request handler, in particular, produces HTML/CSS and Javascript in the same scope: [https://bitbucket.org/tux_/rssparser.lisp/src/7a9f5ed45aca8b...](https://bitbucket.org/tux_/rssparser.lisp/src/7a9f5ed45aca8b1734181be5d637b5bac745c47c/rssparser.lisp?at=default&fileviewer=file- view-default#rssparser.lisp-97)

<comment><USER7> What blows my mind is how, after seeing that, some folks would want to program in anything other than Lisp. Code, HTML, CSS, JavaScript, all with a single uniform representation!

Seriously, anyone who's not taken a look: _take a look_.

<comment><USER8> Offtopic, I use Clojure these days.

Is Common Lisp still worth considering?

<comment><AUTHOR> Does your runtime still barf JVM stack traces? (attr.: [http://www.loper- os.org/?p=42&cpage=2#comment-16767](http://www.loper- os.org/?p=42&cpage=2#comment-16767))

Leaving this aside (after all, it might or might not be a matter of taste), it totally is. The Common Lisp ecosystem is pretty well alive, despite of the rise of Racket and Clojure. You should really give it a try one day. :-)

<comment><USER8> Common Lisp was the first Lisp I tried. But I found the library ecosystem a bit disappointing. This was more than a decade ago, though. No idea if Quicklisp has made everything more lively.

Clojure is nice. I like the emphasis on functional programming, and a very clean set of basic data structures and operations on them. Plus lots of great libraries.

Nonetheless, being on the JVM seems both a blessing and a curse. And I would love if it was a lot more performant. Clasp is tempting: [https://drmeister.wordpress.com/2015/11/23/why-common- lisp-f...](https://drmeister.wordpress.com/2015/11/23/why-common-lisp-for- scientific-programming/). I wish concurrency was better.

<comment><AUTHOR> Clasp seems to be much slower than SBCL (yet?). But yes, the amount of libraries has surely grown over the past few years, probably even too much:

[http://eudoxia.me/article/common-lisp- sotu-2015](http://eudoxia.me/article/common-lisp-sotu-2015)

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> We should do a web-to-mardown thing since so much websites are unreadable.

The funny thing is that chrome for cellphone already has something like that with the "make this website mobile friebdly".

Anyway, nice project!

<comment><USER10> _" We should do a web-to-markdown thing since so much websites are unreadable."_

THE FASCINATOR: that cheeky hacker Aaron beat you to this ~ [http://www.aaronsw.com/2002/html2text/html2text.py](http://www.aaronsw.com/2002/html2text/html2text.py) and [http://www.aaronsw.com/2002/html2text/](http://www.aaronsw.com/2002/html2text/) ... old, interesting to see if it's still usable after almost 15yrs.

Latest code at: [https://github.com/aaronsw/html2text](https://github.com/aaronsw/html2text)

<comment><AUTHOR> There are quite some forks, this could be interesting to watch, thanks.

</comment></comment></comment><comment><USER10> _" written because a disappointing number of websites still does not have an RSS or Atom feed"_

Or a way to programatically parse websites, process with a bit of code, to view sites off-line. Really interesting piece of code.

<comment><AUTHOR> Thanks. :)

</comment></comment><comment><USER11> FYI this functionality is 'automagically' implemented by specifying just a web site URL within the [http://www.protopage.com](http://www.protopage.com) RSS reader. It scans a web site and figures out which are the article headlines and links.

<comment><AUTHOR> Which might (and probably will) fail for a lot of websites.

</comment></comment><comment><USER12> Pretty cool example of Lisp's capabilities.

When trying to create feeds from webpages in the real-world, there are plenty of pitfalls involved, for example: handling JavaScript content, graceful retries, bypass IP blocks, throttle & rate-limit requests, accessing public social media (Facebook, Twitter, Google) etc.

At Feedity ([https://feedity.com](https://feedity.com)), we've developed our own little system over the years using .NET (C#) and node.js, with a bunch of tweaks and optimizations, for generating custom feeds from public webpages.

</comment><comment><USER13> Random question, how many people still use RSS? Just out of curiosity.

EDIT: And while I'm at it, are his/er packages what one usually uses in common lisp for web development?

<comment><USER14> I follow around 200 feeds on Feedly. It is pretty much my sole source of business and personal interest news, because I can consume it all using a single app (Reeder) in a very effective way.

<comment><USER15> That's a ton of feeds. Don't you end up with thousands of unread articles every day? And how do you sift through all of them to find the most relevant / important news? When I open nytimes.com I see the top story right there on the front page. When I open Reeder, I see an enormous list of articles sorted in reverse chronological order.

<comment><USER14> I get around 1500 articles a day, yes, but following feeds doesn't mean you need to actually _read_ it all :)

I simply scan through the headlines. Typically business news is repetitive enough that you can get a good feel for how "hot" a topic is, and then I just read one or two pieces on it (usually from the "best" writers) and discard the other 50.

Even headline-only feeds are useful in that regard - they're just signal boosters.

On the other hand, I tend to read a fair number of personal/tech blog posts in their entirety - around 20 a day, over breakfast.

<comment><USER16> This is absolutely the best feature of RSS for me. Rather than have to open a browser, discover the quirks of its navigation and then page backwards and forwards through articles. RSS gives a sane way to skim through those things and focus on the interesting parts.

Plus keeping up with podcasts which tend to be published less often than articles.

</comment></comment></comment></comment></comment><comment><USER17> I posted here the other day about the death of RSS:

[https://www.spinn3r.com/blog/2016/11/09/The-Death-of-RSS- Lon...](https://www.spinn3r.com/blog/2016/11/09/The-Death-of-RSS-Long-Live- Open-Web.html)

And this kind of codifies my point even though a number of people in the comments here were calling me crazy ;)

<comment><AUTHOR> "Visual Content is better". Exhibit 1: Your website, instantly greeting me with a large "pleeeasse subscribe" pop-up. Wouldn't happen with RSS. :-)

</comment></comment><comment><USER18> > This software was written because a disappointing number of websites still > does not have an RSS or Atom feed so I could subscribe to their updates, > e.g. the KiTTY website.

It seems the KiTTY website does have an RSS feed at [http://www.9bis.net/kitty/data/rss/rssen.xml](http://www.9bis.net/kitty/data/rss/rssen.xml)

<comment><AUTHOR> Yes, it does. But you might see that this does not just list new KiTTY updates but _anything_ that happens on that website; which is not exactly handy, is it?

</comment></comment><comment><USER19> This looks really nice. We've got something similar (written in PHP) at FiveFilters.org [http://createfeed.fivefilters.org](http://createfeed.fivefilters.org)

<comment><AUTHOR> I had a look at your software a while ago. I would probably use it if it was free. (I totally respect you for writing it though!)

</comment></comment><comment><USER20> Which RSS reader do you use?

<comment><AUTHOR> I use NewsBlur but I also keep a Tiny Tiny RSS installation ready as a fallback.

</comment></comment><comment><USER21> Does this work with Facebook? They turned off RSS recently and it was very annoying.

<comment><AUTHOR> It can't log in for you, sorry. :-) But it should be able to process publicly visible contents.

<comment><USER22> This could be paired with a browser extension or selenium?

<comment><AUTHOR> Technically, yes.</comment></comment></comment></comment>


Continuations Made Simple and Illustrated - <AUTHOR> http://www.ps.uni-saarland.de/~duchier/python/continuations.html <comment><USER2> This is a great article. Continuations are rarely understood, which is unfortunate, given their power.

I wrote an article for my compilers class that gives examples of how to use continuations (in Scheme):

[http://matt.might.net/articles/programming-with- continuation...](http://matt.might.net/articles/programming-with-continuations --exceptions-backtracking-search-threads-generators-coroutines/)

It covers basic stuff like exceptions and back-tracking search, and more advanced topics like threads, generators and coroutines.

</comment><comment><USER3> I wrote an article awhile back on continuations in Sleep:

[http://today.java.net/pub/a/today/2008/07/24/fun-with- contin...](http://today.java.net/pub/a/today/2008/07/24/fun-with- continuations.html)

I don't find a need for them in AtD (my current project), but when I was doing distributed systems work they were very valuable to me.

</comment><comment><USER4> On the other hand, see here for continuations made complicated: <http://okmij.org/ftp/Computation/Continuations.html>

<comment><USER5> I'd say this is more continuations in practical applications than purely complicated.

</comment></comment><comment><USER6> Note to the reader: Illustrated does not mean pictorially.</comment>


Q&A with Ron and Topher Conway - <AUTHOR> http://themacro.com/articles/2016/07/ron-and-topher-conway/ <comment><USER2> It wasn't made clear in the article, but Topher is Ron's son. Always good to see that nepotism is alive and well in "meritocratic" Silicon Valley.

<comment><USER3> I've never seen anyone claim Silicon Valley is meritocratic, yet I've seen tens of people get worked up about it on Hacker News.

<comment><USER2> Oh, really? It's right in the article:

> Topher : A founder's grit and determination, not the environmental > conditions, are the key factors in their success.

Funny to hear that from a guy whose future was basically determined the day he was conceived.

<comment><USER4> FYI you'll hear every VC say that right before they go off on their 3 week summer vacation.

If Ron Conway wasn't working with his son then you'd mention how he made the classic silicon valley mistake of putting his career in front of his family.

I mean c'mon, this isn't like handing the CEO role of a multi-faceted 2,000 person company to your son over other qualified applicants. Its a 3-person VC firm that Ron Conway founded and built. The guy wants to work with his son. Let it go.</comment></comment></comment></comment>


Ask HN: How to start a new academic discipline? - <AUTHOR> I've had a very specific role with multiple organizations over the past 10 years. There's no job title for what I do, but I'm in demand with everything from startups to international organizations.
There is absolutely no literature on this type of work, a bit of research on small parts of it, but no academic institutions that teach it as a curriculum. I kind of just picked up pieces as I went and made it into my own marketable discipline/set of expertise.
I think this role is key to our society and will become significantly more important in the next 10 years. It also has so much potential to push our understanding of people, technology, human rights, etc.
Aside from writing LaTeX articles and publishing in a couple journals that tangentially relate, what are other ways I can lay the foundation for something like this to be its own academic discipline?
Where do I start? <comment><USER2> Well, what is it? If you have a a 10 year head start then publicizing what you actually do would seem to be the quickest approach.

</comment><comment><USER3> Traditionally, academic disciplines have stemmed from others via discovery and innovation. There is no difference in academic CS; industrial (software) engineering best-practices, ex. design patterns, are derived from research. I would suggest doing a more thorough search through industry-focused academic literature, and pattern match what you do against findings to find a best match. Additionally, you could pursue a masters/PhD in a lab that does work on that topic (assuming you find something). Alternatively, get sponsorship from a company with resources as was suggested already. Think Bell Labs.

Out of curiosity, what is the general (or specific, if you feel comfortable sharing) area of your expertise? I'm always interested in exciting tech niches.

<comment><AUTHOR> Unfortunately, I've reached out to MIT, Yale, USC which seemed to have departments focused on parts of what I do, but they all basically said "awesome stuff, much needed, we don't have the funding to explore, but please keep in touch".

I play at the intersection of systems engineering and social movements.

</comment></comment><comment><USER4> If I were sure there was no community around the idea at the current point in time I would probably seek to start building that community through different mediums. You could start a meetup that focussed on the discipline, start a blog or aggregate site that collected the available literature and published news in the space. From there if you were willing you could approach different educational institutes and try to build courses or programs around the space. These things combined with other would grow the space and potentially be recognized as a separate discipline.

</comment><comment><USER5> Find a corporate sponsor(s). It's about the money. Have them fund research through a contract including you, a university, and the corporation. With 10 million dollars, the university will create a position "Department Head of Cyborg Spaghetti". Boom. A field is born.</comment>


Twitter reactions to new Node.js Logo - <AUTHOR> http://storify.com/_nw_/nodejs-logo

<comment><USER2> wow, I almost fell over when I saw the new logo. Not very attractive.</comment>


Steve Jobs and the Economics of Elitism - <AUTHOR> http://www.nytimes.com/2010/01/31/weekinreview/31lohr.html <comment><USER2> Open Source projects with strong leaders like Linux, Python, etc... are really just like Apple in terms of their "innovation model".

</comment><comment><USER3> Did anyone notice the mention of the "auteur model of innovation," attributed to "John Kao, a consultant to corporations and governments on innovation" which sounds an awful lot like John Gruber's auteur theory of design: <http://www.youtube.com/watch?v=xk3UcgbbmxQ>

The article even used the same examples as Gruber, hm.

<comment><USER4> 'Auteur theory' is neither Kao's nor Gruber's; they're both referring back to a concept from film criticism:

<http://en.wikipedia.org/wiki/Auteur_theory>

It's a fairly obvious analogy to draw when dealing with other team creative efforts which are orchestrated by strong central personality.

I suspect you could find other people applying the label to Jobs as early as the 1980s; after a quick search here's one from Scott Rosenberg of Salon in 1999: <http://www.salon.com/people/bc/1999/01/05/jobs/index.html>

<comment><USER3> I realise this, it just seemed odd in the context of it being Apple and the exact same references given.

</comment></comment></comment><comment><USER5> I'm tired of good design being considered elitism.

<comment><USER6> I'm tired of elitism having a negative connotation.

<comment><USER7> Then why not call it "meritocracy" instead? The great thing about English is there's a word or phrase for every shade of meaning - if you don't like the connotation of one usage, pick another!

</comment></comment></comment><comment><USER8> I guess there is no chance that it is a very well designed marketing ploy, that is putting Jobs in front of everything?

</comment><comment><USER9> > Great products, according to Mr. Jobs, are triumphs of "taste."

This is basically the same thing a high dollar fashion house is offering as well. Is a $2000 Louis Vuitton scarf warmer than a $10 Walmart scarf? Probably not. But you can guarantee it'll match this season's shoes out of Milan.

</comment><comment><USER10> Elitism does have a negative connotation. I think "excellence" would have worked better in the title. For that matter, I don't really understand why the word "economics" is in the title. The title doesn't seem to fit the article all that well -- at least not to me. The article is about the culture and design process at Apple, not Steve Jobs per se. Yes, Steve Jobs is intrinsically part of that culture. He founded the company and he is an important leader within it. No, you can't really separate the two at this point. But he isn't actually a one man show.

I like the quote used within the article that "A defining quality of Apple has been design restraint." I think that basic idea should have somehow made it into the title, rather than the name Steve Jobs and this incomprehensible, seemingly irrelevant, phrase "Economics of Elitism". Perhaps they could have just said "At Apple, Less is More" and then explained why.</comment>