GTA 'Cheat' Developers Have Homes Searched and Assets Frozen - <AUTHOR> https://torrentfreak.com/gta-cheat-developers-have-homes-searched-and-assets-frozen-181015/ <comment><AUTHOR> From the article: _This lawsuit is notable because the Federal Court of Australia has signed off on several broad enforcement actions. Not only are the defendants restrained from any cheating related activity, they are also the subject of a search and assets freezing order._

This feels severely heavy-handed for computer game cheating. The escalating aggression with which copyright infringement is being pursued is worrying in the context of other trends towards increasing corporate power with decreasing oversight.

I feel like saying 'aren't there other crimes the Australian Federal Police should be prioritising about a thousand cases higher than this?', but then that sounds like the whinging of someone pulled over for speeding. But a country's Federal Police force cracking down on computer game cheating? Is it not farcical?

<comment><USER2> It is farcical. There are a few people who will defend this behavior publicly.

But nearly all of the power is in the hands of the corporations and lawmakers and enforcement agents, and this is what they've decided to do. We don't have a lot of options to counter their decision.

I think it will take a small, dedicated group of people who will fight through legal channels and create technical/physical ways to avoid enforcement actions at the same time.

The Pirate Bay and Piratbyrån were basically exactly what I've described. The international police and corporations cracked down pretty hard and illegally extradited Gottfrid Svartholm from Cambodia. Peter and Fredrik also went to jail too and still have unpaid fines.

Disgustingly, society thanked Pirate Bay for their sacrifices by switching to a closed, paid, corporatized service called Spotify.

Their sacrifice was in vain and we are all worse off 10 years later.

<comment><USER3> > Disgustingly, society thanked Pirate Bay for their sacrifices by switching > to a closed, paid, corporatized service called Spotify.

Or maybe what society actually values is different from what they believed it values or should value. Maybe it's willing to pay the entertainment industry for creating entertainment as long as it's available hassle free and so relevance of Pirate Bay declined once an alternative became available.

<comment><USER4> I believe you are correct, that the overwhelming majority of the population are willing and able to pay for entertainment if the delivery mechanism is hassle free and fair.

Spotify and YouTube are both certainly good candidates (though nothing is perfect, and they are far from it.)

What I'd like to shine a spotlight on, though, is how the operators of these major international businesses operated for decades before they finally "gave in" and started investing in streaming technologies.

Except, the 2nd part of the paragraph above isn't true - they haven't given in.

In my small country, they've funded a law firm with 50 employees to the count of dozens of millions of USD per year for 3 decades, to go after the little guy, who simply wanted convenience, and to listen to their favorite artists new shiny album, and was tired of paying outrageous prices for CD/DVDs that were released months later here compared to other countries.

Instead of, you know, actually spending that money to come up with a solution, funding developers, or whatever.

This is unacceptable.

In addition, they've spent untold millions in small countries (and large) doing political maneuvers to prop up their failing business models. We _know_ they did - and do - this.

This is also unacceptable. It's not the peoples responsibility to extend the life of failing businesses (possibly unless they perform some critical function).

And they are still continuing these practices. The lawyers they used are still 100% employed, now to "catch internet sharing criminals" and to literally _write laws and regulations_. This is not hyperbole, or slander, or rumors. It is fact, common knowledge, and widely reported. Taking advantage of the situation that most politicians throughout the 90s and early 2000s were illiterate about "the interwebs".

These companies deserve to go bankrupt.

They can - quite frankly - get fucked. I have nothing but contempt in my heart for them. It actually borders on hatred.

I could give sources, I could give links to the dozens of examples of these bastards suing people for whistling songs in supermarkets (although that particular example is unrelated to the topic, it speaks to my contempt). But frankly it's such common knowledge that I can't be bothered.

Spotify is decent, but it was not made by these companies - it was made in -spite- of these companies trying to actively stop and hinder development. And now they own it.

I will never use it, and certainly will never pay for it.

</comment></comment></comment></comment><comment><USER5> Is this ironic that it happened in a game that glorifies theft?

</comment><comment><USER6> I suspect this wouldn't have happened if you couldn't use the 'cheat' to give yourself virtual currency, which Rockstar sell to fund continual development.

</comment><comment><USER7> I could understand involving police and courts when there's virtual currency involved, if that currency is related to real money.

But seriously? Sending police after people who enable players to teleport, have god mode and fly in a game???

That puts Rockstar and Take Two on my personal no buy list.

<comment><AUTHOR> Whilst that's one part of the problem, the other part is Australian Federal Courts giving it airtime. I don't know the machinations of courts and how case hearings are prioritised, but this really feels like getting a QC[0] to be an umpire in a game of backyard cricket.

[0] [https://en.wikipedia.org/wiki/Queen's_Counsel](https://en.wikipedia.org/wiki/Queen's_Counsel)</comment></comment>


Secure key exchange for peer-to-peer communication and VoIP - <AUTHOR> http://planet.gnu.org/gnutelephony/?p=12

<comment><USER2> I'm confused by this article for a couple of reasons:

\- There is ZRTP, SRTP, SIP over TLS and many proprietary systems. Why add yet another one?

\- Right now, adding a new extensions to what providers offer is extremely tricky - unless you have a massive number of customers who support / want it. Basically it's easier to add a new VPN connection on top of all the traffic to some site, rather than adding support for feature X (especially if your infrastructure is a mix&match of many solutions)

\- I don't know the amount of standard trapezoid-type SIP connections on the internet these days - but I assume it's very low. If you have a local server with some serious usage, it will be a PBX and not a proxy. If it's a VPBX provider on the internet, it's most probably a PBX not a proxy. This (for many reasons) means that any encoding you can get is only between you and the provider. There, you lose the control over what's happening.

\- "Identity" in SIP networks is a completely different concept than email "identity". Calling a sip uri, you might end up on a sip client, pstn phone, voicemail, redirection to someone else, or any crazy automated service you can imagine. I don't see this being addressed in the article. With user-controlled e.164 directory you may end up on someone's door intercom for all you know.

In reality my recommendation is - You want your call secure? Use your own network only. - You want your PSTN call secure? Forget about it - any serious provider is expected by local laws to provide means for wiretapping, so your call will have to be decoded. The best thing you can do is vpn/tls to your provider. Basically I disagree that the phone call security is something that can be solved by adding features to sip, rtp or other protocols...

</comment><comment> mike-cardwell I find the whole idea about calculating a hash from the shared key and then speaking it over the phone to verify that there isn't a MITM taking place very interesting.

Redphone for Android does this as well apparently but I've not tested it yet because it's US only - <http://www.whispersys.com/>

<comment><USER3> This is how every web-of-trust and key-continuity scheme works; it's why you get a fingerprint the first time you connect to an SSH server, and why people publish their PGP fingerprints on their business cards.

<comment> mike-cardwell Yeah, I understand why they've done it this way. I just thought it was a really clever idea to use the users actual voices and conversation to do the verification.

It's interesting because you use the system its self to verify that the system is secure. Normally you have to use an alternative (already trusted) system to verify the fingerprint.

<comment><USER4> The alternative in this case is hidden, but it's still there - you have to recognise the voice of the person you're talking to.

<comment> mike-cardwell Yeah, I recognise this.

</comment></comment></comment></comment></comment><comment><USER4> The article doesn't appear to mention what defence it has against a downgrade attack.</comment>


Seattle CEO who pays workers at least $70K US says it's paying off - <AUTHOR> https://www.cbc.ca/radio/asithappens/seattle-ceo-who-pays-workers-at-least-70k-us-says-it-s-paying-off-in-spades-1.5482394 <comment><USER2> I'm glad that this has worked out for them! It's a scary thing to be sure - upping your costs with uncertain gains.

I think when people insist this "wouldn't work" in many cases they are missing the point. This is obviously not a move you make without fundamentally changing how you manage the company, but I think all service delivery companies could make this change.

From the article:

> Now, many are starting families and buying homes. He estimates one-third of > Gravity workers have become debt-free, and two-thirds have significantly cut > back on their debt.

> Her junior colleagues work harder than ever, she said, easing everyone > else's workload in the process.

This suggests structural transformation in how the company distributes work and also deep investments in the people at the company. These can be successful strategies! They limit your agility when it comes to staffing changes, but not every problem or opportunity requires staffing agility.

I suspect at high levels this kind of thing might also look like Netflix's approach to pay and jobs (high pay, low security)[1].

[https://www.npr.org/2015/09/03/437291792/how-the- architect-o...](https://www.npr.org/2015/09/03/437291792/how-the-architect-of- netflixs-innovative-culture-lost-her-job-to-the-system)

<comment> Fire-Dragon-DoL To be fair Toyota was in a similar situation long time ago

</comment></comment><comment><USER3> I've encountered a number of small to mid sized engineering contracting groups and specialist LLC's wherein everyone makes well over $70k. Google's median compensation is over 200K company-wide with 100,000 employees, but this doesn't include part time contractors at facilities. Gravity Payments is on the larger side for such a strict "minimum wage", but I doubt they are the largest. It seems the only novel thing here is the politicization of the message.

The payments industry is relatively low-turnover (compared to other "tech" companies at least) and doesn't require as much innovation once a vendor has a foothold in their market. Could this policy have been successful before they were profitable with recurring customers?

I.e. I imagine some startups have attempted a policy like this -- is there any data on the success rate for "flat compensation" companies versus more common meritocratic and seniority-based compensation structures?

<comment><USER4> " but this doesn't include part time contractors at facilities."

And how would the numbers look if full and part-time contractors were included?

<comment><USER5> hahaha way lower.

i did pcb design work at google at a very junior level as a temp, made $15/hr

</comment></comment></comment><comment><USER6> This is good but clearly wouldn't work in many cases. Amazon, 2019 [1]:

      number of employees = 798k
      yearly pretax GAAP earnings = $13,976,000k
      yearly pretax GAAP earnings per employee = $17,514.

This means if all Amazon employees got an extra $18k year end bonus in 2019 then Amazon would have reduced their GAAP earnings to slightly below zero. You can do this calculation easily for any public company, just find their 10-K's on SEC.gov.

[1] Form 10-K, for FY ended December 31, 2019: [https://www.sec.gov/ix?doc=/Archives/edgar/data/1018724/0001...](https://www.sec.gov/ix?doc=/Archives/edgar/data/1018724/000101872420000004/amzn-20191231x10k.htm)

<comment><USER7> Amazon specifically adjusts its margin to show as close to zero profit as possible. Jeff's mantra is "your margin is my opportunity", and on top of that he gets to pay $0 in corporate taxes, what's not to like?

IOW, Amazon is not a very good example.

<comment><USER6> Let's do Wallmart, latest 10-K, 12 months ending Jan. 31, 2019 [1]:

      Pretax earnings: $11,460,000k
      Employees: 2,200k (yes, 2.2 million people, worldwide)
      Pretax earnings / employee: $5,209

And yes I'm picking examples of companies that have a lot of employees; I'm sure Facebook or Google can bump up bonuses.

[1] [https://www.sec.gov/Archives/edgar/data/104169/0000104169190...](https://www.sec.gov/Archives/edgar/data/104169/000010416919000016/wmtform10-kx1312019.htm)

<comment><USER7> You're picking examples of companies with deliberately razor thin profit margins.

<comment><USER6> I agree, but I'm also picking large employers (because that's how you'd get a lot of impact from a change like this). Which one then? :).

Boeing? 10% margin (before the MAX - not in 2019, so not a Google or Facebook but still quite good). 12 months ending December 31, 2019:

      Number of employees: 161k
      Pretax earnings: $-2,259,000k (loss; that's the MAX fiasco)
      Let's take pretax earnings for 2018 instead: $11,604,000k
      Earnings per employee: $72,074

$72k bonus (but nothing more) is theoretically possible, for 161k people.

In a good year, not in 2019 with the MAX troubles. Assuming shareholders are somehow OK with this. And assuming you need $0 for growing your business (like new factories, machines, acquisitions, hiring more people). And assuming you're leaving yourself with zero room for error (no cash cushion for a bad year), because sure as hell Wall Street will not give you investment-grade credit once you need it so that your bonds can go into old people's retirement accounts and slowly blow up there.

</comment></comment></comment></comment></comment><comment><USER8> >two senior Gravity staffers quit in protest, saying the sudden pay hikes were unfair, and that junior workers would slack off.

>But Rosita Barlow, director of sales at Gravity, told BBC News the opposite has been true. Her junior colleagues work harder than ever, she said, easing everyone else's workload in the process.

What a wonderful way to make toxic management get rid of itself.

<comment><USER9> Probably, getting rid of toxic management helped at least a little in increasing productivity.

</comment></comment><comment><USER10> This keeps getting pushed. When I dug in, the CEO of the company was taking out $1M+/yr despite revenue < $20M/yr for the co, and then had a media blitz when the salaries came back to earth.

I walked away with a couple of different lessons, including on why this keeps showing up in places :)

<comment><USER11> This same story made the front page a few days ago. Is someone astroturfing this story on HN?

</comment></comment><comment><USER12> Recent and related: [https://news.ycombinator.com/item?id=22440922](https://news.ycombinator.com/item?id=22440922)

</comment><comment> 1-6 Minimum tech-person wage?

</comment><comment><USER13> Also on Feb 28 by BBC: [https://www.bbc.com/news/stories-51332811](https://www.bbc.com/news/stories-51332811)

</comment><comment><USER7> I mean, median pay in Seattle is $93K. Of course it's "paying off".

</comment><comment><USER14> "Customers wrote him angry letters. Right-wing radio personality Rush Limbaugh dubbed him a communist."

Price: 'we've been relying on billionaire philanthropists for so long, and I don't really think that's working out very well for us...'

<comment><USER15> >Communism = Private company CEO decides to pay his workers whatever he wants

I didn't know Rush Limbaugh could be that hilarious

<comment><USER16> Like how both sides use the concept of states rights.

Some state passes legislation the party in power doesn't like, they use the Fed govt to clamp down on issues. A few years later when the party in power loses majority, they pass legislation on the state level, and complain about their rights being infringed on when the same behavior happens.

Rules for thee, not for me.

</comment></comment></comment><comment><USER17> Kudos to the CEO for taking a pay cut.

</comment><comment><USER18> If I recall correctly, $70k was originally what _everyone_ in the company was paid. Regardless of position. Including the CEO.

Looks like now it's the _minimum_. They had to bump the skilled positions to market rates.

<comment><USER19> No, it was the minimum. There was some grumbling by people who were previously paid ≤70K but more than others that they were being devalued by having their salaries the same as those who previously had been paid less, but nobody was reduced to 70K.

</comment></comment><comment><USER20> Anyone who believes a word of this, does not know a thing about money...or basic accounting, for that matter.

The credit will dry up pretty quickly with stunts like this, and the fact that he doesn't call it a success is VERY telling.

No business fails because it does not generate revenue; they only fail when they do not generate CREDIT. This is a "dit.com" era scam. EVERY job at that company can be automated, and you only get credit when you are reducing costs and expanding. This guy is jerking off in public, nothing more.

This article will not age well

<comment><USER21> 70 k seems a lot for a single step.

I've seen from up close how salary declined for about 1000 people in an unskilled physical job (that didn't change for 100 years). They were initially paid handsomely. Today 700 people do the same work for 1/5 of the money.

When paid handsomely the workers went out of their way to get the job done in time.

When pay sufficiently declined they stopped doing that. To get rid of the uncertainty they contracted another company to manage it. (along with a bunch of other work)

When pay declined further that company hired another company specialized in the task.

When pay declined further that company hired a job agency to fill the holes in the schedule and another company to monitor materials and supply them.

Its funny in a way, people on the work floor use to make their own schedule. If they needed extra employees they would call their wife, their kids, their friends, their neighbors - you have to come help right now!

If tools and materials were lacking they would jump in their car and go get it. They often paid it out of pocket and didn't bother asking it back.

All of the money and then some went towards an army of office folk who have been unable to organize a large list of things for longer than 6 months.

The quality of work is inferior in countless ways but with all these managers and administrators they did manage to increase cost. I estimate it is something around 2-3 fold.

What use to be a beautiful paper administration is now a series of crufty apps made by people who don't understand the work. When the apps fail the old employees are happy to do it on paper again. When the work schedule is delivered the employees start rearranging it.

The only long term employees who stuck around are the ones who don't give a flying fuck if the work is done properly if at all. It use to be that people worked double shifts just to get things done.

The solution, management thinks, is to hire better more expensive managers and more of them.</comment></comment>


Ask HN: System linking discount drug cards to pharmacy or doctor? - <AUTHOR> Not everyone knows that drug manufacturers offer  discount cards on their websites.  Occasionally the doctor's office will give you the heads up, which is nice.  But there's a huge information gap here and it can cost people meaningful amounts of money.
I wish there existed (if there doesn't already) a notification system that links these discounts with the doctor's office (or pharmacy, though that might conflict with their interests).  When they pull up the medicine to prescribe, the discount card information automatically pops up and a print out is shared with the patient.  Maybe a more advanced system would determine the patient's eligibility based on his/her profile and send the discount request/card directly to the pharmacy.
I'm just a sales/marketing/finance guy with the technical acumen on par with advanced primates, so I would be interested to hear your thoughts on the feasibility of this technology.  I appreciate it. <comment><USER2> Many doctors' prescriptions default to the generic option. I think this is actually the law in many states: the patient gets the generic drug unless the doctor (or patient) specifically ask for the brand name.

The notification system you're describing would need access to doctors' records and/or pharmacy records, as well as patient contact info. That's absolutely red-hot information from a security standpoint. It's not cheap or easy to build a system to hold that information, let alone act on it by contacting patients.

It's a substantial technology problem, but it's doable. It's currently an insurmountable sales/education/legal problem.

(I know a lot about this area because some good friends of mine tried and failed to build a company based on the idea of getting brand-name Rx discounts into patients' hands.)

<comment><AUTHOR> This is really helpful, thanks for explaining!</comment></comment>


Windows Phone 7 in the browser - <AUTHOR> http://m.microsoft.com/windowsphone/en-us/demo/index.html#home <comment><USER2> As long as you follow the prompts, the demo works reasonably well on HTC EVO 4G with Dolphin browser. In fact, it looks like a native (Windows Phone) app if you don't show the menu. Make sure you set user agent to "Android" and don't venture too far off the beaten path. Otherwise, the screen can become unresponsive although I've never had to force close the browser. Speaks well for the possibilities of HTML 5 and Windows Phone 7.

</comment><comment><USER3> Caution. Tried it on a Nook Color and got stuck, without access to browser controls. Didn't work (error message) on iOS 3 and got a blank screen on WebOS. Also seems to favor 320x480 screens (used the top-left of the screen only, both on the Nook and on the iPad). YMMV

<comment><AUTHOR> Thanks, I tried it on Chrome and on an iPhone 4S, and it is strikingly faithful to the WP7 interface.

I wonder how much work it took to reimplement so many UI controls in HTML5+Javascript. It is really well done.

EDIT: The meta description says "Demo Windows Phone right from your iPhone or Android device – no app required"

<comment><USER4> Font rendering was pretty horrible in chrome

<comment><AUTHOR> Font rendering is very nice for me (Chrome 15, OSX Lion).

What are you using?

</comment></comment></comment></comment><comment><USER5> Why is that desktop browsers don't support tap events with mouse, while mobile browsers simulate "onclick"?

</comment><comment><USER6> Doesn't work under Firefox 8.0 though. Says browser's unsupported.

<comment><AUTHOR> I think it's meant for mobile users (the domain is m.microsoft.com).

Probably it is optimized for iOS and Android.

</comment></comment><comment><USER7> Heh, reminds me of the old Windows 95 demo disks that used to be given out with magazines which gave a pretty convincing, interactive demo of Win95. Neat, works incredibly well!</comment>


Fight Seasonal Affective Disorder with Light - <AUTHOR> https://medium.com/simplebulb/winter-blues-fight-seasonal-affective-disorder-with-light-1f928af48416 <comment><USER2> Sure, try light. But try vitamin D (D3 isomer) supplements, as well.

Whatever other benefits they do or don't have (the latest: 'No help for bone strength in seniors'), I am not alone in my anecdotal experience of having my mood stabilize (towards the positive side) significantly within a day or two of starting D3.

<comment><USER3> How much do you take?

<comment><USER2> Currently, 5000 IU per day. Happens to be the dosage in an economic but reliable source. I've tried lower, e.g 1000 UI, and I've gone as high as 6000 IU. That seems to be the upper end of what is generally recommended.

You'll get all sorts of opinions, and I don't know the truth of it. So many things competing to do me in, I'm not going to worry about it -- one of the other things is a much likelier candidate for COD, at this point.

I started taking it because one side of the family has had a lot of cancer. I was NOT looking for nor expecting any change in mood. That was a complete surprise, and it took me a few days to figure it out. It was only after this -- some time after -- that I started reading of other people experiencing a similar effect upon mood.

P.S. There's also some debate about how many doses per day, IIRC. The digestive tract is not the best delivery mechanism, and ingested D perhaps also doesn't stick around as much -- not like solar/skin generated D stored in skin and fat. I think some people recommend multiple smaller doses, as opposed to one daily dose. I don't know.

I do know that if I run out or otherwise don't take it, I notice the absence (in terms of mood) within a day or two.

<comment><USER4> Do you monitor your vitD blood levels? Regularly supplementing that amount (2.5xUL) is not recommended if your labs indicate sufficient levels.

<comment><USER2> No. Health care in the U.S. is not too conducive to actual management, as opposed to crisis intervention.

Thank you for the warning. Maybe I will scale back. The supplement brand I've been using upped the dosage, and I just went along with it. Before that, I'd reduced my dosage to more in the 1000 - 2000 IU range, and it was coming through multiple doses across the day.

I have read about controversy as to whether the U.S. RDA was set too low -- just enough to prevent rickets, a primary concern at that time.

</comment></comment></comment></comment></comment><comment><USER5> Light therapy changed my life. I keep my light on for a few hours a day, September through April.

<comment><AUTHOR> Awesome! What surprised me most was how much SAD increases as you move away from the equator.

</comment></comment><comment><USER6> A good idea would be a bulb that transitions through the day.

<comment><AUTHOR> Something we're considering! There is already a great solution from Ketra ([https://www.ketra.com](https://www.ketra.com)) but it's very expensive.</comment></comment>


Huawei savaged by Brit code review board over poor dev practices - <AUTHOR> https://www.theregister.co.uk/2019/03/28/hcsec_huawei_oversight_board_savaging_annual_report/ <comment><USER2> The real point is at the end:

> Finding general issues is a good thing, but other vendors are not subject to > this level of scrutiny. We have no real (at least not this in depth) > assurance that products from rival vendors are more secure."

Pretty sure companies like Cisco (who have had recent high-profile security fails) would not want the same code review.

Until they do, and someone can do a comparative analysis of the two sets of codebases, there are no useful conclusions to be taken by decision makers.

The only value here is for firmware developers - learn from these mistakes. Hopefully GCHQ is coming for your code next.

<comment><USER3> Cisco has gone through in depth code review for many of their products, as they are often the vendor of choice for security critical applications. Look at the desk phones in the upper echelons of the federal gov't and note how the "secure" systems are all Cisco with metal cages on the back to prevent signal leakage/sidechannel attacks.

That being said, Cisco is a bag of dicks when it comes to their support contracts, pricing, and any of their consumer rubbish.

Juniper and other 2nd tier hardware vendors are a bigger threat than Cisco IMO, their gear is much more common, and much more vulnerable (JunOS is a pile of security vulns). None of them take proper software development seriously, and the audits they've undergone are often just to rubber stamp their products.

Frankly, none of these companies should be rolling their own "firmware", as they've proven that they won't reliably update as upstream (usually OpenWRT or Debian) push out security critical updates. Downgrading them to a role whereby their secret sauce is just an extra APT repo/extra metapackage from opkg is more than sufficient for what these companies need, while preventing them from accidentally or purposefully blocking updates.

<comment><USER4> Yea, an in depth code review. Like the last Cisco router bug fixed by banning access if user-agent contains 'curl'?

<comment><USER3> I referenced this in my prior comment, calling out their consumer rubbish which they don't bother to maintain.

</comment></comment></comment></comment><comment><USER5> I once worked for a defence contractor (although I did not directly work on any defence contracts). I didn't have a security clearance, but they wanted me to do a code review of some software (which seemed to be some kind of communications protocol). After reviewing it for some time with a colleague we wrote our findings as "We don't understand what this code was supposed to do, but we highly doubt that it works correctly" along with comments of serious problems on almost every line. My colleague was Chinese and could only work on his visa with that specific company. The manager threatened to fire him unless he retracted the review. After that, they shipped the code. Apparently it didn't work at all and they all got fired. I got a raise (but quit about 3 months afterwards as it was a horrible, horrible place to work).

I can well imagine what it's like to work on the code described in that document ;-)

</comment><comment><USER6> Quite the dog's breakfast:

> In the first version of the software, there were 70 full copies of 4 > different OpenSSL versions, ranging from 0.9.8 to 1.0.2k (including one from > a vendor SDK) with partial copies of 14 versions, ranging from 0.9.7d to > 1.0.2k, those partial copies numbering 304. Fragments of 10 versions, > ranging from 0.9.6 to 1.0.2k, were also found across the codebase, with > these normally being small sets of files that had been copied to import some > particular functionality."

<comment><USER7> Can someone explain to me how you can understand the culture in a team of programmers that leads to this being acceptable? Just a few small guidelines could help alleviate things like this, right? Modularization and a tiny sprinkle of code review and this is solved. Perhaps some (big) initial effort to clean up if you've started with code bases of different individuals with the goal of integration.

<comment><USER8> _the culture in a team of programmers_

The "culture" behind this is endemic to industry and isn't anything unique to Huawei.

People have already commented on this not being a "team". Let me focus on "programmers".

What probably happened is that many of Huawei's programmers are EEs who happened to take a programming course or two in college.

But learning to think and behave like a good programmer is much more than that. It requires a certain mindset. It may require a certain amount of avocation and enthusiasm, beyond what is taught in an introductory programming course. It requires one to grok good software practices.

Most non-CS majors in college (USA or China or whatever country) probably don't get much of that cultural indoctrination during the few programming courses they take. The engineer wants to pass/ace the programming course. Learning the aesthetics or nuances isn't a priority.

Programming is just too easy. Type a few lines into a file, compile, debug syntax errors, tweak until you get something that looks right. There's no rigor involved. No style. No aesthetic.

Don Knuth called it "The Art of Computer Programming". I submit that many engineers don't think of programming as an art. It's just a means to an end.

E.g. here's an example from a large codebase that was extensively reviewed. The context was Toyota's unintended acceleration problem of about 15 years ago. The design review found things like: _Other egregious deviations from standard practice were the number of global variables in the system. (A variable is a location in memory that has a number in it. A global variable is any piece of software anywhere in the system can get to that number and read it or write it.) The academic standard is zero. Toyota had more than 10,000 global variables._ [1]

None of this will ever change until and unless a company's top level management understands the problem and mandates change.

Additionally, there's always an incredible push to bring new products to market. That's 1000x more important than it is to follow best software practices.

[1] [http://www.safetyresearch.net/blog/articles/toyota- unintende...](http://www.safetyresearch.net/blog/articles/toyota-unintended- acceleration-and-big-bowl-%E2%80%9Cspaghetti%E2%80%9D-code)

<comment><USER9> > What probably happened is that many of Huawei's programmers are EEs who > happened to take a programming course or two in college.

Oh yes. Most of my classmates have picked EE over software engineering because they "dislike programming". The fact that EE (and any other engineering field really) is now mostly about programming anyway is lost on them.

People designing EE study programs are usually completely unaware that, well, computers exist. I have literally heard "Want to learn programming? Uh, just spend a weekend playing with Matlab or something and you will be set.".

</comment></comment></comment></comment><comment><USER10> _> because it was developed by coders who learned by copying the crappy coding practices they found in earlier versions of Unix/Linux, and who were highly selected through programming tests which could only be passed by adhering to these same practices_

This will be the same in a great many places, including western companies. It is market forces in action, the race to the bottom, and a consequence of going for the option that "looks the part and it cheap" for too long which makes the supply-side players support being fast to market with the right buzzword features cheaper than the other lot and the bare minimum of care for other considerations.

The people making the buying decisions are at least vaguely aware of the problem, but work under the hope that they'll be long gone (or the kit will have been replaced by something else) before any excrement gets uncomfortably close to the air conditioning system.

At some point things come to a head and people look more deeply into the problem, hence:

 _> HCSEC threw a wobbly and told Huawei to sort itself out pronto_

What has brought things to a head this time is the question "are we sure that can we trust Chinese companies?" combined with the question come out of the various public surveillance/recording news stories "can we trust any companies?!". People are being told to dig by the powers that be because said powers don't want to be the ones to make a cock-up while there is some public scrutiny going on.

 _> the Chinese company still came back with software containing "code that is vulnerable to 10 publicly disclosed OpenSSL vulnerabilities some dating back to 2006_

That though is particularly damning. Having been pointed to the problem and told to sort it out, they seem to have done _less than_ the bare minimum and hoped to get away with it. Just think how lazy they were being when not actively being told to be more careful, and how lazy they might go back to being if this all blows over before significant internal change is made.

<comment><USER11> " Just think how lazy they were being when not actively being told to be more careful, and how lazy they might go back to being if this all blows over before significant internal change is made." \-->Chabuduo, the chinese word for it. [https://aeon.co/essays/what-chinese-corner-cutting- reveals-a...](https://aeon.co/essays/what-chinese-corner-cutting-reveals- about-modernity)

</comment></comment><comment><USER12> Link to original article: [https://www.theregister.co.uk/2019/03/28/hcsec_huawei_oversi...](https://www.theregister.co.uk/2019/03/28/hcsec_huawei_oversight_board_savaging_annual_report/)

Link to actual report: [https://assets.publishing.service.gov.uk/government/uploads/...](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/790270/HCSEC_OversightBoardReport-2019.pdf)

</comment><comment><USER13> It strikes me all this wailing about code quality is simply a cover story to allow UK public sector/companies to exclude Huawei without outright accusing them of being a spying/intellectual property risk.

<comment><USER3> If Huawei is incompetent at managing OpenSSL in their codebase to the point that there are nearly 100 copies sprinkled through, most of which are vulnerable to exploitation, that seems like a perfectly reasonable basis to bar their products for a number of years, regardless their nationality or other actions.

F5 Networks should have been branded a black sheep for its various TLS implementation screw ups (they are the prime reason TLSv1 is considered insecure), yet they came out mostly unscathed. We need to stop giving a free pass to horrid development practices that create massively vulnerable software.

<comment><USER14> > F5 Networks should have been branded a black sheep for its various TLS > implementation screw ups (they are the prime reason TLSv1 is considered > insecure), yet they came out mostly unscathed.

I'm failing to find more information (googling for ssl issues on ssl termination equipment doesn't work well,) though it sounds like it'd be a good read - if you have any more details to share, please...

</comment></comment></comment><comment><USER15> Large customer base, big profits, clean code.

Pick 2.

<comment><USER16> This goes a bit beyond what most people would consider "unclean code", I think.

<comment><USER17> I don't get the demands to cleanliness.

The memcpy shadowing is really, really, really bad. If I see something like that in production code I would never touch it. Removing it could break code from both, people who relied on a check and those who didn't.

The 4 versions of openssh? Happens if you are in business for a longer time in my experience. We don't know on how many devices the software is run on.

Sure, it could probably be cleaner, but so could nearly every form of production code I saw in the real world. I would surprise me to see a different situation elsewhere.

</comment></comment></comment><comment><USER18> They say this applies to every single vendor but they only mention( multiple times) Huawei.

<comment><USER19> The random newsgroup post this links to does, but the sources it relies on don't

</comment></comment><comment><USER20> I would favor requiring a serious third party code review and certification of all infrastructure systems. I am fairly certain that most (Cisco included) would be "savaged" by a serious review.

</comment><comment><USER21> Does this mean now we should choose Huawei Infrastructure kit over any else's, as they're probably all as bad as each-other but at least Huawei's have been audited?

<comment><USER22> No. It has been audited and shown insecure. There's still a chance that other providers are not as bad. They can't be worse, unless they're actively malicious.

<comment><USER23> Why can't they be worse?

<comment><USER22> According to the review the software has been confirmed vulnerable to publicly known issues via old public software. From here we could compare the number of the severity of the issues... but we already know they don't care about fixing those, so there will be more. What can be worse than this without being malicious?

</comment></comment></comment></comment><comment><USER24> Just like every other code.

</comment><comment><USER25> They said:

"There were over 1400 direct invocations of 22 different safe strcpy()-like functions and over 400 direct invocations of 9 different unsafe strcpy()-like functions. Approximately 22% of the direct invocations of strcpy()-like functions are to unsafe variants."

There's nothing provably wrong with using strcpy() instead of strncpy(). If you are are careful to ensure certain initial conditions, there is nothing wrong and on a device with limited resources, it may be important to reduce unnecessary runtime safety checks and instead pay for error avoidance at compile-time.

<comment> yjftsjthsd-h > If you are are careful to ensure certain initial conditions

And you trust people to do this? Even competent programmers need safeguards.

<comment><USER25> Black-and-white thinking and argument is your enemy. Your use case may call for a lot of safety at the expense of performance, so you do run-time checks like this and sacrifice performance, or it may require extreme performance and you do static analysis instead of these wasteful run-time checks.

There's no such thing as 'trust people'. If you write the code yourself you decide whether your own code is safe enough. If you are a manager, you look for unit tests, static analysis or do a detailed code review.

</comment></comment></comment><comment><USER26> Alright if its so bad then why use it ?

Get your own army of coders to create your own 5G electronics.

Nobody is forcing the Brits to buy Huawei Gear - they did it because it was cheaper and they wanted to save a buck.

Huawei will be profitable even if UK,USA,AUS,EU completely stops buying their gear.

The scary part is not that their code is bad, but that they code at all.

30 years ago those hands were picking rice in rural china, and 30 years from now who know what those hands will be doing, maybe writing code for their moonbase.

Chinese gears is a boon to African, Latin American, South Asian countries. Chinese Yaun puts less pressure on their FX reserves.</comment>


My Voice Controlled Smart Mirror: A Postmortem - <AUTHOR> https://chrisuehlinger.com/blog/2016/08/20/voice-controlled-smart-mirror/ <comment><USER2> A bit surprised no one mentioned the (quite large) open source project one of the first Magic Mirror developers created and it is really good:

[https://magicmirror.builders/](https://magicmirror.builders/)

<comment><AUTHOR> After I built this, I discovered a bunch of these things. I hadn't seen that one, it looks really neat! One of the benefits of my approach (for me) was that I already had an Echo and a Kindle Fire (that I wasn't using). If you have a bunch of tech lying around, this approach can be more cost effective than buying a big screen.

<comment><USER2> Oh totally not knocking your project, this was a fantastic writeup! Thanks for doing it! I was just a bit surprised that no one else in this thread mentioned that one as it has been around for awhile and is relatively well established in "home automation" circles that I tend to frequent.

</comment></comment></comment><comment><USER3> i understand i'm nitpicking, but maybe someone should tell the author what "mortem" means? i was expecting something dead, a failure story. pick another worn out phrase ;)

<comment><USER4> I've seen "postmortem" used frequently for project wrap-up meetings. I try to suggest "postpartum" as an alternative.

Occasionally I've been shot down because "postpartum" is linked to postpartum depression, and so it's not a very positive term to use. Instead we keep using the apparently more-positive "postmortem".

<comment><USER5> Because death is so much more positive when you're talking about development.

<comment><USER6> Same

</comment></comment></comment></comment><comment><USER7> Is there any free-software voice recognition that one could use in case one doesn't trust the Amazon Echo not to send everything you say to the NSA?

<comment><USER8> I didnt want to get a echo because of this. One of my friends pointed out that I have no issue carrying around a cell phone with a mic and camera that can and likely is used for exactly this. Now I have an echo and I can turn on nature sounds at night without having to get up and go to my computer.

<comment><USER9> Yeah. I'm pretty paranoid, but I already have Google Now, Siri, and Cortana in my house via phones and laptops, so bringing in Alexa really isn't much of a stretch.

<comment><USER10> If you're really paranoid but need to have at least one of these things, you could make a reasonable argument that using as many of them as possible will increase the size of conspiracy necessary for certain types of attacks against you (eg. wrongful conviction).

</comment></comment></comment></comment><comment> semi-extrinsic I'm not a web dev, just "know enough to be dangerous", so I have to ask: the functionality that we see is just browsing HN, but he mentions using the API to fetch data and that this is cumbersome. Why not just do simple wget calls (or equivalent)?

<comment><AUTHOR> So that approach would be called "web scraping", and was the only way to build HN-based apps and sites before they gave us an API. Many apps still do this.

The API is a little cumbersome (it's totally RESTful, which means you sometimes have to make tons of HTTP requests to get enough data for a particular view), but it's much more reliable. I don't have to worry that HN might change the structure of their markup and break my app.

(Bear in mind, that's not HN's markup on the page, it's new markup that I wrote using the data from HN's API.)

</comment></comment><comment><USER11> I love the "cool" factor of this; it just looks cool.

Chris's addition of voice controls is equally cool.

The appeal to average people is cool; the hacking together of so many tools is cool.

I'm curious where stuff like this heads...

<comment><USER12> At first sight, yes, but do we really need to be able to read Hacker News on (voice) command? Or even the weather for that matter. To me it feels like a "We were promised flying cars and we got 140 characters" kind of future.

<comment><USER13> Yeah, I know what you mean. I like to rip people who actually build real stuff from behind the glow of my computer. Why can't they simply build Jarvis and be done with it? I could do that if I wanted to.

Do I need to explain sarcasm? Probably.

Anyway, the challenge is to do better, not to criticize.

<comment><USER14> So unless we feel motivated to construct a 'better' smart mirror, we're not able to point out that we think the very idea is silly? I mean, I appreciate the effort, and it's really a cool build, but rather pointless in the end. Is that not a valid point of discussion?

<comment><USER13> Don't limit your imagination to a mirror.

The OP wanted to build and learn. Might be kid's stuff or pointless to you. He shipped his version 1.0. That's more than most.

</comment></comment></comment></comment></comment><comment><USER15> Nice! When I posted my comment yesterday I wasn't expecting to see it on a mirror!

</comment><comment><USER16> I'm always fascinated by people's fascination with smart mirrors. I don't get it myself, but I like their enthusiasm.

<comment><USER14> Yea I spend, on average, maybe 5 seconds tops looking at myself in the mirror every day. Why would you build so much functionality into a display that only exists in one, usually very humid sometimes smelly room, and the only way to interact with it is to stand there shouting into the steamy air?

<comment><AUTHOR> Check out the video in the post: I have the mirror in my bedroom, within view of my bed and my reading chair. And even if I only interact with it a couple times per day, I find it pretty useful.

I certainly wouldn't recommend putting this in a bathroom :) Some part of the system would eventually get water damage and Alexa would make more mistakes listening over fan/shower/faucet noise.

</comment></comment></comment><comment><USER17> Is the screen always on, or does it wake up on command? If so, how? If not, does it produce visible light in the room when not displaying?

Amazing result, well done & thank you for sharing!

<comment><AUTHOR> It's always on. This means that when the lights are out, there's a faint black rectangle (with the time in the upper right corner) shining on my wall. It was a little annoying at first, but now I don't notice it. It doesn't keep me from falling asleep.

I couldn't find an API in Fire OS to change the user's screen brightness, and I don't know that one exists. I'd love to have it be brighter during the day to compete better with sunlight, but alas.

<comment><USER18> Never used FireOS, but I assume you'd just use the Android windowsmanager. Code (from my smart mirror, which I posted here a year ago and no one cared) here, line 190: [https://github.com/ineptech/mirror/blob/master/src/com/inept...](https://github.com/ineptech/mirror/blob/master/src/com/ineptech/magicmirror/BrightnessController.java)</comment></comment></comment>


Energy drinks mask alcohol's effects, increase injury risk - <AUTHOR> http://exactlyscience.com/archives/11665.html <comment><USER2> blogspam of

[http://www.uvic.ca/home/about/campus-news/2017+alcohol- and-e...](http://www.uvic.ca/home/about/campus-news/2017+alcohol-and-energy- drinks-increased-injury-risk+media-release)

Study and commentary PDFs available here:

[https://www.dropbox.com/sh/uxux59x1z92ulo6/AABEMAENBxEZdI0sQ...](https://www.dropbox.com/sh/uxux59x1z92ulo6/AABEMAENBxEZdI0sQ- pdp9nGa?dl=0)</comment>


All About Span: Exploring a New .NET Mainstay - <AUTHOR> https://msdn.microsoft.com/en-us/magazine/mt814808?f=255&MSPPError=-2147217396 <comment><USER2> I think "mainstay" is a bit of a reach.

I love C# and I frequently have a need for high perf. However, unless you _need_ that high perf, don't use Span<T>. Make your code more readable instead.

<comment><USER3> > However, unless you need that high perf, don't use Span<T>. Make your code > more readable instead.

Is there anything in Span that inhibits readability?</comment></comment>


Contact Tracing Joint Statement - <AUTHOR> https://www.esat.kuleuven.be/cosic/sites/contact-tracing-joint-statement/ <comment><USER2> > It is vital that, in coming out of the current crisis, we do not create a > tool that enables large scale data collection on the population, either now > or at a later time. Thus, solutions which allow reconstructing invasive > information about the population should be rejected without further > discussion. Such information can include the "social graph" of who someone > has physically met over a period of time.

\- Hear, hear.</comment>


Kubernetes May Be Google's Last Great Open Project - <AUTHOR> https://thenewstack.io/op-ed-kubernetes-may-be-googles-last-great-open-project/ <comment><USER2> clickbait

Istio is still open source! They just didn't donate it to another organization.

Google has done tremendously well building community consensus around a product, getting a bunch of free features from the community, and then upselling. That model isn't going away.</comment>


Bernard Lietaer, an Architect of the Euro, to Keynote Bitcoin Wednesday - <AUTHOR> https://www.bitcoinwednesday.com/speakers/bernard-lietaer/ <comment><AUTHOR> One of the world's authorities on the design and implementation of currency systems and author of Money and Sustainability, Professor Lietaer has become one of the leading critics of fiat money systems...

See [https://www.bitcoinwednesday.com/event/bitcoin- wednesday-47/](https://www.bitcoinwednesday.com/event/bitcoin-wednesday-47/) for the full conference program.

</comment><comment><USER2> I find this surprising. For >30 years, Prof Lietaer has always maintained that currencies need to be backed by something such as a basket of goods. Bitcoin is backed by nothing. I hope he says it again, because it's true.</comment>


Interesting Features in Programming Languages - <AUTHOR> https://blog.frankel.ch/six-interesting-features-programming-languages/ <comment><USER2> This was raised in the Reddit thread, but duck typing really doesn't work when maintaining large or unfamiliar code bases. Explicit "implements" statements are far less cognitive load in those situations.</comment>


Net neutrality will be enforced in New York under orders from governor - <AUTHOR> https://arstechnica.com/tech-policy/2018/01/net-neutrality-will-be-enforced-in-new-york-under-orders-from-governor/ <comment><USER2> It'd be funny if all these state governments end up having trouble getting internet.

Let's say Comcast & all the others violate net neutrality in some small ways. (I.e. A plan where you normally have 100mbps, but youtube can go faster because their servers are well-spliced with the internet backbone. That's a thing that violated net neutrality.) And then-- well hey, they're violating it. And most other businesses end up violating NN because of other optimizations to delivering internet content.

As a cynical libertarian, I love this. There's the potential for state government to lose internet access. That would be _so good_.

<comment><USER3> Excessive government interference in the establishment of Internet infrastructure is what created the ISP monopolies we have today, it surprises me that a libertarian would be pleased to see those government-enabled monopolies completely eliminate consumer choice. If the establishment of those ISPs had played by free market rules and had to pay for their own infrastructure, we would likely have an actual free market and actual choice, and no need for net neutrality regulation in the first place. Multiple ISPs, each in different parts of the city with overlapping coverage, and all too afraid of each other to step on the consumer like this.

But now that the government created a situation where most of us only have one choice in ISP thanks to using taxpayer money to build all but the last mile and refusing to let smaller players in... Now you want the regulation to end? Huh.

<comment><USER2> Strawman harder! I want the government-granted local monopolies to be ended too.

The risk I'm avoiding is not "slightly worse consumer product". The risk I'm hoping to avoid by lobbying for anti-NN is China/Singapore/German-style censorship.

<comment><USER3> I should have read your comment in a more favorable light, as the community guidelines say, so I apologize for that. I admit the image of the government sawing off the only branch it's standing on with regulation is humorous.

Obviously preventing speeding up video delivery with no negative impact to quality is not the intent of Net Neutrality. The intent also, however, is not to prevent "a slightly worse consumer product". Corporate censorship of the Internet for financial gain could do as much damage as government censorship for political gain. But the common element in both cases is one party having too much control because they're the only game in town. And the people pushing for "public Internet" absolutely terrify me.

That said, I don't think preventing title II government regulation of the Internet would prevent government censorship of it. I'd remind you how willingly companies like AT&T worked with the NSA to enable their wiretapping in the early stages of PRISM. They gave them a freaking secret wiretapping room in their building with a fiber optic splitter. Why would we think they wouldn't be just as compliant with government censorship under similar threats or incentives?

I have hopes for mesh Internet providers to solve all of this. Competition is the only answer I see, and I think our philosophies align there at least.

</comment></comment></comment></comment><comment><USER4> It's a welcome move but feels mostly symbolic if the article is taken literally. The "end users" don't typically pay directly, they pay indirectly as the services they use and pay for (say Netflix), have to pay the additional costs and that cost is passed invisibly onto the end users when they pay for non-ISP services.

<comment><USER5> This has been true so far in the US, but there are countries where ISPs transparently provide different bandwidths to different types of content, and customers pick and choose service plans for each in a package deal.

<comment><USER4> The transparency might be ok to choose among service plans of a single ISP, but I suspect those other countries have a fundamental underlying commonality that most US markets are missing. Their markets are structured via regulation, or just happen to be currently constructed, with multiple ISP competing for the business of the end user.

</comment></comment></comment><comment><USER6> New York gov wants more internet regulation. In other news; paint drys.</comment>


How to Turn a Quantum Computer into the Ultimate Randomness Generator - <AUTHOR> https://www.quantamagazine.org/how-to-turn-a-quantum-computer-into-the-ultimate-randomness-generator-20190619/ <comment><USER2> I mean, if you think generating a large amount of pure randomness from a quantum mechanical source is cool, you can do it with crap you can buy at Microcenter.

Just amplify a reverse-biased diode. You'll get some entropy from quantum tunneling and (probably more) from avalanche breakdown. Then you can use a simple MC to digitize, and apply a simple algorithm to ensure an equal number of random 1's and 0'.

This is a good write-up (RIP Make):

[https://makezine.com/projects/really-really-random-number- ge...](https://makezine.com/projects/really-really-random-number-generator/)

<comment><USER3> You are oversimplifying the issue and solving a "strawman problem. From the abstract of one of the discussed papers [1],

> We give a protocol for producing certifiable randomness from a single > _untrusted_ quantum device that is _polynomial-time bounded_. The randomness > is certified to be statistically close to uniform from the point of view of > any _computationally unbounded quantum adversary_, that may _share > entanglement_ with the quantum device.

where I have highlighted the important terms. Your goal is to generate a random string that you trust that your adversary does not have any statistical information about.

* untrusted: the device that you are using to generate the random string is untrusted. You bought it from the market but have not tested it or can't test it with resources on hand.

* polynomial-time bounded: to get a random string of size $n$, you don't want to run the untrusted device for longer than poly($n$)

* computationally unbounded quantum adversary: the adversary is computationally unbounded. If the adversary was more limited computationally, it might be possible to use a simpler protocol to generate your random string.

* share entanglement: this is important. If the adversary is the one who sold you your diode, he might have entangled it in some way with the devices in his own lab, allowing him to get the same measurement results as you did.

Clearly, this is a very difficult problem, but is relevant to when your random number generator comes installed in your laptop from the manufacturer. This problem is also important for understanding the information processing powers of quantum mechanics.

[1] [https://arxiv.org/abs/1804.00640](https://arxiv.org/abs/1804.00640) To add some argument from authority, the authors of this Vazirani and Vidick are two of the giants of the field and know what they are talking about.

<comment><USER2> "If the adversary is the one who sold you your diode, he might have entangled it in some way with the devices in his own lab"

lol

<comment><USER3> You might laugh, but this is a fairly standard statement you will hear a quantum information scientist say. While we are interested in the technological applications of quantum devices, we are more interested in using these information processing tasks to challenge and understand the physical laws of the universe.

In other words, in the statement "If the adversary is the one who sold you your diode, he might have entangled it in some way with the devices in his own lab", the adversary is actually the physical laws of the universe, and we are testing what those laws allow as far as generating randomness goes.

</comment></comment></comment></comment><comment><USER4> Wait, what? I think that's going the wrong direction.

There are quantum(-specific) phenomena that contain true randomness -- i.e. no amount of knowledge will make the result more predictable.

Those phenomena get harnessed to interact in a certain way to produce use computations. Such devices are quantum computers.

But if you just want the randomness, you don't need the computer part. You just measure the quantum phenomena and don't bother to make the interactions happen in just the right way to do (other) computations. The "computer" part is irrelevant for that use case (random number generation).

By analogy, this sounds like "how to turn a (classical) computer into a heater". Same issue: running a current through a wire creates heat. Certain setups of said wires also produce useful computations. But if you just want the heat, you just need a regular boring resistor; you don't need to make it into a computer as well, though you're free to use whatever heat it throws off as well.

Edit: Okay, on further reading, that _is_ what they mean by a quantum computer: one that just takes such measurements and where you can specify a distribution it samples from. But, just to clarify, this is _not_ the kind of quantum computer you hear about generally, where it solves factorization or simulated annealing or something.

As in the quote from Scott Aaronson, it's not the most interesting thing you can do with a QC.

<comment><USER5> But what if you want your heater to send an email...

<comment><USER6> I think I saw that at CES in 2001.

</comment></comment></comment><comment><USER7> A source, but nowhere near the "ultimate" source of random data. For that, you have to think on different scales.

"The researchers believe quasars could make an ideal cryptographic tool because the strength and frequency of the radio pulses they emit is impossible to predict. "Quasar-based cryptography is based on a physical fact that such a space signal is random and has a very broad frequency spectrum," Umeno told New Scientist."

[https://www.newscientist.com/article/dn8913-your-secrets- are...](https://www.newscientist.com/article/dn8913-your-secrets-are-safe- with-quasar-encryption/)

<comment><USER8> Interesting, but it seems like if an attacker could guess the target quasar and time (a much smaller search space perhaps than the general space of random strings), they could use their own database of quasar blips to crack the one- time pad. It's basically a public source of randomness, which seems like it makes it inherently not suitable for cryptography.

<comment><USER7> Well, it isn't as simple as light levels or color. The randomness would come from measuring aspects of individual photons, things that could not be shared between telescopes. If you want to measure something like entanglement, you want a source of randomness totally divorced from any local influence. Nobody can argue that photons formed in a star millions of years away could possibly have been influenced by local forces.

Use two quasars separated by 180* (ie on opposite sides of sky) and you could definitively say that, given the speed of light, the incoming photons could not possibly have interacted with each other before being measured.

</comment></comment></comment><comment><USER9> > Pure, verifiable randomness is hard to come by.

No, that's simply not true. Entropy is everywhere, and really easy to collect. The only thing that is even remotely challenging is estimating how much entropy a particular source provides, and even that is not really a problem because you can just add a few orders of magnitude of safety margin.

You don't really need all that much entropy to be perfectly secure. 512 bits of actual entropy is ridiculous overkill for any application short of securing nuclear stockpiles (and might be adequate even for that).

<comment><USER10> Randomness has bias. Including the type of randomness mentioned in this article. Which in the physical world (something "quantum information theorists" forget about virtually always) has measurement bias at the very least.

<comment><USER9> Yes, and there are well established techniques for compensating for that. TL;DR: don't use the data from your entropy source directly, run it through a cryptographically secure hash first.

<comment><USER10> 1) erm, good luck with that. Why not just hash random strings you come across in that case? May I suggest a text to pick them from?

2) That isn't what the article said. The article asserted "quantum computers" were uniquely and inherently excellent random number generators. I assert you can only say this if you never in your life interacted with matter, which is generally accurate when discussion "quantum information theorists" who come up with gorp like this.

<comment><USER9> > Why not just hash random strings you come across in that case?

Because your adversary could "come across" those same strings. Your entropy source has to be private (obviously).

> That isn't what the article said

The first sentence, is, quite literally, "Pure, verifiable randomness is hard to come by." And that is both false and unimportant.

</comment></comment></comment></comment></comment><comment><USER11> Too complicated, replaced with lava lamp: [https://en.wikipedia.org/wiki/Lavarand](https://en.wikipedia.org/wiki/Lavarand)</comment>


How the Aspiring Can Learn to Write Like Economists - <AUTHOR> https://www.realclearmarkets.com/articles/2019/08/28/how_the_aspiring_can_learn_to_write_like_economists_103883.html <comment><USER2> They left out the most important parts: lie convincingly with statistics, speak with unwarranted confidence about your conclusions, and repeat the dogma of leaders in the field with minimal scrutiny.

</comment><comment><USER3> > Punchlines: "Organize the paper in 'triangular' or 'newspaper' style, not in > 'joke' or 'novel' style. Notice how newspapers start with the most important > part, then fill in background later for the readers who kept going and want > more details....put the punchline right up front."

I have found this the most difficult to achieve in physics papers. Usually, the paper starts with some boilerplate for that field (quantum computers can do xyz), followed by a bunch of background papers that have some relevance to what you have done. Only then are you allowed to broach what you have done - this happens at minimum by the 3rd paragraph, but more common is the 5-6th paragraph.

I would very much prefer to have the central thesis of the paper presented in the first paragraph, followed by proper contextualization for those who are not familiar with the subfield. But journal editors want citations, and that's easier to achieve with the former than by the latter, by helping people from other subfields to low-value cite your paper.

<comment><USER4> The use of meta-communication makes it easier in my experience. It feels very cumbersome and artificial. But when laying out the central thesis, before the contextualization, you describe the content and (sub)conclusions of the different parts of the paper.

My favourite lecture always said there must be no surprises in a research paper. You have to spoil the surprising bits from the get go, and it is better to repeat yourself than surprising anyone.

edit: If I recalled correctly she said that everything of substance in a paper should be touched upon at least four times. One in the abstract, another in the the introductory parts of the paper, again where the actual substance is (results, methods, conclusions, etc.), and finally in concluding remarks.

</comment></comment><comment><USER5> As an econ major, I can't imagine why anyone would want to learn to write like an economist. There are notable exceptions, but in general economists and particularly modern economists are dreadfully dull writers with a reluctance to properly contextualise their claims and a penchant for letting the algebra do 90% of the work of the paper...

</comment><comment><USER6> The problem for popular writing is that you need to motivate the question in the reader.

Suppose, for instance, that you discovered that a particular algorithm can correctly classify a problem. Well, you sort of have to first tell people why this was surprising.

For academic papers you can assume that people know (I show NP>P, folks!) but for an article for people outside the field, inciting curiosity is key.

You can see this in all the pop science (in the best sense of the term) out there: Gladwell, Freakonomics, Lewis etc

They write like it's a detective novel starting with the mystery. I think the earliest example of this style might be Gleick with Chaos but maybe someone can show me an earlier example.

</comment><comment><USER7> Why is this desirable?</comment>


Whiting Out the Ads, but at What Cost?  - <AUTHOR> http://www.nytimes.com/2007/09/03/technology/03link.html?ex=1346472000&en=42689f48237a430c&ei=5090&partner=rssuserland&emc=rss

<comment><USER2> Sure, block Firefox. Guess what I predict will eventually happen? Adblock Plus will offer to install the User Agent Switcher plugin (<https://addons.mozilla.org/firefox/addon/59>) after it configures itself.

Blocking ads is completely ethical (IMHO). The advertising-based business model is not a contract to which the end user has agreed. People have always had the freedom to turn off the TV or radio during commercial breaks. Automating the process (a la TiVo) at the user's request does not somehow infringe upon some given right on the part of the advertiser to show the user its ads.

Just my two cents.

Edit: If you're going to downvote me, at least explain why. Kthx.

</comment><comment><USER3> I admit that I block ads. Long time ago, I started using ad blocking soft to get rid of ads for two main reasons: many were obtrusive, misleading (remember those alert box ads?!), and annoying (I hate those flashing alerts) and also because they were way too heavy and were slowing down my connection. I don't use Windows but if I were a windows user, I'd also worry about spyware that always tends to sneak in through ads. Also, since many ads these days use Flash & Flash just sucks on a Mac (high CPU usage), I block them for that as well.

Now the ethical question... is blocking ads ethical? Who knows... I tend to think that it is. I also tend to donate money/buy from sites that I use often and that offer subscription.

More on ethics here: [http://geekblog.oneandoneis2.org/index.php?title=adblock_rev...](http://geekblog.oneandoneis2.org/index.php?title=adblock_revisited&more=1&c=1&tb=1&pb=1)

<http://adblockplus.org/blog/ethics-of-blocking-ads-part-3>

</comment><comment><USER4> I don't understand this common notion that if you don't like the way someone runs their business, you get to change their business model for them. Here's a quote from a pro-blocking blog post that nickb linked to in another comment:

"Frankly, as far as I'm concerned, if a webmaster runs a site that's popular enough that the costs become at all significant, the onus is on him (or her) to find ways to cash in on that popularity to keep the site going. The visitors have no duty at all, and they certainly aren't obliged to go out of their way to make money for somebody else."

My response is that they did come up with a way to monetize their content (ads), but you don't like it. Too bad. Don't go to the site if you don't like the way they've chosen to make money. This goes along the same lines that if music is too expensive, or has DRM, that you therefore get to download it for free via filesharing, bittorrent, etc.... You don't. You're only ethical option is to not buy the content. That's the only ethical way you send a message (in this trivial context, obviously if were talking about human rights, etc..., the ethics of protest methodologies become more complicated). If I think something in a brick and mortar store is too expensive, would anyone think it was ok for me to just steal it? I don't think so.

A lot of the complaints about bad advertising practices, obtrusive adds, DRM, overpriced content are in fact valid complaints. But, you don't get to overrule the content provider's methods just because you feel like it.

<comment><USER5> So what is next, it becomes compulsory to actually buy the stuff that is advertised, or else it is stealing? What is the point of pushing ads at people who don't want to see them?

The people who go the advertising route know beforehand that not everybody is going to react to the ads and buy something. You are not stealing anything by ignoring the ads.

<comment><USER4> By all means ignore the ads. Using software to physically (so to speak) remove the ads is a much different thing then ignoring them. Advertisers know that a large percentage of viewers are in fact going to ignore them, and that's built into the system.

"What is the point of pushing ads at people who don't want to see them?"

I don't know, what's the point of charging people money for things when they'd really prefer them to be free? This isn't about what you want. This is about people supplying services and/or content, and trying to monetize them in some manner. Again, if you don't like the way they are monetizing these things, don't use them.

<comment><AUTHOR> By serving up some HTML, you're giving away content - you might have some rules about redistribution, of course, but esentially, you're giving some HTML and/or images to someone's browser to render as they see fit. If they choose to ignore or excise some of it, that's their business. For instance, screen readers for blind people ignore images.

I sympathize with the advertiser's point of view, because I have several sites myself that get a little bit of money from adsense. However, I'm enough of a believer in freedom to think that if people want to block ads more than they want free content, well, that's what the market will give them in some way or another.

<comment><USER6> You can't accept this practice as reasonable unless you accept that publishers can also block, or attempt to block, users who block ads.

If you ask me, both are fair game.

<comment><AUTHOR> Yeah, I agree. It's sort of an arms race - publishers might also try sneakier ways of slipping ads in. I have a feeling that 99% of users aren't going to get that excited about it unless the ads get overbearingly intrusive.

</comment></comment></comment></comment></comment></comment><comment><USER7> I'm surprised more companies don't already use a CNAME to serve external ads. Then again, ad networks are loath to have clients touch their source in any way, so it would have to come from their side, and they don't care about that kind of stuff.

Interesting to see this publicized by the NYT. Maybe they're showing off how independent their editorial is from their business side.

</comment><comment><USER8> I use flashblock ( <https://addons.mozilla.org/en-US/firefox/addon/433> ) rather than adblock. I find this gets rid of 99% of annoying ads. I don't really mind text ads or static pictures, but the flashing ones, the ones that automatically start playing audio or video when the page loads, or the ones that pop over the text and follow you down the page, those I can't stand.

If you don't want your ads blocked, don't make ads that annoy users. An average user's natural state is to do nothing. If they've been moved from that state to seek out, download, install, configure an extra piece of software, then it's because the advertiser failed. Isn't the job of an advertiser to produce content that entices somebody to buy something? If the ad doesn't do that, if it actually repels the person from looking at it, then that's a crappy ad. The advertisers can't then turn around and blame the user because their ads are so horrendously bad that people have to block them to use a website, they need to make better ads. Seriously, what other content provider blames its audience when its content is rejected?

Also, wtf is this sentence: "Given the decentralized nature of the Internet, the user's experience has to come first -- for now." For now? Basically, "As soon as we figure out a way to commandeer your computer and force it to show you ads, we'll do that." And they want to talk about ethics? Get real.

</comment><comment><AUTHOR> I'd vote with the 'not unethical' folks. If it turns into that big a problem, content producers will either swing back to charging for content, or find some other way to make money. Any sort of "remedy" is more likely to cause more problems than it solves. How many people are really going to install that kind of thing anyway? The people who do are most likely those who are able to block ads anyway - for example, on most of my own sites, the more geeky ones are the ones with the worst click through rates.

</comment><comment><USER9> How does adblock work at a technical level?

I would think that if it ever took off, the ad networks would just find workarounds. For example, they already seem to use interstitials and in-page css popups to get around pop-up blockers.

In fact, maybe a great startup could be to create technologies that let ad networks get around ad block software.

<comment><USER10> That startup: <http://adpinion.com>

<comment><USER11> If they can get around adblockers, then that's definitely their killer feature, and they need to advertise that on the front page. I had no idea, and was considering trying their service.

 __*

Anyway, people need to quit talking "ethics". Who cares? As the title of the nytimes article suggests, the question is one of money.

9/10ths of the computer programmers I know are using ad blockers, and I suspect this is the norm. But how many of them now (and in the future) will depend upon web advertisements for their salaries?

The early adopters in this case are adopting a technology that could steal their bread and butter. It's best to quietly bury the whole notion, before the general public adopts it.

<comment><USER10> They don't get around adblockers by hacking their way around them. They solve the problem by not showing people ads that annoy them.

<comment><USER12> For now, they get around a default install of AdBlock Plus through obscurity. They didn't make the blacklist yet.

<comment><USER13> They've made mine.

Sorry, but ads are annoying, period. I don't want to spend time training a Bayesian filter when I already have a filter that works perfectly. I wish the Adpinion folks success, but I will not be contributing to it.

PS: "Hello, Chair, inc."? There's got to be a story behind that.

</comment></comment></comment></comment></comment></comment><comment><USER5> I think if the ads come from the same server as the web site, AdBlocker is screwed? So I guess that is what is going to happen - which is good, because it reduces the amount of tracking the advertising companies can do on the user.

</comment><comment><USER14> In my mind advertising and fast food industries have a lot in common. General public kind of needs them right now, but as a society we shall learn to live without such dependence.

P.S. I am a long time AdBlock Plus user and we incorporated its filters (not code) into our own software that performs the same function in IE6&7.</comment>


What About (Microsoft) Bob? (2018) - <AUTHOR> http://techgenix.com/what-about-microsoft-bob/ <comment><USER3> "Microsoft Bob was an attempt to make Windows easier for beginners to use" "Microsoft Bob was an attempt at making it easy for a total novice to use a computer..."

That might have been a decent idea in 1995. In 2020, 25 years later, where at least minor skill in Windows use is a de facto requirement of employment in most jobs, I kind of think that hand-holding and mapping-from-reality-to- computer metaphors are a much worse ideas. Unless the underlying OS changes to fit the utterly simplistic metaphor, there's going to be weird problems - <USER2> when Windows consistently leaves off "exe" file extensions getting people used to just double clicking an icon to open it, and phishers send an executable named "hotgirl.jpg.exe".

Unfortunately, this article doesn't seem to describe a radical simplification of Windows into a consumer appliance. It just pushes the (somewhat unconvincing) idea that everyone needs a 3-D interface with physical metaphors to effectively use the computer they've already got.</comment>


Rising rural BMI is the main driver of the global obesity epidemic in adults - <AUTHOR> https://www.nature.com/articles/s41586-019-1171-x <comment><USER2> In the US I would wonder about the difference between urban, suburban, exurban and rural areas.

In some urban areas there is less obesity because people walk around a lot. For instance, New York City or LA, where there is also a lot of health consciousness and even conspicuous fitness. (I think of a gym that overlooks Union Square where I see somebody jumping from side to side and it makes me feel tired.)

Many people in the U.S. however live in places where they do essentially "urban" work (e.g. office work) and then commute by car to a suburban home. If I live that kind of life (say on the road) and don't make an effort to do something active I can put 2500 or fewer steps on my pedometer.)

Then you have real rural situations where people work on a farm or they used to work in a mine, and that is something different from the above two.</comment>


Getting email through spam filters from a Rails App - <AUTHOR> http://shapeshed.com/journal/getting-email-through-spam-filters-from-a-rails-app/

<comment><USER2> I wonder how necessary the content type and length changes actually were. It seems that the blacklisted IP caused most of his problems.

<comment><USER3> I'm the author and it would be fair to say that removing the IP from the Spamhaus blacklist had the biggest effect, although certain accounts (especially Yahoo) required different measures.

</comment></comment><comment><USER4> It's great to have a concise, consolidated guide on delivering email; it always seemed like magic to me.

</comment><comment><USER5> I don't know why this is presented as having anything to do with a Rails App. The application doesn't factor into any of the solutions which are basic 'how to get your email delivered' tips.

<comment><USER3> I'm the author of the article. That's a fair point, although there are some application specific measures that were taken. This includes setting the mime type and headers. Basically though the advice applies for any web app.</comment></comment>


New York Times Ready to Charge Online Readers - <AUTHOR> http://nymag.com/daily/intel/2010/01/new_york_times_set_to_mimic_ws.html <comment><USER2> I really hope this works for them. I subscribe to LWN and don't mind paying for things that I find valuable (even news). I also like the idea of the reader being the real customer instead of the advertiser.

But I don't think it _will_ work.

The problem is that the 50¢ a copy we used to pay was never the real money maker for newspapers. What made the business so fat was the near-monopoly control they had over many components of local advertising. That control is gone and it's never coming back.

<comment><USER3> But remember one of their largest costs is also disappearing. Newspapers almost certainly lost money per copy by selling it for 50¢, and made up for it by selling ads. The problem will be selling that same metaphor of "copies" or subscriptions, when each additional subscription costs them next to nothing.

<comment><USER4> But the real cost was never the production of the physical newspaper - it was always centered on content. Content really hasn't gotten any cheaper to produce, though... the fact that they're saving a few pennies a copy (that they used to sell _for money_ ) by distributing their content _for free_ online is really little comfort to them I'm sure.

<comment><USER5> The typical newspaper pays 15-20% of revenues towards content creation and the rest to printing and distribution.

The NYT spends a great deal more. Perhaps higher than 40% IIRC.

</comment></comment></comment></comment><comment><USER6> Doubt charging for NYT will work. FT and WSJ can get away with it because their financial reporting is actually worth paying for by biz people.

I think what is really interesting to observe from all of this is the fact that leaving families in charge of companies can lead to innovation stagnation.

WaPo got lucky in that Buffett came aboard decades ago and steered the company towards good capital allocation. Those kinds of lessons served them well and they managed to purchase businesses to support their journalism operations (Kaplan).

But the Sulzberger family (NYT) pretty much stuck with journalism. The Bancroft family (WSJ) lucked out in that their product is good enough to pay for, but early on they had the option of moving into providing financial data services (think Bloomberg) and decided against it. They would have been an absolute beast of a company today if they went that route.

<comment><AUTHOR> Both NYT and WSJ has a product good enough to pay for, but WSJ subscribers are a lot more likely to have their subscription paid by their employer.

Same goes with the Economist, who's doing great at a time where Newsweek and Time face serious problems. IMHO we're entering the age of expense account publications, which will mean quality journalism will have much more limited worldview and target audience.

<comment><USER6> Ask yourself why the employer is willing to pay for the WSJ though. That's the thing. There are only two financial newspapers and most employers, especially in business, will be willing to pay for that because they see an informational benefit in it. Same goes for The Economist, which is known for stellar reporting in their Business/Finance section.

To contrast, the NYT does not offer the same kinds of benefits. Their reporting on global issues faces stiff competition not only from the WSJ, FT, and The Economist, but also TV/Radio journalism and other newspapers.

<comment><AUTHOR> I agree that WSJ, Economist, FT etc are excellent. But they all see the world through a certain angle (a business executive's, to generalize).

Personally I often agree with that angle, but I think it wouldn't be ideal to have high quality journalism written only from that specific view point.

</comment></comment></comment></comment><comment><USER7> NYT, while you're charging for things, please let me purchase an ad-free version of your iPhone app.

</comment><comment><USER8> Not expecting this to work for them, but if it does, maybe they'll use the money to start doing good investigative reporting again. I'd love to see more journalist-run sting operations like reporters used to do in the old days.

<comment><USER9> Agreed, had the quality of their paper (or of the newspaper industry in general) been similar to what it was even just a decade ago, I believe this could have worked.

However, the newspaper industry has been losing quality at a rate equaled only by their loss of readers and one influences the other. This feedback loop they've developed is going to be their death, and unless they can stall this loop, they'll be gone for good, which IMO is a shame.

Unless this pay-for effort spurs new life and quality into their articles, I doubt they'll manage to get enough people to pay the prices required. They need to poach would-be payers from other newspapers and hold them as their own. The newspaper industry is entering an evolutionary state, only the hyper- competitive are going to survive this.

<comment><USER10> Can't really speak for the rest of the world (any one know any studies?) but the quality of online is the Australian market is absolutely appalling.

The Sydney Morning Herald is probably the best broad sheet in the country, but online smh.com.au is absolute link baiting trash. Personally i could not fathom forking out for celebrity trash nor for the un fact checked gibberish that is posted throughout the day. Lately i would be lucky to check it once a day for 30sec.

And i'm really skeptical if they could ever find scale to charge for online access in an any Australian city market.

<comment><USER11> I used to check the site of the News Ltd paper in SA a number of times a day but a couple of months ago I deleted all related bookmarks and feeds and went cold turkey. I don't think I'm missing much. They bow down to the pageview gods and, subsequently, the quality of their material is woeful.

</comment></comment></comment></comment><comment><USER12> Isn't the metered system as adopted by the Financial Times simple to circumvent? I simply open each article in an Incognito Window in Chrome and I can read as many articles as I want.

<comment><USER13> They could make it much more secure by requiring an account (which NY Times already does).

<comment><USER14> Only way that will work is if you require everyone to make an account, which won't do wonders for traffic. Maybe only showing the start of articles without an account would be the only way to prevent people getting around it. Seems useless to if you can just Google search an article and see it anyway.

</comment></comment></comment><comment><USER15> My prediction: A gorgeous interactive iTablet magazine app with the software written by Apple and the content provided by the NYTimes, Sports Illustrated, etc.

At least, I'm hoping the content producers don't try to make their own (as in iPhone). A standard iTablet newspaper/magazine app would make the experience consistent. In the iPhone apps, it's pretty fragmented right now in terms of quality and experience.

</comment><comment><USER16> I don't think advertising for "a paper" will ever be as lucrative as the old paper days, because it's too easy to drift over to the billion other sites on the web.

The old paper days allowed for virtual monopolies because it was physically inconvenient to have more than three or four papers at hand, and most people only had one. It was easier to convince an advertiser that a reader was going to at least glance through every section and be exposed to the ads.

These days I never read a news outlet's site all the way through[1], not in the way I used to sit on the floor on Sunday with paper and coffee. A news outlet has at most two or three articles' chance at getting my eyes to glide over an advertisement. I will never see 99% of what's on a site before I move on to some other site. Google is the only one making money this way.

[1] Except for Hacker News. I think aggregation points the way to where the money is in the future, both aggregation of content and aggregation of ads.

</comment><comment><USER17> I wish them luck but given the majority of people read newspapers for entertainment/distraction I have no idea how they'll compete with the avalanche of free content online.

Personally I'd pay good money for a paper that did lots of investigative reporting (and only investigative reporting) but I suspect I'm in the minority.

</comment><comment><USER18> They should start charging Google to index their content, not the readers. If I were an advertiser on nytimes.com I would be livid right about now.

<comment><USER19> > They should start charging Google to index their content, not the readers.

Why would Google pay? There's very little in the NYT that is unique. How may people would switch to another search engine if Google ignored the NYT?

Google delivers eyeballs for free. The NYT is free to monetize said eyeballs as it sees fit.

<comment><USER20> While I wouldn't pay if I were Google either, and I won't be subscribing to the NYT, I think it's Google that derives the most business value from being able to index NYT content: they get answers to give to their consumers, and they get something valuable for "free" that they sell a large volume of ads against.</comment></comment></comment>


Livescribe: Never Miss A Word - <AUTHOR> http://www.livescribe.com/

<comment><USER2> This is great technology, but not nearly interactive enough. What I really want is a Kindle with these capabilities, preferrably running OS X.

Hmmm - I wonder if Steve Jobs has already anticipated my desires...</comment>


Intel patents chip-to-chip optoelectronic bridge - <AUTHOR> http://litchips.com/intel-patents-chip-to-chip-optoelectronic-bridge/ <comment><USER2> This seems like a big deal. A fundamental method to enable dramatic changes to computer architecture, that will boost compute power at a cost that will unlikely be as astronomical as say quantum computing.</comment>


Embedded builtins - <AUTHOR> https://v8project.blogspot.com/2018/08/embedded-builtins.html <comment><USER2> This is great not only for browsers but possibly for microservice/FaaS type of architectures.

Does anyone know if sharing of built-ins across processes is/will be available on node.js? I couldn't find any issues specifically discussing this on node's repo

<comment><USER3> Since the builtins are embedded directly into a read-only section in the executable, the OS will automatically share them between all processes using that executable; no need for node.js to do anything special.

</comment></comment><comment><USER4> _Back in 2015, builtins were mostly implemented in self-hosted JS, native assembly, or in C++. They were fairly small, and creating a copy for every Isolate was less problematic_

So bizarre, they made this problem for themselves then had to undo it with the presented contortions. Accidental complexity anyone?</comment>