LinkedIn: 'No customer accounts affected' - <AUTHOR> http://video.ft.com/v/1681242005001/LinkedIn-No-customer-accounts-affected-

<comment><USER2> What a joke. They're claiming no customers were affected, in part because the login email addresses weren't released along with the password hashes. All that really means though is that a private group has this information, not that the information isn't out there. They're also ignoring the fact that people reuse passwords- just because they managed to force a password change for the users of their servers doesn't mean the other services the user happens to be a member of will do the same (or even know they should).

Shit happens, and we all know this. The fact that this guy is downplaying it is where I start losing respect for the company.

</comment><comment><USER3> "We've implemented many different security measures, but talking about them on camera would be insecure" (Paraphrased)

Yes, because security by obscurity has such an awesome track record. In fact, if whoever is responsible for this fiasco had asked on Stack Exchange how he best store passwords, this whole hoopla could've been avoided.

<comment><USER4> "because security by obscurity has such an awesome track record."

Please elaborate on how you feel that security for linkedin would be better if they talked about the new specific security measures they've implemented.

<comment><USER5> If they had talked about storing unsalted passwords in the first place, this whole thing may not have happened because somebody would have told them, "Hey, that's dumb" before the leak.

<comment><USER4> We're talking about a major corporation here. They can pay for and hire the appropriate security experts (even more than one firm) and find something like that out.

<comment><USER5> If they weren't competent enough to do that before, what makes you think they're competent enough to do it now?

For all we know, they've "fixed" the issue by switching to unsalted MD5 password hashes.

</comment></comment></comment></comment></comment><comment><USER6> This seems to be taking some liberties with the facts, and it is unfortunate if they are able to get away with this. He said they're unsure if email addresses have been taken, but is very sure that no customer has been harmed!

Even assuming that no email address has been taken, the fact that this list of passwords is now seeding rainbow tables across the world is a quite harmful, I think (and this is true irrespective of any advice to users to use unique passwords). Also, for a site as large and supposedly sophisticatd as linkedin, not using salts is inexcusable.

I have been a long time user of linkedin, and have no plans to stop using it. I certainly dont want to hang them, but an acknowledgement of mistakes are expected, otherwise declarations that it wont happen again have no weight. Disappointed.

</comment><comment><USER7> They make it sound like implementing salts is some kind of rocket science they needed an elite team for, and not one of the most basic and well-known security measures.

Also they act like the file that was posted on that forum is the only information that is out there. Everything indicates those were the passwords the hacker couldn't promptly get and needed assistance for.

</comment><comment><USER8> Nobody would steal hashes without the rest of the data, i.e. user IDs and emails.

And as for the security measures that he "won't put on camera because that would be insecure"... wow.

<comment><USER9> While security through obscurity shouldn't be relied upon, obscurity does play a part in security (You don't go around publishing your private keys, for example, and you don't share your passwords). You'd be foolish to think that narrowing down the vector of attack won't help.

Physical security works in a similar manner. You have multiple obscure parts (keys, passcodes, etc), and non-obscure parts (locks, cameras). If I have keys and passcodes, and I know where the locks are and where the cameras are, I can get through. And, it's not incredibly difficult to get a key (I have personal experience with this, hence the specific setup). What saves you is the passcode and camera that aren't known. That, and the fact that the guy was half-drunk as it was.

In the end, you don't rely on obscurity, but you don't go out of your way to tell everyone what you are doing. That's why you pay experts to do it for you.

<comment><USER10> > "obscurity does play a part in security (you don't go around publishing your > private keys...)"

Security by obscurity is the _opposite_ of using private keys. The algorithms for security by public/private keypairs are published and open to anyone to see; the strength does not depend on keeping the algorithm secret.

(Worth mentioning, some public/private keypair algorithms may actually have security by obscurity built in, such as the DES algo that some people speculate has hidden backdoors in how hashes are created.)

<comment><USER9> Thought it was obvious by the phrasing I was using, but apparently not. The obscurity part is keeping the private key hidden. The password unknown. The key in your pocket.

> the strength does not depend on keeping the algorithm secret.

No, it depends on keeping something else secret.

</comment></comment></comment></comment><comment><USER11> I don't buy it. My wife's yahoo email account, which shared a password with her linkedin account (yes, yes...), was accessed from abroad and used to send spam emails with a link, presumably to some exploit. While the password wasn't that great, it wasn't likely to be guessable or brute-forceable via login attempts.

Sounds like at least one affected customer to me...

</comment><comment><USER12> "We've been open and transparent in our communications".

<comment><USER4> I'd like to know your opinion of my comment above:

"Please elaborate on how you feel that security for linkedin would be better if they talked about the new specific security measures they've implemented."

My feeling is that they would have a better outcome by hiring the appropriate experts rather than being public about anything regarding how they operate.

Keeping in mind of course that linkedin in particular is a mainstream site and it doesn't really matter whether hackers in particular of any type like whether they are open or not. Your thoughts? When you consult do you advise companies to publicly disclose anything (other than misinformation possibly).

<comment><USER12> I certainly can't fault them for not laying out in detail what the new security systems in place at LinkedIn are. Only a few companies would.

Generally, I feel sad for LinkedIn, not outraged.

I would strongly dispute the words "open" and "transparent" in Hoffman's statement, though.

I think you could do a pretty good case study on how not to do security crisis PR from what happened last week. But the only parties really harmed by bad crisis PR are LinkedIn investors.

<comment><USER4> "I think you could do a pretty good case study on how not to do security crisis PR"

Agree but wonder why companies don't have the crash cart ready and always seem to mess this one up.

"harmed by bad crisis PR are LinkedIn investors"

My feeling is different. If people are talking about your company (and plenty has been said about this) and it's something that they've heard before many times I think the publicity is not bad and if anything could get some retail investors interested. Linkedin is not a food product and, in general, I don't think people think of linkedin like they think if they find out a product contains pink slime.

It's like WD-40. You spray it on and the carrier evaporates leaving the stuff that does the work. So the memory of linkedin remains and the knowledge of the problem is lost.

People have short memories. The brand will have a publicity gain and the negative will be forgotten.

This happens with celebrities who do bad things. They just become more famous and valuable (in that case even if people remember the bad like with Sheen). (With the exception of, say, OJ Simpson and maybe a few others such as Tiger Woods because of his squeaky clean image.)

</comment></comment></comment></comment><comment><USER13> My friend's rather unique though imperfect password was among those present on the list. I'm suspicious.

</comment><comment><USER14> Ugh. Autoplay sound (and LOUD) and no warning.

<comment><USER15> Turn on click-to play for plugins, whitelist sites you trust: you'll have a brief reprieve before everyone starts using HTML5 audio/video. :-)

</comment></comment><comment><USER16> Honest and small mistake? I would like to know more technical details

<comment><USER17> He must be referring to them storing the passwords as unsalted SHA-1 hashes.

<comment><USER7> I would like to see him explain why they weren't using salts before and why they thought that was acceptable.

<comment><USER18> Undoubtedly it would be an invocation of the startup timecrunch trope, hence the honest mistake. It's analogous reasoning to large data breaches being successfully handwaved away. Heck, even the US Government says "...nobody could have known [things would get this bad]"

</comment></comment></comment></comment><comment><USER19> uh oh. Once LinkedIn became LNKD, its officers had to stop making stuff up. I anticipate lawyers.

edit: Lawyers trying to represent users were inevitable. Now they'll have shareholder lawyers too.

</comment><comment><USER20> I like how he says "Lets see" after each question, as if he's trying to spin the story in a way which will reassure people. Maybe it's a common phrase, but to me, "lets see" seems fishy.

<comment><USER21> I like it even better when in one of their blog posts they tried to twist the issue around and make it actually good that this happened cause its a perfect reason to update your old insecure password.

What a joke LinkedIn is! I wouldn't be able to stand embarrassment of a hacker-joker to send to all my connections some ads for Viagra (knowing some non-tech people would really believe I start selling Viagra), so I deleted my account.

But ain't that breath-taking that a 10 years old revenue-positive company with NASDAQ presence would not even salt password. [speechless!]

</comment></comment><comment><USER22> Is there anything of value on LinkedIn though? So while no users were harmed on LinkedIn they might have been harmed somewhere else if we assume that also email addresses were leaked.

</comment><comment><USER23> Seeing him be so smug makes me want to close my LinkedIn account.

</comment><comment><USER24> Guys checkout how much LinkedIn is paying to it employees [http://www.visasquare.com/visa-greencard/salary/linkedin- cor...](http://www.visasquare.com/visa-greencard/salary/linkedin- corporation-409793.html)

<comment><USER23> Those salaries seem neither especially high nor especially low... and I don't see how this relates to their lost passwords.

If there is a point you are making, can you elaborate?</comment></comment>


Why the iPad 3 Won't Replace Your Laptop - <AUTHOR> http://www.pcmag.com/article2/0,2817,2401055,00.asp

<comment><USER2> The basic argument is this is how it's done, ergo, it's how it will be. That's is weak.

I agree with the conclusion - laptops have a niche. They are precision tools. But laptops carry no value over a fully capable tablet for most people.

As that mass of people vanishes from the market the re-pricing of the laptop as a professional tool will further wall off its niche. Completely? No. But to a large degree, from a mass consumer perspective.

</comment><comment><USER3> Article MIGHT be correct.. But I don't really see how they can make this statement, not knowing what the iPad 3 will offer. It might be completely revolutional for all we know. Looking forward to the day when we can run OSX instead of iOS on iPads.

<comment><USER4> Most recent developments indicate it's going the other way around, with OSX becoming morel like iOS.

</comment></comment><comment><USER5> I'd prefer something with an integrated keyboard, like an Asus Transformer.</comment>


Git Is Not Revision Control - <AUTHOR> https://blog.feld.me/posts/2018/01/git-is-not-revision-control/ <comment><USER2> Old man yells at cloud.</comment>


Report That Facebook May Cave on Beacon: Victory For Users May Be Nigh - <AUTHOR> http://www.techcrunch.com/2007/11/28/report-that-facebook-may-cave-on-beacon-victory-for-users-may-be-nigh/ <comment><USER2> Even if they back down, my opinion of Facebook is much reduced because they implemented this. How could anyone have thought this was a good idea for users?</comment>


How Lightning Killed 323 Reindeer at Once - <AUTHOR> http://motherboard.vice.com/read/a-very-simple-explanation-for-how-lightning-killed-323-reindeer-at-once <comment><USER2> TLDR since the title is slightly linkbait: They stood close together on wet ground.

<comment><USER3> In Brazil, about 2,000 units of cattle die every year due to lightning [1].

Main reasons: during rain, herd animals tend to pack near fences, under trees, or near each other in the middle of the field.

[1] in portuguese: [http://somarmeteorologia.com.br/noticias/60338/](http://somarmeteorologia.com.br/noticias/60338/)</comment></comment>


Ask HN: How long would it take to crack the Enigma Code now? - <AUTHOR> I wonder about this; how long would it take, without the specific historical knowledge we have about the Enigma Code / Enigma Machines, but with our current computing power / security expert man power / knowledge of encryption and math in general, etc., to crack similarly encrypted messages in the present day. <comment><USER2> I suspect it's hard to answer your question meaningfully. How do we ignore what we know about Enigma and still have modern cryptography?

It depends on which Enigma code and how much knowledge you know about the context of the message. Looking around, you can start with [https://www.cryptool.org/en/cryptool2](https://www.cryptool.org/en/cryptool2) :

> CrypTool 2 provides a variety of cryptanalytical tools to analyze or even > break classical and modern ciphers. With the current version you can, for > instance, apply a ciphertext-only attack on an Enigma-encrypted ciphertext

[https://en.wikipedia.org/wiki/Cryptanalysis_of_the_Enigma#Si...](https://en.wikipedia.org/wiki/Cryptanalysis_of_the_Enigma#Since_World_War_II) points to [http://www.tandf.co.uk/journals/pdf/papers/ucry_06.pdf](http://www.tandf.co.uk/journals/pdf/papers/ucry_06.pdf) from 10 years ago, which say that in about 6 weeks, "a total of ten breaks were achieved".

The WP page also refers to [https://enigma.hoerenberg.com/index.php?cat=M4%2520Project%2...](https://enigma.hoerenberg.com/index.php?cat=M4%2520Project%25202006&page=Rasch%2520Message) , which took 10 years to decrypt (calendar time, not CPU time). See [https://enigma.hoerenberg.com/cms/download.php?cat=65_M4%20P...](https://enigma.hoerenberg.com/cms/download.php?cat=65_M4%20Project%202006&file=Breaking%20the%20Last%20HMS%20Hurricane%20Intercept.pdf) for details.

</comment><comment><USER3> mangeletti, may I refine your scenario? Chuck Klosterman style + additions.

>>>

Suppose that the Enigma Machine had never happened (but the rest of history somehow came out the same--any innovations that came directly from the Enigma or related work at Bletchley Park, etc, those innovations still happened, so all of our tech and history are the same, sans Enigma machine).

Now suppose that some organization (ISIS? USA? Anonymous? China? The Mafia? Russia? Whatever you like.) suddenly obtains enough Enigma machines (they have wifi now instead of whatever they had before) to carry out all their sensitive communications.

Further suppose that you are a leader of some sort and your organization is in direct conflict with the Enigma-using organization. You can intercept the messages, but as of yet you are unable to read them. You must find a way to read those messages!

What are your first orders?

<comment><USER3> 1\. Run entropy measurement. ([http://www.fourmilab.ch/random/](http://www.fourmilab.ch/random/))

2\. If results from #1 are high, prioritize stealing an Enigma.

3\. If results from #1 are low, prioritize performing classical crypto work: interactive use of frequency analysis, etc.

</comment></comment><comment><USER3> It is worth noting that Enigma machine simulators exist.</comment>


GopherCon 2014: Go for Sysadmins by Kelsey Hightower [video] - <AUTHOR> https://www.youtube.com/watch?v=41GffiXhN6I

<comment><USER2> From the same guy that brought us confd:

[https://github.com/kelseyhightower/confd](https://github.com/kelseyhightower/confd)</comment>


Show HN: YouTube videos going viral in realtime (node.js/redis/socket.io) - <AUTHOR> http://www.videomuffin.com

<comment><AUTHOR> Kind of a fun weekend hack, learned a ton doing it. Feedback welcome.</comment>


Unannounced changes to the Nano codebase - <AUTHOR> https://medium.com/@muidem1000_49085/secret-changes-i-found-in-the-nano-codebase-c23ed6cc3d01 <comment><USER2> Oh, I was worried this was about the Nano editor but it's about some cryptocoin nonsense. Whew.

[https://www.nano-editor.org/](https://www.nano-editor.org/)</comment>


Automatic and custom image rotation - <AUTHOR> http://cloudinary.com/blog/automatic_and_custom_image_rotation

<comment><AUTHOR> This blog post describes how to easily rotate images in any angle and how to automatically rotate images left or right if the desired aspect ratio doesn't match the original image. Image rotations can be mixed with any other Cloudinary's image transformations. The results are cached and delivered through a fast CDN.</comment>


10 best pieces of advice for entrepreneurs from movie heroes - <AUTHOR> http://naturaily.com/blog/post/10-best-pieces-of-advice-for-entrepreneurs-from-movie-heroes <comment><USER2> Another one might be Indiana Jones who "cuts the Gordian knot" by whipping out his gun and blowing the sword-fighter guy away rather than going through with the big fight scene. Always look for a quick way around a problem.

<comment><USER3> Nice one! I think I'm gonna write part two. More ideas are warmly welcomed :)</comment></comment>


Swedes rebelling against a cashless society (2018) - <AUTHOR> https://www.bbc.com/news/business-43645676 <comment><USER2> I'm Swedish and this stuff makes me really worried. Especially since the main way for two people to exchange small amounts of money is through a proprietary app that uses a proprietary ID system (owned by a for-profit company) that only runs on iOS, Android, Windows and Mac.

I really hope this trend dies off, a cash-less society is a terrible idea.

I will say, however, that buses not taking cash is perfectly fine. They use NFC/RFID ticket cards which can't identify you. Not being able to buy tickets with cash is a little less fine.

<comment><USER3> > I really hope this trend dies off, a cash-less society is a terrible idea.

I fully understand that my opinion is both unintuitive and deeply disliked by many if not most people, so I can only ask you to spend some time thinking if you _really_ have thought this through.

Anyway, I believe there are realistic scenarios where it is good for the economy and society to have negative interest rates imposed by central banks. Cash is one of the things that prohibits this, thus we need to get rid of cash. _At the same time_ we definitely need privacy respecting payment methods. Thus we would likely need to develop some kind of physical tokens/coins/notes/whatever whose value is time dependent.

Biggest problem here is that the amount of people who simultaneously understand the need of negative rates and privacy respecting payment systems seems to be for all practical purposes pretty close to zero, so I am not holding my breath here.

<comment><USER4> I'm skeptic. Forcing people to buy crap they don't need by denying them ways to store cash will probably increase some numbers in some spreadsheets. But is it really a net positive for society? Or are there other reasons that I didn't consider like more people seeking investment options like the stock market?

<comment><USER3> Well, not "forcing"[1] people buying crap today makes the people creating the crap jobless and yes, that has a real cost for society. first because the jobless do not create value and second because someone needs to pay their unemployment benefits.

[1] Nobody is forcing you to do anything. You can voluntarily choose to lend your money to the bank if you agree with the interest rate. If you do not, you are free to do as you please with your money. Find someone who is willing to pay better interest rates (typically more risky)[2], buy crap, or even buy bitcoin or gold.

[2] Interesting question is, why society should guarantee you a return[3] on your investments if you do not yourself find a counterparty that is willing to pay you high enough return that you are happy with? Smells awfully lot like socialism to me.

[3] And why this guaranteed return needs to be exactly 0%? Why not 5%?

<comment><USER5> If it's legal to own bitcoin or gold, what good does eliminating cash do?

<comment><USER3> Central banks do not guarantee purchasing power of gold or bitcoin.

(A note, The questions I made above are not meant to be snarky. Those are the kind of questions I struggled literally for months when I tried to get my head around negative rates and whether they make sense or not.)

<comment><USER5> How do they guarantee the purchasing power of legal tender? Serious question, I thought the health of the economy and the need to pay taxes was all that did that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> I recently moved back to Sweden after living 4 years in Germany. I don't have any cards, and I don't carry a "smart"phone anymore; in Germany this didn't cause any trouble at all and I was far from alone.

Much of the current Swedish society is currently closed to me, I know of three shops and one cafe in the (200k people) city center that accept cash. Some of it has been gradual but it changed dramatically during the time I was away.

Believe me, this is not the kind of world anyone really wants to live in. It's all very convenient until the crap hits the fan, putting this much power in the hands of any authority is a recipe for disaster. Not to mention those who have no choice.

<comment><USER3> > It's all very convenient until the crap hits the fan

I have difficulties imagining the crap hitting fan that simultaneously breaks down electronic payment systems but rather miraculously keeps the purchasing power of paper money intact for any extended time. Could you maybe elaborate why you consider this specific scenario likely enough to worry about?

<comment><USER7> You may be reading "crap hits the fan" as something massive, like a collapse of the banking system.

I'm not the OP, but I can also read it as "crap hits the fan _for me_ ", and this makes it simple to imagine ways in which a person can lose access to digital payment (by theft, by being blocked by the bank for whatever reason, etc.) and if this happens, life would be difficult on a cash-less society until this access is regained.

Just imagine if you're accidentally identified as a financial supporter of terrorism or something like that, and your bank accounts are blocked. How would you buy even basic necessities if cash is not allowed?

<comment><USER8> People can lose access to cash too, by theft or whatever.

>Just imagine if you're accidentally identified as a financial supporter of terrorism or something like that, and your bank accounts are blocked

Then make it illegal for bank to block your account or whatever.

Sure, digital payment has its issue but why not fix the issue instead of going back to cash.

</comment></comment></comment></comment><comment><USER9> Being able to pay through cards and phones is super convenient, but cash should never not be an option.

Card companies, payment apps and banks are constantly tracking your purchases and profiling you. This data can be leaked/stolen/sold, and is always available to governments and those in/with power.

Cash is (almost completely) anonymous. You should always be able to pay with cash if you want.

<comment><USER10> > You should always be able to pay with cash if you want.

Why, other than your privacy? If I own a business, why should I be barred from choosing to not accept cash? Paper money is more labor-intensive to handle and opens my employees up to risk of being robbed for that cash or sickened by handling dirty bills.

As for people who may not be able to pay electronically, why can I not choose to not have them as customers?

If your argument is "because social good and we make those kinds of requirements on businesses all of the time," I'm open to it but feel it goes much farther than privacy.

<comment><USER11> _Why, other than your privacy?_

Businesses that don't accept cash don't make any money when the infrastructure fails. If your revenue is dependent on your PoS device, Wi-Fi, ISP, payment provider, the payment provider's network infrastructure, banking network, and more that's _a lot_ of risk. For most independent businesses having a working cash register and a bank account that enables cash deposits would be a better option than the cost of SLAs and insurance against not being open.

<comment><USER12> Storing carbon copies of credit cards is something still supported for when the network goes down, see "credit card imprinter"

<comment><USER13> So Sweden has gone almost cashless but they still have a manual process relying on embossed numbers?

In the UK embossed numbers on cards are gone now

<comment><USER14> > In the UK embossed numbers on cards are gone now

Nope.

The only ones I know of which do not use embossed numbers are Starling Bank, and (for premier customers) RBS and NatWest. All bar one of my cards is embossed.

Supposedly as of January last year: "Lloyds, Barclays, Nationwide, HSBC and Santander all say they currently have no plans to introduce such cards."

So which ones are you thinking of where the embossed numbers have gone?

</comment></comment></comment></comment></comment></comment><comment><USER15> Part of why cashless works is the same reason the Swedish welfare state generally works: a trust of government. Contrast this with Germany and its history with...lists; it's best not to have yourself be too traceable. I think the US is somewhere in-between, but at the end of the day, we'll hand over a lot for 2% cashback and avoid paying for journalism at all costs.

<comment><USER16> Of course, the German government that made lists did so without credit card records or electronic ids or anything like that...

<comment><USER17> This misses the point - the spying-on-your-citizens was decided by the state on purpose, going completely cashless enables dragnet surveillance that makes it really hard to evade if one has to (journalists, dissidents)

<comment><USER16> Oh, I was just answering the German comparison. I agree that mass surveillance is a terrible idea and is incomparable with democracy.

</comment></comment></comment></comment><comment><USER18> I am Norwegian and we seldom use cash as well. I use cash perhaps a couple of times per year. However I am totally against the reliance on electronic payment. Cash should alway be a viable option.

Or at least the electronic payment systems we use need to be more robust. I remember from living in the Netherlands that they had a neat system called Chipknip. It was electronic money. So the machines accepting it did not rely on having a direct connection to a bank at all times.

It think if we are to be cashless we need something like that. It needs to be possible to make payments without having a physical connection to a bank at all times.

A big problem with electronic payment is that we are handing over a huge amount of cash to companies like VISA and Mastercard. I think when all of society operates in this fashion there really is a need for a government supported solution, because this is not merely a question of a "neat" feature you can buy but essential infrastructure in society.

It is reckless to leave such essential infrastructure in the hands of private companies.

<comment><USER19> fully agree!

but i push it even further: i'm for electronic cash, but i'm against some american company (visa, mastercard) to know every transaction of mine.

I want public electronic cash. A public, national, non for profit infrastructure that manage cash.

<comment><USER20> I agree with your opinion about corporations tracking every transaction but I also dread the same situation but with government in place of these corps.

<comment><USER19> Well, paper money is exactly this already.

</comment></comment></comment></comment><comment><USER21> In Norway, next to Sweden, accepting cash is mandatory and you can get fined (after a warning it seems) if you don't.

The reasoning is we don't want everything to break down just because the power grid or backbone networks breaks down.

<comment><USER2> Looks like I know where I'm going if Sweden turns to shit.

<comment><USER21> BTW: I often look at profiles on HN.

</comment></comment></comment><comment><USER22> We aren't (Weren't) rebelling. There isn't even a debate about it. I still haven't used cash in years. Certainly not since the 2018 of the article.

We really need "digital cash", ie a government backed digital currency that can be used with the convenience of cards but with the anonymity (at the point of sale) of cash.

I don't believe in regular non-state cryptocurrencies for various reasons, not least because anonymity of all transactions isn't really desirable in a high tax welfare state with high trust that people pay taxes.

The Swedish central back is working on it, so maybe this is not too far away. One should be aware though that "digital cash" doesn't solve all the problems, it's not as resilient technically as paper cash.

</comment><comment><USER23> Its a bold headline, but as the article explains, its not actually very many Swedes who seem to be 'rebelling'.

People I know are trying to get pensioners they are 'responsible for' to stop carrying and using cash, as its far higher risk.

I don't personally know of anybody rebelling against the cashless society, not in any age group. Its not even talked about.

On the other hand, 'do you take swish' (a phone-to-phone payment method) is asked all the time. Lunch with friends? Instead of everyone ordering separately, just order together, and divvy it up with Swish when you get the bill. Etc.

I have a single banknote folded up my wallet, just for emergencies, and I haven't used it this year yet.

<comment><USER24> > I don't personally know of anybody rebelling against the cashless society, > not in any age group. Its not even talked about.

No one is, because the cashless society isn't happening. The concept of abandoning cash is at this stage merely a thought experiment. Even in Sweden, the most significant action taken in that direction is a discussion about whether to have a discussion, from the government.

But why would any government abandon cash? Any fiat currency needs at least some cash to go around, otherwise the remaining cash exchanges that still happens, a lot of which are untracked, would be outside of the control that governments still have over them; valuation. If you take away their cash, they will simply find another bartering tool.

<comment><USER25> You're right that if you take away cash the sketchy side of the economy might switch to euros or dollar :)

But that won't work for shops trying to avoid taxes. It'll also make it much harder to buy stuff from criminals, as you would have to go get cash somewhere.

What other cash exchanges still happens?

<comment><USER24> Tourists, I'd imagine. I am not sure how many merchants you know in Sweden that accepts UnionPay? At least of the smaller ones. And I know most German tourists prefer cash, generally any tourist from a cash heavy society will prefer cash.

Sure, their big ticket items are still going to be hotels and the like, where they will pay with a credit card, but they are not interested in coming if they can pay the small merchant with cash. Because they don't have access to the local infrastructure for digital payments, that the locals do.

<comment><USER26> When I travel abroad I just use my mastercard, why doesn't that work for them? I don't know anyone without a mastercard or a visa.

<comment><USER24> Where do you travel? There are plenty of countries I've been to that don't accept any foreign cards. Unless you only go to the fancy hotels and restaurants, I suppose. But if you actually want to interact with small merchants abroad, you need cash.

I never travel abroad without cash, and that includes when I travel to Sweden.

<comment><USER27> > I never travel abroad without cash, and that includes when I travel to > Sweden.

I've been in Sweden plenty times and haven't even seen a single Swedish krona. In the Copenhagen subreddit we also recommend people not bringing in cash, at least as long as their credit card situation is somewhat reasonable.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> In a society where cash is an option there is a roof on how much money you can extract from the population as if you ask for too much people will increasingly avail themselves of cash.

The cost of switching to using cash is a trip to the bank/atm.

The closer you get to cashless the more you can afford to screw people to the wall.

For example does anyone recall the idea us bankers floated about negative nominal interest on checking?

</comment><comment><USER29> The convenience of electronic payments is obvious. But cashless sounds more like a restriction, indeed inconvenience.

Say, one lost a wallet and phone (robbed or just that, lost) and needs to get back home somehow. Public transportation requires an electronic ticket, cab needs card. What's then?

Walk to your bank branch, explain to driver the story and pay later, hope a compelled passenger would pay for you?

Lending someone a dollar does not oblige one whether you trust the person on not. Paying for one directly is more involved. Surely people don't lend their cards to strangers, willfully.

<comment><USER30> Here is a radical idea: what if everyone paid their tickets through a public infrastructure tax. That way neither the person with cards or cash in their wallets has to worry about getting home. We don't even need to carry a wallet that could get lost in the first place!

<comment><USER29> In many European cities transportation is on honor basis, that is you're assumed to have paid the ticket, unlike elsewhere to pay on entry. But this is paired with random control runs and stiff penalties.

I would imagine one could just take a free ride, and prepare to tell the story if caught. Or maybe even go to police, report a loss, maybe get some means to get home.

Well, it's like a society contract. Looks like it has some small font on it too :)

This changes the notion of money, turning it more into rationning system. Cashless seems almost a step away from social credit system. You can get your "allocated share".

What does it mean to be a run-away in Sweden? Is it walk-away, hide-away, certainly not cashless...

</comment></comment></comment><comment><USER31> Maybe I'm biased but I much prefer the way the UK has handled this. Card payments are _everywhere_ , contactless payments are everywhere (life changer in London's public transport where touching in and out with your phone/card automatically charges you the correct price meaning that you don't need to deal with tickets) and everyone still has the option to use cash.

</comment><comment><USER32> Cash in the only practical anonymous-when-you-need-it-to-be way to pay still.

 _Don 't let it die until we have alternative suitable anonymous and un- blockable-by-cyberattacks (eg. "it must still work while the internet is down") currencies!_

(Note: no, we don't have yet, all current crypto currencies are "barely working prototypes" at best, all of them have issues that still need ironing out! Bitcoin itself is like a proof-of-concept-pre-MVP that got "rushed into production". And the blockchain itself... we _NEED_ to have a way of _fully erasing history_ from it, like paper money do, we _don 't yet know how to do that while keeping the nice properties of blockchain_... all these are open research questions, Satoshi only made the first baby step!)

<comment><USER33> Who are you quoting here?

<comment><USER34> Italics without quotation marks and not prefixed with > are usually simply for emphasis, not quoting.

</comment></comment></comment><comment><USER35> Excerpts from the 2022 Chairman of Harmony answer regarding the Holy See rejection of the Panda chip:

"It is a common misconception that the so called 'Mark of the Beast' chip has anything to do with money. The Panda chip is nothing more than a pandemic health and contact tracing beacon."

"Because the chip is always available and very secure, a lot of the citizens do choose to use it for payments."

"We find the ideas surrounding cash obsolete. All cash is uniquely identifiable and most major stores just destroy received cash for sanitary reasons and print cash on demand for change."

"Regarding precious metal purchases, the Government does allow purchase, except gold which is required to manufacture the Panda chip and related accessories".

</comment><comment><USER30> A lot of the comments to this post talks about the dangers with a cashless society in terms of giving up the right to privacy. While that might be true right now one must remember that the technological advances of cashless payments are very new and we must work towards a cashless payment solution that can meet the privacy needs that cash provides. Saying that "you should always be able to pay with cash if you want" sounds technophobic.

<comment><USER36> In the US, cash money is enshrined in the Constitution. It'll take a significant act of Congress to change that. So a long history of cash as a civil right.

<comment><USER30> That is true for many technological advances when faced with dated legislation. "Written in stone" is a very poor saying since the collective understanding changes with time. Conservativism does not play well with the rapid technological advances made each year.

</comment></comment></comment><comment><USER37> Not may, has caused. I've seen it myself.

On the plus side the app StreetComplete has merged in a quest that allows people to easily answer whether a business in Sweden accepts cash or not.

So hopefully that will improve the poor OSM data set and allow people to easier find cash payment places.

For the nerds out there it uses the OSM tag payment:cash=yes.

</comment><comment><USER38> Cashless is a dream for government because they can switch the populace to a negative interest rate.

<comment><USER39> You can have negative interest on cash as well. See Freigeld.

</comment></comment><comment><USER40> How do tourists pay for things in Sweden? Especially smaller value things.

One of the most inconvenient aspects about visiting China is paying for small things. Large department stores and high end restaurants will accept foreign credit cards, but mom and pop stores don't.

While most still accept cash, sometimes the smaller stores or street vendors won't have enough for change and you have to wait for them to get it. A few times I even got a discount when they couldn't give me exact change.

I installed WeChat and AliPay last time I visited, but the payments don't work if you don't have a local number, ID, or bank account.

<comment><USER41> Mastercard and Visa are the most common ones here, most probably a tourists credit or debit card will support the same payment networks.

</comment></comment><comment><USER42> I am from Spain, and today the people in power there are socialistic(psoe) and communist(podemos),the last one friends and money receivers from Venezuela's Hugo Chavez, Iran and Cuba.

I attended a talk in the past("Know your enemy") when they defended and wanted to collect money and people for helping Colombia's FARC.

Those guys want to destroy democracy from democracy, just like Hitler, Mussolini or Chavez.

The last thing you want to do is give a Government like this all the information of all transactions made by the people in the country.

And that is exactly what "cash free" means. In countries like the US the mechanism of control of political power by people are more powerful, but even there companies control and concentration of information is too high(Americans distrust Government but trust companies) for a healthy system.

</comment><comment><USER43> As a student who recently spent their savings on a Macbook 16 inch, just to have it stolen shortly after I really would have preferred selling it for cash would not have been an option for the thiefs.

in the same manner, I gladly would have accepted mass surveillance if it meant the thief would actually get caught.

</comment><comment><USER44> There is a world trend to criticise skandinavia (Scandinavian countries are always in the top 10 of best places to live) . The BBC has been for the last 10 years an awful source of it. The hit Scandinavia to divert attention of their own problems. EVVERYTHING they criticise is worst in the UK.

</comment><comment><USER45> How can you have a cashless society if I have to enter the pin every time I use my card? During my last trip to Stockholm using cards was more of a hassle than using cash. London/UK is more of cashless society than Stockholm/Sweden.

<comment><USER46> Many stores don't require a pin for smaller amounts. With NFC cards it's really quite quick to pay.

I think the deal is that the store, not the payment processor, eats the cost when a stolen card is used without a pin. But the increased turnover is probably worth it in many cases.

Edit: Maybe they also require a pin for foreign cards when they wouldn't for a local? Just a guess though.

</comment></comment><comment><USER47> Why put all eggs in a single bucket?

</comment><comment><USER48> A cashless society is a step on the way to communism. Whatever you think about communism (fear it or want it). Whoever doesn't want communism (which is much more likely to be a dystopia than an utopia) should defend cash to the death.

</comment><comment><USER49> And when the (broke) Swedish government raises taxes sky-high, they will all flock to cash, gold, bitcoin and other off-the-radar payment methods.

<comment><USER50> Government debt as a percentage of GDP is very low in Sweden:

[https://tradingeconomics.com/country-list/government-debt- to...](https://tradingeconomics.com/country-list/government-debt-to-gdp)

<comment><USER49> The thing about Swedish debt is that it's largely local than national:

[https://www.scb.se/en/finding-statistics/statistics-by- subje...](https://www.scb.se/en/finding-statistics/statistics-by-subject- area/financial-markets/financial-accounts/financial-accounts-quarterly-and- annual/pong/statistical-news/-financial-accounts-third-quarter-2018/)

<comment><USER50> Those figures I linked to don't distinguish between local and national debt.</comment></comment></comment></comment>


The ruthless Russian hacking unit that tried to crash Ukraine - <AUTHOR> https://www.washingtonpost.com/outlook/the-ruthless-russian-hacking-unit-that-tried-to-crash-ukraine/2019/12/26/beaf477a-1470-11ea-a659-7d69641c6ff7_story.html <comment><USER2> [https://darknetdiaries.com/episode/54/](https://darknetdiaries.com/episode/54/)</comment>


Show HN: Halcyon – System for installing Haskell apps - <AUTHOR> https://halcyon.sh

<comment><USER2> This seems like a blessing.</comment>


Why this Canadian restaurant went from a no-tipping policy back to having tips - <AUTHOR> http://www.cbc.ca/news/canada/edmonton/caf%C3%A9-linnea-allows-tipping-1.4272268 <comment><USER2> The article raises some interesting points, but does not consider that there exist countries outside America with different, working, tipping policies:

\- They completely abolished tipping, which caused social backlash because people are conditioned to tip. While the article qualifies this as "if we get good services, we should tip". As someone who recently moved to the US, that does not seem true in my experience, but rather you tip irrespective of the service quality. In other countries your bill includes a standard tip and then you are free to add an additional, smaller tip, if the service was good.

\- They had issues communicating the price "increase". Of course, in effect you still pay the same amount, so other than tax avoidance, this is purely a psychological issue. What other places do: List the same prices as before and include a fixed service fee. This can be per table/per person or just a fixed "tip" of, say, 15%.

\- The waiters were payed less because the prices were not adjusted accordingly. Not a tip/no-tip issue.

\- salaried employees have more stable working hours and their employer was unwilling to pay for all these hours if demand is low. This of course ignores that on the other hand, they don't have to pay extra during busy hours, but previously this part was payed by the customers.

</comment><comment><USER3> I really wish I could look at the books for this place.

I get the no-tipping thing, and how the prices have to change based on that. The higher wages will go down to the servers (and probably other non-tip based staff too), and that's good. I wonder if servers were getting paid higher or lower on the new system? Were there more or less customers (probably less, since they stopped doing it), and how did they feel about the price increases?

Also, I wonder how much of the income of tips is in cash and off the books. Not getting taxed on a part of your income can really make a big difference. Yes, I know it's probably illegal to not report the tips, but I imagine it's something that happens all the time, especially with cash tips.

<comment><USER4> Even back when I was waiting tables in college in the 90's most transactions were CC. You had to enter the tip amount as part of your end of shift processes to balance things out. This was recorded by the system and you then had to enter it into the companies system. Essentially everyone only ever claimed the CC tips and nothing more.

Yet as more and more transactions move to CC the discrepancy between actuals and declared is MUCH smaller.

<comment><USER5> And the cut the CC companies take for providing what should essentially just be a distributed database grows even more.

</comment></comment></comment><comment><USER6> A lot of restaurants have tried this in my area and gone back to tips. The servers generally hate it (no tips with "living wage") because the restuarants that do this tend to be higher end high-minded hipster spots. And the servers make a LOT of tips there. The "living wage" is actually less for them. You don't see this experiment happening at Denny's.</comment>


Startup Design Kit - <AUTHOR> https://uxstudioteam.com/ux-blog/startup-design/ <comment><AUTHOR> Hey guys, Recently we have been working on collecting the key elements that can help a startup grow successfully. Here are our findings. Do you think following these steps is enough to make an impact?

</comment><comment><USER2> It was very interesting, thanks!

</comment><comment><USER3> Thank you for sharing this :)

</comment><comment><USER4> Great post!</comment>


Ask HN: Are any of you salaried under pay-for-performance? - <AUTHOR>

A potential employer just sent me an offer with a 20k reduction in base salary, but 20k added on in bonuses if I meet expectations. Anyone in CTO/programming/IT capacity work this way? <comment><USER2> I'm not sure why anyone would take such a deal, it's not uncommon for developers to have bonuses tied to performance but I would expect that to be on-top of a competitive base salary and not in-lieu of it.

<comment><AUTHOR> That's exactly what I was thinking as well.

In context of CTO-level work, pay-for-performance would also seem to encourage meeting reward goals at the expense of a thousand other unmeasured tasks.

<comment><USER2> Most CTOs (and generally all senior staff) have incentivized bonuses.

</comment></comment></comment><comment><USER3> I've never heard of that and unless you are happy with the worst-case base salary I would renegotiate. Having been a part of many bonus systems, I never plan on the bonus money to actually hit my bank account.

<comment><AUTHOR> Good advice, thank you. I told the employer that since this is a reduction rather than addition, it's more like a punitive system.

<comment><USER4> I believe if I were to take this offer, the risk/reward would have to be higher, in addition to knowing about partial bonuses and how pass/fail/partial allocation is figured(discretionary vs calculated). So in this example to take a 20K salary hit, the bonus would have to be at least 40K. If you hit it only ever other year, it evens out.

</comment></comment></comment><comment><USER5> All else being equal, I would say No deal. reduction in base salary is a huge thing. Let me tell you why. Lets say you do take that new job with the salary reduction, best case you get that 20K bonus. Now, if you want to switch jobs, most employers will consider your base salary first and bonus second because bonus is not guaranteed. Your leverage or power to negotiate goes down with a lesser base salary. Worst case, you don't even get the bonus (oh we had a bad year u know) and there u r. 20K reduced base with 0 bonus. Your next potential employer wont care less why u took a reduction. They see reduction, period.

I know i m sounding harsh here but thats the reality of salaries these days. I understand that startups might have a little more flexibility but as a professional with 10 years of work experience, I would _never_ _ever_ suggest to take a salary reduction. You just don't know where you will end up next.

</comment><comment><USER6> What about benefits? My current employer values benefits at 22% of one's gross salary. I'm a contractor so they figure if I am going to be an employee that I should work for X - 22% + a non-guaranteed performance bonus of 7-15%.

<comment><AUTHOR> Benefits are all buy in at group rates, no equity options, so that may be moot in this case. Good point though.

</comment></comment><comment><USER7> It depends upon the company. If it's a young company that's growing then they might like to give you the salary but can't afford it. By giving you part of the salary as a bonus, it allows them backload the cost.

</comment><comment><USER8> You won't get it unless it's up front. Common sense should prevail here, why structure it like this except they don't want to pay you?

<comment><AUTHOR> I think it's a bit of systemic mistrust rather than any underhanded plan. The owner is worried about what he sees as a high salary and wants to bake in some accountability.</comment></comment>


Hetzner under large ddos attack - <AUTHOR> http://www.hetzner-status.de/en.html

<comment><USER2> We have several clusters in DC19 and have had stable uplinks for most of the year, but now and then DDOS happens. This also happened with our other servers on other providers too, like UK2 and OVH over the years. Unfortunately, DDOS is not easy to protect from and cost a lot to manage. I'd rather have these outages on rare situations than pay 200% more for the same performance. No client's have complained either, because they know we offer more for less.

But if you run HA nodes, cloud or premium services on cheap providers like Hetzner, UK2 or OVH (excluding their cloud offering that has DDOS protection) you only have yourself to blame.

<comment><USER3> We also have several clusters in DC19 and we have had similar experience to yours. However, it looks like DDOS attacks are becoming a real issue for us now.

Could you recommend a provider that in your opinion has a better DDOS protection than Hetzner? (We also use AWS but are not excited about it for a number of reasons).

<comment><USER2> Wait until OVH open again, they offer the cheapest professional DDOS protection in Europe right now.

</comment></comment></comment><comment><USER4> I hate this - especially on a sunday afternoon when I don't want to think about work :( My phone keeps ringing because some of our servers appear to offline....

I wonder how many admins around the globe are currently annoyed by monitoring alerts :-(

<comment><AUTHOR> yep. and i'm pretty annoyed that they do not update their status page more regularly while things seem to get worse by the minute.

<comment><USER5> Try the customer forum for more current, crowdsourced information: [http://forum.hetzner.de](http://forum.hetzner.de)

</comment></comment></comment><comment><USER6> The company I work in has some servers in RZ19 and we have intermittent problem of similar kind all the time over the last month or two. Most of the time the servers just stop being reachable from the Internet or packet loss occurs when trying to reach them, at random times during the day for brief periods like 1 minute, and Hetzner explained it with DoS attempts on other servers in the same data center. Has anyone else had similar issues? Yesterday evening and today they have of course much bigger issues.

</comment><comment><USER7> I have had bad experiences with Hetzner in past, there are many better providers out there I do not understand why people use them and their cheap desktop based servers and minimal support (even if hardware breaks and you can prove it they drag their legs)

<comment><USER8> I've had always had good experiences with Hetzner, a few times even speaking by phone to an English-speaking technician running around the data center.

Which providers would you consider better whilst providing similar value?

</comment></comment><comment><AUTHOR> it seems large parts of their address space within the 18.104.22.168/24 netblock (and not just the mentioned 18.104.22.168/27) are currently shut down. ipv6 traffic is still fine.

</comment><comment><USER9> Look like its UP now... able to access server on DC19 from India...

</comment><comment><USER10> yes, 18.104.22.168/24 looks down for me too, unfortunately even the robot administration is unavailable

<comment><USER11> Try to use european proxy, they banned all US part, as can I see (inbound and outbound connections), but I connect to admin/ssh from Russia.

<comment><USER10> I'm in Europe (Spain now). But it looks down from Czech Republic too.

</comment></comment></comment><comment><USER12> go to link11 (www.link11.de) they host servers and have ddos protection, which works pretty well.

</comment><comment><USER13> Black hole, again, now.</comment>


Ask HN: Can we achieve total self-sufficiency with today´s technology? - <AUTHOR> I have been a supporter of basic income for some time now, but lately I started to have some doubts about its long term feasibility. Without getting into too much detail, it is mostly because even if you have an universal basic income, the individual and communities still depend on the good will of the political system. Let´s say we have a president Trump and he decides something stupid, it could entirely obliterate or at least minimize the gained value of independence (i.e. through hyper inflation).
So instead of thinking about that idea, can we assemble a set of existing technology that would allow everyone to cover the basic needs of life?
Based on the definition of Max Neef the fundamentals human needs are:
-subsistence (i.e. food) -protection  (i.e. housing) -affection -understanding -participation -leisure -creation -identity -freedom
I imagine achieving this could allow a group of individuals to accomplish independence, self sufficiency and open new ways organizing life and structure a society. A precondition would be that the toolset aims for maximum independence from existing states/ governments. While we might have not make it all the way, how far are we down that road as of today? <comment><USER2> Says you need about 2 acres(family of four): [http://www.thesurvivalistblog.net/how-much-land-does-it- take...](http://www.thesurvivalistblog.net/how-much-land-does-it-take-to-be- self-reliant/)

20k house (payment 5% interest $108/mo) [http://www.fastcoexist.com/3056129/this-house-costs- just-200...](http://www.fastcoexist.com/3056129/this-house-costs- just-20000-but-its-nicer-than-yours)

Next would be clothing? Cotton? Internet access?

<comment><AUTHOR> Thanks. How about 3D Printing or other means of automation?

</comment></comment><comment><USER2> Couple projects along the lines your talking about:

[http://opensourceecology.org/](http://opensourceecology.org/)

[http://www.wikihouse.cc/](http://www.wikihouse.cc/)</comment>


Ash Maurya: The lean stack - <AUTHOR> http://www.ashmaurya.com/2012/06/the-lean-stack/

<comment><USER2> Startups, keep you head down and build real products that delight customers, instead of subscribing to these "startup gurus".

<comment><USER3> I'd like to subscribe to your formula as well if you can tell me how to repeatedly delight customers :-)

</comment></comment><comment><USER4> I'd like to think the essence of a start-up is in the passion of its team to produce something _new_ / _fascinating_ / _challenging_ ...

If you want to mainly establish a sustainable business model, just run a traditional service business. There's enough money to be made there.

</comment><comment><AUTHOR> For those in the Midwest we need to banish Midwest nice as well:

[http://www.siliconprairienews.com/2012/06/what-i-learned- in-...](http://www.siliconprairienews.com/2012/06/what-i-learned-in-boulder)

</comment><comment><USER5> I like Ash and his approach to lean but this recent post feels like overkill. The lean canvas (based on the business development model) was meant to simplify planning and decision making, not make it complex and time consuming.

[http://sparknlaunch.wordpress.com/2012/03/05/another-way- to-...](http://sparknlaunch.wordpress.com/2012/03/05/another-way-to-plan- business-model-v-business-plan/)

<comment><USER3> As I point out in the post, I'm not one for needless process... but beyond a certain threshold, I find predictability is needed.</comment></comment>


Freework – Time Tracking for freelancers - <AUTHOR> https://www.freework.com <comment><AUTHOR> Hi,

Co-Founder here :-)

We are happy about any feedback. Feel free to post your suggestions and ideas.

Finally we made it! Our first version is now available in the Apple App Store and Google Play Store.

 __* Description Freework is the simplest and most convenient way to keep track of your daily work – engineered for every freelancer in mind. With Freework you can log your time on the go. Our time tracking tool is free to download, and your one-stop solution to keeping tabs on the most valuable part of your business: you.

 __* Features – Track time and working hours Time logging should be simple, so we made it so. Simply hit the start button to start the timer and stop the task once your done – works on every device. Find out what projects, activities, and clients you spend your time on. Better time management starts with knowing how you spend each second.

– Manage Client Create your clients in just 3 steps. Select your client-name and address directly from our database, and choose your hourly rate through a simple creation process. Log and store information which may be used to increase client satisfaction. You can access all your client data at any time.

– Business Cockpit The Freework overview provides everything you need to run your freelancer business with ease. Check your daily stats, total tracked time and total logged earnings in one simple view. Deliver your timesheets at the touch of screen. Choose which tasks goes into each report, select the file format, and export!

 __* But wait, there is more in our pipeline... The following products / services/ features are in the works # Slackbot # Mac-App # Invoicing

Give it a try and let us know if you have any issues, suggestions or ideas for improvement!

Thank you, Ben

<comment><USER2> If it meets the guidelines, this might make a good 'Show HN'. Show HN guidelines: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

<comment><AUTHOR> Makes sense. Thanks for the hint. I will check the guidelines and might do a 'Show HN' post tomorrow

<comment><AUTHOR> [https://news.ycombinator.com/item?id=15617243](https://news.ycombinator.com/item?id=15617243)

:-)</comment></comment></comment></comment>


The Looming Battle Over AI Chips - <AUTHOR> https://www.barrons.com/articles/the-looming-battle-over-ai-chips-1524268924 <comment><USER2> If you're FB, GOOG, AAPL, AMZN, BIDU, etc, this strategy makes sense because much like they have siloed data, they also have siloed computation graphs for which they can lovingly design artisan transistors to make the perfect craft ASIC. There's big money in this.

Or you can be like BIDU, buy 100K consumer GPUs, and put them in your datacenter. In response, Jensen altered the CUDA 9.1 licensing agreement and the EULA for Titan V such that going forward, you cannot deploy Titan V in a datacenter for anything but mining cryptocurrency, and his company reserves the right going forward to audit your use of their SW and HW at any time to force compliance with whatever rules Jensen pulled out of his butt that day after his morning weed. And that's a shame. Because there's no way any of these companies can beat the !/$ of consumer GPUs and NVDA is lying out of its a$$ to say you can't do HPC on them.

But beyond NVDA shenanigans, I think it's incredibly risky to second guess those siloed computation graphs from the outside in the hopes of anything but an acqui-hire for an internal effort. Things ended well for Nervana even if their HW didn't ship in time, but when I see a 2018 company ([http://nearist.ai/k-nn-benchmarks-part-wikipedia](http://nearist.ai/k-nn- benchmarks-part-wikipedia)) comparing their unavailable powerpoint processor to GPUs from 2013, and then doubling down on doing so when someone rightly points out how stupid that is, I see a beached fail whale in the making, not a threat to NVDA's Deepopoly.

<comment><USER3> FYI I think your comment is informative and I understood a lot of it but that's a shitton of acronymns for the uninitiated.

<comment><USER4> FB: Facebook

GOOG: Google

AAPL: Apple

AMZN: Amazon

BIDU: Baidu

ASIC: Application specific integrated circuit

GPU: Graphics processing unit

CUDA: Compute-unified device architecture

EULA: End-user license agreement

weed: marijuana

HPC: High-performance computing

NVDA: Nvidia

HW: hardware

</comment></comment></comment><comment><USER5> Nvidia will almost certainly respond to this challenge with it's own specialized machine learning and inference chips. It's probably what Google, Facebook and others hope. Forcing Nvidia to work harder is enough for them.

Developing a new high performance microarchitecture for GPU or CPU is complex task. A new clean sheet design architecture takes 5-7 years even for teams that have been doing it constantly for decades in Intel, AMD, ARM or Nvidia. This includes optimizing the design into process technology, yield, etc. and integrating memory architectures. Then there is economies of scale and price points.

Nvidia's Volta microarchitecture design started 2013, launch was December 2017

AMD's zen CPU architecture design started 2012 and CPU was out 2017.

<comment><USER6> Google's gen2 TPU was announced May 2017, and available in beta February 2018. That 2018.02 date is probably the appropriate comparison to Volta's 2017.12 and Zen's 2017 dates.

EDIT: I'm trying to draw a comparison between the availability dates (and where the companies are now), not the start of production (and their development velocity). Including the announcement date was probably a red herring.

<comment><USER5> I'm aware.

Making a chip and making competitive chip are two different things.

When Nvidia enters the market with specialized chip it's likely on completely another level in bandwidth, energy consumption and price per flop performance. They have so much more experience with this.

* [https://drive.google.com/file/d/0Bx4hafXDDq2EMzRNcy1vSUxtcEk...](https://drive.google.com/file/d/0Bx4hafXDDq2EMzRNcy1vSUxtcEk/view)

* [https://blogs.nvidia.com/blog/2017/04/10/ai-drives-rise-acce...](https://blogs.nvidia.com/blog/2017/04/10/ai-drives-rise-accelerated-computing-datacenter/)

</comment></comment></comment><comment><USER7> _Nvidia, moreover, increasingly views its software for programming its chips, called CUDA, as a kind of vast operating system that would span all of the machine learning in the world, an operating system akin to what Microsoft (MSFT) was in the old days of PCs._

Yeah, nVidia throwing it's weight around in terms of requiring that data centers pay more to use cheap consumer gaming chips may turn out to backfire and certainly has an abusive-monopoly flavor to it.

As I've researched the field, Cuda really seems provides considerable value to the individual programmer. But making maneuvers of this sort may show the limits of that sort of advantage.

[https://www.theregister.co.uk/2018/01/03/nvidia_server_gpus/](https://www.theregister.co.uk/2018/01/03/nvidia_server_gpus/)

<comment><USER2> It probably won't. For every oppressive move NVDA has made so far, there has been a swarm of low-information technophobe MBA sorts who eat their computational agitprop right up, some of them even fashion themselves as data scientists. More likely, NVDA continues becoming the Oracle of AI that everyone needs and everyone hates.

<comment><USER8> So is OpenCL dead? Because that's how everyone is talking. The tools you choose, and their licensing, matters!

<comment><USER9> OpenCL isn't dead, if you write your code from scratch you can use it just fine and match CUDA performance. In my experience, OpenCL has two basic issues.

The first is the ecosystem. Nvidia went to great lengths to provide well optimized libraries built on top of CUDA that supply things people care about - deep learning stuff, dense as well as sparse linear algebra, etc. There's nothing meaningfully competitive on the OpenCL side of things.

The second is user friendliness of the API and the implementations. OpenCL is basically analogous to OpenGL in terms of design, it's a verbose annoying C API with huge amounts of trivial boilerplate. By contrast, CUDA supports most of the C++ convenience features relevant in this problem space, has decent tools, IDE and debugger integration, etc.

Neither of these issues is necessary a dealbreaker if you're willing to invest the effort, but choosing OpenCL over CUDA requires prioritizing portability over user friendliness, available libraries and tooling. As a consequence, not many people choose OpenCL and the dominance of CUDA continues to grow. Unfortunately, I don't see that changing in the near future.

</comment></comment></comment></comment><comment><USER10> Do people think that nobody at nVidia has ever heard of specialized deep learning processors?

1\. Volta GPUs already have little matmul cores, basically a bunch of little TPUs.

2\. The graphics dedicated silicon is an extremely tiny portion of the die, a trivial component (source: Bill Dally, nVidia chief scientist).

3\. Memory access power and performance is the bottleneck (even in the TPU paper), and will only continue to get worse.

<comment><USER2> Never overestimate the intelligence of the decision makers at big bureaucratic tech companies. Also, it is not in the best interest of any of them to be reliant on NVDA or any other single vendor for any critical workload whatsoever. Doubly not so for NVDA's mostly closed source and haphazardly optimized libraries.

All that said, Bill Daly rocks, and NVDA is a hardened target. But the DL frameworks have enormous performance holes once one stops running Resnet-152 and other popular benchmark graphs in the same way that 3DMark performance is not necessarily representative of actual gaming performance unless NVDA took it upon themselves to make it so.

And since DL is such a dynamic field (just like game engines), I expect this situation to persist for a very, very long time.

<comment><USER11> > Never overestimate the intelligence of the decision makers at big > bureaucratic tech companies.

See Google and anything chat related after 2010

</comment></comment></comment><comment><USER12> Non paywall link: [https://outline.com/FucjTm](https://outline.com/FucjTm)

</comment><comment><USER13> It would be interesting to try emulate a many-core CPU as a GPU program and then run an OS on it.

This sounds like a dumb idea, and it probably is. But consider a few things:

* NVIDIA GPUs have exceptional memory bandwidth, and memory can be a slow resource on CPU based systems (perhaps limited by latency more than bandwidth)

* The clock speed isn't _that_ slow, it's in the GHz. Still one's clocks per emulated instruction may not be great.

* You can still do pipelining, maybe enough to get the clocks-per-instruction down.

* Branch prediction can be done with ample resources. RNN based predictors are a shoe-in.

* communication between "cores" should be fast

* a many-core emulated CPU might not do too bad for some workloads.

* It would have good SIMD support.

Food for thought.

<comment><USER14> Generally speaking emulating special purpose hardware in software slows things down a lot so I don't think that relying on a software branch predictor is going to result in performance anywhere close to what you'd see in, say, an ARM A53. And since you have to trade off clock cycles used in your branch predictor with clock cycles in your main thread I think it would be a net loss. Remember that even though NVidia calls each execution port a "Core" it can only execute one instruction across all of them at a time. The advantage over regular SIMD is that each shader processor tracks its own PC and only executes the broadcast instruction if it's appropriate - allowing diverging control flows across functions in ways that normal SIMD+mask would have a very hard time with except in the lowest level of a compute kernel.

That also means that you can really only emulate as many cores as the NVidia card has streaming multiprocessors, not as many as it has shared processors or "cores".

Also, it's true that GPUs have huge memory bandwidth they achieve that by trading off against memory latency. You can actually think of GPUs as throughput optimized compute devices and CPUs as latency optimized compute devices and not be very mislead.

So I expect that the single threaded performance of a NVidia general purpose computer to be very low in cases where the memory and branch patterns aren't obvious enough to be predictable to the compiler. Not unusably slow but something like the original Raspberry Pi.

Each emulated core would certainly have very good SIMD support but at the same time pretending that they're just SIMD would sacrifice the extra flexibility that NVidia's SIMT model gives you.

<comment><USER7> _Remember that even though NVidia calls each execution port a "Core" it can only execute one instruction across all of them at a time._

There are clever ways around this limitation, see links in my post this thread.

[https://news.ycombinator.com/item?id=16892107](https://news.ycombinator.com/item?id=16892107)

<comment><USER14> Those are some really clever ways to make sure that all the threads in your program are executing the same instruction, but it doesn't get around the problem. Thanks for linking that video, though.

<comment><USER7> The key of the Dietz system (MOG) is that the native code that the GPU runs is a bytecode interpreter. Bytecode "instruction pointer" together with other data is just data in registers and memory that's interpreted by the native code interpreter. So for each thread, the instruction pointer can point at a different command - the interpreter runs the same instructions but the results are different. So effectively you are simulating a general purpose CPU running a different instruction on each thread. There are further tricks required to make this efficient, of course. But you are effectively running a different general purpose instruction per thread (actually runs MIPS assembler I recall).

<comment><USER13> This is more or less what I'm talking about. I wonder what possibilities lie with using the huge numerical computation available on a GPU applied to predictive parts of a CPU, such as memory prefetch prediction, branch prediction, etc.

Not totally dissimilar to the thinking behind NetBurst which seemed to be all about having a deep pipeline and keeping it fed with quality predictions.

<comment><USER7> I'm not sure if your idea in particular is possible but who knows. There may be fundamental limits to speeding up computation based speculative look-ahead not matter how many parallel tracks you have and it may run into memory through-put issues.

But take a look at the MOG code and see what you can do.

Check out H. Dietz' stuff. Links above.

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> Pretty soft article. General purpose processors no longer have the performance or energy efficiency that's possible at scale. Further, if you have a choice to control your own destiny, why wouldn't you choose to?

<comment><USER16> Great post. It is like mining going to ASICs. We have hit limits and you now have to do your own silicon.

A perfect example is the Google new speech synthesis. Doing 16k samples a second through a NN is not going to be possible without your own silicon.

[https://cloudplatform.googleblog.com/2018/03/introducing- Clo...](https://cloudplatform.googleblog.com/2018/03/introducing-Cloud-Text- to-Speech-powered-by-Deepmind-WaveNet-technology.html)

Listen to the samples. Then think the joules required to do it this way versus the old way and trying to create a price competitive product with the improved results.

</comment></comment><comment><USER17> The article states:

>"LeCun and other scholars of machine learning know that if you were starting with a blank sheet of paper, an Nvidia GPU would not be the ideal chip to build. Because of the way machine-learning algorithms work, they are bumping up against limitations in the way a GPU is designed. GPUs can actually degrade the machine learning's neural network, LeCun observed.

"The solution is a different architecture, one more specialized for neural networks," said LeCun."

Could someone explain to me what exactly are the limitations of current GPGUs such as those sold by Nvidia when used in machine learning/AI contexts? Are these limitation only experienced at scale? Ff someone has resources or links they could share regarding these limitations and better designs I would greatly appreciate it.

<comment><USER18> I went to a talk from the CTO of Graphcore ([https://www.graphcore.ai/](https://www.graphcore.ai/)) on Monday. They are designing chips targeted at machine learning. As I understood it, their architecture comprises \- lots of "tiles" \- small processing cores with collocated memory (essentially DSPs) \- very high bandwidth (90TB/s!) switching fabric to move data between tiles \- "Bulk Synchronous Parallel" operation, meaning that the tiles do their work and then the switching fabric moves the data, and then we repeat.

The key challenge he pointed to was power - both in terms of getting energy in (modern CPUs/GPUs take similar current to your car starter motor!) and also getting the heat out. Logic gates take a lot more power than RAM, so he argued that collocating small chunks of RAM right next to your processing core was much better from a power perspective (meaning you could then pack yet more into your chip) as well as obviously being better from a performance perspective.

[https://www.youtube.com/watch?v=Gh- Tff7DdzU](https://www.youtube.com/watch?v=Gh-Tff7DdzU) isn't quite the presentation I saw, but it has quite a lot of overlap.

Hope that helps!

<comment><USER17> Thanks for the detailed response and link! Cheers.

</comment></comment></comment><comment><USER19> There is certainly a lot of hype around AI chips, but I'm very skeptical of the reward. There are several technical concerns I have with any "AI" chip that ultimately leave you with something more general purpose (and not really an "AI" chip, but good at low precision matmul):

* For inference, how do you efficiently move your data to the chip? In general most of the time is spent in matmul, and there are lots of exciting DSPs, mobile GPUs, etc. that require a fair amount of jumping through hoops to get your data to the ML coprocessor. If you're doing anything low latency, good luck because you need tight control (or bypassing entirely) of the OS. Will this lead to a battle between chip makers? Seems more likely to be a battle between end to end platforms.

* For training, do you have an efficient data flow with distributed compute? For the foreseeable future any large model (or small model with lots of data) needs to be distributed. The bottlenecks that come from this limit the improvements from your new specialized architecture without good distributed computing. Again better chips don't really solve this, and comes from a platform. I've noticed many training loops have terrible GPU utilization, particularly with Tensorflow and V100s. Why does this happen? The GPU is so fast, but things like summary ops add to CPU time limiting perf. Bad data pipelines not actually pipelining transformations. Slow disks bottlenecking transfers. Not staging/pipelining transfers to the GPU. And then there is a bit of an open question of how to best pipeline transfers from the GPU. Is there a simulator feeding data? Then you have a whole new can of worms to train fast.

* For your chip architecture, do you have the right abstractions to train the next architecture efficiently? Backprop trains some wonderful nets but for the cost of a new chip (50-100M), and the time it takes to build (18 months min), how confident are you that the chip will still be relevant to the needs of your teams? This generally points you towards something more general purpose, which may leave some efficiency on the table. Eventually you end up at a low precision matmul core, which is the same thing everyone is moving towards or already doing whether you call yourself a GPU, DSP, or TPU (which is quite similar to DSPs).

Coming from an HPC/Graphics turned deep learning engineer, I've worked with gpus since 2006 and neural net chips since 2010 (before even AlexNet!!), so I'm a bit of an outlier here having seen so many perspectives. From my point of view the computational fabric exists we're just not using it well :)

<comment><USER20> Most top tier tech all.have their working solutions for these. It's a matter of turning into product and moving the industry mindset.

<comment><USER16> There is nothing for the buyer to see. They are buying a service or capability and what silicon that runs on is here or there to them.

A simple example is the Google New Speech synthesis service. It is done using NN on their TPUs but nobody needs to know any of that.

[https://cloudplatform.googleblog.com/2018/03/introducing- Clo...](https://cloudplatform.googleblog.com/2018/03/introducing-Cloud-Text- to-Speech-powered-by-Deepmind-WaveNet-technology.html)

What the buyer knows is the cost and the quality of the service.

Now Google had to do their own silicon to offer this as otherwise the cost would have been astronomical. The compute to do 16k samples a second with a NN are astronomical.

If I could not see it myself I would say what Google did was not possible.

Just hope they share the details in a paper. If we can get to 16k cycles through a NN at a reasonable cost that opens up a lot of interesting applications.

</comment></comment></comment><comment><USER21> Back in the day, there was a 386. And also a 387 coprocessor to have the tougher math bits.

Then came a 486 and it got integrated again.

But during that time, the GPU split off. Companies like ATI and S3 began to dominate, and anyone wanting a computer with decent graphics had one of these chips in their computer.

Fast forward several years, and Intel again would bring specialized circuitry back into their main chips, although this time for video.

Now we are just seeing the same thing again, but this time it's an offshoot of the GPU instead of the CPU. Seems like the early 1990's again, but the acronyms are different.

Should be fun to watch.

</comment><comment><USER22> Does anyone have a non-paywall but legitimate link to the story?

<comment><USER23> Incognito -> search for headline -> click

<comment><USER17> Thank you for this tip. Out of curiosity why does this trick work?

<comment><USER24> Websites like this want traffic from Google. To get indexed by Googlebot they have to show the bot the article text, and Google's anti-blackhat-SEO rules mean that you have to show a human clicking through from Google the same text that you show Googlebot. So they have to show people visiting through that route the article text too.

</comment></comment></comment></comment><comment><USER25> If I were better credentialed, I would definitely be looking to get into semiconductors right now. It's an exciting time in terms of manufacturing processes, and I think some of the most interesting and meaningful optimization problems ever formulated come from semiconductor design and manufacturing, not to mention the growing popularity of specialized hardware.

I would tell a younger version of myself to focus your education on some aspect of the semiconductors industry.

</comment><comment><USER26> Alphabet has already made its AI chip...its second generation already.

<comment><USER16> Plus Google has the data and the upper layers of the AI stack to keep well ahead.

</comment></comment><comment><USER16> The new Google Speech solution is the perfect example on why Google had to do their own silicon.

Doing speech with 16k samples a second through a NN and keep at a reasonable cost is really, really difficult.

The old way was far more power efficient and if you are going to use this new technique which gets you a far better result and do it at a reasonable cost you have to go all the way down into the silicon.

Here listen to the results.

[https://cloudplatform.googleblog.com/2018/03/introducing- Clo...](https://cloudplatform.googleblog.com/2018/03/introducing-Cloud-Text- to-Speech-powered-by-Deepmind-WaveNet-technology.html)

Now I am curious on the cost difference Google as able to achieve. It is still going to be more then the old way but how close did Google come?

But my favorite new thing with these chips is the Jeff Dean paper.

[https://www.arxiv-vanity.com/papers/1712.01208v1/](https://www.arxiv- vanity.com/papers/1712.01208v1/)

Can't wait to see the cost difference using Google TPUs and this technique versus traditional approaches.

Plus this approach support multi-core inherently. How would you ever do a tree search with multiple cores?

Ultimately to get the new applications we need Google and others doing the silicon. We are getting to extremes where the entire stack has to be tuned together.

I think Google vision for Lens is going to be a similar situation.

<comment><USER27> This somewhat blows my mind. Yes, it is impressive. However, the work that Nuance and similar companies used to do are still competitive, just not getting near the money and exposure.

I remember over a decade ago, they even had mood analysis they could apply to listening to people. Far from new. Is it truly more effective or efficient nowadays? Or just getting marketed by companies you've heard of?

<comment><USER28> It is truly better. Objective metrics (such as word error rate) don't lie. You can argue whether it makes sense to use, say, 100x compute to get 2x less error, but that's a different argument; I don't think anyone is really disputing improved quality.

<comment><USER27> Do you have a good comparison point? And not, hopefully, comparing to what they could do a decade ago. I'm assuming they didn't sit still. Did they?

I question whether it is just 100x compute. Feels like more, since naturally speaking and friends didn't hog the machine. Again, over a full decade ago.

More, the resources that Google has to throw at training are ridiculous. Well over 100x what was used to build the old models.

None of this is to say we should pack up and go back to a decade ago. I just worry that we do the opposite; where we ignore progress that was made a decade ago in favor of the new tricks alone.

<comment><USER16> The thing is it is not simply the training but the inference aspect would have require an incredible amount of compute compared to the old way of doing it.

Hope Google will do a paper like they did with the Gen 1 TPUs. Would love to see the difference in terms of joules per word spoke.

</comment></comment></comment></comment></comment><comment><USER16> The dynamics of the chip industry have completely changed. Use to be a chip company like Intel sold their chips to a company like Dell that then sold the server with the chip to a business which ran the chip and paid the electric bill.

So the company that made the chip had no skin in the game with running the chip or the cost of the electricity to run it.

Today we have massive cloud with Google and Amazon and lowering the cost of running their operations goes a long way unlike the days of the past.

This is why we will see more and more companies like Google create their own silicon which has already started and well on it's way.

Not only the TPUs but Google has created their own network processors as they quietly hired away the Lanai team years ago.

[https://www.informationweek.com/data-centers/google-runs- cus...](https://www.informationweek.com/data-centers/google-runs-custom- networking-chips/d/d-id/1324285)?

Also this article helps explain why Google built the TPUs.

[https://www.wired.com/2017/04/building-ai-chip-saved- google-...](https://www.wired.com/2017/04/building-ai-chip-saved-google- building-dozen-new-data-centers/)

</comment><comment><USER29> I just seem to bump into a paywall.

The premise from the title seems plausible, although NVIDIA seems to be catching up again fast.

<comment><USER30> I was impressed enough with their CES demo to buy some stock. Isn't the Volta at 15E9 transistors? It's at the point only the big boys can play in that field due to fab costs, unless it's disrupted due to some totally new architecture.

First time on HN I can read a paywalled article, as I have a Barron's print subscription.

<comment><USER31> 21e9 transistors.</comment></comment></comment>