Complete, Persistent Compromise of Netgear Wireless Routers - <AUTHOR> http://shadow-file.blogspot.com/2013/10/complete-persistent-compromise-of.html

<comment><USER2> This, along with bufferbloat [1], is why you run OpenWRT or another similarly modern, fully open source distro on your home routers.

Right now, the best supported devices are ath9k's, so things like the Buffalo WZR-* models are ideal.

The WNDR 4700 model specifically doesn't have good support for 3rd party firmware [2] due to it's use of NAND flash in an unsupported manner, so if you have that model you're kind of sunk at this point.

1\. [http://www.bufferbloat.net](http://www.bufferbloat.net)

2\. [http://wikidevi.com/wiki/Netgear_WNDR4700](http://wikidevi.com/wiki/Netgear_WNDR4700)

<comment><USER3> If you want a more hardened setup I recommend pfsense, a freeBSD based firewall/router disto [0]. It'll run on any number of mini/nano boards and several companies sell prebuilt boxes. It can run as a wifi AP as well but I find that a separate AP works best.

[0] [http://www.pfsense.org/](http://www.pfsense.org/)

<comment><USER4> What do you use as a separate AP? My cursory searching indicates there exist enterprise-grade APs requiring a controller device, overkill for my apartment, or I use your standard bestbuy device like we're wanting to be avoiding in this thread.

<comment><USER3> Most consumer routers actually work fairly well as APs. Once you've turned off all the routing functionality, which are the most complex and resource intensive bits, they seems to actually be pretty stable. I'm currently using an Asus RT-AC66U, which is complete overkill, but I wanted reliable AC wifi and it was the best option at the time. Prior to that I was using an Asus EA-N66R AP.

As for how this relates to the exploit discussed here, your only using it as an AP, you'll very rarely need to login after the first setup since it really isn't doing much, just Wifi <-> Ethernet bridging. If using a consumer router the WAN port isn't connected to anything, no outside access to worry about (unless you did some funky forwarding on the pfsense box). You should also disable management via Wifi. That limits any access to a wired connection to the network, meaning someone is already in your apartment to physically patch in with an ethernet cable. Any security bets are off at that point. If you want super extra special security you can setup firewall rules on the pfsense box that only make the AP's IP address accessible from a particular port.

As dumb as this exploit is on the part of netgear, remember that to exploit it the attacker had to have already broken the WPA2 security to access the wifi or physically plugged in with ethernet. The first vector can be avoided by simply turning off management via wifi.

<comment><USER5> _As dumb as this exploit is on the part of netgear, remember that to exploit it the attacker had to have already broken the WPA2 security to access the wifi or physically plugged in with ethernet. The first vector can be avoided by simply turning off management via wifi._

Or accessed your router internally via JavaScript, img tag, or iframe hidden on a malicious or compromised page. XSRF is real.

Edit: granted, browsers limit what JavaScript can do across sites, but request-only access is enough to change DNS settings to something malicious, and if the attacker can inject unescaped content into the page in some way, then they can run JavaScript on the router page and send data back that way.

Edit2: I'm not certain, but I think the timing of image load events could be used to determine success/failure of router actions loaded through a hidden img tag.

</comment></comment></comment></comment></comment><comment><USER6> I have a WNDR 4700 and I can't replicate as described. However, I've also never trusted the stupid thing since it stores passwords in clear text (or at least is happy to display them in clear text on one of its admin pages).

<comment><USER7> Even major browsers store/show passwords in clear text, can it be that wrong? ;)

<comment><USER8> That's different. Browsers need to show your password to external websites to prove to others that you're you. This requires storing the actual password. They expose saved passwords in the UI because if they didn't, it would create a false sense of security. There's always going to be some way to get the saved passwords, or the feature wouldn't work.

The router admin interface only needs to _check_ your password. It can do that by storing only a cryptographic hash, not the password itself.

<comment><USER9> I think they could however, as a default behavior, store each password encrypted individually using itself as a key, that way no plaintext passwords would need to be stored at all.

<comment><USER10> Then you would have to type in the password each time you wanted to use it anyway. Not much sense in storing anything in that case. :)

<comment><USER9> Yup that's right, my bad. I were thinking of a way of somehow not requiring input yet providing passwords without plaintext storage.

What would _actually_ work I guess would be storing a hash of <the password, a unique string provided through https auth>. So for the first time the browser would hash the pass and afterwards just provide the pass to the server as a hash without requiring input, acting as a normal pass to the server. However, that would either require some sort of universal agreement among browsers to work, which is tricky to require, or some browser-server protocol in which the browser would only carry such procedure to supported servers. If a supported server is accessed through a non-supported browser, the server itself would perform the hash.

Probably too much of a hassle just in name of abolishing plaintext passwords on browsers, but I couldn't think of anything simpler. However, fun to imagine :)

Obs: This would have the extra bonus of depriving knowledge of plaintext passwords to servers (in case they are compromised, the attacker would not get to try the pass across other services) and preventing password extraction through impersonation of webpages (although this is already guaranteed by https to some extent).

<comment><USER11> If servers accepted a hash of a password instead of the actual password then the hash becomes the password. Ie, possession of the hash is equivalent to possession of the password since it can be used to authenticate.

Therefore, this is no different than storing them in plaintext. Furthermore, it would mean that if the hashes got stolen because a server was compromised those could be used as passwords and that would make it pointless to hash them in the first place.

In other words, no, that wouldn't work.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> One alternative to underpowered routers running OpenWRT or pfsense is to use a beaglebone black as your router. It's got well-supported wifi devices with antennae available, and you're not compromising on clock or ram.

<comment><USER13> Except the BBB only does 10/100 Ethernet so can't really operate as a modern router. The advantage of say an OpenWRT modded D-Link DIR-825, is it includes a gigabit router that handles internal traffic while the cpu handles the firewall and vpn to the outside world. Because local traffic is handled by completely separate silicon inside the router, CPU and ram is not a constraint.

<comment><USER14> Doesn't that separate silicon handle switching, not routing?

<comment><USER13> yes you're right, thanks for the correction.

</comment></comment></comment></comment><comment><USER15> Exploit doesn't appear to work on a WNDR3700v2. I'm hoping it doesn't, as this has been the only router I've ever liked after years of dealing with complete garbage.

</comment><comment><USER16> If you have a Netgear WNDR3700v2 or a WNDR3800, check out Cerowrt [1]. The latest stable build, 3.7.5-2, has been _exceptionally_ stable for me, and fast. I would highly recommend it.

1\. [http://www.bufferbloat.net/projects/cerowrt](http://www.bufferbloat.net/projects/cerowrt)

</comment><comment><USER17> So has anyone used any of the open hardware alternatives, like routerboard.com ? Seems like having the schematics and the firmware would be a reasonable place to be.

<comment><USER18> I looked into these kind of things but I'm in an odd position where I need an ADSL2+ chipset of a certain kind (Broadcom with good noise filtering) because of the state of my phonelines.

I was looking into running an ADSL modem in full-bridge mode (you'd be surprised how many of these modems don't support that anymore) + a routerboard or mirotik product, but when you add up the cost and configuration time it just wasn't worth it.

I'm currently running a Billion 7800VDPX, which I now have the GPL sources to (after some prodding). When I finally have some time to sit down and risk bricking my device, I'll have a look at getting OpenWRT working (although at last glance they were never going to support ADSL).

tl;dr: open hardware alternatives aren't easy enough to drop in yet, or they're not really open - [http://wiki.mikrotik.com/wiki/Manual:License](http://wiki.mikrotik.com/wiki/Manual:License)

</comment></comment><comment><USER19> This post, and other recent ones like it, indicate to me the importance of running a port scan and making sure no management abilities are exposed over the WAN side of these devices. Any suggestions on good, fast online port scanners?

<comment><USER20> In addition to management, a bunch of these can serve up files to the WAN side. On Netgear devices it is in a USB storage section.

I do scans from cellular devices (Fing on Android and iOS, is passable for popular ports) and my laptop (nmap) when out and about.

</comment></comment><comment><USER21> Question: I have Cable internet here in Aus (100mb/10mb) and I like my connection, but we have to use Telstra's silly modem, and they refused to activate any other one on the network.

So, lets assume I don't trust this AP and Modem to be secure (fair enough assumption in my opinion) -- the best way would be to perhaps build my own Wireless AP running pfsense, on a BeagleBone Black or similar?

        Cable -> Telstra Modem w/out Wireless -> pfsense AP -> Network

Would that be the most secure way to handle that situation?

<comment><USER22> Since pfsense won't run on a beaglebone, that's a non starter. I also have my doubts as to a beaglebone's ability to reliably push 100mb of traffic.

<comment><USER21> Ah, that was just an admittedly poorly-researched example. I basically just meant a board that'll run open-source code.

</comment></comment></comment><comment><USER23> Do companies like Netgear not have a team whose only purpose is to try to break their own products? I thought that was a primary source of employment for infosec types.

</comment><comment><USER24> Ah, this just illustrates how much hardware companies suck at building software.

</comment><comment><USER25> I like that this was technical and informative, but still talked down to people like me who aren't at all knowledgable with how infosec works. Great read; wish I could find more like it.

<comment><USER26> Which part did you feel was talking down to you? I need to know in order to improve my own writing.

<comment><USER27> I don't think he meant "talk down" in a negative way. I think he was trying to say that it clearly explained things to someone who doesn't know about the topic (while still being full of details to someone who does).</comment></comment></comment>


Ubuntu licensing dispute resolved in satanists' favor. - <AUTHOR> http://www.neowin.net/news/main/09/06/21/canonical-stops-satanists-selling-ubuntu-esque-t-shirts

<comment><USER2> Read the article and I just have to say - oh, wow, religiously branded Operating Systems.

Am I the only one here who thinks this is taking stupid to a completely new level?

<comment><USER3> If they are really satanists, they aren't talking it seriously.

</comment></comment><comment><USER4> For some reason it thinks I'm running a mobile browser even though I know I'm running Shiretoko nightly (a.k.a. Firefox 3.5) and doesn't let me view the page until I click on full site and then go to [http://www.neowin.net/news/main/09/06/21/canonical-stops- sat...](http://www.neowin.net/news/main/09/06/21/canonical-stops-satanists- selling-ubuntu-esque-t-shirts) again.

I despise UA sniffing.

</comment><comment><USER5> Incorrect title: the original article has "satanists" in quotation marks.

<comment><AUTHOR> Could be, although I and many others have difficulty telling apart Satanists- in-jest vs. Satanists-in-earnest; so the need for scare quotes in the original is debatable.

</comment></comment><comment><USER6> I did a Satanic Edition install for a metal lovin' friend of mine.

It's kinda awesome. Silly, but awesome.

</comment><comment><USER7> I can see a Ubuntu Scientology Edition coming.

Albeit a Windows version would be far more appropriate.

<comment><USER8> "Albeit a Windows version would be far more appropriate."

And here I am, thinking that Apple has more in common with Scientology.

<comment><USER7> I think Apple is closer to a legitimate religion than Microsoft. And, perhaps more important, they seem less prone to do illegal actions to further their interests.</comment></comment></comment>


Rock Mountain Ruby's stance on charging speakers - <AUTHOR> http://martyhaught.com/articles/2011/06/07/conference-organizing-and-speakers/

<comment><USER2> Yeah, the post can spurred some interesting comments from the Python community on why they do charge speakers. Curious about other programming communities.</comment>


The American civil war then and now – interactive - <AUTHOR> http://www.theguardian.com/artanddesign/ng-interactive/2015/jun/22/american-civil-war-photography-interactive <comment><USER2> Great content, but the auto-change on scroll was annoying. They should have at least implemented a small delay.

Anyone know why the trees at Antietam Dunker's Church appear to have shrunk? Or is that just a trick of the lens? I find the trees to be the most interesting part of these comparisons. The Brompton oak is beautiful.

<comment><USER3> They are almost certainly new trees - the originals having been cut down in the decades after the battle. I'm not sure when the programs started, but I know a lot of the battlefields have been intentionally restoring tree lines to their original appearance at many of the battlefields - although this is of course going to be a decades-long process.

</comment></comment><comment><USER4> This is really well done. I only wish they had a little more historical explanation to go with each photo.

I'm not sure if it was the Guardian, but there was a WWII article where they did a similar photo overlay effect. I can't find it. Anyone remember this?

<comment><USER5> I suppose you mean this one from The Atlantic:

[http://www.theatlantic.com/photo/2014/06/scenes-from-d- day-t...](http://www.theatlantic.com/photo/2014/06/scenes-from-d-day-then-and- now/100752/)

</comment></comment><comment><USER6> History really distorts things. Do we have to wait 200 years to see fights with ISIS in a similar "noble tragedy" kind of light, where there are no clear baddies and nobody's assigned blame for the killings?

Maybe some of those dead people were "baddies" fighting for something we don't believe in anymore? In that case, surely we should be celebrating the fact that they died. If not, then maybe we should be complaining about the violent people who killed them? It's not a natural disaster where nobody wants it to happen. Soldiers actively fought for some purpose or other that we presumably either accept or not today.

<comment><USER7> In the case of the American Civil War, we have ample context in these times to hold nuanced understandings of the matter.

The Confederate army was comprised of men, many of whom died defending their homeland from what they perceived to be the aggression of an imperialistic outside force determined to impose an alien set of values on their society, obliterating their capacity for self-determination. The sad fact that these men were commonly quite racist and supported the oppression other human beings (the slaves) does not erase that, and does not mean their deaths met in war were a form of high Justice.

We have been gifted with a powerful legacy, the triumph of the Union and the cause of freedom, and it would be an abuse of that legacy to trivialize the matter. Instead, if we choose to invest the death of one of an enlisted Confederate army private with dignity and respect, one of the "baddies", we are exercising the same respect for our common humanity that impelled our forefathers to sacrifice their lives lifting the slaves out of slavery to begin with.

<comment><USER8> I'm unwilling to separate out "they were defending their values" from "their values included chattel slavery". I find nothing noble in holding values dear that are so wrong.

<comment><USER7> Well, no, and the point isn't to excuse them or call them noble for that, the point is that it's an exercise of _our_ values to say that all men have dignity, and that even if we're fighting them it's not much better to _dehumanize_ people for their values than it is for their race.

I mean, what do you think of people who claim we should blow up all the Muslims because they have inferior values? Little bit monstrous of them, right? Or take the Reformation writ large, nations alternately executing Papists and Protestants.

<comment><USER8> I'm ok with acknowledging the humanity of, but not the dignity of, a group of people who willingly, emphatically, repeatedly worked to deny others of their basic human rights.

We see words like "heritage" thrown around a lot with respect to the south. I like to remember what that heritage is:

[http://www.theatlantic.com/politics/archive/2015/06/what- thi...](http://www.theatlantic.com/politics/archive/2015/06/what-this-cruel- war-was-over/396482/)</comment></comment></comment></comment></comment>


How Indian Immigrants Have Changed the face of Silicon Valley - <AUTHOR> http://www.sanfranmag.com/story/home-where-brain <comment><USER3> I interviewed someone last week for a European multi-national. He was a dream candidate, with much more experience than me (I wasn't interviewing him as a manager, but as a potential colleague) and for much bigger companies than me (Yahoo! to name one) and I probably over-compensated in the technical interview because his resume put mine to shame, but he answered all the questions and we had a good chat about various technologies relating to the position. The only reason he wanted to leave San Fran was because he had to as he is an Indian and having visa issues - so now a European company gets the talent. Thanks, America!

</comment><comment><USER4> "India's best and brightest swept inland, helped turn a valley full of orchards to Silicon."

Uh, no. Those orchards were gone long before South Asians came to Silicon Valley in significant numbers. The demographic makeup of SV engineers was overwhelmingly white American until around a dozen years ago.

With the importation of so many engineers into the US, wages were suppressed and many American students who had the potential to become engineers made the rational decision to pursue other career paths.

<comment><USER5> "The demographic makeup of SV engineers was overwhelmingly white American until around a dozen years ago."

A dozen years ago was 1997. Do you seriously think this is true?

"With the importation of so many engineers into the US, wages were suppressed..."

You seem to think that white Americans work hard to "create" jobs, which are then "stolen" by hordes of immigrants. In other words, white Americans "give" and immigrants "take". That's just not how it works.

Immigrants in SV are on average smarter and work harder than Americans - <USER2> because there's something wrong with Americans, but because these immigrants are a highly biased sample of the world's huge population.

<comment><USER4> "A dozen years ago was 1997. Do you seriously think this is true?"

Of course. That's why I wrote it. This is based on my living and working in SV at the time.

"You seem to think that white Americans work hard to "create" jobs, which are then "stolen" by hordes of immigrants. In other words, white Americans "give" and immigrants "take". That's just not how it works."

Who are you quoting when you put quotes around the words "create", "stolen", "give", and "take"? Are you trying to give the impression that you are quoting me?

The wage issue is basic economics: if you increase the quantity supplied of something (such as wheat, or trained engineers), the price will drop.

<comment><USER5> No, it's not supply/demand economics, that was my point. It would be if Americans created jobs that immigrants later filled. That is not happening.

Rather, both Americans and immigrants worked hard to build a tech industry that then created jobs. Without the immigrants, the Americans would not have been able to create an industry more significant than, say, the Japanese or Italian tech industry. Thus many jobs would not exist, and the wages would not be higher.

You did not say words like "create", "stolen", "give", and "take", but they are implicit in making your supply/demand argument work.

<comment><USER6> I am morally opposed to immigration restrictions in general. But I agree with dbc. An increased supply in engineers lowers price (wages). If all immigrants left SF tomorrow, the companies left short would bid up the price of an engineer. That _is_ basic economics.

The words you have put in quotes are the moral judgements you believe are attached to those events. dbc gave no indication of such a position. He is just talking abut the dynamics of the market. An engineering shortage would have encouraged more engineering training. The number of white engineers is not static.

*The other things that would happen if immigrant left is that it would become more rational to hire engineers outside of SF ultimately damaging the prosperity of the city. SF engineers should not want to lose the immigrants.

</comment></comment></comment></comment></comment><comment><USER7> "For decades, those swells traversed the Pacific and smashed to rolling white breakers south of San Francisco. India's best and brightest swept inland, helped turn a valley full of orchards to Silicon. And Silicon turned to gold, as baby-faced kings with Coke-bottle glasses made millions overnight."

Could someone please summarize the factual content of the article? The title makes me interested, but I don't have the patience to wade through the novelist-wannabee writing.

<comment><USER8> I looked at the HN comments page expecting to see the usual: a bunch of sycophantic comments to the effect of "America is evil! Her immigration policies are backward!!" I wasn't disappointed.

But I'm glad somebody else noticed the pretentious, creative writing 101 nature of the writing. This author is someone who has yet to learn the value of simple, effective language.

Now where's that copy of Strunk and White....

</comment></comment><comment><USER9> As a US citizen, I'd like to apologize for our inane immigration system. Hopefully we can get it changed in the next couple of years.

<comment><USER10> > Hopefully we can get it changed in the next couple of years.

The problems aren't new. It's unclear what's changed recently that would allow them to be fixed.

In fact, I suspect that they're actually going to get worse, as protectionism is the first response to economic woes.

Also the folks who say that they care about making it easier for "the best and the brightest" to come to the US insist on joining forces with the "let everyone in" folks. The two issues are separable and latter has considerably more opposition. If the former is your real goal....

</comment></comment><comment><USER11> I have no doubt that expelling and turning away top Asian talent is bad for American business innovation, but there is another problem here. The advanced degree system is not designed to benefit the individual. I think the amount of work one must put in and the financial rewards one reaps upon graduation are out of sync. PG says as much in his essays.

For a business, they know that if someone has been willing to put up with eight years of crap as a student, they're likely to put up with many more years of it as an employee. Maybe there needs to be a visa program for Asian students without advanced degrees who are starting businesses.

<comment><AUTHOR> > Maybe there needs to be a visa program for Asian students without advanced > degrees who are starting businesses.

Or smart people, period. I'm Canadian and have an undergrad degree in Psych and Computer Science. I've written code at big media companies that you've heard of and started an online education company from scratch with an American co-founder that's growing nicely.

All told I've helped generate millions for the economy and created hundreds of jobs for Americans, and it's _still_ a pain in the ass for me to start a company in the US (technically, I can start a company without problems. But working for a company I start is nearly impossible w/o an American co- founder).

</comment></comment><comment><USER12> I think the limit on H1B's will benefit large multi-nationals and harm smaller American based companies. I also think it will benefit the American born engineer.

The multi-nationals like IBM, Cisco, et al have already moved many of their engineering jobs overseas. They also have the big bucks to pay American citizens to do those jobs. The result is that smaller firms must rely on them for contractors and consultants which increases the price for these engineers _even more_.

The result is that engineers get paid more money to do local work through multinational corporations who farm them out to the smaller firms without the resources to find them or the deep pockets to give them permanent salaried jobs.

It also increases the prices for technology for local firms who can't afford custom systems or assistance developing their wares.

Either way, I'm not sure "American" companies are harmed, there is a division among the companies in America who are harmed and those who benefit. The large ones with offices overseas may very well benefit, relative to the harm done to smaller firms.

Also, American citizens will benefit through the availability of cheaper products produced in foreign lands, including software and hardware products. Holding America up as a torch doesn't make much sense here because _all_ of america won't experience the same effect.

Furthermore, there is a lot of criticism of the program because many economists, including Milton Friedman have called it a "corporate subsidy" and others argue that there in fact _are_ enough americans to fill the technology positions.

Really, there is a lot of irrationality on both sides of the debate. Arguments are made on "right now" rather than the future of America. It is only the corporations who are saying that this issue has a deliterious effect on our future. They say we need to change the policy for our future, because they are feeling the pain right now. I'm not really sure who is right.

</comment><comment><USER13> The comments are scary.

</comment><comment><USER14> Can't remember the last time I saw such a fabulously written piece.

<comment><USER8> Fabulously written? Please. The writing was sophomoric and cluttered with pretentious metaphors and turns of phrase. The fledgling writer's first attempt at self-aggrandization.

Heh.

<comment><USER15> Agree. I was willing to roll with it through the couple of introductory paragraphs, thinking this was just how the writer chose to set the stage for their piece. However I abandoned reading half-way through after realizing that every sentence in the article was going to be a throbbing, oozing purple jumble. Metaphor should be the spice of writing, not the base, otherwise it loses all power and simply becomes cloying.</comment></comment></comment>


SpaceX bans Zoom over privacy concerns - <AUTHOR> https://www.reuters.com/article/us-spacex-zoom-video-commn/elon-musks-spacex-bans-zoom-over-privacy-concerns-memo-idUSKBN21J71H <comment><USER2> The fact that they show end users (no pun intended) an "end-to-end encrypted" badge on the meeting window itself, and elsewhere explain how a Zoom server (not Zoom client) is what constitutes an "end" despite the whole rest of the electronic communication industry using "end-to-end" to refer exclusively to user agents, is bonkers.

<comment><USER3> Agreed. It's unlikely they stumbled onto an industry standard phrase like that alone, then innocently used it without knowing the generally accepted meaning. This is deceptive advertising.

<comment><USER4> Not defending zoom here -- they done fucked up -- but there is a huge disconnect between the marketing folks and the technical folks. It's possible that E2E Encryption was something they planned on implementing but haven't, and the marketing department either didn't get the memo or didn't understand and still kept the wording.

<comment><USER5> If marketing misuses a term on the website because they didn't understand what it meant, that's their fault. If they listed a feature that hasn't yet shipped, that's their fault.

It's natural that there is a divide and marketing isn't expected to understand every engineering thing (nor the other way around.) If your job is to write words, though, you are responsible for the words you right.

<comment><USER6> _you are responsible for the words you right._

Wait, did you do that on purpose? :)

<comment><USER5> :)

</comment></comment></comment></comment></comment></comment><comment><USER7> Zoom is such a bizarre product. For huge video calls, it tends to perform as well or better than everything else out there. Yet at the same time it literally seems like straight-up malware and seems to violate your trust and privacy left and right every step of the way, even in the installer (!).

<comment><USER8> To be fair it does perform _better_ than everything else, which is why people are so forgiving of it, but it still doesn't excuse their ineptitude on privacy and security.

<comment><USER9> In my experience Google's Hangout Meetings have been at least as good or better quality and the interface is far superior in my opinion. For example it works in the browser without any plugins (even in Firefox.)

<comment><USER10> I haven't used Hangouts on a professional setting in a while. Does it finally support tile view? Another feature I find really valuable is allowing two windows. One for participant view and a separate one for shared screen.

<comment><USER11> Nope. Have to resort to chrome extension to get the tile view.

<comment><USER12> When not in presentation mode.

</comment></comment></comment></comment></comment></comment><comment><USER13> The problem with Zoom isn't, that it doesn't have end-to-end encryption. If you consider the problem, it is extremely difficult to solve, as in contrast to a 1:1 video call, the server somehow has to to multiplex the streams and thus at least some access to them. With a trustworthy provider, this isn't a big issue. A trustworthy provider will have a clear policy which ensures that only the multiplexer has access to the unencrypted data. After all, you are running a proprietary client from that provider, and each client of course has access to all unencrypted data.

The problem is, that the actions of Zoom doesn't make them look like a trustworthy provider. They lied about the end-to-end encryption. What they should have done instead is to be transparent on how unencrypted data is used on their servers and what their protocols are to prevent unauthorized access to that data. Which is especially important in a business context, because the business users themselves have confidentiality agreements, they need to guarantee and using an external provider for confidential data required that provider passing the neccessary scrutiny.

And of course, the huge pile of security issues coming up with their client, the web server, the mac installer, the script host, give any reason to believe that they either don't know what they are doing or completely reckless at least. And the term "reckless" doesn't fit in a conversation about security :).

<comment><USER14> No. "End-to-end encryption" does not protect metadata necessary to route the data over a network, just the contents of the communication. The clients could negotiate keys to protect the contents of a meeting end-to-end. In other words, Zoom servers could deduce who was speaking, when they spoke, and for how long, but not what they said.

Your internet service provider can deduce the same about your HTTPS connections.

<comment><USER15> > The clients could negotiate keys to protect the contents of a meeting end- > to-end.

Not really because Zoom makes fairly extensive use of the _decrypted_ video streams on their servers, e.g. to detect who is talking, pause video for people with slow connections, etc. You could _maybe_ do it for meetings with a few people in, but good luck doing it for meetings with 100 people.

Hell the cryptography of group end-to-end encryption hasn't really been worked out yet. WhatsApp doesn't do it and that's just for text. I'm pretty sure Signal doesn't either.

There's really nothing bad with not having end-to-end encryption for group video conferencing apps. The shitty thing is that they pretended that they did.

<comment><USER16> > Not really because Zoom makes fairly extensive use of the decrypted video > streams on their servers, e.g. to detect who is talking, pause video for > people with slow connections, etc. You could maybe do it for meetings with a > few people in, but good luck doing it for meetings with 100 people.

You encrypt audio and video streams separately. If your connection is slow you stop grabbing the video stream. Detecting who is talking is a local function because you are receiving audio packets from them. Encryption doesn't have to change the amount of data sent.

> Hell the cryptography of group end-to-end encryption hasn't really been > worked out yet. WhatsApp doesn't do it and that's just for text. I'm pretty > sure Signal doesn't either.

Two ways: 1\. Your password does not need to be shared with Zoom for entry into the meeting room. That password and the meeting room number are converted into a symmetric encryption key, so everyone who is able to join the meeting successfully has the same group shared secret for both sending and receiving video and audio.

2\. You have an invitation system where the host of the meeting approves people. This approval causes the symmetric key of the meeting to be shared with the person seeking approval, encrypted to their public key. People who can supply a proof of possession of the password or whose public keys were associated with the meeting get invited without requiring confirmation by the host, although the participants in the room becomes a log of who was able to view the meeting.

These get harder if you want to say have a periodic key rotation while a meeting is going, for sure. They also get harder if you try to encrypt routing metadata or disguise that the traffic is audio/video in general.

The real thing that kills E2E for a corporate product like Zoom are the phone dial-ins. Hardly a point for all that security if you have one person calling in having the now unencrypted voice traffic bounced all over the place.

> There's really nothing bad with not having end-to-end encryption for group > video conferencing apps. The shitty thing is that they pretended that they > did.

100% agreed within Zoom's market because of integration of external services like dial-in/dial-out voice.

<comment><USER17> I presume they also resize video, so that you download small streams for thumbnails, plus a bigger one for the main view. If it's just two sizes you could do it before uploading, but this would be harder if it's actually 10 different qualities.

<comment><USER18> Zoom also has a feature that lets people join a meeting by phone. There's no way they could do that without being able to access the unencrypted stream.

</comment></comment></comment></comment></comment></comment><comment><USER19> That's the right thing to do. If SpaceX is important to national security, then Zoom security and privacy is so bad, that a bad actor could steal SpaceX technology.

At my previous job, we used to dial in random zoom numbers and entered into random conversations of other companies. Once we landed into a Facebook call where they were talking about Libra (before it was a thing).

If you turn of camera and video, the host doesn't even know you're there unless they check guest list.

<comment><USER20> Doesn't it chime when someone enters?

<comment><USER21> Sure, but with a large enough call, legitimate users may come and go during the call too.

</comment></comment></comment><comment><USER22> I looked into adding Zoom to our Slack workspace this morning, and was beside myself with the set of permissions they requested — reading the contents of every channel and private chat they're included in? For a slash command?

That's a hard no. Turned me off the service entirely.

<comment><USER23> It's only available in the paid version, but slack's video conferencing works pretty well.

<comment><USER24> It works, but it burns through so much CPU your computer will be a gibbering mess. There's some pretty silly inefficiencies going on, for example; if you switch away to another window, they display a small video player while keeping the big one running the background. Each time you switch into screen sharing mode, they drag you back to the app again. If you draw on the screen, someone has screwed up their linear algebra so you end up seeing double with an extra copy of what you're drawing, in totally the wrong place.

Annoyingly it's a bit too convenient, so going out of band is a pain.

<comment><USER25> I regularly have complaints that people can't hear me over my laptop's fan when using slack video conferencing, or jokes about hair driers. Computer is a MBP16.

Seems like they need to get their CPU use under control.

<comment><USER26> You could also get a headset instead of yelling at your built-in mic. As a 100% remote employee, even before Covid, the coworkers with headsets are _much_ easier to understand, and have less background/foreground noise.

As a headset user myself, no one ever asks me to repeat myself, notices when I type, or hears anything not within an inch of my mouth. Plus, I've got a physical mute switch for instant, unambiguous mute, as-needed.

</comment></comment></comment></comment></comment><comment><USER27> I feel very conflicted on Zoom. It mostly just works and on every platform, even Linux. My kids use it to do their music lessons now. It really is very good at what it does in a time when such solutions are needed. Also they responded to the mobile facebook sdk issue and the macos issue quickly.

But I agree the way they suggest it is end to end encrypted is misleading. I don't think it really can be end to end to get the performance and features. People just need to see each other at the moment. You can do anything sensitive with more secure communication. But it clearly doesn't belong in any place discussing technology with military applications.

I still think it is solid for my kids to keep up with their lessons or for a weekly meeting about some web development. There are genuine criticisms of Zoom at the moment that need to be taken seriously but there is likely also some negative media being generated from their competition that are missing out.

<comment><USER28> They did not address the OSX issue for ages. They claimed it was intentional and a valuable feature for customers. In the end Apple had to release a security update to remove the web server.

</comment></comment><comment><USER29> So what's a good open source replacement? Jitsi, Jitsi Meet, Linphone, Ekiga, Jami and a bunch of others look okay [1], but it's hard to say how easy they are to use.

[1] [https://en.wikipedia.org/wiki/Comparison_of_VoIP_software](https://en.wikipedia.org/wiki/Comparison_of_VoIP_software)

<comment><USER30> I've used Jitsi Meet with ordinary (that is, non-IT) people without trouble.I've also recommended it to elementary school teachers, who have been happy with it. It works with desktop browser, on mobile it offers a minimal app installation. Self-hosting is quite easy with their apt repo.

</comment></comment><comment><USER31> As they should, since they're subject to ITAR regulations, and ITAR is not a joke.

<comment><USER32> Came to say the same thing. Zoom is impossible if you are considered part of the DoD supply chain. Most of the public products are untenable if you need to talk about ITAR projects or about anything considered CUI.

<comment><USER33> Even if they weren't supplying the DoD with anything, rocket technology is missile technology. (Granted, liquid fueled ICBMs are old-school, but they'd nevertheless still be under ITAR even if they took no government contracts.)

</comment></comment></comment><comment><USER34> Guys, I'm starting to think this company isn't worth a P/E ratio of 1600.

<comment><USER35> I'm surprised by the concerns raised by the HN commenters. When Zoom filed their S1, HN was nothing but complimentary about their product and business model.

The time to pull out might be after their next quarterly report.

</comment></comment><comment><USER36> Spacex is a targeted environment. It's smart for them to not use such a service. Many years back it was getting hardware shipments intercepted and bugged. A company was spun out of just dealing with the amount of attempts to root Elons devices.

<comment><USER37> Which company?

<comment><USER38> Many claims. Not enough sources.

</comment></comment></comment><comment><USER39> I have to agree that Zoom just doesn't seem to care very much about privacy or security. Once? Sure, maybe an honest mistake. But, come on.

Also, I have been enjoying this: [https://github.com/arkadiyt/zoom- redirector](https://github.com/arkadiyt/zoom-redirector) which highlights how optional the use of the native client is.

</comment><comment><USER40> SpaceX is strategic national defense, so this makes sense. I expect many similar companies to follow suit.

<comment><USER41> Seems like any organization under ITAR should prefer in-house solutions in areas relating to dissemination of sensitive design notes.

<comment><USER42> "In house (software)" is usually synonyms with "not properly tested or secured"... I'd generally rather they relied on third party code audited by the nations security services.

<comment><USER43> Rather than "NIH" solutions, I think that such businesses commonly choose products that can be hosted on premise.

There's also MS Government Cloud: [https://azure.microsoft.com/en-us/global- infrastructure/gove...](https://azure.microsoft.com/en-us/global- infrastructure/government/dod/)

</comment></comment></comment></comment><comment><USER44> Zoom's hidden doctrine "convenience over privacy" works really well. They assume their user wouldn't care too much about security and privacy, and sadly, for the vast majority, they assumed correct.

</comment><comment><USER45> To those saying SpaceX is subject to ITAR and defence standards, what does that say for anyone in healthcare, finance, California or Europe?

Zoom is looking like it's closer to Discord than Slack.

<comment><USER46> Zoom and Slack are both FedRamp authorized for government use. Zoom is even authorized Moderate, while Slack is still being audited for that rating.

[https://marketplace.fedramp.gov/#/product/zoom-for- governmen...](https://marketplace.fedramp.gov/#/product/zoom-for-government) [https://marketplace.fedramp.gov/#/product/slack](https://marketplace.fedramp.gov/#/product/slack)

<comment><USER32> You don't get zoom's government platform by default, you have to ask for it and I'll bet it has different pricing. I suspect you also lose some features, like recording (at least at the server). I haven't checked Zoom but other FedRamp products I've seen are 3x the price of the standard offering.

<comment><USER47> FedRAMP moderate doesn't require an isolated, US citizen-only-staffed, environment. Only FedrAMP High requires that, so they can still be on shared infra for moderate.

</comment></comment></comment></comment><comment><USER48> It was clear from Zoom's security vulnerability last year that they value ease-of-use over security, so it seems obvious to me they wouldn't care about privacy.

</comment><comment><USER49> Setting up Jitsi on a very basic Linux VM is super easy. I know, because I am terrible at server setup and even I was able to do it in a couple of hours this morning.

<comment><USER50> Yes, but what do you know about its security?

<comment><USER49> Well, it's my own server, and the code is open source, so... pretty trivial to verify.

<comment><USER51> > _and the code is open source, so... pretty trivial to verify._

* laughs in Heartbleed _

</comment></comment></comment></comment><comment><USER52> I've found Hangouts to be equal in call quality to Zoom, and it runs entirely in the web browser. The only down side is it consumes a LOT of power, so you need to stay plugged in while you use it.

<comment><USER53> Also can't have too many attendees

<comment><USER52> You can have 200, and you can also live-stream large meetings. It is a bit weird that you have to split the stream, but it's worked great for us doing ~300 person all-hands meetings.

<comment><USER54> Google Meet also works well if you have G Suite: [https://gsuite.google.com/products/meet/](https://gsuite.google.com/products/meet/)

</comment></comment></comment></comment><comment><USER55> I'm not Zooming, but everyone I know is, and it looks pretty damn slick and seems to work great. I can't think of any service that has had as fast and huge an adoption, which is obviously due to blind luck/things beyond their control (no one saw global apocalypse coming and hoping for such would be a horrible business plan).

Of course there's been other services working just as well or better for at least 10 years now. Interesting things converged suddenly on Zoom. I guess full cross-platform support was the key? Also interesting is the deluge of anti-zoom articles that are blanketing the cybersphere :-) just as they are getting traction. Jealous rivals? Disgruntled lovers?

<comment><USER56> Zoom is the deluge du jour (literally—today has been the day of Zoom deluge complaints), but Occam called and wanted to let us know that we don't need any sinister explanations. It's obviously (or at least, explicable) as an effect of the covid crisis.

[https://news.ycombinator.com/item?id=22754135](https://news.ycombinator.com/item?id=22754135)

[https://news.ycombinator.com/item?id=22751116](https://news.ycombinator.com/item?id=22751116)

<comment><USER55> Thanks, that "black hole story" is a really useful and compelling metaphor.

</comment></comment></comment><comment><USER57> Has anyone noticed how hard some late-night-US-TV-shows are pushing (advertising) Zoom? Stephen Colber, Seth Meyers... Zoom is spending big $$$$ to advertise. While competition (WebEx for example) has been silently killing it. I feel that Zoom wants to be "the new cool kid" in town for which nobody knows anything about.. and while we do learn it looks that it's got some shady practices (as we discuss here).

</comment><comment><USER58> I use MS Teams in my company, seems to work very well, great quality video, I'm don't fully understand the security issues with Zoom, so I'm curious, does anyone know how MS Teams compares to Zoom?? The school my kids go to (in Portugal) also use Teams, for online learning, seems to be working well for them now. (Europe had issues a few weeks ago with Teams, when most of the schools first closed)

<comment><USER59> I believe...

MS Teams is better but you have to pay for it (and maybe it's complex to implement too).

Zoom is free (and supports large numbers of participants which other free alternatives don't). Also meetings can be setup with about 4 mouse clicks by the user himself with no other kit than a browser in Zoom. Getting your art department home workers to correctly

It has been weird watching people insist we use zoom because it supports so many users, when there are only three of us actually in a meeting. So the cynic in my suspects it's being used by (say) schools and universities (as the Skype limit was 32 people, now 50). And other people have assumed it's better since Harvard\Cambridge use it, so now they use it for 4 people...

<comment><USER58> Thanks - Teams is surprisingly easy (for a Microsoft product) to set up a glitch free video conference call. I was curious how secure it is? Its free with an Office 365 subscription and they are quite cheap, office is pretty much essential for most businesses, I think schools get it very cheap or even for free.

</comment></comment></comment><comment> W-Stool I've never heard of the Zoom app until about three weeks ago and now I'm reading something about it here on HN almost every day. Why is this company and their app suddenly so popular and so critiqued? I thought the world was Skype, FaceTime, WebEx, that whole cluster of technologies and related applications. Why are the Zoom folks suddenly on the front page everywher?

<comment><USER60> WebEx is terrible, FaceTime is Apple-only, Skype is circling the drain since being bought by Microsoft, so there is a lot of pent-up demand for a good cross-platform videoconferencing tool. Zoom is one of the front-runners.

There is a good overview of the options in an article recently posted here - see under "Videoconferencing":

[https://apenwarr.ca/log/20200309](https://apenwarr.ca/log/20200309)

</comment></comment><comment><USER61> Being the Linux geek, I use MS Teams. I even use it with its Linux client, and works astonishingly well.

My only 2 grievances with it are:

1\. Teams steals focus to make the next message on a group, rather than in the threat ALL THE TIME. Ive been there for a dozen comments because Teams stole cursor focus.

2\. Its easy to make an invite to a one-shot room, rather than use an existing room. Doing so loses all history and provenance and discussion. And there's no "merge this room with the real place" when that happens.

But all in all, Ive been on 130+ person calls with no issue. Works very well, aside those issues above.

<comment><USER62> I have to use MS Teams and hate it.

The fact that I lived with the bug described in [https://news.ycombinator.com/item?id=22741348](https://news.ycombinator.com/item?id=22741348) for a long time with no idea how to fix it didn't help.

</comment></comment><comment><USER63> "Please use email, text [...]" as an alternative with concern over privacy?

</comment><comment><USER64> Why ppl are so obsessed with e2e as a de-facto synonym for security?

Another question, why ppl who so care about security keep relying marketing stuff rather than using open-source solution?

</comment><comment><USER65> Remember the movie Antitrust, where Bill Gates type character played by Tim Robbins records everyones computer screens to steal secrets? Thats Zoom for you, minus the murders.

</comment><comment><USER66> Think of the poor engineers working to roll out some form of legit end-to-end protocol while this blows up in management's face. Godspeed.

</comment><comment><USER67> I'm completely out of the loop with Zoom. What's so great about this compared to Google Meet for instance?

</comment><comment><USER68> So what video conferencing solution do they use instead?

</comment><comment><USER69> They also don't use AWS.

<comment><USER70> Pretty definitive statement there. Source?

<comment><USER69> Can't seem to find it right now :/ sorry.

<comment><USER71> Plausible though, considering Musk's fundamentalist tone

<comment><USER42> And the amount of classified material they handle, and the fact that Jeff Bezos is a direct competitor so Amazon is very very closely affiliated with a direct competitor.

<comment><USER72> So, SpaceX.com at least uses an IP address owned by Amazon: [https://www.abuseipdb.com/whois/18.104.22.168](https://www.abuseipdb.com/whois/188.8.131.52)

      slenk@Enterprise:~$ host spacex.com
      spacex.com has address 184.108.40.206
      [output truncated]

<comment><USER13> Well, there is no security problem to host a public web site on e.g. AWS. I think the restrictions more affect internal, confidential data.

<comment><USER72> You're probably right. Just proving that broad blanket statement wrong

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER73> Good, the less we use Zoom the better. Even facebook Messenger is more secure.

<comment><USER74> Would you suggest organisational video conference meetings of e.g. 25-100 people over Messenger...? There is a niche Zoom is occupying very well.

<comment><USER73> It's more of a "trusting" facebook transparency vs if Messenger has the same solution that Zoom fits in.

Meanwhile, it's 2020. Didn't think video conferencing was such a big deal.

</comment></comment></comment><comment><USER75> I really really wish Apple would build a replacement for zoom, that is available on as many devices as zoom is.

This is a matter of national issue. This rush to remote is not something that will go away completely.

I think many security minded people are not comfortable with zoom, but have to use it.

Please Apple, build something that can replace zoom.

</comment><comment><USER76> This is a knee-jerk reaction. Zoom was indirectly sending information to Facebook as part of their Facebook SDK integration to enable login, not directly as part of explicit information gathering. Any app that integrates with the Facebook SDK does this, and they've also patched it already [1].

The supposed root exploit found in Zoom also requires physical, logged-in access to the machine, at which point a Zoom exploit is the least of your problems [2].

Zoom is a solid piece of software, and the developers are responsive and seem to care. I'm disappointed to see it getting dumped on during the past few days. A cynic might even suspect a co-ordinated campaign by Cisco, considering Zoom was started by frustrated ex-Cisco employees and has had runaway growth during the viral crisis, while the same cannot be said for Cisco's competitor product WebEx.

[1] [https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of- facebo...](https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk- in-ios-client/)

[2] [https://9to5mac.com/2020/04/01/new-zoom-bugs-takeover- macs-c...](https://9to5mac.com/2020/04/01/new-zoom-bugs-takeover-macs-cam-mic- root/)

<comment><USER77> > Zoom is a solid piece of software, and the developers are responsive and > seem to care.

The dodgy things they've been doing suggest otherwise.

* Hijacking package preflight script rather than standard package installation mechanism, so their software is installed before the user clicks Install.

* Installing a hidden web server without user consent.

<comment><USER78> That's more about management decisions and unethical developers. It still could be a solid software despite those issues.

<comment><USER79> Does it matter which part of Zoom is causing the issue? It ends up making it shady either way.

</comment></comment></comment></comment><comment><USER80> The rumor that I've heard is that the "security and privacy concerns" are that Boeing has somehow gotten access to their Zoom. I don't know what that means, exactly, but it's at least somewhat more rational than being concerned that facebook is siphoning up the data.

<comment><USER81> Where did you hear this rumor?

<comment><USER50> I'd like to know that too. Worthy of a downvote until substantiated.</comment></comment></comment>


Dolphin Progress Report: August 2016 - <AUTHOR> https://dolphin-emu.org/blog/2016/09/01/dolphin-progress-report-august-2016/ <comment><USER2> The "allowing texture samples from 0x0" fix is really an interesting read. Makes perfect sense if you think about it - it should always work just fine on the console. Terribly poor readability for the code though.

<comment><USER3> But it still leaves you puzzled, why on earth would you load a texture from 0x0???

<comment><USER4> It's a simple constant that you just happened to know won't hold values that are considered transparent and is always loaded?

<comment><USER5> More like it's a bug that worked on the real console so they didn't ever notice it.

<comment><USER6> Yeah this seems like null pointer dereference that happened to work fine so it was never found.

<comment><USER7> Well, and that NULL was a valid memory location on this platform. It's actually quite nice to have virtual memory with NULL unmapped!

<comment><USER8> NULL is actually only a valid memory location from the view of the GPU on this platform, not the CPU, and yeah, this is very likely to simply be an uncaught bug.

Traditional game console architectures don't usually have a lot of memory protection for the GPU - in fact, both the 360 and the 3DS were at various points in times hacked by subverting the GPU to do writes to global memory.

<comment><USER9> This is going back a few years now, but I'm pretty sure NULL was valid to read from the Wii's CPU (though not write, I don't think).

It was where the product code was stored, as I recall - so every now and again you'd find some junk in some random string, starting with your title's product code, and it would be time to track down another missing NULL check...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> This is the quote any emulator dev should write on top of its desk:

> <the emulator> should never, ever trust the software it is running to be > sane.

Console games always does weird things the only way to check is real hardware, that's why writing a good emulator is hard, because you must have a way to quickly test a particular behavior on hardware.

<comment><USER11> We like to romanticize our favorite games as being written by people as passionate as we are about said games.

But the reality is that most (though certainly not all!!) of them are primarily there for a paycheck. They're expected to work on new systems with poor debugging capabilities, and get games out as fast as possible. So naturally, they end up having lots of gross hacks and erroneous code just to get things working and ship the game.

My favorite bug so far was a game that read from a write-only register in a loop until a certain bit was set. That bit could never have been set under normal conditions, so it was freezing in emulators. Turns out that the game had a DMA channel running during each scanline, and after a few million iterations of the loop, the stars would align and the DMA channel would read a byte from memory that had the required bit set, and that value would be floating on the bus, followed immediately by reading from said undefined memory location. Since nothing would respond to it, it would reuse that DMA byte fetch, and exit the loop.

Even more fun, to test on real hardware, I was using a copier device. But said copier device pulled the data bus lines low whenever an unmapped region was accessed, which effectively broke the game on the copier as well. It took me two weeks of full-time work to track down that bug and exhaust all other possibilities for what was happening.

I can't begin to imagine why that loop was in the shipped game, nor why it only ever triggered once during hitting one of many buttons (this one required to finish the level), in stage 6-2 of the game.

<comment> ryanplant-au I'm going to have nightmares after reading that. I don't know you do it.

</comment></comment></comment><comment><USER12> I've never heard of this project - very interesting. I wonder if this will start to happen more frequently in the near future.. software simply being to old to really manage and keep updating to run on current operating systems.

I'm also always amazed at the hardware reqs for emulators. They suggest at least an i5 or i7 and recommend a dedicated gpu! For a gamecube! Released 15 years ago!

<comment><USER13> Not surprised at the system requirements- it has to emulate a 486 MHz PowerPC CPU. I have no idea why it would require a discrete GPU though. It only needs to output SD-quality video. Maybe shader performance is a limiting factor in the GPU emulations?

<comment><USER11> > Not surprised at the system requirements- it has to emulate a 486 MHz > PowerPC CPU.

Yeah, to anyone who has tried to optimize a CPU interpreter before; dynamic recompilers are nothing short of magical.

You'd be quite talented to emulate just a 50 MIPS interpreter core from a sufficiently awkward CPU at 100% speed on modern processors. Let alone all the other parts of the emulator, and synchronization between components.

Of course, dynamic recompilers sacrifice huge amounts of synchronization precision in return for that raw speed. But it's very much a necessary evil -- otherwise we wouldn't have playable modern emulators at all. The developers of dynarecs deserve extra special praise for being willing to give up both idealism _and_ portability when writing them.

<comment><USER14> If you sacrifice synchronization you can also hit some pretty good performance with an interpreter. Until fairly recently CEMU was interpreter-only and they managed to hit 100% speed in a few games. The trick: they were running 50K instructions at a time without checking external interrupts or scheduling other components. At least, that's from what I can tell from reverse engineering...

<comment><USER11> I can only see full speed on a Wii U CPU interpreter happening when the game has huge idle loops that you can skip over.

If you're saying they hit it at 100% Wii U CPU load at fullspeed, then that's really impressive! :)

</comment></comment></comment></comment></comment><comment><USER15> For those interested, the next generation Nintendo emulator, Cemu for Wii U emulation is also making rapid progress, with many games fully playable near native speeds.

[http://cemu.info/](http://cemu.info/)

Unlike Dolphin, it's currently closed source & Patreon backed though.

<comment><USER16> There's reasons to believe that Cemu is closed-source because it uses stolen code from official Nintendo SDKs.

decaf is fully open source: [https://github.com/decaf-emu/decaf- emu](https://github.com/decaf-emu/decaf-emu)

<comment><USER14> I think the claim of "using stolen code" is a bit strong. Do you have any evidence of that?

I'm completely willing to believe that they asm2c'd quite a lot of system libraries instead of properly reimplementing them. And I wouldn't be surprised if that's a prime reason why their software is not open source. But that's a step away from "stolen code" in my opinion.</comment></comment></comment>


Jeff Bezos climate change plan unveiled – buy 100k electric vans. - <AUTHOR> https://www.cnbc.com/2019/09/19/jeff-bezos-speaks-about-amazon-sustainability-in-washington-dc.html <comment><USER2> I'm glad to see that there's deliberate movement in this direction. However, it's a little dismaying that the headline is implying that we can address climate change by Consuming More Stuff; that's how we got into this mess in the first place.

<comment><USER3> Some consumption is good, i.e. replacing and old appliance or a car with a more efficient one, or you can buy a video game on Steam rather than driving to a picnic. It is not always apparent what behaviour is the most energy- wasteful. For example airplanes emit tons of CO2, but if the same 300 people in a plane drove the same distance it could be much worse.

Advanced economies have grown their GDPs, but have also reduced their emissions since about 1990.

The best policies to counter climate change like carbon taxes and schemes like cap and trade, which align people's incentives to emit less, but also don't damage the potential for growth and consumption as much.

<comment><USER4> > For example airplanes emit tons of CO2, but if the same 300 people in a > plane drove the same distance it could be much worse.

Technically true, however airplanes provoke a rebound effect. By making travel so efficient and fast, it makes people travel more. If airplanes didn't exist all people would simply travel less, not drive more.

<comment><USER5> And not to be pedantic, but when the above poster said "or you can buy a video game on Steam rather than driving to a picnic", that discounts the amount of times the game developers had to drive to work to create said game. As well, replacing an old appliance or car isn't a straight-forward net savings, you need to take into account the materials harvested and factories that need to be built to produce those new items.

<comment><USER6> The average game on Steam sells 32000 copies. It takes some seriously poluting developer to offset the picnic of thousands of people.

Also (pedantic but you started it), the society we currently live in is based around work. So if games weren't being developed it is more likely the developers would still travel to work.

<comment><USER7> That's only if you cut out games. An overall lifestyle change of much less consumption would slash jobs.

</comment></comment></comment></comment></comment></comment><comment><USER8> This is a big deal because it increases the critical mass towards electrification of transportation, even moreso than the carbon offset by the vans. Right now early adopters are okay with ChargePoint and tolerating some uncertainty with the next charge, but we need 1) more renewable grid input and 2) much more "refueling" infrastructure (public 40 and 80 amp charging).

<comment><USER9> Amazon clearly wants Rivian to succeed: [https://www.cnbc.com/2019/02/15/rivian- announces-700-million...](https://www.cnbc.com/2019/02/15/rivian- announces-700-million-investment-round-led-by-amazon.html)

:-)

<comment><USER8> And that is fine, in my opinion. I don't think it's self dealing. If you think climate change is an urgent issue, you fund solutions. When you fund solutions, you choose the best option. When you're ready to act on it, you choose the best option.

<comment><USER10> Well, it's not as if there are 100k electric vans ready for purchase, Rivian needs their investment and their orders to scale up to 100k. Amazon's creating its own demand and supply here.

<comment><USER8> Yup. Just comes with the territory of the scale they are operating at. Looking at Renault Kangaroo ZE and Nissan e NV200 sales its possible 100k electrics vans is more than have ever been produced, cumulatively, period.

</comment></comment></comment></comment></comment><comment><USER11> While I applaud any move towards decreasing negative impacts our our environment, I also encourage people to take advantage of Amazon's option to pick a delivery day and get all your stuff at once.

Even without that option, Amazon has some work to do on their route planning - I should never need 3 different deliveries from 3 different drivers on the same day, and that has occurred at my house.

<comment><USER12> Consider this: shipping is free for you. Sending more trucks to deliver packages many times per day is annoying for you, but it's _expensive_ for Amazon.

That's a huge incentive to do that as rarely as possible.

</comment></comment><comment><USER13> How can you meet Paris commitments early when you are working on helping oil & gas companies extract fossil fuels from the ground even faster?

[https://aws.amazon.com/oil-and-gas/](https://aws.amazon.com/oil-and-gas/)

</comment><comment><USER14> > Bezos said the first electric delivery vans will be on the road by 2021

I strongly doubt this will happen. Their truck still isn't in production and they haven't even built a concept van yet. The chances of them producing vans in two years is very low.

<comment><USER15> I thought this about a year ago when they came out of stealth, however; Rivian has all the magic in their sleeves. 1: They actually did the work, the prototype trucks are rather far in development for their announcement. Seemingly they are almost R&D-complete. This is different from most other EV startups like FF or Lucid as they pretty much just showed off mockups.

2, and this is what really matters:

They got major investments from established ICE manufacturers (Huge investment from Ford) with agreements to cooperate on building the factory and making products together. This is the real barrier to entry on EV startups and they executed on it by spending years figuring out the powertrain issue and then going off and getting help by those with the institutional knowledge on manufacturing them. This is why I think they will win.

3: It's a van, a skateboard with a metal box on top, likely borrowing heavily from already developed designs. Note that the van appears largely production ready lacking all the normal concept drawing details and lacking any form of wild 'FUTURE!!' details. Boring Ford van mirrors, standard marker lights, correct size tires and rims. This is a production-ready design, not a concept- car, that likely makes use of the Ford production machine for all the little bits. Think of it like building an app with Angular or React, they know what they want to do and what they want to use other sources for.

<comment><USER16> I appreciate the optimism and hope you are right but there is plenty of talk/hype in this space and there are not many EVs that are not compliance cars actually in production in the US.

</comment></comment></comment><comment><USER17> >delivery vans from vehicle manufacturer Rivian

is Rivian really a vehicle manufacturer? or a startup? I though you have to actually manufacture something to be called manufacturer.

<comment><USER18> They already have their Truck and SUV on display at the motor shows, 0-60 in 3 seconds, towing 7700 lbs, 700hp, 400 mile range. They said shipping in 2020. But I dont see any mention of vans on their website.

Amazon is a financial backer of Rivian, so this makes sense.

<comment><USER14> They've been showing the truck for years. It's still vaporware. They've yet to build a single production vehicle.

</comment></comment></comment><comment><USER19> The shareholder proposal may have been defeated, but this is a sign to me that it _worked_ to bring this problem to the forefront of Amazon's agenda. This is a good thing.

</comment><comment><USER20> Wow talk about win-win. Amazon gets electric vans and Rivian gets ~$10B in expected revenue, which increases the value of Amazon's stake in Rivian.

<comment><USER21> Also, Amazon gets to pay fewer taxes due to accrual...

</comment></comment><comment><USER22> we can't "electric van" our way out of the climate crisis because it makes too little of a dent over too long of a timescale. bezos' plan is far too weak to even be worth media coverage.

mediocre quarter-measure plans like this one will keep us moving at full steam towards catastrophe. if bezos wanted to put a dent in climate change genuinely, he'd take the path of least resistance: subsidize a meaty discount on goods that emit the least CO2 during their production and use as measured by a third party authority. this would create a virtuous economic cycle of manufacturers competing for lower emissions.

instead, he's found a way to accomplish little other than self-enrichment while appearing to make an effort. well, bravo. bezos is well on the way to being the richest man on an uninhabitable rock of a planet.

<comment><USER23> He also stated the goal is to be carbon neutral by 2040, that's a solid goal. So it goes beyond the vans.

</comment></comment><comment><USER24> AWS profits something like a million dollars an hour so it's pretty unambitious to need 11 years to make AWS be fully green. $100+ billion in profit will accrue from AWS in that time. It doesn't take 11 years to claw back 1900 workers' health care.

</comment><comment><USER25> Yet another plan. Great. When will we finally start seeing media reports on actual emission reductions? In 2020 I want to read "Amazon has reduced its total emissions by 5% compared to 2019".

<comment><USER26> The most upvoted comment on HN would be how this 5% reduction is just meaningless marketing, probably because Amazon will have increased sales by X%, meaning the products delivered maybe had a higher carbon footprint.

</comment></comment><comment><USER27> I'm rooting for Rivian, if they make a true small SUV after their initial R1S launch I'd be all over it.

</comment><comment><USER28> These will be mostly Rivian pick up trucks. Kinda smart move. $700 million investment will help Amazon.

</comment><comment><USER29> For cities it would make sense to deliver packages to neighborhood hubs in vans and from there deliver them using cargo bikes to the recipients. That would probably safe more energy, but cost a bit more as a bicycle worker can transport fewer packages per day.

</comment><comment><USER30> What about the strain on the environment from sourcing and disposing batteries for these vans?

<comment><USER23> Because dirty diesel has no ill effects?

<comment><USER30> Did I say that? I'm wonder if sourcing and disposing batteries on a mass scale will be any better than burning fuel.

</comment></comment></comment><comment><USER31> Is there any chance this will make Rivian Trucks cheaper? I really want one.

<comment><USER32> The company has been around for 10 years without shipping a product. To me the bigger question is whether you'll _ever_ be able to buy one. By contrast, Tesla started in 2003 and shipped the Roadster in 2008 and the Model S in 2012.

<comment><USER15> Counter point: They have major investment and signed contracts from real manufacturers like Ford (which is the real issue with starting an EV company, sure you can design an electric truck but can you build them?) The fact of the matter is that they now have the tech, solid R&Ded designs and the best people on earth to help them make them, this is not what any other company has ever had at EV manufacturing, not even Tesla.

</comment></comment></comment><comment><USER33> Where I live UPS trucks have been plug-in hybrid for years now. They are powered entirely by battery when driving slowly through neighborhoods. So I'm not sure how much difference this would _really_ make.

</comment><comment><USER34> as expected, sections of the bourgeoisie are trying to barely solve CO2 pollution while continuing to maximize every other kind of resource consumption and concomitant non-CO2 pollution. or at least, pretend that they are trying to solve it. either way they will run into the concerted resistance of the bourgeoisie who depend on CO2 pollution as a business model, and who are extremely powerful.

the alternative to this shitshow is to democratically plan resource investment, and get away from the insanity of a road-and-small-vehicle-based city system (aka, establish socialism). I'm optimistic we'll get there after the youth watch rich people vacillate over climate change for a few more years :)

<comment><USER35> Because every place that did implement socialism did SUCH a great job of preventing pollution and protecting nature!

As they say, the only thing History teaches us is that History teaches us nothing.

</comment></comment><comment><USER36> this is awesome and makes a lot of business sense (Amazon is an investor in Rivian). kudos to Amazon!</comment>