Vulnerability of Speculative Processors to Cache Timing Side-Channel Mechanism - <AUTHOR> https://developer.arm.com/support/security-update <comment><USER2> Almost as disgusting as Intel's response.

> _" It is important to note that this method is dependent on malware running > locally which means it's imperative for users to practice good security > hygiene by keeping their software up-to-date and avoid suspicious links or > downloads."_

If you're running something on your ARM CPU, it's _running locally_!, they're using careful language to make the problem seem to impact them less than it does and lay the blame on the user.

This affects a huge number of processors out there, not just in phones and tablets but in embedded, industrial and network devices - many of which will never seem workarounds from their OS / software for the hardware fault.

Also OH: _" The bug doesn't happen if you don't use our product"_

<comment><USER3> Their response makes perfect sense and is a careful contrast to the "everything is broken" hysteria from the other side. This isn't like Heartbleed or a remote code execution vulnerability --- the attacker _has to be able to run very specific code on the processor_ in order to exploit anything. Thus they are basically saying "you're fine if you don't run untrusted code" \--- something which bears repeating since it is the only positive thing in this whole debacle.

 _but in embedded, industrial and network devices - many of which will never seem workarounds from their OS / software for the hardware fault._

...many of which won't ever run anything but the original firmware they came with from the factory anyway, making it a somewhat moot point (and if there are exploits that lead to remote code execution, chances are there are better things for an attacker to go after than try to exploit a timing side-channel.)

The ones most affected by this are cloud providers and other scenarios where multiple mutually untrusting users are sharing the same hardware on which they can run arbitrary code.

The ones least affected (i.e. not at all) are isolated single-user/single- purpose machines running trusted code. This includes the majority of embedded systems, which is presumably why ARM is emphasising the point so much compared to Intel or AMD.

<comment><USER4> > Thus they are basically saying "you're fine if you don't run untrusted code" > \--- something which bears repeating since it is the only positive thing in > this whole debacle.

Except for that whole web thing that has most of the world running untrusted code just about every minute of every day. Security hygiene doesn't protect you from this.

<comment><USER3> _Except for that whole web thing that has most of the world running untrusted code just about every minute of every day_

Certainly those who e.g. have JS off by default are currently in the minority, but perhaps this will be the defining event that causes everyone else to think more deeply about letting untrusted code run, regardless of how sandboxed it is.

Things like TEMPEST[1] have shown for many years that side-channel attacks are extremely difficult to defend against, even for an attacker who is merely in proximity to the hardware and can't influence it at all; nevermind running code directly on it. It was only a matter of time. A lot of malware researchers already don't trust VMs and use separate physical hardware, precisely because of these risks of sharing trusted and untrusted code on the same hardware.

[1] [https://en.wikipedia.org/wiki/TEMPEST](https://en.wikipedia.org/wiki/TEMPEST)

<comment><USER5> There's not a single program that i trust. Not even the programs I've written myself; even taken all reasonable precautions, it's far too easy to introduce a vulnerability.

There are programs that I choose to run with escalated privileges, like the operating system, out of necessity.

If I can't run untrusted code; I simply can't compute. It's the main thing hardware is designed to do.

<comment><USER6> For instance, even if you read your compiler's source code and then compile it, there's no way to know that the compilation process didn't insert a back door, as in this classic essay: [https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp...](https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf)

</comment></comment></comment></comment></comment></comment><comment><USER7> Maybe it's just because this is a more technical update, but the responses from Intel[1] and AMD really seem like night and day to me. This page is for the most part clearly written and only has a minimal amount of BS before getting to the point about:

• identifying the problems (without casting aspersions on other vendors or being FUD-y about issues that don't exist)

• specifying what _specific_ hardware is vulnerable

• info for developers (here's the patches you need if you're building your own kernel, here's a new compiler intrinsic that will be available soon for your applications, here [2] is code to implement the intrinsic yourself if you're not able to update your compiler)

• slightly less useful info for end users (update your stuff, which isn't necessarily actionable advice for some of us on Android)

• lets us know that future hardware may still require the KPTI patches, but it sounds like the speculative execution issues that aren't fixed by the patches ("variant 1") will be fixed in hardware

Things that still aren't great:

• no mention of performance impact of their various mitigation strategies that surely someone would have benchmarked in the 6 months they've been working on this. However I'm sure before too much longer someone will grab that code from their github and compare it to regular memory accesses

• this FAQ purporting to be in layman's terms definitely isn't [3]. Imagine telling your elderly relative that saw an article about scary computer bugs in the New York Times that the problem is just a "novel use of an existing side- channel technique" to "access data from privileged memory (DRAM or CPU cache)."

[1] [https://newsroom.intel.com/news/intel-responds-to- security-r...](https://newsroom.intel.com/news/intel-responds-to-security- research-findings/)

[2] [https://github.com/ARM-software/speculation- barrier/blob/mas...](https://github.com/ARM-software/speculation- barrier/blob/master/speculation_barrier.h)

[3] [https://developer.arm.com/support/security- update/frequently...](https://developer.arm.com/support/security- update/frequently-asked-questions)

<comment><USER8> Nitpick: This is Arm's press release, not AMD's.

</comment></comment><comment><USER9> > However, this side-channel mechanism could enable someone to potentially > extract some information that otherwise would not be accessible to software > from processors that are performing as designed and not based on a flaw or > bug.

I'm having trouble parsing this bit of lawyer speak.

In the prior sentence they say nothing is new. Then in this sentence, they are saying that there _is_ something new. I'd say "potentially extract information that would not be accessible" as definitely not "performing as designed" _unless_ it were "based on a flaw or bug." That is, if you take security seriously. I mean, how could it not be? Are you saying that this attack is by design?

Is... is this an NSA canary? Did you guys just admit that this is not a flaw by design? Blink once if the men in black are listening, twice if they know we know they are listening.

<comment><USER10> To be honest, they're saying two things which are both simultaneously true:

* you can access information that, by design, the processor would ordinarily prevent access to * the fault is not a flaw or bug, but inherent in the design of the processor

The intent of the design was to keep the information secure, and the features of the design to do that are working as intended. Other features of the design, intended to increase performance, are also working correctly, but turn out to leak information in certain circumstances.

There's no clear analogy in the physical world I can think of, but I don't think this is weasel-speak. Exfiltration of data accidentally through a side- channel, like here, is very difficult to design against.

<comment><USER11> "We succeeded on the design of it, but failed on the security goal."

</comment></comment></comment><comment><USER12> > However, this side-channel mechanism could enable someone to potentially > extract some information that otherwise would not be accessible to software > from processors that are performing as designed and not based on a flaw or > bug.

"performing as designed and not based on a flaw or bug"

I have no words...

</comment><comment><USER13> White paper direct link as the site seems to be under heavy load: [https://developer.arm.com/-/media/Files/pdf/Cache_Speculatio...](https://developer.arm.com/-/media/Files/pdf/Cache_Speculation_Side- channels.pdf?revision=966364ce-10aa-4580-8431-7e4ed42fb90b&la=en)

</comment><comment><USER14> > All future Arm Cortex processors will be resilient to this style of attack > or allow mitigation through kernel patches.

Lol, 'we may or may not fix our HDL.'

</comment><comment><USER15> 2018 is off to a great start.

<comment><USER16> Especially for Google's Project Zero.

<comment><USER17> Project Zero AKA Google is probably a better choice than "Tailored Access" guys at the NSA or their Russian or Chinese equivalents.

</comment></comment></comment><comment><USER18> Oof. The Cortex-A75 has a hardware security bug _before any silicon with it has been released_. On the other hand, this luckily means that software mitigations can be included before release.

Luckily for most unpatched Android phones, they use Cortex A53 and Cortex A7 in-order chips which are not affected because they lack the speculative execution required for this vulnerability.

<comment><USER19> Cortex A53 certainly have speculative execution because they have branch predictors. The branch predictor of the A53 is probably the most sophisticated thing about it and other in-order ARM cores like the A8 are vulnerable. But apparently something about the A53 design prevents speculating of indirect loads making them safe.

<comment><USER20> Speculative execution in computer architecture terminology is reserved for speculating past branches.

<comment><USER19> Yes, and the A53 speculatively executes past branches, otherwise there's little point in having a branch predictor. The difference between it and an out of order processor is that the depth of speculation is limited by the pipeline length rather than the reorder buffer.

EDIT: The pipeline layout severely constrains what sort of speculation can happen and, thinking about it more, I'm really surprised that the A8 can finish load and issue a second one before the mis-speculated branch is resolved and the loads are quashed.

EDIT2: Well, that's not the only difference obviously. The big one that makes a processor in order versus out of order is whether a stalled instruction causes all subsequent instructions in the stream to stall or just ones with data dependencies on it. But the problem of quashing bad instructions is shared by all processors that are pipelined and which can throw exceptions, not just those that continue speculatively issuing past predicted branches.

<comment><USER20> I'm not familiar with the A53, maybe it is some kind of hybrid, but certainly there are branch predictors in pipelined in-order superscalar processors that don't speculate past branches, like Pentium or 21064. The advantage is that a correctly predicted branch can be executed quickly and the following instruction can be fetched & decoded. This doesn't yet require register renaming, reservation stations etc.

<comment><USER19> I think we have a conflict of definition? I would call instruction fetch and decode behind an unresolved branch speculation. If you have a machine with a single execution stage which can't issue instructions in parallel with the branch then of course you can't have these speculated instructions execute because whether they are valid will always be resolved before they get to the execution or writeback stages. But the mechanics of putting instructions into the pipeline on the basis of speculation and quashing them if the branch resolves differently than predicted is the same and re-use the same hardware mechanisms that handle exceptions, making the speculative issuing of instructions a clear win from a design perspective. It's the details of the pipeline that determine whether it's possible to trigger the Spectre vulnerability before the branch resolves.

Register renaming isn't required for speculation and you can even design out of order micro architectures without it. On an in-order processor you just have to make sure that writeback occurs after the branch is resolved and just flush the pipeline above the branch if the branch resolves incorrectly. No need to mess about with checkpoints because the register state is always valid. Well, there are some considerations with store commands too if you're using superscalar execution but it's still pretty easy. But again, these are all mechanisms you need in any event because your processor has to deal with interrupts that might be thrown at any moment by external triggers or memory faults.

EDIT: I suppose it's possible in theory that you could look at an upcoming branch, predict how it will resolve, and then fetch the relevant instruction data into your instruction cache. But I'd tend to call that an instruction pre-fetcher by analogy to the data pre-fetcher eveyone uses rather than a branch predictor. And I'm not aware of anyone every having done that.

<comment><USER20> Here's the 1997 Intel optimization manual: [https://www.ece.cmu.edu/~ece548/localcpy/24281603.pdf](https://www.ece.cmu.edu/~ece548/localcpy/24281603.pdf)

In 2.1.3, that pertains to the original Pentium processor, it describes how the predicted branch target instruction is fetched.

This is not commonly considered speculative execution in computer architecture terminology.

In 3.2.1 it describes how on later OoO processors the fetched instructions are speculatively executed.

Here in the description of the 21064, another in-order processor, the pipeline is described (under "Conditional-Branch Pipeline Flow") as potentially taking zero cycles for correctly prediced branches, meaning that the instruction decode is also pipelined: [http://collaboration.cmc.ec.gc.ca/science/rpn/biblio/ddj/Web...](http://collaboration.cmc.ec.gc.ca/science/rpn/biblio/ddj/Website/articles/DDJ/1995/9516/9516c/9516c.htm)

<comment><USER19> You're right, that's speculative issue rather than speculative execution. I was being sloppy in my terminology when I called it that. It is speculation, however.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> The whitepaper linked from this article introduces a new memory barrier named "CSDB". Does this work with existing ARM CPUs, and if so, how? I guess they could have always had this instruction encoding defined but just never gave it a name, but the seems a little odd.

<comment><USER22> According to the table here [1] it is a DSB (data synch barrier) instruction. I don't know if it corresponds to any of the listed valid _option_ values in [2].

[1] [http://kitoslab- eng.blogspot.nl/2012/10/armv8-aarch64-instru...](http://kitoslab- eng.blogspot.nl/2012/10/armv8-aarch64-instruction-encoding.html)

[2] [http://infocenter.arm.com/help/topic/com.arm.doc.dui0802b/CI...](http://infocenter.arm.com/help/topic/com.arm.doc.dui0802b/CIHGHHIE.html)

</comment></comment><comment><USER23> Does TrustZone mitigate this? Can the secure world be compromised via this side channel?

<comment><USER24> Your question is a bit too vague. TrustZone by itself doesn't really give you anything. For instance, by default you run everything w/ TrustZone bit set unless you do something different during boot.

In general, I would say TrustZone is not special at all (yet) in regards to immunity to side-channel attacks. See: [https://twitter.com/bryanbuckley/status/912458210191093760](https://twitter.com/bryanbuckley/status/912458210191093760) On the other hand, TZ (NS bit) was a bit special for ARM so maybe they paid more attention to it (i.e. maybe it matters greatly that addresses are tagged NS/S for the HW, unlike x86 which was not designed to consider addresses part of securable boundary between modes/rings?). Or maybe ARM still opted for speed over security, in some surprising/disappointing ways.

However, that may be a moot point if you can execute arbitrary code in SWd and if something like Spectre might leak SWd usr to SWd usr (since you could then use normal communication between the SWd/NWd)?

Of course folks will experiment and we will know in the coming months.. if a TEE vendor does not first make a comment (e.g. linaro). Also remember that the TEE folks have different OSes (some are micro-kernels that are more security- focused).

Curiously, I saw the blog post in August last year and it reminded that it was during OMAP5 bring-up that I think I sent my first ever patch to lkml, dealing with aborts being spammed (being originated via speculation; aborting because we had a region of memory dedicated for TZ). A15 had introduced a deeper branch prediction buffer, iianm.

I can't find the final patch. Hopefully my sign-off was just omitted rather than the commit living in some OMAP specific fork. My RFC patch was pretty dumb (basically I disabled speculation during early linux loading, re-enabled once "the real" page tables were ready to activate) so better programmers took the helm and I confirmed the fix..

So anyway.. at least on OMAP the hardware _seemed_ to disallow any access at all across TZ boundary, even by hardware. Then again, you can't really trust this reporting/aborting (good sign at though) and would have to verify yourself w/ some PoC attack.

And obligatory mention that The Mill seems like a better CPU arch.

</comment></comment><comment><USER25> Are Apple Ax processors affected?

Could their great performance advantage over other ARM-based be derived from a similar "check later" speculation as Intel's?

</comment><comment><USER26> The site isn't loading, and there's no google cache yet. Does anyone have a rip or mirror?

<comment><USER27> Fun fact: The website linked most probably runs on Intel CPUs as it seems to be hosted on Azure. Azure doesn't offer Ryzen VMs yet.

And here is an archived link: [http://archive.is/jVCwc](http://archive.is/jVCwc)

<comment><USER28> I wonder if we will ever see a bug dangerous enough to cause clouds to shut down so many machines that it is impossible to get the word out about a fix.</comment></comment></comment>


Yahoo's Mayer gets internal flak for more rigorous hiring - <AUTHOR> http://www.nbcnews.com/business/yahoos-mayer-gets-internal-flak-more-rigorous-hiring-1C8814659 <comment><USER2> At first I was thinking this would be an article where management was upset that they couldn't hire java jockeys anymore because of some rigorous hiring practice - but it turns out that the hiring practice in question is to require applicants to have degrees from prestigious universities.

I think this reflects well on Mayer's distrust of yahoo's HR department. Even though hiring employees from only prestigious universities is a terrible decision when it comes to getting as much good talent as possible, it's the only "solid" solution to force HR to at least be hiring candidates who might almost be good at what they're doing.

The reforms taking place in yahoo are quite interesting. Mayer's probably running under the knowledge that most of yahoo's employees aren't really good at what they do, so it's going to be very interesting to see what kind reforms she can pass so that the quality of the work produced by yahoo doesn't correlate with the quality of employees they're currently dealing with.

<comment><USER3> Not sure how the focus on prestigious degrees squares with the seven figure acqui-hire of a seventeen year old that hasn't finished his high school qualifications yet...

I'm willing to believe that _people with prestigious qualifications not seeking work at more prestigious companies_ and _startup wunderkinds_ are probably the worst talent pools for Yahoo to be trying to dredge, especially considering the wealth of smart developers who don't fit into those brackets are probably more likely to stick around.

</comment></comment><comment><USER4> Let me backseat CEO this for a second. To me, the problem with Yahoo is they're no longer relevant, they no longer have a thing people want. In the past they made their money by being the "default" they WERE the front page of the internet. You open up a browser, there's a search bar, the weather, and a bunch of fluffy reprinted news articles.

But this isn't 1996. People don't need ANY of this. If I want the weather, I have a gadget on my phone, which by the way is the first thing I look at in the morning. If I want to search I type the query into the URL bar (I use chrome) If I want news I go to reddit or hacker news. Nothing is drawing me into yahoo. Reprinted badly written blog articles do not attract me. My mom would probably read them, but doesn't know how to search for them.

Basically, having an army of the top engineers in the world isn't worth anything if they're not working on something people want to use. Yahoo needs to rethink who they are if they want to survive, they lost news, they lost search, and they lost "hosting gadgets".

<comment><USER5> > an army of the top engineers in the world isn't worth anything if they're > not working on something people want to use

Lockheed Martin's F-22 team was worth billions, and nobody wanted that plane. But yes, war profiteering aside, your point stands.

<comment><USER6> People wanted the original idea for that plane.

The really sad part is that the F-35 is such a problem, they might restart production on the F-22 to supplement the fleet of uprated older planes to make up for the F-35.

</comment></comment></comment><comment><USER7> Rejecting more people is not the same as being more rigorous. They _can be_ the same if your rejection criteria are well-chosen, but I don't have much faith in "the CEO glances at your resume." For all the problems that Yahoo! may have with recruiting talent, I have a hard time believing they can be solved by any filter process whose sole input is resumes.

<comment><USER8> Google used the same policy, and somehow I don't think you would make the same argument about them:

>Yet, after five peer interviews, a candidate is still vetted by hiring committees, and Larry Page must approve every hire.

Source: [http://www.csmonitor.com/Books/Book-Reviews/2012/0124/Are- Yo...](http://www.csmonitor.com/Books/Book-Reviews/2012/0124/Are-You-Smart- Enough-to-Work-at-Google)

</comment></comment><comment><USER9> Of course she is going to get internal flak: she's basically saying the current management is incompetent and needs to raise the bar because she can't continue to blindly trust the hiring decisions that are being made on a day to day basis.

Brutal but how else will you separate the wheat from the chaff?

<comment><USER10> By looking at their code? Testing? Hiring based on their university instead of their chops is pretty narrow minded. I would be livid if I found a great candidate but was refused the approval to hire them just because they didn't graduate from MIT or Stanford.

<comment><USER11> To be fair Google has had a similar unofficial policy for ages and it has worked well for them =)

(Not supporting it either way...a bit undecided myself)

<comment><USER12> Has it though, really?

Google's company-defining products are (in my opinion):

      Search - not relevant to hiring practices, Search came before the company
      Gmail - initial version made by Paul Buchheit -
        Case Western Reserve University in Cleveland, Ohio.
      Adsense - created by Oingo and acquired by Google
      Android - created by Danger and acquired by Google
        (Andy Rubin - Utica College, Utica, New York)
      Chrome - basically Webkit, created by KHTML project and Apple

As far as I can tell, the breakthroughs Google has had are completely unrelated to any Ivy League hiring practices.

<comment><USER13> In addition to having a few key products, a company also needs hordes of smart, hardworking and reliable people to keep things running and add incremental improvements. Top grades from a good university is a pretty good filter for "smart, hardworking and reliable."

<comment><USER11> Agreed -- it's a good filter for a higher probability of better talent (note: I say "probability" and not "guarantee") and their stock price and potential for growth speak for their human resources strategy.

</comment></comment></comment></comment></comment></comment><comment><USER14> Funny, from the title, I thought I'd read the article and end up wanting to defend all of Mayer's policy (the intent of which seems right), but then you see quotes like:

 _Job applicants often go through the interview process, then "wait and wait," said one executive who recently left Yahoo. "One person we wanted waited eight weeks, then they inevitably got another offer."_

It seems like at this point, Yahoo would want to streamline their hiring process as much as possible to bring good engineers on as quickly (and painlessly) as possible. And have that be an asset in terms of recruiting. I've had friends complain about this "wait and no response" sort of thing when interviewing with Google, but they're more willing to put up with it, because hey, it's Google.

<comment><USER15> If that guy didn't get another offer until 8 weeks later, it was probably not a huge loss for Yahoo.

<comment><USER16> I suspect your reading comprehension is broken. Just because the person in question didn't take another job after 8 weeks doesn't mean he didn't have offers waiting.

</comment></comment></comment><comment><USER17> "internal flak" = if you're hiring someone better than me that will cost me my job. i hate to say it but the more i hear about mayer the more i want to buy the stock...

</comment><comment><USER5> At their level you're better passing over a few good applicants than letting in some bad ones.

If you don't like it thats something we need to talk about changing in our industry, not just shooting ire at a single company. Mentorship is not common, and we consider 5 years of experience sufficient for a 'senior' position. Until that changes they are going to have to find some way to limit their hiring. (note: I don't 100% agree with these new practices, but I do understand where Mayer and Yahoo! are coming from)

<comment><USER18> If they are really rejecting candidates that don't come from a prestigious university they should be ineligible to apply for H-1B visas.

</comment></comment><comment><USER19> So her response to the criticism regarding missing out on good people because they did not have degrees from top universities is to say "Why can't we just be good at hiring"? Seriously? Your employees are trying to tell you how to improve your decisions and be more flexible, and your response is to tell them "No, actually you just need to do as I say, but do a better job at it."

Did Mayer spend 25 years as a military officer? That seems to be her management style.

</comment><comment><USER20> Good for her. I look forward to a day when "I work for Yahoo" will again be a phrase that can be said with meaning.

<comment><USER21> In the future it'll mean "I got the job because I have a piece of paper from certain universities, not because I showed my talent in other ways".

<comment><USER16> I genuinely wonder if they ask the question "What have you built, and may we look and go through the source together".

Doesn't that seem better than papers? I mean as a software engineer, design and product side of things.

Open source, API's, client side apps and etc.

<comment><USER22> For non-open source stuff, those pesky NDAs say "You shall not pass !!!". I think it's a very good idea, still.

My two cent is, the reverse can be applied by showing the interviewee some source codes/designs/product.Good programmers definitely cringe at the sight of bad code and excite at sight of good stuff. Same can be said for designers with...well, designs. Rather low cost consulting too for the company who does that. Win-win situation.

</comment></comment></comment></comment><comment><USER23> To me this whole "new Yahoo!" thing is all backwards.

1\. Yahoo! is in trouble. We need someone to take us out of this rut? But who? Enter Marissa Meyer: an executive with little top-level leadership experience and even less experience making desperate companies like Yahoo! relevant.

2\. We need more productivity and creativity. Umm, lets get rid of work-from- home. That should do it. But we'll give out free food in company cafeterias. It's what Facebook does, right?

3\. Our HR department sucks at hiring. Should we fix it? Nope. Just contrive some draconic hiring practices -- we're only going to look at people from engineering programs at UC Berkeley, UCLA, Stanford, Caltech, MIT, Harvey Mudd, and, of course, all the ivies. This kid went to CMU and has had already had a couple of floundering start-ups? Nope, don't even consider him. This is what Google does, isn't it?

So, in short, every single strategy is backwards. Instead of fixing the ACTUAL problems (leadership, HR, productivity, creativity), Yahoo! constantly misfires. Productivity is a side-effect of an already-positive company image. Good hires are a side-effect of an already-healthy corporate image.

</comment><comment><USER24> First no remote working and now hiring based on credentials. Is Meyer moving Yahoo into the future or the past?

</comment><comment><USER25> Her lack of trust with their HR department worries me more than any silly restriction on the candidates they hire. I mean if she's going to sit around and personally review every single person that comes to apply at Yahoo then, yeah, she better restrict the number of recruits reaching her. By forcing this restriction she's upping the average quality of the people reaching her and lowering the number of candidates she needs to toss out.

I'd imagine once she felt the HR department was capable of hiring the type of employee she personally finds to be exceeding she'll likely consider removing this restriction in favor of having those candidates take an active part in the hiring process. Also with her HR department trained on what candidates she considers good it'll make it harder for them going forward to settle on someone who fits the position but doesn't fit into Mayer's vision.

Who knows though -- I think it's a dumb idea but I'm also not the CEO of Yahoo with whatever knowledge she has on hand to justify this as an area of concern.

</comment><comment><USER26> I'm all about merit/talent-based hiring and working from home, but it's hard for me to be too judgmental of extreme measures taken in an effort to resurrect a declining company. Yahoo is the patient on the operating room table being defibrillated with 1000 volts -- a desperate act that would be absolutely crazy to perform on a healthy person just for good measure. As others have suggested, maybe Yahoo has some deeply embedded cultural faults that can only be worked around with these measures.

Whether it will work or not, I couldn't say. I find it a little sad to see companies wait until they're past the point of no return before looking for a savior. (See: Palm and Jon Rubinstein).

</comment><comment><USER27> To me, it just sounds like Mayer is trying to implement Google's structure to Yahoo! without everyone calling it that.

You'll see it mentioned in articles concerning the similarities between her new structure and Google. But they're quickly dismissed usually by flaky differences such as in this one where she's not implementing Google's independent work program, which I'm pretty sure isn't a thing at Google anymore.

She's smart, she doesn't want to reinvent the wheel, she knows what Google is doing works. She just doesn't want to be known as the one who "Google-ized" Yahoo!.

</comment><comment><USER28> I'm surprised that nobody has yet pointed out that an emphasis on what college a job candidate attended only makes sense when you're hiring kids fresh out of school who have no real accomplishments they can be judged by. Even if you're hiring someone with just five years of work experience, what they've accomplished during their years of employment is much more relevant to their success at your company than where they went to school and what grades they got. Is Yahoo hiring anyone over the age of 25?

</comment><comment><USER28> " _Mayer insists on personally reviewing every new recruit, a practice that supporters say brings needed discipline to the company._ "

For a company the size of Yahoo (or any company that's bigger than a small business), having the CEO review every hire is the worst kind of micromanagement and sends the message to her managers that she doesn't trust them to do what they're paid to do. It also means that Mayer is spending less time doing the things that really _are_ her job as CEO.

<comment><USER29> Micromanagment is not always a bad thing, and Steve Jobs is one shining example of this. Of course not everyone is good at it, but time will tell how this ends up.

My guess is that current management have become stale, comfortable and somewhat corrupted. Recruiting favors those with connections within the company, not the ones with experience, knowledge or brilliance. She could of course outright fire managers, but that could lead to worse consequences than micromanagment would.

Anyway, time will tell.

</comment></comment><comment><USER30> Mayer's weird actions make more sense in if the later context the article provides is true: that Yahoo is in a de-facto hiring freeze. If Yahoo were trying to grow it would be madness, but they aren't.

I think is her plan to limit managers ability to build empires by only allowing them to replace employees out of a tiny pool hand picked by Mayer. I wouldn't be surprised if it worked, but it's a stunning vote of no-confidence in the entire company structure...

</comment><comment><USER31> I am really rooting for Mayer. I hope that she not only turns around Yahoo but also give Google a real run for their money in every way it can.

There will be bumps along the road and ugly mistakes, but at the end of the day I have a feeling that She is really going to turn things around for yahoo.

</comment><comment><USER32> It's funny whenever I hear someone say "We only hire people who went to X" I always just assume that person is insecure about their own abilities. Hiring based on credentials doesn't require you to be good at the job yourself.

</comment><comment><USER27> If I were to simplify the problem:

Google: Search Facebook: Newsfeed Yahoo!: ???

</comment><comment><USER33> All this makes sense to me. To change a culture you must make big turns. You can't change a company's future by adding a single web product or updating a website. She's putting the company in a positon to do something big that 700,000 people will see.

Keep going!

</comment><comment><USER34> Have fun getting top engineering talent while requiring a degree from a top university.

To me this screams 'only hire engineers that are like me because they /must/ be the best engineers'.

Sad thing is none of the EXPERIENCED engineers with those degrees will touch Yahoo! with a 10 foot pole.

And I don't care where you graduated from, without experience and good guidance you will be producing mediocre shit and get out performed by a kid who has several years of experience under his belt without any degree.

</comment><comment><USER35> Blame it on low level employee , classic ... lol... but if you want "top level" university people and have requirements like in top financial institutions , you need to offer them a top level gig.

Can Mayer afford that ? without a product or a strategy ? what yahoo is about ? a brand but what else ?</comment>


Text messages coded into booze vapor - <AUTHOR> http://www.scienceagogo.com/news/20131119043537.shtml <comment><USER2> Alcoholic spies celebrate new employment opportunities.</comment>


Mapping N Turing Machines ("K-Tape") – Into a Single-Tape Turing Machine - <AUTHOR> https://cs.stackexchange.com/questions/14619/how-to-map-the-tapes-of-a-k-tape-turing-machine-into-the-single-tape-of-a-1-t <comment><AUTHOR> Googling for a simple C Compiler that compiles to a Turing Machine (to potentially help answer another HN post about wanting to learn assembler), I stumbled upon the following page:

[https://cstheory.stackexchange.com/questions/18688/a-small-c...](https://cstheory.stackexchange.com/questions/18688/a-small- c-like-language-that-turing-machines-can-simulate)

Which had the following comment, by GMB:

"My Theory of Comp professor in undergrad started by _proving that a single- tape Turing machine can implement a multi-tape Turing machine_. This handles variable declaration: if a program has six variable declarations, then it can be easily implemented on a seven-tape Turing machine (a tape for each variable, and a "register" tape to help perform tasks like arithmetic and equality-checking between tapes). He then showed how to implement basic FOR and WHILE loops, and at that point we had a basic Turing-complete C-like language. I found it satisfying, anyways."

I would have found that last part satisfying too...

But what I really found satisfying is the statement: "a single-tape Turing machine can implement a multi-tape Turing machine", because before reading this, I didn't know that a Single-Tape Turing Machine -- could in fact simulate N ("K-Tape" in academic parlance) other Turing machines in its space...

Which is truly fascinating...

It makes sense, if we think about machine virtualization.

A virtualized machine can simulate another virtual machine, which can simulate another, as long as there's enough memory -- turtles all the way down, as the saying goes...

But usually virtual machines are complex and instruction set bound, and Turing Tapes / Turing Machines are simple, much simpler (perhaps orders of magnitude simpler) abstractions for any form of computation...

It just makes a lot of sense.

Utterly fascinating, IMHO...

Anyway, links and comments on this subject appreciated...</comment>


Ubuntu 10.04 - Perfect - <AUTHOR> http://lunduke.com/?p=1095 <comment><USER2> Calling 10.04 perfect is a real, long stretch. Even the authors own description of 10.04 hardly amounts to "perfect."

Its cosmetic changes are, in my opinion, dubious at best. Window controls are on the left hand side of the Window for no good reason. The color scheme is way too dark, it made me long for the old human theme. UI elements are glitchy in places. The "Me Menu" is useless to me. And why the heck did they ever remove the startup/shutdown options from the system menu? Why are they off on their own?

I like the idea of the Ubuntu Software Center but its execution leaves a lot to be desired. Last time I checked it was just another front end to apt. Many of the packages available are totally useless to the vast majority of people.

Ubuntu One and the Ubuntu Music store, well, we'll see how those go. Personally, I've never, ever used them and I have to wonder if they're the type of things that will actually draw people to Ubuntu

And, well, I hate to come off as a curmudgeon because I really do like Ubuntu, but to say that 10.04 blows OSX and Windows 7 out of the water is just wrong. It doesn't. For instance, why does Ubuntu still have the same old application menu? Both OSX and Windows 7 (and even KDE4) have moved away from this model. The categorized, hierarchical menus that have been around forever are really unhelpful. Why can't I search this menu like in Windows 7 and KDE4? For that matter, why can't I easily search _everything_ like I can in Windows 7 and OSX (spotlight). If they really want to compete with Windows or OSX they need to give me better ways to find, sort and organize _everything_ on my computer.

<comment><USER3> >The categorized, hierarchical menus that have been around forever are really unhelpful.

Call me old-fashioned but I liked this way better. Search-based interfaces don't help when you know _what_ you want to do but don't know what _applications_ are available to do it. On Ubuntu for people coming from other OS's, this is probably a very common experience (e.g., "I want to listen to music, what media programs are on this OS?"). I like being able to get on an Ubuntu box and riffle through the hierarchical application menu to see what's installed and what I might need to add for my own use. The fact that the hierarchy is well-integrated with the package manager makes it all the more worthwhile.

By moving away from this format in e.g. Mac OS X, I have a hard time keeping track of what applications I have installed without riffling through my entire Applications folder from time to time. Unless you put your Applications folder as a stack on your dock (which is not the default), I have no idea how typical users on Mac OS X remember and launch apps that aren't pinned to their docks.

<comment><USER2> I didn't necessarily suggest that the menu not be organized at all, just that the strict categorical hierarchical menus are lame. Why do some text editors go under the Utilities menu and others under the Programming menu (like Emacs). It's hard for a new user to know which menu a program is going to be under immediately after installing it, so they have to scrub all of them until they find it.

Why not have a more semantic approach? Why can't I tag my applications and have the application menu be more like a tag cloud and let applications be under multiple menus. At least then I could put Emacs under Editors and Programming.

<comment><USER4> It's a nice-to-have, for when you don't know exactly what you're looking for; I just wish that there were a way to make more people aware of things like Gnome Do as a complementary solution. <http://do.davebsd.com/>

</comment></comment></comment></comment><comment><USER5> Perfect? I wonder if the author tried installing it on a MacBook Pro.

WiFi won't work without the proprietary BroadComm drivers. But jockey (the program which detects which drivers you need and installs them for you) won't work without an internet connection. So if you don't have a usable ethernet connection handy, you're a bit stuck.

It's possible to install the drivers manually, but it's a pretty convoluted process (which still involves downloading things - go figure). I've not yet had any luck with it.

The irony is that it clearly has the drivers somewhere in the .iso, because when you run it in LiveCD mode it's able to install them, no internet connection required.

Overall it felt like a trip back to the bad old days of linux, where you had to spend a week editing config files before you got a usable system

Not what I'd call perfect.

<comment><USER6> I'd like to have working suspend/resume on my Thinkpad while using Compiz and the FireGL. I'm going to blame this one on ATI, rather than anything under Ubuntu's control, but it's still short of perfect.

<comment><USER7> I have a Lenovo T61. There is no suspend option in the power management menu, but from the command line, pm-suspend-hibernate seems to do the right thing.

<comment><USER6> What video card does it have? The problem I'm having is specific to ATI's proprietary driver when used together with Compiz.

</comment></comment></comment></comment><comment><USER8> Not saying I could do any better, but all things visual just can't seem to shake a decidedly amateur quality level.

Perhaps an empty desktop looks good, apart from the Firefox icon scraping the top pixel of the screen, but open a few applications...

<http://img203.imageshack.us/img203/9595/fffb.png>

</comment><comment><USER9> I had huge problems with my proprietary nvidia driver and the new nouveau drivers (which replaced nv).

Because of this, the experience of upgrading was very painful. It's fine now - but, on the surface, there really isn't much difference to karmic.

</comment><comment><USER10> The release is quite nice but not perfect - still can't rotate the monitors 90 degrees for vertical alignment unless you go in and manually edit the files instead of the gui

</comment><comment><USER11> It's perfect just like every Ubuntu release in the last 2 years has been.

<comment><USER12> Meaning it's not perfect?

<comment><USER11> Yes. Every time a new Ubuntu release comes out, it's finally the one that has fixed everything wrong with Linux! It's only a matter of time before Linux has a 50% market share of desktops thanks to this release!

And then market share basically stays flat. But don't worry, there'll be another _perfect_ release in 6 months :)

<comment><USER13> the bar is continually being raised by other OSs all the time, so the definition of perfect changes. Try using windows 2000 or MacOS 8.55 and see if you don't prefer Ubuntu tremendously. Then ask yourself what has changed about Windows and MacOS in the last ten years.

</comment></comment></comment></comment><comment><USER14> _As of this very moment, MacOS X 10.6 and Windows 7. Neither of them ship with a video editor of any kind out of the box. That's right. Of the three operating systems, Ubuntu is the only one that ships with any video editor at all._

Huh? My iMac shipped with iMovie, and Windows ships with Windows Movie Maker.

update: whaddyaknow, windows 7 doesn't actually ship with the movie software, you have to download it (free) from <http://download.live.com/moviemaker>. Still.

<comment><USER15> Technically your iMac came with that iLife software preloaded, it didn't come with the OS. If you had an older iMac and bought an upgrade for the OS then you'd have to buy the upgrades for iLife separately. (You almost always got a game too, again that wouldn't be there if you bought the OS itself).

<comment><USER14> What you say is true, but it's splitting hairs really. The fact is that unless actively deleted, every mac has video editing software installed from the day it was delivered. Still, I have to concede that although it is present, it was not actually shipped with the OS.

It's a pretty lame boast that has to be laden with so many caveats, though.</comment></comment></comment>


Show HN: my humorous and entrepreneurial take on Watson's Jeopardy appearances - <AUTHOR> http://IBeatWatson.com

<comment><AUTHOR> Any and all feedback would be appreciated! In return, please use the coupon code "hackernews" during checkout for $2 off.

(If you'd like a shirt and we share similar circumstances — e.g. you're in San Francisco, or even California — please let me know as I would be happy to accommodate.)

</comment><comment><AUTHOR> 1600+ uniques after Wired tweeted this less than an hour ago (<http://twitter.com/#!/wired/status/38030059625390080>) and I have made a single sale. The Internet is weird.

</comment><comment><USER2> What happens if Watson wins?

<comment><AUTHOR> I drew inspiration solely from playing along (and doing well) as I watched last night, thus I didn't really consider the potential "studio participant" outcomes.

I'm sure it might give my product moderately more longevity if Ken or Brad win, but the net benefit would likely be negligible given that there is virtually no investment (nor profit) in the product. The good news, of course, is that the inverse is true as well.

Thanks for the response!</comment></comment>


The U1 chip in the iPhone 11 is the beginning of an Ultra Wideband revolution? - <AUTHOR> https://sixcolors.com/post/2019/09/the-u1-chip-in-the-iphone-11-is-the-beginning-of-an-ultra-wideband-revolution/ <comment><USER2> My theory on why they didn't elaborate on U1 / announce the (rumored) object tracking tags: they need better U1 chip penetration geographically before making any promises. Once a bunch of iPhone 11's are out there, they can further test the new product in a more realistic setting, and make adjustments if necessary. There could be some critical flaw that may need reengineering and they won't want a repeat of AirPower.

For instance, if they released the new object tracking tag with iPhone 11's, it would be a bad user experience because U1 is not spread out. Better to wait until the U1 geographically saturates to their standards before releasing it.

They can still talk about U1 in regards to e.g. new AirDrop capabilities, and in other marketing-level generalities.

<comment><USER3> There's an even more compelling reason why Apple's waiting a while before announcing the tracking tags: crowdsourcing.

At WWDC this year, Apple announced that all iOS devices would begin reporting nearby devices' locations back to Apple. U1 probably only works at relatively close range, so they want to wait until their "crowdsourcing network" includes enough devices for long-range tracking to work. (IIRC they aren't going to let users prevent their devices from contributing to the network, so it's just a matter of waiting until everyone has the latest iOS update.)

<comment><USER4> is that data privacy issue if we cannot opt out ?

<comment><USER5> Wired has a good article about how it works

[https://www.wired.com/story/apple-find-my-cryptography- bluet...](https://www.wired.com/story/apple-find-my-cryptography-bluetooth/)

<comment><USER6> A rotating scheme that makes it impossible for the wrong actors to track you.

It would be better if I could verify the code running on the device. You have to trust that Apple won't track you. And hey, I trust Apple more than some unfriendly government, but I still have to trust Apple. If a big profitable unfriendly government asked them to track someone, what would Apple do?

<comment><USER7> > _If a big profitable unfriendly government asked them to track someone, what > would Apple do?_

Presumably the exact same thing they'd have done if they hadn't rolled out this Find My feature. They designed it so Apple can't tell where your device is, which means if anyone wants to demand this info from Apple, then Apple has to implement that tracking separately, which they could do regardless of the Find My feature's existence.

If Apple had access to the device data themselves, then that's a huge problem because governments can reasonably start issuing warrants for that info. The fact that Apple doesn't have it means nothing has changed on the governmental front.

<comment><USER6> > The fact that Apple doesn't have it means nothing has changed on the > governmental front.

You're presuming that Apple does not "have" our location data. I am making the claim that Apple could gain our location data if Apple wanted to. I think we are making different arguments. I don't know if Apple has anyone's location data. But if Apple decided to selectively enable the collection of some people's location data, the iPhone 11 would offer them increased precision which other iPhone 11 users would unknowingly assist in collecting.

<comment><USER8> Why would an actor use Apple as a target vector? It is much easier to get location tracking thru the mobile service providers. They have the location data in real time and can't deny that. It's done thousands of times a day all over the world with and without a warrant. No vendor specific phone and no activation of special functions needed.

<comment><USER6> > Why would an actor use Apple as a target vector?

I can only speculate. But if I wanted someone's location without making some noise, this increased precision would be nice to have over carrier's coarse location data. Your GPS position could localize you to a building, but your UWB position could perhaps localize you to a room. And actually if the law enforcement agency had a device capable of detecting yours based on its UWB signal, they could find you very quietly.

<comment><USER9> Using current generation technologies like OTDOA and similar, cell carriers can already localize you to a room in a building in many cases.

Verizon can do down to around 10 centimeter accuracy with their LTE-M network in the best case (don't have a link to support that handy, otherwise I'd share).

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> It feels like this is the key to unlocking useful AR [1] for low powered, lightweight headsets. If the heavy lifting for locating and interacting with objects in 4D space is done with UWB, you don't need to do too much computational heavy-lifting - reducing bulk, increasing available space for batteries and reducing battery draw.

[1] Right now I can't really see a killer app for AR, something that would make you super-human enough to want a layer of abstraction between you and the real world. However if I could remotely interact with objects through walls, like turning off a lamp in a bedroom or seeing where my wife is and opening up a audio chat with her so that we're not yelling to hear each other, all of a sudden the trade off of having to charge and wear another device seems less annoying. All of a sudden you have powers not unlike a sorcerer.

<comment><USER11> Killer app: ambient information, especially face recognition. Think "thought bubble" information appearing over anything you might want to know about. I'm lousy with names, would be nice to see names over everyone I should know.

<comment> crooked-v One line of thought I've pondered here for scifi settings is people being able to share their currently playing music that way, like a tiny virtual radio station.

<comment><USER12> For my commute I set the radio to between 91.1 and 93.3. This range tends to be where the default for most Bluetooth and AUX radio broadcasters ends up being set.

Arguably an invasion of privacy, but it turns fellow commuters into DJs. I've discovered some good music this way.

Also lots of static.

<comment><USER13> Are you saying that if I turn on my phone's radio and set it between 91.1 and 93.3, I'd be able to hear what other people are listening to? Could you elaborate?

<comment><USER14> Nowadays, most new cars offer at least one way of connecting to an external playback device, via Bluetooth or wired auxiliary input or both. A decade ago, though, this was more of a premium feature. Back then, if you wanted to connect your music player or smart phone to your basic stereo, the simplest and least invasive way was a device that plugged into the headphone jack of your device (or alternatively connected to it via Bluetooth) and which broadcast a very low power FM signal. You would the tune your car stereo to the matching frequency, and your device's audio would be piped through the car's speakers. Usually the transmitter provided a way to choose from a list of frequencies so you could pick one not used by any local radio stations. When operating in good conditions, if another car was driving down the road next to you, they could also tune to the same frequency and hear your playback.

</comment></comment></comment></comment></comment></comment><comment><USER15> UWB is essential for secure vehicle unlocking. Bluetooth isn't, because it can be relayed. It'll give Apple a nice integration point with your new car.

For scooter rental, it'll be way smoother than opening an app and scanning a QR code. You can just step on the scooter and go.

(My wife hates the QR-code scooter app experience so much that I generally unlock both scooters under my own ID when we're going around together. Fun fact: there are geocoded low-speed zones in Paris, where it limits the scooter to 10 kph in some crowded pedestrian areas. Fine. But when you unlock two scooters with the same phone, it uses the GPS location of the phone to decide when to limit or un-limit the speed. And a lost Bluetooth connection can leave it stuck at low speed. But I digress.)

UWB will also improve the ergonomics of contactless payment. With the current system, you have to hold your phone really close to the reader for a few seconds. UWB could allow an instant gesture.

EDIT: removed fatuous intro

<comment><USER16> > UWB is essential for secure vehicle unlocking. Bluetooth isn't, because it > can be relayed. It'll give Apple a nice integration point with your new car.

The radio technology involved should have almost nothing to do with the ability to perform a relay attack. There are two straightforward mitigations:

1\. Timing. The two parties confirm that a message can round trip in a specified, very short time T. This proves that the distance between the parties is T/2c or less.

To be useful, T should be, say, 20ns or less, which requires a bit of clever crypto to make the actual exchange fast enough.

2\. The transmitter attempts to localize itself, using GPS or other technologies, and refuses to authenticate unless it's near the receiver.

There is reason to believe that UWB will help with localization. I see no reason it would be any better than any other technology for time-of-flight measurements unless sub-nanosecond resolution is needed.

<comment><USER15> Bluetooth uses frequency hopping, which is unsuitable for measuring TOF. This group tried it: [https://hal.inria.fr/hal-01995171/document](https://hal.inria.fr/hal-01995171/document) and even with a lot of cleverness they were seeing 100 foot RMS errors from Bluetooth. Not enough to prevent stealing someone's car parked in their driveway while their phone is in the house.

<comment><USER16> They're using unmodified hardware and minimally modified software. It would be interesting to see how much precision could be achieved with hardware modifications.

<comment><USER17> Instead of Bluetooth (which Apple could totally fudge on their own devices if they wanted to), the TOF for the Apple Watch<>Mac auto-unlock uses Wi-Fi 802.11v. It seems really quick too (presumably the Mac is establishing a short-lived AP), would work fine for unlocking a car.

<comment><USER18> Here's a good article further explaining it for those curious: [https://networkingnerd.net/2016/09/21/apple-watch- unlock-802...](https://networkingnerd.net/2016/09/21/apple-watch- unlock-802-11ac-and-time/)

</comment></comment></comment></comment></comment></comment><comment><USER19> From the article:

> Imagine a whole-home audio system moving music playback through multiple > rooms based on the location of an individual listener.

Hell, why stop there? Imagine that same audio system not only activating different rooms as you move through them, but also adding the appropriate delays to each audio channel to make sure they arrive at your ears in sync. That'd be pretty neat.

<comment><USER20> Bill Gates had the room activating thing back in the 90s. He talked about it in his book The Road Ahead.

[https://www.digitaltrends.com/home/the-awesome-technology- in...](https://www.digitaltrends.com/home/the-awesome-technology-inside-bill- gates-mansion/)

<comment><USER21> I can imagine Tim Robbins describing this tech as "primitive."

</comment></comment></comment><comment><USER22> Could someone who understands the radio technology please explain why using time-of-arrival and phase tricks with existing WiFi and Bluetooth signals is "wide-banded" in any way?

<comment><USER23> WiFi channel width is 20 MHz or 40 MHz. UWB has 500MHz channels. [https://en.wikipedia.org/wiki/List_of_UWB_channels](https://en.wikipedia.org/wiki/List_of_UWB_channels)

<comment><USER9> WiFi channels can also be 80MHz (which my laptop is currently connected at) and 160MHz (which is still a bit rarely supported), but your point still stands.

</comment></comment></comment><comment><USER24> Can someone explain the privacy implications? Is this part of the new always on Find Phone network? Does apple respond requests from LE to 'find person x'? Is there similar random UUID protections built in (e.g. change MAC address frequency)?

<comment><USER25> No need to worry. Apple told us they won't track us.

<comment><USER26> I get that Apple has a better rep than most other companies when it comes to user privacy, but that still doesn't mean that we should take everything that they say at face value. As users, it is up to us to stay vigilant and ensure that Apple is doing as promised.

<comment><USER25> My comment was satire about how apples proprietary systems offer us no more than some PR persons comment saying it's all ok.

</comment></comment></comment></comment><comment><USER27> I expect indoor navigation to be a very powerful, especially the U1 chip is combined with the existing Indoor Maps functionality in Apple Maps: [https://developer.apple.com/design/human-interface- guideline...](https://developer.apple.com/design/human-interface- guidelines/maps/overview/indoor-maps/)

</comment><comment><USER28> It will be interesting to see how the U1 chip fits into Apple's widely expected 2020 AR glasses rollout

<comment><USER29> I really hope Apple can show enough restraint to not make these glasses cameras or video recorders like Google glass.

<comment><USER30> I think the interesting question to follow up is: "why not camera"? Is it intuitively bad? How bad? When weighing against the benefits, is camera still worth it? I'm not 100% sure, just a couple random points:

1/ The first concern pops into my head is having a recording device nearly always on. In reality, there is no way you can prevent people to take photos and/or videos using smartphone when something interesting is happening in the public. It takes less than 5 seconds for people to take the phone out of their pockets and start recording. Then what's the real difference between camera on the face or camera in the pocket?

2/ The Glass-Hole issue. People always blame the camera as the ultimate evil. I'm not that sure. Remember, the original Google Glass was basically a piece of not-that-useful-to-put-it-nicely gadget that costs $1500. Honestly, back then, I thought whoever is buying those stuff that just overpaid nerdy douchebags (I'm thinking that way mainly because I cannot afford it). I'm not sure having a camera is the biggest issue; but having a camera is probably the biggest issue that you can publicly talk about.

3/ Trust issue, i.e. whether Google/Apple/FB are secretively collecting those video feed. Or even worse: what if the business model of future AR products depending on collecting those video feed.

<comment><USER31> When someone is holding up their phone or actual camera to take a photo, that's very visible and obvious to everyone in the area what they're doing, and social feedback can be delivered if the usage is inappropriate.

That's very different from an accessory like glasses, which are typically on somebody's face all the time, whether or not they're being used for photo functionality, with a hidden camera constantly pointed at whoever they're talking to or whatever they're looking at. You may never know that a photo or video or other recordings of you, of your property, of your company secrets, of national security, etc are imminent or already taking place.

"What's the real difference" is kind of absurdly obvious, yes?

<comment><USER30> Apologize if I didn't make my idea clear enough. Seems there are two topics here: 1. being able to use a camera & 2\. being able to conceal a camera.

My originally argument is focusing on point 1: people can already _use_ smartphones to take pictures and to record videos as easily/convenient as using a wearable camera.

On the point 2. I totally agree with you, wearables will make it easier to conceal the camera and that is a bad thing. I guess the takeaway here is that the camera isn't the problem, the problem is being able to conceal the camera.

<comment><USER32> No one has ever said anything to me about carrying my phone in my shirt pocket. The lens is exposed and facing outward.

My primary recording device is 100% socially acceptable to have deployed at all times. Recording would be unacceptable, but no one can tell if I am recording. (To be clear, I am not recording.)

There is no technical difference between this and camera glasses. It is just a weird public perception problem for the glasses.

<comment><USER33> > .. phone in my shirt pocket.. Recording would be unacceptable, but no one > can tell if I am recording.

People know how phones work, you press a button to start recording. AR Glasses are expected to capture at all times, recording or sending to cloud for analysis. And that is what no one would like.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> I don't know, the Decawave DW1000[1] has been out for a couple of years now and the revolution hasn't happened. Perhaps there is another missing piece to the puzzle.

[1] [https://www.digikey.com/product-detail/en/decawave- limited/D...](https://www.digikey.com/product-detail/en/decawave- limited/DW1000-I-TR13/1479-1001-1-ND/4499860)

<comment><USER35> Being inside an iPhone?

</comment></comment><comment><USER36> Not sure if UWB-enabled devices are also capable of sensing spatial position of other devices (i.e. phone A is on the left of the phone B), but I'm already envision how this can be used to create screen-to-screen file moving feature – some sort of Avatar-like UX: [https://imgur.com/8O89CXK](https://imgur.com/8O89CXK)

<comment> yoz-y According to their ad copy it should be able to do it.

To quote from the iPhone 11 page:

> The new Apple‑designed U1 chip uses Ultra Wideband technology for spatial > awareness — allowing iPhone 11 to understand its precise location relative > to other nearby U1‑equipped Apple devices.

</comment></comment><comment><USER37> How does this deal with multipath? This article is all hype and no explanation.

<comment><USER38> UWB deals with multipath by having very short pulses. The direct path is always faster, so the "true" pulse is the one which arrives first.

<comment><USER39> It's been 10 years since I think the last attempt at UWB failed to gain traction. But I think you can use a rake receiver with UWB to combine the multipath components.

</comment></comment></comment><comment><USER40> If they put the tech into a keyfob, as suggested by the article, does that mean I would never lose my keys again?

<comment> crooked-v Apple leaks and patents suggest that they're even aiming to have distributed location recovery, e.g., you lose your keys in a store and turn on 'find my keys', some random person's iPhone detects them and pings Apple, and Apple pings you with the location.

<comment><USER41> RIP Tile.

<comment><USER42> In a nightmarish scenario, I can easily imagine Apple's success killing off Tile. Which would be a shame as I really love my Tiles.

</comment></comment></comment></comment><comment><USER43> > UWB can also determine the angle of arrival of the radio signals by > measuring the phase shift

this reminds me a bit of how VORs work [https://en.wikipedia.org/wiki/VHF_omnidirectional_range](https://en.wikipedia.org/wiki/VHF_omnidirectional_range)

</comment><comment><USER44> The tracking tags are still pretty interesting, could see apple succeeding with a "tile" like device.

<comment><USER45> My Tile died but I'm waiting for Apple's solution. Hopefully for Christmas.

</comment></comment><comment><USER46> Short-term and small scale, Apple _really_ needs to add UWB tracking, at least a beacon you can locate, to the next generation of AirPods.

(Signed: someone whose spouse "can't find my airpods, I was sure they were in this bag …")

Thereafter: full inventory control and location of all your e-waste-to-be?

<comment><USER47> Or finding them on the train tracks of the New York subway:

[https://www.macrumors.com/2019/09/03/lost-airpods-nyc- subway...](https://www.macrumors.com/2019/09/03/lost-airpods-nyc-subway-train- tracks/)

</comment></comment><comment><USER48> UWB scales poorly. There's a limited number of channels. Ad hoc range finding requires a call and response.

However.

The range finding is accurate.

So long as one is dealing with a few devices, it is incredibly effective. It's not going to be GPS for the house, but it does make proximity triggers reliable.

<comment><USER49> What's the upper limit though? Wouldn't a half dozen devices placed at known coordinates around the house be enough to do indoor GPS?

<comment><USER48> There's 6 channels, and I think a high / low setting to get a total of 12.

With indoor positioning, the anchors aren't positioned as precisely as GPS satellites, nor do they have the same quality clocks. Thus time of flight is done with a call and response per device.

It was hard to setup positioning for more than 1x device... remember that 1x device is range finding to 4x anchors.

Am sure these problems can be solved, but in the near term think this is more about precise distance rather than position.

</comment></comment></comment><comment><USER50> I haven't really been this exciting for a new technology on my phone for a while. Am I just drinking the UWB hype kool-aid it is this actually revolutionary? So far it is difficult to tell but I guess we'll see.

</comment><comment><USER51> Does this mean Bluetooth is dead, if UWB can do all the stuff that Bluetooth did?

<comment><USER52> I have no idea if this could replace Bluetooth but even if it did, Bluetooth would not be "dead". Bluetooth has enough inertia that it will be supported for the next decade.

</comment></comment><comment><USER53> This will really help a a lot in tracking things real time for AR apps

</comment><comment><USER54> UWB may well end up the USB of wireless for tech as it has many uses.</comment>


Ask HN: Putting a price on your app? - <AUTHOR>

Releasing a web based productivity app in a couple months.
I noticed that there is always a lot of talk about product-market fit and general startup tips about finding cofounders and lifestyle changes but I haven't found anything good about pricing.
Anyway, our project has one constraint: we're not seeking outside investment so the app has to sustain itself.
Server costs per user will probably be hovering around $2-3/month (mostly bandwidth charges).. This is obviously a hosted solution where the kind of pricing that would make the most sense is some kind of monthly charge.
Couple of questions:
Is it ok to change prices around in the beginning to find where the market price is i.e. what gets us the most customers?
What's your take on the 2-tiered Google Apps model (Free ad supported or Premier) vs the 6 tiered Basecamp or Freshbook pricing matrix models (seemingly a more traditional approach)..?
My teammates and I do consulting on the side so we're not worried about immediate cashflow. So we're leaning more towards building an audience and breaking even than making substantial profits. Does that sound reasonable?
Lastly, anyone know of any resources or books that have helped them get a better feel for pricing strategy?
Thanks in advance for any suggestions..
ps. Thought this post was pretty good: http://news.ycombinator.com/item?id=910144 <comment><USER2> > Is it ok to change prices around in the beginning

Not really... or rather you risk pissing off users. However if you take an initial 3 or 4 month hit to run a free "beta" of some description that might help you figure out reasonable pricing. At that point you will be able to

a) confirm the exact cost per user per month

b) ask actual working customers (in a survey) what they would be prepared to pay

Such data would be invaluable in fixing a final release price.

<comment><AUTHOR> Sounds reasonable. We may just have to take the hit. It might also be a good idea to float around a limited number of beta passes.

<comment><USER2> Oh yeh; releasing it in a limited way is the best move in my eyes. I mostly suggested that approach because you said immediate money wasn't a huge concern (always good!).

The way I see it, if you make a limited initial beta for a reasonable length of time (say 3 months) and make sure you pick people who will actively use the service (that's the hard bit) then you:

\- have an active user base who are very highly likely to convert to immediate paid accounts, especially if you sweeten it just a tad for them as beta users :D

\- get final stage beta testing while still on limited release

\- get your first real public product feedback; always useful for setting a price that is fair but not off putting!

(can I ask what it is your putting together? If it's too early just say no :D)

<comment><AUTHOR> Something along the lines of a highrisehq.com competitor.

We're about a 6 weeks away from a private beta launch.. So pricing is coming up quite a bit. =)

<comment><USER2> sounds interesting; add my email (it's in my profile) to your lists if you have any - that's something my employer might be interested in in the near future.

<comment><AUTHOR> Will do. Thanks ErrantX. You've inspired me to seriously consider putting up a splash page asking for email addresses - to be notified when it's released.

</comment></comment></comment></comment></comment></comment><comment><USER3> Do the Steve Blank price-boxing experiment. "How much would you use this if it were free? $50 / month? $1 million dollars?"

Your customers will tell you what they're willing to pay. If that number is below your operating costs, however, be prepared to either drastically change your model or move into another business.

</comment><comment><USER4> I love this talk about pricing software: <http://venturehacks.com/articles/pricing>

I've had it on my MP3 player for about a year and I only just noticed it's by Steve Blank! Audio's a bit crappy in the beginning, but gets better.

<comment><AUTHOR> Thanks.. Listening to it now..

EDIT: Quite entertaining and informative.. Only thing I would say is it's more about enterprise software. He does make some great points about not under- pricing your app and how engineers tend to do this.

</comment></comment><comment><USER5> great ebook on pricing: <http://www.neildavidson.com/dontjustrollthedice.html>

<comment><AUTHOR> Half way through it. Great read and the PDF is free.

Thanks!</comment></comment>


ASK HN: Feedback on my weekend project http://lb.anishoo.com - <AUTHOR>

Hi, Long time reader and first time poster. I recently changed jobs and moved to web development engineer role working on the LAMP stack. As part of ramping up I had started a hobby application in LAMP that I thought had use at that time. Its been 6 months since then and have finally managed to get it working enough to open for feedback. My intent is to provide services for mobile/dektop platforms and started off with a Leaderboard service that I needed for my WP7 games at that point. I know there is enough similar services out there but I do have some ideas on other services to add to this eventual portfolio that will be different. Let me know what you guys think about this. Url is http://lb.anishoo.com. <comment><USER3> Sort your homepage out.

 _Welcome to Anishoo Services - A portal for application developers.

Anishoo's mission is to provide value add services to mobile/online application developers. Please refer to the section below to see the list of services being provided._

Absolute drivel. 'List of services'? - all I can see is one service - <USER2> Leaderboard API. So just write:

'Anishoo provides a Leaderboard API for mobile developers.'

<comment><AUTHOR> Valid feedback. I have made that change..there are other services that I am working on that will be part of this. Having said that I accept that till its not ready to make it explicit.

</comment></comment><comment><AUTHOR> Clickable.. <http://lb.anishoo.com></comment>


Bitfloor Hacked, $250,000 Missing - <AUTHOR> http://bitcoinmagazine.net/bitfloor-hacked-250000-missing/ <comment><USER2> And therein lies the problem with non-traceable, uninsured currency.

One of the benefits of using a major bank (in the United States, for this example), is that your money is federally insured. You'll always see little logos or blips of text advertising that the bank is a "member, FDIC."

People take this for granted -- after all, if your bank is robbed, why should it be _your_ loss? It's a little harder when the currency is anonymous and completely uninsured.

Many bitcoin exchanges will do their best to dip into their profits to reimburse users after they were hacked. I know that several major exchanges have already dipped into their own coffers to reimburse their users. However, they need to pay for this completely out-of-pocket, and even then there's nothing that indicates that they _have_ to do so.

I think that bitcoin is an interesting idea, and certainly has gained a lot of traction for more privacy-minded individuals. Those that want to active day- trade it, though, should stick to standard forex markets, in my opinion. In fact, there is nothing to guarantee that the organizers of an exchange won't simply steal your money and disappear -- there'd be no way to prove that it was them, short of seizing their machines and hoping an incriminating bitcoin wallet was sitting there.

<comment><USER3> How is this a property of "non-traceable"/anonymity?

If someone physically robs the bank and gets away with a large amount of cash that is arguably even more anonymous and non-traceable than bitcoins.

The only problem ought to be that bitcoin exchanges are not being insured, by who or that the currency happened to be bitcoin doesn't matter (as long as the insurance covers it).

<comment><USER4> Don't banks track the new money they receive by serial number range?

<comment><USER3> What stops you from doing that at a bitcoin exchange as well?

</comment></comment></comment></comment><comment><USER5> Read the thread referenced in the article: <https://bitcointalk.org/index.php?topic=105818.0e>

Bitfloor admits to earning about $2100 a month. So it's a totally unregulated market, and it'd be easy to increase your earnings by 100x this month. During the time the wallet was left in an unencrypted location, just happened to get hacked.

I can't call the Bitfloor owner a thief, but reading his posts about looking to the future, and not to the past, no claim of a police report being filed, and the generic term "We got hacked!" make for some obvious conclusions.

<comment><USER6> I seriously doubt they stole the money, because they've exhibited an extremely high level of professionalism in the past.

(Even when not comparing them to other bitcoin ventures, which tend to set a very low bar.)

Another reason I doubt they would steal it is because "cashing out" now would be like Zuckerburg cashing out a year after starting Facebook. At least, from the perspective of someone who believes in bitcoin.

</comment></comment><comment><USER7> "the attacker gained accesses to an unencrypted backup of the wallet keys"

<shakes head>

What is with these bitcoin exchanges and their pathetic records on security? How is the currency ever supposed to go mainstream with these continual security lapses?

<comment><USER8> Well when you consider that a traditional bank has teams of security experts, spend millions of dollars on security infrastructure and STILL have the occasional lapse in security; how do you think a couple of guys in their spare time will fare?

<comment><USER9> A bank's software infrastructure and "attack surface" dwarfs these tiny bit coin exchanges. Banks also have byzantine processes and guidelines that encumber their technical teams so building their software is inherently costly regardless of security.

Meanwhile unregulated, nimble BitCoin exchanges struggle with the OWASP top 10.

<comment><USER10> I'm not quite sure I buy that. Obviously banks are more complicated. But because of the regulatory environment what they are not is "just servers on the internet". You can break into a bitcoin exchange and steal BTC by copying data. You can't do that with a bank -- banks can only transfer electronically to other banks, and "being a bank" is a tightly regulated state.

So while the complexity is there, it's not clear to me that it correlates to an "attack surface" in the sense network security people use the term.

</comment></comment></comment></comment><comment><USER11> A problem with an untraceable currency is that it's also very easy for an exchange to collaborate with a hacker and vanish (or declare banckrupcy). Not saying that is what happened here, but that would be my fear.

<comment><USER6> Those kinds of trust issues are present in some form in _many_ kinds of commercial transactions, and there are many ways of dealing with them (insurance, lawsuits, interact with companies you can trust and avoid ones you can't, etc.).

<comment><USER11> Bitcoin provides plausible deniability, which makes lawsuits difficult. In contrast to centralized banking systems which leave a paper trail.

And insuring bitcoins has its own logistical challenges that will probably scare an actuary.

Trust is a hard one as I'm sure the people who used bitfloor had trusted it until today.

<comment><USER6> Insuring bitcoins is actually pretty easy. As a sidenote, there are already people doing it. The ideal way to do it would be to audit the exchange, and possibly also use an escrow, populated with money from the exchange, that pays you (the insurer) if the exchange loses money. It would be in the interest of the exchange to cooperate in these areas, in order to promote the availability of cheaper insurance, and therefore more customers.

A digression: Bitcoin would be the government regulator's wet dream if you could assign people addresses (and they could only use the assigned address), because you can trivially track all transactions. Actually, I have in mind a way to implement such a system in a (likely) cryptographically sound and enforceable way. But in theory, the government could outlaw cash and track all transactions _anyway._

</comment></comment></comment></comment><comment><USER12> 'hacked' ... Anyways, here's my question - why aren't private keys for these centralized wallets encrypted with a password the user has to put in when they do a transaction. That way private keys aren't stored on disk, but only temporarily in memory. Also if the encrypted keys get stolen, there's time for people to move their money to new wallets before the encryption is broken.

<comment><USER13> Transactions are often automatic and unattended. For instance, you put in a buy or sell order that may or may not be automatically fulfilled sometime in the next day.

</comment></comment><comment><USER14> The best thing about this is that the conversion rate of Bitcoins is relatively unaffected. And that's good, because this is not a failure of Bitcoin, but of a single service provider.

</comment><comment><USER15> Since all bitcoin transactions are traceable, it will be interesting to see how this money gets laundered.

<comment><USER14> 1) Setup free Bitcoin mixer service where people can "launder" their own Bitcoins for improved anonymity (Hint: those services already exist)

2) Feed your stolen coins into the service and make sure that the rate of this isn't too high

3) Profit (if someone asks you have the perfect excuse)

And in case you argue "using money from such a mixer service is suspicious": It doesn't have to be a mixer service. Use one of the numerous Bitcoin casinos. With the right games you can expect to win around 90% or more of the money that you've invested. And if you're lucky the coins that you get from the casino are different than the ones you paid them.

</comment></comment><comment><USER16> 1\. Start a Bitcoin exchange

2\. Announce you were "hacked"

3\. Profit!

</comment><comment><USER16> Are there tools/databases out that keep track of stolen Bitcoins and where they end up? It seems like it would be in the interest of the exchanges to share this information and blacklist coins originating from a theft.

They should also allow users to check incoming transactions against this blacklist and reject them if they choose. I suppose you'd end up with a black market of tainted Bitcoin, but that's better than just allowing thieves to immediately exchange stolen coins for another currency or legitimate services/products.

<comment><USER6> To answer your first question: It's pretty easy to track where bitcoins go. People have tools that visualize this (I've seen them). I don't know of one off the top of my head I can point you to, though.

To answer your second question: This idea has been discussed at length on bitcointalk.org by a lot of people. The idea is known as "tainting." There are a lot of problems with making it work in practice, so the concensus seems to be "don't go there."

To give you a sample of the (IMHO valid) objections: For one thing, it's difficult to verify which coins really should be tainted. (How do you know someone claiming certain coins should be tainted is trustworthy?) For another thing, tainting creates two "competing" bitcoin currencies, black coins and white coins. Finally, there is no central authority, so it would be challenging (though perhaps not impossible) to come to a "general concensus" on who should be in charge of declaring coins tainted.

</comment></comment><comment><USER17> I lost a lot back when they were ~$20 a pop and you could still crunch them. I lost enough to put me off completely. Nice to know my caution isn't entirely paranoia induced.

<comment><USER18> When you day lost, how exctly? Hacked trading? other?

<comment><USER17> I had some in an exchange which was hacked.

</comment></comment></comment><comment><USER19> Yet another Bitcoin exchange on Linode being hacked through the service console (I can't find the post where he mentioned it, but I remember reading it yesterday. He mentioned that the machine wasn't reachable on an external IP.).

I'm currently not sure about weather this is partially to blame or not. Would a dedicated server have made it harder to access the machine?

</comment><comment><USER20> Sorry to hear that a lot of people's bitcoin deposits were lost in the BitFloor hack.

CampBX has been in operation for over a year, is based in Atlanta, and has successfully cleared multiple independent Pen-tests and security audits.

Give us a try! www.CampBX.com

</comment><comment><USER21> Why do people leave any amount of money in the wallets at these places?

<comment><USER22> Do you mean the exchange or the customers? The customers have to deposit BTC before they can place any sell order, and the BTC has to be held in escrow by the exchange as long as that order stays on the books. As others have said though, the exchange shouldn't be keeping much money in a hot wallet; that's probably just lazy programming.</comment></comment>


Ask: What API is missing? - <AUTHOR>

We have Stripe, Twilio, FullContact, SendGrid, etc, etc etc...<p>What's missing? <comment><USER2> Basic infrastructure sucks to manage. Dhcp, tftp, pxe, site dns, pki, kerberos, sysctl, disk subsystems, raid cards(!!!), directory services, & host networking. All of those are requisite basic infrastructure for sites. And best case you get a bunch of incompatible clunky 1980s era libraries. Ohad levy has made a start on this, but it's more "I needed a thing to do this thing" stage.

Oh, a real answer may be networking. However I suspect the enterprisey network guys are going to get there before the web 3.0 "devops" kids even realize its a Problem. Bright side is it'll be clunky java ee SDN garbage so there will still be room for late comers.

</comment><comment><USER3> I want an API for my living space. Temperature, how much power my devices consume, light levels, etc. Correlate this with my utility bills for power, gas, water, and the like.

Everything can have a microprocessor in it now. What's taking so long?

<comment><USER4> the closest air interface/protocol with a large enough install base is probably Bluetooth Low Energy. unfortunately, a lot of consumer devices don't expose many profiles or other low-level functionality, so if you want to do something off the beaten path (even within the standard), it may not be possible unless you build your own device.</comment></comment>


The Xerox PARC Visit - <AUTHOR> http://www-sul.stanford.edu/mac/parc.html <comment><USER2> One factor many people forget was that Doug Engelbart did "The Mother of All Demos" back in 1968 to over 1000 computer professionals:

[http://www.wired.com/science/discoveries/news/2008/12/dayint...](http://www.wired.com/science/discoveries/news/2008/12/dayintech_1209)

<http://sloan.stanford.edu/MouseSite/1968Demo.html>

Far more primitive than Alto or the Mac, but the ideas were percolating out there. SRI's NLS/Augment system definitely inspired the work at PARC (which didn't open until at least a year after the demo).

Steve Jobs later said that the GUI overshadowed other innovations at PARC (ones which later drove a lot of the work done at NeXT).

"And they showed me really three things. But I was so blinded by the first one I didn't even really see the other two. One of the things they showed me was object orienting programming they showed me that but I didn't even see that. The other one they showed me was a networked computer system ... they had over a hundred Alto computers all networked using email etc., etc., I didn't even see that. I was so blinded by the first thing they showed me which was the graphical user interface. I thought it was the best thing I'd ever seen in my life. Now remember it was very flawed, what we saw was incomplete, they'd done a bunch of things wrong. But we didn't know that at the time but still though they had the germ of the idea was there and they'd done it very well and within you know ten minutes it was obvious to me that all computers would work like this some day."

Triumph of the Nerds transcript <http://www.pbs.org/nerds/part3.html>

</comment><comment><USER3> "Unbeknownst to Raskin, Jobs had his own reasons for visiting PARC: Xerox's venture capital arm had recently made an investment in Apple, and had agreed to show Apple what was going on in its lab."

I think this is kind of the point they make in Steve Jobs bio as well. Xerox allowed Apple to use some of the concepts in the lab because they were investors in the company. Also, if I recall correctly, Apple engineers went a little farther in the window metaphor, allowing, for example, to overlap and stack windows, something XEROX wasn't able or willing to do.

<comment><USER4> I once read an anecdote saying that that Jobs remembered this part wrong: he told Apple's engineers about the stacking, overlapping windows he _thought_ he had seen; armed with this piece of misinformation, they went ahead and "duplicated" that feature.

<comment><AUTHOR> Not quite the same thing but here is a corollary...

"Smalltalk had a three-button mouse and pop-up menus, in contrast to the Mac's menu bar and one-button mouse. Smalltalk didn't even have self-repairing windows - you had to click in them to get them to repaint, and programs couldn't draw into partially obscured windows. Bill Atkinson did not know this, so he invented regions as the basis of QuickDraw and the Window Manager so that he could quickly draw in covered windows and repaint portions of windows brought to the front. One Macintosh feature identical to a Smalltalk feature is selection-based modeless text editing with cut and paste, which was created by Larry Tesler for his Gypsy editor at PARC." --[http://www.folklore.org/StoryView.py?project=Macintosh&s...](http://www.folklore.org/StoryView.py?project=Macintosh&story=On_Xerox,_Apple_and_Progress.txt)</comment></comment></comment>


Any good alternatives to basecamp for a startup/side project? - <AUTHOR>

We've been using basecamp for the project we're working on, and of course we're bumping up against the limits of the free plan.
I was thinking about upgrading to the basic plan, but just found out it is now $24 a month (I remember it being $10), which is something we can clearly not afford at this stage.
This isn't a rant against 37Signals or anything like that (though I think they should have more options to cover folks like us). I just want to know what hn'ers out there are using to project manage their startups. <comment><USER2> I'm not a basecamp user, but if $24/mo is make-or-break, I'm not sure how much you believe in the startup.

I'm not saying you must blindly buy crap or else you don't believe, but if Basecamp is working for you, I'd pay the money instead of burning time on finding a substitute. (Said differently: what is your time worth to investigate and to port your data over the new system and/or to live with the losses while you have two systems of record?)

<comment><USER3> Interestingly, His name is "trustfundbaby."

However, it should be noted that he may be from another country where $24/month is extremely expensive.

<comment><AUTHOR> > Interestingly, His name is "trustfundbaby."

Thats the joke. Get it?

</comment></comment></comment><comment><USER4> A few alternatives:

<https://teambox.com/> <http://goplanapp.com/> <http://www.assembla.com/> <http://www.codebasehq.com/>

<comment><USER5> I love basecamp and signed up for teambox for the document sharing, but haven't really used it yet. What do people think about it?

</comment></comment><comment><USER3> Have you tried google docs?

We seem to doing okay using google docs + remember the milk.

</comment><comment><USER6> Here is an open source option: <http://collabtive.o-dyn.de/> works great for my company`s project management.

</comment><comment><USER7> Your profile says that you know Ruby on Rails, so I'd recommend just installing Redmine on a spare or dev server.

<comment><AUTHOR> Thank you ... I forgot about that.

</comment></comment><comment><USER8> Have a look at clockingit.com : project management, collaboration, time tracking..

</comment><comment><USER9> There are a lot of solutions. I like Manymoon and Zoho Projects. If you use Google Apps, you can purchase both of them on the market and integrate.</comment>