Reinventing the Mail Truck - <AUTHOR> http://www.nytimes.com/2015/03/06/automobiles/the-mail-truck-is-a-classic-and-thats-a-problem-for-a-modern-post-office.html <comment><USER2> Before I worked @ my current job hacking together DSLs I was a postie in Canada while going to school. Those new trucks are almost exactly the same as the one's used here, but left-hand drive. Problem w/right-hand drive is the enormous blind spot where you don't see people stepping off the curb in front of your truck or cyclists using a 4 way stop. Look at the picture of the guy in the older truck, there's 2 beams obstructing his view and the side mirrors (the mirrors on the left side are the same size as the right side). When you pull up to a 4 way stop and glance over to the right anybody on a bicycle is perfectly obstructed by the double mirrors and double beams. They of course go first and you think you're clear to go and almost hit them every time. This happened so much we had to roll down the windows and actually stick our heads out to look to see who was on the right in an intersection. Probably something to think about when they design these vehicles.

Canada Post are also concentrating on parcels and not caring so much any more about lettermail or physical spam as a result are making $200+ million per quarter in profit now as Fedex and UPS losing business to them.

They are also contracting out somebody to build them new devices and dumping Microsoft handheld scanners for something else, which they haven't decided upon yet. If you run such a corp should probably start shilling your services to them.

</comment><comment><USER3> I wonder if a company like tesla would put in a bid? You'd think electric would be the way to go when they spend over half a billion on gas each year, the extra cost for the vehicles would pay itself off pretty quickly.

<comment><USER4> For the constant stopping and starting these vehicles do, it does seem like electric would be perfect. How many miles a day does a typical mail delivery truck run? Let say the overall average speed of the truck through out the day is 10 mph. That puts in in the ballpark of 75 - 100 miles/day. Given that it's all stop-start movement, that would probably exhaust the battery pack that comes with the Model S. Regenerative braking would help, though.

Seems perfectly doable. Feel free to correct my napkin math. I could be off quite a bit but Fermi-wise I think I'm good.

</comment></comment><comment><USER5> Background on the current Grumman LLV (Long Life Vehicle): [http://postalmuseum.si.edu/collections/object- spotlight/llv....](http://postalmuseum.si.edu/collections/object- spotlight/llv.html)

Working video link: [https://www.youtube.com/watch?v=qahIvBF3d7g](https://www.youtube.com/watch?v=qahIvBF3d7g)

<comment><USER2> Type "USPS Vehicle Catches Fire" into google. For some reason the Grumman LLV's tend to randomly ignite, so often that Canada ended their lifespan early and replaced them all with small Ford Transits. Granted this was after decades of being driven like they were stolen.

</comment></comment><comment><USER6> Here's a better idea for a USPS mail truck: End the USPS.

All I get is spam. Why are taxpayers subsidizing advertisers?

<comment><USER6> Interesting on the downvotes. Someone, please make an argument why governments should provide physical mail services in 2015.

<comment><USER7> because not everybody has easy access to the internet. Plus, packages can't be delivered digitally.

<comment><USER6> Why should government be in the business of delivering packages for private industry? Infrastructure already exists for this including UPS, Fedex, DSL.</comment></comment></comment></comment>


"Premature optimization" as phrased by Musashi - <AUTHOR> http://brannerchinese.wordpress.com/2013/08/11/premature-optimization-as-phrased-by-musashi/

<comment><USER2> I wonder if the proportion of 'students' of Musashi who use this phrase as a reason for no strategy at all is the same as the number of programmers who disdain optimization of any kind?

</comment><comment><USER3> And the way of the grind. Or daily iteration.

"Today is victory over yourself of yesterday."

</comment><comment><USER4> Who said that "unripe strategy" = "strategy defined too early"?

<comment><USER5> Thanks for your question. I grant you, it could mean that the strategic thinking of the strategist is still immature. But in context I don't think it does.

Musashi lays great weight on developing keen perception of the moment and its potential. When he says _nama_ 生 'unripe' strategy, I understand him to mean strategy that is settled before conditions have ripened. That's comparable to Knuth's remark about optimizing code. I don't think Musashi means that the strategist is too inexperienced.

Although there is a vein in East Asian military theory about wizard-like long- range anticipation of strategic conditions, Musashi doesn't indulge in that.

</comment></comment><comment><USER6> That could as easily go either way.</comment>


Jailhouse: Linux-based partitioning hypervisor - <AUTHOR> https://github.com/siemens/jailhouse#jailhouse <comment><USER2> >Unlike full-featured Linux-based hypervisors like KVM or Xen

I'm being pedantic about a random part of their description, but Xen is not based on linux. It is a microkernel sort-of based off of Nemesis OS. The dom0 is not Xen itself, it is just the control domain. Linux is probably the most heavily used dom0, but it is by no means the only dom0 - Solaris, FreeBSD, etc, can or previously could be used as dom0.

<comment><AUTHOR> > but Xen is not based on linux

The description didn't say Xen was originally based on Linux. What the description said was that full-featured Linux-based hypervisors _like_ KVM or Xen manage the resources to scale beyond what is physically available. Given the _context_ of that quote was that Jailhouse is based on Linux, KVM and Xen have Linux-based versions, and Jailhouse is different because it doesn't oversubscribe hardware, I would say that there's little reason to nitpick the comment.

<comment><USER2> > full-featured Linux-based hypervisors like KVM or Xen

> KVM and Xen have Linux-based versions

There is no such thing as a Linux-based Xen. KVM and Xen are fundamentally different in that regard.

When you are running Xen, you are not running Linux. If you have a Linux dom0, that is still not Linux-based Xen. That is a control domain (a VM) where the management toolstack is installed. It's also the default driver domain, but you can have stub domains just for drivers too.

The point is that there is nothing Linux about the Xen hypervisor, at all. When you see a linux kernel with xen in the name, that isn't because it contains the xen hypervisor - it's because it is a kernel modified to utilize hypercalls, etc.

</comment></comment></comment><comment><USER3> This looks pretty interesting especially for low latency / realtime-ish applications.

In that case it is already common to isolate CPUs and other resources away from the base system and run the high priority components on it.

This just takes it further that way.

Well and I guess because it is sponsored by Siemens, I shouldn't be surprised. They would be very interested in those kind of applications probably.

</comment><comment><USER4> Previously: [https://news.ycombinator.com/item?id=6767212](https://news.ycombinator.com/item?id=6767212)

</comment><comment><AUTHOR> FWIW, I heard about this from attending ContainerCon in Seattle this week. Here's the link to the talk: [http://lccocc2015.sched.org/event/6549b913b1cdbad4431352203b...](http://lccocc2015.sched.org/event/6549b913b1cdbad4431352203bfec2b6?iframe=no&w=&sidebar=yes&bg=no#.VdfElixVhBc)</comment>


Saying Goodbye to Google Services - <AUTHOR> https://danielmiessler.com/blog/saying-goodbye-to-google-services/?fb_ref=e0550e3ecdec470994a4fca81ee9c009-Hackernews <comment><USER2> Title needs year!

Are we supposed to bask in your prescience? How has your quest for non-Google services progressed in the near-year since that post?

</comment><comment><USER3> I'm kind of disappointed that this article is just an open letter to Google outlining why the author is choosing to leave, and not a piece on the alternatives and the experience transitioning.

</comment><comment><USER4> In my opinion Google is only doing better and better. Their new material design is easy to work with, though they aren't using it yet on all of their services. I'm also pretty excited about their domain name hosting.

</comment><comment><USER5> Lots of people are frustrated by Google's behavior and half-baked products that they throw together and later abandon. Google is the antithesis of Steve Jobs' famous saying:

       I'm actually as proud of the things we haven't
       done as the things I have done. Innovation is
       saying no to 1,000 things.

But, this is nothing new about Google. Not sure there's much to discuss here.</comment>


Theranos' Hail Mary pass: A tabletop laboratory - <AUTHOR> http://www.cnn.com/2016/08/01/health/theranos-table-top-laboratory/ <comment><USER2> I've worked in corporations and Silicon Valley to see a plant article a mile away.</comment>


Funny but telling Homeaway ad attacks Airbnb - <AUTHOR> http://www.wsj.com/articles/homeaway-mocks-airbnb-sharing-economy-in-new-ad-1453093262 <comment><USER2> I know a girl who lives in the Marina district of SF and rents part of her rent controlled apartment on airbnb for $200 a night to subsidize her lifestyle. She doesn't list in the ad that 1.) you are sharing the apartment and a bathroom with her roommate and 2.) that there is a dog in her apartment. She has even asked people who stayed at the airbnb to take care of her dog for her!!

Then she wonders why people get pissed and complain. However people are afraid to leave her negative reviews because they don't want her to leave them a negative review as well. It's ridiculous.

In my travels I have found airbnbs to be annoying (too many rules about when you can and can't show up, what you can and can't do, etc) and just went back to mid-range hotels. At least I can eat in my room, bring my own booze and not worry about having to show up before 9pm. The security deposits and cleaning fees also imo make airbnbs not worth it.

<comment><USER3> > However people are afraid to leave her negative reviews because they don't > want her to leave them a negative review as well. It's ridiculous.

I work at Airbnb. Maybe we have to do a better job of making it clear that the review is double-blind, to prevent this dilemma. Go ahead and write an accurate review. It can't be seen by the other party (or anyone else) until two weeks have passed or the other person wrote their review, whichever comes first.

<comment><USER2> Oh that's good to know! Thanks for letting me know.

</comment></comment></comment><comment><AUTHOR> Interesting that Homeaway is trying to position itself between market segments. They are a sharing model, but they aren't sharing economy like Airbnb. They are a hospitality company but not like Hilton.

As funny as the video is, and while it addresses possible ickynightmare scenarios, it apparently does not reflect the sentiments of the millions (and growing) of happy repeat sharing economy consumers :)

Also, Nick Offerman FTW.</comment>


Liquid cooled bulbs ready for summer (another LED replacement bulb) - <AUTHOR> http://news.cnet.com/8301-11386_3-57428934-76/liquid-cooled-led-bulbs-ready-for-summer/

<comment><AUTHOR> Another take on the LED incandescent bulb replacement, although in this case they use a fluid inside the bulb to aid in heat convection outside of the bulb.

I'm always curious to know if anyone is working on a high temperature LED material which would not be as susceptible to heat death as current LEDs.</comment>


Grails 4 GA Released - <AUTHOR> https://objectcomputing.com/news/2019/07/11/grails-4-ga-released <comment><USER2> Grails 4 is a fairly critical release for that ecosystem.

I think it has to be said that Grails 3 was a failure because it updated nearly everything but failed to improve much that anybody cared about and made a bunch of things worse - including, worst of all, it did nothing but exacerbate the bloat and slowness.

Even despite all of that I still don't know a framework for the JVM that is as comprehensively full stack as Grails, so I think it has a chance. But it really has to hit it out of the park. For now, I'm relatively happy just using Micronaut and piecing together a lightweight system on top of that.

</comment><comment><USER3> Love what the grails and groovy teams keep pushing out.</comment>


This is 'iPhone XS' - <AUTHOR> https://9to5mac.com/2018/08/30/2018-iphone-xs-design-larger-version-gold-exclusive/ <comment><USER2> "...will come in two sizes including a larger version"

Two sizes generally includes a larger one... so I guess I can't fault the author's logic.

</comment><comment><USER3> I know Apple have gotten away with names HN have disliked, but XS sounds like Extra Small.

iPhone XS sounds like the follow up to iPhone SE ...

<comment><USER4> The entire world knows XS is 'extra small'. These cryptic abbreviations should stop. I've always wondered why Samsung's flagship is called 'Galaxy S#'.

<comment><USER5> In music theory context, sharp implies augmentation. Maybe that's why? (No idea)

<comment><USER6> It's not the Galaxy S#, it's the Galaxy S7, S8, S9, etc. (i.e. the # is replaced by whatever number).

</comment></comment></comment></comment><comment><USER7> By the name, I imagined it would be a successor to the iPhone SE, probably the only smartphone in the market I can comfortably use with just the one hand.

It turns out it's anything but that.

</comment><comment><USER8> If this is the name, I bet it will be Xs not XS.</comment>


Why is it acceptable for native apps to have sound effects? - <AUTHOR>

There seems to be a double standard in software development on the topic of sound effects. Native applications (twitter app, operating systems, etc) have sound effects. Web applications do not. Any ideas why this split in ux has occurred? Is this still a hold over from the 90's websites that abused sound effects? <comment><USER2> You may be using a web app on a PC or a tablet, and if that's the case you may have several browser windows or tabs open: The result would be that a window you aren't looking at would suddenly produce a sound effect.

A mobile app on the other hand tends to be a peer to a web browser in that it takes over all of the screen real estate on the device, so it's assumed that you are just looking at that app at that time.

Also sound effects for an app aren't a left over thing from the 90s: Your app may be a video game! And if that's the case you really want that sound.

But as an interface designer I beg to to not think "all sound is bad". Sound is like anything else: It's a very good thing when used correctly in the right context.

</comment><comment><USER3> In a nutshell, I'd say it's probably because native apps use core mobile OS services (like sound), and web apps don't (for the most part).

<comment><AUTHOR> Interesting, I think having sound effects gives a significant advantage to native apps because it creates a more stimulating experience.

<comment><USER4> I don't think I know anyone who doesn't turn off the sound effects as soon as they discover them.</comment></comment></comment>


American strategy, military spending and collective defence in the Indo-Pacific - <AUTHOR> https://www.ussc.edu.au/analysis/averting-crisis-american-strategy-military-spending-and-collective-defence-in-the-indo-pacific <comment><USER2> None of the 9 points in the 'Australia should' list mention the Australian economy at all.

Australia is in a 'lose-lose' situation. If it goes wholeheartedly with the US, it loses the 30% of its economy that makes China its greatest trade partner. If it goes wholeheartedly with China, it loses out financially and security-wise (and very likely, plus sanctions) without the US's backing.

At some point or other, and very soon, Australia will have to choose whether it is on America's side or on China's side.

In the long run, Australia would be much better off to choose the ascendant China. But racially and ideologically, it will choose the US and join the general collapse of the West.

It's all arithmetic. Figures don't lie the way you want them to. Two plus two always equals four. China _alone_ has a greater manufacturing capacity and a greater number of men of military age than the _whole_ of the West ('Five Eyes' plus Europe).

</comment><comment><USER3> From the start,it's crazy to work under the assumption that we should have total control over the Indo-Pacific, but this just gets ridiculous.

After bemoaning how they only had two super huge budget increases since 2012, they move on to how the pesky democracy gets in the way of US strategic influence. How dare the Republicans not have complete unity over Trump's recommended plan, and the Democrats can't do anything when half their party wants lower military spending.

How do you write such an analysis without once mentioning our ongoing military operation in Yemen's Indian Ocean?

It's surprising the recommendations don't appear to include a coup.

</comment><comment><AUTHOR> Tried to access [https://www.thetimes.co.uk/article/us-would-lose-any-war- fou...](https://www.thetimes.co.uk/article/us-would-lose-any-war-fought-in- the-pacific-with-china-7j90bjs5b) but it's paywalled. Then stumbled onto this edu.au report based on googling around a couple of key terms.</comment>


High-Performance Log Parsing in Haskell: Part One - <AUTHOR> https://blog.safaribooksonline.com/2015/03/30/high-performance-log-parsing-in-haskell-part-one/

<comment><USER2> """ We write a lot of Python here at Safari, in fact it's our most widely-used language. Because it's a very high-level language, it was likely it would satisfy my second requirement. But my experience with writing log parsers in Python before–even when using tricks like lazy evaluation–led me to suspect that it would not do so well in satisfying the first requirement. """

How can one say one parse is high performance and another isn't if no comparison is made? e.g. the author could use pylogsparser and benchmark it:

[https://pypi.python.org/pypi/pylogsparser/0.8](https://pypi.python.org/pypi/pylogsparser/0.8)

Then we can get an idea of whether the project set out to meet its goal of being quicker than python.

In any event, I'd be interested to see how luajit-lpeg compares to their haskell impl. It even has a nice online test tool:

[http://lpeg.trink.com/share/syslog](http://lpeg.trink.com/share/syslog)

<comment><USER3> Author here. Thanks for pointing me to pylogsparser, I'll definitely take a look at that. Your point is well taken: without building a parallel implementation in Python, we don't have a way of knowing for sure if Haskell is faster. The only data points I have are that we've built a couple of logparsers for custom formats in Python before this, and the number of lines parsed/second was far smaller than the attoparsec-based parser.[1] It's not apples-to-apples, since the formats differ a bit, but I don't think that it has no predictive value. So in the second part of this post, which I'm working on now, I'm hoping to be able to provide a fully-functional NCSA combined log format parser in Haskell alongside the blog post. I think that would be fairly easy to benchmark since it's a common-enough log format.

[1] that's just measuring the time to parse log files into some sort of structured data, not necessarily to do anything with it

<comment><USER4> Thanks for the article, I think you're missing some code, it seems that every time you have a `do` block in your code samples most of the code is cut off (I assume).

<comment><USER3> Thanks for pointing that out; I think the syntax highlighter may have clobbered some code. It's now fixed.

</comment></comment></comment></comment><comment><USER5> Hey, that's pretty cool!

After playing with Haskell for the last two years, I figured that it would be pretty damn hard to write conventional LAMP/JS webpages in Haskell, but I still wanted to try to solve some of my _real world_ problems with it.

So I'm parsing the log files that my LAMP stuff produces.

So far it's a very fun and frustrating waste of time, but given my recent progress, it will probably become a slightly less fun and frustrating time saver.

I just recently cleared up some confusion and type errors coming from ByteString/Lazy ByteString/Text/Whatever conversion issues (which made up 95% of the recent frustration, as every other language I'm using right now has _one_ single sort of string (which more than often serves to contain ints ;))

... and database CRUD and JSON typeclass instances have appeared as if by magic.

Awesome!

And now I can celebrate by unleashing that stuff tens of megs of logs, opening top, and then seeing the executable instantly eat up all my RAM, before slowly conceding space to the postgres server.

Hopefully your post will help me implement streaming.

Cheers!

<comment><USER6> > After playing with Haskell for the last two years, I figured that it would > be pretty damn hard to write conventional LAMP/JS webpages in Haskell, but I > still wanted to try to solve some of my real world problems with it.

Really?

You should check out:

[http://adit.io/posts/2013-04-15-making-a-website-with- haskel...](http://adit.io/posts/2013-04-15-making-a-website-with-haskell.html)

<comment><USER5> I already got a few libraries and frameworks up and running (including scotty, actually, which is really cute), but somehow I can never have everything I want at the _same time_...

Some tutorials will have a few routes and a DB, some other will have an intricate rendering and templating architecture and basically no data storage solution, some are more or less a hello world with a session manager... And there's Yesod, which seems to do everything out of the box, but which has such a colossal amount of dependencies that I never got anything to build beyond fresh yesod-init setups, which still manage to fail on my current setup, despite using Stackage _and_ sandboxes.

Among what I've seen in Haskell, ORMs and web frameworks are the two types of libraries that carry the largest and most cumbersome monad transformer stacks around; making a website involves having to typecheck a huge monad transformer into another huge monad transformer. This is not easy.

Not to mention that, in the world of open-source web developement, nearly all the documentation, expertise, copy-pastable code examples and standard practices are in dynamic OOP languages.

Perhaps the ease of RoR, PHP and Node has let everybody forget how much stuff is involved in making modern webpages : )

<comment><USER6> > including scotty, actually, which is really cute

You know people use Scotty in production right? It's more than cute, though I agree that most Haskell library/framework documentation could use some work.

> And there's Yesod, which seems to do everything out of the box, but which > has such a colossal amount of dependencies that I never got anything to > build beyond fresh yesod-init setups, which still manage to fail on my > current setup, despite using Stackage and sandboxes.

Hm, did you try only using Stackage or sandboxes? If your up for another solution, I know Halcyon[0] is supposed to be very frictionless.

> Among what I've seen in Haskell, ORMs and web frameworks are the two types > of libraries that carry the largest and most cumbersome monad transformer > stacks around; making a website involves having to typecheck a huge monad > transformer into another huge monad transformer. This is not easy.

Matter of opinion? I find Scotty and Snaps monad transformer stacks to be pretty simple. This is something that becomes easy with experience I think, just like getting used to using composition over inheritance.

> Not to mention that, in the world of open-source web developement, nearly > all the documentation, expertise, copy-pastable code examples and standard > practices are in dynamic OOP languages.

Mostly a function of manpower available I'm guessing. I find when you ask for examples or file bugs against libraries/frameworks they are responded to quickly though.

> Perhaps the ease of RoR, PHP and Node has let everybody forget how much > stuff is involved in making modern webpages : )

You just have to remember how much polish they have and how it was nowhere near this easy in the beginning.

<comment><USER5> Yeah, I meant "cute" more in the sense of "elegant". Unfortunately it felt too barebones and there wasn't enough documentation to let me get everything running. I like that lib, though.

...

Halcyon, I'l remember that. I still have to try Nix one day, too

...

Matter of experience, I guess, yeah

...

Precisely, there's a virtuous cycle going around popular platforms due to the larger amounts of features and documentation getting written, and in turn, the larger amount of new devs getting into it. Shame those platforms are built on such bad languages... It's cool to see the web evolving in a direction where Haskell can solve very specific problems without disrupting people's stacks.

</comment></comment></comment></comment></comment><comment><USER7> _" In type-system theory this is called a "Sum Type" because we can define all possible representations"_

It is indeed a sum type, but I don't think that is why (or true of all sum types, or less true of product types). It sounds like they are conflating "enum"?

As an example of a product type for whom we can define every possible representation: ((),()) has precisely one representation.

As an exampe of a sum type for whom there are infinite representations: (Either String Integer)

My understanding has it that it is called a sum type because 1) for finite types the number of representations is the sum of the number of representations under each tag, and 2) it behaves more generally like a sum (a^x * a^y = a^(x+y) is an equality in arithmetic, (x -> a, y -> a) is isomorphic to ((Either x y) -> a) in programming).

<comment><USER3> That's a good point. A sum type/disjoint union (by my understanding) means the type is in the union of subsets and that the subsets are pairwise disjoint, but it doesn't say that the subsets have to be finite. Since this post is really aimed at Haskell beginners, I was trying to avoid going down the rabbit hole as regards type system or set theory and I might have oversimplified in the process.

</comment></comment><comment><USER8> > Sequencing parsers applicatively allows the compiler to perform static > analysis on a parser without running it. This knowledge can be used to avoid > things like backtracking that may slow your parser down. This is not > possible when sequencing parsers monadically because the grammar of each > parser depends on the previous one. However, performance results in this > case are probably negligible; don't hesitate to choose do-notation if you > find it easier to read.

Would be good to talk more about this and quantify too. Very interesting topic.

<comment><USER6> Maybe this paper[0] on using Applicatives for performance and concurrency in Haskell's Haxl will help.

Also note that there is a feature proposal[1] for Applicative Do notation.

0: [http://community.haskell.org/~simonmar/papers/haxl- icfp14.pd...](http://community.haskell.org/~simonmar/papers/haxl-icfp14.pdf)

1: [https://ghc.haskell.org/trac/ghc/wiki/ApplicativeDo](https://ghc.haskell.org/trac/ghc/wiki/ApplicativeDo)</comment></comment>


Discovering the brain's nightly "rinse cycle" - <AUTHOR> https://directorsblog.nih.gov/2020/03/05/discovering-the-brains-nightly-rinse-cycle/ <comment><USER2> If I could pick one of the things to optimize all of society around, it would be sleep. I believe that many of society's ills can be traced back to people being sleep deprived on average. Modern society both ignorantly and through sheer foolishness undervalues sleep. I understand the emotional motivation for a statement like, "you can sleep when you're dead," but I do despise this prevelant sentiment which has become a culutre.

<comment><USER3> Our society is so focused on productivity that we forget that the foundation for improved productivity is sleep, exercise and diet. Mind & Body, one system.

<comment><USER4> I enjoy my sleep thoroughly and I sleep 7-8 hours a day. Still, I think it's a waste of time, and I don't mean work productivity, but life. You sleep, wake up, and surprise, a third of the day has just gone by and you didn't even notice.

I recognize the need to sleep, but I personally just wished we could develop a way to keep going with your day without sleeping. If that were physically possible, I'd just meditate some few hours daily instead of sleeping 7-8 hours.

<comment><USER5> If you factor in that during sleep your body is actively restoring your organs, and mind is flushing/filing the info collected during the wake hours. How many hours needed for that is an intriguing question. But hardly this time is wasted, unless your sleep is ... restless.

I recently watched an episode of "Nova" on the subject of sleep (Mysteries of Sleep), very convincing , even to some toddlers fussy about the sleep as usual :)

<comment><USER6> Still, it's upkeep. It's necessary, but I wish it wasn't, because it's expensive.

<comment><USER4> Exactly my point

</comment></comment></comment></comment></comment></comment><comment><USER7> As an airline employee who sometimes faces large shifts in sleep times, I've become quite worried about brain health. Papers like this and Matthew Walker's recent popularity seem to have brought more attention to the issue. Last week I slept from 9pm - 2:30am, 12am - 7am, 7am - 11am, 9pm - 6am, in that order. The week before I had to wake up at 1am two days in a row. It isn't possible to function normally on such a schedule and it's horrible for your health, yet that fact is completely ignored. I'd be considered alarmist and met with a "suck it up" attitude if I were to take a stand against such things. The FAA wipes their hands of it by saying that it's "your responsibility" to make sure you've gotten adequate rest and to call in fatigued if you haven't, but one would soon lose their job for doing so as often as would truly be required. Flying an airliner is easy, but we have two pilots because one or both are often totally exhausted, whether they realize it or not. Operating on "stem power" is a phrase sometimes used, as in, 'so tired that your higher level functions are shot and you're operating on brain stem power alone'.

<comment><USER8> I feel your pain... Reminded me how quite similar it seems to be for hospital staff: alternating night and day shifts, extra long shifts like 24hr of continuous work. When asking "but how can you deal with it and know you keep working properly at all time?", answers consistently seemed to dismiss it being an issue like "oh, you get used to it..." but I must admit I'm still having a hard time believing it...

</comment></comment><comment><USER9> I was in a car accident once and injured my neck. I got a lot of mental fatigue afterwards and in particular the angle of my neck can trigger a lot of tiredness very quickly and reliably. It comes with a swooshing squirting sound in the back of my head... iirc other people can hear it too when it happens.

I can't help but wonder if it's related to this rinse system in some way. Luckily it has improved a ton over the years but a bent neck still triggers it and I never found out why

<comment><USER10> You could have some kind of malformation or inflammation from your injury causing a build up of cerebral fluid, so when you move it's able to rush past into the spine and make the funky fluid noises. In perfectly healthy people, the flow is controlled by a sort of tonsil, and during movement or laughing/coughing it is able to escape into the spine as well. In people who have a malformation from birth, it can cause all kinds of physical developmental issues like lopsided muscle reactions, scoliosis and such. It also gets worse and worse, not better.

I'm not a doctor, just had a close family member with a malformation there which was corrected with surgery. You should really see a specialist!

<comment><USER9> Interesting. What sort of specialist knows about that?

<comment><USER10> In my family members case, an orthopaedic surgeon diagnosed the issue, but a neuro surgeon was required to confirm the diagnosis and eventually perform the surgery.

The issue they had is known as a Chiari Malformation.

[https://www.ninds.nih.gov/Disorders/Patient-Caregiver- Educat...](https://www.ninds.nih.gov/Disorders/Patient-Caregiver- Education/Fact-Sheets/Chiari-Malformation-Fact-Sheet)

<comment><USER9> Thanks for the info

</comment></comment></comment></comment></comment><comment><USER11> After hearing Michael Pollan's interview on NPR and hearing about caffeine's 6 hour half life, I stopped cold turkey. It really has done wonders for my middle-aged insomnia.

<comment><USER12> It depends on how fast a caffeine metabolizer you are. I've been classified in genetic testing (whatever the reliability of that is) as a fast metabolizer, and I can have a full cup of coffee 2-3 hours before bed and not stay up. Other folks who I know that got slow metabolizer on the test can't have caffeine after noon without it affecting their sleep (maybe this is the case for you).

<comment><USER13> I've drank my first coffee of the day and immediately suffered an intense desire to nap. Coffee just isn't a very intense tool for the job.

<comment><USER14> I've read that one of the symptoms of ADD is the reaction to stimulants. Specifically, they tend to have a calming effect instead of the typical jolt of awareness.

<comment><USER15> Oh, that would explain so, so much.

</comment></comment></comment></comment></comment><comment><USER16> As a solo developer of my own company I pay the price of my own bad decisions every day. A night with proper sleep opens the deepest parts of the brain with strong executive thinking, ability to see alternative solutions to problems, and better personality and attitude. I've come to a point where I wouldn't let myself code if I catch myself wanting to watch movies (hint that my mind needs sleep) and would take a quick nap instead. Even 20 minutes of extra sleep when sleep deprived brings a different mind to the table. There are plenty of times when long coding sessions are necessary, but if you've had one sleep debt is the first that needs paid so your brain can actually move your codebase forward instead of introducing more problems.

</comment><comment><USER17> "The discovery of CSF is attributed to Emanuel Swedenborg (1688-1772), who had graduated from the University of Upsala, Sweden, with a degree in mining and engineering (Fig. 1), Working as a mining engineer, Swedenborg often came across an underground stream of water that lead him to search for its source. As a religious man and a teacher of theology, he took upon himself to search for the seat of the soul. His search for the soul brought him into contact with anatomists in France, Germany, and Italy. Having observed and participated in numerous dissections between 1736 and 1740, he felt prepared to engage in original medical investigations of the brain, which seemed a likely seat of the soul."

<comment><USER18> If he had known what we know now, for example the amount of energy the brain uses, it would have seemed like an even more fantastic device to him (and clearly the seat of the soul).

</comment></comment><comment><USER19> Link to the study: [https://science.sciencemag.org/content/366/6465/628](https://science.sciencemag.org/content/366/6465/628)

</comment><comment><USER20> Sleep deprivation is physical torture.

</comment><comment><USER21> This reminds of of a paper a read a couple years ago.

[https://mdedge-files-live.s3.us- east-2.amazonaws.com/files/s...](https://mdedge-files-live.s3.us- east-2.amazonaws.com/files/s3fs- public/issues/articles/content_74_Suppl_1_SI-128.pdf)

There's also some recent papers on how the glymphatic system differs in people with iNPH

[https://academic.oup.com/brain/article/140/10/2691/4085293](https://academic.oup.com/brain/article/140/10/2691/4085293)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6124518/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6124518/)

[https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6609364/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6609364/)

I suspect some of what we see as singular disorders (Alzheimers, etc...) now will eventually be seen as sets of other distinct disorders.

</comment><comment><USER22> I've always wondered why we need to be unconscious for our brains to recover? Seems like a huge weakness to let your defenses down for so long. And all animals do it! You'd think there would be a huge evolutionary incentive to find a workaround.

<comment><USER5> The body and mind need to slow down to free up time slices for cleaning up the waste. Humans "in wild" are mostly daytime creatures, that's when they're supposed to actively look for food, deal with danger, maybe compete for mates, handle the offsprings. So not much safety to slow down in daytime.

On the other hand, nighttime affords this naturally, though modern society arguably blurrs the utility and safety aspect of nighttime.

Counterexample is some marine mammals, like dolphins and seals, which can shutdown half of their brain for sleep, while the other one is active for safety reasons.

</comment></comment><comment><USER23> > The findings [...] are the first to suggest that the brain's well-known ebb > and flow of blood and electrical activity during sleep may also trigger > cleansing waves of blood and CSF

Oops, I guess the article or researchers missed the prior work on this subject... here's a TED Talk from 6 years ago about this exact mechanism (much more informative than the article): [https://youtu.be/b8uvrdBrdR4](https://youtu.be/b8uvrdBrdR4)

Gotta say though, I'm ecstatic more research is being done in this area and I wholeheartedly support their efforts!

</comment><comment><USER24> I wish the article had discussed a few more details about this "rinse cycle", such as when exactly in the sleep cycle is it that this happens? REM?

<comment><USER25> Non-REM.

> By studying 11 people as they slept, Lewis and her team identified three > parts to the rinse cycle. First, there is electrical activity that's > definitive of slow wave sleep. Then neurons "go quiet" as Lewis puts it, > blood volume within the brain decreases, and cerebral spinal fluid flows > upwards. This flow happens about every 20 seconds during slow wave sleep, > according to the study.

[https://www.inverse.com/article/60583-sleep-rinse-cycle- alzh...](https://www.inverse.com/article/60583-sleep-rinse-cycle-alzheimer-s- toxins)

<comment><USER26> The paragraph you linked doesn't conclude to Non-REM though

<comment><USER25> Slow wave sleep is non-REM [1]. Sorry, should've done the extra legwork and included that as part of the comment you replied to.

[1] [https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2824210/](https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2824210/)

</comment></comment></comment></comment><comment> 1-6 I wonder how important this function is with physical posture during sleep. Does this affect people who fly coach often and do their sleep prone?

<comment><USER27> Yea, I've wondered this exact thing. My guess is yes, but it depends on grade of incline. You also need to compare to supine and if there are other dramatic sleep interferences due to GERD or sleep apnea that would make supine worse in other ways.

</comment></comment><comment><USER28> Watch the latest episode of Nova, Mysteries of Sleep, lots of good stuff like this.

</comment><comment><USER29> Besides for the headline, there is no mention of this "rinse cycle" only happening if sleeping during night. People sleeping the entire day instead, also experience the "rinse cycle".

</comment><comment><USER30> Does meditation have the same effect?

<comment><USER31> One anecdote you keep hearing about some very advanced practitioners is that they sleep less, with no apparent ill effects. Perhaps that's worth investigating.

<comment><USER32> People on a Ketogenic diet report need only 6 hours of sleep with no adverse effects. I am on Keto plus I also meditate, and I currently sleep 4-5 hours a night, but I'm feeling awake and refreshed. This is both awesome as I used to be an owl, and it freaks me the hell out. This is completely unreal, and I wonder if its going to last or if it is just the usual temporary keto insomnia due to disrupted melatonin synthesis. It needs glucose and takes a while to adapt (Glucose -> L-Tryptophan -> Serotonin -> Melatonin).

<comment><USER33> Anecdotally, I experience the same thing when I'm on keto. I have much more energy during the day and I'm not groggy in the morning. Otherwise, it's nearly impossible for me to wake up even if I've had 8+ hours of sleep, and I often sleep through my alarm.

</comment></comment></comment></comment><comment><USER34> its the deep BASS bombs that killed my sleep cycle a few years ago: [https://www.ncbi.nlm.nih.gov/pubmed/15273026](https://www.ncbi.nlm.nih.gov/pubmed/15273026)

it just permeates through every surface.. you literally go nuts after a few nights. I finally had to move to lovely Patagonia.

</comment><comment><USER35> Cool.

If sleep is something chemical it may be easier to improve than if it was something psychological/neurological.

</comment><comment><USER36> If someone could make a machine that allows us to only sleep 4 hours per night but provides the same benefit of a full rested 8-hour sleep, I'd shout TAKE MY $$.

I envy those who can actually pull this out due to some genes. Lucky bastards...

</comment><comment><USER37> i don't trust this plane at all and can barely trust boeing's other planes now. i certainly don't trust the FAA or beoing themselves. this essentially amounts to a government bailout by the FAA. from their language on their own website, the FAA seems to be minimizing the widely publicized internal issues at boeing that led to the 737 max. is there a way to submit complaints or comments to this process, given the FAA is a public, government organization?

</comment><comment><USER38> I'm surprised to see no mention of the recently discovered glymphatic system[0] which is responsible for this rinsing. Very much looking forward to research into drugs which modulate the function of the glymphatic system, as they could potentially solve one of my most difficult life problems, sleep.

It's crazy that we only recently discovered such a critical and [physically] widespread biological component. Makes me wonder what other "obvious" things we've yet to stumble upon.

0\. [https://en.m.wikipedia.org/wiki/Glymphatic_system](https://en.m.wikipedia.org/wiki/Glymphatic_system)

<comment><USER39> This is a negative view of it, but it makes me wonder what the culture is in the biological and medical fields. Is there a resistance to new concepts?

<comment><USER40> while technology is very advanced it still has a lot of limits. Watching what is happening in someone's brain without damaging them is quite difficult. From the article "Currently, people who volunteer for such experiments have to be able to fall asleep while wearing an electroencephalogram (EEG) cap inside of a noisy MRI machine—no easy feat." So it would seem that studying internal brain activity during healthy sleep is indeed a challenge.

<comment><USER41> Imagine some years into future we will find that sleep does not work the way we thought because all data was from selected few unnormal enough to be able to sleep inside mri machine.</comment></comment></comment></comment>


Ask YC: SBIR, STTR? - <AUTHOR>

Has anyone in the HN community taken money through the government's SBIR (small business innovation research) or STTR (Small Business Technology Transfer) programs? In casually chatting with someone today and telling them what our startup's goals are, I was told, "Hey, you should look into SBIR and STTR." The person with whom I was chatting didn't really know much past passing a reference though so I'm wondering if anybody on HN can provide some enlightenment. <comment><USER2> My mom runs an sbir funded company and it has really worked out well for her. It takes a while to get up to speed as a business - you start out writing phase 1 proposals that will give you 100K for a project, and you might get funded ten percent of the time. But once you have the phase 1, you have maybe a one in two shot of making it to a phase 2 grant, which is funded at a much higher rate.

But keep in mind that you would be doing government contracting, and there are a lot of hoops that you have to go through, like doing accounting the government way, filing out reports and the like. So it is a big undertaking.

Anyway, you can drop me a line if you want to know more. And my mom is always looking for collaboraters, but her focus is in x-ray and neutron detectors...

</comment><comment><USER3> We received a Phase I SBIR in 2005 and we just got our Phase II, from the NIH. I've written 3 proposals, so that puts my success at 33%.

The posters who suggest it is easy money to get are cocky and I feel mostly wrong. The typical success rate for Phase I's are in the 10-20% range, and Phase II is higher, but not 50%. The problem is that each government agency has its own policies and success rates, as well, the judging is based on who else is submitting during the current cycle (and even when in the fiscal year the cycle occurs). Each agency has a certain set-aside $, so it all depends on how much they have and the scores of those you're competing with.

I think the biggest problem is that large businesses rightfully recognize that the SBIR/STTR process can be a cash cow, so they set up dedicated panels and proposal writers to vet and sharpen proposals, and then find a small company that can qualify and go after the $.

It can be good money (it is helping us enormously), but it's an arduous process. My best advice is to get a grant writer or grant coach who really knows the agency you're going after, and has a good track record. You will pay a few thousand dollars for help in writing the grant, and perhaps 5% if you win the grant, but it is well worth it. I found that just our coach's experience with handling the budget and now the electronic filing was well worth the fee.

</comment><comment><USER4> At Pitt I heard a presentation about getting SBIR/STTR loans from a consultant who helped people get those loans. His advice was to hire a consultant to help you jump through the hoops.

</comment><comment><USER5> I was the CEO for a company that one Phase I and Phase II SBIR grants joint with a University, and it can be a very good thing if the goals of the grant and your product goals are closely aligned. The goal of the grant is to fund the product development, not to make you rich, and you'll make a very small (like <10%) margin on the work.

</comment><comment><USER6> They are a bad idea for startups, I think.

It's easy to win them, but government money is like crack. You are locked into their cycle and it will make it harder to innovate.

That said, you'd be surprised to learn how easy it is to win a few hundred thousand dollars.

If you want to make a boutique research company, go ahead.

<comment><USER7> Do have any experience with SBIR-type loans, or know anyone who has any? Were you surprised to learn how easy it was? I'd love to hear the anecdotes.

<comment><USER6> I've worked on half a dozen, and written as many proposals. You need to write a 20 page proposal, and you get a stage 1 round. It's usually smallish like $100K.

You ask what the sponsor wants you to build, build it with $20K, use the rest on real work, and then get a $700K check to do a bigger project. You should be able to get a product to market with that money.

The problem is that the government doesn't expect you to do that. You meet expectations and just finish the work while writing other proposals. It isn't conducive to a growth startup.

For example, iRobot was a boutique research firm for almost a decade before they finally decided to make a product. I used to work for CRA in cambridge. That's still their schtick.</comment></comment></comment>


The trouble with saying you don't want children - <AUTHOR> http://www.bbc.com/news/magazine-34916433 <comment><USER2> Why does anyone care if someone else doesn't want kids? I mean, I have kids but I couldn't give a toss if others don't want to procreate. Its not like the species is at risk.

<comment><USER3> Because society as a whole spent resources on you to educate you and turn you into productive member of the society.

Its your responsibility to repay that debt by reproducing.

This is one of the strange explanations I usually get.

<comment><USER4> That's actually not a strange argument. It's semantically identical to the widely-held belief that the benefits of order, safety, and education granted by the government morally obligates one to pay taxes.

</comment></comment></comment><comment><USER5> HN comments on the previous story:

[https://news.ycombinator.com/item?id=10609524](https://news.ycombinator.com/item?id=10609524)

This is why I don't talk about this decision, although I admit that's not a great solution.

</comment><comment><AUTHOR> I wish there was some way that Twitter et al could automatically filter hate messages. Some sort of clever language processing system that can detect tone?

<comment><USER6> It's almost a worst-case scenario for current AI, though. It wants volume of text for confidence, and Twitter guarantees the nonexistence of that.

<comment><USER7> If you added the equivalent of a spam button ("I don't like this"), took the user's history into account, and relations with other users, would there be a way to pre-flag posts much like a spam detector?

Although I suppose even if it were an interesting and feasible AI project, and even if it were useful to some users, it's probably something Twitter just wouldn't want to get into. They would be setting themselves up for endless political flak when it did or didn't work correctly.

<comment><AUTHOR> Problem with that approach is that a lot of the worst trolling comes from one- time accounts.

I think twitter probably needs to do something about this, however. Or soon (if it isn't already) it'll become as big a cesspit as reddit, and soon after that be replaced by the next new and clean service.

<comment><USER8> In that scenario, it should be doable from Twitter not to have new accounts to have the ability to @ at some other account for the first 24 hours after creation or something and maybe after 24 hours to be able to @ at someone the new account must have at least 5 follower which in turn have at least 5 followers or something. Maybe not full-proof but it will weed out quite a bit of new accounts purely created for trolling.

I'm sure Twitter themselves should be able to come up with a more effective method but it seems they simply don't want to...</comment></comment></comment></comment></comment>


Australia's oldest working scientist at 102, fights to stay at university - <AUTHOR> http://www.abc.net.au/news/2016-08-27/david-goodall:-australia%27s-oldest-working-scientist/7788844 <comment><USER2> _He lives alone unassisted, does his own shopping on the weekends and travels to the Joondalup campus at least four days a week, making the 90-minute commute that involves catching two buses and a train._

It's fascinating -- and inspiring -- to see how mentally and physically capable some people remain into their 100s.

Is it good genes? Good lifestyle? Good environment? Good luck? Maybe it's all of these.</comment>


Oracle embraces SQLite; wraps it around BerkeleyDB as SQL API - <AUTHOR> http://www.oracle.com/technology/products/berkeley-db/sql.html

<comment><USER2> This post just generated a tremendous amount of discussion in my company. Not just for the SQLite wrapper, but also about the Berkeley XML DB. Anyone have experience using Berkeley for medium-to-large scale data stores (1-100GB?)? How's the concurrency? What's the licensing model? Is there a way we can use this without having to give away our source?

<comment><AUTHOR> I don't have experience with the Berkeley XML DB. I have used the BerkeleyDB 'Java Edition' (a different codebase and on-disk format) for multi-GB spill- to-disk queues and maps/sets.

The BerkeleyDB license is roughly: free to include in open-source projects, pay if you want to redistribute as part of a closed-source product. So like with the GPL, using strictly inside your company might not be considered 'distribution'. But also, if you are selling software licenses their bundling rates might not be bad compared to your unit price. Of course, do your own license analysis before business use.

<comment><USER3> What would be the licensing model if the product is open source, but is NOT free (i.e., customers are charged for an open-source product in which BDB is used)?

<comment><AUTHOR> You need to do your own analysis, not trusting some random guy on the internet (eg, me). But:

(1) If people need to pay to use, it's not "open source" by the "open source definition" of the OSI: <[http://www.opensource.org/docs/osd>](http://www.opensource.org/docs/osd>);

(2) Contacting Oracle/BDB will let you know what _they_ think your obligations are.

</comment></comment></comment></comment><comment><USER4> Excellent. Now I can say, "I'm using Oracle" and still get some work done too.

<comment><USER5> that phrasing just sounds wrong to me.

</comment></comment><comment><USER6> Is it faster? More reliable? A way to trick people into paying for SQLite?

<comment><AUTHOR> The claims in the announcement email I received were performance-related:

 _\- SQL Performance

\-- 10s of thousands of INSERTS/UPDATES/DELETES per-second

\-- 100s of thousands of SELECTs per-second

\-- Approximately as fast as SQLite for reads (within 10%)

\-- About 3X faster than SQLite for updates/writes

\-- Has fine grained locking which leads to better read/write concurrency

\-- 6-8x more transactions/second compared to SQLite when using multiple threads_

</comment></comment><comment><USER7> I'm not sure I get the point of this. Two of SQLites strong points (among many others) are: (a) Short dependency list (b) Platform independent filesystem storage

..doesn't this negate both of those for what seems like little gain?

<comment><AUTHOR> BerkeleyDB doesn't have many dependencies, uses only plain files as storage, and is itself highly-portable open source (with a quasi-copyleft condition).

So you don't give up much to get the claimed benefits of this combination -- only the ability to use public-domain SQLite in proprietary distributed software.

<comment><USER8> SQLite outperforms it by far. That could also weigh in a little :)

<comment><USER9> Do you have any benchmarks to support that claim?

<comment><USER10> I do. I wrote a tool to help me understand what I could do on various storage tiers running as safely as possible. Here's one of my results from linode:

<http://skitch.com/dlsspy/nh2qb/kvtest-results-on-linode>

Here's the code: <http://github.com/dustin/kvtest>

Depending on what you're doing and how safe you want it, you can adjust inputs to select a different winner.

<comment><AUTHOR> What does the 'auditable' qualifier (which seems to make the difference between SQLite beating BDB, or BDB beating SQLite) mean?

<comment><USER10> auditable means every revision of every change was saved in a fashion that allows you to go back in time and what-not.

Specifically, it means this: [http://github.com/dustin/kvtest/blob/master/sqlite- base.cc#L...](http://github.com/dustin/kvtest/blob/master/sqlite-base.cc#L164)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> So would that mean that you could easily and transparently use this as a backend for something with a sqlite interface, say for example Django?

<comment><USER12> Yes, but more importantly, this should allow concurrency to the database. You can now have multiple writers to the same underlying database.

Previously, I believe SQLITE would lock the entire database any time you accessed it.

</comment></comment><comment><USER8> I have nothing but good things to say about SQLite. Small. No dependencies. Lightning fast. Public domain. I use it exclusively for all things databases where the customer for whatever reason does not demand one of the other players. I'm glad to see a major actor in the DB industry picking up on it.

<comment><USER10> Most importantly: The best tested software out there: <http://www.sqlite.org/testing.html>

"As of version 3.6.23 (all statistics in the report are against that release of SQLite), the SQLite library consists of approximately 67.2 KSLOC of C code. (KSLOC means thousands of "Source Lines Of Code" or, in other words, lines of code excluding blank lines and comments.) By comparison, the project has 679 times as much test code and test scripts - 45678.3 KSLOC."

</comment></comment><comment><USER13> anybody have any idea how this might compare to mysql inno or myisam?

<comment><USER12> It's roughly comparable to innodb in that it's ACID compliant.

MyISAM doesn't support transactions or transaction logging, so it's not as durable as INNODB or BDB.</comment></comment>


Show HN: Sqlata, the SQL builder I wanted - <AUTHOR> https://github.com/lethalman/sqlata <comment><USER2> This looks similar to knex.

<comment><AUTHOR> I've looked at knex. But I felt it not to be as composable as sqlata.

In knex operators are written with .where() itself. Also it doesn't manage table aliases apparently. And it's quite tied to an underlying connection as I can see.

But yes, all the sql bulders out there are quite similar, but there are notable differences compared to sqlata if you look deeper.</comment></comment>


Gerald Ford Rushed Out a Vaccine. It Was a Fiasco - <AUTHOR> https://www.nytimes.com/2020/09/02/opinion/coronavirus-vaccine-trump.html <comment><USER2> [http://archive.is/BqKOI](http://archive.is/BqKOI)

</comment><comment><USER3> New vaccines are tested heavily for a good reason. Sometimes autoimmune response is detected after the vaccine has been already accepted.

During the 2009 A(H1N1) influenza pandemic Finnish health system used vaccine called Pandemrix, It was almost exactly the same as Focetria used elsewhere in the Europe but it was manufactured using slightly different method.

It caused Narcolepsy for 200 kids (normally there is only 50 new cases of narcolepsy per year in Finland).</comment>


How to unc0ver a 0-day in 4 hours or less - <AUTHOR> https://googleprojectzero.blogspot.com/2020/07/how-to-unc0ver-0-day-in-4-hours-or-less.html <comment><USER2> > So, to summarize: the LightSpeed bug was fixed in iOS 12 with a patch that > didn't address the root cause and instead just turned the race condition > double-free into a memory leak. Then, in iOS 13, this memory leak was > identified as a bug and "fixed" by reintroducing the original bug, again > without addressing the root cause of the issue. And this security regression > could have been found trivially by running the original POC from the blog > post.

Yikes. Especially looking at the diff of the original problematic fix, it seems like they slapped a quick patch on there and called it a day, instead of investigating to find the underlying architectural issue. Doesn't really inspire a lot of confidence that the resolution for unc0ver is any more thought-through. I wonder if they've identified the root-cause? That'd be the real interesting piece to me.

<comment><USER3> What's wrong with Apple? Why is modern iOS so buggy?

<comment><USER4> A friend at Apple told me that the testing story for iOS is complete shit, and they actually rely on hundreds of humans to test their software to make up for poor automated testing.

Apple takes the approach of throwing humans instead of automation at a problem quite frequently [1]:

> The press release mentions RMSI, an India-based, geospatial data firm that > creates vegetation and 3D building datasets. And the office's large > headcount (now near 5,000) [used to create Apple Maps]

The lack of automated testing is something Apple is working on fixing, but they're a ways away from having anything substantial. The terrible iOS 13 release quite significantly bumped up the internal priority of stability and testing. iOS 14 is likely to be far less buggy than iOS 13 because of this culture change.

[1]: [https://www.justinobeirne.com/new-apple- maps](https://www.justinobeirne.com/new-apple-maps)

</comment></comment></comment><comment><USER5> > By 1 AM, I had sent Apple a POC and my analysis.

> Still, I'm very happy that Apple patched this issue in a timely manner once > the exploit became public.

Sh- should we be happy Apple fixed this so quickly? unc0ver allows consumers to get more out of their Apple devices, and Apple's fix isn't really optional (unless you disable auto-updates and tap "Later" on every update notification). Is this exploit even an issue? Apple's probably not going to let an app exploiting this zeroday into its App Store and sideloading is difficult; it's very unlikely someone malicious is going to trick people into installing malware that uses this exploit. It sounds to me like Apple is purposefully limiting consumer freedom by actively trying to prevent jailbreaking.

<comment><USER6> Look at the attacks on various human rights activists- those are using the same exploits that jailbreaks use.

Fixing bugs used to attack people means fixing bugs used for jailbreaks. There isn't some magical mechanism by which a jailbreak exploit isn't exploitable but anyone else.

<comment><USER7> Of course, removing the need to jailbreak for such control would mean that this dichotomy would not have to exist…

<comment><USER8> If you remove the need for a jailbreak in order to allow arbitrary code to run on any device, you're allowing arbitrary malware to run on any device.

<comment><USER7> The problem is not running arbitrary code, but running arbitrary code without informed consent. Malware runs without consent. Apple's solution for iOS is removing the ability to run anything completely, bypassing the need to figure out how to obtain consent.

<comment><USER9> > bypassing the need to figure out how to obtain consent

How do you propose getting "informed" consent from an audience who doesn't care and willingly expose everything about themselves and everyone they know to find out which Star Wars character or 80s pop song they are most like? Genuine question, as this doesn't seem the least bit a solved problem anywhere.

<comment><USER10> I don't understand why people think that because some people are clumsy the rest of us have to live in a straight jacket.

<comment><USER9> > why people think that because some people are clumsy

Nobody said anything about clumsy people. As one of many examples, look at all the guides that tell folks to disable SIP and don't explain the risk and really don't even need to disable SIP, the app should just be fixed properly.

There are exceptions of course and good reasons to disable it, so I'm glad Apple has the option, but I'd venture to say 85% of the time it's done by a person who isn't really making an "informed consent".

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Fantastic write-up. It's great to see this level of information sharing, complete with a walkthrough of the author's thought process and strategy for confirming the exploit. It's also interesting that this was a regression of a previously-fixed bug rather than a new exploit.

As a side note, it's disappointing to see so much unfounded criticism here in the comments. Apple was going to find and fix this bug quickly, regardless of the author's efforts. In this case we get a peek into the inner workings of the exploit discovery process that would otherwise remain secret. The author and Apple both clearly noted that unc0ver was the source of the exploit, and the author made no attempts to hide that fact. Calling the author of this blog post "lazy" or an "informant" is out of touch and uncalled for.

</comment><comment><USER12> TL;DR: reverse engineer a jailbreak exploit.

> By 7 PM, I had identified the vulnerability and informed Apple

I don't know why this rubbed me the wrong way. Like, it feels "lazy" (for lack of a better way) to disassemble an exploit and run off to tell the vendor. If anything, the exploit writer should get the credit. I don't know.

<comment><USER13> All this has taught me is that if I find an exploit to unlock <insert DRM'd device> I need to obfuscate the heck out of it to make it as onerous as possible for low-effort bug bounty do-gooders to scoop up a reward from it.

<comment><USER14> Project Zero researchers don't take bounties, to my knowledge.

<comment><USER7> Nor have they been ever offered one, to my knowledge: [https://twitter.com/i41nbeer/status/1027339893335154688](https://twitter.com/i41nbeer/status/1027339893335154688). I'm actually not sure Apple has ever paid a bounty for anything that wasn't a web issue…

<comment><USER15> If memory serves, they've been offered but the bounties are always been given to charity.

I'm guessing that's a policy/requirement of Project Zero as, presumably, the P0 folks are making "enough" already.

</comment></comment></comment></comment></comment><comment><USER16> Checkra1n, another iOS exploit (although it's more impressively a bootrom exploit), is mentioned. You can see slides on it from 2019 here: [https://iokit.racing/oneweirdtrick.pdf](https://iokit.racing/oneweirdtrick.pdf) (The One Weird Trick SecureROM Hates)

<comment><USER17> Interesting, from that slide I should always null my variables after I'm finished with them.

<comment><USER18> If they're globals, then yes you should. Having dangling pointers anywhere, even in supposedly unused areas, tends to come back and bite you.

For locals, why bother? The optimizer will probably discard the writes, and worrying about stack addresses being reused is a waste of mental space and clutters the code.

</comment></comment></comment><comment><USER19> Since this always comes up, here's an overview I made several weeks ago about where Project Zero focuses their efforts:

All counts are rough numbers. Project zero posts:

Google: 24

Apple: 28

Microsoft: 36

I was curious, so I poked around the project zero bug tracker to try to find ground truth about their bug reporting: [https://bugs.chromium.org/p/project- zero/issues/list](https://bugs.chromium.org/p/project-zero/issues/list) For all issues, including closed:

product=Android returns 81 results

product=iOS returns 58

vendor=Apple returns 380

vendor=Google returns 145 (bugs in Samsung's Android kernel,etc. are tracked separately)

vendor=Linux return 54

To be fair, a huge number of things make this not an even comparison, including the underlying bug rate, different products and downstream Android vendors being tracked separately. Also, # bugs found != which ones they choose to write about.

<comment><USER20> Project Zero has uncovered 2033 issues... The majority of those could be used alone to ruin your life. The rest might require 2 (Eg. one for the sandbox, one for the kernel).

Thats a team of ~10 security researchers over many years...

Considering how many are being discovered each day/month/year, chances are that there are at least hundreds undiscovered...

If it only takes _one_ to ruin your life, and a good security researcher can find one in a few weeks, or months at most, the barrier to someone evil is really really low...

<comment><USER21> > good security researcher can find one in a few weeks

s/good/extremely good/

This doesn't change the fact that someone evil will still probably find one.

</comment></comment></comment><comment><USER22> I have nothing to add but the author of this was my best friend in elementary school. Interests included robots, crazy science experiments, dinosaurs, general mischief, and Perl programming.

</comment><comment><USER7> TL;DR background for this one: there existed a zero day bug in iOS 11 related to how the kernel processed the lio_listio call. Apple fixed it then but introduced a memory leak. In iOS 13 Apple fixed the memory leak but reintroduced the vulnerability. The regression was found and packaged in a obfuscated jailbreaking tool (unc0ver); this post explains how the tool was deobfuscated. This resulted in an "emergency" iOS 13.5.1 update to fix the issue. Interestingly this fix still does not fully fix the memory leak: [https://www.synacktiv.com/posts/exploit/the-fix-for- cve-2020...](https://www.synacktiv.com/posts/exploit/the-fix-for- cve-2020-9859-and-the-lightspeed-vulnerability.html)

</comment><comment><USER23> Why is he doing that work? Does Apple not fix every jailbreak exploits by themselves?

<comment><USER24> In this case, it looks like there is a point to it:

> My goal in trying to identify the bug used by unc0ver was to demonstrate > that obfuscation does not block attackers from quickly weaponizing the > exploited vulnerability.

<comment><USER25> We all know obfuscation isn't some magic "no one knows how this works now" trick: the goal is to buy time while people are forced to work though your defense and to slow down the proliferation. Now, the "problem" with this is that some people are just really good at pulling things apart, and so one person can spend four hours attacking it and then tell the world how it worked. But then it is more a matter of incentives, and it still isn't the case that there is much universal incentive for it to both be reverse engineered and then documented for others so quickly (even in the world of piracy; the incentives there are fascinating, but still selfish).

And in fact, I will argue that this looks like it worked great: yes, someone-- and of course, likely many people working in shadowy areas of organized crime, arms dealers, and government contractors--figured it out in hours, and they could have been malicious and used it to attack others. But the real question is then how _many_ such attackers you enable and what their goals are. If you publish an exploit as open source code along with the tool (which some people have done in the past :/), you allow almost any idiot "end" developer to become an attacker: millions of people at low effort instead of thousands or hopefully even only hundreds (when combined with incentives, not just ability).

If you publish a closed source binary with obfuscation--one which is restricted to a limited usage profile (like if nothing else it isn't in the right UI form to "trick" someone into triggering it, or where what it ostensibly "does" is too blatantly noticeable) you limit the number of people who both have the time and incentives to work out the vulnerability and then rebuild a stable exploit for it (which is _hard_ ) down to a small number of people, almost none of whom (including the attackers) who are then incentivized to publish a blog post (or certainly code) until at least months after it gets fixed (as was the case here).

And so, as someone who had been sitting in the core of this community--where everyone is wearing a grey hat, the vendors are the "bad guys", and "responsible disclosure" is being complicit in a dystopia--and dealing with these ethical challenges for a decade, my personal opinion is "please never ever drop a zero day on the world without it being a closed source obfuscated binary" unless you want to drop the barrier to entry so low that you have creepy software engineers quickly using the exploit against their ex-spouse as opposed to "merely" advanced attackers using the vulnerability for corporate or government espionage.

<comment><USER24> > And so, as someone who had been sitting in the core of this community--where > everyone is wearing a grey hat, the vendors are the "bad guys", and > "responsible disclosure" is being complicit in a dystopia--and dealing with > these ethical challenges for a decade, my personal opinion is "please never > ever drop a zero day on the world without it being a closed source > obfuscated binary" unless you want to drop the barrier to entry so low that > you have creepy software engineers quickly using the exploit against their > ex-spouse as opposed to "merely" advanced attackers using the vulnerability > for corporate or government espionage.

Obviously you have a better understanding of the iOS jailbreak scene than I ever will, but I still have to say I disagree with this ethical viewpoint. Personally, I'd rather run an open source exploit chain than obfuscated binaries from parties I do not know that are difficult to be sure are safe. Thankfully in the case of unc0ver that is not an issue anymore, but in the past it has been an issue for longer time periods. OTOH, if there is really a moral dilemma in releasing 0days as open source specifically because of the small time abusers and not nation state adversaries, I don't understand how this moral quandary doesn't mean you can never ethically release an iBoot/more generally any bootrom exploit, for example.

I'm genuinely curious how many abusive people are motivated enough to come up with a creepy use for a tethered jailbreak. I know it's possible, but short of rolling your own stalkerware, it really doesn't seem too straightforward?

</comment></comment></comment></comment><comment><USER26> There is nothing to brag about. I want to own my device. I want to install on it whatever i like.

</comment><comment><USER27> Working for the wrong side snitchy snitch

</comment><comment><USER28> FTA: "...the LightSpeed bug was fixed in iOS 12 with a patch that didn't address the root cause and instead just turned the race condition double-free into a memory leak. Then, in iOS 13, this memory leak was identified as a bug and "fixed" by reintroducing the original bug, again without addressing the root cause of the issue..."

Ooof. Talk about running in circles. Either this was someone who is swamped with work and spaced out, or a new programmer who wasn't familiar with the original. Oddly, I feel bad for both of them!

<comment><USER29> Reguardless of how bad the original fix was, this is why testing is important. The original person should've added tests to make sure that specific issue doesn't come up again, and it would've caught the regression.

> Thus, this is another case of a reintroduced bug that could have been > identified by simple regression tests.

</comment></comment><comment><USER30> So proud to have reverse engineered an 0day. Ok, move on. Nothing to see.</comment>


Hack-a-Mol - <AUTHOR> https://chemapps.stolaf.edu/jmol/jsmol/hackamol.htm <comment><USER2> Funny.

I have recommended this website ([https://www.stolaf.edu/depts/chemistry/courses/toolkits/247/...](https://www.stolaf.edu/depts/chemistry/courses/toolkits/247/js/names/dnames.htm)) to many of my students to help them practice naming alkyl substituted alkanes.

The web-page has an "analyze" button that does a great job showing students how to find the longest carbon chain, which is then used to help determine the molecule's IUPAC name.

I've always wondered who was behind the site that I had recommended, but I was never curious enough to poke around and answer my own question.

When I saw "hack-a-mol" and stolaf.edu, I thought, "okay, must be the same person."

People like this (his name is Bob Hanson: [https://www.stolaf.edu/people/hansonr/](https://www.stolaf.edu/people/hansonr/)) are hidden gems. He's probably not super-famous, but he's made many great tools and I can only imagine that his students have benefited tremendously from his passion and skills.

<comment><USER3> Reminds me of Paul Falstad and his excellent circuit simulator tool. He originally wrote it as a Java applet, then gave permission to an Iian Sharp to have it rewritten in HTML5: [https://www.falstad.com/circuit/](https://www.falstad.com/circuit/)

</comment></comment><comment><USER4> This is a very impressive site for teaching molecular file formats indeed! If there is one caveat that an old crystallographer might add...

      press ENTER, the 2D and 3D structures will update.

When going from the 2d connectivity graph to 3d there arise essential emergent properties, some of which can be specified, like stereochemistry (left or right chirality), and some which can be estimated with a lot of theory and additional calculation like multiple conformers (e.g. trans and cis), and thermal preferences (staggered vs eclipsed along rotable bonds), and onwards to intensive quantum chemistry for electron distribution which is so critical for design for enzyme binding. That is, "3d" at this level is very much an approximate single still image of a very dynamic system.

</comment><comment><USER5> What a neat and timely teaching tool! Literally just an hour ago today I was reading an article in Chemical Review titled "Concepts of Artificial Intelligence for Computer-Assisted Drug Discovery" [0]. There was a lot of pretty standard stuff in there related to AI work but the real puzzle for me was trying to come up with a clean way to store and work with these data sets. I had come up with a few possible solutions that seemed decent but I knew there had to be a more standardized format. After struggling to get the correct search terms I decided to take a coffee break and then lo and behold, I come across this post. Thank you Mr. Hansom, you have successfully kept me busy the rest of the night :)

[0][https://pubs.acs.org/doi/10.1021/acs.chemrev.8b00728](https://pubs.acs.org/doi/10.1021/acs.chemrev.8b00728)

</comment><comment><USER6> That's great!

How do you represent a chemical structure mathematically? Is it a graph? Or something else? It seems more complicated than just a simple graph structure.

<comment><USER7> Mathematically: [https://en.wikipedia.org/wiki/Schr%C3%B6dinger_equation](https://en.wikipedia.org/wiki/Schr%C3%B6dinger_equation)

Is it a graph? Mostly yes - just ignore anything that's not covalent. It depends a bit on how complicated an interaction you're willing to allow an edge to represent, and how much of reality you're willing to ignore. A few examples of complications are linked below. The depictions may seem trivial, but for large molecules things quickly become ridiculous.

[https://en.wikipedia.org/wiki/Resonance_(chemistry)](https://en.wikipedia.org/wiki/Resonance_\(chemistry\))

[https://en.wikipedia.org/wiki/Pi_interaction](https://en.wikipedia.org/wiki/Pi_interaction)

[https://en.wikipedia.org/wiki/Antibonding_molecular_orbital](https://en.wikipedia.org/wiki/Antibonding_molecular_orbital)

</comment></comment><comment><USER8> Anyone knows if this program is open source?

<comment><USER9> There is Openbabel, which was open-sourced by the folks from Openeye in New Mexico. Anthony Nichols is quite a character, and David Weininger was even more so.

The CACTVS software used on that website is related to Gasteiger at Erlangen.

<comment><USER10> I will second Openbabel as a reliable tool in my comp-chem pipeline.

</comment></comment></comment><comment><USER11> What is going on? This was actually submitted 11 hours ago, but now re-appears under the _same HN URL_ on the front-page, saying it was submitted only 1 hour ago?

On top of that all comments on it seem to have shifted by like 10 hours as well (busyant's comment is actually half a day old by now, not 40 minutes).

You can see the timestamps don't match up here: [https://news.ycombinator.com/submitted?id=breck](https://news.ycombinator.com/submitted?id=breck) (says 11 hours ago).

Or here: [https://news.ycombinator.com/threads?id=busyant](https://news.ycombinator.com/threads?id=busyant) (says 10 hours ago on his comment on this submission).

<comment><USER12> Likely the 2nd chance queue.

This is a process HN has devised to give selected submissions another chance at the front page. See:

[https://news.ycombinator.com/item?id=11662380](https://news.ycombinator.com/item?id=11662380)

<comment><USER11> It's kind of problematic that they roll back the time on user comments as well. This kind of "rewriting history" can lead to all sorts of issues.

<comment><USER13> How, specifically?

<comment><USER11> You don't see how lying about when something was posted can lead to problems? Just making sure I'm answering the right question.

The spectrum begins at me being slightly annoyed because I can't tell posts that were posted just now from posts that were posted hours ago.

It probably ends at people arguing in court over such things as prior art in patent cases, or someone trying to submit an online comment as evidence. Imagine Facebook mucking with timestamps... Often _when_ is pretty important.

There's a lot of things in between there which I'll leave to your imagination.

In any case, changing meta information silently can be as bad as silently changing the content of posts themselves and will hurt your credibility as a platform. The reddit CEO did it as a _joke_ once, and that already caused a massive shitstorm[1].

[1]: [https://www.reddit.com/r/announcements/comments/5frg1n/tifu_...](https://www.reddit.com/r/announcements/comments/5frg1n/tifu_by_editing_some_comments_and_creating_an/)</comment></comment></comment></comment></comment>


Coronavirus: Why everyone was wrong – Back to Reason - <AUTHOR> https://medium.com/@vernunftundrichtigkeit/coronavirus-why-everyone-was-wrong-fce6db5ba809 <comment><USER2> Seems peculiar that a "former director of the Institute for Immunology at the University of Bern, a biologist and professor emeritus" would use "coronaviri".

<comment><USER3> Coronaviri is the plural of coronavirus. The virus that causes the Covid-19 disease is the SARS-CoV-2 virus, which is a virus of the type Coronavirus. That means, there are other virus which are Coronavirus, hence if you want to refer to them as a group it would be correct to say coronaviri. If you re-read the article now knowing that coronaviri is the plural of coronavirus, you'll see every time it refers to coronaviri it is in plural (i.e. "is related to other coronaviri")

<comment><USER2> [https://www.thoughtco.com/what-is-the-plural-of- virus-112199](https://www.thoughtco.com/what-is-the-plural-of-virus-112199)

<comment><USER3> It makes sense. I like to use datum as singular of data(or a piece of data), although I know data is also correct. So if anything it would be virus-vira, and not virus-viri, so coronavirus-coronavira. When I was in high school I remember visiting sites with tutorials and info on hacking and they had H/P/C/V/A (Hacking/Phreaking/Cracking/Virii/Anarchy) so it was using Virii as plural of virus (computer virus), so that stuck in my mind.

<comment><USER2> It's a natural and common extrapolation, but not one that I'd expect to see from a scientist, particularly a biologist. I can't see the original article due to the paywall, but I understand the the German plural is _Viruses_ , as in English. All very odd.

</comment></comment></comment></comment></comment><comment><USER4> Counter-narrative. Flagged!</comment>


Dutch Data Protection Authority: Microsoft breaches law with Windows 10 - <AUTHOR> https://autoriteitpersoonsgegevens.nl/en/news/dutch-dpa-microsoft-breaches-data-protection-law-windows-10 <comment><USER2> >Microsoft has indicated that it wants to end all violations. If this is not the case, the Dutch DPA can decide to impose a sanction on Microsoft.

These big companies always get away with a Warning. So if I were Microsoft, then why would I not have done it this way? They can now just say "It was nice while it lasted." But that's about it.

Another point I have is that if you join the Insiders Program you have to submit your "typing data" (whatever that is). I understand that some data is required if I join the program (since I am then a tester, so some debugging data is okay). But some of the data should not always be submitted automatically, even if I am a tester. Data such as my typing data and full memory dumps.

<comment><USER3> > These big companies always get away with a Warning.

[https://www.cnbc.com/2017/06/27/the-largest-fines-dished- out...](https://www.cnbc.com/2017/06/27/the-largest-fines-dished-out-by-the- eu-commission-facebook-google.html) \- over 1.5 billion in fines, they were made to release versions without a media player, they were made to offer a browser selection window.

<comment><USER4> Yeah, but when I was driving 12km/h over the limit I got a huge fine right there and then. I wasn't told to drive under the limit up the road while the police reviewed my behavior. I think that's what OP means, one rule for megacorps, another for the rest of us.

edit: My question is that when you have a company that has a track record, why do government contracts and private enterprise keep begging on the same street corner, instead of looking for work elsewhere, that is to say, why do they keep going back to Windows and not invest elsewhere as investment would lead to an acceptable (to them) enterprise Linux (Red Hat++ exists!)

<comment><USER5> That's not true - plenty of people/places will stop you, and tell you not to speed, and then send you out a ticket in the mail. It's also a totally different situation - if you were under investigation for X crime (but not proven guilty yet) you're allowed to (mostly) go about your business while you wait for the investigation to conclude

<comment><USER6> Only if the crime is relatively minor. How bad of a crime is using dragnet surveillance to create activity logs and dossiers of millions of people, then using that to profit financially, but also (very probably) providing those dossiers and activity logs to foreign governments' intelligence services?

</comment></comment></comment></comment></comment><comment><USER7> I wish Microsoft would keep moving their recently changed reputation forward (at least with some people they seem to be doing good by building open source tools) by being clearer about their data collection and allowing more controls over it, as well as more controls over Windows Update, seems after the Creators Edition I lost control over my Windows Updates (namely I remember being able to pick dates for running updates, now I only get the option to pick the hours that I'm allowing them to update) I'm switching to Ubuntu and running Windows in a VM as a result, at least then I only lose what's on Visual Studio.

<comment><USER8> > by building open source tools

While MS is working on some open source tools (Typescript is one example I can think of), they seem to have no problem violation licenses with their Windows tools (to only release code when they have no other choice) [0] [1].

> clearer about their data collection

Please remind me why an OS that you paid good money for (>$100) needs to collect your personal data and usage at all? :)

[0] - [https://www.osnews.com/story/21882/Microsoft_s_Linux_Kernel_...](https://www.osnews.com/story/21882/Microsoft_s_Linux_Kernel_Code_Drop_Result_of_GPL_Violation)

[1] - [http://www.zdnet.com/article/microsoft-admits-its-gpl- violat...](http://www.zdnet.com/article/microsoft-admits-its-gpl-violation- will-reissue-windows-7-tool-under-open-source-license/)

(edit: formatting)

<comment><USER9> You do realize that those links are from 2009, right? Regardless of anything else good or bad the company has done, the relationship between Microsoft and Open Source couldn't be more different today than it was then.

Disclosure: employee since 2008

<comment><USER8> Yes these are old links. However, I haven't seen any change in MS's behavior regarding Open Source since.

More recently they build an emulator for running Linux binaries (Bash), which again is closed source [0].

> relationship between Microsoft and Open Source couldn't be more different > today than it was then

Please mention some examples of this?

[0] - [https://github.com/Microsoft/BashOnWindows/issues/178](https://github.com/Microsoft/BashOnWindows/issues/178)

<comment><USER9> By "more different" I mean the internal culture -- not necessarily the externally facing part. Ten years ago I was working on IronPython and IronRuby, open source reimplementations of other open source projects. Even though the originals are under a very permissive license, we weren't allowed to go anywhere near their source. Because of company policy, where external OS was essentially treated as radioactive, there was a vacuum around both process and engineering knowledge.

Today, the company has a lot of standardized procedures and tools around the consumption of external open source -- and, in fact, actively encourages it. Along with that comes awareness of appropriate and not appropriate usage. In the nine-year old example you give, that's obviously not an appropriate usage.

I'm not sure what your point is about the reimplementation of the Linux kernel API inside Windows. Most large software companies build some amount of closed source software. I don't know what decisions might lead to this being opened or not opened, but there are very few people who'd argue that a company should publish or make available all of their source code.

<comment><USER8> > Today, the company has a lot of standardized procedures and tools around the > consumption of external open source

That MS consumes open source for their own good comes not at all unexpected to me. However, consuming is not contributing. I believe you made to point that MS now contributes to the OSS community. I may have misunderstood.

> I'm not sure what your point is about the reimplementation of the Linux > kernel API inside Windows. Most large software companies build some amount > of closed source software

Most companies don't clone FOSS but build on top of it instead. Also most companies are pretty open about using OSS (crediting the projects and their source code). I haven't seen a single written line from MS crediting GNU and the Linux community for their work. They only credit MS and their own people. (Some recent examples: [0] [1])

[0] - [https://blogs.msdn.microsoft.com/wsl/2016/07/08/bash-on- ubun...](https://blogs.msdn.microsoft.com/wsl/2016/07/08/bash-on-ubuntu-on- windows-10-anniversary-update/)

[1] - [https://blogs.technet.microsoft.com/heyscriptingguy/2016/09/...](https://blogs.technet.microsoft.com/heyscriptingguy/2016/09/28/part-1-install- bash-on-windows-10-omi-cim-server-and-dsc-for-linux/)

</comment></comment></comment></comment></comment></comment><comment><USER10> I wonder what makes Windows worse than Android. Android seems to get consent in an equally unclear way (i.e. location tracking), collect much more personal data because phones are carried everywhere, and runs on much more devices in the Netherlands than Windows 10.

Is Android going to be the next target, please?

<comment><USER11> Android's location tracking is a feature and I believe is not turned on automatically. Most of Windows 10's data collection serves no obvious purpose and is on by default. It's also 4 screens full of toggles that make you go "uh what?!"

But I wouldn't mind if they went after android for the purpose of making it clearer what's being tracked and gathered.

<comment><USER12> "Android's location tracking is a feature and I believe is not turned on automatically."

It's not but they insist that you do in an unclear way every time you open google maps.

<comment><USER13> And when you disable location while it's in GPS-only mode and re-enable it, it defaults to the send-everything-to-Google mode.

</comment></comment></comment></comment><comment><USER14> The Dutch law for the protection of personal information (wet bescherming persoonsgegevens) on which these conclusions are based, is basically just an implementation of an EU-wide directive. So if the WBP authority can agree that this breaks the law, this could climb up the ladder and result in another huge EU fine for Microsoft. I wonder if and how MS will respond or react to this release.

<comment><USER15> Probably Windows 10.1

<comment><USER16> Or an N version again.

<comment><USER17> Yes, I'm thinking this will at most result yet another N version that nobody will buy and will have 0 practical impact.

<comment><USER18> Nobody will buy it, because it will be unobtanium, just like the N version was.

<comment><USER19> I thought it was easy to obtain, but nobody actually wanted it!

<comment><USER18> Have you ever tried to obtain it? Have you ever seen it as an OEM version bundled with computers, or just a box?

The only time I've seen it was on the MSDN download page. Nowhere else.

"Nobody wanted it" was a dishonest statement. It was not available -> nobody bought it -> so nobody "wanted" it.

<comment><USER19> Listed right there next to the other editions in Stores which are required to sell it....

[https://www.microsoft.com/en- cy/store/collections/windows](https://www.microsoft.com/en- cy/store/collections/windows)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> This took much longer than many people expected.

Next year new data-protection EU-law will be introduced, it will hit companies like Facebook, Google and MS, it will also affect your company, so take a read what's changing [http://www.telegraph.co.uk/connect/small- business/business-n...](http://www.telegraph.co.uk/connect/small- business/business-networks/bt/data-protection-laws-changing/)

<comment><USER21> I work at an ISP.

GDPR is _huge_ and #1 on just about every priority list. Accounting for every single piece of (even theoretically) personally identifiable information, access restrictions to said data, storage time limits, logging of access and changes (without logging anything sensitive) and everything else is a gigantic undertaking.

Every single system we have that stores or even just caches data is affected by this, and it's tying up a large amount of our resources.

As a consumer I certainly welcome the GDPR, but as someone who works in IT, holy shit our workloads have increased.

<comment><USER22> This is when it pays off to just minimize the use identifiable information.

Finally there might be a drawback to just collect just because it seems to be valuable and might be exploitable tomorrow. The vast majority of companies never even recovers the development cost of collecting the data, no wonder they don't have the energy left to secure it.

<comment><USER23> Folks who designed their applications with data reduction and data economy in mind have a much easier time with all of this.

</comment></comment></comment></comment><comment><USER24> I am so looking forward to how Microsoft will handle the GDPR. 4% of MSFT turnover is roughly 3.5 billion dollars. That is the sort of fine the GDPR allows for serious privacy violations (which this is).

</comment><comment><USER25> I like what they're doing because Microsoft is just too vague about what they're really doing with all this information. At least they should be forced to be way more clear about what they're doing. But it's a bit hypocritical one side of the government is complaining about involuntary collection of personal data while the other end wants to legalize it for itself:

[https://geensleep.net](https://geensleep.net)

</comment><comment><USER26> The premise that you can make predictions based on historical data and force it down people's throat is deeply flawed and only perpetuates those obsessed with data hoarding and analysis and are vested in seeing more value than it provides and patterns where none exist.

There is no reason for Google or Microsoft to track any individuals location, buying preferences or interests. They are fickle and change forget days hour to hour. They perpetuate echo chambers and promote narrow segmented views rather than universal information.

So historical data is useless. And the very idea of tracking location and being blase about it seeking to 'normalize' it is deeply invasive, odious and authoritarian. It's not normal to stalk people. These companies have become monsters with no ethical constraints in search of more ad revenue and there is going to be a massive backlash soon.

</comment><comment><USER27> So, as I read the article, the main objection is that the users aren't informed clearly enough about data collection. MS can remedy this in two ways: 1) by being more clear about data collected and asking for consent, 2) by turning off data collection.

I guess they'll go for 1). No that I mind, I almost always say "yes" when asked to participate in improvement programs.</comment>


Bitcoin.org has a new site - <AUTHOR> http://bitcoin.org/

<comment><AUTHOR> The info looks good but the design I'd say has taken a step back.</comment>