LinuxBoot: Linux as Firmware - <AUTHOR> https://www.linuxboot.org/ <comment><USER2> IMO, the problems that [U]EFI introduces (that far exceed the historical limitations it overcomes) should be _self-evident_.

IMO, he should not have to argue against having multiple, redundant copies of drivers, shells and utilties each accessible only in its own "OS" (UEFI, GRUB, OS). It should not be a debate. This is definitely not "defense in depth". IMO, whomever controls the first OS controls the computer because there is no need for the second and third OS in order to do work (make network connections, move files across the network, etc.).

These "hardware features", whether its [U]EFI or ME _or whatever acronym_ , IMO is a land grab by hardware vendors over what we know as the "OS". Less computer owner control, more vendor control. The sum effect of all these "features" is that verification that something is the way that the owner wants it and has not been modified is far too complex and is ultimately under control of the vendor, not the computer owner.

I do most work on the commandline in text-mode (no graphics layer) and as such _I only need one OS_ , with some basic utilities. When the news came that new computers would have [U]EFI, I considered whether I should just switch from the OS I am using to [U]EFI. It seemed to have all the utilities I would need to do work, along with the ability to extend with new programs.

I only need one OS to boot to a working environment. I should be able to choose that OS. I hope that Minnich and Hudson and others will consider that the user may want to _choose_ a kernel other than Linux as a source for drivers, e.g., BSD, Plan9, others incl. future OS not yet written, etc., even if it today it has inferior driver support compared to Linux, or Intels UEFI, or whatever.

The speaker seemed a bit perplexed when someone in the audience questioned whether Linux is a "TCB". What is and what is not a "TCB" should be the _computer owners_ decision, and not anyone elses. If the computer owner wants to cede authority for that decision to a third party, then she can make that _choice_. But IMO it should be a _choice_ made by the computer owner, and not anyone else.

<comment><USER3> > These "hardware features", whether its [U]EFI or ME or whatever acronym, IMO > is a land grab by hardware vendors over what we know as the "OS". Less > computer owner control, more vendor control.

What control did you have with an old PC BIOS that you now are missing with UEFI? Things like SMM and Intel ME that keep running after your actual OS has started existed and were pretty much ubiquitous before UEFI became common in consumer hardware. They aren't required to implement UEFI, and UEFI doesn't enable them any more than PC BIOS did.

> I only need one OS to boot to a working environment. I should be able to > choose that OS.

You weren't able to choose your PC BIOS any more than you can choose your UEFI implementation now. There are PC BIOS and UEFI motherboards that can accept coreboot or something similar, and in all other cases you're stuck with an opaque vendor blob. At least with UEFI you have an opportunity to write your own software that can be part of the boot process, doing so with a BIOS was usually impossible unless you could install an option ROM.

> I do most work on the commandline in text-mode (no graphics layer) and as > such I only need one OS, with some basic utilities. When the news came that > new computers would have [U]EFI, I considered whether I should just switch > from the OS I am using to [U]EFI. It seemed to have all the utilities I > would need to do work, along with the ability to extend with new programs.

That's great for you but a lot of people want to be able to install different OSes on their hardware. Having to duplicate the hardware initialization code for each would be a major pain and would probably result in a lot of hardware only supporting one OS (e.g. many consumer motherboards would probably be Windows only in this situation). I really don't see how having the firmware wedded to a particular OS is going to give people more choice.

<comment><USER4> > What control did you have with an old PC BIOS that you now are missing with > UEFI?

I had a PC with a BIOS once. It didn't seem as slick as the Kickstart I'd used for the previous decase on my Amigas. It was also much less configurable/programmable than the OpenFirmware that came on my subsequent PC. My current machine uses libreboot, which is fine but I much prefer OpenFirmware.

tl;dr "BIOS vs EFI" is a false dichotomy, and "it's better than BIOS" is pretty weak praise for a boot system.

<comment><USER3> The person I was responding to was claiming UEFI was restricting their choices and had "introduced" problems. I don't really see what OpenFirmware, libreboot, etc. has to do with this. I didn't say UEFI was the best boot system ever envisioned (I definitely think they could have done better) but claiming it's some anti-consumer conspiracy in a way PC BIOS wasn't makes no sense.

<comment><USER4> For what it's worth, I agree with the parent. IMO Microsoft's strong-arming around "SecureBoot" is enough to distrust everything to do with EFI.

</comment></comment></comment></comment></comment><comment><USER5> BTW, on the flip side of the UEFI haters, i.e. things that I can do with UEFI more easily than BIOS (or at all).

I can now have a normal partition to put my boot loaders in rather than a hidden chunk at the beginning of the disk.

I can easily update, add and remove boot entries from the OS command line.

I can forgo bootloaders entirely and use Linux as UEFI application.

I can use GPT and finally partition as much as I want.

I might have forgotten something too. :)

<comment><USER6> On other hand - a common partition that is shared among all operating systems has too high chance of getting corrupted or simply blown away by another install.

Just yesterday - RHEL7.5 beta install overwrote UEFI entry of Ubuntu for me and Ubuntu became unbootable. On another laptop - Fedora blew away my Windows bootloader from UEFI partition and I have been too lazy to recover it.

Also - because UEFI partition actually contains things needed for booting these operating systems - it is almost always non-trivial to restore.

<comment><USER3> You can have multiple EFI system partitions on the same disk. The Windows installer does not like this, but it won't affect the actual boot process after it's installed. The Linux distros I've seen don't mind at all, since /boot/efi is usually mounted by UUID in your fstab.

<comment><USER7> No you really can't. There can only be one ESP and that's in the spec. You can have multiple partitions each assigned as /boot for a different OS, but there can only be one ESP which is used by the firmware to store its settings, etc.

The EFI spec [0] is _officially_ silent about the presence of multiple EFI system partitions __on non-removable hard drives __, but explicitly forbids multiple ESPs on removable disks, per §18.104.22.168:

> For removable media devices there must be only one EFI system partition, and > that partition must contain an EFI defined directory in the root directory

But in practice, Bad Things (TM) happen if you have more than one ESP on the boot disk.

An ESP isn't just a partition mounted to /boot or one that has bootfiles or a bootloader, it's (in practice) a FAT32 partition that has a different filesystem ID, in particular, the magic GUID {C12A7328-F81F-11d2-BA4B-00A0C93EC93B}

I'm the author of EasyBCD and numerous other boot utilities and spent a hell of a lot of a time (too much time) researching and working around the various UEFI deficiencies in various desktops, laptops, firmware implementations, bootloaders, and operating systems.

Here's a Microsoft bulletin on the matter: [https://support.microsoft.com/en- us/help/2879602/unable-to-b...](https://support.microsoft.com/en- us/help/2879602/unable-to-boot-if-more-than-one-efi-system-partition-is- present)

(long story short, the Windows kernel may bork if it runs into multiple ESPs and fail to load. Our bootable boot repair CDs wouldn't boot into the WinPE kernel because the disk management subsystem would hit an infinite loop in certain cases (not this case). We ended up switching to FreeBSD for our live CDs and writing our own disk repair subroutines to get around cases where even Windows live CDs wouldn't boot so we could fix the customer's PCs)

Linux may not hang if there are multiple ESPs (except it sometimes does), but it certainly doesn't support treating multiple partitions as the ESP simultaneously, either: [https://superuser.com/questions/688617/how-many-efi- system-p...](https://superuser.com/questions/688617/how-many-efi-system- partitions-esp-can-a-computer-have)

[0]: [https://www.intel.com/content/dam/doc/product- specification/...](https://www.intel.com/content/dam/doc/product- specification/efi-v1-10-specification.pdf)

<comment><USER8> > I'm the author of EasyBCD

Thank you!

Also, maybe you can answer this: what's the 'correct' way for systems to handle multiple disks with an ESP partition each? In other words, if I'm using software RAID and clone the partition tables, should I assume that the UEFI firmware will default to the first disk's ESP, or is that set when boot configurations are updated?

<comment><USER7> > Thank you!

No problem! Glad you found it useful.

> if I'm using software RAID and clone the partition tables, should I assume > that the UEFI firmware will default to the first disk's ESP

With regards to your question: I guess it depends on what you mean by "software" raid. Enabling RAID in the "BIOS" (that term has now come to encompass the firmware configuration utility for UEFI motherboards as well) (typically Intel "RST" rapid storage RAID, nvraid for nVidia chipsets (less common these days), AMD raid, etc.) is 100% software raid, which does nothing more than make the BIOS aware of its presence (and toggle a flag so that RAID drivers can find the array) so that it doesn't run into exactly the problem you describe, i.e. it'll be aware of the cloning at a level higher than the UEFI bootloader init, which will only see the virtual raid volumes rather than their independent components.

Now if you put all that aside and are just wondering how it selects in the presence of multiple ESPs on different devices that made it through to the bootloader layer: the UEFI "BIOS" doesn't know (and can't know) since UEFI has done away with the concept of drive order entirely. You can set the order manually in the "boot device order" section (typically on the boot tab in the BIOS config) or choose the one-time boot target via F11 or F12 at the boot-up screen, but otherwise it's just a tossup and the BIOS is free to chose any local device's ESP as "the" ESP. In practice, it'll choose one of the SATA drives (assuming a mix of other interfaces such as NVMe), either the first to respond (not an issue with SSDs which respond quickly, but magnetic media takes time to spin up if you're still using old HDDs) or the first to be enumerated by the SATA controller (which has its _own_ firmware and its own level of abstraction and logic (and bugs) and whatnot).

BUT in the case of software raid, that RAID 0 should actually extend to the GPT itself and both drives will have the same content and mirrored ESPs, so in practice it won't matter which is loaded (so long as your OS doesn't do anything stupid like try to modify the on-disk structure before loading the RAID-aware storage driver. I've seen BIOSes that "helpfully" store a copy of the current firmware to a locally-attached disk with an understandable partition format (so FAT32) that ended up breaking a RAID because the drives were no longer in sync because the BIOS wasn't aware of the mirror).

</comment></comment></comment></comment></comment></comment><comment><USER7> There is virtually no information on that page. I don't understand why this is getting voted so highly. I'm interested (this falls right in my area of expertise, see my other comments on this page) and I've heard about this proposal before, but the landing page this story links to is just a placeholder with no useful (technical or marketing) information.

<comment><USER9> This is probably because people saw the LinuxCon video and are excited that it's out.

At least that's my case :)

<comment><USER10> Do you have a link to the talk?

<comment><USER11> The front page of LinuxBoot has links to talks' videos and slides.

</comment></comment></comment></comment><comment><USER12> I do like the coreboot + lightweight payload (such as u-boot or grub) approach, and simply can't see any benefit of jamming a Linux kernel in; Simplicity is itself value.

Even if I were to find their approach appealing (I don't), Linux's monolithic design with no driver APIs doesn't even seem like a good fit for this; NetBSD's kernel size (and its cleaner design, and the RUMP kernels feature), Minix3 (high assurance, unlike Linux) or even Genode are far better suited.

But, seriously, we need less, simpler, cleaner code, and this "jam Linux into everything" approach seems nothing less than the old "when you have a hammer, everything looks like a nail" problem.

<comment><USER13> > NetBSD's kernel size (and its cleaner design,

Don't make me laugh.

<comment><USER14> Most of us have not read the NetBSD kernel source code (I have not.) I've read a small bit of the Linux source code. Please inform me of why I should laugh at this claim.

</comment></comment></comment><comment><USER15> If we use LinuxBoot to boot Linux (desktop or server), then why don't we boot direct into Linux (desktop or server)?

<comment><USER16> There's probably an argument to be made for a lean bootloader/kernel that does minimal work - and for a os kernel that's more general. But with network boot (ethernet, WiFi stack, network stack, one or more network transports ((t)ftp, nfs?..) and support for encryption... The line does blur.

Might be worth it to have minimal Linux "profile" that support "booting" other Linux via kexec.

But then, will you boot nt, freedos, bsd and minix via kexec too?

<comment><USER17> > _There 's probably an argument to be made for a lean bootloader/kernel that > does minimal work - and for a os kernel that's more general._

We had that in Linux; it was called LILO (Linux loader), consisting of a 512 byte machine language program run from the boot sector which would load a canned sequence of more sectors, a slightly larger program, which would then load a kernel image from a sector map.

Before that, generations of machines going back to the dawn of computing had minimal bootstrap sequences.

But, on the flipside, idea of more capable boot firmware precedes Linux by probably ten years if not more, like on Sun workstations and whatnot.

</comment></comment></comment><comment><USER18> wait what? using a whole linux kernel as firmware before booting another OS to improve speed, reliability, security? does this seem strange to anyone else?

<comment><USER19> Check Ron Minnich's talk explaining the why:

[https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20wit...](https://schd.ws/hosted_files/osseu17/84/Replace%20UEFI%20with%20Linux.pdf)

(The video of the presentation is linked in the OP).

There's already two and a half obscure OS's running underneath the OS for booting. So this replaces all that crap with something lean and good.

<comment><USER20> Firmware with a built in web server is pretty spooky. Why do they have that?

<comment><USER21> Most UEFI implementations have a network stack these days. It's horrible.

<comment><USER22> I agree, but it's not exactly like PXE didn't exist before EFI was invented, and AIUI EFI actually decided to reuse PXE instead of NIHing another overengineered non-solution, so honestly that's not even so bad.

</comment></comment></comment></comment></comment><comment><USER23> Correct me if I'm wrong, but you still need a coreboot-compatible motherboard ?

<comment><USER24> Actually no. We've demonstrated this on boards without using coreboot support such as OCP's Winterfell machine. The reason is that we're inserting the Linux kernel in UEFI's DXE stage, whereas cpu init such as memory training are still handled by UEFI's PEI stage. From the perspective of UEFI, the Linux kernel is just another DXE to execute.

<comment><USER25> Is there a document that does a decent job of explaining how UEFI works?

<comment><USER24> You could try this: [https://github.com/tianocore/tianocore.github.io/wiki/UEFI-E...](https://github.com/tianocore/tianocore.github.io/wiki/UEFI- EDKII-Learning-Dev)

I don't know of any easily digestible document though.

<comment><USER25> Thanks!

</comment></comment></comment></comment></comment><comment><USER26> I remember my Commodore 64 days where you turned on the C64 and it booted right into BASIC because it loaded BASIC from a ROM, or it loaded software from a cartridge. The 1541 floppy drive was extra, or the tape or modem etc.

The thing I liked most about the C64 was booting into BASIC as soon as you turned it on.

If Linux becomes the Firmware or installed on Firmware on an EEPROM or whatever, it can boot into a LiveCD Distro of Linux from an EEPROM faster than from a hard drive or USB drive or DVD whatever.

I have to say some computers are getting rid of DVD/CD/BluRay drives and booting from USB Drives, which makes download a Linux Live CD/DVD and test it out, now it can just boot from BIOS with the bare minimum LiveCD distro, and allow you to have tools to work on hard drives and fix them etc.

If I ran Commodore, and brought it back from the dead, I'd make Intel/AMD PCs, and I'd also make Commodore Bridge Cards that run a 68M/PPC Amiga on a PCIe/PCI card that can run in the host OS as a Window or Full Screen and can make virtual hard drives and floppies out of files, etc. Maybe a C64/C128/C65 on a card with ports from the Commodore series to hook up real 1541 drives etc. The Commodore Colt PCs will have a VIC-20 series that is low end, and a Mad Max series that is high end and built for video games and SteamOS or run Windows. They will come with Debian Linux but can be reformatted for Windows or SteamOS and make a deal with Steam to run C64 games in emulators the same way Sega Genesis games are run in emulators.

I'd also try to make ARM-based PCs running Linux for under $100 based loosely on the Raspberry PI but assembled. Contribute to the Raspian or whatever it uses with an emulator app for 8-bit Commodores and they can buy ROMs from a store in the emulators to download and run, after getting permission from the software companies if they still exist to license them and pay 10% or whatever the fee is to the customer.

<comment><USER27> People have tried to reboot the Commodore IP only to make some Linux version with all the emulators on it running on a PC in a keyboard case that resembles a C64 or Amiga 500. I think yours being a box that has expansion slots would do a lot better. They could not figure out how to monetize the ROMs as TOSEC on Archive.org and other places has virtually every ROM, Tape, and Floppy ever made for the C64.

I like that idea of selling C64 games on Steam the same way they sell Sega Genesis games. Just port VICE to use Steam and verify codes for purchases for different ROMs to load after being paid for.

</comment></comment><comment><USER28> Is there any chance of a big player like Dell getting behind this project? Will servers ever ship with this firmware?

<comment><USER11> Horizon Computing will ship OCP nodes running LinuxBoot / NERF in Q2.

</comment></comment><comment><USER29> I don't understand what's wrong with Grub. UEFI loads Grub which loads your OS. The previous "OS" gets replaced in each iteration (except for the Intel ME stuff .. which is off running somewhere in its own little world).

Grub supports raid, lvm2 and luks. I literally have a 1 partition with LUKS that contains an LVM with a swap and root (/) volume. Yes, that means I have an encrypted boot. The only thing unencrypted is my EFI/SPI partition.

<comment><USER14> UEFI has more privileges than your OS, just like ME has more privileges than UEFI. How do we know it hasn't messed with the environment in ways we can't see? How do we know our UEFI firmware wasn't compromised? I'd argue it's very hard to tell.

</comment></comment><comment><USER30> Boot firmware by any other name is still boot firmware, and the same forces that have made EFI what it is will affect any other thing you try to put in its place.

</comment><comment><USER31> > Typically makes boot 20 times faster

Really? That means my current Fedora boot on an T430 with SSD of 20s would go down to 1s? Seems unbelievable.

<comment><USER11> We should clarify that. Our example is an OCP Winterfell node, where boot time went from 8 minutes to 20 seconds.

<comment><USER32> That's an edge case. Asserting that boot is _typically_ 20 times faster is misleading.

<comment><USER33> It's pretty typical boot time for most UEFI server platforms with network cards and RAID controllers. The Dell R630 takes about six minutes, the HP DL3x0 is about eight and the Lenovo x3550 takes over ten. Of the ones I've tested only the Intel s2600wf is under two minutes in a stock configuration, but with LinuxBoot it is less than twenty seconds to a Unix shell despite the PEI and DXE serial debugging messages: [https://www.youtube.com/watch?v=0HISDFXZvSI](https://www.youtube.com/watch?v=0HISDFXZvSI)

</comment></comment></comment></comment><comment><USER34> if i look at the diagram it looks like linux replaces a bootloader? or is that a bit too simple of a conclusion?

wouldn't a minimalistic bootloader loading linux then not do about the same? (if you implement coreboot) since that leaves linux to configure everything something like GRUB would usually initialise? I think linux actually re- initialises most things that are done by the loader, and seeing that linux kernel is in the 'memory init' zone, i'd say it's not 'in firmware' and so wouldn't change much??

in my eyes, bios confiugres some stuff like smm etc., then hands over to bootloader (grub or so) which further initialises system ,and hands over to OS. (linux?) So this just seems to skip the bootloader? of which most initialisation is ignored / reinitialised by linux anyway?

</comment><comment><USER35> MS-DOS on BIOS Linux on MS-DOS (UEFI) ??? on Linux (this)

Great

</comment><comment><USER36> Wonderful! I detest the UEFI/secure boot schema in use on post-Windows 8 systems

<comment><USER7> This doesn't really have anything to do with Windows, recent Linux and FreeBSD release prefer to use UEFI and Secure Boot if available.

While UEFI is platform/OS-agnostic, it's too early to tell if this LinuxBoot will be as open (even if better designed). Additionally, there _are_ benefits that Secure Boot brings to the table (notable with regards to security and integrity verification) that you should not be so hasty to throw out along with the bathwater. If LinuxBoot does not support Secure Boot, I can guarantee you it will be a project dead in the water, no one (in the corporate world) will want to go back to untrusted boot.

<comment><USER33> The threat model that LinuxBoot is addressing is different form SecureBoot and it can use the well known, normal Linux tools rather than the unconventional UEFI ones.

The Heads runtime can do things like use TPMTOTP to attest to the user that the firmware is unaltered and includes gnupg to verify the kernel and root filesystem signatures with the user's own key.

For cloud systems a LinuxBoot runtime can use the TPM or other trusted hardware to remotely attest to the client's own provisioning server that the configuration is unchanged, and since it is reproducibly built, that the firmware is what the user expects. This is significantly more trustworthy than the binary blobs and non-reproducible UEFI firmware on most servers.

</comment></comment></comment><comment><USER37> No, and I'm sorry that it came to this. The article presumes that the quality of the Linux kernel is indisputable, and it simply isn't.

</comment><comment><USER38> Now systemd will be in the boot loader, too, so finally we'll be able to have _perfect_ power management in Linux, once it controls everything first-hand :-)

<comment><USER39> You can put whatever in the initramfs, but since Linux just boots as a UEFI executable with CONFIG_EFI_STUB=y, it would be somewhat silly to start up a full userland via systemd in the bootloader.

systemd-boot is a thing though, which is a pretty small UEFI application that reads a Freedesktop Boot Loader Specification config [1] from an EFI partition and tells UEFI to boot a kernel directly. Definitely no Linux or systemd-init involved though.

[1]: [https://www.freedesktop.org/wiki/Specifications/BootLoaderSp...](https://www.freedesktop.org/wiki/Specifications/BootLoaderSpec/)

<comment><USER40> (formely known as gummiboot)</comment></comment></comment>


Ask HN: What tech has made us better? - <AUTHOR> Advancements in technology continue to make our lives better. What advancements have actually made us better people? I know "better" is subjective, but I'm thinking along the lines of more honest, more empathetic, more kind, generally better behaved, etc. Definitely open to interpretation - but interested to hear what people think. <comment><USER2> I don't think it has made us better humans, it has made us weaker humans in the biological and physical sense.

I don't need a powered toggle to roll down the windows in a car, but technology assumed I did, and it's little things like that, which make us weaker and lesser than our primitive counterparts.

The most primitive self sufficient savage is superior to the technological cube dweller.</comment>


Goism – Use Go instead of Emacs Lisp inside Emacs - <AUTHOR> https://github.com/Quasilyte/goism <comment><USER2> I haven't taken an incredibly close look at this, but it seems like a pretty bad idea. Elisp is definitely not a great language, and I'd like an alternative as much as the next Emacs user. But I feel pretty strongly that any alternative has to be a Lisp, or very close to one. Code-is-data/data-is- code is very important for the more "config-file" aspects of configuring Emacs. Being able to use and write DSLs to succinctly encode exactly how you want aspects of the editor to behave is a critical strength. I've tried systems that were configurable in Python and other good-but-non-Lisp languages, and it's always much more annoying, because the language is (purposefully) limited w.r.t metaprogramming and possible DSLs. That's a good thing when optimizing for maintainability by others and obviousness, but not so much when optimizing for maximum personal customizability.

Go seems like quite possibly the polar opposite of this, as far in the "keep it simple and understandable by literally everyone by cutting out many techniques for metaprograming and code reuse". Which perhaps is the point, but if so it seems like that point misses much of the draw of Emacs?

While this is definitely impressive technically, I think Guile Emacs is a much more plausible option.

<comment><USER3> I used Emacs Lisp for scripting tasks like code and data generation. It is great to have an ability to evaluate form right inside the spot you want results to be inserted. This kind of code does not require AST manipulations or macro.

Also, some of my projects that become bigger than 1000 LoC could benefit from static typing and (subjectively) better tooling.

By the way, I think extending Emacs in Racket would be great; just do not have an idea on how to implement that integration smoothly.

<comment><USER4> You may already know about Guile-Emacs, but in case not, take a look at [https://www.emacswiki.org/emacs/GuileEmacs](https://www.emacswiki.org/emacs/GuileEmacs) . Guile is not Racket, or more precisely Racket is no longer exactly Scheme, but they are closer to each other than to elisp.

</comment></comment></comment><comment><USER5> The idea of using a language without Map/Reduce/Filter as a substitute for a Lisp, in an editor built around Lisp...seems vaguely antithetical to me.

<comment><USER3> You can call map/reduce/filter from Go code: `xs := lisp.Mapcar(f, ys)`.

Mapconcat is already used inside runtime implementation: [https://github.com/Quasilyte/goism/blob/master/src/emacs/rt/...](https://github.com/Quasilyte/goism/blob/master/src/emacs/rt/builtin.go) (Print and Println functions).

<comment><USER6> Why did you get downvoted for this?

</comment></comment></comment><comment><USER7> I agree Emacs Lisp is pretty inferior as far as lisps go, but IMO this seems pretty misguided.

Technically impressive, I'm sure, but will it be around for another 30 years?

If someone writes a module using this, will I be able to rely on that module keeping on working for the years to come?

<comment><USER8> Why wouldn't that be the case? The golang authors have been pretty strong on backwards compatibility so far (even though it is admittedly a young language).

<comment><USER9> Is josteink talking about Go or Goism? Probably the latter.

</comment></comment></comment><comment><USER10> Neovim has a go client[1] for nvim's RPC API. Vim doesn't have bytecode to speak of, so of course there's no transpiler step. But it removes the friction of integrating between nvim <-> go, and that is "useful when it's useful". In particular it enabled a new UI[2] to be built in go.

[1] [https://github.com/neovim/go-client](https://github.com/neovim/go-client)

[2] [https://github.com/dzhou121/gonvim](https://github.com/dzhou121/gonvim)

</comment><comment><USER11> Dear God, no. No. Please, just give me Guile. Please. We've been so good. So patient. Guile.

</comment><comment><USER12> What a sad idea.

Seriosuly, is that hard to learn Emacs Lisp? Even if one is using Go or Rust (etc) at work, any programmer worth his salt should at least already be familiar with Lisp syntax.

It is one of the easiest languages to learn!!

<comment><USER3> I love Emacs Lisp.

Emacs has really good support for it which continues to improve over time.

But.. I love more than one language (and more than one Lisp for sure). Will you try to persuade me that I am wrong in that regard?

<comment><USER13> Emacs only having elispallows me to fix the third party code that I have in my config, and simplifies all the things. Thoemacs already has C too now, there is module support. I guess it could be possible to use Rust via that interface too, and maybe go. But better keep these to a minimum because elisp is one of the things that makes emacs great

</comment></comment></comment><comment><USER14> Another case where it'd be nice to have a "Why are we doing this?" section in the README.

If it's just a demo then it's neat. Interesting that it can be done.

On the other hand, if it's a real push to get people scripting Emacs with Go, then I don't see the point at all. It's solving a problem people don't really have.

<comment><USER15> > It's solving a problem people don't really have.

Isn't "I want to script Emacs but I don't like LISP" a problem to solve?

<comment><USER16> A better thing to answer would be why people prefer less powerful languages to the more powerful, and what can be done about it? Framed that way,this seems like an XY problem.

<comment><USER17> >why people prefer less powerful languages to the more powerful

Clearly, power is the only measure one should consider when picking a programming language. And Lisp surely has more power than Go. I'm going to guess 36.1% more power, to be exact.

>and what can be done about it

We could always start performing eugenics to get rid of them.

... Okay, I apologize for being an ass. But I hope my points aren't lost; the way you're phrasing things makes it feel like you're bitter that anyone would consider using something that's not Lisp.

<comment><USER16> >I'm going to guess 36.1% more power, to be exact. Where's this figure from?

>We could always start performing eugenics to get rid of them.

I meant more like what we could do to improve the more powerful languages to make them more appealing.

I'm less bitter than I am perplexed about the choice to use Go over Lisp.

<comment><USER17> It was sarcasm. Obviously one can't objectively measure the power of two languages. I assume you mean it has more powerful metaprogramming than Go, which is what everyone else is saying.

But I find the rhetoric quite closed-minded, because I doubt any of the people replying here who've just found out about this and are calling it a bad idea have actually tried it yet. Clearly, there are advantages to Lisp that you would lose if you tried to do something in Go. But nobody is acknowledging the reverse, that there may also be advantages in Go to Lisp that are unforeseen, even for this specific task.

All in all this is a disappointing development. I don't think it would go over the same in other text editor communities, because people seem very defensive about the use of languages in place of Lisp where they might not be so defensive about the use of languages in place of say, VimScript.

</comment></comment></comment></comment></comment></comment><comment><USER18> ...and write all the types (without generics) - no, thank you!

Sarcasm aside, Lisp is as much as possible well-suited for the job of text and AST processing, Emacs is one of the Lisp's "killer apps" and the second best "case study" after classic old-school AI code (PAIP).

</comment><comment><USER19> Congratulations, keep up the good work.

</comment><comment><USER20> How does it compare to something like [https://github.com/janestreet/ecaml](https://github.com/janestreet/ecaml) ?

<comment><USER3> I see three main approaches for the tasks projects like ecaml and goism try to solve:

1\. Use a plugin system (ecaml)

2\. Transcompile to a target language (gosim and emscripten-like platforms)

3\. Embed another VM inside Emacs and call its eval

There are many differences between these approaches and I am not sure one of them is objectively better as a general solution.

For the end users, all of these approaches can deliver good level of integration (they require different sets of tricks to achieve that).

</comment></comment><comment><USER21> Replacing a 50s language which a 60s language! Amazing!

</comment><comment><USER22> Being able to script the editor in something other than Lisp seems good to me (despite the objections of others in this thread). After all, many people are just scripting settings and stuff for themselves. Might as well not make them jump through hoops to do so.

I wonder about the implementation strategy -- why compile to Emacs LISP instead of doing a plugin (FFI) or RPC style setup?

</comment><comment><USER23> What happens if I hover over a goism function and hit M-.? Do I get dumped into the go source?

<comment><USER3> Currently, no. Hope I get your question right..

Name mangling scheme preserves fully qualified package path. All goism sources live inside GOPATH (1), so nothing stops us from implementing a jump to Go definition.

For given `goism-foo/bar.baz` Emacs symbol, Go definition can be found in `GOPATH/src/foo/bar/` package. Exact location can be found by using existing Go tools (simple grep-like solution can work, too).

(1) It can change in future; see [https://news.ycombinator.com/item?id=13368846](https://news.ycombinator.com/item?id=13368846) and even more relevant: [https://github.com/golang/go/issues/17271](https://github.com/golang/go/issues/17271)

</comment></comment><comment><USER24> Why?

</comment><comment><USER25> Is it possible to have a language transpire/compile to elisp?

<comment><USER3> It is possible to emit Emacs Lisp instead of bytecode/lapcode. This was the first code generator target actually.

Easier to debug, simpler to trust (for the end user) and not that hard to generate.

The problem is that it is harder to implement some features of Go in terms of Emacs Lisp without going down to the virtual machine level. Best examples are arbitrary return statements (can be emulated by throw/catch) and goto.

<comment><USER26> Could you implement arbitrary return with cl-block and cl-return-from?

<comment><USER3> With minor Emacs Lisp compiler patch (addition of %return, %goto and %label intrinsics), it is now possible to output Lisp that is optimal.

Possible implementation (about 20 lines of code): [https://github.com/Quasilyte/goism/issues/57](https://github.com/Quasilyte/goism/issues/57)

Not sure if "defadvice" around "byte-compile-form" is acceptable for all users.</comment></comment></comment></comment>


The TV antenna is making a comeback - <AUTHOR> http://www.marketplace.org/topics/business/new-generation-discovers-good-old-tv-antenna <comment><USER3> I'm 24 and I have never had cable in my life. Frankly, I'm surprised it's not more common. You get a LOT of TV for free. I grew up watching PBS and Simpsons and etc.

I remember at superbowl some of my friends were amazed that I was able to watch the football game without cable. I was floored. They didn't even know that channels came in over the air. I showed them the antenna, where it installs in the TV, how cheap they are. I got HD video without having to pay anything.

These weren't dumb people either. They worked for tech companies. They legitimately did not know it was an option.

A lot of people cut their cables after that party.

<comment><USER4> How on earth does this situation come about? Hypereffective advertising by the cable companies?

<comment><USER5> Related: Replacing incandescent light bulbs with LEDs - nowadays LEDs have about 95-99% of the warmness profile of an incandescent and are relatively cheap (can result in <1y ROI), but people still keep buying incandescents.

Another related: NiMH slow-discharge batteries (Eneloop) are very good, last as long in a remote control, and have more consistent charge levels than an alkaline. Yet people (even enviro-conscious relatives) keep buying alkalines. Why?

<comment><USER6> I haven't had much experience with LED bulbs, the early ones I saw weren't omnidirectional, cost a bunch, and needed good ventilation for a reasonable lifespan. I earnestly tried CF for awhile. Maybe due to early technology or cheap bulbs I had to replace them way more than incandescent (I suspected inconsistent power affected lifespan). In addition to that, the extra price and bad color temperatures or flickering bothering me made be go back to grabbing incandescent bulbs when I've had to replace lights. I do plan on doing research and switching to LEDs--I've noticed some LEDs have flickering that annoy me I hope I find something I like after some research.

A year or so ago I bought a recharge pack (Microsoft branded) for my 360 controllers. After only a few charges they wouldn't hold a charge anymore so I went back to alkalines. Either it was a poor quality battery, poor charger, or poor charging habits.

Taking time to research and paying more for a quality solution can be too much for most people. Prematurely releasing technology or poor implementations can also turn people off.

</comment></comment></comment></comment><comment><USER7> I took a look at a relative's cable bill last year. He lives in a town with three competing cable/ISP services. Here is how the monthly costs broke down:

 _Expanded basic service: $60

High definition converter box: $10

Digital converter rental: $3

HBO Cinemax package: $18

Premiere Total Pack: $16

Showtime/TMC: $5

Starz: $5

Franchise fee: $7

Broadcast TV surcharge: $4

Sports programming surcharge: $2

Total monthly cost: $130

Annual cost: $130 × 12 months = $1,560_

That doesn't include Internet access, which adds another $60 or $70 per month, plus the land line. So they're paying close to $250/month. Sadly, that's typical for a lot of people around here, who often get suckered in by $99 "triple play" deals and don't read the fine print about extra fees, premium packages, or escalating rates after years 1 and 2.

It's a total racket.

One thing to add about TFA: DTV reception even over a good antenna within 10 miles of the broadcast towers can be spotty. We live near Boston, and every time a car drives by our house the image freezes even for the big VHF channels.

<comment><USER8> I don't know about that last point. I live about 45 miles from Philly and 55 miles from NYC. I get pretty much all of the stations from both with minimal drop and I have a $35 antenna inside in my attic.

<comment><USER9> I'm curious about the antenna you're using. I'm also approximately equidistant from NYC and Philly, but I tried a digital antenna once, and could only pick up one NJ station, and none of the NYC or Philly ones. I'd love to find an antenna that works!

<comment><USER10> > I'd love to find an antenna that works!

Try the "coat hanger antenna" (google it). It's directional enough to be effective. There are some tweaks you can make to it to adjust how directional it is. (Adding more elements, or doubling it mainly.)

It's very cheap so you can experiment.

You'll need one of those impedance converter thingies to convert from twin lead to coax.

</comment></comment></comment></comment><comment><USER11> With Chromecast (or something similar to connect your computer to TV), and a decent Antenna, you do not really need anything else. Plus, most of the things that we watch are on-demand anyway - we don't have patience to sit through commercials for 1 hour to watch 20 minutes of a Sci-Fi episode.

<comment><USER12> > With Chromecast (or something similar to connect your computer to TV), and a > decent Antenna, you do not really need anything else.

Unless you want to watch a lot of sports.

<comment><USER13> Pretty much all of the MLB stuff (except for playoffs) is cable only. NFL will at least of the either Monday or Thursday game along with your local on Sunday.

<comment><USER14> Even the playoffs for MLB are cable only.

[http://m.mlb.com/postseason-schedule](http://m.mlb.com/postseason-schedule)

OTA FOX only gets one or two playoffs games and the World Series.

In previous years it was possible to watch most of the games online via "live alternative video feeds (excluding the broadcast feed)", and now even that is not allowed.

Check out all the disclaimers and fine print here

[http://mlb.mlb.com/mlb/subscriptions/index.jsp?&affiliateId=...](http://mlb.mlb.com/mlb/subscriptions/index.jsp?&affiliateId=MLBTVREDIRECT)

<comment><USER15> I suspect that some league (NHL perhaps?) will specifically exclude webcasting from its next huge TV contract. Or it will extract a higher price _not_ to be the first to do so. It will be the beginning of the end for regional sports channels, and eventually for ESPN.

</comment></comment></comment></comment></comment><comment><USER16> This kind of TV is the 'default' here in the UK (Freeview) - we get about 50-60 digital channels and 10 HD channels.

I suspect cable TV is actually on the rise here, but can't find stats to back that up.

<comment><USER17> The Brits really have us beat here. For Americans, take a look at this list: [http://www.ukfree.tv/channels/all](http://www.ukfree.tv/channels/all)

On the other hand, they have to pay an annual government tax just for owning a TV.

<comment><USER18> The TV Licence funds the BBC content, which is Free to Air TV, online stuff, Radio etc. It has no ads and aims to have as much diverse stuff as possible.

The BBC is awesome, I happily pay my tv tax :)

<comment><USER19> I'm also happy to pay, and feel sorry for Americans who have to put up with inferior public TV services.

Not only is the BBC awesome, the licence fee is much lower than cable or satellite charges, and BBC programmes are not stuffed with mind-numbing adverts.

</comment></comment></comment></comment><comment><USER20> Two years back I decided to make my own antenna. I had no idea what a folded dipole was, but found a website that instructed me to use a metal clothes hanger cut to the proper length for HD US signals, and a block of wood. I had neither so I taped some leftover enamel wire to a piece of cardboard. I still use this antenna today, and get about 50 channels, living 30 miles away from the nearest broadcast antenna.

Point is, these broadcasts are incredibly easy to access, and it doesn't seem like the voodoo designs of $200 dollar antennas are actually needed by most people. It's somewhat surprising TV manufacturers don't simply add simple antennas as an accessory the same way my FM radio tuner came with one.

<comment><USER21> Awesome. Care to share the resources you used for this project?

<comment><USER20> It may have been this page, though I'm pretty sure the resource I used told me what length to cut it. [http://www.diytvantennas.com/dipole.php](http://www.diytvantennas.com/dipole.php)

Still, we can figure this out: Wikipedia says North American UHF frequencies are on average 680MHz across all channels, which corresponds to a wavelength of about 44cm. A folded dipole needs to have a length half of that, so we want a 22cm antenna when folded, plus about a 1cm gap.

</comment></comment></comment><comment><USER22> I just recently installed an antenna in our attic after we cancelled our cable TV, and I've been very pleased with the results. Here in the Atlanta area, we're getting almost 60 TV channels, plus about 10 audio-only simulcase of several local radio stations. There's even a channel that displays a program guide, like the ones you find on the cable or satellite services.

People's lack of awareness of over-the-air television has been surprising to me. We had houseguests last week, a retired couple in their 60's. This is in the age range that I would expect to be familiar with broadcast TV, having grown up with it as the predominant, "default" option. And yet, I was still asked, "so you don't get CNN?"

[Edit: text formatting]

<comment><USER23> I suspect that, for many people, getting cable (or satellite) has just become sort of the default. Of course, many do watch sports which often (though not always) run on non-network channels.

Also, not everyone is able to get TV OTA or is in a position to install an attic/rooftop antenna. I personally can't get anything OTA. I regularly toy with cutting back to a very basic bundle but haven't seriously pursued yet.

<comment> Lx1oG-AWb6h_ZG0 That's a bit misleading. Most NFL games are only available on network channels, not ESPN/Fox Sports/Univision. I'd hardly call that minor.

<comment><USER23> Well, that's just one sport. In New England at least (and I assume this situation exists in other places as well), a lot of the local sports are primarily just on cable--NESN in the case of New England.

I don't watch much in the way of sports in any case, but a lot of people buy cable and satellite sports packages.

I actually agree with the basic point up-thread though. I do think a lot of people probably pay for their monthly cable package without a whole lot of thought about how much value they're getting and what alternatives there might be.

</comment></comment></comment></comment><comment><USER24> You don't even need a TV to take advantage of this if you have a computer.

You can buy a tv tuner card that will connect to your laptop and allow you to plug in an antenna to watch TV.

Something like this: [http://www.amazon.com/Hauppauge-1191-WinTV- HVR-955Q-Tuner-No...](http://www.amazon.com/Hauppauge-1191-WinTV- HVR-955Q-Tuner-Notebook/dp/B001DEYVXO/ref=cm_cr_pr_product_top?ie=UTF8)

<comment><USER4> I do this with Windows 7's included Media Center as a PVR. I was surprised when checking out popular "media center" software that most of it seems to concentrate on playback of videos and not support being a PVR.

<comment><USER25> Don't upgrade to 10. They killed WMC...

</comment></comment></comment><comment><USER26> Get internet service from cable provider with basic cable plus HBO for less than the advertised price of the internet service alone. Have to call back every year to get the promotional price back, which sucks. But we almost never watch the cable channels. Local channels in HD with a couple low-end antennas in the attic. And tend to watch HBO GO on a Roku, where we also have Netflix, Prime, etc.

Doing Sling during football season for ESPN.

As others have said, would like to have a better antenna setup with DVR that does not require subscription. Need a community-driven site where people can put in the type of antenna they have and what channels they get for more precise location-specific antenna recommendations.

<comment><USER27> >would like to have a better antenna setup with DVR that does not require subscription

I have been looking at a Channel Master[0] for this exact purpose; the cost is $250+HDD. It has an ethernet port which allows one to get an EPG [1] from Rovi, but it isn't required. If I pull the trigger maybe I'll do a write up and submit it.

[0][http://www.channelmaster.com/Antenna_DVR_s/336.htm](http://www.channelmaster.com/Antenna_DVR_s/336.htm)

[1][https://en.wikipedia.org/wiki/Electronic_program_guide](https://en.wikipedia.org/wiki/Electronic_program_guide)

<comment><USER28> Isn't an EPG part of the US-American standard? It has been part of the DVB (rest of the world…) standard since the beginning, so there's generally a button on a TV remote to display it.

(The DVB MPEG transport stream contains mostly video packets, but is interspersed with the EPG — in bits — and other media. Almost all TVs will cache the EPG, though earlier systems required the user to wait until the requested information was rebroadcast.)

<comment><USER29> EPGs are part of the standard and broadcasters are required to transmit them, but there's no quality control on them beyond what the broadcaster does themselves; some broadcasters do a great job and some... don't.

That's where paid services like SchedulesDirect [1] come in; they pull data from the same source that Tivo and the cable/satellite companies are using, which (usually) gives you accurate scheduling.

[1] [http://www.schedulesdirect.org/](http://www.schedulesdirect.org/)

</comment></comment></comment></comment><comment><USER30> In 2010 when I lived in the San Francisco I ordered my broadband from Comcast, but I didn't pay for the TV package.

I added a splitter to the Comcast coax cable, then plugged one wire into the cable modem and the other into the back of my TV. Network TV channels for no extra cost.

<comment><USER31> This was technically stealing.

<comment><USER32> There's precedent for things that get delivered to you being yours to use, even if you didn't order or pay for them. While I am aware that it is absolutely not the same thing, there is a law that anything sent unsolicited to you in postal mail is yours to keep, no questions asked. This is to prevent a type of now-dead fraud that involved doing that, then billing people for it.

It's really the responsibility of the cable provider to correctly filter services, if they want to charge for them. And you'll probably find that if you call up and try to "complain" about this, that they'll do nothing and tell you to do as you like, as it isn't even worth their time to bother about... putting a rather low bound on the degree of harm you're "inflicting" on them even in the worst case.

<comment><USER33> I understand your point, but I think there's a difference between the cable company "correctly filtering service" and a person getting additional hardware to bypass the cable modem demarcation. It does get muddied by them allowing customer cable modems, which means there's not a clear a demarcation point anymore.

<comment><USER34> There may be a terms of use clause forbidding splitting like this but it almost certainly isn't a demarcation issue, so there is no real 'bypass' that I am aware of.

The demarcation is generally clearly marked (plastic box often called a 'network interface device') and is almost never located at the modem itself.

Typically, the legal demarcation is on the exterior of houses. For a multiple dwelling unit (apartment complex) or commercial building, the demarcation is usually inside. ISPs try to choose a demarcation that is accessible from the outside, so as to not require being allowed into the building to test signal leading to the premise. This cuts down on cancelled repairs due to 'no access'. My point in all this is that for most coax and twisted pair services, the indoor wiring is usually the property owners and not the ISP's, especially at the point where it connects to the modem. For someone to add a splitter to wire that is their responsibility and property is almost certainly legal.

I worked for one of the bigger ISPs up until last year, so I speak only from my personal experience. For more details:

[https://en.wikipedia.org/wiki/Demarcation_point](https://en.wikipedia.org/wiki/Demarcation_point)

<comment><USER33> > The demarcation is generally clearly marked (plastic box often called a > 'network interface device') and is almost never located at the modem itself.

Yes, but if cable companies always provided and required you use their cable modems, then there would be a clear demarcation point, the cable modem. Whether it's usually inside or outside is irrelevant (and "usually" in this case is debatable. I've worked at multiple business locations where it's inside, because there is a location dedicated for it). Of course there _isn 't_ a clear demarcation at the cable modem, as many cable companies allow you to use your own cable modem instead of theirs, which is why I said the issue is "muddied".

</comment></comment></comment></comment></comment></comment><comment><USER35> I don't get it. Who's broadcasting the signal? How do they get paid?

<comment><USER36> Local television stations (__not__ networks - although there are a small number, limited by law, of network owned-and-operated local stations - <USER2> the biggest markets), which may or may not be affiliated with a network (CBS, NBC, Fox, ABC), broadcast the signals.

If a local station is affiliated with a network, they've agreed to broadcast the network's prime-time feed (7pm - ~midnight) including the national ads that the network has sold to large brands.

The local tv stations get (not very many) ad spots to insert in between national ads. The local tv station does not generally get any revenue from the national ads (the big ads for big brands - Coke, Apple, Nike) and only receive revenue from local ads (Stu's burger shack down on main street).

There are also open slots where the national network does not have shows scheduled and local stations can broadcast locally produced shows, News, and, sadly, tons of infomercials. This is the non-prime-time - daytime, weekends and late night.

If the show being broadcast is locally produced, there are generally more open ad slots for local ads. It is possible that the local station also gets a cut of national advertising during that show.

The local TV station has purchased the exclusive right to use the frequency/channel (in a particular "market") from the Federal Government, but has to provide, as part of the agreement, a number of things, "to promote the public welfare" \- such as educational programming, community service programming, and a few other things.

</comment></comment><comment><USER37> What I'd like is an easy, cheap DVR solution for OTA. Mostly I'd just like to be able to pause and rewind live TV. After cutting the cord, it's like living in the 80s again shouting at family members to be quiet when you need to hear something.

<comment><USER38> Not exactly easy or cheap, but a data point for you:

My OTA DVR for the last 8 years setup has been a PC with Windows Media Center. Apart from the setup, there is no monthly cost for the guide data, as with Tivo etc. Right now this runs on a NUC, with a SiliconDust HD Homerun (HDTC-2US) living in my attic, which transcodes the OTA MPEG-2 to H.264, saving tons of disk space. A nice side effect is that I can archive shows (e.g. NOVA episodes).

P.S. One interesting tidbit I remember from a Tivo ad (but can't dredge up right now), based on their users TV consumption stats, apparently ~ 87% of what people watch is available OTA.

Edit: Windows Media Center was dropped from Windows 10. The replacement will be Xbox One DVR functionality, coming 2016.

<comment><USER39> Interesting, I have a similar setup, but with the old standard PCI-based tuner that just pulls the data and dumps it. I hadn't seen a tuner option that would transcode it on the fly. Is there any noticeable lag when watching live? Does the WMC still record it in the standard wtv format, just with a different video codec?

What's a rough size estimate for a 1-hr show? Can you adjust the amount of compression or otherwise tweak the h.264 encoding parameters?

<comment><USER38> Transcoding happens on the fly, in hardware I assume. The compression is configurable, from a very high quality 1080p profile, down to more lossy streams for mobile devices, 3 profiles total IIRC (non tweak able). The highest quality mode is _almost_ indistinguishable from the OTA signal. No lag or stutter, whatsoever.

An added bonus of the transcode is the reduced bandwidth in the LAN. Previously I needed CAT5 for a stable ATSC stream, now Wifi suffices (e.g. to iPad/iPhone). There is an app for the iPad, to watch those streams. On iPad Air 2 it renders 1080p without lag.

Also, putting the HD Homerun in the network let's one get away with a small head unit (in my case an Intel NUC).

You are correct, the resulting files are still wtv container, but with h.264 stream inside. VLC can play them fine. Not sure about conversion to MPEG4.

A 1-hour show comes out around 1.5GB (from memory), maybe less. Much better then before.

<comment><USER39> Great info, thanks. That's a 4-6x size improvement from what I'm seeing now, so that'd be very helpful. Probably actually cheaper to buy this than just get a larger HDD.

I'd looked at options that would auto-transcode recordings on disk, but they generally changed enough things that it wouldn't maintain the metadata and/or otherwise treated them as individual videos and not episodic content.

One last question, do you happen to have any extenders? I'm using an xbox 360 as an extender and I wonder if it can play the h.264 encoded video.

<comment><USER38> I did indeed have a Linksys extender, which stopped working completely after upgrading to MC on Windows 7. Don't know about the 360.

</comment></comment></comment></comment></comment></comment><comment><USER40> If you're using an OTA antenna to get HDTV, this site can help you point it in the right direction to get the best signal. Just enter your ZIP code.

[http://www.antennaweb.org/](http://www.antennaweb.org/)

<comment><USER41> A much more advanced tool here.

[http://tvfool.com/](http://tvfool.com/)

<comment><USER40> Nice.

Click "See which TV stations you can get on a map", then click ">> Start Maps <<" and enter your address or just the zip code. When the map appears, check the "Show lines pointing to each transmitter" checkbox for best presentation.

<comment><USER39> That tool is handy, but I think the more standard one, especially if you're looking for antenna advice on somewhere like the CordCutter reddit, is actually under 'Check your address for free tv'.

Same major data provided, but in a table that's easier to pass around and you generally don't need the map unless you're just curious.

</comment></comment></comment></comment><comment><USER42> My understanding is that OTA HDTV is actaully uncompressed, which means you get the best HDTV picture quality when receiving over the air.

Cable, uVerse, DirecTV etc all compress their HDTV signals resulting in far more artifacts and pixelization. It is far more noticable when you have a 120 inch projector displaying a football game with lots of moving images etc.

<comment><USER43> OTA uses the 8VSB modulation standard, which provides about 19 mbit/sec of payload.

If your station is not broadcasting any subchannels it's a VERY nice signal. (It's still compressed with MPEG-2, the raw bitrate of a 1080p video is over 1Gbit/sec)

Unfortunately most channels in my market are sending 3-4 subchannels which knocks down the quality of the primary. AFAIK only Fox broadcasts a single stream (and football looks pretty freaking great there).

Yes, the cable and dish operators recompress the MPEG-2 stream into whatever they are broadcasting and they do it at a lower quality to cram more channels into their pipe.

<comment><USER44> It depends on your local station; my Fox affiliate does have subchannels. But the Fox network is only 720p anyway, so they should have the bandwidth available.

</comment></comment></comment><comment><USER45> My experience was almost exactly that in the OP.

I bought my first TV used off craigslist 6 months ago (I'm 30, lived past 12 years w/o a television), mainly intending to use it as a big monitor to watch movies/tv shows from my laptop via HDMI.

I started to get into local sports, but wasn't willing to pay for cable. I suffered through a few poor quality (aka "was that a touchdown or interception?") internet streams of the games.

Then one day I recalled that had a TV, not just a big monitor. $15 dollars later I had an antennae and was getting the local football games over-the-air in great HD.

</comment><comment><USER46> OTA TV is $250 per year in the UK, before equipment.

If you get satellite / cable you still have to pay.

If you watch live on computer, pay up.

<comment><USER47> Heh, they used to drive around in the UK with an EM locator, looking for unlicensed TV's to tax. Craziness.

<comment><USER48> You mean unlicensed TV _broadcasters_? How could they track a _receiver_?

<comment><USER40> In the CRT days, from the HF section or the flyback transformer leaking signals. Not sure how they'd do it today with LCDs.

<comment><USER49> Sound could be an option.

A TV license is required to watch broadcast television, so the number of channels they could be watching is finite. Even a muffled signal detected from a vibrating window (via laser microphone) could be compared to what is currently being broadcast by each of the channels (give or take a short processing delay) and any match found.

Nowadays it's mostly database enforcement. You obviously don't have to care about addresses that do have TV licenses so you just go looking for people with various TV subscriptions (Sky, Virgin Media) that don't have a TV license. It used to be done by the retailers submitting addresses of people who bought/rented TV equipment (TV, VCR, etc), any that didn't get (or already have) a TV license would get a visit shortly afterwards. Also people who watch programmes 'live' on-line (IP -> address conversion thanks to the DSL providers).

</comment></comment></comment></comment></comment><comment><USER19> One advantage of OTA TV is that it can be a very efficient use of spectrum. It costs the same to broadcast a TV signal to 5 million users as it does to broadcast it to 5 users. This is not the case with video (or radio) transmitted over the internet or via cellular networks, where every additional user consumes additional bandwidth.

<comment><USER50> The internet is not as simple as you imagine it to be.

<comment><USER19> I'm not as simple as you imagine me to be.

</comment></comment></comment><comment><USER51> I had cable for one year after college (U-Verse had just come to my city and it was actually cheaper to get cable + internet than just internet for the first year), then cancelled. Only reason I have it now is that my roommate is locked into a contract for a few more months (cancellation fee is greater than just playing out the string, and there are some small convenience benefits, particularly for sports). However, we'll be cutting that cord in December for good. I've had a Mohu Leaf, Roku, and a Chromecast for 3 years (OTA, apps, mirroring), and to be honest, the only things missing for me are Pac-12 Network and TNT (which only matters for select NBA games, anyway). Now that SlingTV offers TNT, Pac-12 Network is really the only thing I'm aware of that isn't legally available without cable.

</comment><comment><USER52> I'm a little confused here as a Canadian, and was wondering if anybody could help me out?

When searching for TV antennas on Canada Computers (my go-to electronics store in the GTA) I am met with cheap iCan (Canada Computer in-house brand which is quite good usually) digital antennas which claim they have UHF/VHF reception for about $10.

Then there are ATSC antennae which are all more expensive (~$20) and anything I read about ATSC [0] on wikipedia sounds like that's the one I need.

So basically my question is will the cheaper antenna work? They have thousands of them in stock across the country so it must do something... I'm planning on picking up one tomorrow to watch the Jays.

I would ask them in store but I somehow doubt that their salesmen (who are usually great) will know much about TV antennae.

</comment><comment><USER53> The tech is great. I bought a "COLOR TV ANTENNA" from Radio Shack, when they were still open a few years back. Amazingly, it came in the same looking box I recall from the late 70's. (upgrading mom 'n pops old antenna as a kid to get UHF channels)

Took an hour to get a good orientation. Mostly problem free, and there are some 30 channels here in PDX, maybe 10 of them offer something I might watch.

And that's the only real problem area. Commercial AD loads are HIGH. Higher than I remember in the past. Quite frankly brutal, and there are very few things I'll watch, given that high load.

Mostly, I use a Chromcast to stream things to the nice smart tv and call it good.

<comment><USER54> PDX is the airport code for the Portland airport just in case you don't keep up with the airport code for the 19th largest US metro area.

<comment><USER55> Ha, thanks! Like my multiplication tables, I have only memorized the codes for the top 12 metro areas.

</comment></comment></comment><comment><USER56> Forums about TV antennas:

* [http://forum.tvfool.com/forumdisplay.php?f=10](http://forum.tvfool.com/forumdisplay.php?f=10)

* [http://www.avsforum.com/forum/25-hdtv-technical/](http://www.avsforum.com/forum/25-hdtv-technical/)

* [http://www.digitalhome.ca/forum/81-over-air-ota-digital-tele...](http://www.digitalhome.ca/forum/81-over-air-ota-digital-television/)

* [https://www.reddit.com/r/cordcutters/](https://www.reddit.com/r/cordcutters/)

</comment><comment><USER57> In my experience a lot of people don't realize you can get network TV in HD with an antenna. The cost of cable is just way too high to stomach given other available options, the best option being watching less TV.

<comment><USER58> Do people in your area skew towards a younger demographic?

Here, widespread cable tv became dominant in the early 80s. A lot of us had to use antennas to watch local tv on the main or secondary television sets in our homes.

I haven't polled anyone but I can't imagine that most people aren't aware that network tv can still be watched over the air.

</comment></comment><comment><USER59> My digital TV (MPEG2 DVB-T, I'm in Australia) antenna recently broke and I'm replacing it in the next few weeks.

Once it's back up and running I'll be using MumuDVB [1] to stream channels over my network. Even a Raspberry Pi 1 should be able to act as a "receiver" this way.

[1]: [http://goughlui.com/2013/11/10/project-building-a-dvb-t- tv-t...](http://goughlui.com/2013/11/10/project-building-a-dvb-t-tv-tuner- server-with-mumudvb/)

</comment><comment><USER60> Cordcutter here as well. My experience with HD antennae hasn't been great, although it seems to be more due to my basement location than anything else. I still get enough channels to keep it, but they periodically cut in and out, which is a bit annoying.

I've spent a good bit of time experimenting with Kodi add-ons and Chromecast- compatible apps. Those have worked pretty well for supplementing my substantial amount of local media.

<comment><USER61> I've been antenna-only for 6+ years now. My first antenna cost $60 and was OK. After a couple of years, I replaced it with a $100 version that is much better. I rarely ever have any issues with it.

</comment></comment><comment><USER62> I have a similar setup. I live in San Jose, and with a digital antenna and an amplifier, I get more than 60 channels, with 20+ in flawless HD. The farthest I think is in Napa. A not insubstantial number of them are in Vietnamese, but still. Sometimes it's nice to just turn on the TV and watch whatever's on in the background instead of having to choose something on Netflix or Hulu.

</comment><comment><USER63> As much as I like the idea of free broadcast TV and not being dependent on cable/satellite companies ...

1) Is over-the-air broadcast TV widely used anywhere? Very few even know about it where I live, but maybe there are places where it's more common.

2) Is it essential to any group of people?

3) Could we get more beneift from that spectrum by repurposing it for something else?

<comment><USER64> 1) In the US, its _everywhere_. Usually, the more urban the location, the more channels you can get.

2) It used to be the only way to get TV. And it costs a tiny fraction of any other type of content provider. So you could say its essential to low income people or people who think its immoral to support comcast.

<comment><USER23> Everywhere is a bit of an overstatement. Most, if not all, urban and suburban locations with reception rapidly falling off in exurban and, especially, rural locations (i.e. the vast bulk of the land area of the US). Obviously on a population basis, the OTA situation is a lot better but there's still a pretty rapid falloff as you get 30 miles or so away from urban centers with TV stations.

</comment></comment></comment><comment><USER65> I didn't have cable tv in college back in 2005. We used rabbit ears. I went without cable tv for 8 or 9 years and subscribed a year or two ago. I look back and I'm glad at the money I saved. I was blown away when HD antenna was introduced. The antenna is really underrated nowadays. I'd love to see it make a comeback.

</comment><comment><USER66> On a home we purchased, the house antenna that was mounted on the chimney picks up clear HD channels of the local stations that look wonderful.

Paying for TV doesn't make sense nowadays. If a home doesn't have an antenna on the roof, I would recommend it as an upgrade for anyone interested in the local channels.

<comment><USER67> Paying for TV can make perfect sense depending on someone's viewing habits and what they watch. If they're into live sports, for instance, an antenna might not meet their needs.

<comment><USER66> I completely agree. But I feel like in the very near future, content providers will start selling subscriptions to their service.

</comment></comment></comment><comment><USER68> I haven't paid for cable TV in a long time. We've got netflix and amazon prime, and pay the $20/mo for sling during college football season (I would gladly pay less for an NCAA streaming channel..). Everything we watch is covered by those.

</comment><comment><USER69> Winegard makes nice affordable OTA TV antennas. They are made in America too.

[http://www.winegard.com/hdtv-outdoor- antennas?q=offair](http://www.winegard.com/hdtv-outdoor-antennas?q=offair)

<comment><USER70> Costco carries a few different TV antennas including Winegard models. They're only about $40, they are flat and inconspicuous (basically look like a paper towel) and they work great!

</comment></comment><comment><USER71> What blows my mind is how many people I know who watch football on Sunday on broadcast stations in SD because their cable box isn't HD. When I tell them they could get HD with a $20 antennae their minds are blown.

</comment><comment><USER72> I love the idea of using an antenna. HDTV with 5.1 surround for no cost other than a rooftop or set top antenna? This is the future! (or the past) Only one problem, what if we live in an area where we are blocked from a signal? Could a community pool their money and buy a shared antenna? (as was done in the 1970s - this is how the cable companies go their start) No. We could not. The cable companies (and others) would sue. This is what happened with Aereo. Brilliant business model that made cable companies successful, is sued out of existence. TiVo bought their assets, so perhaps there's still hope. But it's sickening how much power we've given these anti-competitive companies.

<comment><USER67> Aereo was the anti-competitive one, I'm sorry. They were a cable company, just not paying the same fees that the other cable companies were.

</comment></comment><comment><USER73> Is there a reason the publisher links to a Google search of the Antennas Direct link instead of to the direct site? It was the only link that went to a Google search.

</comment><comment><USER74> What worries me is how long will it take for lobbyists or the government to mess this great free HD over OTA thing up in the US. Let's hope never.

</comment><comment><USER75> With the exception of sports and news, linear TV is dead. It doesn't matter if it comes from the cable company or an antenna. Once users get a taste of watching things on their schedule, they don't want to adhere to the broadcaster's schedule.

Also, I am going to predict that the advertising model used by current cable and broadcast networks won't ever work with on-demand programming. This is probably why Hulu now offers the ad-free option. Getting rid of advertising will improve the quality of the programming by removing the redundant parts.

<comment><USER76> Broadcast TV doesn't place any more restrictions or limitations on linearity of watching than any other transmission medium. If anything, broadcast TV places fewer restrictions since it's open access - anyone can connect and receive.

It's the devices used to receive the information, as well as the viewer's desire to be WATCH IT NOW which force the linearity.

</comment></comment><comment><USER77> The U.S. switch over to digital transmission killed my reception. The analog signal had no problem with the mountain ranges between me and the nearest metropolitan areas, but the digital signal can't make it through. I was using a rabbit ear antennae up until then.

I get the NYC stations. It's perhaps a horrible thing to say, but Osama Bin Laden's boys knocked out only one of my channels and only temporarily; the FCC, however, killed them all.

<comment><USER78> ATSC (well, 8-VSB) is pretty terrible at handling multipath. I live 12 miles from the antenna farm and ought to be able to get great reception with a bit of aluminium foil, but because I have a tree (who would have trees, right?) any one antenna position gets only about 2 channels well.

If the FCC hadn't succumbed to NIH and used the European version (COFDM), which handles multipath better, people might actually see the very nice picture available over digital broadcast.

<comment><USER74> Odd, we have trees and are 30 miles LOS from downtown. We get Fox, NBC, ABC, CBS, 3 PBS, the hmm forgot the name, CB? something. We get all we want which is main networks and in beautiful HD. I think Fox is in HD not sure, it looks nice though. If we spoke Spanish we'd have more choices. A few times a year in the early evenings Fox sometimes has issues but overall I'd pay for the quality we get if it wasn't free, not much maybe $10 most per month. Don't get any ideas US government!

</comment></comment></comment><comment><USER74> I think Netflix and ironically the government (in the US) deserve credit for enabling the cord cutting revolution.

</comment><comment><USER79> Cable to expensive? It's a 10 dollar addon(digital starter) if you have internet with comcast. It used to be cheaper to have internet and limited basic than just internet alone.

</comment><comment><USER80> If I can't watch a show or movie on my Apple TV (or other streaming devices), I just don't watch it.

Got rid of cable when I moved away for college, not going back anytime soon.

</comment><comment><USER81> I am always stunned of how USA are both forerunners of new technologies, and very backward as well... for credit cards with chip, digital television, gsm diffusion, etc etc... Also, in most of United States you can not get an european level ADSL.

<comment><USER82> The US is very, very big, and very, very empty compared to Europe. Outside of the I-95 corridor on the East Coast, some islands of density in the midwest, and the coastal zone of California, Oregon, Washington, it's overwhelmingly rural or uninhabited.

<comment><USER83> This is the correct answer.

Old, but still relevant density map: [https://en.wikipedia.org/wiki/Population_density#/media/File...](https://en.wikipedia.org/wiki/Population_density#/media/File:World_population_density_1994.png)

<comment><USER84> Norway and Sweden have excellent Fiber-to-the-Home and very low population density. You can get 1GBit/s symmetrical quite cheaply (I don't remember how much, one Swedish offer I found just now is $120/month).

<comment><USER83> 1\. I suspect that offer isn't available in northern Norway.

2\. They are only a couple hundred miles from the big internet exchanges in the Netherlands and Germany. Most of those miles can be covered with undersea cables, so you don't need to dig, which is expensive.

3\. The U.S. regulatory environment for internet providers is horrible and everyone knows it.

<comment><USER28> See [1], which is a request to tender: "Tromsø Municipality will contribute to the initiation of construction of a powerful and progressive fibre-based broadband network in the outskirts of the municipality of Tromsø". I assume that means the town itself already has it.

Or [2], a press statement from Luleå's largest fibre broadband provider, back in 2012.

Both places are in the Arctic, Tromsø is 3000km from Amsterdam. NYC to London is only 5,500km...

[1] [http://www.publictenders.net/node/1956874](http://www.publictenders.net/node/1956874)

[2] [https://www.telegeography.com/products/commsupdate/articles/...](https://www.telegeography.com/products/commsupdate/articles/2012/10/25/lunet- offers-its-fibre-customers-com-hem-tv-packages-in-lulea/)

</comment></comment></comment></comment></comment></comment><comment><USER85> Lord knows why. It's basically a tool to pick up non-stop advertising. If you're lucky, there's some horrible Big Bang Theory rerun displayed in one quadrant of the video signal, sped up to 210% normal framerate, so they can fit more commercials in. Plex is the new tv antenna.</comment>


Ask HN: What is your favorite root cause story? - <AUTHOR> This comment (https://news.ycombinator.com/item?id=20043944) got me thinking about strange or elusive root causes of errors. What are your favorite root cause war stories? <comment><USER2> The classic case of the 500 miles email: [https://www.ibiblio.org/harris/500milemail.html](https://www.ibiblio.org/harris/500milemail.html)

</comment><comment><USER3> UO server would crash because the player's mount could wander around inside their inventory:

[https://www.raphkoster.com/2014/08/16/random-uo- anecdote-2/](https://www.raphkoster.com/2014/08/16/random-uo-anecdote-2/)

</comment><comment><USER4> That time a deer broke into a datacenter (though... not sure if there was any downtime).

[https://www.reddit.com/r/techsupportgore/comments/aipopo/dee...](https://www.reddit.com/r/techsupportgore/comments/aipopo/deer_breaks_into_a_datacenter/)</comment>


The Unbearable Lightness of Web Pages - <AUTHOR> https://thelocalyarn.com/excursus/secretary/posts/web-books.html <comment><USER2> I weep for the depths of human knowledge that are lost behind Facebook groups, dead forums, purged geocities pages, Photobucket and Flickr erasure, and the countless other hosted services they have been lost to time and profit. But I wonder if a book is the best way to address this. I recently tried to find some older books and Amazon's stranglehold on the market has made books with no active publisher terribly inaccessible. I know this is complaining without solution but maybe one day we'll find something.</comment>


University of Utah pays $457k to ransomware gang - <AUTHOR> https://www.zdnet.com/article/university-of-utah-pays-457000-to-ransomware-gang/ <comment><USER2> This shows how bug bounties are pitifully small and inadequate. Stop thinking that a $10k reward will prevent hackers. Either pay-up for sec experts or be prepared to pay-up through extortion or having your site exploited, and it will cost way more than 10k.

<comment><USER3> Actually it's the exact opposite. Bug bounty programs have constantly proven to be among the most effective ways of increasing a company's security, no matter how "pitiful" the payouts are. The overwhelming majority of people, when they find an exploit, are going to to do the right thing and report it, not sell it to the highest bidder. Increasing the bounties isn't really going to help, considering there's always going to be a hacker group or government entity willing to pay more.

Of course the programs aren't going to be a replacement for real product security teams, but they were never meant to be.

<comment><USER4> Actually you are both right. Bug bounty programs are extremely effective because they find serious vulnerabilities for vastly less than the damages you would expect if they were exploited. However, the fact that the bug bounties are so low indicates that the prevailing security is atrocious.

To explain, generally speaking a bug bounty is going to the smaller of:

1\. Cost of Discovery since that is the amount someone would be willing to find bugs at otherwise they are losing money on each bounty they get.

2\. Cost of Damage (risk-adjusted) since that is the most a company would be willing to pay.

The reason for this is that as long as the Cost of Discovery is lower than the Cost of Damage (up to ROI), it is reasonable to keep paying the Cost of Discovery since you are paying less than the risk-adjusted harm. But, there is also no point paying significantly more than the Cost of Discovery as long as people keep reporting problems as fast as you can fix them since there is no real reason to pay to get more problems than you can fix. So, to first order the bug bounty for a certain type of problem reflects the cost of discovery of that type of problem.

Circling back to the original point, we see problems that can cause millions in damages getting bug bounties on the order of $10K. This means that, to first order, million dollar attacks only cost $10K to execute which results in a crazy high ROI in the 100s. With an ROI in the 100s, it should be no wonder that such attacks have been increasing in frequency given their sheer profitability. The fact that bounties are so low for such critical problems is a major indictment on the prevailing level of security in the industry.

<comment><USER5> > 1\. Cost of Discovery since that is the amount someone would be willing to > find bugs at otherwise they are losing money on each bounty they get.

This is probably the biggest issue in terms of incentives to a researcher. You're either finding the bug by accident or out of curiosity, or you stop short of basically losing money you would otherwise earn going a paid audit.

</comment></comment></comment></comment><comment><USER6> I have to say I think ransomware is one of the most interesting "business" practices. The trustworthiness of the criminals is huge because if they have a track record of providing the decryption key, you may as well pay.

In a logical extreme you could start adding features like "Give us the info of people you know and for every one we successfully extract a ransom from we'll give you 10% off your ransom."

It's interesting to think about at least.

<comment><USER7> I think one of the only ways to stop ransomware would be to setup a team distributing the ransomware, extracting fees from the victims and then -not- providing the keys. A few high profile cases of this should be enough to destroy confidence that paying a random will work.

<comment><USER8> This is brilliant. Destroy the credibility of the criminals.

<comment><USER9> By becoming a criminal yourself? The cure seems to be much worse than the disease.

</comment></comment></comment></comment><comment><USER10> You really can't blame them much, they had backups. University doesn't work like corporate, you have thousands of student who change every year, do their projects for which they require lot of access; you can't lock everything dangerous, can't have any sensible BYOD policy, ... It's really hard to lock up everything while not limiting students too much. With organization like this, that sort of incidents is unfortunate but inevitable.

<comment><USER11> Public universities and their security budget are highly underfunded. They can't afford to invest heavily into security.

<comment><USER12> Is it that they can't afford it? Or is it instead that they would need to reprioritize some of their spending to invest into security?

</comment></comment></comment><comment><USER13> What if it were a federal criminal offense to pay ransom? With long prison sentences for any individual convicted of participating in or having knowledge of a payoff? And the government was serious about tracking down and prosecuting anyone who did so? Nobody would pay ransom, and, at least in countries with such a law, these extortion gangs would stop bothering.

<comment><USER14> Then they just wouldn't admit to being attacked. Companies would still pay ransoms, but we wouldn't know about it.

<comment><USER15> I mean that's like saying "banning insider trading/securities fraud won't work, because people will still do it". Yeah, they might, but I find it hard to believe that an executive is loyal to their company to the extent that they'll risk year of jail time for it.

<comment><USER16> Trading is a public act. Cooking the books to hide a payment by some random corp is orders of magnitude more obscure than trading in securites.

</comment></comment></comment></comment><comment><USER17> > "The university's cyber insurance policy paid part of the ransom, and the > university covered the remainder. No tuition, grant, donation, state or > taxpayer funds were used to pay the ransom"

I was looking to dunk on them but it seems that what they did wasn't entirely unreasonable. The article further states that they paid to protect student data.

<comment><USER18> Where did the money come from if not from "tuition, grant, donation, state or taxpayer funds"? And if they have another source of funding, this still means the money is missing to fund things in the future that now they have to use "tuition, grant, donation, state or taxpayer funds" for.

They also send a clear message that ransom ware blackmail is a great business model. I think that is more than enough reason to dunk on them.

<comment><USER19> No you don't understand, they didn't use _that_ money, they used _different_ money! Nevermind that money is fungible.

Unless they set money in the budget every year for "Ransomware Insurance Shortfall" this is 100% "tuition, grant, donation, state or taxpayer funds" at some point in the chain.

<comment><USER20> It was partly covered by insurance.

<comment><USER19> We're talking about the part that wasn't.

<comment><USER21> Even the insurance policy that distributed the payout was ultimately paid for with those funds.

<comment><USER14> Sunk cost

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> Out of curiosity, are these hackers still demanding ransom money in Bitcoin, or say any traceable cryptocurrency?

I remember encountering similar scenarios before and they all seem to want the money in a Bitcoin address.

Why not Monero, or an alternative if there is any, which I guess makes moving the funds around much more stealthily? Please correct me if I'm wrong.

<comment><USER2> no one is getting arrested or caught in spite of the traceability, unless the hacker is dumb enough to just deposit the BTC on an exchange immediately. The btc is split up and sent through mixers and laundered into thousands of tiny pieces and after a few years or so forgotten by anyone trying to track it.

<comment><USER23> All the tiny pieces could be traced in an automated way. It's probably the lack of regulation that lets exchanges get away with not implementing better anti-laundering mechanisms.

<comment><USER14> That's not how tumblers work. There's no way to link the input and output addresses when you go through a tumbler.

<comment><USER24> You could refuse to transact any tumbler output.

<comment><USER25> Some exchanges are refusing tumbled input. That said, it seems most of the time if you complain enough and provide more id they do anyway.

</comment></comment></comment></comment></comment></comment><comment><USER26> Interesting discussions here about the actual costs and value of finding the bugs that enable these problems. There's basically very little cost to the companies in most cases that have vulnerabilities.

It's absolutely crucial, in my opinion, that we pass laws making paying off criminals illegal.

There are arguments here that paying off via insurance or other 'secondary means' are somehow shielding the institutions. It's morally wrong, and I suspect in reality it's technically wrong to make these payments. It's just wrong. There is the problem that at least some of these ransomware groups are in countries like Russia that don't care to really prosecute them. We need to stop this, make it clear it's not acceptable, fight with our usual means against money laundering. Pretty much every company company in the western world is vulnerable to these problems, every public school, and behind the scenes lots of people are vulnerable.

</comment><comment><USER27> When you pay ransom for physical possession you get your possession back.

When you pay ransom for lost data you get a copy of your data back. The culprits still have the data, but they likely don't have a use for that data.

But this is the worst kind of ransom.

You already have the data, you're paying ransom to make sure the culprits don't use the data, but the culprits still are in possession of the data and they can use the data next year, or two years later, or demand more payment next year.

What in the world?

<comment><USER28> >The culprits still have the data

It'd be too hard/expensive to exfiltrate the data once it gets large enough, without much added benefit. They just encrypt it in-place.

<comment><USER29> Well it's exactly what happened here.

> The university said its staff restored from backups; however, the ransomware > gang threatened to release student-related data online, which, in turn, made > university management re-think their approach towards not paying the > attackers.

The university is paying them not to release the data, but it has no way of forcing them to delete it.

</comment></comment></comment><comment><USER30> Devil's advocate: ransomware is good. The financial incentives around it directly encourage this variety of hacking. It's an involuntary "bug bounty". And IT security becomes something more than a "nice to have" for these institutions, which it never would have before.

$450k? Universities know all about paying to learn. That's cheap, and they won't make the same mistakes again.

<comment><USER31> Actually, depending on the cost of mitigating this sort of disaster in the future, they may learn the lesson that it is simply less expensive to pay the ransom.

The criminals doing these sorts of things are businesses too, the are unlikely to price themselves out.

<comment><USER32> Markets in everything: The price of ransomware will reach equilibrium when the cost of paying the ransom becomes equal to the cost of paying for cybersecurity. Then we're back to "to pay or not to pay" once again being a merely moral/ethical issue.

</comment></comment></comment><comment><USER33> Just think, they could have paid two engineers to fortify their systems against such an attack and still saved lots of money.

<comment><USER34> How do you know they weren't already paying at least two engineers to fortify their systems?

<comment><USER33> Hmm. I'm guessing not having backups means they may have been paying one person but also giving that person way too many responsibilities such that they couldn't focus on doing a backup well.

<comment><USER35> The ransom was paid by an insurance provider, so they were at least doing something to acquire coverage.

<comment><USER2> probably insurance is cheaper than hiring sec experts

<comment><USER36> Insurance coverage is common. Depending on coverage amount may require independent audits.

</comment></comment></comment></comment></comment></comment><comment><USER37> Can one detect a ransomware infection early by watching copy-on-write snapshots on a file server?

<comment><USER38> You can, the company I work for makes a product that does exactly that.

It's very much a last line of defense way of detecting attacks because it means the attackers are already in and already have access to whatever workload is being protected.

[https://www.rubrik.com/en/products/polaris- overview/polaris-...](https://www.rubrik.com/en/products/polaris- overview/polaris-radar)

Disclaimer: I'm just an engineer (not a sales person/pr/...) and _all_ my comments on HN including this one are entirely my own views/not the companies views.

</comment></comment><comment><USER39> > "The university's cyber insurance policy paid part of the ransom, and the > university covered the remainder. No tuition, grant, donation, state or > taxpayer funds were used to pay the ransom," University of Utah officials > added.

Can anybody elaborate more on this ? What are the other resources than tution/grant/donation/state/fund to earn money ?

</comment><comment><USER40> At this point the government agency should perform some of those attacks, extort the money, make it public and then delete the data so the victim is out of data and the money.

Paying ransoms is terrible for the world. We will have more attacks on more targets. There needs to be heavy incentive to not pay.

<comment><USER41> ^ things that will get you instantly unelected

<comment><USER40> It's not like advocating for strategies that work and make the world a better place get you elected anyway. It's all about making feel good promises anyway. Maybe you can convince someone already elected in their last term to actually implement it.

</comment></comment></comment><comment><USER42> There is no way those 450k are not being traced right now like a hell, most likely it was allowed just because investigation said so, its matter of time now

</comment><comment><USER13> They had backups: good for them.

But they also had unencrypted, sensitive information sitting on their networks.

</comment><comment><USER43> The data was leaked. They didn't "pay ransom to stop leaks".

<comment><USER44> do you have a source?

[https://attheu.utah.edu/facultystaff/university-of-utah- upda...](https://attheu.utah.edu/facultystaff/university-of-utah-update-on- data-security-incident/) says they paid the ransom to prevent leaks.

</comment></comment><comment><USER45> It's good to be aware that this entire thing wouldn't have been possible without Bitcoin.

<comment><USER46> It's good to be aware that this entire thing wouldn't have been possible without encryption.

I'm sorry, I'm not sure I'm seeing what point you're trying to make. Are you trying to say that Bitcoin is bad?

<comment><USER47> Bitcoin was sold to me as freedom, from governments, from banks, etc.

But now I have come to realize that a completely unregulated payment system is very dangerous.

To be clear, Bitcoin is not "bad". Humans are bad and this is why we can't have nice things.

<comment><USER48> Bitcoin is more regulated and more spied on than most forms of payment. To turn a large amount of Bitcoin into dollars in a bank account, you have to go through extreme AML/KYC checks. I can go to a gas station in California and send $1000 in cash to someone in Turkey who could receive cash and walk out a few minutes later. A briefcase full of cash is not regulated at all and can be used to settle debt or pay taxes, unlike Bitcoin. The only advantage of Bitcoin is not requiring the risk of physical presence, which has to be <1% of all crime. Also, unlike cash, Bitcoin by design retains a full immutable public ledger. The criminals can mix their coins, but it'd still be possible (although computationally expensive) to recreate a chain of transactions going back to the original ransom. In the future if Bitcoin is to become used in commerce more, it should be expected that these dirty transaction outputs would be worth less than clean ones or not accepted, like dollar bills cut in half taped together.

<comment><USER49> If a chemical plant sets up in an area then pollutes the environment during the course of business, it is required to clean up the mess. Known risks are required to have mitigations ready, and sometimes-expensive procedures must be followed to ensure safety.

Bitcoin (and everything like it) is very much at the "Pollute the environment with whatever the hell I want" phase of its existence. That should change.

Bitcoin should be taxed to recover the externalized costs it imposes -- basically, compensate the victims of bitcoin-enabled crime.

Is only a small fraction of bitcoin usage related to crime? No problem -- the tax will be very low.

<comment><USER46> We don't have a tax to compensate the victims of crimes enabled by cash, gift cards, Western Union, wire transfers, etc. Sorry, but I'm still not seeing the point being made here.</comment></comment></comment></comment></comment></comment>