"Did you copy/paste the info? Facebook seems to read all pasteboard data" - <AUTHOR> https://twitter.com/alainparadis/status/947066227595214848 <comment><USER2> I handle sensitive data on a daily basis and religiously keeping stuff like Facebook off my devices is beginning to look increasingly sensible.

I'll point to this next time someone questions my stallman-esque stance.

What's full-disk encryption do if Facebook et al are going to funnel the data off your devices anyways?

<comment><USER3> > _What 's full-disk encryption do if Facebook et al are going to funnel the > data off your devices anyways?_

Serious answer: the threat model FDE aims to address is cold physical attacks. That's it, everything hot (or even warm) and online is outside of scope. Facebook would be more akin in class to gray non-persistent malware, although they aren't actually malware in the strict sense and do face some bounds from the law which should make filtering and keeping them off a sensitive system more straightforward. At any rate, FDE is a good idea for a bunch of reasons given how cheap it is at this point, but it's just one of many needed pieces.

More fundamentally and beyond Facebook specifically, we need better ways to control data exfiltration and transfers from our datastores to and between software and services, period. Whitelisting should be the default. Data channels like clipboard APIs should either simply not exist at all or at least require explicit user per-application sign off (and preferably even then with restrictions like requiring code signatures, timeout options etc). While single purpose hacks are generally not justified, the specific instance of passwords & keys might be important enough in reality to justify operating systems providing some much more explicit "secure pasteboard" system that is far more heavily mediated.

<comment><USER4> The Firefox Focus app for iPhone pushed out an update a few months ago that showed an active clipboard tray below the URL bar, which was shocking and freaky to see. Anyone know whether the update had added the API or just made it visible? With the desktop browser it's enabled by default, but at least can be disabled through about:config.

<comment><USER5> > With the desktop browser it's enabled by default, but at least can be > disabled through about:config.

What option are you referring to?

</comment></comment></comment></comment><comment><USER6> When handoff was first introduced, it was obvious that facebook was auto- scraping the pasteboard, because as soon as you foregrounded the facebook ios app, iOS would show a "pasting from macbook handoff..." type dialog despite no user interactions performed.

If I remember correctly, the facebook iOS app would also auto-prefill a new post draft for you if it found an URL in the pasteboard?

<comment><USER7> Oh! I've seen this a few times, it must be in Messenger/WhatsApp. I don't know why Apple let them do that because it's awful UX and I just assumed Apple had screwed it up and sometimes couldn't background the copy/paste aross devices properly.

<comment><USER6> I think they got caught red-handed with an existing pasteboard API that suddenly gained handoff powers but at the same time started showing modal system overlays UIs when accessed? At least it came off like that.

</comment></comment></comment><comment><USER8> Here's a start: [https://raw.githubusercontent.com/jmdugan/blocklists/master/...](https://raw.githubusercontent.com/jmdugan/blocklists/master/corporations/facebook/all)

<comment><USER9> I wonder what happens when redirecting to 0.0.0.0 instead of localhost

<comment> the-dude It is the same. Except on Windows 8.1.

[http://winhelp2002.mvps.org/hosts.htm](http://winhelp2002.mvps.org/hosts.htm)

</comment></comment></comment><comment><USER10> Great,

On android any app can listen for clipboard events without permission. It's very possible that the Android Facebook app is scraping this data.

It also happens that the Facebook app is pre installed on Samsung devices and cant be removed.

<comment><USER11> > It also happens that the Facebook app is pre installed on Samsung devices > and cant be removed.

It can be disabled, which is as good as removed. Now if Samsungs own apps could be disabled, I would be happier.

<comment><USER12> Note that FB has a service that keeps the app updated, which can't be disabled.

</comment></comment></comment><comment><USER13> Would like to see further evidence backing this claim.

</comment><comment><USER14> Is there any legit reason for the clipboard API? If I want an app to see or fill its contents, I would just copy and paste normally.

<comment><USER15> I use copyq[1] on Linux and earlier used Ditto on Windows. I don't actually use it that often, but when I need it, the history of copied things is extremely useful. It's a built-in function in Emacs[2] and Vim and honestly, it should be also implemented by the OS or thereabouts (X/Desktop Env/WM in the worst case). And BTW, for keeping tabs on more than just the clipboard, I use selfspy[3], which is a really neat... keylogger, basically. It's great for filling timelogs!

Anyway, what I want to say is that there are legitimate uses for nearly every API. Some should be protected with permissions and so on, but once an API is there, you should always assume it's central to someone's workflow.

[1] [https://hluk.github.io/CopyQ/](https://hluk.github.io/CopyQ/)

[2] [https://www.emacswiki.org/emacs/BrowseKillRing](https://www.emacswiki.org/emacs/BrowseKillRing)

[3] [https://github.com/selfspy/selfspy](https://github.com/selfspy/selfspy)

</comment></comment><comment><USER16> Stupid question: Why not get hold of an image of the facebook app and check if there is suspicious code? If it were an android app, you could even try to decompile it, but even so, there should be suspicious calls to the clipboard API somewhere in the code, shouldn't there?

<comment><USER17> Because all of these companies go to great lengths to hide their "anti- malware" libraries and do a bunch of stuff like code obfuscation and ASLR outside of even the compiler tooling.

<comment><USER18> If you spend a little time getting used to working with obfuscated apps, they are easy enough. Facebook's app is no different. And ASLR has literally nothing to do with preventing reverse engineering.

</comment></comment></comment><comment><USER19> Based on my understanding from the tweet, it sounds like it can only see the type of data i.e. URL/plaintext and will only be able to get access to URLs and not necessarily the actual text (ex: if you copied a password), can anyone verify this?

Edit:

Source: [https://www.thedailybeast.com/facebook-is-spying-on-your- cli...](https://www.thedailybeast.com/facebook-is-spying-on-your-clipboard)

"This recognition software prevents the app from scraping text that does not look like a URL, like passwords or emails, Harrison said. It's not a perfect system, though: broken or fake links like "FacebookHasAccessToMyData.com" are still automatically recommended for posts."

</comment><comment><USER20> Now imagine cp ing a private key...

</comment><comment><USER21> Check out [https://github.com/indywidualny/FaceSlim](https://github.com/indywidualny/FaceSlim) \- seems to be the sanest way to access Facebook from a mobile. Also available on F-Droid.

</comment><comment><USER22> I'm pretty sure Chrome (for iOS) does this too, and presumably it could be sent to Google's servers. Otherwise they wouldn't be able to suggest opening a URL that has been copied (and show the URL before any user confirmation) by simply tapping on the address bar. Whether or not they use it for ad targeting is anyone's guess.

</comment><comment><USER23> So don't put your passwords into your pastebin from your password manager.

<comment><USER24> seriously? lots of sites block pw autofill. copy/paste is a must, and frankly, the whole idea that any installed app would have unfettered access to clipboard contents is outrageous.

though to be fair, this is an issue with most OSs.

</comment></comment><comment><USER25> Another recent post from Reddit on a related topic:

[https://www.reddit.com/r/privacy/comments/7mxn9i/is_facebook...](https://www.reddit.com/r/privacy/comments/7mxn9i/is_facebook_listening_and_creating/)

A lot of circumstantial evidence for extreme pervasive surveillance by Facebook apps is mounting.

Edit: another possibility is that _other_ apps are doing the monitoring and selling the data to Facebook or to data brokers that then sell it to Facebook. Lots of "free" apps ask for every permission.

In any case security researchers now have something new to tear apart in 2018.</comment>


Disabling Intel ME 11 via undocumented mode - <AUTHOR> http://blog.ptsecurity.com/2017/08/disabling-intel-me.html <comment><USER3> This is why I support Power/MIPS/RISC development going forward. It's just a shame that we allowed intel and amd to both put in cpu backdoors at such an obvious level (I like x86 but it's not the cpu of the future unless it's open). I highly suspect some national security letter type shit is going on in the background, ala Promis and William A. Hamilton who has claimed on Bruce Schneiers blog they (intel agencies) were infiltrating even low level chip manufacturers. Danny Casalaro's death was likely a required nastyness to keep it covered up.

<comment><USER4> If some other CPU architecture were the dominant PC platform, do you think it wouldn't grow such features too?

It's not hard to imagine an alternate universe in which we all have RISC workstations with the equivalent of ME, and Intel/AMD are the minorities who have more "open" CPUs without, but only because they hadn't grown enough.

The underlying reason why ME became popular is the same reason why proprietary walled gardens became popular: because they are heavily promoted as a _security /safety_ feature, and "who doesn't want to be safe and secure?"

Remember that, shortly before the turn of the century, Intel was convinced by the masses to remove a feature that would seem almost innocuous today, a serial number, but only because they marketed it as for DRM/identification instead of a security feature:

[https://www.wired.com/1999/01/intel-on-privacy- whoops/](https://www.wired.com/1999/01/intel-on-privacy-whoops/)

<comment><USER5> > The underlying reason why ME became popular ...

... is also because it provides management features that are _wanted_ by enterprise customers. If you're running hundreds of servers in a data center, the more management you can do remotely, without visiting the machine room and preferably automated as much as possible, the better.

This is quite irrelevant and even undesirable for an individual's personal computer.

<comment><USER6> I read statements like this often on HN, but not once during my years of work as a sysadmin in enterprise IT in different countries did I meet anyone who used ME/AMT for employee laptops. Also not at conferences.

Admins use the ILOM/IPMI for servers, so you don't really need it for server CPUs. For laptops all management happens at the operating system level, not below it.

<comment><USER7> Admins used the "Intel System Defense Utility"[1] back in the vPro/AMT days. It allowed for "nice" BMC-like features for normal desktops and laptops. I know about it from "The Website is Down"[2], but I find it hard to believe that nobody used it.

[1]: [https://downloadcenter.intel.com/download/15362/index.htm?ii...](https://downloadcenter.intel.com/download/15362/index.htm?iid=go+isdu) [2]: [https://www.youtube.com/watch?v=v0mwT3DkG4w](https://www.youtube.com/watch?v=v0mwT3DkG4w)

<comment><USER3> I hadn't seen that episode of TWiD. So hilarious, with a mix of sad how true it is.

</comment></comment></comment></comment></comment></comment><comment><USER4> _Nonetheless, our research team (Dmitry Sklyarov, Mark Ermolov, and Maxim Goryachy)_

Dmitry Sklyarov! There's a name I haven't seen in a while... good to see he's still actively doing this stuff.

The immense complexity of the base firmware and hardware in a modern system is astonishing. XML, MINIX, and three(!) complete 486 cores in the PCH.

Given this amazing feat of engineering, and the goals of the ME, it makes me wonder what people would be willing to work on it --- "making the nooses on which to hang ourselves", as the saying goes --- and if perhaps some of those people are actually not too approving of the idea and would, given an opportunity to do it without consequences to themselves, do a Snowden and leak everything that they could...

The fact that such an "ME killswitch" exists doesn't surprise me either; in this case it seems to be an actual feature, but putting such functionalty into debug/test modes is not uncommon. It was only a matter of time before someone would find it.

<comment><USER8> In my experience firmware is developed by an underclass who are happy to have any decent-paying job at all.

Or maybe the people who work on the ME realize that it's far from the largest risk in the system.

<comment><USER9>
      Underclass

LOLWUT?

Firmware pays pretty damn well. If you know what you're doing.

</comment></comment></comment><comment><USER10> If ME is not a backdoor then why doesn't Intel allow to disable it? Why don't they publish detailed descriptions? Why don't they allow user to run their programs on ME CPU?

<comment><USER11> If ME isn't a backdoor why did Russia and China start efforts to surplant Intel with locally sourced processors (even before US embargo'd Intel from china)

<comment><USER12> >even before US embargo'd Intel from china

You can see how well this embargo works in every electronics mall

<comment><USER11> It isn't a blanket sanction, just against government and computing centers. The last 3 chinese super computers have used home grown FeiTeng RISC processors which were binary compatible to Itanium, but for new models their using OpenSPARC.

<comment><USER13> > The last 3 chinese super computers have used home grown FeiTeng RISC > processors which were binary compatible to Itanium, but for new models their > using OpenSPARC.

Where did you get that information?

[https://en.wikipedia.org/wiki/SW26010](https://en.wikipedia.org/wiki/SW26010) doesn't claim any of that.

<comment><USER14> China's newest supercomputers are based on Sunway like you linked, but newer FeiTeng models (post-Itanium) were indeed OpenSPARC:

[https://en.wikipedia.org/wiki/FeiTeng_(processor)](https://en.wikipedia.org/wiki/FeiTeng_\(processor\))

<comment><USER15> I don't understand what the SPARC "front end" actually is, but the Tianhe-2 Top 500 figure comes from Intel processors <[https://www.top500.org/system/177999>](https://www.top500.org/system/177999>).

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> Impressive work on reverse engineering this.

Am I correct in assuming that since this backdoor chip has access to all of the peripheral I/O that it could even be used on a device with onboard wireless in "power off" mode, which is usually some kind of low-level sleep? So a compromise of this subsystem (or intentional backdoor) would allow one to take control of even a device that is "off". Given the trend to non-removable batteries, it might actually be impossible to prevent such an attack without physically destroying a laptop.

<comment><USER17> a Faraday cage laptop bag is probably a less drastic solution.

<comment><USER18> I think if you're at that point, a laptop is a luxury you can't really afford.

</comment></comment></comment><comment><USER19> Rather than assume anything nefarious on the part of the USG, I'm willing to bet a buck that someone in the USG asked the right questions during contract negotiation, which is why this kill switch was added but not publicized to anyone outside participants in the HAP Program.

<comment> dane-pgp But maybe that contract negotiation also included a rhetorical question like "And you won't offer this option to other governments, will you?".

<comment><USER19> I mean, just asking for a feature exclusive to customers with the HAP Program is enough to meet that goal.

<comment> dane-pgp I think it's worth considering what sort of incentives are created by such a deal.

</comment></comment></comment></comment><comment><USER20> The more details leak about ME the more shocking it becomes. Why is this accepted in any free democratic society?

There can be discussions, there can be debates but in everyday life this is already accepted. And even if one does not want to accept it what are the choices given similar technology is now integrated in other processors?

If we accept that computers are essential to operate in modern society then this is akin to a company taking control of the water supply with the ability to stop supply and do other unknown actions with zero accountability.

If you expand this thought this is a kind of fascism. We could be left with a shell of freedom and democracy while the government in partnership with corporates take deeper control of day to day life.

<comment><USER21> "There can be discussions, there can be debates ..."

Can there be ?

If ME is part of DRM platforms (and I believe it is) then disabling it is circumvention of a digital copyright mechanism which brings the DMCA into play.

"The lawsuit against 2600 magazine, threats against Professor Edward Felten's team of researchers, and prosecution of the Russian programmer Dmitry Sklyarov are among the most widely known examples of the DMCA being used to chill speech and research. Bowing to DMCA liability fears, online service providers and bulletin board operators have censored discussions of copy-protection systems, programmers have removed computer security programs from their websites, and students, scientists and security experts have stopped publishing details of their research."[1]

[1] [https://www.eff.org/wp/unintended-consequences-under- dmca](https://www.eff.org/wp/unintended-consequences-under-dmca)

<comment><USER22> This is rather an argument against DMCA or an argument why researchers working in this area should consider leaving the USA.

</comment></comment></comment><comment><USER23> Such blatant security holes are why Google resorts to measures like this: [https://cloudplatform.googleblog.com/2017/08/Titan-in- depth-...](https://cloudplatform.googleblog.com/2017/08/Titan-in-depth- security-in-plaintext.html)

<comment><USER24> The company I founded built something very similar to a titan equipped server to allow attestation/measurement/signed logs/full external policy. I can tell you point blank that while the product we built is great, getting enterprises, the majority of whom ___still___ haven't patched eternal blue to worry about clean source, log traceability, etc. can be quite a challenging business at times. They don't understand problems with IPMI or anything else.

The only thing that is going to change the face of the security market is that the loop between responsibility and inaction gets closed; as things stand today, the primary difficulty in the space is that for your average, not-very- knowledgeable customer, there is effectively no difference in mostly fraudulent security solutions and real ones - both get auditors out of your hair, so why bother buying anything real (or even not deploying anything like Comodo which actually makes things worse but still checks the box)?

</comment></comment><comment><USER9> The interesting question here is: why undocumented. It was created on request, but nobody was told. Who pushed so hard ME to be on for everything but them? And why? We know the answer :)

<comment><USER25> Intel's response to the authors kind of explains it: they added this feature hastily to meet specific requirements of the HAP program and didn't fully validate it – so it's not supported.

<comment><USER9> You missed the point. It was added for people with big money. I promise you - it is supported. Just not for you. You need to be backdoorable. They don't

<comment><USER26> ME itself was added for people with big money.

I'm not an engineer experienced in this kind of work, but I fail to see how a company whose core business is manufacturing chips would develop an entire computer (comprising an x86 CPU, its own RAM, MINIX OS, and access to all kinds of I/O) hidden inside each one of their chips and made largely inaccessible to regular users and developers. Unless they are paid _very_ well to do so.

In retrospect they were kind of naive not to make it much harder to enable this HAP mode, considering the lengths they went to make ME tamper proof. They left the flag wide open and even commented it in an XML file.

<comment><USER27> > comprising an x86 CPU

The ME runs an Argonaut RISC Core instruction set and leverages a lot of the existing infrastructure in the system since it sits directly in the chipset and can ask the main CPU to do some things on its behalf too.

<comment><USER28> Old versions did. Newer ones, as mentioned in the article, use a 486-derived low-power core (similar to what was used in Edison/Quark platforms) for the ME.

</comment></comment></comment></comment></comment></comment><comment><USER29> Here's the me_cleaner dev branch which supports setting the HAP bit to disable ME. [https://github.com/corna/me_cleaner/tree/dev](https://github.com/corna/me_cleaner/tree/dev)

</comment><comment><USER30> This is something I always have been wondering about. I can't imagine the US government is happy having the ME in every computer, with a closed source operating system running that has complete access to CPU, memory and network. If anybody can call Intel and ask for a custom version without this stuff, it is the government. And it looks like they did.

(If any important Silicon Valley CEO reads this, why don't you give Intel a call, as an important customer, and ask why 1) you can't disable the ME and 2) for a written guarantee that there is no backdoor in the ME?)

Something else: does anybody know if the trick mentioned in the article has negative side effects? Does power management still work? Can we be sure that this doesn't _activate_ a backdoor to begin with, and the computer tries to connect to an NSA domain :-) ?

<comment><USER26> Considering that they left the HAP flag in the open and even commented it in an XML file; considering how it does not disable all of ME, but only certain bits; and contrasting it with the otherwise inscrutable, encrypted, and tamper-proof nature of ME, it's hard not to see it as a honeypot or bait.

<comment><USER10> Intel's management and QA probably looked only at UI where the flag is marked as "Reserved".

</comment></comment></comment><comment><USER31> TL;DR: Intel put a special High Assurance Platform (HAP) mode in ME for the US government. If toggled on, it disables all non-critical ME functionality. Questioned, Intel responded:

> In response to requests from customers with specialized requirements we > sometimes explore the modification or disabling of certain features. In this > case, the modifications were made at the request of equipment manufacturers > in support of their customer's evaluation of the US government's "High > Assurance Platform" program. These modifications underwent a limited > validation cycle and are not an officially supported configuration.

<comment><USER32> basically govt finally learned about ME (like VNC built into CPU) and said "what?! are you kidding!?" and on second breath - "keep it on for everybody else though!"

<comment><USER33> ME isn't like VNC built into the CPU - that's AMT. AMT is restricted to higher-end Intel platforms, but ME is everywhere.

<comment><USER32> [https://en.wikipedia.org/wiki/Intel_Active_Management_Techno...](https://en.wikipedia.org/wiki/Intel_Active_Management_Technology) :

>AMT is part of the Intel Management Engine, which is built into PCs with Intel vPro technology.

>Currently, AMT is available in desktops, servers, ultrabooks, tablets, and laptops with Intel Core vPro processor family, including Intel Core i3, i5, i7, and Intel Xeon processor E3-1200 product family.

<comment><USER33> AMT is a piece of software that runs on the Management Engine. vPro-enabled platforms are the ones aimed at business laptops and workstations, not consumer stuff. It's important to make the distinction because people can check, find that their machine doesn't have the VNC functionality and then assume that they don't have anything to worry about as far as the ME goes, which is a false sense of security.

<comment><USER32> i don't think you described the behavior of typical HN reader :) Anyway, vPro with VNC seems to be present on all consumer (ie. with IGP) CPUs, so there is nothing to worry about in the sense that one anyway can't do anything about it, and thus the worrying is futile.

<comment><USER33> No, it's not. AMT is only shipped on Core-series CPUs when they're accompanied with the business chipset rather than the consumer chipset. It's not an integral part of the ME, it's software that the OEM has to license and ship in their firmware.

</comment></comment></comment></comment></comment></comment></comment><comment><USER34> Can someone explain simply what this means for projects like libreboot and coreboot? I'm always interested with this stuff and it's implications, but don't have the background to understand a lot of low level details. Is the verdict still the same or are we gaining ground? Last time I checked, purism was quite optimistic about it, but the libreboot website seemed really pessimistic about it.

<comment><USER35> I imagine coreboot might integrate this functionality or recommend that people using coreboot do so themselves, but libreboot won't, because the entire point of libreboot is to only use entirely free software and the ME firmware (even the stripped down version that obeys this disable bit) which is required to boot the machine is not free.

</comment></comment><comment><USER10> I wonder if Apple is ok with this. They usually don't like someone's else software running on their machines, especially on such a low level. They will probably negotiate a kill switch for them too.

<comment><USER36> i've heard the ME is not enabled in macs. for technical/architectural reasons. somebody please enlighten me if that is true.

<comment><USER37> I've heard that ME can't communicate over a non Intel WiFi or Ethernet chip- set. Possibly related?

</comment></comment></comment><comment><USER38> Does AMD have anything like Intel ME on their chipsets? I recently completed a Ryzen build and am curious.

<comment><USER39> Yes, the AMD Platform Security Professor. The CEO said in a Reddit AMA they would look into open sourcing it.

<comment><USER40> They aren't going to:

[https://news.ycombinator.com/item?id=14803373](https://news.ycombinator.com/item?id=14803373)

<comment><USER41> This makes one wonder if there is a secret legal requirement for this kind of capability.

<comment><USER42> Years and years ago, when color printer/scanners were fairly new, I tried to scan and print a $5 dollar bill. I was curious. The machine printed out about a third of the image but the rest of what it printed was a very official looking notice to please call the US Treasury.

(edit: HP was the manufacturer.)

<comment><USER43> Likely to do with the EURion constellation: [https://en.wikipedia.org/wiki/EURion_constellation](https://en.wikipedia.org/wiki/EURion_constellation)

Another item of interest may be printer stenography, in which every piece of printed paper, seemingly from every printer, can be traced back to make, model and potentially even the unit used to print it: [https://en.wikipedia.org/wiki/Printer_steganography](https://en.wikipedia.org/wiki/Printer_steganography)

<comment><USER42> I'm one of the most paranoid people you're ever likely to meet. (People more paranoid than I am won't communicate online.) Printer stenography is just beyond the limit I set for myself to try to disbelieve, and yet, here it is.

(Meaning that I always assumed something like this was going on, _because that 's what I would do_, but I try to disbelieve it so as to be able to act normal. I believe all phones are continually listening to and scanning their ambient environments, _because that 's what I would do_. But probably not, right? Right?)

The thing that bothers me the most is that "normal" people refuse to engage with reality. I used to tell people some of the things e.g. that Snowden revealed, but I was always accused of wearing the tinfoil hat. From my point of view, normal people are hugely intellectually dishonest. Poor Ed Snowden had to throw his life away to try to get people to notice and think about what's happening, and typically all most people do is whine about their precious privacy (the ones that don't immediately stick their heads back into the sand that is.) Like privacy is something that still exists. It doesn't.

I better wrap it up here before I get the urge to talk about forbidden technologies like REDACTED, REDACTED, and REDACTED. I mean, there's a certain tension knowing about a REDACTED that can cure all diseases, but that cannot be popularized because it can also REDACTED without a trace. Could you imagine the chaos if something _like that_ became public knowledge!?

<comment><USER43> I wrote off freedom and privacy 2 years ago simply because it was having adverse effects on my mental health. I wasn't changing anything by being paranoid so I just stopped being paranoid.

I still don't use facebook and I run free/open-source software exclusively, but worrying about it didn't change anything.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER44> Here's the main product using HAP if anyone wants to see if they can buy it and RE _its_ firmware.

[https://gdmissionsystems.com/cyber/products/trusted- computin...](https://gdmissionsystems.com/cyber/products/trusted-computing- cross-domain/trusted-multilevel-computing-solution)

Some stuff is government only but some for businesses. You'll have to contact them to find out.

<comment><USER45> Recently I saw a guy in a cafe with a General Dynamics laptop. It looked ruggedized and a few years old; I don't know if it was an HAP system. He said he got if off of eBay.

</comment></comment><comment><USER22> What I consider as "interesting" is the fact that much more research (at least if you look at HN headlines/posts) goes into "Intel ME" vs. "AMD Secure Processor" (formerly known as "AMD PSP" ("Platform Security Processor")). I really don't want to badmouth this important research on "Intel ME", but I am a little bit confused from this asymmetry.

<comment><USER46> Perhaps this is because Intel ME is deployed much more widely than AMD PSP.

</comment></comment><comment><USER47> Could somebody explain in layman terms what exactly (say, 'spy-wise') ME could enable some parties to (remotely?) do with one's pc? And what are the chances this actually is being done?

<comment><USER48> They could put in a backdoor that opens when a magic packet is passed. These things exist[1]. Your cell phone likely has one in the radio[2]. The problem with this existing, other than the privacy issues, is that the packet can eventually be discovered by fuzzing[3] the hardware.

[1][https://github.com/elvanderb/TCP-32764](https://github.com/elvanderb/TCP-32764)

[2][https://www.contextis.com/resources/blog/binary-sms-old- back...](https://www.contextis.com/resources/blog/binary-sms-old-backdoor- your-new-thing/)

[3][https://www.owasp.org/index.php/Fuzzing](https://www.owasp.org/index.php/Fuzzing)

</comment></comment><comment><USER49> So if i understand correctly, the way to disable intel me is to simply flip a bit? Using a software tool?

<comment><USER50> Thw article also mentions removing some non critical binaries and modifying the ME filesystem

<comment><USER19> My understanding is this step isn't really a necessity but rather was done to prove that ME could be disabled at an extremely low level since the missing binaries would no longer trigger what's effectively a failure condition.

Could be wrong. Probably safer to just set the killbit rather than also tamper with ME directly is ultimately my point. That's my risk aversion at work.

<comment><USER49> I'm simply intrigued how this bit has managed to elude so many developers and hackers over the years. It's literally an option in an intel software tool, and yet you have people who have vehemently complained about Intel ME for the past few years. I have some serious cognitive dissonance going on right now.

<comment><USER51> The latest version of ME, 11, uses a x86 processor. That's why the researchers were able to perform this analysis and find the bit to flip. It also doesn't disable ME, just most of it.

<comment><USER49> I see, it appears ME 11 was introduced in September 2015, which means this discovery came about in less than two years.

</comment></comment></comment></comment></comment></comment><comment><USER52> Great new marketing phrase tho: MINIX Inside!

</comment><comment><USER53> ACPI is almost as horrible: complicated, opaque, untrusted code running on a VM instead of using declarative data tables.

Closed-source firmware and silicon must end, because it's impossible to authoritatively verify correctness or rule out malware implants inserted at some point along the way.

<comment><USER54> Well said. It also makes computing much more expensive and slow to progress. But those fraudsters love their violence-backed monopoly. Image if a few vital manufacturing plants were destroyed, we would have silicone shortages. We have made ourselves fragile, backwards and weak.

</comment></comment><comment><USER55> What happened to 3rd party chipsets? Seems like VIA, ALi, SiS, Nvidia nForce, all stopped making them for Intel processors around 2008. If there were alternative chipsets still around, we would see more motherboard makers adopting something like openBMC with an alternative chipset and using it. No Intel PCH, no Intel ME.

<comment><USER8> _If there were alternative chipsets still around, we would see more motherboard makers adopting something like openBMC with an alternative chipset and using it._

No we wouldn't. All the chipsets would be subject to the same market forces and thus would converge on similar features, including the ME. Just like how 99% of x86 systems are running UEFI instead of coreboot.

<comment><USER55> That is not an apples to apples comparison. Plenty of features differ from motherboard to motherboard. Someone like an ASUS could adopt openbmc much easier if an alternative chipset existed. I'm not arguing about the marketability of openbmc, I know it exists. I'm talking about why there are no chipset alternatives to Intel PCH that would force Intel ME on us.

</comment></comment></comment><comment><USER56> Q: How does one actually determine intel ME is present in a CPU... I've got an old P8600, I can find no definitive list of CPUs or ways to test for it. Some articles say all intel CPUs since 2006, others say only the newer "core" brand.

<comment><USER57> Intel Core 2 Duo P8600? That has the ME.

Intel's ME was first available in 2006, and by the end of 2008 it was on every CPU they produce.

According to ark.intel.com, the P8600 chip was produced Q3'08 so it's in the right timeline for having the ME. But the giveaway is that the chip has "Trusted Execution technology".

        Intel® Trusted Execution Technology for safer computing is a versatile set
        of hardware extensions to Intel® processors and chipsets that enhance the
        digital office platform with security capabilities such as measured launch
        and protected execution. It enables an environment where applications can
        run within their own space, protected from all other software on the system.

On the bright side, older MEs are easier to de-fang. The 06-08 versions can sometimes be removed entirely.

</comment></comment><comment><USER58> Is this the same Dmitry Sklyarov who got caught up in a DMCA debacle over a decade ago?

</comment><comment><USER59> I really can't grasp the "undocumented mode" term. I believe It was created on request.

<comment><USER60> That is pretty much standard term for processor features that are not supported by Intel. The main selling point of the whole Intel's x86 platform is that when something is supported and documented it will either behave the same way on newewr processors or newer processors would include some mechanism to emulate the old behavior. Intel tends to go especially overboard with this approach and even support feature combinations that are not useful in any way.

Recent example is that original AMD's x86_64 CPUs did not support certain descriptor formats in long mode and didn't support x87 FPU ISA for 64b code. Intel's EMT64 supports both of these things. Usefulnes of first is somewhat questionable as only real user of that is dosemu, another would be if somebody would want to modify some Concurrent DOS/FlexOS derived OS to be 64b aware (there actually might be some small bussiness case for doing so). Microsoft solved this by droping support for 16b and DOS applications in 64b builds. And for the second limitation it is pretty obvious that there cannot be any code that would be broken by that.

Older examples are the whole A20M# business and then there is LOADALL, which was never officially documented, has three diferrent encodings and behaviors depending on CPU generation but got used by Microsoft and thus the 386 encoding and behavior is somewhat semi-documented and semi-supported even 30 years later.

<comment><USER61> Just to clarify: the A20 stuff was an IBM PC/AT feature in the chipset of the original machine, not a CPU thing. It was actually a response to an Intel _mistake_ in backward compatibility between the 8086 and 286 (real mode segments that pointed "beyond" the first 1MB would wrap around on the original processor but hit the second megabyte on the 286).

But when the memory mapping went on-chip in later devices, it needed to be part of the CPU core for compatibility with software written to work on the AT.

<comment><USER60> The mistake was with the fact, that 8086 has 64kB-16B worth of user visible memory addresses that are beyond what the harware could actually address due to width of the physical address bus and thus got aliased to the other end of address space. People say that there was software that depended on this behavior, but I can't see any sane reason why somebody would write something like that (given how the address layout of PC looks like the only sane application of this aliasing is in the early initialization BIOS code, which obviously had to be significantly rewritten for AT)

Edit: the reason why 486 and later CPUs contain the A20M logic internally has nothing to do with "memory mapping". 486 has on chip cache which has to know, whether this memory region is aliased or not. Additional effect of this logic being in the CPU is that it can be controlled by writes into MSRs, which are significantly faster than sending commands into KBC which controlled this thing on AT. (Also, in vm86 mode this compatibility hack could be implemented by MMU without dedicated hardware cludges, which is what essentially all DOS XMS managers do)

<comment><USER61> You're arguing semantics. Pulling the cache on-chip _means_ that the memory bus and its mapping logic needs to be on-chip too, because it sits beneath the cache. We're saying exactly the same thing.

(And FWIW: the mistake Intel made was that those accesses were legal on an 8086. They should have been an exception condition, which would have avoided this problem by making the 286 behavior a proper superset)

<comment><USER60> I know we are saying ecactly the same thing, but somebody else who reads this threads might not, so the successive clarifications are useful :)

In hindsight, making accesses beyond the end of physical memory on 8086 an exception is nice solution. But I think that more useful solution would be different design of the 8086 pseudo-segmentation that would make such linear adresses unrepresentable on the user level. On the other hand whether this would be good idea depends on whether you view another horrible cludge (ie. HMA/UMB and potentially also usage of that as EMS window or bounce buffer) as useful.

Edit: as for the memory attached to processor behaving sanely it is interesting to look at Alpha which expects that memory is memory and could be write back cached. With one small and significant exception: the region on which ISA VGA would exist is hardwired to be uncacheable.

</comment></comment></comment></comment></comment></comment><comment><USER62> Are there any good open computers?

<comment><USER63> I think that depends on what you mean by _good_ and _computer_. You might, for example, want something that costs on the same order of magnitude as an Intel or AMD x86_64-bit cpu. Afaik the answer to that question then becomes _no_.

There's some hope around power9-based systems:

[https://www.raptorcs.com/TALOSII/](https://www.raptorcs.com/TALOSII/)

For more modest demands on performance, and affordability , there's LEON and OpenSPARC.

<comment><USER62> Thanks. I couldn't find LEON (bad google-fu?), can you link?

So in effect, big $CORPs own computers and with Alphabet agency influence and systemic flaws, the hope for open and secure and powerful computing should be forgotten.

<comment><USER63> See: [https://en.m.wikipedia.org/wiki/LEON](https://en.m.wikipedia.org/wiki/LEON)

> the hope for open and secure and powerful computing should be forgotten

I'd say it depends a bit. IBM still throwing money at POWER is interesting. The openSPARC is interesting for certain embedded applications that deal with signal processing - where there's real work to be done both in software and hardware (asic / fpga) - like wireless communication. Having a few sparc cores that run Linux well ready to drop in on a fpga is very nice.

But for consumer hw... Yeah, it's difficult to compete with arm on one side and Intel/AMD on the other. Remember that even transmeta had to throw in the towel trying to compete in that space.

</comment></comment></comment></comment><comment><USER37> I didn't notice if the HAP switch is available on earlier (pre ME 11) hardware.

</comment><comment><USER64> Imagine if some non-US government voided Intel and AMD's patents as a self- defence measure against these probably-backdoored 'features'. Why should they protect the profits of hostile corporations?

<comment><USER10> Voiding patents probably doesn't change anything because patents usually contain just vague description.

<comment><USER64> You underestimate how much patents are used to impede competition - <USER2> [https://arstechnica.com/information- technology/2017/06/intel...](https://arstechnica.com/information- technology/2017/06/intel-fires-warning-shots-at-microsoft- claims-x86-emulation-is-a-patent-minefield/) , and the many less public patent licenses and threats.</comment></comment></comment>


Ask HN: Has open-sourcing every killed a company? - <AUTHOR> A common fear I hear from people who don't want to open-source their projects is that a competitor might steal their code. I've personally never heard of this  happening, but I'd be interested to hear any stories about it. <comment><USER3> I don't know of any companies which failed due to competitor access to source code. There are probably many companies that failed as businesses because their code was open source and as a result they couldn't convince people to fund their work, so that seems like a more pressing concern.

OpenSSL is a famous example of an open source project that is massively depended on, including by billion dollar companies, and yet the company/project trying to maintain it was receiving almost no funding until an outcry a few years ago.

It might also be instructive to think about FreeBSD. It is much less popular than it used to be. Its code was used as part of the basis for the original Mac OS X release in 2001, but Apple's changes were made proprietary rather than contributed back to FreeBSD, and (arguably) as a result hardly anyone uses FreeBSD now, while millions use macOS. We can think of macOS as having been a competitor to FreeBSD in this sense.

Linux, on the other hand, requires contributions to be given back to the main project, and is doing much better.

<comment><USER4> It wasn't an outcry, it was a bug. Heartbleed happened in OpenSSL, people then realized that the project was massively important so pledged funding.

[https://arstechnica.com/information- technology/2014/04/tech-...](https://arstechnica.com/information- technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund- openssl/)

</comment></comment><comment><USER5> I worked for an open source company about 4 years ago. It was quite popular, venture backed, and had all the interest in the world. We launched with a lot of fanfare, and adoption was quite strong. We raised a series B just before our official launch and had the backing of great investors. The problem with open source isn't that someone else is going to come and take your code and use it to compete against you. It's that it's nearly impossible to monetize something that you give away for free otherwise.

We experimented with a lot of different business models, but the reality was ... no engineer was willing to pay us for something like "analytics" ... or "hosting" ... They were just going to keep using the code.

It's also incredibly difficult to track actual usage. There was no way to enforce the use of it on our CDN, so people were likely using our product, and we didn't know about it at all. When you open source, you just give up a lot of control. When you're end user are engineers, they won't pay unless it's something they can't do themselves, or aren't already using another service.

If you look at a company like SugarCRM (open source CRM product), businesses will pay. Granted, they aren't salesforce, but they have a legitimate business model that works for them. So while it can work, before making a decision, I would talk to your customers about what they would be willing to pay for, and how much.

</comment><comment><USER6> A codebase is an assert (or a liability), one that you spend time and money creating. If your business model/operations are such that anybody with the code could clone it quickly, it's a bad idea to give it away.

The obvious one I can think of is where you sell (commodity) hardware + value- add software for a premium. Mobile apps is maybe another example which already suffers badly from cloning (without available source code), because the over- saturation makes success more or less luck.

From a business perspective, open-sourcing some code still make sense in many situations though. You may want to grow a community around it (Docker/Chef/Puppet/Ansible/Salt/etc), or gain market share by making it easy to install/try out (see previous, or PostgreSQL vs Oracle/MSSQL/IBM DB2), or recruit. In general, "business" is always going to underestimate the value of this and stray away, because it's taking a leap of faith (read: risk).

It gets interesting when pluses and minuses overlap. For example Arduino, would they have gotten as popular without being open source? Probably not. Are knock-offs cannibalizing their sales? A bit. Did that cause much loss? I don't know, I assume ARM boards and ESP8266 had more impact. So even though they're commodity hardware + software, the community part probably offsets the easy- to-clone pitfall.

</comment><comment><USER7> At the widest level 'has open sourcing ever killed a company'.

Off-hand I can't think of any companies that have taken a _successful_ proprietary product (code-base) and then open sourced it. If your main code- base and business around it are successful there's not much value to open sourcing it. It would be hard to convince any business that they should do something that increases risk. The "business" argument in favour of open source would be around contributors and the marketing effect - but if the product is already successful that's a weak argument.

In most circumstances software companies have open sourced proprietary code- bases because they were under threat and needed some sort of radical strategy. The canonical example is Netscape. There's really on a few examples - I don't think there's much evidence that they failed _because of_ open sourcing. The reality is they were under competitive pressure any way. Another big example is Sun though that's a nuanced story far beyond open source.

Then the last group is companies that are built as open source endeavours. Do they fail 'because' of open source more than proprietary software companies? It's a bit of a difficult to infer what would have happened if they weren't open source: how do you imagine Docker would be doing without being open source, VMWare is an example from an earlier age but the user audience and market dynamic are a bit different. My personal opinion would be that open source helps in the initial stages if your target user is technical [0], but that it does make it harder to commercialise and puts you under consistent risk of substitution or disintermediation. Community building isn't really dependant on being open source - look at GitHub, it _serves_ the developer community who are pragmatists. The problem of commercialisation is that the economics aren't on your side and the customers buying behaviour is orientated on the proprietary model - users buy scarcity.

If you're interested there's quite a lot of good academic work on open source as a business model, searching for 'innovation and open source' should turn up some interesting papers. Like all business studies they all suffer from a small group of examples and a complex environment aka real life.

[0] In other words, if it's a normal user audience open source makes no difference. That's why line of business apps don't have any traction.

</comment><comment><USER8> I think docker is going to become an example of this.

<comment><USER9> I doubt it would have taken off to begin with if it wasn't open source, though.

</comment></comment><comment><USER10> Not in that sense. But one open sourcing I was witnessing revealed other sensitive information (credentials), and resulted in a huge losses to the company.

</comment><comment><USER11> Balanced, perhaps:

[http://blog.balancedpayments.com/benefits-open-company- balan...](http://blog.balancedpayments.com/benefits-open-company-balanced/)

Whether or not that had anything to do with their demise, I couldn't yell you. Fantastic company though.

</comment><comment><USER12> I was thinking of open source projects that killed other companies -- Ie, Wikipedia shuttering Microsoft Encarta - but then I saw your comment..

</comment><comment><USER13> The other side of the equation is - how many projects benefit from the additional eyes and hands that a community brings?

<comment><USER7> "projects" benefit. It's not that easy to declare that companies do honestly. We can infer that most VC's and founders don't think it does because everyone _uses_ open source, but few (any?) of the major growth start-ups from the late 90's open source their key commercial code. I'm thinking of things like Facebook - they open source infrastructure as honey pots for engineers - <USER2> not their key code. That's also partially because the nature of how you made money changed - it became all about the data slurp.

</comment></comment><comment><USER14> Sun? Netscape?

<comment><USER15> Netscape was already failing when they open sourced the browser, IIRC.

Sun was bought by Oracle, which is the opposite of open-sourcing the product.

<comment><USER16> The wikipedia page on Netscape is pretty good reading.

[https://en.wikipedia.org/wiki/Netscape](https://en.wikipedia.org/wiki/Netscape)

</comment></comment></comment><comment><USER17> Possibly Santa Cruz Operations, but they where in trouble before Linux really took off IIRC.

</comment><comment><USER18> Starwood Hotels.

<comment><USER19> Can you explain this comment please?

</comment></comment><comment><USER20> RoboVM.

</comment><comment><USER21> look at Hashicorp: all their products are opensource and I think it's not disappearing in the next years.

Packer, Vagrant, Terraform...they are largely adopted and it makes Hashicorp in a strong position

</comment><comment><USER22> *ever</comment>


3 Pros and Cons to Building Mobile Apps with JQuery Mobile and HTML5 - <AUTHOR> http://niallohiggins.com/2011/09/23/3-pros-cons-mobile-apps-with-jquery-mobile-and-html5/

<comment><USER2> JQTouch is definitely still buggy. One of the problems is that there are only maybe two css3 transitions that look identical between the Safari Mobile and whatever browser Android phones typically run.</comment>


+Music: A kick-ass Google chrome extension  - <AUTHOR> https://chrome.google.com/webstore/detail/ddjklapimfghfjjinidpblloipjnnpgb

<comment><USER2> Interesting.

However,

 _It also features deep integration with Facebook, allowing you to share full songs with friends, even if they don't have the extension._

Facebook? Not interested. Now, g+ integration would be nice.</comment>


Sydney airport seizure of phone and laptop 'alarming', say privacy groups - <AUTHOR> https://www.theguardian.com/world/2018/aug/25/sydney-airport-seizure-of-phone-and-laptop-alarming-say-privacy-groups <comment><USER2> The Customs Act works nicely with GDPR: "Hague... said the actions of the ABF officers had put his business in breach of Europe's tough new GDPR data privacy laws and he would now need to give privacy breach notifications to his clients."

<comment><USER3> This is staggering. Crossing the border gives the government freedom to do whatever they like, privacy be damned.

(Looks like the submission was missed; really needs to get to the front page)

</comment></comment><comment><USER4> I envy my confreres who get to travel with burner laptops.

But the other side of the coin is having to preclear to justify permission to travel. Owning your own burner is good but for some people won't work. I did a one year peripetetic work-around-the-world and a burner isn't an option for that. You really do wind up wanting private cloud and no cached state sometimes.

The people who have to preclear have state secrets. I don't think many of us carry that burden, it's just fear of being held to account by random circumstances.

</comment><comment><AUTHOR> I always shutdown my phone and laptop at the border crossing and I always have firmware password on and hope that they can't gather anything from my laptop. And just hope they can't crack my 6 digit iphone passcode easily.

<comment><USER5> But are you not supposed to give them the pin?

<comment><AUTHOR> Well nobody is "supposed" to give them pin but one should expect long detention, longer confiscation of devices and denying entry into the country.

<comment><USER3> And potential of 10 years in jail...

</comment></comment></comment></comment><comment><USER6> > Put it on the cloud where the GDPR [EU's General Data Protection Regulation] > is in force ...

... so that _any_ government with enough technical means can (illegally) access the data at their leasure and in such a way that you won't even know it was accessed....</comment>


What causes an imbalance of interest between non-technical and technical person? - <AUTHOR> I'm developing this web application on django. Im pretty swamped in backend and I'm looking for a front end dev and marketing person. During the process, I noticed people who are non-technical are way more interested in the app than those who are technical. In fact, I haven't found any technical person interested.<p>Is it because it's not technically "cool" enough? I understand a technical person may get sourced by all sorts of non-technical person, but the imbalance is just so striking to me. What would cause this imbalance of interest? I feel like there's a discontinuation somewhere. <comment><USER2> We'd have to know more about the application to give you an answer. You can also ask them why if you can't tell us more.</comment>


Ask HN: What's your biggest gripe with craigslist and/or ebay? - <AUTHOR>

From a usability, content or technology standpoint. <comment><USER2> Ebay's auction model includes a strict time limit that doesn't adjust for bidding. That is, if someone bids in the last few seconds of an auction, there's no increase in time as there would be in a traditional physical-space auction to allow others an opportunity to bid higher if they're interested. This leads to the whole phenomenon of auction sniping, which is pretty silly when you realize it's all the result of what's arguably a design flaw.

Imagine an auctioneer in real life implements this policy. "Going once for x. Going twice...." They begin mouthing the word "sold" when a competing bidder jumps in at x+1. The auctioneer proceeds as though nothing happened ("Sold!") except that the sniper wins ("For x+1...").

<comment><USER2> Currently investigating to see if I'm wrong about this - if eBay does actually have a dynamic time limit feature and I was just unaware of it.

<comment><AUTHOR> They don't, and I agree that it is flawed. But perhaps flawed is too strong of a word, and it's just that ebay auctions don't tend to mimic real-life auctions (and maybe there is a reason for the discrete time limits, ie sellers need to know exactly when items are ending; buyers are often time limited sometimes as well: 7 days often seems like an eternity anyways). Many of the up-and-coming penny auction sites include this feature, as it is much more necessary to their business model.

<comment><USER2> I think Ebay realized at some point that marketplaces are more profitable than auctions and adjusted their model accordingly. Now they're in this limbo between an auction site and a marketplace site but not great at either. They can afford this of course because they're a monopoly, but if I really want the experience of one or the other I'll use a service with clearer focus.

</comment></comment></comment></comment><comment><USER3> Shameless plug, I have a love/hate relationship with Missed Connections, and as a result created <http://www.MissedConnections.com> to improve on the good work Craigslist started.

<comment><USER4> Nice domain.

</comment></comment><comment><USER5> ebay: auctions suck, bidding on stuff isn't my idea of fun. There is too much of negative press surrounding fraud etc, so you have to go out of your way to portray yourself as not being a criminal. craigslist: people are cheap, it is handled face to face, if you are selling something large, usually random strangers come into your house.

So that really has nothing to do with coding, but those are my gripes with each.

</comment><comment><USER6> on craigslist, scams/spammers

<comment><USER7> Craigslist spam is a huge problem, but they don't do enough to take care of it. Right now I'm really annoyed by the way every single time I want to look at the job listings, it makes me click again after a page explaining what affiliate marketing is and how it's scammed.</comment></comment>


Why do we write dedications in books? - <AUTHOR> https://www.spectator.co.uk/2019/09/why-do-we-write-dedications-in-books/ <comment><USER2> i have a dedication on a book by an old teacher.

he used to teach geography to a bunch of 14 year olds, so he had to be harsh sometimes to get us quiet enough to learn.

once, i was sitting by myself during his class and i was reading lord of the rings under the table (it was that HUGE edition that has the 3 books + appendix) -- i was so focused i didn't see him coming. he called my name, i looked up, he asked me what i was doing. i said reading a book, he scowled, and went back to the front of the class.

months later, at the parents-teacher conference, he called my mom out in front of everybody. my mom thought he was going to say something bad, but in fact, he said he was proud to see a young student reading but that she should tell me that there are places to read those kind of books, and middle of class is not one of them.

he also gave her a book so she could give it to me -- a book on genghis khan's empire. it had a dedication that said:

"i dedicate this book so you can have nice moments and remember your teacher"[0] (shitty translation from ptbr, sorry).

it was already a great gift -- i loved books -- but the dedication on the book made it so much more... special. since them, whenever i give books to people (and i still do frequently, books are one of my passions), i write something nice, mostly because i feel that it makes that specific book special to that person.

[0] [https://i.imgur.com/rK3y2wp.jpg](https://i.imgur.com/rK3y2wp.jpg)

<comment><USER3> This story actually made me tear up, not only what the teacher said but also what dedications could really mean passed that.

</comment></comment><comment><USER4> Some are not just to mom, or dad, or _from your two wise daughters_. One dedication in particular is my favorite, because it ties the author to the story.

 _The Little Prince_ by Antoine de Saint−Exupery

> I ask the indulgence of the children who may read this book for dedicating > it to a grown−up. I have a serious reason: he is the best friend I have in > the world. I have another reason: this grown−up understands everything, even > books about children. I have a third reason: he lives in France where he is > hungry and cold. He needs cheering up. If all these reasons are not enough, > I will dedicate the book to the child from whom this grown−up grew. All > grown−ups were once children−− although few of them remember it. And so I > correct my dedication:

> To Leon Werth when he was a little boy

<comment><USER5> I understood about 20% of that!

</comment></comment><comment><USER6> A couple of years ago I was sorting an uncatalogued batch of old children books. At random I leafed through a thin grey book, from the 1870s, with a beautiful print on the cover of a young boy in furs on a viking ship. Inside was a tender dedication from a grandpa to his grandson. Something about adventure and wonder as I recall.

Getting a peek into the relationship between an old man and his grandson, well over a hundred years ago, was really something. It enlightened the otherwise mundane job of sorting these books for me.

It made the book some much more than an example-document of 19th century children literature, and turned it into historic artefact of children culture.

</comment><comment><USER7> Its an acknowledgement that knowledge grows like a tree, and every new creative work has a root or foundation in the past which was used as inspiration and leverage to reach new heights and without which, perhaps those heights might not have been possible to reach.

A good one - "If I've been able to reach new heights, it's because I strove after the examples set by my inspirations."

</comment><comment><USER8> A classic: [https://scsh.net/docu/html/man.html](https://scsh.net/docu/html/man.html)

<comment><USER9> I love that one as much as you, but if/when it comes time to purge Olin Shivers from any position of respect within academia or computer science, this will be used as Exhibit A against him and evidence of his "violent tendencies". It will go nicely with one of ESR's pro-gun screeds when painting a picture of "why tech has a gun violence problem".

</comment></comment><comment><USER10> I was once told that this is due to the library system in the US. I was told that you, as an author, get a bit of money when someone is borrowing your book at a library. If the book has a dedication you get a tiny bit more money and that is the reason. I have not verified this information but always believed it was true. I might be wrong.

</comment><comment><USER11> To me it's the same thing as writing 'greetz' in some sort of software release. It's letting people know that it's not just a monolithic release but had inspirations and ideas that extend beyond the immediate.

</comment><comment><USER12> Not really an author, but I do some writing, and good writing is, in my experience _hard_. Obviously, just like software development, its kind of all- or-nothing, either you finish the it and get it in front of people (and then maybe make some money/fame of it), or you fail to finish the project that you have now sunk a ton of time into. Just like software, you can quickly finish something, but then it will likely not be quality, and won't receive the attention you maybe think it deserves. All of this to say I think authors probably get a lot of support and assistance and thats why dedications happen.

<comment><USER13> Although I only skimmed it, this article is about hand-written dedications that you might write in a book when you give it as a gift.

I went looking for some of the information about why authors write dedications, but I didn't see any of that.</comment></comment>


How We Prepared the NSA's Sensitive Internal Reports for Release - <AUTHOR> https://theintercept.com/2016/05/16/how-we-prepared-the-nsas-sensitive-internal-reports-for-release/ <comment><USER2> Fascinating Intersection of tech and journalism. Techno-journalism?</comment>


Topics in Advanced Data Structures [pdf] - <AUTHOR> http://web.stanford.edu/class/cs166/handouts/100%20Suggested%20Final%20Project%20Topics.pdf <comment><USER2> I was going to roll my eyes about stuff no one will ever hear of, much less use in their day job, but there are some really relevant structures here. Finger trees, cache-oblivious structures, R-trees, etc., just to name a couple from a random page or two. The "why they're worth studying" summaries are gold.

Thanks!

<comment><USER3> A doctor has to mostly always treat common cold, and influenza. But that's no excuse for her / him to not know the purpose of the left pulmonary vein. The more basics they know, the better doctors they are. Sorry if this analogy is a bit extreme, but I want to make a point.

<comment><USER2> I think a more apt analogy would be if you would disqualify doctors who don't know the nucleotide sequence of the genes that code for the cytochrome p450 enzyme process from treating your cold or flu.

The left pulmonary veins are gross anatomy, akin to knowing what an 'if' statement is. Knowing the current state of the art in determining a minimum complexity for an operation on an obscure tree implementation is deep domain knowledge used by only a few specialists.

</comment></comment></comment><comment><USER4> The material seems to be for this course: [http://web.stanford.edu/class/cs166/](http://web.stanford.edu/class/cs166/)

There are more slides and info on that site :)

<comment><USER5> It's a pity there are no video lectures. Are there lectures out there for a similar algorithms class?

<comment><USER6> MIT 6.851 Advanced Data Structures, Spring 2012: [https://www.youtube.com/playlist?list=PLUl4u3cNGP61hsJNdULdu...](https://www.youtube.com/playlist?list=PLUl4u3cNGP61hsJNdULdudlRL493b-XZf)

<comment><USER7> I took that class that year, one of the best classes I ever took. A ton of work, too.

</comment></comment></comment></comment><comment><USER8> > Traditional data structures assume a single-threaded execution model and > break if multiple operations canbe performed at once. (Just imagine how > awful it would be if you tried to access a splay tree with multiplethreads.) > Can you design data structures that work safely in a parallel model – or, > better yet, take maxi-mum advantage of parallelism? In many cases, the > answer is yes, but the data structures look nothing liketheir single- > threaded counterparts.

Makes me wonder which data structures have "parallel" versions besides the two mentioned.

<comment><USER9> would all of scala's default( immutable) datastructures fit the bill?

<comment><USER9> I was just curious. Not sure why this is downvoted.

</comment></comment></comment><comment><USER10> This kind of stuff fascinates me. General software engineering seems comparatively boring. I was considering going back to university to do a phd in cs and this is making me realize that research in algorithms/data structure would actually be viable (still lots of stuff to discover).

Does anyone here know what it is like doing research in these areas? Any general advice?

<comment><USER11> I've got a PhD in CS, and these structures fascinate me as well. The Bloomier Filter reads amazing.

Unfortunately, day to day job has almost nothing to do with these algorithms, but mainly software architecture and maintainability.

I think the majority of these algorithms are not really something you will find implementing in day to day work. And at most I can see myself using a library with one of those. Even if you do research, it will have to be very focused on data structures and algorithms to really get deep into some of these.

Still, very enjoyable.

<comment><USER12> Just today I finished implementing radix heaps in C# to optimize some of my Dijkstras.. When I googled I saw zero implementations in C#, so I may be the first to write it. It worked well, giving me 3x speedup in practice over DAry heap and very low GC pressure, fortunate as my process was exceeding 256GB ram.

Rolling your own data structures is pretty vital if you're working on algorithms.

</comment></comment></comment><comment><USER13> Does anyone in their work find that they are able to employ data structures like this, and if so, what do you work on? I've almost always had to delegate all my state to a database using default indexes, etc., which is productive, yet a little disappointing, because I'm always applying my brain power instead toward more mundane tasks.

<comment><USER14> I do plasma simulations and recently had the problem of finding the distance to the nearest neighbor for every of the particles in the simulation. Doing that naively is O(n^2) and took hours even for small test problems. Building an R-tree once and using if for nearest-neighbor look-ups brought that down to 5 minutes.

libspatialindex lacks documentation, but worked really nicely. The rtree interface in python is much friendlier.

<comment><USER15> I'm taking Advanced Data Structures at UCSD right now and our first assignment was making a K-D Tree and an efficient KNN Classifier. It was surprisingly simple and the efficiency between the KD Tree and brute force implementation was quite drastic.

If you only build the tree once and do no insertions what is the benefit of an R-Tree vs KDTree?

<comment><USER14> I actually do plan to update the tree as I insert additional particles in locations where the distance to the nearest neighbor is large.

</comment></comment></comment></comment><comment><USER16> I love learning Algorithms and Data Structures. The issue is that I don't get to use these frequently, not even basic DS. Most of what I need exists in the language or some framework, and if I am to implement it from scratch, I am sure I will do worse. The only time I really use this knowledge is during interviews.

<comment><USER17> I (did) feel excatly the same. Now after working for 17 years I realize that I barely ever use this stuff, and when asked this stuff in an interview I do a lot worse than I did straight out of university. I am however a lot better software engineer than I was then.

</comment></comment><comment><USER18> I'm surprised no one mentioned the "Crazy Good Chocolate Pop Tarts" algorithm. That one took my by surprise :)

[https://www.researchgate.net/publication/51952511_De- amortiz...](https://www.researchgate.net/publication/51952511_De- amortizing_Binary_Search_Trees)

Hilarious

</comment><comment><USER19> Hm, where else are Lowest Common Ancestors in tree-structures useful? Storing for instance ORDPATH/DeweyIDs allows to simply check for a common prefix (they are hierarchical node labels). I think maybe for locking in a storage system with multiple read/write transactions or to determine which of two given nodes is the firs one in preorder, which is useful for XQuery/XPath processing (to determine the so caslled document order). Can anyone think of other usages? Or for having hierarchical node labels in trees?

<comment><AUTHOR> You can use lowest common ancestor queries in conjunction with suffix trees to solve a lot of interesting string problems. For example, take two indices within a string, find their corresponding suffixes in the suffix tree, and then take their LCA. That gives you an internal node corresponding to the longest string that appears starting at both indices (this is called their "longest common extension.") You can use this as a subroutine in a bunch of genomics applications.

<comment><USER19> Thanks, great use case and I have to say I have to read about genomics... :-)

</comment></comment></comment><comment><USER20> Does anyone know books which explore in depth recent development in advanced data structure (or just not well known advanced data structure) ?

</comment><comment><USER21> The list is great, but unfortunately has no pointers to documentation. I find nothing online for some of the topics.

Where can I find the description and discussion of 'ravel trees'?

<comment><USER22> They also caught my eyes. I finally found a paper here (the correct denomination seems to be RAVL tree) : [http://sidsen.azurewebsites.net/papers/ravl-trees- journal.pd...](http://sidsen.azurewebsites.net/papers/ravl-trees-journal.pdf)

<comment><USER21> Super, thanks for being better at searching! (The name makes more sense this way.) :-)

</comment></comment></comment><comment><USER23> This is awesome, thank you!

Used nested R-Trees in a personal project recently (sharded in memory spacial db for a game) which is not something I thought I'd ever have to do.

</comment><comment><USER24> My favourite somewhat obscure data structure that I didn't see on the list: Hash Array Mapped Tries.

</comment><comment><USER25> What font are they using? I find it very unpleasant to read on a 4k screen set to 125% scale. Or maybe it's Firefox.

<comment><USER25> I loaded the page on Chrome and the text is definitely heavier (and more readable) but also less sharp.

</comment></comment><comment><USER26> Where can I learn more about ravel trees?

<comment><USER27> From one of the comments on this thread. [http://sidsen.azurewebsites.net/papers/ravl-trees- journal.pd...](http://sidsen.azurewebsites.net/papers/ravl-trees-journal.pdf)

</comment></comment><comment><USER28> Great! More fodder for interview questions /s.

<comment><USER29> That's probably it, any use of these algorithms in business software would need to be justified for the increased training your fresh-out-of-school replacement would need to maintain this.

</comment></comment><comment><USER30> This is quite cool, thanks.

</comment><comment><USER31> nice sharing !!

</comment><comment><USER32> Please provide the solutions in git repo. Thanks.

<comment><USER33> Paraphrasing (almost every) math book: "Solutions are left as an exercise for the reader."</comment></comment>


Ex Entrepreneur/Developer looking to join a startup - <AUTHOR> http://www.segaldoron.com Hi guys,
My name is Doron Segal I'm a serial entrepreneur looking to join an interesting startup. feel free to email me. I have experience on UX and development using Ruby, Php and Node.js. My latest project is goubiquiti we going to lunch on January 6 2014 <comment><USER2> Was quite curious when I clicked on your link. Got to distracted by the scroll path stuff unfortunately. (everything between about and companies)

The only thing I noted was you may have interest in "Big Data solutions using Hadoop", the rest was too general.

Though I'm curious about what the scope of your "security consulting" work was?</comment>


Vast volcanic 'raft' found in Pacific, near New Zealand - <AUTHOR> http://www.bbc.co.uk/news/science-environment-19207810

<comment><AUTHOR> Was trying to find some better pictures, some that show it looking more like a raft and not appear like waves cresting.

So far have the same picture on all the reports I found, though some have a added picture of the pumice: [http://news.sky.com/story/970992/rock-raft-the- size-of-belgi...](http://news.sky.com/story/970992/rock-raft-the-size-of- belgium-floats-off-nz)

Nice wiki entry about these types of events: <http://en.wikipedia.org/wiki/Pumice_raft>

Google has some past event picture but nothing can saftly attribute to this event at this stage. Though I expect more and better pictures to be forcomming over the days.</comment>


Deriving Quests from Open World Mechanics - <AUTHOR> https://arxiv.org/abs/1705.00341 <comment><USER2> The modeled quests described (ever-escalating series of crafting better items) is reminiscent of those found in traditional MMOs like World of Warcraft. And those quests aren't _fun_ , and the "grind" is regarded as an antiquated game mechanic, even in the context of Minecraft. (of note, WoW recently introduced a weekly "quest line" which is all complete-10-generic- quests/kill-100-demons/etc grind and no plot. Players are not happy.)

<comment><USER3> _those quests aren 't fun, and the "grind" is regarded as an antiquated game mechanic_

The approach I'm working on for my game, is to allow the player to optimize a growing "economy." I personally find watching, guarding, and optimizing to be far more fun than grinding. There will be threats nipping at the edges of this infrastructure, or interdicting its transportation, however. Seeing those off will be one kind of "quest."

<comment><USER4> Agree agree wholeheartedly, do you have any more information on the type of game you are working on?

<comment><USER3> Superficially, it looks like an 80's Asteroid type game connected to a vast procedurally generated universe, with a SC2 style hyperspace. But I want to emphasize things that can produce emergence. Like procedurally generated tech trees:

[https://www.youtube.com/watch?v=E3DPalL7p5w](https://www.youtube.com/watch?v=E3DPalL7p5w)

I want to implement an artificial life simulation system to produce an ecology/ecosystem on which the economic system will be based. There will be trading, but instead of trucking the goods yourself, you'll be nominating and paying for others to transport it. (But if you come along and "ride shotgun" and win battles, your piracy losses will decrease.) I want to let users craft and script everything, then sell/license those to other players.

The power of the players will increase exponentially as they go off into space, but the power of enemies will also increase exponentially, with a larger constant. The leaderboards will be based entirely on how far out in unknown space you can camp and survive.

[https://www.emergencevector.com](https://www.emergencevector.com)

Right now, the procedural universe and some combat are all that's up in the demo.

</comment></comment></comment></comment><comment><USER5> After skimming the paper, given my own understanding of game mechanics and terminology, I would rename it:

"Deriving Achievement Requirements from Crafting Mechanics"

Which is a LOT less interesting than I was hoping for...

<comment><USER6> It was literally a paper that talked about creating a graph of all the craftable tools in the game. Not to downplay the merit in the methods used, this is extremely uninteresting and just bad game design.

</comment></comment><comment><USER7> Getting lost without purpose is often a trap I fall into with open world games. However, probably the two great things that open world games can achieve is a sense of place and wonderful emergent stories in gameplay. And this reminds me that I've still to make the plunge into the as-"real"-as-it- can-get-in-games world of Dwarf Fortress. I love reading about the development and the truly astounding stories that happen while playing, which might be nearly as good as actually playing.</comment>


Server-side HTML vs. JS Widgets vs. Single-Page Web Apps - <AUTHOR> http://blog.pamelafox.org/2013/05/frontend-architectures-server-side-html.html <comment><USER2> I've had the most mileage out of single-page web apps. So much of your code is perfectly untrustable UI logic that can live on the client anyway. I use <http://meteor.com> so I never run into issues with latency or spotty ORMs...

</comment><comment><USER3> I am a huge fan of JS-heavy single page apps paired with a nice REST Api to exchange JSON data. That's how we've built the dashboard at userfox.com and I've seen this same architecture pop up at other shops since. What makes this especially appealing to me was the fact that I was pretty much developing the API along with the web app. An API that can also be used by other clients in the future (native smart phone apps, etc.)

</comment><comment><USER4> I love the benefits on single-page web apps, but the SEO issues associated with them and the current methods to get around it (using selenium to do a render of the html on the server?!?) keeps me from using them on things.

It seems to me that by using node.js on the server, we should be able to share the application code, including rendering to html/dom. I have a vision in my mind of an http request coming in to the server for a given url, ember.js picking it up and rendering views/templates into html that is sent over the server. On a javascript client, that html/dom would need to be linked into ember.js on the client-side (this could be done be either regenerating the html, or by "deserializing it" in some way). Further actions on the page could be handled by the client-side javascript in normal ember.js fashion.

This approach would have several benefits. Initial response would have working html that could be rendered without having to wait on loading the application's javascript (along with dependencies) and would be workable for non-javascript clients, such as web crawlers and older clients. Links in this html could default to be links back to the server for other full page requests, and only switch to using ember.js on the client if and when the javascript loads. Applications would have even more reason to make their interactions with the page routable via url and therefore easily linkable and sharable.

Normally when developing websites, you shy away from too much in the javascript because of these usability/SEO concerns and the normal approaches involve writing the same logic on the client and on the server (normally not even in the same language). With javascript on the server, why don't we run the same code on both ends, remove this handicap, and use the benefits to offload processing to the clients when possible but still provide a server- based fallback for the many cases when it is necessary?

<comment><USER5> I'm not very familiar with Node, but I had assumed that a more flexible or movable client/server dividing line was the point of Node, and assumed it's what people were already doing... but maybe not. Can any Node afficianados speak to this question?

<comment><USER4> I am not an afficianado by any means, but it does help in some ways. Many libraries exist that can run on both sides of the connection. Unfortunately, I haven't found much that allow you to modify the DOM/html using the same code on client and server, and even less that allows you to go from an application state on the server into an identical state on the client. Meteor.js, Opa, and Derby.js seem to be the main options in this field, but I'd like to see a simple javascript library that facilitates this so that many other frameworks can take advantage of it.

</comment></comment></comment><comment><USER6> There is a lot I kind of dislike about single-page web apps and I don't think they provide enough benefit to outweigh the inherent complexity of them.

My current favorite combination is server side rendering + knockout. Minimal JS to get the job done and has a mental model that I enjoy. Also, less futzing with yet another template engine like mustache.

</comment><comment><USER7> Very nice discussion and slides, the videos added a lot.

My favorite approach is somewhat in the middle. You might call it an "MSPA" - Multiple Single Page Apps, each major section in the app is it's own standalone SPA. (public searchable pages are plain HTML e.g. using Jekyll).

For example, if I have an admin section with master detail scenario, this would consist of a single SPA, And an "account" section with settings + and profile sections will be also it's own SPA. I only keep it "SPA" where it makes sense to keep the same context, and where there are frequent transitions between section's pages.

p.s. I like your stack (Backbone, Django, Play). my specific stack of choice is not that far though I eventually moved from backbone to AngularJS and never looked back. With Scala I use it just as Servlets / JAX-RS on steroids instead of Play, I found performance to be better.

<comment><USER8> (Post author) Good point, we actually do take that approach - we have about 8 different Backbone apps currently, for different aspects of the admin and student experience. We don't have a hard and fast rule for when we break into a new app, but it usually becomes obvious at some point. And it's not too hard to refactor that sort of thing, since it's mostly just changing a routes file around.

</comment></comment><comment><USER9> I'm interested in single-page application frameworks... however as a developer whose built UI's for desktop applications I find the focus on the MVC design pattern rather strange. I've tried learning how to build these kinds of interfaces in Backbone and friends. However the learning curve is rather high and the metaphors don't make a lot of sense. I was surprised when, after bugging my JS developer friends, I finally got "Hello, world!" up on the screen.

As a test I was able to get a native cocoa application up on the screen in <30 lines of CL.

I realize it must have something to do with the whole document/DOM relationship that has perversed UI programming on the web this way... but it also doesn't seem like there's a way out. It's just not elegant so lets stop using that word.

<comment><USER10> You're right that the complexity derives from the DOM. But in my opinion the DOM isn't so much the problem as the fact that it is so hard to manipulate. There are two ways to manipulate it: by low-level node fiddling at a level far below that of the discrete UI elements being represented, or by deleting subtrees and replacing them from a serialized source (html), losing event handlers and embedded state in the process. Neither solution is usable when dealing with complex ui elements that have no corresponding html tag, so you end up needing an abstraction layer that implements of these mechanisms and does the boilerplate work to make it practical. Because of this abstraction layer things always get complicated as soon as you try to move beyond basic html tags with onclick handlers beause you end up learning the pseudo-dsl of the abstraction layer.

The long term solution is to make html itself extensible so you can define additional tags at the start of the page, with all the related logic, and then can go back to straight dom manipulation without needing any abstraction framework. This should become possible with web components and shadow dom, but we have a way to go still.

</comment></comment><comment><USER11> In our framework, we basically have "pages" which can be loaded/unloaded using AJAX for you, and "tools" which you can put on pages. So a developer can quickly put together an app out of pages and tools, and wire it up, with just a bit of data going between the server and the client. What's more, he or she can set up heavy caching (e.g. on a CDN) of the AJAX responses, making the entire interface render client-side like a native app. We even have support for storing a bundle locally -- in, say, PhoneGap -- and still use the newest files as they are updated on the server in subsequent releases.

Components and models are loaded "on demand", and instead of MVC -to- MVC syncing we have opted to have one MVC, with the authoritative model on the server, and messages being broadcast to all participants in the stream.

So basically the "best practice" is to grab some existing tools and stream types, or create new ones. Everything "just works" out of the box.

<comment><USER12> Is the framework available/visible anywhere? It's a neat approach, one I've thought about but never done anything towards. Kudos for turning it into reality!

<comment><USER11> Yep, you can see some of it here;

<http://qbix.com/blog> <http://framework.qbix.com>

we are working on rolling out a much better framework portal for it though.

<comment><USER13> I can't see too much on the second link. What's the point if it is password protected and you don't give it away?

<comment><USER11> We are building it in a cathedral before releasing 0.9 to the bazaar :)

</comment></comment></comment></comment></comment><comment><USER14> Pardon my shameless plug, but I've been working on something for a looong time that combines all of the above into one massive time-saving system. The hardest part is definitely making it fast and efficient while also being user friendly.

If you take a look at the trends of the web over the past decade, I really think this (or something like it) is the future of web application development. Long story short, you can (mostly) point-and-click to build flexible/reusable JS widgets that can either be laid out on a single page or embedded elsewhere. (Side note: I developed a system on top of jQuery similar to backbone that should eventually allow the widgets' HTML to be cached and loaded instantly, as opposed to regenerating each widget's components from its JSON representation every time. This is where "Server-side HTML vs. JS Widgets vs. Single-Page Web Apps" all come together.)

I've already posted a description in a comment before, so I apologize if you've happened to have already read it. Here's a more detailed description:

It was originally designed to appeal to non-programmers; and I would have released it months ago but decided to rewrite nearly everything to make the code as modular/flexible/easy-to-learn as possible for developers (both newbie and seasoned).

Before I link to it, I'd like to apologize for overly generic descriptions currently on the site. I whipped together the entire site in a few days not knowing the exact direction I wanted to take the software, so I left everything pretty vague; I really just wanted some content that at least somewhat described my ideas. I'll put the link at the bottom of this comment so you read all this first. From a technical standpoint, this is currently where I'm at with it:

\- Users create a myriad of widgets that can "interact" with each other; the fullscreen version of Loggur consists of "layouts" of widgets, while the mobile version of Loggur lets you access widgets individually in typical mobile app fashion

\- Databases are incredibly easy to create; just add fields to a widget and specify their relationships to one another

\- All kinds of special extensions included by default, like automatic importing of various data sources, scraping of websites, cron jobs, PDF report generation, emails, sms notifications, triggers, and graphing

\- Everything is taggable for reuse, from the apps themselves to widgets to components to elements to lists and to the data associated with all of the above; you can either "mirror" or "clone" any one of these parts in another app/widget/component by doing a quick search for tags (or if you know the exact path to the part, just enter that); so for example, if you really liked what someone else has made and wanted to reuse parts of it in your own app, you'd do a quick search for it, clone it, and modify it to suit your needs, saving a lot of time

\- Data associated with apps can be any combination of public/private, singular (your individual profile), and/or group-specific; you can quickly/immediately switch between views of each

\- Permissions on everything; specify who can view and/or edit apps, widgets, components, elements, lists, and/or data

\- Appearances are somewhat customizeable and will become much more so at some point; customization currently consists of the basics like colors, backgrounds, and sizes; apps are designed to be scalable to any screen resolution (think large dashboards ;)

\- Each one of the pieces outlined above (widgets, components, etc.) can be embedded on your own site(s) through small snippets of code

\- Data associated with apps is easily accessible, currently only available in JSON but if for some reason other formats are requested in high numbers, I might do that

\- Users can toggle the ability to view app/data updates as they happen in realtime; they can also invite each other (or a Loggur dev if they need help) to take turns using/building an app

\- Regarding the mention above about rewriting the project to be more modular/flexible for developers, I felt doing this was 100% necessary/worth it because it occurred to me a few months ago that the best approach to make this succeed in the long term is to make this a legitimate platform (buzzword, sorry!) where developers can quickly/easily make and share awesome extensions and be rewarded (paid) for their work

Check it out (sign up for it ;) here and remember to ignore the bad, vague descriptions currently on the site: <http://loggur.com>

<comment><USER15> "I would have released it months ago but decided to rewrite nearly everything"

Recipy for disaster. Release early, release often.

Is this b.t.w. a one-man project? Big code bases written by one man which doesn't get out to the public early is a risky undertaking.

However I really admire your passion/enthousiasm.

<comment><USER14> Yeah it's just me for now. There would be too much overhead involved in getting anyone else up to speed on it and getting them on the same wavelength. I have a fair amount of documentation, so when I everything is finished that I personally have to do, bringing in others won't be an issue then as it would be now.

I beg to differ about your claim that delaying its release by a few months is a recipe for disaster. If you saw what I had written prior to the rewrite... _that_ was a recipe for disaster. First impressions are huge. And this project isn't your typical easy come, easy go type of startup. There's a lot to it, and if one piece of the puzzle is missing, it stands no chance in the real world, so it has to be done right from the very beginning. I do have a list of things that would be okay to do after its initial release, of course.

I have plenty of runway time, so the reality of it is that releasing it months ago instead of months from now would not have been beneficial at all. If anything, I'd have gotten discouraged because of complaints of massive amounts of bugs and complaints about lack of features/functionality, and I'd have ended up rushing to write code and it would be ugly. But since I have plenty of runway to spare, I can do it right and release everything (mostly) as advertised, save a few gray hairs, and maybe even have better timing on its release. Timing is everything. And if you asked me a year ago, I would have said the world is not yet ready for Loggur.

I'm noticing a trend on HN that quite a few people seem to think there's one path to take for a successful startup. Repeating the "release early, release often" mantra is evidence of this fact. Yes, that mindset might work for the majority of startups, but certainly not all of them.

</comment></comment></comment><comment><USER16> It is pretty disappointing that these comparisons always seem to consider the server side template case as "we did it in the most horrible way possible, I know all the issues we had were solved long ago and we could do it right, but lets pretend that isn't possible because I want an excuse to do everything in javascript".

<comment><USER17> Yeah. To me, the pros and cons ought to assume you're Doing It Right; otherwise, you're probably better off learning to Do It Right than changing your approach.

I see the tradeoffs as:

Server-side rendering gives you better language choices, but it's more expensive to the site owner than serving static HTML/CSS/JS for pages and using AJAX for data only. Client-side rendering is often more performant for the end user than server-side, but that depends on the device and the application.

Which one makes sense, then, depends on whether client-side rendering is actually faster for your application and expected user device usage patterns, and how much you value better language choices versus lower server costs.

As with absolutely everything else in software, there's no one-size-fits-all correct answer.</comment></comment>


I analyzed 40k makers on ProductHunt for diversity - <AUTHOR> https://femake.tech <comment><AUTHOR> I've recently become a lot more involved in the ProductHunt community and really wanted to know what the gender representation was like in the community. I decided to scrape all of the makers and products created since the platform was started and see what the data said.

After processing over 40k names and manually checking over 8k for accuracy, I put together FeMake including stats like % of females each year, average upvotes, average products launched, etc.

I also wrote about the process, my take on the data, and why I think this matters here: [https://medium.com/@stephsmith74/femake-understanding- inclus...](https://medium.com/@stephsmith74/femake-understanding-inclusion-in- making-460949b3d76a)

<comment><USER2> How long took you to collect the data and analyze and filter them?

</comment></comment><comment><USER3> Beautiful visualisations! How did you get the data?</comment>


#WITBragDay - <AUTHOR> https://code.likeagirl.io/witbragday-f0e79b2bb31b <comment><AUTHOR> What is your #WITBragDay Post? Here is mine. "Over 100 million people have used code I wrote. Me and 5 guys made sure @BlackBerry was secure in 2004. I am on 20+ patents. #WITBragDay"</comment>