Windows 7 patch for Meltdown enabled arbitrary reads and writes in kernel memory - <AUTHOR> http://blog.frizk.net/2018/03/total-meltdown.html?m=1 <comment><USER2> This is what happens when devs are presented with a very complicated problem, extremely short deadline and enormous amount of pressure.

<comment><USER3> >extremely short deadline

they had 6 months.

<comment><USER4> > they had 6 months.

You say that like 6 months is automatically a lot of time. "She had 6 months to give birth". Yeah, only it takes 9, so 6 is short.

Consider the scope and depth of the issue and the fact that they probably couldn't involve too many people on this effort.

<comment><USER5> The Linux kernel developers came up with a decent solution, how can it be that they can do this and the Microsoft developers cannot?

<comment><USER6> Is Windows written the exact same way as Linux? Never underestimate the amount of technical debt that can be holding a team down.

<comment><USER5> It appears not, if such a bad bug can get through all the way to release.

<comment><USER7> "Linux" had a bug in which you could log into a system by pressing backspace 28 times a few years ago. And by Linux, I meant GRUB[1], and in turn, (many) Linux systems.

We're comparing Linux and Windows, an operating system that contains 3.5 million files[2] (of course, not just the kernel in this case). That isn't really fair. Code is as perfect as humans can make it, and it certainly does not help that there's so much to take into account.

[1] [http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication- by...](http://hmarco.org/bugs/CVE-2015-8370-Grub2-authentication-bypass.html)

[2] [https://arstechnica.com/gadgets/2018/03/building- windows-4-m...](https://arstechnica.com/gadgets/2018/03/building- windows-4-million-commits-10-million-work-items/)

<comment><USER8> This GRUB bug you are talking about, is not a kernel problem though; on a side note, I'm going to read on the links you provided as I want to see if encrypted root partitions could also be compromised, I suspect no.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> A really simple test you can compile with cygwin - if it doesn't crash, the bug is present:

      #include <stdio.h>

      int main()
      {
              volatile unsigned long *ptr = (volatile unsigned long *)0xFFFFF6FB7DBED000;

              printf("%lx\n", *ptr);
              return 0;
      }

<comment><USER10> I seem to be unable to find a patch that will make it so that this doesn't run. Windows Update says that I have all required patches. I first tried KB4088875. That didn't cause this program to fail. Then I tried "2018-03 Preview of Monthly Quality Rollup for Windows 7 for x64-based Systems (KB4088881)", which was only a recommended update. That didn't help either.

<comment><USER11> Same for me. I tested a Windows 7 x64 system which has all security patches, but caf's "really simple test" above still runs, which seems to indicate that the bug still exists. Same as you, I applied KB4088881, which was the only pending update, but it made no difference.

Also, I tried the command from the orginal article:

 _pcileech.exe dump -out memorydump.raw -device totalmeltdown -v -force_

This creates 5GB file which does look like a raw memory dump. I'm not sure how to interpret this; I don't know what the behavior should be with or without the bug.

</comment></comment></comment><comment><USER12> Well, let's take a breath and be grateful that even MS can mess something like this up.

One dev or 1000, who cares, whatever they chose did not work particularly well. Are "they" to blame? Yes. Are the engineers to blame? Probably not. Is management the culprit? We don't know.

What's left? Next time your customers bug you about some random downtime caused by an overworked datacenter intern, don't feel stressed. Take the time to remember that even if you would've had billions of dollars, years of experience and thousands of employees, you could've messed up, just like MS did :)

<comment><USER13> "Take the time to remember that even if you would've [sic] had billions of dollars, years of experience and thousands of employees, you could've messed up, just like MS did :)"

When you are the direct, contracted, IT support for a company then you _do_ have responsibilities. You might be considered responsible for timely delivery of patches - a fair argument in court I think. Mitigations might involve helpdesk logs as well as contracts.

well_done: Your tone comes across as BOFH. I'm possibly a simple PHB who owns an electric cattle prod that is wired up to the mains (three phase) but I prefer to get sign off for a project via work committed and not threat done.

<comment><USER14> >Your tone comes across as BOFH

I didn't read it like that, and I'm usually the first to read things negatively. I read it as motivational: don't feel bad about your own mistakes, even the big guys with tons of money and a lot of really smart people mess up sometimes. So cut yourself some slack and just do the best you can.

<comment><USER13> "Next time your customers bug you about some random downtime caused by an overworked datacenter intern, don't feel stressed. Take the time to remember that even if you would've had billions of dollars, years of experience and thousands of employees, you could've messed up, just like MS did :)"

I missed the :) which might sound a bit naff now but was probably intended to deflect comments like mine. Hit taken. However I did invoke BOFH which is (I hope) normally seen as an indication that a comment is not to be taken too seriously.

EDIT: BOFH => Negative - nope, not here.

<comment><USER14> You're correct, I read "BOFH" as a negative. I apologize since you did not mean it in that way. I never thought that BOFH would ever be considered the good guy in the story :)

</comment></comment></comment></comment></comment><comment><USER15> Yeesh. I didn't know that Windows still uses the self-referential page table trick. This makes me very nervous, especially since they seem to keep it mapped in the user page tables. This seems likely to poke a big hole in ASLR if nothing else. It's a _huge_ target for write-what-where exploits.

<comment><USER16> They changed it in Windows 10 (RS1 IIRC)[1].

[1] [http://www.alex-ionescu.com/?p=323](http://www.alex-ionescu.com/?p=323)

<comment><USER9> The tl;dr is that they're still using the self-referential page table trick, however the PTE_BASE is now randomised at runtime with dynamic fixups.

</comment></comment></comment><comment><USER17> Security is hard. I don't think I'd have the stomach to work on kernel or encryption code.

The worst I can do here in userland is crash or delete data. And that's pretty bad already

<comment><USER18> I dunno. I think a program that produces subtly wrong results is the worst. It reminds me of a project I once did. It involved producing reports from tens of thousands of records including summing some of the fields. I was constrained to work on Windows so I put the date into an SQL server database and used MS Access to produce very nice looking reports. I reviewed the reports and everything "looked OK" so I handed them to the users for approval. They users were accountants. They added up the partial sums and pointed out that the results were only approximately correct. It turns out that MS Access is not so good at arithmetic. I restructured the reports to perform the arithmetic in the SQL queries and just use MS Access to format it for a pretty page. I also checked the arithmetic before handing the next revision over.

Better testing (as in more than a superficial glance) would have caught this before review but there always exists the possibility that subtle bugs can sneak past even well thought tests.

Just my own experience and opinion.

<comment><USER19> Agreed. I was doing an derailment investigation a number of years ago which involved digging through event recorder logfiles. The event recorder is such that it writes an entry every second but only updates GPS 20 seconds, so it writes GPS coordinates against every 20th entry.

What I discovered was that the event recorders on certain locomotives updated GPS at the 20th second rather than the 0th second. This meant that the GPS entry next to each line was in fact offset by 20 seconds - i.e. the entry for 02:11:40 was in fact what was sampled at 02:11:20. I think they must've held the GPS coordinate in memory somewhere but updated it AFTER writing that second's entry, so they wrote 02:11:20 whilst holding 02:11:00's GPS, then updated it, but then written that update at 02:11:40, etc. This was a fault with the design of the event recorders, not just one loco, as it occurred on each of that type that I looked at.

This confused me so much because it looked right - it was in the right general location, it was updating, etc. - but for a solid few days I did a bunch of analysis thinking the train was in a different location to where it really was. I eventaully picked up on it when subtle things kept not adding up and verified it by watching another loco come to a stop but then see the GPS keep moving for a bit afterwards until it settled.

I agree with you, subtly wrong results are the worst.

</comment></comment></comment><comment><USER20> I guess upgrade to Windows 10 is the message Microsoft is trying to get out here?

Laying off all those QA and testing people will have some downside - MS seems to be letting older versions take the hit.

<comment><USER21> Perhaps. However, Microsoft has published very clear guidance on how long previous versions of Windows would receive support for, specifically including the period for security updates. Doing what you're describing is effectively reneging on that deal, and that sends a very different kind of message.

<comment><USER20> Sure, I have a hard time believing MS would purposefully screw their Win 7/8 enterprise customers - but the issue at hand suggests it's at the very least a byproduct of their new strategy of focus on Win 10 and the decision to do with less QA/Testers by involving more end users to participate in testing. Thus Win 7 users end up with slower, less tested patches and no hardware support backports. To be fair only the less tested patches sound terrible.

</comment></comment></comment><comment><USER22> Has anyone actually confirmed this bug? The author seems to be an expert in low-level DMA security, but it would be nice to see independent confirmation. Reading through the comments so far, it doesn't seem so. The closest anyone comes is this: [https://news.ycombinator.com/item?id=16693599](https://news.ycombinator.com/item?id=16693599)

I was hoping to see someone who said:

(1) I tested a Windows 7 X64 machine without the Meltdown patch (pre-December 2017) and couldn't read arbitrary memory.

(2) Next I tested with Microsoft's Meltdown patch KBnnnnnnn (Jan or Feb 2018) and _could_ read arbitrary memory. The system is insecure.

(3) I then tested with Microsoft patch KBnnnnnnn (March 2018) and can no longer read arbitrary memory. They fixed it.

<comment><USER9> I did use a modified version of my short test program to actually test modifying the page tables to read a chosen physical address, which worked just fine. The bug is real.

<comment><USER23> And KBnnnnnn that fixes it is which KB?

</comment></comment></comment><comment><USER24> My take on this is a little bit dumb, but, once upon a time, many moons ago, I thought I understood the CPU I acted upon, I could peek and poke and look up what was where. I mostly wanted faster, but what i got was more complex.

Is there a way to just get faster without the complexity. What would a new cpu architecture and OS look like if we started again? is there room for open hardware to save us all?

<comment><USER25> Superscalar processing was unfortunately a major step forward in terms of performance.

The answer in [https://stackoverflow.com/questions/8389648/how-do-i- achieve...](https://stackoverflow.com/questions/8389648/how-do-i-achieve-the- theoretical-maximum-of-4-flops-per-cycle/8402970) is interesting; I'm particularly fascinated by the temperature warning (the answer author's CPU got to 76C in testing).

My CPU's sitting at 30C right now. It maybe climbs to 48C if Chrome's being stupid, and 50+C if I'm doing something mildly taxing. I've never made it go beyond 60C IIRC.

So, modern CPUs are _so_ efficient that they're simply just never hitting their maximum throughput. I think that's pretty incredible.

The sad thing about CPUs that don't use modern (superscalar, multi-stage, microarched, etc) design is that they just can't keep up.

And people's OCD about speed and (more frequently) parallelization nowadays drives what they'll buy. Something had better have a killer feature if it isn't fast or highly parallel.

So it's possible, but a huge headache. Whatever you built would likely be highly purpose-specific.

</comment></comment><comment><USER26> The article says that this vulnerability was patched in March 2018, so at least there's that.

<comment><USER13> I'm still working on a bloody huge list of customer updatathons for Meltdown and Speccy. Now I have to go back around a load of them that I have already patched and find the Win 7s and 2008r2s and update those before I continue.

Oh well, it gives me something to do of an evening 8)

<comment><USER27> Why are you manually patching workstations? WSUS allows central management (inc. zone deployment), but even in Windows 7's default state it should apply these updates without intervention.

2008R2 I can see doing it by hand, but Windows 7 clients is odd. Particularly as it seems to be taking you two months to apply urgent patches.

<comment><USER13> Some of my customer VMs are Windows 7 - Veeam proxies for example. I also take backups quite seriously. Yes this is all a bit manual in some cases.

(Nearly) All of them are on the end of an IPSEC VPN that I can get at from home via the office web proxy and another VPN or via magic. Some of them have 192.168.0/24 or 192.168.1.0/24 - those are on the end of OpenVPN. I wrote this: [https://doc.pfsense.org/index.php/OpenVPN_NAT_subnets_with_s...](https://doc.pfsense.org/index.php/OpenVPN_NAT_subnets_with_same_IP_range) . You have no idea what networking is about until you've had to do that sort of nonsense a few times 8)

I don't have the luxury of one WSUS to manage, we have loads of the bloody things. Some customers have pretty skilled local IT depts, some have somewhat vocal users that accuse you of resetting their passwords after spending hours doing way more than they have paid for and would not understand what you are on about in the first place. I love them all equally as any parent would ...

When I get bored of watching Windows Update I run apt update && apt upgrade && reboot on a few machines and keep a weather eye on the monitoring system. When I get really bored, I run up yaourt on my laptop or my office PC. When I've got a newly installed Win system or two to patch, I fire up a few emerge -Uvh --deep --newuse --keep-going @world sessions (I'm not really joking here) or run up genkernel.

Yes, there is the default state designed by .... bbzzzzrrt .... soz, lost it, and then there is reality. Could I also remind you that there is rather more to patching than WSUS:

* Firmware - Dell, HPE and Co have had to do rather a lot of work here and had to start again in Jan when Intel dropped the ball * Hypervisors - I generally see VMware - that's a lot of patching and don't forget that some of them were buggered, so need excluding. * VM vHardware versions - yep, all those little lovelies have their own hardware types to worry about * "My fooking factory runs 24x7 - what are you going to do about it?" .... "Yes but you didn't go for the full cluster version _sign_ I'll see what I can do" ...

You think I'm odd! No mate, my little company are well aware of automation and use it where we can but we are pragmatic and have to deal with a lot of reality.

We could of course bind our customers to our iron will and enforce our policy and stuff. They would not work on weekends or other odd hours. They would not insist on doing things their way and they absolutely would pay us on time - they generally do 8)

</comment></comment></comment></comment><comment><USER28> Wow, that's crazy. About as bad as it gets for local privesc!

</comment><comment><USER29> So why does this only affect Windows 7?

<comment><USER30> Probably because after Windows 7 they started a kernel rewrite , known as MinWin, to extricate the Win32 Userland tendrils that had crept into the Kernel since the NT days.

[https://en.wikipedia.org/wiki/MinWin](https://en.wikipedia.org/wiki/MinWin)

<comment><USER31> The article doesn't seem to indicate that MinWin started after Windows 7. If there has been a fundamental kernel change effort after Win7 (I'm not aware of one), maybe it has a different name?

<comment><USER30> You're right, for some reason my brain said Vista came after Windows 7. Given that 7 came after Vista my theory makes no sense.

</comment></comment></comment></comment><comment><USER32> Any indication of whether this was actually exploited? I really don't want to do a full key-rotation routine.

Also, does windows 7 map the entire address space into kernel memory? That is, would this have enabled direct memory access to other processors.

<comment><USER33> My understanding of the article is that the page table itself was writable. So you an attacking process could map in the entire memory of the computer and read everything, regardless of what was in the kernel's version page table.

<comment><USER9> The attacking process could also put whatever code it wanted into the kernel, and so give itself full access to everything on disk as well.

</comment></comment></comment><comment><USER34> This sounds contradictory:

"Only Windows 7 x64 systems patched with the 2018-01 or 2018-02 patches are vulnerable. If your system isn't patched since December 2017 or if it's patched with the 2018-03 patches or later it will be secure."

"I discovered this vulnerability just after it had been patched in the 2018-03 Patch Tuesday. I have not been able to correlate the vulnerability to known CVEs or other known issues."

</comment><comment><USER35> The fun thing is that even MS admitted it break non-PAE kernels and pre-SSE2 processors (in the most recent one). I have been fighting a similar bug in one of the Jet 4.0 patches for a while now.

</comment><comment><USER36> Sounds like Microsoft found and patched it independently already. Afterwards someone else (blog author) found it too, maybe by reversing the patch from patch Tuesday.

</comment><comment><USER37> Predictable. Fixing old bugs introduces new bugs.

<comment><USER38> I wonder for how long Windows as a software can continue to grow. I looked at the list of services, and its crazy. So much exotic functionality, and so many of what i don't ever need. Then the file system, there are even hidden folders managed by windows itself, that just grow and take up space. All that adds to complexity, and increases the probability for bugs. I wish there was a version of the OS that just shed all that unnecessary functionality and returned to basics. Something like a minimalist Linux distro, but able to run all games and office.

<comment><USER39> Hmm, but it appears that windows has fewer security bugs than Linux. Is there any data showing otherwise?

(TBH, this is already unfair, comparing the kernel with an entire OS)

[https://www.cvedetails.com/top-50-products.php](https://www.cvedetails.com/top-50-products.php)

[https://www.cvedetails.com/product/47/Linux-Linux- Kernel.htm...](https://www.cvedetails.com/product/47/Linux-Linux- Kernel.html?vendor_id=33)

[https://www.cvedetails.com/product/32238/Microsoft- Windows-1...](https://www.cvedetails.com/product/32238/Microsoft- Windows-10.html?vendor_id=26)

[https://www.cvedetails.com/product/17153/Microsoft- Windows-7...](https://www.cvedetails.com/product/17153/Microsoft- Windows-7.html?vendor_id=26)

[https://www.cvedetails.com/product/22318/Microsoft- Windows-8...](https://www.cvedetails.com/product/22318/Microsoft- Windows-8.html?vendor_id=26)

<comment><USER13> "Hmm, but it appears that windows has fewer security bugs than Linux. Is there any data showing otherwise?"

Yes, I think you are being a bit of a noddy comparing a kernel with an entire OS. That said, all software has bugs. Blimey, how on earth can you compare the paltry 3000000000000 odd source files of Windows tucked up in GIT with the gazzilions of source files that comprises a modern Linux based system (let alone the BSDs etc).

I will simply mention here that when I update an LTS Ubuntu or Debian box I run "apt update && apt upgrade && reboot" (or use a GUI if I'm bored) and it takes a few seconds to minutes to update the entire system. Everything. That includes Java, Flash, Office suites, graphics drivers, USB drivers, printer drivers, CAD suites, database servers, web servers, PHP, Python, Perl, Rust, Go, ... need I go on. Everything. The same happens when I use pacman or yourt, or emerge, or yum, or rpm or whatever.

I'm personally CREST accredited, so have a fair idea about security and prefer to spend my time doing stuff and not waiting for updates to install (if I can even find them) - you?

<comment><USER25> FWIW WinXP is officially quoted as 45 million lines of code ([https://www.facebook.com/windows/posts/155741344475532](https://www.facebook.com/windows/posts/155741344475532)), everyone's decided Win10 is 5-10 (some say 15-20) million more.

I've been meaning to SLOCcount Linux sometime, actually!

Having said that, I don't think it'll be 45M LOC. The kernel is 20M LOC ([https://www.linuxcounter.net/statistics/kernel](https://www.linuxcounter.net/statistics/kernel)). Chrome is 18M (excluding blank lines/comments) ([https://www.openhub.net/p/chrome/analyses/latest/languages_s...](https://www.openhub.net/p/chrome/analyses/latest/languages_summary)). LibreOffice is 9M LOC ([https://www.openhub.net/p/libreoffice](https://www.openhub.net/p/libreoffice)).

And then I found out that KDE is 60M LOC!! ([https://www.openhub.net/p/kde](https://www.openhub.net/p/kde))

GNOME is 9M ([https://www.openhub.net/p/gnome](https://www.openhub.net/p/gnome)).

But I'm guessing those two stats are comparing just the base desktop environment in GNOME's case with all the productivity apps (including KWrite et al) and system libraries (including QtWebKit et al). This must be kept in mind.

TL;DR, an incredibly basic system with _just_ a word processor and web browser, and maybe a minimal windowmanager on top, would be 47M. Adding KDE in makes it 107M - but you're almost never going to use all of it (whereas with Chrome and LibreOffice some large proportion of that 18M and 9M is loaded into RAM and potentially targetable).

<comment><USER13> Mate, the sheer amount of LoC in any modern system is nearly uncountable. I have been a serious Gentoo aficionado for many years. My lap has been burnt for hours simply compiling Firefox or LO. They are both massive and they are only two apps.

If you want to SLOC Linux then download it [https://www.kernel.org/](https://www.kernel.org/) and help yourself. Why not look here as well [https://www.freebsd.org](https://www.freebsd.org) and others - those are my mates, and good ones.

</comment></comment></comment></comment></comment></comment><comment><USER40> I guess we know now that from the 3000000 files or what it was they boasted about, not a lot of them are some sort of unit test..

<comment><USER41> How can you test against an unknown bug?

<comment><USER42> Testing to make sure you can't read from somewhere you are not supposed to read from seems like a pretty obvious test for an OS.

<comment><USER43> There are lots of places you're not supposed to read from. Does any operating system have 100% test coverage of addresses that aren't supposed to be readable?

<comment><USER44> IDK, there's a quite narrow whitelisted known range of addresses that _should_ be readable by your process; you could (and should) certainly have an simple automated test that simply tries to read everything with the expectation that it should succeed only in known cases.

</comment></comment></comment></comment></comment><comment><USER13> I'm just about to add this to our Risk Register. I'm thinking of 0.01 x 100 (our scoring system is 1-3 x 1-3.) That means I think it is very unlikely but seriously (I will probably offend someone if I let loose here) nasty.

<comment><USER45> So you'd give this 1 on a scale from 1 to 3? Presumably 3 being the most serious.

That doesn't make any sense. If this bug is present, this is instant total control of a PC. That's as bad as it gets.

<comment><USER46> Unless OP edited his post, he appears to be scoring it 100 (i.e. it's off the scale).

<comment><USER45> I misread grandparent post. The scale is 1-3 x 1-3, in other words, from 1 to 9.

0.01 * 100 is 1.

<comment><USER46> Ah, I see. I was reading it as two axes, not a product.

<comment><USER13> Yes a product although the term "two axes" works as well. It's a pretty common way of quantifying "risk" into something that you can tabulate and form a todo list. You list your risks and give each one a score from 0-9 that is made up of "chance of happening" x "business impact or importance or whatever". You could score either as zero as well which will obviously cause the total score to be zero.

I'll be changing our Risk Reg soon to become a Risks and Opportunities Register after a discussion in our last ISO 9001 audit. Not sure how the scoring scheme will work for that yet.

This may look like a bit of a silly pseudo formal exercise but it really does help with decision making. There's nothing wrong with bending the scores either, if you are open about it. It is simply a way of prioritising a list of things to do in the end.

I have to be a PHB sometimes as well as a sysadmin 8)</comment></comment></comment></comment></comment></comment>


Did Twitter Ban Trump? (no, he's back) - <AUTHOR> https://twitter.com/readldonaldtrump <comment><USER2> Your link has an extra d. The real link is

[https://mobile.twitter.com/realDonaldTrump](https://mobile.twitter.com/realDonaldTrump)

...

oh shit

Archive link for posterity,

[http://archive.is/tdyiQ](http://archive.is/tdyiQ)

Twitter banned the POTUS

</comment><comment><AUTHOR> typo in the URL, but the correct URL also 404s [https://twitter.com/realdonaldtrump](https://twitter.com/realdonaldtrump)

<comment><USER3> It works for me. I see his twitter.

<comment><AUTHOR> it just came back...

<comment><AUTHOR> [https://twitter.com/pierce/status/926222729660862464](https://twitter.com/pierce/status/926222729660862464)

</comment></comment></comment></comment><comment><USER4> Discussion [https://news.ycombinator.com/item?id=15615583](https://news.ycombinator.com/item?id=15615583)</comment>


Google's Chromebooks Rule Schools as IDC Pegs Them as Top Sellers in K-12 - <AUTHOR> http://techcrunch.com/2014/11/10/googles-chromebooks-rule-schools-as-idc-pegs-them-as-top-sellers-in-k-12/ <comment><USER3> I bought a Samsung Chromebook for travelling. Turns out that they're very capable. With Crouton I basically get a bare bones Linux laptop. I ended up using it all the time.

<comment><USER4> True. And for browsing only, or web-services chromebook (the OS) is as good and fast as it gets!

</comment></comment><comment><USER5> My only knock against Chromebook is that Skype is not supported. For many casual users Skype is still a requirement.

Supposedly there is a way to install Skype for Android on a Chromebook ([http://www.pcworld.com/article/2686712/run-any-android- app-o...](http://www.pcworld.com/article/2686712/run-any-android-app-on-your- chromebook-with-this-hack.html)) but Skype app did not load properly for me.

I ended up making a dual boot with Lubuntu on it just for Skype.

Otherwise a Chromebook is pretty much sufficient for casual users(my mother- in- law etc).

<comment><USER6> I have switched to Hangouts instead. It only misses interoperability with similar services like Skype (one can dream).

<comment><USER7> Skype and Hangouts have both proven to be difficult to use for me and my girlfriend in our long-term relationship. Given a steady internet connection, Hangouts is the preference, as I have found it drains the battery and other performance less. However, Skype seems to be better if there are weaknesses in the connection.

</comment></comment></comment><comment><USER8> I have something in between an observation and a theory about chromebooks, though I'm not entirely sure about it.

First, I think there's still a big whole in home computing. Windows laptops are a bundle of compromises that doesn't serve the average home user all that well. Chromebooks are an appealing concept.

OTOH, the praise of chromebooks since the start always seems to be "these are cool, they would be great for X" where X is your theoretical aunt, nephew or neighbor. Enthusiasts also like them as a "2nd machine." At the same time, while they continue to sell well I see very little of Chrome OS traffic in web analytics. When the iphone first went on sale, the traffic ramped up immediately. Android web traffic lagged behind sales a lot more and the build up took longer, but it was still obvious. Public data seems to be generally similar.

I don't know how far to take conclusions from that. I realize that certain sites do experience significant Chrome OS traffic, especially US education focuses sites. But, for most of the web, Chrome OS seems to be fighting to get to the middle of the "other" category, with SymbianOS and Playstation as rivals.

I think Chrome OS is awesome, but still not done. Some sort of a merger with android, some rejigging of the apps and the basic metaphors might be an improvement. I know for my part I'd like to get my Dad one, but it doesn't run Skype so...

<comment><USER9> Anecdotally: My 12-year-old daughter uses her phone to text friends and her Android tablet (Nook running Cyanogenmod) to read books from the library in the Kindle app. She's constantly dragging around a Chromebook because "it has better speakers" and the folding screen doesn't need to be held to show YouTube videos.

The 10-year-old daughter (not old enough for a phone (for us), reads paper books) drags around another Chromebook for YouTube and writing.

The 8-year-old son uses a Kindle Fire tablet to play games and read books we've bought.

We replaced the iMac in the kitchen with a Chromebox and that's been hugely popular. The old iMac was six years old and very slow.

My 10-year-old has had some trouble at her school because they use MS Office and she's not used to having to save her changes. She's written 6730 words in her story for English class since the start of November in Google Docs and we transfer it onto a flash drive so she can take it to school.

My wife and I have MacBook Airs but I would find it tempting to replace mine with a new Toshiba Chromebook (1920x1080 IPS screen for $330) if my MacBook died today. I'd like shell access without necessarily needing root access. Trying shell access meant flipping a switch on the Chromebooks that brought up a scary warning every time I opened the lid. This was a couple of years ago and I hope things have progressed.

</comment></comment><comment><USER10> I purchased the Dell Chromebook from Dell's education website. It's a slick looking device that was quite reasonably priced. I find it to be much more useful than my Nexus 7 or my iPad 2.

<comment><USER11> Chromebook is like the flipside of that Ballmer quote[1]: "that is the cheapest computer in the world and it appeals to everyone because it even has a keyboard"

[1] [http://youtu.be/eywi0h_Y5_U](http://youtu.be/eywi0h_Y5_U)

<comment><USER12> That's some video quality.

</comment></comment></comment><comment><USER13> "IDC's new figures for tablets and laptop sales in K-12 education finds that Chromebooks as a category constitute the best-selling device across the entire category in 2014"

So, what are the figures?

</comment><comment><USER14> MS should release a WinRT for x86 devices, same security as chromebook and tons of apps. Also believing that it is a new OS and WIndows marketshare in post PC devices, shouldn't get any trouble with govt for monopoly abuse.

<comment><USER15> In what world does WinRT have a ton of apps? Most of the Windows Store apps are of quite questionable quality, and the selection isn't good either.

<comment><USER7> It also doesn't help that no Google apps are officially supported on the Windows store. Casual users want their Youtube and Gmail! Their lack of existence (and the dearth of other apps) stopped people from adopting the platform.

</comment></comment></comment><comment><USER16> Just completed some work with a large higher education client. There seems to be a real battle forming in education between Google and Microsoft.

On one side the institutions cash strapped from years of government under- investment into education and with lots of their infrastructures long beyond end-of-life.

On the other, large software vendors that - like with FMCG - want to create their products from childhood onward as everyday items that every child knows (and will continue to buy for the rest of their lives).

Within higher education, at least in the UK, Microsoft seems to be winning in the moment.

You have only a (very) small set of universities that are providing Google apps etc to their students. With HW - BYOD and that latest every second year student now has her own computer(s)has most likely helped a few of the universities to stay more easily afloat. Microsoft at the same time has managed to win over more than 60% of all universities in the UK (to use Office 365).

One reason for that might also be that those universities that tried to provide Google Apps 1-2 years ago to their students mostly had rather negative experiences & many issues with the "roll-outs". But an even more important reason is the continuous dominance of MS Office in the business world - <USER2> proficiency with MS Office does still sound much better on a CV than having used Google Apps for 4 years.

This is now intensifying with Microsoft providing MS Office for free directly to all students (including K12) latest from next month on. They have last week started to give free access to their mobile (iPad, Android - tablet solution soon arriving) versions and those are now leading the download charts of all app stores. BTW - real world stats show that about 2/3 students use MS Office on at least 2 devices (laptop plus 1-3 mobile).

And the battle for the education infrastructures (storage space, business compute, thin clients - higher edu is one key client for that market) is also intensifying with MS now getting more aggressive with their virtualised desktop solution offerings (see also IE as a service).

If Google wants to regain some ground here it needs to provide more turn-key solutions in the infrastructure area. With day-to-day web based and virtualised application infrastructure, the OS becomes more and more secondary for typical end users (HPC / scientific computing / design & engineering are completely different ballgames and dominated by Apple machines on one side and linux / unix clusters for the other use cases).

When most mass use and productivity apps can be delivered to almost every machine including Chromebooks in those ways, the end user OS has fully become a commodity and decisions are / can be made mainly by the price / cost only. At that point Chromebooks (together e.g. with NUCs today, US$100 sticks to plug into monitors running Win8/10 / ChromeOS tomorrow) might become the cheapest option with all the consequences for the manufacturers (small margins, scale needed, etc).

<comment><USER17> In my experience at American universities, Microsoft has been successful in getting contracts with the universities, but students don't actually use their products. There are some students that use Outlook's web interface for email, but most forward everything to their personal Gmail accounts. And _no one_ uses Office 365 - everyone knows about & uses Google Docs (again, from their personal Gmail accounts).

However, I don't think that what students use in universities really matters when they transition into the corporate world. Even with BYOD, when everything's on the web, you can just require your employees to use a particular productivity suite. So I'm not convinced that using free/discounted education software to gain mindshare among future employees is an effective tactic.

<comment><USER16> I can only provide some insides with UK universities.

There also students very frequently were using GMail and just used mail forwarding from their university email accounts.

With at least one large UK university we've seen very strong uptake of the MS Office apps & email (85% vs 30% in the years before). They also have a large number of distance learners for which these solutions are substantially better than what the university offered previously so that might skew the numbers a bit. Uptake of OneDrive for example was much lower around 40% 3 months after the roll-out but still rising. Stats that MS provides on this are mainly MS Exchange (online) based (plus some SharePoint / OneDrive data - the rest of the stats they provide are at best historic or unusable).

At the same time when the university wanted to communicate with all students besides their course work, they used Twitter or Facebook and not email.

</comment></comment></comment><comment><USER18> Can you put a C++ compiler or an C++ IDE on that thing ?

<comment><USER19> Not officially. But I've heard of people who've managed to cross compile and install gcc on Chrome OS in developer mode. Otherwise you can simply install Linux.

<comment><USER18> any badly supported drivers ?

<comment><USER20> +1 what dagw said, also if you have a c720 like me, you will probably be interested in this: [http://www.reddit.com/r/chrubuntu/comments/1rsxkd/list_of_fi...](http://www.reddit.com/r/chrubuntu/comments/1rsxkd/list_of_fixes_for_xubuntu_1310_on_the_acer_c720/)

The c720 touchpad drivers made it into the most recent (3.17) kernel, which is good, but with most distros this will require you to compile the kernel yourself. I've had issues both with a normal linux installation and crouton chroots; it's hard to recommend either option wholeheartedly. Generally my experience has led me to use cloud-based alternatives when I can; it's a nice experience to boot Chrome OS for the first time, sign in, and have all my Chrome apps, settings, and wallpaper available in at most a couple minutes. I can particularly recommend cloud9 as an IDE. Together with a VPS for my "real" linux work, I am becoming more accustomed to using Chrome OS exclusively.

</comment></comment></comment></comment><comment><USER21> I hope the schools are aware of the privacy implications for students, who are essentially captive because they'd have to change universities to avoid being tracked and are very susceptible to advertising.

From [http://www.edweek.org/ew/articles/2014/03/13/26google.h33.ht...](http://www.edweek.org/ew/articles/2014/03/13/26google.h33.html)

"As part of a potentially explosive lawsuit making its way through federal court, the giant online-services provider Google has acknowledged scanning the contents of millions of email messages sent and received by student users of the company's Apps for Education tool suite for schools. In the suit, the Mountain View, Calif.-based company also faces accusations from plaintiffs that it went further, crossing a "creepy line" by using information gleaned from the scans to build "surreptitious" profiles of Apps for Education users that could be used for such purposes as targeted advertising."

"A Google spokeswoman confirmed to Education Week that the company "scans and indexes" the emails of all Apps for Education users for a variety of purposes, including potential advertising, via automated processes that cannot be turned off—even for Apps for Education customers who elect not to receive ads. The company would not say whether those email scans are used to help build profiles of students or other Apps for Education users, but said the results of its data mining are not used to actually target ads to Apps for Education users unless they choose to receive them."

...

"Student-data-privacy experts contend that the latter claim is contradicted by Google's own court filings in the California suit. They describe the case as highly troubling and likely to further inflame rising national concern that protection of children's private educational information is too lax."

"Mr. Thiele said his district has used Google Apps for Education since 2008. Officials there have always been aware that the company does "back-end processing" of students' email messages, he said, but the district's agreement with Google precludes such data from being used to serve ads to students or staff members. As long as the company abides by those terms, Mr. Thiele said, "I don't have any problem with it." In an emailed statement provided to Education Week, Bram Bout, the director of Google Apps for Education, said that "ads in Gmail are turned off by default for Google Apps for Education and we have no plans to change that in the future.""

...

"Those plaintiffs in the California lawsuit allege that Google treats Google Apps for Education email users virtually the same as it treats consumer Gmail users. That means not only mining students' email messages for key words and other information, but also using resulting data—including newly created derivative information, or "metadata"—for "secret user profiling" that could serve as the basis for such activities as delivering targeted ads in Google products other than Apps for Education, such as Google Search, Google+, and YouTube."

"The plaintiffs allege that Google has employed such practices since around 2010, when it began using a new technology, known as Content Onebox, that allows the company to intercept and scan emails before they reach their intended recipients, rather than after messages are delivered to users' inboxes, regardless of whether ads are turned off."

"While the allegations by the plaintiffs are explosive, it's the sworn declarations of Google representatives in response to their claims that have truly raised the eyebrows of observers and privacy experts. Contrary to the company's earlier public statements, Google representatives acknowledged in a September motion to dismiss the plaintiffs' request for class certification that the company's consumer-privacy policy applies to Apps for Education users. Thus, Google argues, it has students' (and other Apps for Education users') consent to scan and process their emails."

"In November, Kyle C. Wong, a lawyer representing Google, also argued in a formal declaration submitted to the court in opposition to the plaintiffs' motion for class certification that the company's data-mining practices are widely known, and that the plaintiffs' complaints that the scanning and processing of their emails was done secretly are thus invalid. Mr. Wong cited extensive media coverage about Google's data mining of Gmail consumer users'

>Mr. Wong's inclusion of the following reference to the disclosure provided to students at the University of Alaska particularly caught the attention of privacy advocates: The University of Alaska ("UA") has a "Google Mail FAQs," which asks, "I hear that Google reads my email. Is this true?" The answer states, "They do not 'read' your email per se. For use in targeted advertising on their other sites, if your email is not encrypted, software (not a person) does scan your email and compile keywords for advertising. For example, if the software looks at 100 emails and identifies the word 'Doritos' or 'camping' 50 times, they will use that data for advertising on their other sites."

"The fact that Google put this in their declaration means we take it as true," said Ms. Barnes of the privacy watchdog group EPIC. Google's sworn court statements reveal that the company has violated student trust by using students' education records for profit."

From a Google filing in court about Gmail privacy:

>Indeed, "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties." Smith v. Maryland, 442 U.S. 735, 743-44 (1979).

>it's "inconceivable" that someone using a Gmail account would not be aware that the information in their email would be known to Google.

<comment><USER22> I remember reading somewhere that Google announced that they're now stopping using emails in Apps for Business and Apps for Education for building ad targeting profiles.

Very surprising to know that the paid Google Apps for Business were also being used that way, but this being primarily an ad company, not surprised that they were making misleading and false statements to the public on their web site until they were compelled to explain in federal court, where apparently they couldn't continue lying under the threat of heavy fines or jail time. Only Google knows what other data is being used to track people for showing ads.

I doubt many people are aware that their Android phone's location might be being tracked for monetizing ads.

[http://www.datadrivenbusiness.com/google-quietly-testing- off...](http://www.datadrivenbusiness.com/google-quietly-testing-offline- store-visits-tracking)

I am debating getting a Nest, but all this makes me queasy.

<comment><USER23> We've been an Apps customer (20,000+ seats) since 2009 and have always been told our content was not scanned or otherwise used for advertising purposes (and of course no ads are displayed, either).

<comment><USER22> From [http://googleforwork.blogspot.com/2014/04/protecting- student...](http://googleforwork.blogspot.com/2014/04/protecting-students- with-google-apps.html)

>removed all ads scanning in Gmail for Apps for Education, which means Google cannot collect or use student data in Apps for Education services for advertising purposes.

>We're also making similar changes for all our Google Apps customers, including Business, Government and for legacy users of the free version, and we'll provide an update when the rollout is complete.

I believe the data gathered was used to target ads shown in other Google properties, like YouTube, and that Content OneBox was scanning all emails. See this:

>The plaintiffs allege that Google has employed such practices since around 2010, when it began using a new technology, known as Content Onebox, that allows the company to intercept and scan emails before they reach their intended recipients, rather than after messages are delivered to users' inboxes, regardless of whether ads are turned off.

Looks like the ads checkbox applied to only ads being shown in Apps, not to the data being collected from the emails on the backend to build ad profiles.

</comment></comment></comment></comment><comment><USER24> Subsidised, cheap laptops sell well in schools. Amazing.

<comment><USER25> Subsidized?

<comment><USER26> I assume he means subsidized by the value that Google is getting out of the sales other than the purchase price (because it increases Chrome usage which increases Search usage). I suppose he's not technically wrong (even if it's an indirect subsidy) but it's a bizarre usage of the term and it could apply to a LOT of device vendors.

<comment><USER27> I think it's fair to say that if your kid comes home with a ChromeBook that you didn't purchase, it's being subsidized somewhere. My local high school just issued them to all freshmen. What I find a bit odd is that if there is any paperwork involved, it's not "Do you give us permission to lend a laptop to your child?", it's "Your child must sign this pledge not to abuse this device." I support the program, but the responsibility goes two ways, and I expect the school district to advocate student privacy over the lure of "free stuff."

<comment><USER23> I don't think Google is giving them away (at least not in the US). This would have been funded by the school district. In my area (North Carolina), some have chosen Windows, some tried Ipads, and some are using Chromebooks. Generally peaking ,the ipads fair the worst and the trend is moving in favor of Chromebooks. Even if the hardware is free, there is still the need for an administration license, too.</comment></comment></comment></comment></comment>


Presentation:  How to Raise Venture Capital - <AUTHOR> http://www.markpeterdavis.com/getventure/2010/07/how-to-raise-vc-presentation.html

<comment><USER2> On slide 13, Mark (or is it Mark Peter) starts off with 'location'.

Can you provide some insight into why this is important? Does SF, matter vs Salt Lake or Vancouver? Does Tahoe matter vs. SF (I ask that being from Whistler, BC, but understand that many VCs won't invest outside their home country).</comment>


Fix 260 character file name length limitation: Declined - <AUTHOR> http://visualstudio.uservoice.com/forums/121579-visual-studio/suggestions/2156195-fix-260-character-file-name-length-limitation <comment> chao- I was made aware of this artificial limitation through a pretty vivid edge case while I a student some years ago. TortoiseSVN had somehow borked and began to recursively create .svn directories inside of each other, as fast as it could, until such time as I managed to kill the process.

Many can guess what happened next: I went to delete the erroneous top-level .svn folder and was given an error, the gist of which was: "Cannot remove. Path too long." There's more to the story, but it turns out the real answer was to boot into a Linux LiveCD and delete from within there.

I found it strange that one set of Win32 calls allowed TortoiseSVN to _create_ paths of a certain depth, but the other set, used by Microsoft in their tools, would not allow me to delete them. These days I understand the reasons behind it, and so instead find it merely annoying.

<comment><USER2> NTFS has actual support for hard file links, but only usage I ever seen was for jokes similar to this one.

<comment><USER3> I use junction/hard links to alias part of my filesystem into dropbox. There is a real use case for it.

</comment></comment></comment><comment><USER4> Unfortunately this kind of thing is the reason why Windows is in a death spiral that it probably won't get out of.

Microsoft has had many chances to introduce clean new APIs: for instance, .NET could have been built on top of a simpler platform, or Metro could have been an opportunity to take out some cruft.

In the end Metro breaks everything (if you think the median programmer could write non-trivial apps with asynchronous I/O, think again.) Amazingly, Metro almost feels like a tablet operating system when it is running on top of the line hardware, but the ultimate attack on latency is to remove things from the stack and not to add them.

Personally I think Windows today (even Win 8) beats the pants off Linux and MacOS as a GUI operating system, but I seriously have to ask questions such as "will Intel be making new x86-compatible processors 10 years from now?" when I see Microsoft and Intel consistently painting themselves in a corner.

<comment><USER5> It shouldn't matter. NT was designed to be platform agnostic; it was written on the Intel i960, a long-forgotten RISC processor from Intel, by guys who had cut their teeth on VAX and Alpha, and was released on x86, Alpha, MIPS and PPC. There was even a SPARC port which never saw general release. I was running SQL Server on NT on Alpha in '96 or thenabouts, and bloody quick it was too! Porting NT 7 (or whatever Windows 8 really is) to ARM or POWER or whatever is not going to be a big deal.

<comment><USER6> > Porting NT 7 (or whatever Windows 8 really is) to ARM or POWER or whatever > is not going to be a big deal.

I'm uncertain they kept cross-platform systems running around (whereas I'm reasonably certain Apple has a full OSX running on ARM internally, as they had OSX/x86 long before they left POWER behind). Although NT was built to support a number of architectures, it's been almost 15 years since NT last ran on non-x86 systems (AlphaNT, the Alpha port of Windows 2000; MIPS and PPC had already been dropped by this time), that's a very long time, and more than enough for x86 dependencies to creep in.

On the other hand, WinRT is supposedly a full NT kernel on ARM, so...

<comment><USER7> Windows through Server 2008 ran on Itanium, so they've been fine with non-x86 at least up until that point.

<comment><USER8> The Itanium build continued through Server 2008 R2.

Thus, _every_ version of Windows NT has been released on at least one non-x86 platform.

\- NT 3.1-3.5: x86, Alpha, MIPS

\- NT 4.0: x86, Alpha, MIPS, PowerPC

\- 2000 through 2008 R2 (7.0): x86, Itanium

\- 2012 (8.0): x86, ARM

<comment><USER9> 2012 is actually NT 6.2 (as is Windows 8).

<comment><USER8> > _2012 is actually NT 6.2 (as is Windows 8)._

Notice that I listed Windows Server 2008 R2 as 7.0 rather than as 6.1. And that I listed Windows 2000 as 2000, rather than as 5.0.

In other words, I was giving the equivalent workstation OS -- not the internal NT version number.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> [http://msdn.microsoft.com/en- us/library/aa365247%28VS.85%29....](http://msdn.microsoft.com/en- us/library/aa365247%28VS.85%29.aspx#maxpath)

[http://stackoverflow.com/questions/1880321/why-does- the-260-...](http://stackoverflow.com/questions/1880321/why-does- the-260-character-path-length-limit-exist-in-windows/)

[http://www.codinghorror.com/blog/2006/11/filesystem-paths- ho...](http://www.codinghorror.com/blog/2006/11/filesystem-paths-how-long-is- too-long.html)

Summary: The assumption has been baked in forever and changing it is Non- Trivial. Workarounds exist though! (Kind of.)

<comment><USER11> Yep, our Maven project routinely fails to build on Windows as there are some paths which are just too long.

</comment></comment><comment><USER12> The "forever" in the title does not exist in the linked response, and I would also note that the question seems to be in regards to Visual Studio and has a very VS-oriented response.

Some Windows APIs support 32k paths but since not all do, very few applications can claim to support more than 260.

</comment><comment><USER13> > gets in the way of having a deeply-nested project hierarchy"

Do people actually want deeply-nested project hierarchies?

For example, from a real-world, full operating system, the deepest path I can find[0] is in a build directory and 184 characters:

> "./ports/lang/python26/work/Python-2.6.1/portbld.static/build/temp.XXXXXX > XXXXX-vHEAD-amd64-2.6/XXXXXX- > home/XXXXX.git/src/ports/lang/python26/work/Python-2.6.1/Modules/_multiprocessing"

(Names changed to protect the "innocent.")

[0]:

        $ mkfifo ../names
        $ find . > ../names &
        $ python
        >>> with open("../names") as f:
        ...   l = 0
        ...   nm = None
        ...   for n in f.readlines():
        ...     if len(n) > l: l, nm = len(n), n
        ...   print l, nm

<comment><USER14> Right now, sure. But suppose some piece of software goes rogue and starts creating dirs and files. Further suppose that there's enough of them to fill the disk. OK, now your disk is full and nothing on the machine works, so you need to delete those deeply-nested files. Except, whoops!, the paths are too long, so you can't delete them with the command line. OK, now you're writing a script or burning some godawful boot CD to try to get to a safe mode or Linux kernel. All in order to delete some silly unnecessary files.

Problems like this aren't problems when everything is working normally. But that's beside the point. When the shit hits the fan and the system is only getting in your way and adding to the problems instead of helping solve them, it's really really really not fun.

<comment><USER13> I know, when the shit really hits the fan, visual studio is the tool I would use to try and clean up those messy directories.

</sarcasm>. The complaint is about Visual Studio's decision in particular, not the weakness of (some) (old) Win32 APIs.

</comment></comment></comment><comment><USER15> Errr, it says Visual Studio will limit the path length for now. Windows already support longer path names, if you use the right APIs.

My understanding is that it's not worth going over all of their code to use the newer APIs since they also rely on third parties that they can't force to update. Those would still break when dealing with longer paths.

Still sucks (the path length limit is indeed problematic, especially when dealing with Java code), but let's not exagerate things shall we?

<comment><USER16> I have the same feeling as you... I don't understand where other people's hostility is coming from. This sounds like it would be a minor change. Will Buik, who posted the decline note, said that it would affect many products and features. Besides making those changes, they also have to be rigorously tested. And then the change may not even be consistent all across the board because of third-party tools that depend on the 260 character limit assumption... In the end, Microsoft has limited resources just like every other company. They have to allocate it in a way that creates the most value for customers, I'm assuming. Bug fixing and addressing customer complaints is creating value, but it has to be weighed against other priorities, depending on the severity.

<comment><USER17> People are hostile because they're tired of Microsoft holding things back. These decisions, while reasonable, ultimately don't add up to good decisions. They're not obligated to do anything else, but I'm not obligated to be nice about it.

</comment></comment></comment><comment><USER18> MAX_PATH is a #define, so by increasing it you immediately cause buffer overflow vulnerabilities in every program which ever does a wchar_t foo[MAX_PATH] = {0}; since the old limit will be baked into the binaries.

Even if VS restricts itself to 32k-aware APIs, you'll hit this eventually when shelling out or calling any third-party code. Never going to happen.

<comment><USER19> Ok I may just be overtired but how would changing a define cause this? Its a static number - you make it bigger and ordinary programs just can't see the extra length in buffers. They're not going to be assuming they can execute memory they didn't allocate, and Windows won't allocate them memory from a buffer string that's already been handed out.

Even if they're just looking for a null terminator, they'll crash when they overrun the bounds if written properly.

<comment><USER18> Consider something like

        wchar_t buff[MAX_PATH] = {0};
        int (*callback)(void);

        if (NULL == ::PathCombine(buff, /* ... */)) {
          return; // Error, don't continue
        }
        callback();

If this is compiled with a small MAX_PATH and run on a system with a large MAX_PATH, then the system can write a value that's too long, overflow `buff` and overwrite `callback`, which would then execute the buffer contents and probably crash. Building an exploit out of this is left as an exercise for the reader (e.g. supply PathCombine with some shellcode)

I picked a random API, but there are several win32 functions which accept a character buffer without an explicit size, and mention MAX_PATH in the MSDN documentation.

<comment><USER19> You could patch those functions if you were Microsoft and overload them so they had a form which worked explicitly with long paths, though I suppose that's getting beside the point since Windows already has the necessary APIs - the problem is MS for some reason insists on not transitioning to them.

<comment><USER20> There is nothing to say the developer did not create their own version of that API function:

       if (NULL == ::MySpecialPathCombine(buff, /* ... */)) {
          return; // Error, don't continue
       }

There is no way Microsoft can patch that, but the problem is still there.

Also back to the PathCombine example. When the third party executable was compiled, the Windows SDK would have defined PathCombine to take a string the size of 260 (or whatever value MAX_PATH was at the time it was compiled).

If Microsoft did patch the call and then return more than 260 it would just crash the calling third party executable as it would only be expecting at most 260 characters.

In effect Microsoft would effectively re-defined the static PathCombine API signature at runtime and making it some sort of dynamic signature.

</comment></comment></comment></comment></comment><comment><USER21> Am I the only one that had a response of "OK" to this? While I think this limitation is so sad it's funny I haven't had problems with it in years.

<comment> mark-r Check out some of the replies on the page. It seems that under certain not- rare circumstances, Visual Studio itself will generate paths longer than 260 characters.

</comment></comment><comment><USER22> What's important here is not the bug or how it can be fixed, or worked around. What's important is the fact that they'd rather create new features than fix bugs. Now that might be undue, this is a the very definition of an edge case, but it's just one more nail.. Proving that they'd rather "move forward" than look back. Not a good image to have. Even if it's just an image.

</comment><comment><USER23> oh no, how will my Enterprise Java Enterprise Application work on our Windows Enterprise Production Enterprise Datacenter Edition?

</comment><comment><USER24> This is a global issue with Windows, not with Visual Studio. If you use these "new" APIs to write above MAX_PATH [1], the file system will obey you, but tons of other tools will not. One of these minor tools is Windows Explorer![2].

So if you updated Visual Studio to support it, a ton of other tooling and UX would fail. This needs to be a corporate wide, product wide, and 3rd party initiative. The scale of which is likely not worth the result.

[1] [http://msdn.microsoft.com/en- us/library/windows/desktop/aa36...](http://msdn.microsoft.com/en- us/library/windows/desktop/aa365247\(v=vs.85\).aspx)

[2] I don't heavily use Windows anymore, but when I tested < Windows 8 machines with > MAX_PATH, Explorer did not work.

</comment><comment> w-m Looking for the longest path on my machine, I was slightly amused to learn it was this one (length of 345 characters):

/Applications/Xcode.app/Contents/Developer/Documentation/DocSets/com.apple.ADC_Reference_Library.DeveloperTools.4_6.docset/Contents/Resources/Documents/recipes/instruments_help- stack-trace- help/Displaying_Your_Source_File_That_Contains_a_the_Symbol_in_a_Stack_Trace/13_Displaying_Your_Source_File_That_Contains_a_the_Symbol_in_a_Stack_Trace.html

</comment><comment><USER25> Dear Microsoft, you made thousands of us to suffer the pain to deal with your API to access long paths.

Please have now at least the decency to do the same without complaining.

</comment><comment><USER26> I always thought this limitation came from NTFS, or at least a previous version of.

Maybe this might be resolved in the gradual move to ReFS which I am under the impression is the long term future of the windows world.

<comment><USER27> NTFS is actually a pretty glorious filesystem. It even includes support for soft and hard links.. but for some reason Windows doesn't use them and instead prefers it's weird shortcut file abstraction which never works outside of Explorer

<comment><USER28> You haven't looked at the default filesystem layout of Windows Vista and later, did you?

Hardlinks are extensively used in WinSxS to link the DLLs and executables to places where they used to live. Symlinks are used for many of the legacy directory names that some applications have hardcoded, e.g. C:\Documents and Settings links to C:\Users.

<comment><USER29> But the user has no access to file symlinks without escalating to admin every time they want to make one.

<comment><USER8> > _But the user has no access to file symlinks without escalating to admin > every time they want to make one._

By default.

This is a security restriction, like UAC. And so you can turn it off, just like you can turn off UAC.

<comment><USER29> And requiring that makes it useless for most purposes.

</comment></comment></comment></comment></comment></comment><comment><USER30> perhaps someone has posted it, but I don't see it here:

[https://en.wikipedia.org/wiki/Subst](https://en.wikipedia.org/wiki/Subst)

Gotta really stupid-long base path? alias it.

</comment><comment><USER31> This .NET library from the .NET BCL team helps a little: [http://bcl.codeplex.com/wikipage?title=Long%20Path&referring...](http://bcl.codeplex.com/wikipage?title=Long%20Path&referringTitle=Home)

</comment><comment><USER32> Fixing it on visual studio would still leave it unfixed the Windows API and for almost all other software, e.g. you can't open files with path > maxpath from windows explorer. Visual studio support would not help much.

</comment><comment><USER33> If Windows has good enough support for symbolic link, this wouldn't even be a problem in practice. There always is some way to solve the problem other than declining it.

</comment><comment><USER34> Another fun one: the Line Number variable in Visual Studio's debugger is 16-bit. In huge generated files, you can't step through code beyond line 65535.

<comment><USER35> This is not actually true. I just tried it.

</comment></comment><comment><USER36> Oh my god. I don't use windows anymore, but I remember this limit of 260 characters from DOS 6.0. I just assumed that they already fixed it long ago.

</comment><comment><USER37> And this, children, is why we take proper abstraction very seriously.

</comment><comment><USER2> There is old joke which is now actually true. The best Win32 implementation is Wine on Linux :-)

<comment><USER2> Why downwote? Oh I see; fixed version: Wine on Mac</comment></comment>


Optimizing Gaussian blurs on a mobile GPU - <AUTHOR> http://sunsetlakesoftware.com/2013/10/21/optimizing-gaussian-blurs-mobile-gpu

<comment><USER2> The page isn't loading for me but I will chime in with an image smoothing optimization trick I've used. If you don't need an exact Gaussian blur you can approximate it very efficiently using integral images: [http://en.wikipedia.org/wiki/Summed_area_table](http://en.wikipedia.org/wiki/Summed_area_table)

The more "boxes" you use in your sliding window (analogous to a convolution kernel), the better you can approximate a Gaussian kernel. If you're using a big Gaussian kernel on a big image then integral images can result in a large reduction in the number of operations performed and thus potentially enable a big speed-up.

</comment><comment><USER3> In addition to what was already there, I'd suggest looking at trying to operate on the whole image at a time rather than pixel-by-pixel. To take a simple blur example, a blur that samples the local pixel at 50%, and each of the top, bottom, left, and right by 12.5% is equivalent to drawing the entire image half darkened, then drawing it in each of one pixel to the left, right, up, and down at 12.5% of the original brightness, merging additively. I don't know if this would be faster or not, you'd have to profile it, but I'd consider it worth a try.

<comment><USER4> On the contrary. Consider that the memory is the bottleneck when performing the blur. I understand you would create five instances of the images (50%, 12.5% Left, R, Top, B). This would worsen the bottleneck even more.

Additionally, the advantage of computing pixel by pixel is that the shader can operate massively parallel.

<comment><USER5> I would think it is going to depend on your cache size. Piecewise will be better if the image can't all fit in the cache, but if the image is small enough you can fit everything in the cache.

Or, do you mean that memory is the bottleneck as in, shipping the image to the GPU's memory space?

<comment><USER4> Yes, it really depends on your cache size.

And the problem with that is, you can't guess the cache size. You can help yourself with profiling, but this leads to a local optimization for only some GPUs.

If you wish to run your code optimized for any GPU, the pixel-by-pixel approach usually works best. Then, the GPU scheduler can run as many neighboring threads as possible in subprocessors. Note that every subprocessor has another local cache which is really quick.

</comment></comment></comment></comment><comment><USER6> FFTs where designed for this [http://en.m.wikipedia.org/wiki/Convolution_theorem](http://en.m.wikipedia.org/wiki/Convolution_theorem)

<comment><USER7> I'm surprised this isn't even mentioned in the article. I guess there are issues with boundary effects, but those can be overcome in a variety of ways.

Also, if your convolution kernel is short enough, you can beat an FFT. So, in 2D with an NxN image, an FFT filter will have a complexity of about (N^2 + N^2 Log N). If your kernel is KxK, then direct convolution will be (N^2 K^2), so you have to compare Log N with K^2. But keep in mind 1.) these are asymptotic complexities the coefficients matter 2.) K may or may not depend on N 3.) FFTs are may have larger memory requirements, although you may be able to get away with in-place FFTs, and you don't have to explicitly compute the FFT of the gaussian - you can work that out analytically (you should get another gaussian...).

Also, as someone pointed out, the gaussian is separable, so then the complexity of the direct convolution is (K N^2).

Anyway, what are FFT libraries like for iOS? I suppose with Apples policies, you can't compile FFTW for your App?

<comment><USER8> Last I played with FFT convolution it didn't end up being a win for any sane filter size, even compared to brute-force convolution with arbitrary non- separable kernels. Admittedly I was using off-the-shelf tools in Nuke, but I would imagine both their FFT and Convolve nodes are reasonably optimized.

There's an analysis of the 1D case here with some interesting cautions at the end: [http://www.engineeringproductivitytools.com/stuff/T0001/PT15...](http://www.engineeringproductivitytools.com/stuff/T0001/PT15.HTM)

</comment></comment></comment><comment><USER9> I've done some research in doing live blurs and created my own hack solution [0]. The biggest bottleneck I've always seen people run into is doing the snapshot. Your solution looks really great, but I'm wondering how you would continuously snapshot the screen without running into issues? Or, have you found another solution.

Really great read!

[0]: [http://whoisryannystrom.com/2013/09/17/Live-blur-in- iOS7/](http://whoisryannystrom.com/2013/09/17/Live-blur-in-iOS7/)

</comment><comment><USER10> There is also blur by fft. This way you get nlogn performance in the number of pixels. All unrelated to sigma and the size of your blur kernel.

</comment><comment><USER11> Another opportunity for efficient blur would be to rescale the image if the blur radius is above a certain amount. This incurs overhead, so for smaller radii it might be more efficient to just blur the full-size image, but for larger radii you can first reduce the image, blur with a smaller radius, and then upscale the image.

You might need an Arbitrary Hack Constant (oh, sorry, "tuning parameter") to decide when to make that transition.

<comment><USER12> That's already in the article:

> _Instead of filtering the image in its native resolution, I used OpenGL 's > native support for linear interpolation to downsample the source image by 4X > in width and height, blurred that downsampled image, then linearly upsampled > via OpenGL afterward._

<comment><USER11> Indeed it is, my bad for not RTFM

</comment></comment></comment><comment><USER13> Are there other blurs that are cheaper than the Gaussian but look good enough to replace it for this sort of purpose?

<comment><USER8> I've used a triangular ("conical"?) kernel when in a hurry and it looked reasonable. Vastly better than a box blur, at least. They're actually not separable but one can pretend and just do horizontal and vertical passes without much damage.

Amusingly Autodesk ship a GLSL shader with Flame which uses a triangular kernel under the hood but labels the button in the interface "Gaussian", the cheeky swines...

The nicest option to imitate lens blur is a circular kernel but that's quite aggressively non-separable. The other thing that really helps is blurring linear-light values instead of the usual gamma-encoded images. The blurs in Windows 7's Aero themes very clearly don't do this, to my eye - dark lines spread out too much and look generally muddy.

VFX guy who loves to blur things here :)

</comment></comment><comment><USER14> you can also downscale before blurring and upscale after blur. 4x without much noticeable difference in image quality. This gives a speed boost in two respects - less pixels and a smaller radius

<comment><USER4> This is already mentioned in the article.

</comment></comment><comment><USER15> You can do Gaussian filter in 2 passes: first along X, then along Y. Then you only grow linearly in size, rather than quadratically. This change should also improve your cache hits.

<comment><USER16> Mentioned in the article.</comment></comment>


Breakup Email: The Hail Mary in Your Sales Outreach - <AUTHOR> https://blog.klenty.com/breakup-email/ <comment><USER2> Anyone who does anything like what this post recommends should, and often will, get told to f' off.

For any HN readers: ignore this post and instead, go read about how to sell by demonstrating value. You don't need to - shouldn't - be annoying, let alone feel dirty, to thrive as a salesperson. Start with [https://blog.chaddickerson.com/2013/02/21/inside-sales- advic...](https://blog.chaddickerson.com/2013/02/21/inside-sales-advice/).</comment>


GPT-3: An AI that's eerily good at writing almost anything - <AUTHOR> https://arr.am/2020/07/09/gpt-3-an-ai-thats-eerily-good-at-writing-almost-anything/ <comment><USER2> The biggest problem we still have is that we're not able to teach a model to think creatively. What we have is like a clever parrot, but like a parrot it has no understanding of context or plotting or story just words repeated back.</comment>


PostgreSQL DBaaS vendor comparison and calculator - <AUTHOR> https://barnabas.me/articles/postgres-dbaas.html <comment><USER2> I recently used Digital Ocean managed PostgreSQL 11 and was pleasantly surprised. Having used Amazon RDS in the past, I found DO's offering to be simpler and faster to provision. I did have an issue whereby the password they showed for a newly created user (on the Web UI) didn't work and I had to reset the password to generate a new one, but otherwise it was pretty reliable. The documentation could do with some expansion (the cluster has some default roles that DO create but these don't seem to be documented anywhere) and it would be great to see wider extension support (I considered trialling pgaudit but it wasn't supported). Overall we were really pleased.

We're a small team without a dedicated DBA at this point, so outsourcing management of our database infrastructure was a no brainer. I was more keen on managed vanilla PostgreSQL than something like Aurora (where the implementation could stray enough from the origin that it would more difficult to migrate away should we have the need).

<comment><USER3> Really? The lock in boogeyman...

If you're using standard Postgres and reading the standard Postgres documentation, how would you even know about any Amazon extensions?

Does DO give you data storage across three availability zones? Point in time backups? Autoscaling synchronous read replicas?

<comment><USER2> I'm not sure if DO's offering has the feature parity you need, but it works really well for us, at our scale.

Having done many migrations between technologies over the years, I think it's prudent to have some level of skepticism when it comes to "forked but compatible" systems. I don't consider proprietary lock in to be a boogeyman. That's not to say all proprietary technologies are bad (they're not! We use them mix of proprietary and open tech) but having an escape hatch is one of our criteria for adopting closed tech. Especially cloud services where prices aren't fixed and are subject to future increase.

<comment><USER3> If you are interacting with the database using the standard Postgres drivers using the standard Postgres syntax why does it matter what's going on under the hood?

<comment><USER4> I don't know of a single non-trivial situation where you can ASSUME that 2 implementations of the same spec will behave exactly the same in all possible scenarios.

It's possible your error budget accounts for this potential difference, the parents error budget seems to have no room for the possibility of edge case bugs/divergence in the implementation of their database of choice.

<comment><USER3> They start with the same open source code. The main difference between Postgres and Aurora/Postgres is the storage engine and optional integration with AWS IAM, S3 extensions. If AWS didn't store the data in a way that was cross compatible with Postgres. There would be a major outcry. But he is using DO. I doubt that his requirements are that of a large enterprise.

I don't know of one large enterprise that you could go to and say we want to use Digital Ocean.

</comment></comment></comment></comment></comment></comment><comment><USER5> In my opinion, for DBaaS, number of cores, amount of RAM, and even I/O performance for the buck are secondary considerations. After all, for any non- hobby application, the data are significantly more valuable than the hosting costs.

I would be more interested in a comparison of security features, backup infrastructure, replication tooling, failover procedures, version upgrades, etc.

<comment><USER6> Definitely. I'd also look at pg version support (GCP is still on 9.6) and extension support.

</comment></comment><comment><USER7> Do these estimates account for some amount of I/O costs? For example with Heroku Postgres the instances use provisioned IOPS which is bundled into the cost, but if you're running on RDS your cost may vary considerably depending on actual usage or whether you provision the same amount of IOPS.

<comment><AUTHOR> The calculator doesn't factor in IOPS, and that's good to know, thanks. I just wanted a blunt tool to get a feel for these vendors' price points at least using the common denominators of memory, CPU, and storage. I could be wrong.

</comment></comment><comment><USER8> You might want to include www.elephantsql.com as well. They provide a level of support big cloud providers don't.

<comment><AUTHOR> Good suggestion, I'll work on it, thanks!

I'm trying to keep the comparison apples-to-apples, and I believe only their dedicated instances ($50 and up) provide the PostGIS extension. That's kind of a requirement for the projects I'm interested in, and it seems like a strange omission.

[https://www.elephantsql.com/docs/faq.html#postGIS](https://www.elephantsql.com/docs/faq.html#postGIS)

Edit: just added ElephantSQL, the update should be out in a few minutes.

</comment></comment><comment><USER9> Wanted to also mention aiven.io. We use them for a while now and we're very happy. Prompt and knowledgeable support and friendly service. They can deploy on pretty much any cloud and even migrate between them (I think).

Not affiliated in any way. Just a happy customer.

<comment><USER10> Aiven has been pretty cool for me to quickly set up clusters of things like Kafka or Postgres among others to do various tests with. I have really enjoyed them.

</comment></comment><comment><USER11> Do any of these services provide point-in-time backup recovery? It is very easy to implement with WAL archiving on my own deployment but I haven't found any hosted services who do it.

<comment><USER12> Google cloud has MySQL PITR [https://cloud.google.com/sql/docs/mysql/backup- recovery/rest...](https://cloud.google.com/sql/docs/mysql/backup- recovery/restoring#pitr)

Oddly seems missing from their PostgreSQL offering though, which is also several versions behind.

[https://issuetracker.google.com/issues/71565188#comment73](https://issuetracker.google.com/issues/71565188#comment73) mentions Aiven, which looks good to me..

<comment><USER13> I've been staying off Google's postgres offering for this reason; am I missing something about Postgres replication methods, or is this a massive hole in their offering?

</comment></comment></comment><comment><USER14> I find it interesting how the author mentions $200/month for a side project. Makes you think, everyone's side project budget is pretty different.

<comment><AUTHOR> For a hobby project that I wouldn't expect to monetize, $200 is too much, I totally agree. For a side project that makes some passive income however, I would hope to start out under $50 and scale up as needed.

</comment></comment><comment><USER15> Interesting post. But there other things to consider in addition to the price, like the supported versions of PostgreSQL, the supported PostgreSQL extensions, and service availability during automatic updates.

To illustrate my comment, I like the Google Cloud ecosystem, but Google Cloud SQL doesn't support PostgreSQL 10 and 11, and when using a single node, there is a downtime during automatic updates. DigitalOcean Managed Databases are more recent but, according to their documentation, these "issues" are solved.

<comment><USER16> Agreed. I really like a lot of the GCP experience, but Cloud SQL definitely feels like this service they just added and forgot about.

There are a lot of factors that impact how you select a cloud provider, but database offerings are always very high on the list.

Amazon clearly gets it. Digital Ocean became legitimate when they added one finally.

Google had other offerings in the DB space that are compelling but their PG offering needs a lot of work.

I was really hoping they would be the company that purchased Citus.

</comment></comment><comment><USER17> Moved all values to maximum and got exactly my current Hetzner configuration: 8 cores, 32 Gb RAM and 500 Gb storage. I have around 500 Gb of data, but real storage is about 3Tb.

Difference is that minimum price on DO is $480 per month. I pay 30 euros, and some more for backup storage.

<comment><USER18> Can you tell me something about how you manage backups or point me to any guides used for setting this up? I use the same Hetzner setup for some small side projects and my backup strategy here is just a daily pg_dump and archive on S3.

For larger projects I usually run Amazon RDS and don't worry too much about backups.

<comment><USER17> It is not very different from yours. Since all data can be easily redownloaded and processed again I really care only about code. Which is managed by Gitlab on a different machine and use internal Gitlab tool for backups.

</comment></comment></comment><comment><USER19> Vey interesting but again will the same amount of core and memory result in the same amount of transaction per seconds?

How can we easily know what is the optimal number of CPU core and Memory needed to achieve X Transaction per seconds ?

I know benefit of memory depend on cache hit rate, or how large is your working set. But assuming 100% cache hit rate how many core do you really need ?

<comment><USER20> Will the same amount of cores result in the same tps? No.

I gave a talk on this subject at PostgresConf NYC a couple weeks ago, my slides are here: [https://postgresconf.org/conferences/2019/program/proposals/...](https://postgresconf.org/conferences/2019/program/proposals/transactions- per-dollar-postgresql-in-virtual-and-bare-metal-clouds)

I'll follow up with a blog post in the near future.

</comment></comment><comment><USER21> IBM has a relatively new managed PG offering with mutually exclusive scaling of Disk and RAM. Neat feature to not have to rely on instance sizing, [https://cloud.ibm.com/catalog/services/databases-for- postgre...](https://cloud.ibm.com/catalog/services/databases-for-postgresql).

disclosure: I work @ IBM.

<comment><AUTHOR> Thanks Graphguy, I didn't know about that. I'll check it out. Finding out about other options was part of my motivation of putting this out in the world.

<comment><USER21> NP - I can submit a PR to your work tomorrow? Seems like a useful tool for surveying the growing PG-aaS space!

</comment></comment></comment><comment><USER22> Comparing AWS T type instances isn't necessarily a 1:1 with some of the other offerings which have dedicated CPUs

[https://aws.amazon.com/ec2/instance- types/t3/](https://aws.amazon.com/ec2/instance-types/t3/)

</comment><comment><USER23> Heroku's missing Standard 1 has always annoyed me, but it did save me the migration effort moving from Standard 0 to Standard 2 right away, instead of waiting a little longer before needing to upgrade yet again.

</comment><comment><USER24> With all of these offerings, I really hate that it's 2019 and I'm still having to choose cores and ram and storage.

I really just want a no-brainer solution that horizontally and vertically scales whenever needed.

<comment><AUTHOR> I wonder if Amazon Aurora is what you're looking for: [https://aws.amazon.com/rds/aurora/](https://aws.amazon.com/rds/aurora/)

Does anyone have any real world experience with this, in comparison to these more traditional DBaaS offerings? Not sure if it's a practical contender at a smaller scale.

<comment><USER3> Serverless Aurora is dirt cheap for low usage scenarios.

[https://aws.amazon.com/rds/aurora/serverless/](https://aws.amazon.com/rds/aurora/serverless/)

</comment></comment></comment><comment><USER25> Thanks for making this! I've got a PostGIS app that is starting to groan a bit with a Heroku Standard-0 database and I've been trying to weigh my options for next step.

</comment><comment><USER26> Strange bug: If I increase the Memory in the calculator to 2 GB, and then down to 1 Gb again, the AWS cost is stuck at $50.

<comment><USER27> Offtopic, but as someone who hasn't done a lot of JS recently, debugging something like this looks like a terrible job. I assume the non-sensible function/object names are the result of some kind of packer? Do modern JS folks have to recreate this sort of thing in a pre-packed environment to track it down more easily?

<comment><USER28> The author published all the content and code on gitlab, here is the logic for the pricing calculator: [https://gitlab.com/barnabas/barnabas.gitlab.io/blob/master/d...](https://gitlab.com/barnabas/barnabas.gitlab.io/blob/master/docs/.vuepress/components/DbaasCalculator.vue)

<comment><USER27> Ah, thanks. And the fix was: [https://gitlab.com/barnabas/barnabas.gitlab.io/commit/f7fede...](https://gitlab.com/barnabas/barnabas.gitlab.io/commit/f7fedea54a3be8046df8d7e753cfb7f69fc870b9#289a33df87be2b903369ee3b4c88a22d9fc4a920_121_138)

</comment></comment></comment></comment><comment><USER29> If you commit to RDS for 3 years you can go the server for 60% off which changes the math a lot.

<comment><AUTHOR> I totally agree. But, I wrestled with putting the AWS numbers at the 1-year commitment level when none of the other vendors have that requirement. In the end I decided that was the level of commitment I'd put toward a side-project.

<comment><USER30> I think 1 year is reasonable. AWS upgrades often enough that it makes sense to not lock yourself out of those performance increases.

</comment></comment></comment><comment><USER31> Why not just install PostgreSQL with apt on your server and use that?

Or if you need HA use Kubernetes and deploy the Stolon helm chart.

<comment><USER32> Because I don't know what a "stolon helm chart" is, other than possibly some kind of Norse relic, and in the amount of time it will take me to find out I can have an easily-scalable, reliable, secure database in place using something like RDS.

Sometimes—if you have the skill, knowledge, and resources—it will make sense to run your own HA database cluster, with a good backup system, automatic failover, and all the rest of the nice things you want. Other times, it would be more expensive and less reliable to set up and maintain that infrastructure versus a third-party service. There is no "one size fits all" solution to this sort of problem.

</comment></comment><comment><USER30> Why stop at 500GB storage?

<comment><USER33> Interesting also that for all providers except azure storage can only scale together with cpu/ram. Never understood why that is.

<comment><USER30> Are you talking about this tool, or the cloud providers? AWS RDS lets you pick storage size independent of the compute resources.

</comment></comment></comment><comment><USER34> What about MySQL?</comment>


Ask HN: What is the biggest struggle in your business right now? - <AUTHOR> <comment><USER2> Marketing is by far the biggest challenge for us. Also keeping up the morale, I wrote about it here: [https://news.ycombinator.com/item?id=17608421](https://news.ycombinator.com/item?id=17608421)

<comment><AUTHOR> I recollect quite a similar incident with a friend of mine who had high motivations but lack of willingness to pursue the product they started. I believe you either need to talk this out clearly and define milestones on what you expect him to do. If the milestones are complete in a given period of time, nothing like it. If he still doesn't put efforts to contribute, then I would recommend that it's time to have 'the talk' with him whether he would like to pursue this further, or not.</comment></comment>


Would Intel/AMD branded laptops be a good idea? - <AUTHOR> https://www.reddit.com/r/hardware/comments/42cnbq/would_intelamd_branded_laptops_be_a_good_idea/ <comment><AUTHOR> Notice I put a "high quality UEFI BIOS" in my wishlist.</comment>


DR70 – A dedicated machine for astrologers - <AUTHOR> https://plus.google.com/108984290462000253857/posts/PjnzSytQkWj <comment><USER2> There are also circuit diagrams for 'e-meters' ... presumably targeted at a similar crowd.

[http://www.cs.cmu.edu/~dst/E-Meter/](http://www.cs.cmu.edu/~dst/E-Meter/)

<comment><USER3> Haha, these kind of quack science devices really annoy me.

Looking on eBay, there's some e-meters for £300. I'm sure a £3 multimeter would do a better job of measuring resistance ;)

I'm really curious as to whether the people that produce/sell these things, know they're crap, or whether they believe they work.

In a slightly similar vein - [https://www.theguardian.com/commentisfree/2009/nov/14/bad- sc...](https://www.theguardian.com/commentisfree/2009/nov/14/bad-science-iraq- ben-goldacre)

(A bomb detector, which is basically a glorified dowsing rod)

</comment></comment><comment><USER4> There's a very good star-chart program that's been around for many years, called Astrolog [0].

Although it's obviously intended for astrologers, you don't have to believe in astrology to find it useful. Maybe you just want to know whether that bright light near the moon is Venus or Jupiter, or when is the next time Mars will be easily visible.

[0] [http://www.astrolog.org/astrolog.htm](http://www.astrolog.org/astrolog.htm)

</comment><comment><USER5> I was always a bit puzzled by the ubiquity of astrology and other superstition in old scifi (PKD, Heinlein to name a few), but I guess if even Reagan used things like this that explains where the trope came from.

<comment><USER6> There was in the US, in about the early 80's I think, a sort of mass abandonment of telekinesis/ESP/astrology/ghosts...all sorts of stuff.

Part of it may have come from the same rise in evangelical political engagement as the Republican party weaponized them, definitely some of it was a push back against the perceived failure of Hippy culture.

</comment></comment><comment><USER7> Very curious find! I wonder what sort of calculations it's doing. Anything that would be useful to an astronomer? Or just weird bunko? Are the calculations deterministic?

There's a great book called _Practical Astronomy with your Calculator_ ; I wonder what the astrological analog would be.

<comment><USER8> Since Astrology is bunk, it might be interesting just to see what they're doing/claiming with this.

It's very unlikely astrologers have created or added anything that's useful or applicable to astronomy. It's more likely that they've taking things astronomers have discovered and used and worked that into their quackery to make slicker quackery.

<comment><USER9> Astronomy now is a science, but historically there wasn't any distinction and much astronometry (measurements of the sky) was done to increase the accuracy of the predictions.

It could well be they are doing epicycles caculations to determine stellar positions etc

<comment><USER10> Right: Astronomy is astrology which advanced beyond the pre-scientific mindset, and made progress, as opposed to stagnating. We can see similar progressions in the medical world, and we can see that one thing holds true: The scientific version of the field became useful to society as a whole, whereas the non-scientific one remains only useful to the practitioners, and then only to the extent they charge for their services.

</comment></comment></comment></comment><comment><USER11> Nice to know the (ex-) leader of the most powerful military machine and protagonist in the cold war used this to make 'better' decisions.

<comment><USER12> I once was hired on basis of my "Uranus in Mercury"... I declined instantly. But it's a job, I can not imagine living under astrology based decision making government, that's nightmare realization

</comment></comment><comment><USER13> > This is the same Digicomp which made two mechanical "computer" models, or > toys

I doubt it is the same company. Those toys were made by E.S.R., Inc., whereas the DR70 is by Digicomp Research Corporation, which apparently still exists. A cursory search didn't reveal any connection between the companies.

</comment><comment><USER14> I wonder which key switches it uses.

<comment><USER15> Microswitch, no doubt, from the looks of it. The best key mechanisms ever made. (Think MIT AI/LISPM keyboards.)</comment></comment>


Kiwi IRC gets sponsored by PrivateInternetAccess - <AUTHOR> https://kiwiirc.com/blog/Kiwi_IRC_gets_sponsored_by_PrivateInternetAccess <comment><USER2> This is good to see, PIA has been sponsoring lots of good things lately.</comment>


Signal issue: "Request for contacts uses creepy wording" - <AUTHOR> https://github.com/WhisperSystems/Signal-iOS/issues/1354 <comment><USER2> I installed it, and without consenting to sending any notifications or whatever, I started getting Signal messages from long-forgotten people who apparently had ME in THEIR contacts. It apparently notified THEM that I had installed Signal, which I absolutely did not want.

This included a few folks who I wish to distance myself from in every way possible, and have deleted from my contacts. Apparently they still had me in theirs. This also included a few folks who I keep in my contacts only so I'll recognize the number if it rings and know not to answer. Obviously the last thing I want is to remind these people that this I still exist and this is my current number.

The worst part was, for the ones who weren't in my contacts, I had to ask the stranger "Umm, forgive me for asking, but who is this?" in order to ascertain that, nope, I really didn't want to interact with them.

Shit shit shit shit.

Uninstalled it very quickly.

<comment><USER3> Wow, you'd think something like that would be opt-in, especially since Signal's entire selling point is privacy and security. :/

That's a critical failure in my book.

</comment></comment><comment><USER4> Isn't this wording just a misunderstanding on the users' behalf? You download a messaging app, you want to message your friends, and it needs access to your contacts. I don't see this as being suspicious. In other apps such as a music player or photo viewer it may be suspicious, but a messaging app has a clear need to know who you can connect with, and I think Whisper Systems saying "We do not store your contacts..." should at least give them the benefit of the doubt (if that's not enough, you can always read the source or speak to Moxie yourself).

Seems like much ado about nothing.

<comment><USER5> Why does it need access to contacts? You say that like its fait accompli, like its literally impossible to have a messaging app that doesn't access your contacts.

<comment><USER6> Moxie has written "people [...] expect contact discovery to be automatic in their social apps." The only way for it to be automatic is to access your contacts.

This app is designed for those people, not "cryptonerds" (his word), and this is one of the concessions made to provide that ease of use.

<comment><USER5> Ah, because they want more customers. Got it.

</comment></comment></comment></comment><comment><USER7> I'm all for privacy and security, and I find our current situation a nightmare, but I uninstalled Signal just a few minutes after installing it for the first time. I just knew it's not going to be popular (I'm talking messaging app scale). If I know that my family, co-workers and friends would never use it then it's already dead to me.

Two reasons that killed it for me (Android):

\- It required so many permissions that I had to scroll down (old permissions api?)

\- First app interaction was a blank screen and no straightforward way to find my contact list or quickly send messages. Like 90% of the people I know would uninstall it on the spot after that blank screen. They don't want to feel dumb and they are "too busy to read a tutorial". I also couldn't find a single soul using it.

</comment><comment><USER8> I don't use signal because there's no real benefit if others don't use it... No one I know cares and I don't particularly care... Not like I text anything important.

</comment><comment><AUTHOR> Has anyone here installed Signal and NOT seen that popup?

<comment><USER9> Absolutely.

I'm on Android.</comment></comment>


Auth0 raises $103M, pushing its valuation over $1B - <AUTHOR> https://techcrunch.com/2019/05/20/auth0-billion-dollar-unicorn/ <comment><USER2> Interesting.. anyone have experience using Auth0 and have thoughts to share on it?</comment>