BadUSB – On accessories that turn evil [pdf] - <AUTHOR> https://srlabs.de/blog/wp-content/uploads/2014/07/SRLabs-BadUSB-BlackHat-v1.pdf

<comment><USER2> I think the "no effective defense" slide (#20) is kind of disappointing. Their whole talk, for me, circles around the "someone plugs in a USB device with surprising functionality" narrative... And there are two possible things that can go on. First, the device could try to exploit flaws in parsing of USB descriptors. This is how the PS2, I think, was sucessfully rooted/unlocked/made-linux-run-on-it.

But the talk linked to mainly focuses on the second possibility: "the OS automatically loads the driver for keyboards and network adapterse", and this is trivially defended against, at least on Linux. I assume you can do similar/identical things on other operating systems (e.g. Windows probably has a registry key for that, because it always has registry keys for everything...)

            # echo 0 >/sys/bus/usb/drivers_autoprobe

Now, no drivers are bound to USB devices automatically. Just try it. I plugged in peripherals into the computer, the only thing you'll get (running 3.15.8-1-ARCH, archlinux x64) is the following text in the dmesg:

            [ 6765.949361] usb 5-1: new low-speed USB device number 3 using uhci_hcd  **mouse**
            [ 6846.469357] usb 6-1: new high-speed USB device number 3 using ehci-pci **harddisk**
            [ 7062.616021] usb 7-4.4: new high-speed USB device number 7 using ehci-pci **eth/network**

Now, if I am convinced that one of the devices hasn't been tampered with, I'll run the following command, that triggers automatic probing for a single USB device (1.0 is configuration 1, function 0, I think...)

            # echo 7-4.4:1.0 >/sys/bus/usb/drivers_probe

dmesg shows....

            [ 7193.076584] ax88179_178a 7-4.4:1.0 eth0: register 'ax88179_178a' at usb-0000:00:1d.7-4.4, ASIX AX88179 USB 3.0 Gigabit Ethernet, 00:0a:cd:22:b4:40
            [ 7193.099754] systemd-udevd[10470]: renamed network interface eth0 to enp0s29f7u4u4

But if I only want to allow USB storage devices, I can manually bind to the usb storage driver.

           # modprobe usb-storage # was not loaded on my machine, yet...
           # echo 1 >/sys/bus/usb/devices/6-1/bConfigurationValue  # enable 1st configuration
           # echo 6-1:1.0 >/sys/bus/usb/drivers/usb-storage/bind

dmesg, again...

           [ 7583.801824] usbcore: registered new interface driver usb-storage
           [ 7729.898188] usb-storage 6-1:1.0: USB Mass Storage device detected
           [ 7729.898404] scsi6 : usb-storage 6-1:1.0
           [ 7730.900552] scsi 6:0:0:0: Direct-Access     TOSHIBA  MK4309MAT        G5.0 PQ: 0 ANSI: 0 CCS
           [ 7730.904913] sd 6:0:0:0: [sdd] 8452080 512-byte logical blocks: (4.32 GB/4.02 GiB)

Now, this of course is completely ridiculous, from a user-interface perspective, but, I think if you only want to cover mounting of USB sticks, you can script this in shell/perl/python/awk, using "lsusb -v" for parsing the binary USB descriptors and only start usb-storage on USB sticks.

 _EDIT_ / _ADDED_ : -----

And also note: The mechanism described above concerns the binding of drivers to devices. There's a different facility in place to make USB devices inaccessible to the drivers/the user, and that's using the "authorized" flags: You set the "autorized_default" flag in /sys/bus/usb/devices/usb<N> to 0, then every device that is connected to the machine is initially disabled:

           [ 9162.809251] usb 7-4.4: new high-speed USB device number 11 using ehci-pci
           [ 9162.912337] usb 7-4.4: Device is not authorized for usage

If you are sure that this particular device is allowed to connect, authorize it...

           # echo 1 >/sys/bus/usb/devices/7-4.4/authorized

           [ 9214.302656] ax88179_178a 7-4.4:1.0 eth0: register 'ax88179_178a' at usb-0000:00:1d.7-4.4, ASIX AX88179 USB 3.0 Gigabit Ethernet, 00:0a:cd:22:b4:40
           [ 9214.302678] usb 7-4.4: authorized to connect
           [ 9214.326028] systemd-udevd[10771]: renamed network interface eth0 to enp0s29f7u4u4

That way, you could have the publicly accessible USB connectors (say... usb2 and usb4) in "autorized_default=0" mode, and the internal USB connectors, or the ones on the back of a device that is somewhat physically secured set to "autorized_default=1" to not impede usage and comfort... But, of course, if you have scripts in place implementing a "USB ACL", that doesn't really sound as if it's worth the added complexity?

<comment><USER3> USB devices that can attack the host computer have been known for some time, and are not the point of the talk. The demonstration methods of attack that use them are only examples. This threat is about the other direction, where the (compromised) kernel attacks the USB devices firmware.

Nothing the kernel can do defends against the BIOS trusting the mass storage device and booting from it (possibly with an extra HID to press F2 or F12 or whatever to enable the correct boot order), which was covered in the talk.

Also, there's nothing the kernel can do to detect a device that is modifying the data during some of the reads, which was also discussed.

More importantly, it doesn't matter what a handful of technical people do to try and defend their own computers: there is currently a _very_ large set of users that are currently wildly vulnerable running Windows or stock-and- never/rarely-updated Ubuntu. These people like to use their devices in the manner in which they were intended to be used. This has the potential to spread malicious firmware very quickly.

The main vulnerability this talk was trying to demonstrate was not that the USB port on a traditional computer has poor defenses; they are showing that USB devices are easily re-flashable; _any_ USB hardware could _become_ infected, closing the loop.

This possibility of recursive infection over sneakernet suggests that _normal, non-technical people_ need to learn to not trust any kind of shared USB until new devices with unchangeable firmaware can be made.

<comment><USER2> I agree that the current default config in popular operating systems (I.e. what normal non technical people use) is insecure and needs to be fixed. It's just that the defense, in my opinion, is not difficult at all.

The main attack vector given by the talk is: device with an additional, unexpected, function. That's the USB stick emulating a keyboard, or the smartphone presenting a network device (which, by the way are functions legitimately found on real hardware).

And the only defense against this is a stricter policy on what a computer will talk to, which again technically is binding of drivers. This defense can be implemented rather trivially.

The fact that a malicious payload itself reflashes the target is really a very nice hack, and I don't want to belittle this in any way... But in the end, considering the huge amount of updates everybody installs all the time, it's not surprising at all. I have several devices that reflash the connected device to match an updated driver... Of course we are not used to USB sticks doing that, yet.

The BIOS is a different problem, and I have no easy solution for that. But in my opinion it's not as important, because in the normal use case (of the non technical user) an OS is running. (And in fact, e.g. on some cromebooks, the keyboard isn't even looked at to boot faster if a special button isn't pressed... So this could be a solution.).

A harddisk/stick tinkering with returned data is indeed one of the more interesting things, and has been used to root some devices that first verify a file, then read it again to execute it... But that deserves a completely different defense and itself isn't the topic of this discussion.

</comment></comment></comment><comment><USER4> To some extent, this feels like the old "if you have physical access…"¹ rule.

It is good to see more awareness of the fact that USB devices can be quite arbitrary things. I remember trying (hard) to convince people that a cell phone was a computer years ago. It's basically the same thing: a USB device can certainly house a computer, for some definition of that.

It would seem that page 11's attack would require that the machine is unlocked and just sitting there. If not, how would it install the keylogger? (It'd be at the password screen, and input would go there.) Otherwise, this is simply a shortcut to install a keylogger and capture sudo. (Which again brings us back to "physical access".)

Page 13: Are there really that many distros that just DHCP any interface? Gentoo (at least mine, I suppose? it is configured by the user, but I thought I chose the defaults here?) doesn't?

Page 17: are there boot orders that put USB first? I feel like HDD is almost always first, given the number of times I need to beg for a prompt in BIOSes, but again, maybe just me?

However, if anything, the above does show how much of a minefield this is…

¹then it's really hard to be secure.

<comment><USER5> > To some extent, this feels like the old "if you have physical access…"¹ > rule.

Do you completely trust the manufacturer, previous owners and every person that ever had opportunity to touch any of your USB devices for more than a couple seconds? (Including before you purchased them)

> It would seem that page 11's attack would require that the machine is > unlocked ...

No, many Linux distributions have a daemon that will auto mount USB mass storage devices.

<comment><USER6> ...but how will it install the keylogger then? The USB device can do that if it's a keyboard, but not if it's a mass storage device.

<comment><USER2> ...keep in mind that a USB device can be both, or more...

<comment><USER4> > ...keep in mind that a USB device can be both, or more...

Fine: let's assume the device can fake being both, or more (which it can), and that my machine will automount any USB mass storage device. (I actually think this is accurate.)

So it automounts the USB mass storage device somewhere… and then what? The machine is still locked, and I presume it would need to run something off that mass storage device to do any real harm, but how would it accomplish that?

</comment></comment></comment></comment></comment><comment><USER7> The Video is also up on Youtube and adds quite a bit to the slides including some good demos

[https://www.youtube.com/watch?v=nuruzFqMgIw&list=UUJ6q9Ie29a...](https://www.youtube.com/watch?v=nuruzFqMgIw&list=UUJ6q9Ie29ajGqKApbLqfBOg)

</comment><comment><USER8> Once you can install arbitrary programs on a device (or a single program, the firmware) you should treat these devices with a general mistrust.

The main problem here that you can't use your usb devices at public places safely, since they can patch your usb device's firmware at will. The problem here that you use your trusted usb device on a not-trusted computer which can do anything it wants with your device's firmware. There should be an approval mechanism directly, physically on the device to prevent this.

For example on usb thumb drives there could be a switch on the device which turns it to "firmware upgrade mode".

<comment><USER9> there are ide/sata/usb write blockers, but they would need to be modified to filter specific custom SCSI commands used for firmware update.

Best defence for this kind of attack is running your own firmware on all USB devices :)

</comment></comment><comment><USER10> Really the key thing to focus in here, IMO, is the fact that arbitrary USB hardware firmware can be overwritten - anything taking place after complete control of the USB hardware has already been exploited and well documented; for example the teensy device and the usb rubber ducky.

</comment><comment><USER11> I can think of 2 solutions to this issue offhand.

\- Accept general input from a keyboard or mouse only after the user's password has been entered into a confirmation window. (Even just a yes/no would work here.) \- Change all key shortcuts and menus that can execute things (WinKey+R, Alt+F2, etc.) to something nonstandard. You could also remove them altogether or prompt for a password if afraid of a targeted attack.

The question then becomes this: Are there other attacks that can use USB to execute code beside mimicking input devices?

</comment><comment><USER12> This remainds me of sd card hacking: [https://www.youtube.com/watch?v=CPEzLNh5YIo](https://www.youtube.com/watch?v=CPEzLNh5YIo)

</comment><comment><USER13> arstechnica article on it: [http://arstechnica.com/security/2014/07/this- thumbdrive-hack...](http://arstechnica.com/security/2014/07/this-thumbdrive- hacks-computers-badusb-exploit-makes-devices-turn-evil/)

</comment><comment><USER14> Sorry for the silly question, but the slides seemed to indicate that any USB keyboard can read any other keyboard's keystrokes? Is that a correct understanding? Otherwise, I don't see how they can steal passwords. Am I just missing something obvious?

<comment><USER15> Their evil keyboard runs commands to install malware which capture your password when later entered on the good keyboard. i.e. Their keyboard types "install keylogger".

</comment></comment><comment><USER16> Here is the speculative discussion from one week ago based on the summary of the talk before it was given at BlackHat today:

[https://news.ycombinator.com/item?id=8112942](https://news.ycombinator.com/item?id=8112942)</comment>


Why hasn't TeXmacs completely replaced TeX/LaTeX by now? - <AUTHOR> <comment><USER2> Why haven't apples completely replaced oranges by now?

<comment><AUTHOR> Please elaborate. TeXmacs is good enough for writing scientific papers and books. So why are people still using TeX/LaTeX?

Most people now use WYSIWYG word processors for business. So why won't scientists & mathematicians use WYSIWYG scientific word processors such as TeXmacs?

<comment><USER2> LaTeX is good enough for writing scientific papers and books. So why should people switch to TeXmacs?

<comment><AUTHOR> Try TeXmacs and it will be obvious why.

<comment><USER3> I did, and I'm impressed. All I have to do is switch to a new editor for document editing, learn new keybindings and mouse actions, port all my editor customizations to Scheme, convert my .tex files to .tm files (a lossy process, both empirically and by texmacs' own FAQ), give up on being able to answer my questions with google or Leslie's or Don's excellent books, and give up on being able to edit my documents over ssh. The WYSIWYG productivity gain is sure to be huge, and more than make up for it. I'm waiting (tries it...) 0.422 seconds for tetex to run, every time I want to see what my document looks like, which is really slowing down my work. Sold!

</comment></comment></comment></comment></comment><comment><USER4> I was using LyX for homework. To be honest I didn't even know about TeXmacs. So maybe the problem is marketing? _laughs_

Is there a decent LyX TeXmacs comparison? My Google-fu is failing me.

<comment><AUTHOR> TeXmacs has its own real-time typesetter. So what you see while editing is exactly what gets printed.

LyX just has a rough approximation for editing to make it less painful and uses LaTeX/TeX to generate the output.

For scientific publications, you may be required to use TeX, so LyX might be preferable there.

For homework, there's no reason why you can't use TeXmacs.

<comment><USER4> Wow. That sounds much better.

I wonder about the underlying technology. I've been longing for an editor that could handle special characters so things looked more like math.

<comment><AUTHOR> TeXmacs is an incredible achievement. It's probably one of the most sophisticated open source programs ever written. Its main author is a genius.

<comment><USER4> ...sudo apt-get...

<comment><USER4> Wow. It's really nice. I've noticed that they've decided to make their own decisions as to the menu structure, so there is a bit of a learning curve. But it's so beautiful!

I've formatted the YC application we have, and put it in here. It looks really professional. That's quite an achievement, given the conversational language we used. ^^

I then sent the whole thing around as a .tm file, so now the rest of the team has no choice. Viral technology yay!</comment></comment></comment></comment></comment></comment>


Two years with Emacs as a CEO (and now CTO) - <AUTHOR> https://blog.fugue.co/2018-08-09-two-years-with-emacs-as-a-cto.html <comment><USER2> Some excellent points made about control and productivity whether you're an emacs user or not.</comment>


Programming Languages for Beginners - <AUTHOR> https://medium.com/@janjilecek/5-programming-languages-for-beginners-cbc97a63e567 <comment><USER2> > GO strengths lie in its ..... expressive power.

Am I misunderstanding what people mean by expressive? I would say Go is one of the least expressive languages out there.</comment>


Calm down trendspotters – 'lagom' is not the new hygge (2017) - <AUTHOR> https://www.theguardian.com/commentisfree/2017/feb/06/lagom-sweden-hygge-lifestyle-trends <comment><USER2> My mother in law's Swedish cookbook helpfully includes adding a "lagom" of nutmeg. Really?</comment>


The Secret Lives of NYC Mega-Projects - <AUTHOR> http://gizmodo.com/the-photographer-who-documents-the-secret-life-of-nyc-m-1697968505 <comment><USER2> I recently spoke to a few people who have worked on these large scale municipal projects. We think we have a hard time managing active software projects. These projects have change orders alone worth well into the 10s of millions. There are so many moving parts, literally, that it is a miracle they get completed at all.

I don't find the choice of photos particularly inspiring, from an artistic sense, but it is nice to have a peak into that world.

</comment><comment><USER3> These projects are amazing. Seeing the work that goes into just a single subway line makes it absolutely mind blowing to me that China has managed to build entire metropolises, complete with subway systems, in well under a decade. These photos are absolutely fantastic, and I'm happy to have had the opportunity to see some of what goes into this kind of work.</comment>


New York is proposing the creation of a 'public Venmo' - <AUTHOR> https://www.vice.com/en_us/article/pked9v/new-york-is-proposing-the-creation-of-a-public-venmo <comment><USER2> The piecemeal attempts to create a rational payments system are getting to the point where the Fed just needs to acknowledge the need for a free/secure/unified infrastructure run and regulated by the government. They are starting to do this (Fed real time payment + settlement system) but not fast enough.

Other countries laugh at us when we talk about the checks we have to write, the scams we endure with mistaken payments / withdrawals without our knowledge, or the fees we accept banks charging us.

We would never choose to have the system we currently do. We need to get over the interests / lazy inertia holding us back.

<comment><USER3> > Other countries laugh at us when we talk about the checks we have to write,

Checks are increasingly rare in the US as well. Ask someone under the age of 25 how often they write a physical check to someone who _isn 't_ their landlord. (And even many landlords are starting to accept other forms of payment these days).

Personally, I don't think I've written a physical check in at least five years, except to my superintendent (holiday gift - I don't want to send cash by mail, and it's the one time that a physical check is actually the most convenient way to pay someone).

> the scams we endure with mistaken payments / withdrawals without our > knowledge

SEPA, which is what is used in Europe, is actually vulnerable to mistaken payments and similar scams as well. It's _faster_ than ACH, but it's just as easy to send money to the wrong recipient (and just as difficult to rectify if that happens).

<comment><USER2> Well, at least it's _your_ mistake that you make. (I agree that some better checksum or verification before you press "send" might be good).

In the US, people can withdraw from your bank account if they have the numbers. And it's on you to detect and report the fraud to get it reversed.

</comment></comment></comment><comment><USER4> > "Why should we have to pay to use a payment system? It's like paying to use > a street," Hockett asked at a press conference announcing the proposal.

I'm probably ambivalent about a "public" banking system, but this comment seems to ignore that we quite literally do pay for using streets in the form of taxes (indirect) and tolls (direct).

<comment><USER5> Don't we pay for streets though, indirectly through municipal taxes or what not ?

<comment><USER4> That is exactly what my comment stated.

</comment></comment></comment><comment><USER6> India UPI was proposed and implemented by the Central Bank and provides a fantastic example of a low-to-zero cost option of intra-bank money transfer which is bank and vendor neutral. Google recently recommended the model to the Fed[1].

However, what NYS is proposing is distinct from an open payment system. This is a closed parallel system of exchange which serves as both a bank account and a payment system. I don't get how this will be better than providing low- cost bank accounts to the unbanked and then providing an easy payment system on top.

Or perhaps requiring banks in NYS to provide free accounts to those whose income is below a certain threshold. Certainly another way to bell the cat rather than creating an alt-currency and a ledger.

[1] [https://www.bloombergquint.com/business/can-indias-upi- becom...](https://www.bloombergquint.com/business/can-indias-upi-become-a- global-model-google-thinks-so)

(edits: grammar)

<comment><USER7> Correction: It is run by NPCI (National Payment Corporation of India) which is a multi-bank private non-profit body that is authorised by the central bank (RBI) to run a payments system.

Additionally, the central bank already runs a vendor neutral bank account transfer infrastructure called NEFT which recently became 24x7. UPI just happened to be mobile first and we had enough underlying infra to support such a thing.

</comment></comment><comment><USER8> If this turns into an open-source and independent application/enterprise then it could be quite interesting and maybe even good. Unfortunately, I'm fully expecting the end result (if this proposal even goes anywhere) to be a heap of state-run opacity. There's no way I trust the State of New York with my money.

<comment><USER9> I think the more likely scenario is that NY would contract the transactional system out to some company, and force banks to setup special account types that interact with the system, and pay licensing fees for using it. And setup a clearing house to enable end users to get accounts from the participating banks.

And "force" is more hyperbole. It goes without saying that the banks will not pass up the an opportunity to add a significant amount of cash to their reserves, and will lobby heavily for it.

</comment></comment><comment><USER10> Canada's interbank network Interac has allowed for "Interac eTransfers". It's run as a for-profit, but since it's a consortium backed by banks in Canada, most banks don't charge for eTransfers.

Among my friends, it's the way to pay for _e.g._ your share of the take-out, or pooled office gifts.

<comment><USER11> Similar things exist for banks in the US. For example, Zelle is a product created by a company owned by a number of US banks that is integrated into those banks' apps as well as most other banking apps (my smallish credit union uses Zelle). I tend to use Venmo still because more of my friends have it and I think most people in the US will stick with Venmo unless the barrier of entry for a new system is negligible.

</comment></comment><comment><USER12> This is aimed at solving one of several problems people without bank accounts have. So let's just figure out why people don't have bank accounts and account for that:

> People who are unbanked often cite distrust of the banking system, lack of > access to government-issued ID, or inability to maintain a minimum balance > as reasons they don't have bank accounts.

Seems easy enough to me. Make government-issued IDs free, make account minimums illegal for FDIC insured banks, and if you don't trust banks, you have nobody to blame but yourself (plus, if you don't trust banks, why would you trust gvmt-venmo?). These fixes would also address a lot of other problems (voter ID issues, other negatives of not having a bank account)

<comment><USER13> > if you don't trust banks, you have nobody to blame but yourself

Well, the banks made a pretty good case for why they can't be trusted in 2008.

That doesn't mean I don't use a bank. It's just not practical to go without one, and I trust the government-backed insurance of my funds for when the bank fails, but I don't trust the banks themselves one single bit.

<comment><USER14> Even with deposit insurance, if there's a run on your bank you want the money out ASAP, because the money is only useful to you if you can reasonably access it, and waiting a few days or weeks for a check in the mail can make or break people living paycheck to paycheck.

<comment><USER13> Yes, you're absolutely right, that's why I have split my money over two banks. Hopefully they won't fail at the same time.

</comment></comment></comment></comment><comment><USER15> There is already an open source payment system which needs a bit fine-tuning so it can scale to payments. No government, serves all unbanked. Solves the same problem. You know the name.

<comment><USER16> No payment system will ever succeed unless someone can use it to purchase something from an unknown person, receive their good or service, be dissatisfied with the good or service, return the good or service, and then be assured of a refund from an unknown and untrusted actor.

Even with cash, in the vast majority of cases you physically hand over the cash to someone you can see at a location you can return to. In the event of a transaction for physical goods at least you have the good in hand, and in the event of services thanks to government regulations most expensive services require licenses so you can later find the person who failed to perform the service you paid for in cash to your satisfaction. Also, one can create an actual, literal, "paper trail" by requesting a physical receipt-- one that serves as evidence of the exchange and would ideally contain contact information.

With your un-named payment system, can I do a "charge back" if I order some totally legit good or service from an unknown actor in an unknown location in the event of the non-delivery or fraud?

Also, no payment system that requires an internet-connected device (and a powerful one at that if no third parties with the ability to store and process large amounts of transaction data are involved) will ever, ever, despite the protestations of its acolytes, between now and the heat death of the universe, ever be able to serve the unbanked.

That why with the IVL part of the proposal is a physical card that can be used, if a patron is poor and unbanked and does not have an internet-connected device, to transact with the ledger via a trusted intermediary.

<comment><USER8> > return the good or service, and then be assured of a refund from an unknown > and untrusted actor

Escrow systems are inherently a second layer atop a currency. The "issuing authority" of a currency does not engage in such dealings with the users of the currency; these arrangements are made by the seller (or a palatable third party on the seller's behalf) or by the buyer (or a third party contracted by the seller, e.g. a credit card company).

With the "un-named payment system", escrow is entirely possible and has been successfully set up in many instances, most notably on popular darknet markets. A type of protocol-layer escrow is also possible, by the way, through the use of multi-signature transactions.

> payment system that requires an internet-connected device

This is _exactly_ what the OP article is proposing to build, and what these comments are discussing.

> no third parties with the ability to store and process

SPV and other "light" wallets that remain cryptographically verifiable and decentralized without needing a constant, high-bandwidth connection exist and are, in fact, the default option for most people.

<comment><USER16> >This is exactly what the OP article is proposing to build, and what these comments are discussing.

If you read the white paper, which apparently nobody else did, they say (paraphrased) "Look, this thing is online but we recognize that not everyone has a computer or cellphone so part of the system is a physical card like a debit card that poor people can use".

</comment></comment></comment></comment><comment><USER17> Are government run digital payment systems a cyber-security nightmare?

</comment><comment><USER18> >"public Venmo"

Europe figured this out years ago; it's called a SEPA transfer.

</comment><comment><USER19> Generally seems like a good idea, minus the part about it being state owned and operated. If it's operated by the state, it will probably be a disaster. Many governments can barely keep their Windows machines up to date, leading to ransomware attacks. It would be a shame if people's money were held hostage for ransom.

<comment><USER20> I love how we say this with a straight face and ignore the fact that the best hackers _anywhere_ are mostly currently or formerly employed/trained by the government: NSA, FBI, same with Israeli hackers trained by the IDF, Russian and Chinese hackers, pretty much everyone is a current or former state actor.

So yeah I'd trust NSA lending its talent to securing our payments infrastructure over some of the people that were in that Google thread that got paid 300k to do hardly any work in years. But this is a false dichotomy.

<comment><USER21> I somehow doubt the NSA would be the ones building it. It would probably be farmed out by the govt like the ACA website.

I agree it would be terrible if the govt ran it, but would make sense is for the govt to actually plan it and put regulations around it. Provide a framework for private companies to work off of.

<comment><USER20> That's why I said lending their talents. The NSA and FBI would definitely consult on something that big.

Actually they'd do it regardless of whether it was built by the public or private sector.

I'm in the DC area – so I know exactly how bloated and utterly incompetent most defense contractors are (I worked for a couple). So I have nearly zero faith in them doing a better job.

</comment></comment></comment></comment><comment><USER22> What about Venmo for beggars. Cities in the UK have foreign beggars camped outside every grocery store near the city centres. Locals do not know what to make of this. Are they desperately poor, or part of a scam to exploit people's generosity? Do they make £10 per day or £200? What can the authorities do if there's no law against it?

If there was a sort of begging venmo app where you could donate money, but it only worked up to a certain limit each day, then at least you'd know the public was not being exploited by professional beggars, and genuine beggars would see a bigger share of the public's generosity.

It could even go further and show what the money gets spent on (in aggregate), so we could definitively answer debates like whether beggars spend all their money on drugs/alcohol.

<comment><USER23> Or we could implement a basic standard of living where we don't have to have beggars.

<comment><USER22> How?</comment></comment></comment>


Rosetta Stone for Unix - <AUTHOR> http://bhami.com/rosetta.html <comment><USER2> as someone who worked in an hpux and solaris (and a little AIX) shop, writing code with a fair number of system calls on these systems, brings back memories and not good ones.

Subtle differences in the way everything was done. slight difference like: the max size of a udp packet was slightly smaller on hpux (or was it solaris) such that things would break in unexpected ways. The gzip or tar params where all slightly off... You got used to it but it was a pain.

This reminds me why linux was ascendant. I'm not sure its better but much more consistent.

<comment><USER3> The _gzip_ parameters should be identical, since all implementations are the GNU one. The _compress_ program, on the other hand…

EDIT: My information was obsolete – apparently some BSD's reimplemented gzip. I stand corrected.

<comment><USER4> The BSDs have their own gzip. I know this because it rejected some files that were fine according to the official version...

</comment></comment></comment><comment><USER5> I'd like to see an updated subset with rhel/ubuntu/debian and systemd.

<comment><USER6> Seconded.

</comment></comment><comment><USER7> "unique id useful for licensing" => Linux "/sbin/ifconfig eth0"

Really?

<comment><USER8> This sort of thing can lead to ridiculous problems.

MATLAB R2013b on Mac OS tried to do something similar. However, it sometimes decided that my hostid was the MAC address of my Ethernet interface, and sometimes my wireless interface (in which case it would reject the license). In the end I resorted to obtaining two license files and manually switching them when necessary.

</comment></comment><comment><USER9> This has been enormously useful, and inspired me to create one for performance metrics (from the USE method): [http://www.brendangregg.com/USEmethod/use- rosetta.html](http://www.brendangregg.com/USEmethod/use-rosetta.html)

</comment><comment><USER10> Some parts may be a bit out of date. I mean, I do still have a box with ReiserFS on it, so I guess it's OK that's included, but ext4 is left out...

<comment><USER11> Definitely - Reiserfs for the win. Great FS for tons of small files like email, news.. ok, when you really think of it, only multimedia and database files tend to be 'large'. Everything else tends to be rather small. Btrfs is far too unreliable. I've been using Reiserfs on hundreds of servers for 16 years and the last time I can remember having any trouble with it was in 2001... great FS. Too bad distros are killing it off, but when the author's in prison, it's a bit understandable.

</comment></comment><comment><USER12> Just goes to show that UNIX eco-system is not as portable as many youngsters think of it.

<comment><USER13> As far as I know, UNIX isn't really a standard. POSIX is, with varying degrees of compliance from these OSes.

<comment><USER14> It absolutely is, and has been for a long time. I find it very hard to keep track of the various standards, but things got a lot simpler with v3 of the Single Unix Specification, which is the same as POSIX 2001[0].

The problem is that SUS and POSIX only define a subset of what's wanted by most modern software and a subset of the tools people need to interacting with the system. It's a double-edged sword, though: if we always stuck to what was common to all Unix-like systems, we wouldn't have lots of important OS features.

[0] [http://en.wikipedia.org/wiki/Single_UNIX_Specification#2001:...](http://en.wikipedia.org/wiki/Single_UNIX_Specification#2001:_POSIX:2001.2C_Single_UNIX_Specification_version_3)

<comment><USER15> > [I]f we always stuck to what was common to all Unix-like systems, we > wouldn't have lots of important OS features.

Like seriously....It ain't even funny.

:-|

[http://www.gnu.org/savannah- checkouts/gnu/autoconf/manual/au...](http://www.gnu.org/savannah- checkouts/gnu/autoconf/manual/autoconf-2.69/html_node/Limitations-of-Usual- Tools.html#Limitations-of-Usual-Tools)

</comment></comment></comment></comment><comment><USER6> Just a comment: This page is awesome and I have used the crap out of it in the past.

Once, I printed a lot of it on a large format printer so I would have it handy while administering a mixed Unix shop. HP/UX, IRIX, Solaris, Linux...

</comment><comment><USER16> This is very out of date, OS X hasn't used Netinfo Manager since 10.4.

</comment><comment><USER17> We need one of these for The Web. That'd be a truly revolutionary contribution to the mass-communications zeitgeist: how to communicate to your social sphere, effectively, using email. How to do it with RSS, how to do it with The Web. How to stop doing it with Facebook, et al.</comment>


Seems Legit (Suspicious Craigslist Ad) - <AUTHOR> http://southjersey.craigslist.org/cps/5184080755.html <comment><USER2> That's pretty darn clever. Either they're DDoSers or they want to steal everything from your network.

I mean, chances are that they won't be able to penetrate your computers or break through any of your HTTPS data anyway, but it's still extremely dangerous.

Anyone mind buying one and analyzing the payload or connecting it through an isolated network tunnel and watching the packets fly through?

<comment><USER3> Well you could just put it on your DMZ network and limits its ability to connect to just any random host, but people who do this for $50 are not that smart.

</comment></comment><comment><USER4> The routers that most of us use are also essentially black boxes with unverified software that could be spying on us (e.g., via some back-door known to its manufacturer, your ISP or the FBI). And if you think that a reputable company wouldn't distribute malware with their product, you've already forgotten about Lenovo's little stunt.

</comment><comment><USER5> Apparently they lowered the reward ... it used to be $100. [http://slumz.boxden.com/f244/dude-wants-to-pay- me-100-month-...](http://slumz.boxden.com/f244/dude-wants-to-pay- me-100-month-2251331/) \- There is a copy of the email that they sent back to a guy that asked for info and and somebody had the conspiracy theory: "They are just setting up a network of computers where all the box does all day is just click on their Google ads. They need unique hits to either make more ad money or make their sites appear to be worth more to sell them."

They most likely want to use it as a proxy so they can have a good pools of different IPs.

</comment><comment><USER6> Looks like a Raspberry Pi 2, given its connectors. Should be relatively straightforward to figure out what the device does by just getting the microSD-card out of the case and taking a peek at its contents. Chances are there's nothing of interest on it though, except a small script setting up a SSH-connection to a remote server, allowing them to do pretty much anything later on.

</comment><comment><USER7> The question is will these folks ever get brought before law enforcement for such a brazen attempt to infiltrate networks?

<comment><USER2> It's not provable without actually hooking it up to a consumer ISP while watching the packets that it's an attempt to infiltrate networks. Who knows, maybe it's a stealth P2P startup.

</comment></comment><comment><USER8> Definitely a scam, but I'm not sure exactly how it is a scam. Could it be distributing malware to other devices sharing the network? Maybe messing with the router firmware and phoning home (allowing for a follow-up remote attack)? Sniffing for non-SSL logins/credit card info?

</comment><comment><USER9> The RIPE Atlas project[1] does something similar, except that they pay you with data instead of money - and RIPE is 100% legit of course.

[1] [https://atlas.ripe.net/](https://atlas.ripe.net/)</comment>


A Cell-Phone Network powered by signals from baby monitors & cordless phones - <AUTHOR> http://www.technologyreview.com/communications/26581/?p1=A4

<comment><USER2> Yeah, that should /not/ work.</comment>


The Challenges of Being in the New Contract Workforce - happy-go-lucky https://www.npr.org/2018/01/23/579720874/will-work-for-no-benefits-the-challenges-of-being-in-the-new-contract-workforce <comment><USER2> One aspect of the "gig economy" that I've not seen covered is the way it effects gigsters professional social graphs. At the deep end of Mechanical Turk services where work is dispatched by an algorithm (Uber/Lyft/AirBnB/etc.) there are no upward connections to supervisors and managers and officers and no lateral connections to coworkers.

This means that working does not provide insider access to potentially better (or alternative) jobs when coworkers move on. There's no implicit social framework for _insider_ information. There's no personal channel where a Lyft driver finds out that Uber is a better opportunity (or vice versa).

To put it another way, two Lyft drivers have little basis for connecting on Linkedin. Not that I think Linkedin is great. Only that gigsters don't even get the loose social connections that Linkedin facilitates...and cynically, the gig economy casts other Lyft drivers as competitors rather than coworkers.

<comment><USER3> Perhaps there's not social connection directly in the workplace, but there IS social connection between Uber/Lyft/etc drivers online. It was on HN a week or two ago: [https://www.fastcompany.com/40501439/the-network-uber- driver...](https://www.fastcompany.com/40501439/the-network-uber-drivers- built) [https://news.ycombinator.com/item?id=16110598](https://news.ycombinator.com/item?id=16110598)

 _The Network Uber Drivers Built:

Ride-hail drivers work alone, but they're banding together online to compare notes, uncover new policies, and help each other navigate the rough roads of the gig economy._

Similar online communities exist for Mechanical Turk.

(I don't think your overall point is wrong, just pointing out that contractors often figure out ways to organize online anyway... This is a good trend, and hopefully spreads as a way to counteract the sometimes-isolating world of contract work...)

<comment><USER4> Personally, I think web forums like that are a poor substitute for actual interpersonal social connection. A 1-1 relationship with a friend, colleague, or supervisor can give you _in particular_ a leg up when you need it. Any broadcast medium can't fill that role, all it can do is disseminate information to a wide group.

<comment><USER3> > can give you _in particular_ a leg up when you need it. Any broadcast medium > can't fill that role, all it can do is disseminate information to a wide > group.

If all we're talking about is getting a small number of people a leg up, then is it so bad (socially) that contract work lacks that? In my mind, the whole question is about overall social benefit, thus benefit to the "wide group." In fact, if web forums are as equality-inducing as you imply (which I kind of doubt, to be honest), that would count as a big benefit overall to that kind of system.

<comment><USER4> > If all we're talking about is getting a small number of people a leg up

That's the wrong interpretation. It's about giving a large number of people each a _personalized_ leg up. It's equality-inducing in the _worst sense_ to have everyone hit the same indifferent and impersonal wall. Personalized opportunities are how you find _holes_ through that wall.

Basically real human relationships are a safety valve in an inhumane system. Weak and distant broadcast relationships aren't.

</comment></comment></comment></comment></comment><comment><USER5> Keep this in mind when looking at the government's monthly job reports. We've set the wrong metric, so while unemployment may be low the power that would normally flow to workers from a tight job market doesn't exist here.

 _"We find that 94% of net job growth in the past decade was in the alternative work category," said Krueger. "And over 60% was due to the [the rise] of independent contractors, freelancers and contract company workers." In other words, nearly all of the 10 million jobs created between 2005 and 2015 were not traditional nine-to-five employment._

[https://qz.com/851066/almost-all-the-10-million-jobs- created...](https://qz.com/851066/almost-all-the-10-million-jobs-created- since-2005-are-temporary/)

<comment><USER6> IMO this is one of the many different manifestations of a financial squeeze (or at least a "power shift") against middle- and lower-class workers that has been growing over 50 years.

What I find intellectually-interesting is the idea that it's a big hetereogenous system where different parts and aspects are "crumpling" (both concurrently and sequentially) rather than one big politically-noisy snap.

Push kids towards college for earning-potential; defer usual retirement ages; have fewer children; live in a smaller place; both spouses work, live in the city, since you need a denser job-supply for both spouses to be hired and commute; work a second part-time job; etc.

<comment><USER7> Most things are this nuanced, but tabloids and headlines would rather condense everything to 140 characters.

Especially in economics, nothing is simple. Everything has branching consequences and influences. Nothing happens in isolation. Trends are the products of a thousand knobs being tuned according to another thousand knobs each.

</comment></comment></comment><comment><USER8> Am I in the minority here for being a contract developer who is happy to be in this place?

* I make over 40% more than I did when I was full-time, and I was already in the top band for pay in my title. This far exceeds the 15% markup for self-employment tax.

* My wife works full time so she has our back for health insurance

* I can save way more for retirement with an SEP IRA than I ever could with a company-sponsored 401k...it's $55k/yr for 2018 (assuming you contribute 25% of earnings or make $220k/yr)

I can understand that the Gig Economy is certainly not benefiting everyone (e.g. Uber drivers, Postmates runners), but I mean boutique consulting firms have existed for a while and many of them achieve many millions in revenue even with only a few partners. Am I missing something or delusional in my thinking?

<comment><USER9> How would your situation change, if item number 2 was no longer there. (ie, your wife became a contractor) I think that is the largest concern/tipping point for most people..

<comment><USER10> Single father and consultant of 5 years here. It's easy if you're conservative/responsible with your money. Buy health insurance, get short and long term disability. Keep 6 months of expenses in your emergency fund. Don't have any consumer debt. I think the hardest part for most people is being able to not burn through their money as fast as they get it.

<comment><USER11> It's also expensive, inconvenient, time-consuming, and risky to be poor. None of the suggestions you make are "easy" for poor people.

Consider how much time, energy, and expertise it takes even to research disability insurance and buy the appropriate product.

<comment><USER10> There are basically two options for disability insurance, 50% or 75% of what you currently make. I'm sure there's other options, but those are the default choices. The minutia of what's covered basically the same across the industry and if you just choose the first provider you talk to it's not really different than getting it from your employer where you had no choice of providers or coverage. The big barrier is realizing you have personal agency and can do basic things like shop.

<comment><USER11> > The big barrier is realizing you have personal agency and can do basic > things like shop.

This argument reminds me of web designers who blame users for the mistakes they make when presented with a horrible user interface -- that there is no system so terrible that the user can't be a moral failure, 100% responsible for their own misfortune.

<comment><USER10> The difference between you and me is that you believe poor people are stupid and I don't. Otherwise you wouldn't have felt the need to qualify how difficult it would be for "poor people" to figure out how to buy disability insurance, a product that's largely off the shelf.

<comment><USER11> No, the difference is that I factor in structural factors that keep people poor, while you pretend they don't exist.

<comment><USER10> What structural factors, specifically, stop poor people from attaining the level of "expertise" necessary to buy disability insurance?

<comment><USER12> Fundamentally it's lack of time due to having to work 2+ gigs likely while juggling child care or elder care. People with money can pay people to do things for them, freeing up time. Even if they do it themselves, they likely have a more comfortable life so it's easier to devote an evening or a weekend to figuring out complicated medical/legal/financial scenarios.

<comment><USER10> Do you similarly feel that it's impossible for poor people to buy car insurance? Disability insurance is LESS complicated than that. Do you want the 50% of your current salary or 75% of your current salary option? That's it. Maybe you can pay a few extra bucks for a rider that increases your disability coverage each year as you get a raise. This is not complicated stuff and any insurance agent is going to be happy to walk you through it if you have questions.

<comment><USER12> Nobody's saying it's impossible or even difficult. But if I'm rushing from my shift at McDonald's to pick up my kid and drop them off at home with some dinner before heading to the late shift at Home Depot, I'm not going to be able to talk to an insurance agent who might very well be happy to walk me through it, let alone spend time actively thinking about what coverage I need.

<comment><USER10> You dodged my first question. Apply the same thing to car insurance. Are poor people generally incapable of attaining the "expertise" to be able to purchase car insurance?

<comment><USER12> Car insurance is _much_ simpler than health insurance. Still, I expect most people without car insurance are poor, and the reason they don't have it is not simply a lack of money but also (and relatedly) a lack of time.

Generally yes, poor people are less capable of gaining the "expertise" to do many things, because they are busy trying to stay alive. It's textbook hierarchy of needs.

Noticed other replies; why the fixation on car insurance? I thought we were talking about structural impediments to poor people?

<comment><USER10> This is the comment I'm responding to:

>Consider how much time, energy, and expertise it takes even to research disability insurance and buy the appropriate product.

This is in the context of a discussion about starting your own business. If you're on the tier of hierarchy of needs where you're struggling for food, then sure, maybe you shouldn't be starting your own business at this point. However, if you have the intellectual capacity to buy car insurance, and also are in a position to be starting your own business, you almost certainly have the cognitive ability to purchase disability insurance.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> > Within a decade, contractors and freelancers could make up half of the > American workforce.

This is pretty shocking to me. With recent trends you can easily see that the other half of the population will be people in IT and health care (home service providers, nurses, etc.)

I've never had a contract job, I'm not sure if part-time college jobs count, are contract employees getting work via an agency or are they on their own? If these agencies exist are they helping to negotiate on behalf of their workers?

It feels like there is space for a digital employment agency, there must be a way to combine the "flexibility" of contract work with the longer term cushion that comes with a full time job.

<comment><USER14> I am a contract employee who gets work via an agency. I have full health benefits (health, vision, dental which costs me about $200/mo), paid holiday, vacation, and even paid overtime (1.5x my hourly rate). All of this was negotiated ahead of time, along with the salary range I was looking for.

Any new opportunities that are available, my agency contacts me and asks if I am interested in doing work there, or if I want to stay at my current place. I have been working at my current place in govt defense embedded work for the past 2+ years getting paid more than most direct hires with the only real downsides being no 401k matching and no personal/sick time when looking at total comp. I am also able to work from home and make my own hours, so I am more flexible than direct hires who have to remain in the office during "core hours".

Some people here have been contract workers for well over a decade, so as long as the company has a need for you, you can remain on contract. If you want to go direct with the company you are contracted at, you can also negotiate that during their periods when they open up direct hiring.

This is my situation here in the Midwest as a defense contractor, so it may differ elsewhere and in different fields of work. Needless to say, it's not a bad gig, especially if you can get into an area where the company can't afford to lose you. For example, I am one of two people in the entire company who knows the OS architecture for every vehicle we make, and I got paid extra money to grind out a few hours a week to learn that architecture.

<comment><USER15> >the only real downsides being no 401k matching

That's not exactly a downside from a total compensation perspective, so long as you are considered self-employed for setting up a one-participant 401k. You get significantly more control over what portion of your total compensation is taxable vs tax-deferred.

</comment></comment></comment><comment><USER16> Good (edit: in the long run). The services they list, like health insurance, retirement, or pensions, should be decoupled from your employer.

<comment><USER17> Ideally they would be coupled to our government, but since they aren't providing that, our employers should be obligated to ensure they are providing us with the means to keep ourselves healthy.

<comment><USER18> That's historically the way it has been but it's absurd in general. Would you argue the same thing about housing, food, and water (they should all be provided by the employer)?

Really what we need is an expectation of being able to buy healthcare on our own with regular incomes.

<comment><USER19> No, the american approach is beyond absurd. Of course my employer should pay into(government ran) healthcare on my behalf. Of course they should pay into a pension plan. And yes, currently, if I stay beyond my mandated 7.5 hours, my employer has to provide food during that time. My employer also has to provide water during working hours. If my employer asks me to go somewhere on company business, they have to provide housing.

<comment><USER20> You didn't really explain how the American approach was absurd. Also, 7.5 hours seems extremely arbitrary. Why pick that number of hours? Why not 4 hours? Why not 9?

<comment><USER21> For non-salary workers, in your "8 hour" work day there is a certain mandated amount of break time. X minutes per Y hours, for example, plus time for lunch. They might have taken 8 hours and subtracted two 15-minute breaks.

I'm not sure if the 8 hours is intended to be (8h + X break time), or (8h - <AUTHOR> break time); I thought it was the former, but but might be mistaken. That's probably where the GP got their 7.5 from.

<comment><USER22> In the USA, there is no federal requirement for break time.

<comment><USER21> How true! However, there are some at state levels. For example [0]:

(2018) Under California law (which is much more generous to employees than federal law), if you are a non-exempt worker, you are entitled to meal and rest breaks: a 30-minute meal break if you work more than 5 hours in a workday, and 10 minutes breaks for every 4 hours you work

For an 8-hour work day, that would yield a 30 minute break + two ten minute ones.

0: [https://calaborlaw.com/what-break-periods-am-i-entitled- to/](https://calaborlaw.com/what-break-periods-am-i-entitled-to/)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> People who use Uber, AirBnB, Deliveroo and similar companies are only fuelling this race to the bottom. Maybe one day it will catch up to them, and then it will be too late. Use your leverage while you still have it, Comrades.

<comment><USER24> It's not a race to the bottom. It's a correction. Why should your health care be determined by your employer? It's a ludicrous system that should have died decades ago.

<comment><USER25> > Why should your health care be determined by your employer? It's a ludicrous > system that should have died decades ago.

Yeah but it's being replaced by insurance that is utterly unaffordable for a lot of contract employees. If we want to decouple health insurance and employers (and we should) then we should be proactively working out what that looks like in the future.

<comment><USER26> > utterly unaffordable for a lot of contract employees

Caused in part by the issues of employability of (some) chronically ill people, driving up costs, and making "individual" plans de facto "high risk pool plans". Which would be helped by, as you said (and I agree):

> decouple health insurance and employer

</comment></comment></comment></comment><comment><USER27> I'm sure I'll get some flak for saying this on HN, but I would encourage everyone not to take a contracting gig unless you're absolutely desperate for work. I don't believe most people are cut out to properly negotiate the pay for a contracting position (in that they do not know how to properly account for all of the benefits they are not getting). And by taking a contracting position you are basically encouraging the contracting and gig economy to grow, and allowing employers to take even more advantage of their employees by baiting them with a carrot on a stick. You can argue the gig economy allows flexibility for the worker, which is true to some extent, but I can't imagine this flexibility wouldn't cause a huge amount of stress in the day to day lives of people who need gainful employment to support someone else (children, elderly parents, etc.)

Look, I can't claim to have been a contractor for any significant length of time, so maybe I'm talking out my ass and every freelancer here can tell me so. But the fact is the american people have let employers have too much power for far too long, and encouraging people to take contract work seems to me like just another step in the wrong direction of giving these companies even more power, and then everyone is worse off for it.

<comment><USER28> Contract work _should_ be fine. I frankly blame the American government for tying healthcare to not just _employment status_ but _particular employer_ so tightly for so long. It is frankly ridiculous and disgraceful that our political leaders are not held to account for this.

The early Tea Party was _supposed_ to be organized around a theme of "stop the nonsense and denial!" with respect to these kinds of problems, but it was quickly corrupted by the ignorant and by the people who were hoping to find ignorance. Rather than turning energy and community action into positive change, they were derided and stymied.

So now we have Trump who is basically nonsense and denial personified.

Not that Obamacare did anything to get us off the employer healthcare crutch. In that respect, things seem to have just gotten worse.

And I'm a person that doesn't think _everything_ needs to be political! It's just hard to get around the fact that American is grossly misgoverned here. But the American voter can't bring itself to vote on real issues instead of rooting for its political team. This gives me little hope that we'll ever get the 2/3 to 3/4 consensus we'll need to practically fix this (1).

(1) Even if we don't need that many people agreeing to _pass_ legislation, I think things like reforming entire sectors of the economy and employer/employee relationships requires very broad support to be both fair and lasting. Having 51% of voters pee in the cornflakes of the other 49% doesn't get us anywhere. Hopefully that's clear given American politics since 2006 or so.

EDIT: To tie this back to contract work, contract work is _great_ and provides needed dynamism and small-business know-how to the economy. But it's _very_ risky. One needs an independent source of income (other investments, working professional spouse) or a big pile of capital so you can weather ups and downs, take health sabbaticals if needed, hire temp help sporadically, etc.

<comment><USER27> Oh I agree completely, it should be fine. But mega-insurance already managed to lobby basic universal health care out of existence. And now that those safety nets have been removed, employers want to have their cake and eat it too by not giving health insurance to their employees. I'd rather the american people have some access to healthcare than none at all. So until the people figure out that universal healthcare is the only way to go, unfortunately this is the best option.

<comment><USER29> maybe some mega insurance was against obamacare, but a lot of them wanted it to continue because it was providing steady business. most individuals liked it for the changes like kids being on parent's health ins till 25.

</comment></comment></comment></comment><comment><USER30> > According to the poll, 51 percent of freelance and contract workers do not > receive benefits common to many full-time jobs — sick leave, unemployment > insurance or retirement savings.

Back when I worked at Boeing, there were many contractors. They usually were paid double the hourly rate of the salarymen. But they got no benefits, and could be let go without notice.

Turns out that the Boeing benefits package was worth about 40% of the salary, and coupled with the unreliability of contract employment, it worked out about even steven to be paid double.

Sadly, the article does not delve into the pay differential aspect of salary vs contractor. Safety nets don't come for free.

</comment><comment><USER31> We should uncouple insurance from employers anyway. Offering benefits such as insurance was a hack that started during WW2 so that companies could get around the idiotic wage freezes imposed by the government, and it gives your employer far too much power over your health.

</comment><comment><USER32> I'm totally cool with "contract" work (that's what I do in a way) so long as I:

* Do the work from home or wherever I want

* Use my own tools and equipment

* Work when I want to (within reason)

* Have a say in the deadlines

* Can turn down projects

But the minute you dictate my hours and where the work is done? No way.

<comment><USER33> > But the minute you dictate my hours and where the work is done? No way.

Isn't that how US law determines if someone is actually a contractor vs an employee?

<comment><USER32> There is freelance contract and contract employment. Those are two different things, but, yea, to a degree you're right.

</comment></comment></comment><comment><USER34> The US will have huge numbers of broke old people in future decades.

<comment><USER35> That's a realisation which hit me about 5-7 years back.

Slow-motion train wreck.

</comment></comment><comment><USER36> I think this speaks to the importance of universal healthcare.

</comment><comment><USER37>
       Being on your own in the workforce often means you don't have the safety net of benefits and other forms of support that traditional workers do.

Even the first sentence is kinda stupid. Benefits are a form of salary. Independent have the freedom to buy the benefits they want and spend their income as they please. What's wrong with that ?

      The best antidote to fear, she says, is to create a new social safety net where freelancers can rely on each other

I fear people like her trying to force us "for our own good"

<comment><USER38> Unfortunately cash is not as efficient in procuring the sorts of services that are normally provided by benefits, due to the advantages of structured negotiation.

You are unlikely to get as good a deal from health insurance providers as your employer.

<comment><USER39> Beyond just pricing there's also a question of availability: prior to the ACA you could easily find former contractors who needed to take a corporate job because they or a family member had some sort of long-term condition or risk factor which meant that insurance plans wouldn't cover them at less than extortionate rates.

Having insurance negotiated by individuals is a huge impediment for entrepreneurship.

<comment><USER40> This is why a Social Health Care system would be such a boon to entrepreneurship. It would remove one of the biggest worries for people creating their own business.

<comment><USER41> Yea - we can work and pay taxes to give you a "boon" as you try out your next big idea. Sounds great for you, not so great for me. Hard pass.

<comment><USER39> As FireBeyond noted, the system you're defending takes more of your money: not only are U.S. medical costs substantially higher – on average! It's even worse for independent buyers — but the layers of inefficiency designed into the system mean that the outcomes are worse.

The other side of this is considering what happens if you get sick: should we just let you die and bill your next of kin for the cleanup costs? If you're not that heartless, all of the alternatives cost more than helping people get medical care. I'd much prefer to pay a little more so people can get treated rather than pay for them to be disabled and out of the workforce, or to spare their families the crippling cost of trying to effectively be an insurance pool with a single-digit number of members.

<comment><USER41> I'm not trolling you - but yes I am that heartless. This could have a lot to do with upbringing, but mine was full of analogies of humanity to nature. One of those was a firm belief that there is no "safety net" to catch me or my family. If I succeed, they succeed - if I fail, then we all fail. Everyone is responsible for themselves.

Everyone's particular set of values will vary, but that is mine.

</comment></comment></comment></comment></comment></comment></comment><comment><USER42> There are pros and cons depending on your personal situation. Having that workforce profile can be liberating if you have the right skill set to keep you on track and organized. The freelance/GIG economy has a lot to offer not only younger workers but veteran workers looking to add more tools to their toolbox. [https://latechnews.org/los-angeles-gig- economy/](https://latechnews.org/los-angeles-gig-economy/)

<comment><USER43> > Having that workforce profile can be liberating if you have the right skill > set to keep you on track and organized.

Well yeah, some people are just awesome/lucky/blessed. Given nothing, they know how to build great things. But this is a strong minority of people.

The majority of people are just normal, they may have one or two skill that they are good at, but don't have the skills required to run their own company. A person can be a great employee developer whose capable of building awesome products, but an awful freelance one because they are not good at negotiation, management, finances, etc.

It's a step away from the efficient specialization of a corporate structure, where each employee only needs to be skilled at their particular job, to a guild-like structure where everyone is a worker, manager, accountant, book keeper and politician.

</comment></comment><comment><USER44> Is anyone here a member of the mentioned freelancer union? I'd be interested in hearing a member's perspective.

<comment><USER45> I'm a member of Freelancer's Union. I don't interact with the union much, but I do buy life and term disability insurance from them. By the time I joined their health insurance offering changed from custom plans to just listing on and off exchange individual plans. Not that there's anything wrong with that, it's just nothing more than you can get on healthcare.gov or your state's exchange, or shopping the off exchange market yourself.

</comment></comment><comment><USER46> I guess it must be different in the US vs the UK. Contracting in the UK (at least in the IT world) is very popular and quite lucrative. (I guess not having to worry about health insurance helps somewhat, though)

I've been permanent, and I've been contract, I really hope I get to finish the rest of my career as a contractor.

<comment><USER47> The US doesn't have the NHS.

<comment><USER46> >> (I guess not having to worry about health insurance helps somewhat, though)

</comment></comment></comment><comment> Chiba-City Our lack of universal and convenient primary care hinders the formation of small or new large businesses. Our medical care quality is low due to lack of data sharing that national health services enjoy for free. Our oddly expensive but low performing healthcare is a pathetic vestige of our apartheid racist labor history here in the USA. These issues do not concern fancy elective medicine we also sadly fetishize amidst our ongoing dysfunctioning. We prefer endless pitches of futuristic delusions than reliable heartbeat services. We will continue to suffer this needless hamstringing until we catch up with civilized people who can add, subtract, multiply and divide.

</comment><comment><USER48> As a contractor I don't feel I opted out of a "social contract."

Instead, I opting in to a tailored package of benefits that I choose myself. I fund (at very reasonable cost) my insurances directly.

The phrase "social contract" sounds like statist utopian fiction to me. It's a sad world indeed, when employees can only rely on the impersonal, bureaucratic HR department of their massive employer. Or the cold, dead hand of the state and its civil servants.

Freedom lies in taking responsibility for your own affairs. Insuring yourself against calamity. Saving money for a rainy day.

Step outside our one-size-fits-all system, and further both your career and your security.

</comment><comment><USER49> Very excited about MTurk's feature called Premium Qualifications. Anyone ever have success with this?

</comment><comment><USER50> I worked in both ways and there are pros and cons.

If you are a good negotiator then contracting is best. I prefer negotiating the best rate then minmaxing I'm buying my own "benefits" rather than having my employer pick for me.

At the end of the day you pay either way in the sense that high benefits affect salary.

I'd rather get the straight hourly or daily rate and then build on costs for vacation, pension, insurance, etc.

Now it stinks if the rate does not cover necessary expenses as I've seen IT jobs try to straight line convert FTE to contractors (eg, $100k salary to $50/hour rate) but that's why you need to be good at negotiating.

<comment><USER51> > I prefer negotiating the best rate then minmaxing I'm buying my own > "benefits" rather than having my employer pick for me.

This isn't always true though. For example, health insurance. My employers package is far far better than anything I could get as an individual, and costs 1/5 f the closest comparable package that I could buy on my own.

<comment><USER50> Oh definitely. When I ran my 1099 business it was impossible to get insurance similar to my employers at the same cost. I had to pay a lot more.

But that's what I mean by building it into your rate. If you know insurance costs you $20k to be similar to what a big company pays only $10k, then add it into your contract. Of course, contracting isn't for everyone, especially if you can't get a high enough rate to be more valuable to you than w2.

</comment></comment></comment><comment> King-Aaron In my experience, the way the workforce is changing towards a contract economy helps no one except for employers.

In the short term, contractors can get more money by far - hour to hour. But when life events crop up such as illness, death in the family, personal injury, etc, the house of cards can become unstuck pretty rapidly if people haven't planned well enough for their rainy day.

</comment><comment><USER52> I wonder if contract workforce will fade as unemployment falls. The last 10 years the job market has been bad so many people had no choice but to work on contract. Now they have more of a choice.

<comment><USER53> Odds are that these people are not reskilling and will be left out of any new boost we have. Also consider where and when any recovery happens, most people already on tenuous ground are less likely to move to take advantage of that.

</comment></comment><comment><USER54> I guess one of the only advantages of more contractors is that may eventually push us to single payer healthcare system.

</comment><comment><USER55> Employer "benefits" are things that are all freely available a la carte. There's no reason contractors can't buy health insurance from a marketplace or contribute to an IRA and wind up with the same end result. You as a contractor just have to factor those additional costs in to your decision-making process when evaluating compensation packages.

<comment><USER56> The "benefit" portion of that statement is that the employers typically take on a portion of that cost so it's reduced for the employee. Have you ever filed taxes as a freelancer? You nearly pay double because you're both the employer AND employee in that situation... The same goes for other benefits as well like healthcare - There are no group discounts when you're the only one getting coverage.

<comment><USER20> The government provides incentives (tax exemption) for employer provided insurance, which distorts the market. Seems like extending that benefit to freelancers or eliminating it entirely would be extremely helpful. [https://www.mercatus.org/publication/tax-exemption- employer-...](https://www.mercatus.org/publication/tax-exemption-employer- provided-health-insurance)

</comment></comment></comment><comment><USER57> "No benefits" is a somewhat strange way to think about it because all of these benefits, you can buy yourself. They are just really expensive. The underlying problem is that these jobs do not pay as much as people would like. That is still a very real problem. But since this article does not discuss pay at all, it's hard to really understand what's going on from the article.

<comment><USER41> What's going on is ad revenue. Pick a touchy subject, write something(references and quality not required), and watch the impressions stack up.</comment></comment>


Is it a language, or an operating system, or a virtual machine? - <AUTHOR> http://akkartik.github.io/mu/ <comment><USER2> Oh, add a transactional hierarchical DB and you've got yourself a clone of MUMPS.

<comment><USER3> Author here. OP isn't exactly the best link to start reading about this project. Please check out [http://github.com/akkartik/mu#readme](http://github.com/akkartik/mu#readme) and tell me what you think.

<comment><USER4> Do you want us to change the URL to that one?

<comment><USER3> Nah, that's ok. Thanks!

</comment></comment></comment></comment><comment><USER5> >Make simple changes to any project in an afternoon, no matter how large it is. How? How do you help me "orient myself"? What do traces have to do with this? And please don't say mu.

</comment><comment><USER6> A complete tangent from the project itself, but it's important to get in the mindset of asking the question in the title about _every_ language you meet. It's a step on the path to enlightenment.

• Ruby: a language; now also a VM. Its language semantics can exist on other VMs and people still consider that "Ruby"; nobody really uses the VM outside of the language. So, we call Ruby a language. However, its language semantics require a lot of the VM (the ability to redefine methods of existing classes, for example), so one could say Ruby has its own Abstract Machine that a lot of VMs just happen to be adequate implementations of already.

• Erlang: a language, _and_ a VM (itself called BEAM.) The VM's semantics are the important part; the language is just an arbitrary syntax. Other languages on the BEAM VM (or rather, the Erlang Abstract Machine, which the BEAM VM implements) all "taste" very strongly like Erlang, because the flavour of Erlang comes from the VM, not the language. (And then "OTP" is the operating system for that VM. You could write your own, but I'm not sure anyone has. All the current BEAM VM languages assume they're running inside OTP.)

• C, C++, Rust: different languages, all for the same Abstract Machine, which has no real name but assumes a "C Runtime" with POSIX-like abstractions is available. You could call it the "C Abstract Machine": it's the effective assumptions of hardware instruction-set that allow one to talk about things like "signed pointer-length integers". When something hits "undefined behaviour" in one of these languages, it's behavior undefined _by the C Abstract Machine_ —likely because different ISAs do different things and it's too costly to try to smooth that over. (Note that the POSIX abstractions could be said to be an "abstract operating system" of sorts, one which is implemented by multiple different real C-AM operating systems.)

• Smalltalk: its own syntax, its own OS, and its own VM. All three are just known as "Smalltalk" in general, with the name of the implementation prefixed. Simple!

• Java, C#: languages that created VMs (the JVM and the CLR) that are now more important than those languages. The JVM has no operating system, just a bunch of libraries. The CLR has an implicit dependency on a lot of Windows to be its operating system; Mono and Wine have a weird relationship because of this.

• Lua: a language. The actual VM is irrelevant (there are multiple), though the "Lua abstract machine" has the interesting requirement of being an embeddable sandbox. No operating system; everything inside the VM comes in along with the application.

• JavaScript: a language that spawned an abstract machine with three choices of operating system: a very small one (Node), a very large one (the browser runtime), and one in the middle (Macromedia Flash.) Node-Webkit and Electron are examples of a non-embedded instance of the JavaScript abstract machine running the browser OS.

<comment><USER7> C really is defined in terms of the C abstract machine, in the specs, essentially a naive interpeter.

</comment></comment><comment><USER8> Didn't expect to see this on HN :)

</comment><comment><USER9> I had to look up what it means to be answered with just the word _Mu_. I've seen it before, but I never really bothered to look it up. The humorous explanation is here - [http://www.urbandictionary.com/define.php?term=mu](http://www.urbandictionary.com/define.php?term=mu)

<comment><USER10> Aaaaaand I'm officially old.

I learned the word from JARGON.TXT, a text file passed around BBSes in the 90s.

[http://www.catb.org/jargon/html/M/mu.html](http://www.catb.org/jargon/html/M/mu.html)

<comment><USER11> Dates back to at least 1979 with Godel, Escher, Bach.

<comment><USER12> Actually, to a long time before that: [https://en.wikipedia.org/wiki/Mu_(negative)](https://en.wikipedia.org/wiki/Mu_\(negative\))

</comment></comment></comment></comment><comment><USER13> Interesting concept, but the examples are extremely difficult to read because the color contrast on the black background is too low.

<comment><USER3> Thanks for the feedback! Could you possibly send me a screenshot of how it looks on your screen? My email is in my profile and also on the OP.

<comment><USER13> Done. It's a combination of the color and the small font; the black tends to "swallow up" the edges of the white characters, and the teal and red are difficult to distinguish. Also, probably my eyes are significantly older than yours are.

<comment><USER3> Many thanks! I can certainly increase the font size, that seems like an easy way to improve matters.

<comment><USER13> Thanks. Seems improved.

</comment></comment></comment></comment></comment><comment><USER14> I made an x86_64 operating system with a compiler. The compiler compiles a dialect of C/C++. It operates both JIT and AOT.</comment>


Show HN: ZombsRoyale.io -100 person real-time multiplayer, 2D Battle Royale game - <AUTHOR> http://zombsroyale.io <comment><USER2> Well, I made it to #6 before my screen froze for 10 seconds :(

Fun game though!</comment>


Show HN: Wabi – Stop paper junk mail - <AUTHOR> https://meetwabi.com <comment><AUTHOR> I've started this project, Wabi ([https://meetwabi.com](https://meetwabi.com)), to help people stop physical junk mail, get back control of your life, and ultimately reduce the waste and protect our beautiful Mother Earth.

"Is there a way to unsubscribe all the junk mail?", I asked myself when I saw a pile of coupons, catalogs, and mails in our living room. Then I started researching online, turns out there are ways to do that but are incredibly time-consuming. I want to build a platform that can help people not just reduce mails but eventually reduce stuff they don't need, physically and mentally, and enjoy a simpler life.

Currently, Wabi has been used by hundreds of people successfully and saved thousands of trees and counting. I want to invite all of you to join us and try it out. Feel free to leave a comment or PM me if you have any questions and suggestions. Thanks a lot, and let's make this world a better place!

P.S. it's only available in the U.S. at this moment but let me know if you have similar problems in your country.

P.P.S. According to the Center for Development of Recycling at San Jose State University, an American adult receives 41 pounds of junk mail per year. To produce this much paper requires cutting down somewhere between 80 million and 100 million trees annually. If left standing, these trees would absorb 1.7 million tons of CO2 a year.

</comment><comment><USER2> From Privacy Policy:

> The amount and type of information that Wabi gathers depends on the nature > of the interaction. For example, we ask visitors who sign up for a blog at > [https://meetwabi.com](https://meetwabi.com) to provide a username and email > address.

What does it mean to "sign up for a blog"?

<comment><AUTHOR> It used to be a blog. Thanks for letting me know.

</comment></comment><comment><USER3> I really like the idea behind this project. I'm quite curious how it works to unsubscribe you from mail.</comment>


Why isn't Facebook popular in Japan,Russia,China? - <AUTHOR>

Recently Zuckerberg said that was the case. Jut wanted to see what the HN community feels. User interface? Use-cases? Government interference? Net infrastructure?Culture?
  < I just made this observation -  All these countries seem to LOVE the color Red. Just look at China's flag, japan's flag- and best of all- the former Soviet Union's flag.<p>Perhaps there are almost invisible cultural cues. TopCoder is incredibly popular in countries of former Soviet Union,China.
And what does every coder worth his NaCl on TopCoder, aspire? Becoming a 'RED-RATED' member.
And Facebook- is all 'Blue'.  91 % of all Desktops use the ubiquitous Windows 'Blue' login screen. I would go as far to argue that, everything else being the same,'Blue themes' definitely resonates well with Americans. Not sure about former Soviet union/Communist countries. Feel Free to comment/brainstorm/criticize! <comment><USER2> (Russia) VKontakte.ru ("in contact") is incredibly popular in Russia (along with odnoklassniki.ru and my.mail.ru). VKontakte is basically a clone of Facebook, which was there long before FB had any russification and it was promoted heavily among universities.

Odnoklassniki ("Classmates") appealed more to older crowd, searching for long lost connections. Moy Mir("My World" my.mail.ru) appealed to younger crowd.

So, we basically have more than enough social networks, Facebook was kind of too late to the party, because most people already had accounts with one of those networks.

BTW. VKontakte is blue. (It's a clone of Facebook)

<comment><AUTHOR> Thanks for sharing the information! Really weird- when I visit <http://vkontakte.ru/> on Chrome, and translate it to English - The site says "Facebook - the most visited site in Russia and Ukraine."

</comment></comment><comment><USER3> Red is not a uniformly positive colour in any of these countries. For example, in China (and in Japan too, I believe), writing in red is traditionally associated with death threats. And I don't know of any social network using a reddish colour scheme. Closest I can think of are <http://mixi.jp/> which uses orange, <http://vsetut.uz/> which uses pink, and <http://ibox.mn> which uses a red bar on a dark blue background. Many popular sites both corporate and social seem to use blue regardless of the country. Vkontakte and Renren are already mentioned. Naizuud from Mongolia (<http://naizuud.mn>) is another one, for example.

Local social network sites can get a toehold because Facebook or Friendster are not localised in their language, so they start as "clones". But that's just the start. It's stupid to look down on them just because they copied an interface or a few ideas. They grow (and their other local competitors die) because they execute well in _their_ market. E.g. Renren may _look_ a lot like Facebook, but the actual workings of the site are a lot different --- the two most obvious differences being that you can see who visited your profile, and game mechanics play a much larger role (e.g. you get "level up" by logging in for n consecutive days, giving you profile badges and the like). This annoys the living hell out of me, but I'm guessing most of their users like it, otherwise they'd be on another site instead.

Thanks to the Great Firewall, the Renren users don't have the option of going to Facebook, so there's no direct competition there, yet. But local sites can survive against international competitors as long as they execute well. Korean search engine/portal Naver is still going strong, because they continued to come up with strategies to stay ahead of their competition and keep their site as a destination (incentivising user-generated content, entering into tie-ups with local newspapers, putting printed dictionaries and encyclopedias online for free, etc.).

And on the other hand, Korean social networking site Cyworld executed extremely poorly, which is why they are struggling now. Ten years ago I knew plenty of people with Cyworld accounts --- Korean international students I studied with, and even Korean Americans (who couldn't even sign up on their own, but had to use their relatives' citizen ID numbers to sign up!). Then in 2006 Cyworld announced they were going to try to enter into the USA market. But they didn't leverage the existing userbase at all --- instead they created walled gardens for the USA and China which were completely separate from their Korean network. So of course I didn't bother signing up, and neither did hundreds of thousands of other people _who all had friends with Cyworld Korea accounts_ and who certainly would have signed up if it would have connected them to their Korean friends. Oops. (The lack of support for anything but IE didn't help either). And now, all the Koreans who were studying abroad when Facebook started getting big have graduated and are going back to Korea for work (and getting all their domestic friends onto Facebook too).

Mongolia has the opposite story: the local search engines like Haih couldn't come up with any strategy to become profitable and are now defunct. The only feature they offered was Mongolian-language search. Google didn't --- and still doesn't --- handle Mongolian stemming. If you search just for "Ulaanbaatar", you won't find Ulaanbaatarad (in Ulaanbaatar), Ulaanbaatariin (Ulaanbaatar's), etc. But Mongolian stemming didn't make any money for Haih, and they had no strategy beyond "copy Google" (right down to the logo design). In contrast, at least for now, the local Mongolian social networks (Naizuud, Banjig 360, Ibox, etc.) are doing great --- plenty of Mongolians have accounts on Mixi or Facebook, but at least for now they're happy to keep using both the international sites _and_ the local sites. Wonder how long that will last. Interesting times!

<comment><USER4> Writing in Red, and death threats? A Korean social networking site,which started in 1999 ? So,technically,would this be the first successful social networking site? Nice information and links! From this discussion,I am inclined to the proposition,UI have little to do with popularity in a specific country -It narrows down to features like game dynamics on login, and profile visits, which local sites seem to have done a great job catering to their audience- and that's something Facebook might have a tricky incorporating (Profile visits enabled only for China?? ) Interesting!

</comment></comment><comment><USER5> coincidence or pattern?

<comment><AUTHOR> Perhaps it's a coincidence.. This site is supposed to be one of China's popular social network <http://renren.com/> ... And you just cant ignore the blue theme! Was just thinking out aloud, hoping to see what HN'ers had to say about Facebook's lack of popularity in those countries</comment></comment>