The Worst Mistake in the History of the Human Race (by Jared Diamond) - <AUTHOR> http://www.agron.iastate.edu/courses/agron342/diamondmistake.html <comment><USER2> Repeatedly on Reddit, e.g. <http://science.reddit.com/info/1rssu/comments>

Agriculture simply multiplied everything. Hunter-gatherers still had and have tribal wars, murder, rape, rapine, torture, high infant mortality, much lower male life expectancy (due to fighting), plus the usual disease, famine, and social inequality of women.

The average college student in a dorm room enjoys greater luxury and comfort than kings of yesteryear; they have climate control, hot and cold running water, antibiotics, corrective eyewear, and of course a far greater selection of food year-round, not to mention a better selection of healthy mates.

Whether people are happier in modern technological society or hunter-gatherer society is almost beside the point; evolution seems to have selected for worried, discontented people -- they outcompete the easily satiated. Even as we precipitate the extinction of traditional hunter-gatherer lifestyles, we can imagine them at some point in the past wiping out even less technologically-savvy people who perhaps were even more happy and contented, leading an existence akin to our bonobo relatives. A similar article written then by gatherers might blame the widespread adoption of hunting for increasing societal violence and leading to a new class division: warrior, due to the ensuing upswing in human-human "hunting".

Increased population can be thought of as a tool; it has been exploited for ill much of the time, but it can also be used for the betterment of all. When we start to live in "The Matrix" (a pleasurable one), we may well rely on aquaculture to produce high-yield algae we farm for biofuel and for nutrients for our IV drips. At that point we may instead regard agriculture, regardless of temporary blips, as the best thing to happen to humanity.

</comment><comment><USER3> Ok, time for a bit of hand wringing. I said I'd wait a week, but this needs to be pointed out. In the space of one day, we've gone from startup news to rehashed reddit news.

<http://reddit.com/info/3895/comments>

Not only that, but the article itself is _20 years old_ , and is not an attitude I have read in Diamond's later works like 'Collapse', where he certainly underlines the dangers and problems that face the human race, but does manage to strike a good balance between gloomy and cautiously optimistic about the possibility for improvement.

Harumph.

<comment><AUTHOR> I don't read reddit, anyway, I guess it takes time to find out what is considered appropiate for the new hacker news. I went by the definition of "is not shown on TV". It's 20 years old, but old articles have been posted before, and I only found it today... If nobody is interested, nobody will mod it up?

Besides, I thought this article also relates to startupping, because of the average work hours aspect. But granted, Jared Diamond is not exactly unknown.

<comment><USER3> It's not that bad a link... it just seems so drastic a change:-/ It seems also to illustrate that the intersection of interesting startup links is very well defined, whereas the intersection of interesting 'hacker news' is rather less well defined, and will probably be more prone to disagreement, even if the people posting are the same ones as with the old yc.news, because our interests and beliefs are likely to be quite varied.

Add to that people who didn't see or take part in the original, and while I hope the change will go ok, it will be a lot of work.

<comment><USER4> >news interesting to hackers generally.

Obviously hackers have found this interesting, but I agree it is on the border of being irrelevant. I think it is useful to use PG's rule of thumb that if it's covered on TV news then it's off topic which I think this is an exception to.

I like this new direction that yc is taking, the site was rather boring to me before which I barely frequented until I saw that it changed on reddit.

I shouldn't come here to often because each time I read something by PG I feel like quitting my job and starting a company.

<comment><USER3> I think part of what bugs me is that it's also somewhat sensationalist, which is why reddit keeps reposting it.

</comment></comment></comment></comment></comment><comment><USER5> Anyone who thinks hunter gatherers had pleasant lives should stop to think what happened to people who were too old to follow the tribe when it moved, or what happened when a mother who was already nursing had another baby.

<comment><USER6> Indeed. I love this comic: <http://static.flickr.com/100/267584452_4c7f35863f.jpg>

</comment></comment><comment><USER7> >Astronomy taught us that our earth isn't the center of the universe but merely one of billions of heavenly bodies. From biology we learned that we weren't specially created by God but evolved along with millions of other species.

Neither of which would have been possible if we were too busy hunting for food every waking hour.

<comment><USER8> >>It turns out that these people have plenty of leisure time, sleep a good deal, and work less hard than their farming neighbors. For instance, the average time devoted each week to obtaining food is only 12 to 19 hours for one group of Bushmen, 14 hours or less for the Hadza nomads of Tanzania.

FTA... please read it :p

You can make the argument that by increasing population size and crowding, it also made collaboration, partnership, and the growth of ideas easier but the article itself debunks the whole "they spent their entire life looking for berries" argument.

Jared Diamond is awesome.

<comment><USER9> I think it is moreso the ability to settle in one place that caused the growth of technology. The hunter-gatherers, no matter how numerous, certainly did not spend their free time building forges and experimenting with metal.

Also note that the time spent gathering food likely does not include preparing to gather food (e.g.: making weapons). Although they could spend plenty of time playing games, note that games originated to prepare children to spend time gathering food (and practice other necessary survival skills).

<comment><USER9> I must rescind this statement. As a result of these discussions, I began reading Guns, Germs, and Steel, which, in the chapter "To Farm or not to Farm," makes clear the disconnect between agriculture and sedentary living:

"Another misconception is that there is necesarrily a sharp divide between nomadic hunter-gatherers and sedentary food producers. In reality, although we frequently develop such a contrast, hunter-gathers in some productive areas, including North America's Pacific Northwest coast and possibly southeastern Australia, became sedentary but never became food producers. Other hunter- gatherers, in Palestine, costal Peru, and Japan, became sedentary first and adopted food production much later. Sedentary groups probably made up a much higher fraction 15,000 years ago, when all inhabited parts of the world (including the most productive areas) were still occupied by hunter-gatherers, than they do today, when the few remaining hunter-gathers survive only in unproductive areas where nomadism is the sole option.

Conversely, there are mobile groups of food producers. Some modern nomads of New Guinea's Lake Plains made clearings in the jungle, plant bananas and papayas, go off for a few months to live again as hunter-gatherers, return to check on their crops, weed the garden if they find the crops growing, set off again to hunt, return months later to check again, and settle down for a while to harvest and eat if their garden has not produced. Apache Indians of the southwestern United States settled down to farm in the summer at high elevations and toward the north, then withdrew to the south and to lower elevations to wander in search of wild foods, during the winter. Many herding peoples of Africa and Asia shift camp along regular seasonal routes to take advantage of predictable seasonal changes in pasturage. Thus, the shift from hunting-gathering to food production did not always coincide with a shift from nomadism to sedentary living."

(<i>Guns, Germs, and Steel</i> p. 106)

</comment></comment></comment></comment><comment><USER10> Obnoxious. This article manifests the worst mistake in the contemporary world -- the triumph of modern cynicism over progressive idealism.

</comment><comment><USER11> I can't believe this article was up-voted. What does this have to do with hacking or startups???

I'm a little worried this site will go the way of reddit...

<comment><USER12> Yeah I agree - this belongs on reddit not the site formerly known as startup news...

There are enough reddits and diggs in the world, if hacker news is going the way of reddit and digg I'll probably pass

</comment></comment><comment><USER13> Massive self-aggrandizing factual error in the third paragraph:

 _It's a life that philosophers have traditionally regarded as nasty, brutish, and short._

Um, Jean Jacques Rousseau? Noble Savage? Only a few decades after Hobbes?

It may not be relevant to the case being made here, but _come on_. I remember writing "compare and contrast" papers on Hobbes and Rousseau in high school.

<comment><USER14> Yes, the basic idea has been re-hashed endlessly:

<http://www.thecourier.com/manifest.htm>

It sort of bothers me that this is getting upmodded--not because it's off- topic, but because it's so painfully banal--every high schooler has already thought these things through completely, just like this:

<http://news.ycombinator.com/item?id=42398>

<comment><AUTHOR> I didn't see the article as a manifesto against industrialism, despite the sensationalist title. Jared Diamond is a researcher, after all - I just found it informative to learn something about ancient societies, without jumping to conclusions from that.

</comment></comment></comment><comment><USER15> This article certainly is well documented... still I don't see why agriculture is a mistake. Yes, our ancestors were intelligent enough to understand that progress usually involves a temporary loss of comfort to achieve long-term benefits. Why is it a mistake?

</comment><comment><USER16> One of the recurring off-topic discussions on Startup News was the evolution of humanity from nomadic tribes through the Industrial Revolution and beyond. Now that the scope of the site has expanded, it would make sense that one of the most popular discussions is still the evolution of humanity. If this topic doesn't interest you, maybe you should submit a story that you find interesting.

</comment><comment><USER17> This story is only interesting as a historical artifact in itself. It was a nice example of the current "conventional thinking" refuted by that other story yesterday about how England escaped the malthusian trap. Why is this story still here and the newer one gone already? Jared Diamond is very useful in this field, so maybe vote up some of his newer stuff?</comment>


RedisMonitor: Free Redis monitoring service - <AUTHOR> http://www.redisgreen.net/redismonitor.html <comment><USER2> I would gladly pay a license fee to install this on my servers. I would not however, feel comfortable exposing my redis cluster to the whole wide world. I think they need to figure out how to offer this as an installable piece of software, that comes with either a usage or support license.

<comment><USER3> I'm not sure how they implemented this, but there is a way to implement this in a sane way, which is as a separated process that is able to access Redis, but _totally_ mediates the communication with it in a secure way.

So you install this daemon alongside your Redis servers deployment, and it calls home (to avoid opening ports at all) with SSL in order to establish a secure communication channel with the web app.

Every request received by the web app is then verified and sent to the Redis server only after validation.

<comment> why-el This is what scout_realtime[1] does, more or less.

[1] [https://github.com/scoutapp/scout_realtime](https://github.com/scoutapp/scout_realtime)

<comment><USER4> Redsmin also offers the proxified approach - [https://github.com/Redsmin/redsmin](https://github.com/Redsmin/redsmin)

<comment><USER3> It is interesting that this is open source and BSD licensed, so in theory RedisGreen could use the same stuff as well and join the effort. This is the common part of the infrastructure that makes somewhat sense to develop together.

</comment></comment></comment></comment></comment><comment><USER5> Hi, I helped build this. A few notes about security since people are asking...

RedisMonitor supports AWS security groups for people who are interested (just hit support and ask after signing up). This is the safest way to open up Redis for the security-conscious.

Standard security on a Redis server is a very long password checked at login (AUTH). All of the communication between client and server is unencrypted. We consider this reasonably safe within EC2, high risk over the open Internet.

Redis doesn't have TLS. A few clients have forks with TLS support, but we haven't audited their security at all yet and (frankly) we don't trust them at all.

<comment><USER6> You are actively encouraging a process that is vulnerable to MITM, not acknowledging that between regions AWS data transfer is over the public internet [[http://stackoverflow.com/questions/9891419/can- ec2-instances...](http://stackoverflow.com/questions/9891419/can- ec2-instances-in-different-regions-communicate-over-their-private-ip- address)], etc.

I strongly suggest you evaluate something like [http://www.tarsnap.com/spiped.html](http://www.tarsnap.com/spiped.html), a VPN, or a similar solution. This isn't just read-only access we are talking about.

<comment><USER5> I absolutely acknowledge that inter-region AWS usage is over the open Internet, and no one's encouraging bad habits like transferring unencrypted data between regions here.

VPNs are great. AWS security groups are reliable too.

<comment><USER6> I may have overreacted but I've seen people make statements like "We consider this reasonably safe within EC2..." and not realize the inter-region issue. That is why I wanted to force a clear statement.

I also think this really needs to be in your marketing copy or someone who is unaware of that is going to do that sort of thing.

Sorry if I'm being a pain but I think you are overestimating the average developer's knowledge of the potential security issues with exposing Redis like this.

<comment><USER7> Heroku offers 4 redis cloud providers. I wonder how many setups (if any) happen to go through inter-region, and if some of these providers support some kind of VPN/tunneling.

\- [https://addons.heroku.com/openredis](https://addons.heroku.com/openredis) \- [https://addons.heroku.com/rediscloud](https://addons.heroku.com/rediscloud) \- [https://addons.heroku.com/redistogo](https://addons.heroku.com/redistogo) \- [https://addons.heroku.com/redisgreen](https://addons.heroku.com/redisgreen)

<comment><USER4> Redis Cloud instances are at the same region as Heroku's (both in the US and the EU) - don't know about the rest though.

</comment></comment></comment></comment></comment></comment><comment><USER8> This violates a direct security tenet espoused by Redis itself:

"Redis is designed to be accessed by trusted clients inside trusted environments. This means that usually it is not a good idea to expose the Redis instance directly to the internet or, in general, to an environment where untrusted clients can directly access the Redis TCP port or UNIX socket." ([http://redis.io/topics/security](http://redis.io/topics/security))

Moreover, your channel, which could be accomplished with a safer read-only, verified script, enables write access to potentially production Redis servers.

Write access for a _monitoring_ service.

AUTH from Redis is _not_ the only concern in this case.

What if the Redis server has buffer overflows?

What if the Redis server has a bug lurking inside it like Heartbleed?

Even _without_ logging in with AUTH, attackers could still access and play with this Redis server because it is no longer firewalled---it has to allow you to connect to it.

As others suggest, I would figure out some _secure_ _read-only_ method of accessing the Redis server.

<comment><USER6> Read only would require a separate daemon/install package which I'm sure they want to avoid.

Tbh, my internal monitoring of Redis uses the same trick but I'm doing it on a racks inside our physical office.

<comment><USER8> It could be a simple script with a couple of commands you setup as a cron job.

Similar to Loggly setup.

Easily verifiable by hand as well if you wanted to.

A direct connection which arbitrarily sends commands to my server? Completely unverifiable as to what commands it could potentially send.

<comment><USER6> Yes, like I said they probably wanted to avoid an install process and I would only do this internally. :)

That doesn't mean there isn't a cost v. benefit decision to be made that should be left up to the end user at some point. But basic precautions [such as securing the connection properly] need to be made at a minimum.

I provided the TBH as part of the disclosure of 'I do this...but I do not use a 3rd party.' so it is viable if done internally.

</comment></comment></comment></comment><comment><USER4> For the security-minded, SSL/TLS can be easily added to your Redis server ([http://bencane.com/2014/02/18/sending-redis-traffic- through-...](http://bencane.com/2014/02/18/sending-redis-traffic-through-an- ssl-tunnel-with-stunnel/)) and Redis Cloud offers SSL plans as well. Furthermore, Redsmin has SSL support and SSL-enabled clients for Python, Ruby, Java & PHP are also out there (we helped with that, so I can recommend them fully) - [http://redislabs.com/blog/secure-redis-ssl-added-to- redsmin-...](http://redislabs.com/blog/secure-redis-ssl-added-to-redsmin-and- clients)

</comment><comment><USER6> "No Assembly Required All you need to use RedisMonitor is a working Redis URL — there's no software to install, configure, and manage."

If you are suggesting they open up their Redis instance to the outside, you probably should make clear the security implications...

I'm assuming this works via [http://redis.io/commands/monitor](http://redis.io/commands/monitor) which means you'd have write access to their redis instance if you were compromised. :/

</comment><comment><USER9> It is ridiculous to ask people to expose their Redis instances to the open internet while ignoring all the security risks associated with this, in addition to giving you full read/write access.

It wouldn't be much added complexity to require the use of something like stunnel or spiped. Or better yet a little daemon that streams the relevant data to your service; which can be audited and verified.

</comment><comment><USER10> Does it mean that your Redis server is accessible from the outside? Can you even tunnel that in TLS?

<comment><USER8> (1) Probably _yes_ unless you are inside Amazon EC2 and use some special security group settings and (hope) that all traffic and access stays within EC2 networks.

(2) It is impossible with the current setup to do that.

also there's a (3) you didn't ask, but should think about:

(3) You are giving _write-access_ to a _monitoring_ service.

</comment></comment><comment><USER11> This is a service that _needs_ an agent type setup, I am disappointed by the number of services these days that require the ability to SSH or connect directly to my systems from some unknown network.

I am deliberately going to keep my Redis inside a VPC security group that permits zero outside connectivity, I only expect my webservers/workers/monitors to connect to a database so giving some third party access violates the whole point of VPC.

I'd invest the time to either use something like bsg75 mentioned or write your own Redis stat reporting in agent in something like Go.

</comment><comment><USER12> Yet another SaaS product that wants me to open access to my systems to the world.

I feel like I'm taking crazy pills - why would anyone think this was okay?

EC2 security groups are IP-based, which is easy to fake your way past, so even their limited "security" isn't actually secure.

If this was an installable product, it looks like it would be great on my local network. Otherwise, forget it.

</comment><comment><USER13> Security groups: yes. Why no stunnel on top?</comment>


Everything Isa (2014) - <AUTHOR> http://wiki.c2.com/?EverythingIsa <comment><USER2> Python's "everything is a writable, string-indexed dictionary" is clearly meant for Javascript. Python's dictionaries are extremely non-string-indexed!

Given how descriptors work I feel like "everything is a proxy wrapper for a dictionary" encapsulates everything in Python a bit better

</comment><comment><USER3> Tangent: anybody knows what happened to C2?

<comment><USER4> I just navigated to the link directly, and everything seems fine.

[http://wiki.c2.com/?EverythingIsa](http://wiki.c2.com/?EverythingIsa)

<comment><USER5> It's all read-only now. Changes are no longer allowed, at least not as seen there.

</comment></comment></comment><comment><USER6> > PythonLanguage: everything is a writable, string-indexed dictionary.

What do you mean? Unicode or Bytes? Or Both?

<comment><USER7> In python a dictionary key can be any `hashable` object. In practice this means almost any immutable type can be used (e.g. unicode strings, bytes, tuples, etc).

However, unicode strings are by far the most common dictionary key and the core language uses them extensively.

</comment></comment><comment><USER8> Isabelle - everything is proven. (Is a proof.)

<comment><USER9> Everything isa belle, surely.

</comment></comment><comment><USER10> Shouldn't Erlang be "Everything is a process"?

And Elixir would be "Everything is a process, but in Ruby".

<comment><USER9> "Everything" is a type; "everything" is a variable.

</comment></comment><comment><USER11> JavaScript - everything is a hack.

<comment><USER12> JavaScript - everything is a hack, except when it's not a hack.

Therefore "hack === hack _/ / false_"

<comment><USER13> Checks out. NaN === NaN // false

<comment><USER14> NaN is 'not a number' A string is not a number A function is not a number If 'not a number' === 'not a number' then any string === any function

This is a joke...</comment></comment></comment></comment>


Newly found TrueCrypt flaws - <AUTHOR> http://www.itworld.com/article/2987438/newly-found-truecrypt-flaw-allows-full-system-compromise.html <comment><USER2> ...which is why you should be using VeraCrypt ([https://veracrypt.codeplex.com/](https://veracrypt.codeplex.com/), the actively-developed fork of Truecrypt)

<comment><USER3> Hm, how did they fork and change the license? Or are they just hoping the TrueCrypt authors never attempt to enforce their license?

<comment><USER4> If TrueCrypt authors are anonymous, can they even claim that they own that codebase?

<comment><USER5> In theory? Sure.

In actual legal practice? Probably not if they want to retain anonymity.

<comment><USER6> False. See below. Even if they wanted to enforce copyright, they can register as a pseudonym. They can also enforce in court under a pseudonym, as long as they can prove it's the same person with the registration.

Which may be tricky.

<comment><USER7> In the US Legal System, an accuser has to face the defendent. Not sure how they can do that and remain anonymous.

<comment><USER6> That's criminal, and something afforded to defendants.

In the civil system, which is where copyright resides, you can simply be represented by counsel and never appear at all :)

This happens all the time.

<comment><USER7> touche!

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Just to let people know. I did some digging into this yesterday

Here are the pull requests that fix the bugs.

        https://veracrypt.codeplex.com/SourceControl/changeset/cf4794372e5dea753b6310f1ca6912c6bfa86d45
        https://veracrypt.codeplex.com/SourceControl/changeset/0d9239178bab3332d0f9c911de89f6f80b65d2d1

The first version of truecrypt that is vulnerable to the accessToken bug was 6.1a, which is roughly 4 years ago. I didn't look into the other bug though....4 years was enough for me....

If you want to do the digging into release dates, I would check this repo. This was the only archive of truecrypt code I could find. [https://github.com/DrWhax/truecrypt- archive](https://github.com/DrWhax/truecrypt-archive)

If you ask me, a much more serious bug would be going from an encrypted hard drive to an unencrypted hard drive... Local Privilege Escalation is definitely a bad bug, but it's not anywhere as bad as it could be.

<comment><USER9> > This was the only archive of truecrypt code I could find

There'a also [https://github.com/AuditProject/truecrypt-verified- mirror](https://github.com/AuditProject/truecrypt-verified-mirror) (maintained by opencryptoaudit.org)

</comment></comment><comment><USER10> This is just the Windows driver enabling local privilege escalation.

<comment><USER11> "just"

<comment><USER12> From the title, I assumed it allowed disk decryption.

<comment><USER13> Agreed, that would've been much worse.

</comment></comment></comment></comment><comment><USER14> Here are the commits that fixes the issues in VeraCrypt (a fork of TrueCrypt): [https://veracrypt.codeplex.com/SourceControl/changeset/cf479...](https://veracrypt.codeplex.com/SourceControl/changeset/cf4794372e5dea753b6310f1ca6912c6bfa86d45) and [https://veracrypt.codeplex.com/SourceControl/changeset/0d923...](https://veracrypt.codeplex.com/SourceControl/changeset/0d9239178bab3332d0f9c911de89f6f80b65d2d1)

They are lot shorter that I expected

</comment><comment><USER15> Only on Windows? If so, it should be in the title.

<comment><USER16> Every instance of this story omits the 'Windows only' part. It is sort of pertinent.

</comment></comment><comment><USER17> Can someone explain why this is not just something that Microsoft should patch in windows? i.e how is this not just a windows vulnerability that you can use TrueCrypt to take advantage of? Why are drivers able to escalate privilege at all?

<comment><USER18> A driver is kernel-mode code that's written in C. It can do just about anything, and when there's a bug, you're in trouble.

I'd like to see Microsoft allow more drivers to run in user-mode, but this is just the risk you take when installing drivers. Microsoft has been tightening driver signing requirements, so you can at least be sure they're from a known source.

</comment></comment><comment><USER19> You can set a program on Windows 10 so that all users must be an administrator to run, not sure about past Windows OS versions but probably.

<comment><USER20> You could technically do that using NTFS permissions.

</comment></comment><comment><USER21> Let me guess, this has something to do with SUBST.

<comment><USER13> Wow, I hope you're joking but I can't quite tell. :/

</comment></comment><comment><USER22> So much for that great "audit" of the code.

<comment><USER23> I've seen this a lot in response to this bug.

I did not realize how poorly the general "tech savvy" public apparently misunderstands software security.

Auditing is closer to an art than a science. For any real software, no two auditors will find the same set of bugs.

Think of it as similar to QA. If you write some complex software from scratch, and give it to 1 tester to do one pass on it, do you expect every bug was found and fixed?

Like security audits, you'll still be finding bugs for years, or in some cases even decades, that were sitting there all along.

</comment></comment><comment><USER24> Local machine privilege escalation and "full system compromise" are SOOOOOO vastly not of the same magnitude at all. This click bait title is obnoxious.

I don't even _have_ non privileged users on my windows machine. Most end users don't. This could only really matter in some corporate environments but even my windows machine at work has full admin privileges.

<comment><USER25> Well, who is the target? Corporate and government customers are obviously important especially when we consider the various cyberwars going on and how much private and trusted data these companies have on us. Priv escalations are scary in my world. In the world of grandma's vacation photos? Not so much.

This is a major, major vulnerability, no doubt about it. Shame TC has a hackey Windows driver to make its pseudo-drive features work. Anything that installs a driver is dangerous in the world of Windows as it has high level permissions. I imagine organizations with strong security policies wouldn't run this and instead just run some PGP variant that doesn't use any customized Windows drivers.

>I don't even have non privileged users on my windows machine.

Technically, you do if you have the UAC enabled. You're only really an admin after UAC runs, at least in most cases. From what I'm reading this should work around he UAC if the driver is running at SYSTEM level.

<comment><USER24> >Technically, you do if you have the UAC enabled.

Interesting. Makes sense.</comment></comment></comment>


The Android (in)adequacy: How to tell if a platform is good enough - <AUTHOR> http://www.asymco.com/2011/07/02/the-android-inadequacy-how-to-tell-if-a-platform-is-good-enough/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Asymco+%28asymco%29 <comment><USER2> I admittedly have an iPhone bias, but based on anecdotal evidence, I know way too many non-technical people who have Android phones (instead of iPhones) simply because:

1) The iPhone wasn't available on their carrier 2) They received their Android phone at a very low price (or free) due to a carrier promotion 3) They hate Apple, or just want to be different

With the iPhone being available on Verizon and costing as low as $99 on contract, I don't know if Android will continue to have such amazing growth numbers after this year. Given how much money iPhone users spend on apps compared to Android, I don't see them switching to Android any time soon, especially when they're not available on Android.</comment>


Over 100,000 people say good morning to Alexa each day - <AUTHOR> https://www.technologyreview.com/s/603228/in-2016-ai-home-assistants-won-our-hearts/ <comment><USER2> Why these companies aren't giving these devices away free is beyond me.</comment>


Ask HN: What Do You Think of GEB and the Emperor's New Mind? - <AUTHOR> I have a feeling a lot of people think the second is quantum-crankish in places (I'd agree). <comment><USER2> I first read GEB when I was a teenager (and I've re-read it many many times since). It is one of the few books that made me re-think the way that I think, and it's one of my favorite books of all time. "The Emperor's New Mind" didn't thrill me the way GEB did, but I enjoyed it. I recently read "I Am A Strange Loop" and it got me thinking again :)</comment>


Ask HN: Is there a service to get your engineering resume reviewed? - <AUTHOR> Greetings,
Trying to find work as an Engineering Manager recently. I've two questions: do you know of a service where I can send my resume and get comments/suggestions for a fee? b)- are there any Engineering Managers/CTOs here who would be willing to look at my resume and offer suggestions (my email in profile)?
Thanks in advance. P.S: Edited to correct spellings etc (sorry not a native speaker). <comment><USER2> I hope it's OK to jump on the bandwagon here.

I'm a German CS graduate[1] in desperate need for some professional feedback/assessment and maybe career advice.

I have three years of experience in not very code-focused tech companies that work with legacy tech stacks where I feel no employee learned anything new during the last 5-10 years, so at work I never had anyone to learn anything from or even consider a "mentor" in any way, so I just tried to learn as much as possible by myself in my free time.

Unfortunately I have similar impressions of many of my professors (being stuck somewhere many many years ago) and fellow students (not at all being interested in recent tech).

I don't have active accounts on either GH, SO or even HN, Reddit or Twitter, I don't have a blog and I don't have any real projects/products to showcase.

I'd love to be able to just chat with someone experienced and get some feedback on where I do and don't feel skilled - even if it's really only for a couple of minutes.

I set up a mail address which is [my HN username]@outlook.com

Thank you very much in advance.

[1] I'm writing the thesis for my B.Sc. right now and will graduate in a couple of months. In German you call someone writing their thesis "graduate", I don't know if you also do in English.

</comment><comment><USER3> You're email is (not currently) in your profile. I'd be happy to take a look. I was a tech recruiter for 9 years, and am now a developer. My email is in my profile.

One thing I can tell you right now is that a key to interviewing well as an engineering manager is demonstrating an ability to make people happy (or at least content) with all the money/resources that get spent on your team. Who you need to keep happy depends on the level of the position. It could an owner, client, investors, CFO, VP of Eng., etc.

Think about asking "who needs to understand why we're spending all this money on software?", imagining the answers you'd get to that question, what you'd do to help peoole understand where all the money went, and how'd you'd get them to give you(r team) even more money when the time comes.

<comment><AUTHOR> Thank you so much. I will email you my resume for sure.

</comment></comment><comment><USER4> Resume review by Gayle Laakman: [https://www.careercup.com/resumereview](https://www.careercup.com/resumereview)

<comment><USER5> She's a champion

</comment></comment><comment><USER6> _I 've two questions: do you know of a service where I can send my resume and get comments/suggestions for a fee?_

I actually do that kind of work.

</comment><comment><USER7> Email me your resume, I'll review it.

<comment><AUTHOR> Can you kindly let me know your email (mine is in the profile)?

</comment></comment><comment><USER8> Happy to give you a general review (typically I charge 200 RMB for it). Only "simplegeek" for free please, I have a business to run.

I run a professional services firm in Shanghai, China and do resume editing on near daily basis. Trained in the US through National Resume Writers' Association in best practices, native speaker, previously 24 years on Wall Street in the US.

Give me a few days due to packed client schedule.

Regards,

Vince Fulco, CFA, CAIA Managing Director, Weisisheng Consulting vfulco[@]weisisheng.cn

<comment><USER9> Would you review others for a fee?

</comment></comment><comment><USER10> I'm not seeing your email in your profile. Adding it to your "about" section should make it public.

<comment><AUTHOR> Sorry, just added it.

</comment></comment><comment><USER11> This is something hard to automate. Maybe you can ask a befriended HR person.

</comment><comment><USER12> TopResume.com

</comment><comment><USER13> Email sent to you</comment>


TC Cribs: Inside Box's Bigger And Better New HQ – Slides, Scooters And All - <AUTHOR> http://omg.yahoo.com/blogs/the-thread-omg/jennifer-lopez-vs-emma-stone-fashion-faceoff-205511164.html

<comment><USER2> Wrong link</comment>


Ask HN: Bootstrap companies that were acquired? - <AUTHOR>

I'm interested to find out what companies were 100% bootstrapped and had a successful exit.<p>This means they did not take outside funding from angels, VC firms, investment companies etc. <comment><USER2> We were acquired.

<comment><AUTHOR> Would love to hear a bit about your story. How many years in business, how the acquisition came about, what your doing now etc.

Also saw in your profile: don't bill hourly, bill by the day. Any blog post or detail on this idea?

<comment><USER2> Founded '05, sold '12\. We had grown to be one of the largest and most stable firms in our field. I do almost exactly the same thing now that I did before.

Here's a starting point for the hourly/daily thing:

[https://news.ycombinator.com/item?id=6105004](https://news.ycombinator.com/item?id=6105004)

</comment></comment></comment><comment><USER3> I think [http://drifty.co](http://drifty.co) used to be 100% bootstrapped.

<comment><AUTHOR> They didn't have an exit and aren't bootstrapped...

</comment></comment><comment><USER4> courserank was bootstrapped and acquired by chegg</comment>


Supreme Court rules for Samsung in smartphone fight with Apple - <AUTHOR> http://www.reuters.com/article/us-usa-court-iphone-idUSKBN13V1XL <comment><USER2> The actual opinion is quite short. [https://www.supremecourt.gov/opinions/16pdf/15-777_7lho.pdf](https://www.supremecourt.gov/opinions/16pdf/15-777_7lho.pdf)

It basically states that if a single component of a multi-component device infringes a patent, then calculations of damages based on profit can (but aren't required to) consider only the profit made on that component. While the ruling is in Samsung's favor, it seems unlikely to make much of a difference in the disposition of the case.

<comment><USER3> It will make a difference in the damages

<comment><USER2> It _may_ make a difference in damages. From what I can see nothing in this decision says that the lower court must change its damage calculations. This only says that they have the option to.

</comment></comment></comment><comment><USER4> > The justices in their 8-0 ruling sent the case back to the lower court for > further proceedings.

Interesting part of Sotomayor's opinion [1]. "The parties ask us to go further and resolve whether, for each of the design patents at issue here, the relevant article of manufacture is the smartphone, or a particular smartphone component. Doing so would require us to set out a test for identifying the relevant article of manufacture ... We decline to lay out a test ..."

Sounds to me like the decision is based on the subtle specific scope of the patent(s) and or legislation on what scope is allowed.

[1] [https://www.supremecourt.gov/opinions/16pdf/15-777_7lho.pdf](https://www.supremecourt.gov/opinions/16pdf/15-777_7lho.pdf)

</comment><comment><USER5> This is probably a good precedent. If my product has 15 lines of infringing code out of 2 million, then you shouldn't be entitled to my entire profit margin. There should be some basic test by the courts to determine what percentage is liable. This means less of a payout and ideally lower incentives for patent trolls to litigate and more of a "fair" compensation instead of a winner-takes-all model that seems to be the default.

<comment><USER6> "If my product has 15 lines of infringing code out of 2 million, then you shouldn't be entitled to my entire profit margin."

If out of 2M lines of code you have 15 infringing lines, unless those lines are to something very specific and not general like say a simple random number generator anyone using that language would write the exact same way, you shouldn't have to pay jack and it shouldn't be considered infringing in the first place.

<comment><USER7> LOC is a bad analogy as it's often easy to determine coupling.

It'd be more like saying my car had tail/headlights like a Mercedes - how much of my sales/revenue is because it looks like a Merc?

<comment><USER5> Trademarks and trade dress are completely separate issues from software patents.

I can code something 100% unique with an apple logo and looks exactly like an ipad. I violate no software patents.

</comment></comment></comment></comment><comment><USER4> This was flagged for being political or some other reason?

<comment><USER8> Probably for being political. We did ask users to err on the side of flagging for one week. Clearly it would normally be on topic.

</comment></comment><comment><USER9> Wow pretty crazy that's it's fully unanimous

<comment><USER10> Lots of SC decisions are unanimous. I think the majority in fact.

</comment></comment><comment><USER11> > The 5.7 terawatt-hours of electricity Google consumed

> [Microsoft] data centers currently use about 3.3 million megawatt-hours

Come on, editor.

<comment><USER12> I think you meant to comment on this thread: [https://news.ycombinator.com/item?id=13114803](https://news.ycombinator.com/item?id=13114803)

<comment><USER13> S/he might be looking at the "ALSO IN TECHNOLOGY NEWS" section on that Reuter article and commenting the editorial there :)

</comment></comment></comment><comment><USER14> At this point, Samsung should just pay up and focus on removing the "explode" feature from their smart phones. They did copy the designs blatantly.

<comment><USER15> The engineers are working on one the lawyers on another its not like the legal team is going to roll up their sleeves and pull out some schematics.</comment></comment>


China to Lift Ban of 400,000 DWT 'Valemax' Mega-Ships - <AUTHOR> http://gcaptain.com/china-to-lift-ban-of-400000-dwt-valemax-mega-ships/ <comment><USER2> This reads like a warning against doing too much business in China? They basically blackmailed a Brazilian company into setting up a joint venture with a local Chinese shipping / ore company by forbidding their ships to enter Chinese ports?

<comment><USER3> That's basically the way foreign trade with China has always worked, particularly sea-trade. The Portuguese were consigned to stay on Macau, and trade via a guild of registered Chinese merchants in Canton, the Cohong. Later the English and others got in on the deal. And then, unhappy with the restrictions of the system, and crack-downs on smuggling opium, from 1840 to 1914 damn near every western merchant power engaged in trade wars and gunboat diplomacy to wrest free-trade agreements and other concessions.

<comment><USER4> Is there a good book that covers the history of trade with China? This sounds interesting.

<comment><USER3> Jonathan Spence's The Search for Modern China is fairly decent, although it is not light-weight.

[http://www.amazon.com/Search-Modern-China-Jonathan- Spence/dp...](http://www.amazon.com/Search-Modern-China-Jonathan- Spence/dp/0393307808/)

</comment></comment></comment></comment><comment><AUTHOR> "Signs of a thaw began appearing last September after Vale signed a deal to sell and lease back ships from China Ocean Shipping Co (COSCO), the country's largest shipping conglomerate."

<comment><USER5> Imagine the mafia started a country and then a hundred years later tried to clean up their image a little.

That's how I think of business and government there.

<comment><USER6> What do you think of Rockefeller and other early US industrialists?

<comment><USER7> ...and Smedley Butler's "War is a Racket" testimony.

</comment></comment></comment></comment><comment><USER8> This issue has been building for a while. See this 2011 article.[1] Shipowners in China were unhappy with Vale, which is an iron ore producer, using their own ships.

[1] [http://www.bloomberg.com/news/articles/2011-11-23/china- shun...](http://www.bloomberg.com/news/articles/2011-11-23/china-shunning- biggest-ore-ships-shows-2-3-billion-vale-mistake-freight)

</comment><comment><USER9> This is a really interesting site for shipping news. Here's a video about the largest floating structure in the world being built: [http://gcaptain.com/prelude-flng-taking-shape-birds-eye- view...](http://gcaptain.com/prelude-flng-taking-shape-birds-eye-view-of- largest-floating-structure-ever-built/)

</comment><comment><USER10> In some respects, not all that large; from the Wikipedia page ([https://en.wikipedia.org/wiki/Valemax](https://en.wikipedia.org/wiki/Valemax)): " _Once all 35 Valemax ships are in service and if each ship does four round trips per year, they will be capable of carrying about 15% of the annual iron ore exports from Brazil to all destinations._ "

</comment><comment><USER11> Ignoring the political issues, living in a landlocked state, it always boggles my mind reading about and seeing pictures of these huge ships. I'm not sure I've ever seen a man made object even coming close to the size of these ships.

<comment><USER12> Skyscrapers? Sporting stadiums? Megamalls? You could also probably consider large sections of the road network to be single objects.

<comment><USER11> From what I've heard, some of the larger cargo ships and oil tankers are big enough to carry the Empire State Building. And the Empire State Building is a lot bigger than any building I can think of in Colorado.

And besides, buildings just sit there. These big ships are moving machines that travel around the world. Much more impressive, IMO.

</comment></comment></comment><comment><USER13> China keeps overplaying its hand. How many case studies do you need before you realize that as a non-Chinese company you are not allowed to win. This can't end well for China.</comment>


Writing your styles in JavaScript ≠ writing inline styles - <AUTHOR> http://mxstbr.blog/2016/11/inline-styles-vs-css-in-js <comment><USER2> If anybody has questions related to the article (or anything else I might be able to answer really) feel free to ping me here!</comment>


VSCodium: Binary releases of VSCode without MS branding, telemetry and licensing - <AUTHOR> https://github.com/VSCodium/vscodium <comment><USER3> If I needed a one-time "use it and lose it" attack vector, this would be an excellent way to provide one. Imagine how many thousands of code repositories I could _successfully_ inject a backdoor into, using only a repackaged "without the telemetry" version of Microsoft's code. Y'all are far too trusting.

Edit: The point is that we all have a blind spot around risk assessment and threat evaluation when it comes to certain software topics, such as code editors and terminal software.

<comment><USER4> Never trust a binary more than you trust the person who built it and the channel you downloaded it through.

A better method might be to fork VSCode's repo and modify the build scripts and/or code to remove telemetry.

<comment><USER3> Gentoo's biggest failure to me is in persuading people that building from source is somehow safer than binaries.

Never trust a source code repository more than you trust the people who commit it and the channel you downloaded it through.

Autoupdates from a source repository that you don't review before accepting updates are no safer than autoupdates from a binary source.

<comment><USER5> > Gentoo's biggest failure to me is in persuading people that building from > source is somehow safer than binaries.

I don't think this is a big reason Gentoo users use Gentoo. At least not the knowledgeable ones.

<comment><USER6> > I don't think this is a big reason Gentoo users use Gentoo.

Exactly. The two most compelling reasons to use Gentoo are/were: 1) It's a rolling-release distribution and 2) it offers customization by virtue of building from source. I don't think I've seen the argument that it's more secure--not seriously anyway. I used it back then because I wasn't a huge fan of Linux and Gentoo seemed more familiar to me with its ports analog.

Perhaps part of the OP's confusion is the hardened profile (or similar)? I'm not sure considering their wiki currently advertises it as risk mitigation [1], but I haven't used Gentoo in probably 6-7 years (at least not consistently outside a VM) so my memory on this is likely wrong.

[1] [https://wiki.gentoo.org/wiki/Hardened_Gentoo](https://wiki.gentoo.org/wiki/Hardened_Gentoo)

<comment><USER3> To clarify: Gentoo did no harm. Many Gentoo users cited the risks of prebuilt binaries in their evangelism of Gentoo. That perceived risk remains an undercurrent in people's thinking today, even though we've generally since realized that prebuilt binaries aren't the risk we were led to believe they were back then. I blame the Gentoo evangelists of yesterdecade for this persistent "anti-binary" mindset, not Gentoo itself.

</comment></comment></comment></comment></comment></comment><comment><USER7> Thanks for doing this. This will be the canary that tells us whether Microsoft is really changed like they claim. Since they call themselves "in love with open source" [1] and letting Github "remain an open platform" [2], I expect them to not remove this project from Github. If they do remove it, whatever reason they give about wanting to provide the best possible VSCode experience is bullshit and Github will no longer be a home for open-source projects.

[1] [https://info.microsoft.com/rs/157-GQE-382/images/Microsoft-l...](https://info.microsoft.com/rs/157-GQE-382/images/Microsoft- loves-Linux.pdf) [2] [https://open.microsoft.com/2018/06/07/github- acquisition-mic...](https://open.microsoft.com/2018/06/07/github-acquisition- microsoft-commitment-open-source-developers/)

<comment><USER8> "You can recover from Microsoft and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages."

Lol Microsoft! why a random $5 number?

</comment></comment><comment><USER9> Finally. It obviously is something that flies over the heads of most people here at least by reading the comments. This is great.

<comment><USER10> I don't personally see the need, but the fact that someone _can_ do this should at least once and for all settle how "real" the open-sourceyness of VSCode is.

<comment><USER11> Some of us want to write code without shipping a bunch of usage data / telemetry / whatever back up to the Mothership.

It's the principle of the thing; and anything that shaves off a few clock cycles is fine by me.

<comment><USER12> VS Code already provides mechanisms to disable all background network activity.

<comment><USER13> Defaults matter. They matter even more given Microsoft's demonstrated history of quietly adding new telemetry and metrics which are enabled.

I have no skin in this particular game, but I'm glad to see the work being done.

</comment></comment></comment></comment></comment><comment><USER14> I appreciate this effort and am not suggesting it's not necessary. Just curious: are there any known ill-desired effects of the MS binaries? My understanding is that it's just branding and telemetry that can be turned off.

<comment><USER15> They can't be distributed in distro package managers which usually require everything to be foss.

<comment><USER16> Depends on the distro. For the main Debian repos, it's true. Others like Arch are more lenient, e.g. Arch packages the Steam client.

<comment><USER17> It's worth noting that VS Code is only available in the AUR:

[visual-studio-code-bin]([https://aur.archlinux.org/packages/visual-studio- code-bin/](https://aur.archlinux.org/packages/visual-studio-code-bin/)): Original binary from Microsoft

[code]([https://aur.archlinux.org/packages/code/](https://aur.archlinux.org/packages/code/)): Build from latest release source code

[code-git]([https://aur.archlinux.org/packages/code- git/](https://aur.archlinux.org/packages/code-git/)): Build from latest Git commit

The versions that build from source (`code` and `code-git`, AFAIK have telemetry disabled).

</comment></comment></comment></comment><comment><USER18> I don't see the beneficial element to this project. Visual Studio Code is opensource, free of charge and used by millions at this point, why would anyone want another license just because of the license alone?

<comment><USER19> The source license and binary distribution license are different. The source code is MIT licensed; nothing wrong with that. Great license for this. The binaries are provided with a different license that also covers components from third parties that may not be in the vs code repo as well as telemetry and other data gathered.

If for whatever reason you don't like this license, you can build from source. This project seems to do that and remove all of the MS branding and telemetry. There are only a handful of commits on the project so it does not look like it is massive change. The big question is whether that adds enough value and whether this project will make enough effort to keep it's fork up to date.

I agree that for the vast majority of users, using the official binaries should be perfectly fine. MS did a fine job with this product. But nothing wrong with having the choice.

<comment><USER20> Looking around, this repo is just a few ~10 line shell scripts. Very simple, and it isn't a fork of vscode. It clones the Microsoft repo directly and builds it from that.

</comment></comment></comment><comment><USER21> Nice idea.

With Chromium there is a bit of a problem with protected video codecs, but I think this doesn't apply to VSCodium.

<comment><USER22> To me, that's a feature.

<comment><USER21> Was a bit of a hassle to get popular video platforms running ;/

</comment></comment></comment><comment><USER23> Related: [https://code.headmelted.com/](https://code.headmelted.com/)

<comment><USER24> Strange way of downloading and executing the installer. Most usually you see either

1\. Pipe it to an instance of sh or bash, or

2\. Download, mark executable, run.

Instead, what they do is they run wget in a subshell and redirect the output of the subshell as input to the source builtin command.

        . <( wget -O - https://code.headmelted.com/installers/yum.sh )

Don't really see why though.

Speaking of which, the following would have been better:

        curl -sSf https://code.headmelted.com/installers/yum.sh | bash

With these parameters, curl should wait for the whole script to be successfully downloaded, and if it isn't it won't write any of it to stdout. Especially important because the authors of the above mentioned script have NOT wrapped the whole script in a function which is then called at the end of the script.

If the download fails midway and you are using wget -O - or curl without -f then you execute an incomplete script.

Also, executing the script by using the source builtin is annoying because if you answer "no" to the first question asked by this script then it closes your terminal window :<

</comment></comment><comment><USER25> Nice! I don't use VSCode, but I know a few people who do and I'll gladly point them to this build.

</comment><comment><USER26> Doesn't have the latest build for macOS. :(

<comment><USER10> Disclaimer: general comment. Not affiliated with project, etc.

I don't know about you, but I don't typically feel like shelling out $1000 to buy a machine specifically for an OS I don't use, just to build a binary to non-paying users of free software.

If Apple would provide easily installable ISOs for VBox/VMWare installations (or something equivalent), I _might_ bother setting up a build for it.

Right now it's out of the question.

<comment><USER27> > but I don't typically feel like shelling out $1000 to buy a machine > specifically for an OS I don't use

I keep seeing this argument and it honestly just sounds rather lazy when a few seconds of Googling will point you towards build services you can use without having to purchase a Macbook (for instance, TravisCI has an OS X build environment). Or if you're opposed to cloud-hosted build tools for some reason you could ask users/the user requesting a macOS binary would mind working with you to test your build script(s) for compatibility and mention that Mac users will have to build from source in your README. This whole "well I would if Macs weren't so expensive" sounds like "I just don't want to support macOS" because you have options if you actually were interested.

<comment><USER28> > This whole "well I would if Macs weren't so expensive" sounds like "I just > don't want to support macOS" because you have options if you actually were > interested.

Mac development is a bit more complicated than running MacOS on a CI, especially with GUI apps.

And of course code authors prefer compiling programs themselves on their infrastructure. If you want to volunteer and provide a Mac Build then get the source do it and distribute it. But don't accuse people of being somehow lazy for not supporting mac, that's preposterous.

Apple is responsible for the situation. Don't shift the blame away from them.

<comment><USER27> > Mac development is a bit more complicated than running MacOS on a CI, > especially with GUI apps.

And this is a cross-platform project that's not exactly Cocoa-heavy (being based on Electron). The person I responded to did not say anything about creating GUIs either, so I am not sure what your point is.

> And of course code authors prefer compiling programs themselves on their > infrastructure.

Which is why Travis, Circle, Appveyor and co have zero users, as we all know.

> If you want to volunteer and provide a Mac Build then get the source do it > and distribute it

It's almost as if that was one of the things I suggested - working with the requester to provide a binary

> But don't accuse people of being somehow lazy for not supporting mac, that's > preposterous.

I said the argument is lazy, not the people. If for some reason (ideological or whatever) you're not interested in supporting macOS, then say so outright. Don't pretend as though the only obstacle between you and distributing your otherwise cross-platform software for macOS is not having a literal Mac in your hands because there are other easy options, like taking on a contributor or using a build service.

</comment></comment></comment></comment></comment><comment><USER29> This just creates more problems than it solves. If you don't like Microsoft's approach to VS Code you're better off choosing another editor to use - <USER2> are lots to choose from.</comment>


A look at the die of the 8086 processor - <AUTHOR> http://www.righto.com/2020/06/a-look-at-die-of-8086-processor.html <comment><USER2> Do we have any hope for garbage collecting CPUs 40 years later or are they a doomed venture?

> In 1975, Intel's next big plan was the 8800 processor designed to be Intel's > chief architecture for the 1980s. This processor was called a > "micromainframe" because of its planned high performance. It had an entirely > new instruction set designed for high-level languages such as Ada, and > supported object-oriented programming and garbage collection at the hardware > level.

<comment><USER3> I'd much rather have a security-oriented processor with tagged bounds checked pointers... such a facility could _also_ make garbage collecting more efficient, but what it could do for security would be wonderful.

<comment><USER4> The 8800 (iAPX 432) provided bounds checking too. Every object reference wasn't a pointer but an "Access Descriptor" that included permissions. So you couldn't access anything out of bounds. I should emphasize that this isn't like a JVM, but was implemented at the machine instruction level. It's hard to understand how strange and radical this processor was.

[https://en.wikipedia.org/wiki/Intel_iAPX_432#Object- oriented...](https://en.wikipedia.org/wiki/Intel_iAPX_432#Object- oriented_memory_and_capabilities)

<comment><USER5> Every time I hear about abandoned "improved" tech like this, I always wonder why the idea was shelved. The link kinda handwaves it away. Any good resources on why the idea didn't take off?

<comment><USER6> You'd probably have to find an Intel insider to know the real truth.

But the most likely possibility is that the plan was too grand for the time (note, this was 197x to ~ 1984ish, the IBM PC with its 8088 had only been on the market about three or so years) and therefore much too expensive for any market to bear.

Additionally, the iAPX432 was being worked upon during the same time that the IBM PC suddenly brought the x86 chips to _significant_ popularity.

Combine the concepts of pouring money into an arch. that was too big and grandiose for the integration tech. at the time, with a sudden influx of profit from the x86 chip line, and it seems that a likely reason was simply to devote resources to the chip line that was suddenly producing those same resources.

The Wikipedia page ([https://en.wikipedia.org/wiki/IAPX432](https://en.wikipedia.org/wiki/IAPX432)) also says this about the '432:

"Using the semiconductor technology of its day, Intel's engineers weren't able to translate the design into a very efficient first implementation. Along with the lack of optimization in a premature Ada compiler, this contributed to rather slow but expensive computer systems, performing typical benchmarks at roughly 1/4 the speed of the new 80286 chip at the same clock frequency (in early 1982).[7] This initial performance gap to the rather low-profile and low-priced 8086 line was probably the main reason why Intel's plan to replace the latter (later known as x86) with the iAPX 432 failed. Although engineers saw ways to improve a next generation design, the iAPX 432 capability architecture had now started to be regarded more as an implementation overhead rather than as the simplifying support it was intended to be."

<comment><USER7> That makes sense. I remember absolutely huge data sheets and reference manuals for the IAPX432. So it's very possible that Intel didn't think hard about re- licensing the somewhat janky 0x86 design because they expected it to be a dead end.

<comment><USER8> Historically speaking, I'm not sure if Intel ever -wanted- to license x86.

The main reason that AMD (and others) manufactured x86 CPUs early on was because IBM had a 'second source' requirement; i.e. there had to be another vendor who could provide the same part.

So an AMD 286 was no different from an Intel 286.

By the time of the 386, IBM had relaxed/dropped the second-source requirement. Thus the Am386 isn't the same design as the i386 (and there was a court battle to try to keep the AMD part out of the market.)

tl;dr - Intel never wanted to license at all.

<comment><USER9> Am386 was reverse engineered design, but microcode was 1:1 Intel copy :). There was no court battle over this chip. Intel was forced into arbitration due to second source agreements, and lost.

Court battle was over 287 and later Am486. AMD announced clean-room design ... and gave their clean room engineers 386 microcode copy :]

[https://www.sec.gov/litigation/admin/3437730.txt](https://www.sec.gov/litigation/admin/3437730.txt)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> I used the CONV-86 8080 to 8086 converter tool mentioned in the article on a project back in 1983. It really worked quite well, with hardly any fixup required on a fairly large (at that time) code base.

I remember thinking that the 8088 (in the IBM PC) was a speed demon compared to the 8080 (in the CP/M system I was converting from).

<comment><USER11> I tried to track down that converter for a retro computing project about 10 years ago and failed; [https://stackoverflow.com/questions/2038929/where-can- i-find...](https://stackoverflow.com/questions/2038929/where-can-i- find-a-8080-to-x86-assembler-conversion-tool)

A few months ago I returned to the project and completed it this time; [https://github.com/billforsternz/retro- sargon](https://github.com/billforsternz/retro-sargon)

As I should have realised the first time, you can write your own converter in an afternoon or two :-)

<comment><USER10> CONV-86 came on 8" floppy disk for the ISIS-II operating system on Intel MDS development boxes. Even if you found a copy, you'd need an MDS-80 to run it on.

After the IBM PC came out, everyone tossed their MDS-80 systems when Intel started to provide their tools on MS-DOS.

With the current interest in retro computing, I wish I had saved more stuff from back then. I kick myself for not saving an Intel i960CA evaluation board that I used in 1992. I loved the i960 architecture and developed quite a few products with it.

However, I still have the processor from that board because I replaced it with an i960CF.

[http://www.w6rz.net/IMG_0035.JPG](http://www.w6rz.net/IMG_0035.JPG)

<comment><USER11> The funny thing is, back in the day I wrote a 8080 emulator that could run CP/M programs on MS-DOS, and then I went the extra mile and adapted it to run ISIS-II programs for the Intel blue boxes we had. There were some 8051 Dev tools I thought were worth bringing over. But that would have been in the 80s, and the 8 inch drives went to the landfill decades ago. So yeah.

<comment><USER12> Of course if you had a NEC V20/V30 (pin-compatible 8086 clone), it had a special mode for running 8080 code! It couldn't run Z80 code because it lacked the extensions like LDIR.

<comment><USER11> If you read the GitHub page I linked to earlier you'll see I digress as far as a discussion of the NEC V20 :)

</comment></comment></comment></comment></comment></comment><comment><USER13> You gotta love that weird segmented memory model though, to allow it to address up to 1MB of RAM using 20 lines, combining a pair of 16 bit registers to generate the 20 bit address. The Motorola 680x0 was a bit saner.

<comment><USER14> I think that the face of computing would have changed quite dramatically if Intel had decided to make the x86 segment paragraph size 256 bytes (8 bits) instead of the useless 4 bits. Imagine not having a 640K (or 1MB) ceiling (without hacks like "expanded" or "extended" memory). It would not have been a big deal for Intel to do this; I'm pretty sure they could have multiplexed four more pins worth of address lines.

It would have given the x86 a native 24MB address space, equal to the 68000's physically provisioned 24 bits (which is all most 68K systems supported anyway, certainly the Atari ST and the Mac).

For instance, in the mid 80s, VisiCorp was trying really, really hard to fit their products into 640K. They had some whizzy stuff, but the address space problem pretty much killed them. Later, Microsoft and IBM came along, did the disgusting memory-space hacks that plagued users for a decade or more, and VisiCorp foundered.

<comment><USER15> _"It would have given the x86 a native 24MB address space, equal to the 68000 's physically provisioned 24 bit"_

That would be 16MB (plus possibly 65,536-256 bytes, depending on whether they added a bug on address wraparound ([https://en.wikipedia.org/wiki/A20_line)](https://en.wikipedia.org/wiki/A20_line\))).

Also, the 68000 would still have the clearer upgrade path, as the 24 address lines restriction was in the design of the chip, not in its architecture. As long as code didn't assume addresses were modulo 2²⁴, code would run unmodified on a CPU with over 16MB memory, and use all of it.

Also, the idea with the 8086 was that programs would actually use 16-bit pointers for objects, not 20-bit ones. That would be wasteful of memory if the granularity of such addresses were 256 bytes.

<comment><USER14> I meant 16MB, of course. Duh.

Argument still stands.

</comment></comment></comment></comment><comment><USER16> This is a fascinating article!

I remember back in my early CS courses where the teacher explained "microcode is this or that" and it sounded so _dry_. He could have explained microcode was magical goblins for all I cared. It didn't help that I knew nothing (and still don't) about circuitry.

But actually seeing _registers_ and _microcode_ there in the photo is amazing. All this stuff I was taught about actually has a physical form that can be seen!

The lowly 8086 really went a long way from its humble origins.

<comment><USER17> Yeah... Almost like a cute cub to a carnivorous monster.

<comment><USER16> Or from mogwai to gremlin ;)

</comment></comment></comment><comment><USER17> > _the 6502... didn 't use microcode_

Hmm, the top part of the die shot looks like microcode to me:

[http://visual6502.org/images/6502/6502_top_op10x_BF_4677.png](http://visual6502.org/images/6502/6502_top_op10x_BF_4677.png)

<comment><USER4> The 6502 has a PLA, as do many other early microprocessors such as the 6800, 8080, and Z-80. The PLA is a structured arrangement of logic gates, rather than a microcode ROM. But they both have a similar grid-like appearance.

<comment><USER12> Of course you're the expert here, but isn't this a little nitpicking? The decode logic of the Z80 (from your site[1]) works in much the same way as microcode by stepping through a set of fixed "instructions".

[1] [http://static.righto.com/images/z80/z80_labeled_bus_addr.png](http://static.righto.com/images/z80/z80_labeled_bus_addr.png)

<comment><USER6> > Of course you're the expert here, but isn't this a little nitpicking?

No, a PLA [1] and a microcode ROM are two very different animals.

A PLA is a way of compactly specifying combinatorial logic circuits (arrangements of and/or/etc. gates) and in the form that gave it the name, it is end user programmable (the P stands for Programmable). But at its heart, a PLA is just a big arrangement of logic gates. A signal goes in, and after the necessary gate delays settle, the result signal comes out.

Microcode is literally a "program" and is 'executed' in the same way that all other programs are executed, one instruction at a time, addressed by a program counter. There are also often branching instructions that generate new program counter values to use to sequence through the various steps. None of which exists in a PLA.

The appearance of similarity arises because both look similar in a silicon die photo (rows and columns of transistors), but they are very different and perform quite different functions on the chip.

[1] [https://en.wikipedia.org/wiki/Programmable_logic_array](https://en.wikipedia.org/wiki/Programmable_logic_array)

<comment><USER18> I suspect that at the time microcode was copyrightable while masks (and therefore PLAs) were not (note the actual (C) message on the die explicitly calling out the microcode)

<comment><USER2> Is 8086 microcode reverse engineered or released today for studying?

<comment><USER19> Not yet, but with these new high-resolution die photos it is only a matter of time.

Meanwhile the US4449184 patent [1] referenced in the post's footnotes has a lot of information about how the microcode works (and the meaning of the 21 instruction bits) and, in Tables 7-12, shows the microcode listings for some of the microcoded 8086 instructions.

[1] [https://patents.google.com/patent/US4449184](https://patents.google.com/patent/US4449184)

</comment></comment></comment></comment></comment></comment></comment><comment><USER20> Wow another great post!

I had a question about the following passage:

>"The photo above shows part of the microcode ROM. Under a microscope, the contents of the microcode ROM are visible, and the bits can be read out, based on the presence or absence of transistors in each position. The ROM consists of 512 micro-instructions, each 21 bits wide."

I was curious why 21 bits? I would have expected this would have been a multiple or instruction size or perhaps also 16 bits. Or is there really no correlation between size of an instruction and it's underlying micro-ops?

One other question I had was in regards to the "Closeup of some transistors in the 8086" photo where the author states:

>"The circles are connections (called vias) between the silicon layer and the metal wiring, while the small squares are connections between the silicon layer and the polysilicon."

Vias are alway vertical correct? So are we looking at the chip from the top looking downward then? Why don't we see the metal layers then? Or do the metal wires themselves constitute the metal layer?

<comment><USER4> Why 21 bits? The first factor is there is absolutely no need for an instruction to be 8, 16, or 32 bits. Modern processors use these sizes to be compatible with the 8-bit byte, but older processors used whatever word size was convenient: 12 bits, 13 bits, 17 bits, 27 bits, or pretty much anything.

The second factor is that (as you suspect) there isn't any connection between the size of the machine instructions and the size of the micro-instructions.

Finally, the width of a micro-instruction depends on how much you want to control at once. You can have a micro-instruction that is 100 bits wide, letting the processor do different things in parallel (e.g. IBM 360 mainframe), or a very short micro-instruction that doesn't do very much. The choice of 21 bits is enough for each micro-instruction to do two things (a data transfer and an operation). Having a 100-bit wide micro-instruction would improve performance but make the ROM too large, so it is a tradeoff. (Lookup vertical and horizontal microcode for more information.)

For your second question, the photos are all looking downward onto the chip through a microscope. In the first die photo, you're looking at the metal layer. But in the closeup photo, I've removed the metal and polysilicon layers with acid, so you see the silicon layer. It's tricky to show how all the overlapping layers are connected, so I didn't do that in this post. But I have another post that shows how the layers work together in the 6502: [http://www.righto.com/2013/01/a-small-part-of-6502-chip- expl...](http://www.righto.com/2013/01/a-small-part-of-6502-chip- explained.html)

<comment><USER20> >"Modern processors use these sizes to be compatible with the 8-bit byte, but older processors used whatever word size was convenient: 12 bits, 13 bits, 17 bits, 27 bits, or pretty much anything."

Indeed. I guess it's easy to forget that processor in the 1950s up until 1970's or really before the microprocessor era were all over the map with word sizes.

Thanks for the clarification of the die photo. That makes sense.

By the way I really enjoy these posts and the discussions. Keep up the great work. Cheers.

</comment></comment></comment><comment><USER21> You can get exposed chip dies on keychains from the intel merch store, which when i worked there i believe was in SC5 building.

We had hige prints of the designs of many chips on the wall in our lab.

They were super cool looking.

I always regretted not taking some home.

Before multi-cores existed, i recall asking some colleagues there, "why cant we just stack multiple cpus on top of eachother?"

<comment><USER12> _> Before multi-cores existed, i recall asking some colleagues there, "why cant we just stack multiple cpus on top of eachother?"_

I guess you know this already, but the answer is you were right. You can, but heat dissipation is a real problem. The technique is called 3D ICs. [https://semiengineering.com/stacked-die- changes/](https://semiengineering.com/stacked-die-changes/) [https://en.wikipedia.org/wiki/Three- dimensional_integrated_c...](https://en.wikipedia.org/wiki/Three- dimensional_integrated_circuit)

<comment><USER21> Yeah - basically, a (like a couple years, that first comment was made in ~1998) while after that comment I went on a hike with a guy in research and we were talking about then secret research that was happening - and he stated they had a 64 core version (yes, 64 cores - but I do not know how functional this test chip was - just that the number of cores was 64) on a test chip that could function.

This was in ~2002 or so? I cant recall.

But the compute power was low - it was more about the interconnects, IIRC?

Anyway -- I ran the gaming lab and was responsible for testing games with SIMD instruction optimizations against games on the first celeron and pentium based CPUS to determine if they passed a subjective muster, as intel would give a company $1MM in marketing funding if they advertised their games as being opt for intel procs...

My greatest claims from intel was:

I never once sat in my cube.

I had the same pee schedule as Andy Grove and for some reason, like every single time I went pee... he was there also and we peed "together"

The most I ever said to the Titan was "Hi How Are You" GOTO 10 "Oh Shit, He Is Here Again"

</comment></comment></comment><comment><USER22> I'm excited for someone to actually reverse engineer that 8086 microcode. Curious what might come out of that.

<comment><USER4> Yes, it will be interesting to look at the microcode. Intel's 8086 patent discusses the microcode in some detail and gives examples of the microcode for a few instructions. So I'm not expecting any huge surprises.

[https://patents.google.com/patent/US4449184](https://patents.google.com/patent/US4449184)

<comment><USER23> Do you have any sort of automated technique to extract microcode from a picture, or do you do it all by hand?

<comment><USER9> [http://caps0ff.blogspot.com/](http://caps0ff.blogspot.com/) guys have a collaboration tool and they often ask people to help with filling/validating mask image to bits conversion

</comment></comment></comment></comment><comment><USER24> And what about 8088? Because it become more popular due 8 bit I/O data channel.

<comment><USER4> I've ordered an 8088 so I can compare the internal circuitry of the chips. They should be mostly the same, except that the 8088 has an 8-bit data bus externally and has 4 bytes of prefetch buffer instead of 6.

<comment><USER18> remember that the address and data pins are multiplexed - the 8088 and 8086 have the same number of pins

My guess is that the prefetch buffer is always 6 bytes but the 8088 fetches instructions more slowly and never fills it past 4 instructions

I think they're probably the same die, the thing to look for is whether there's a bonding difference

<comment><USER25> > I think they're probably the same die

Very unlikely. The 8088 was developed after the 8086, and there are more pin differences including m/io inverting to io/m.

<comment><USER13> Now I really want to get a 8086 on a bread board and see if I can do things with it! What else do I need to put on the breadboard to build a minimum computer?

<comment><USER26> Probably just a voltage regulator, a clock source, reset pin logic, a couple ROM chips (2 8-bit wide chips or 1 16-bit wide), some static RAM, a PAL/GAL/74xx logic for address decoding and chip select pins, stuff to deal with the multiplexing, and whatever input/output you want (bus buffers for parallel I/O, off the shelf UART chips, etc)

I've only done it with the 6502 and Z80, but the 8086 shouldn't be too much harder. There are plenty of resources available online for those two chips that you could adapt!

</comment></comment></comment></comment></comment></comment><comment><USER27> How can you tell what section is the adder by the shape of wirings?

<comment><USER4> The registers are made of small repeated blocks, one per bit, so they form a grid. The adder (and ALU) is also repeated for each bit, but each unit is much larger and more complex. It also helps that the block diagrams and patent diagrams roughly match the die layout.

</comment></comment><comment><USER28> I was current on every other processor of this era, but I avoided 8086 because of the crappy addressing scheme. They (apparently) wanted to keep some sort of connection to 16-bit addressing, so they came up with the "segment registers", which were a real kludge. I guess I was wrong, and once they graduated from "real mode", it got better.</comment>


HTML5 QRcode-Reader (Demo) - <AUTHOR> http://miniqr.com/docs/demo/

<comment><USER2> Minor niggle: do you perhaps mean "flash-free" or "pure HTML/javascript"? It's starting to weird me out that folk are building up 'HTML5' as an meaning client-side, script-heavy, and fancy.

Otherwise, very cool idea! I always figured QR recog should be something utterly trivial (read: WhyTF do I normally need a multi-megabyte app for this!?).

<comment><AUTHOR> well, it's HTML5 as it uses the <video> element - which is a core of HTML5, and the awesome new getUserMedia-function and get UserMedia produces MediaStreams, which is part of HTML5.

so yeah, this is HTML5 and JS and fancy.

as yeah, now reading QR codes is trivial.</comment></comment>


Report on 2013 London Dreamliner Fire - <AUTHOR> http://www.aaib.gov.uk/cms_resources.cfm?file=/S4-2014%20ET-AOP.pdf

<comment><AUTHOR> tl;dr: Battery pack shorted out because the wires got pinched in the cover plate.</comment>


You might not need to build that script anymore - <AUTHOR> https://www.netlify.com/blog/2017/03/07/you-might-not-need-to-build-that-script-anymore/ <comment><USER2> Am I weird for really not wanting to rely on a company just to help me release an update to my site?</comment>


The Long Life and Quiet Death of True Detective Magazine - <AUTHOR> http://truecrime.io9.com/the-long-life-and-quiet-death-of-true-detective-magazin-1725094095

<comment><USER2> And I was just flicking through online at archive.org and found a bunch scanned:

[https://archive.org/search.php?query=true%20detective&and[]=...](https://archive.org/search.php?query=true%20detective&and\[\]=mediatype%3A%22texts%22)

Love the covers...</comment>


Shambles, made by Notch in 7 days - <AUTHOR> http://www.youtube.com/watch?v=Ud5l0Hy_PoM

<comment><USER2> Direct link to game: [http://shambles.notch.net/](http://shambles.notch.net/)

I thought it was kind of interesting. It seems procedurally generated. There even appear to be caves! No surprise there coming from Notch.

The big problem I have is, even for a 7dfps, there's not much to do. I'm not a big fan of collecting score pellets.</comment>