State considered harmful: A proposal for a stateless laptop (2015) - <AUTHOR> https://blog.invisiblethings.org/2015/12/23/state_harmful.html <comment><USER2> I've started running Tails on my laptop on a daily basis. It's great. [https://tails.boum.org/](https://tails.boum.org/)

It runs off a USB stick and presents a pristine system each time you boot. Modifications to the filesystem go on a ramdisk "overlay", which disappears as soon as you power it off.

It does support "encrypted persistent storage", but there is quite fine- grained control over what things are allowed to go in it. In particular, nothing to do with the web browser persists across a reboot unless you go quite far out of your way to make it persist. And each time you boot, you can opt not to unlock the persistent storage if the work you want to do is either liable to get you infected with malware, or just doesn't need any of your persistent data.

Additionally, all of the networking is done over Tor, and the firewall blocks non-Tor traffic, so you can't even miss out Tor by accident. (But if you don't want to use Tor, it's probably not for you, although having used Tor in the past, I was pleasantly surprised how much faster it is now than it was then).

EDIT: And for those who don't know, OP is developer of [https://www.qubes- os.org/](https://www.qubes-os.org/) which I tried out for a while, and really like the premise of, but found just slightly too inconvenient to use, and I currently prefer Tails.

Qubes has multiple container VMs. All applications run inside a VM, but the I/O is transparently multiplexed into one desktop environment. The window decorations tell you which VM each application is running in. You can copy and paste, and share files, between different VMs, but only where you explicitly want to. You can create VMs to separate data for different purposes (e.g. one just for email, one just for web browsing, and different ones for working on different projects). The VMs can even run different OS's, and there are VMs included by default that route all of their internet over Tor. It is great.

<comment><USER3> I don't think it's relevant to the article. If your host machine has malware in CPU firmware, then it doesn't matter whether you boot from [stateless] USB, because malware sits between your kernel and, say, keyboard, network card, or display.

<comment><USER4> sounds horrifying

can you point to any resources on a few things:

(o) examples of these kinds of malware, either code or writeups

(i) ways of detecting these kinds of malware

(ii) ways of removing these kinds of malware

(iii) ways of preventing these kinds of malware from getting installed

<comment><USER5> [https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p7...](https://www.archive.ece.cmu.edu/~ganger/712.fall02/papers/p761-thompson.pdf)

[http://spritesmods.com/?art=hddhack&page=5](http://spritesmods.com/?art=hddhack&page=5)

[https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf](https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf)

<comment><USER4> it looks like all of your links are basically only addressing my initial list item

the first link is about modifying a system's c compiler which the op's tails live usb is infact a solution to

the second is about altering firmware on harddrives, which is an engrossing writeup, thank you, but does fall short of suggesting ways to identify and remedy such an invasion

your third one is about intel's ME which i figured i'd see someone link to

unfortunately, the really interesting listed elements in my original post are the preventative and resolutive elements

</comment></comment></comment></comment></comment><comment><AUTHOR> Hi. A lot of interesting and intelligent comments, but I think that on the whole, we've over-complicated the issue.

To explain what I mean, consider a Commodore 64, Apple IIe, or Atari 800, Ti99 4a, or Radio Shack Color Computer, or most home computers from the early 1980's.

None of these computers, NONE OF THEM, had any form of persistent memory (Flash, EEPROM, battery-backed CMOS, CPU persistent memory, etc.) such that when you unplugged the computer and plugged it back in, something, even so much as a single bit was changed.

In other words, you unplug, and you start over with the exact same initial STATE as you did the first day when you unpacked the box.

That is, software, legitimate or malware, CANNOT change the initial power-up state of the computer. CANNOT.

That is STATELESS HARDWARE.

Note that I did not include x86 PC's in my list, because they typically have battery backed up CMOS, and onboard FLASH in newer models. Those things (and places for writeable Firmware) STORE STATE, thus they change the INITIAL power-up state of the computer.

Once a computer can store state between power offs, then you could be dealing with a different machine than you were when it first came out of the box.

When that happens, now you need all kinds of crazy security asserts that whatever is in there is safe. As opposed to simply powering off, and starting fresh, knowing that you are.

<comment><USER6> All of those machines had persistent memory in the form of cassette or floppy

<comment><AUTHOR> That is correct. Storage by definition is persistent memory. But, BUT, the storage is in a format which is easily auditable to the end-user or virus- checker program. You can reformat/reinstall and start over. Show me how that's possible with undocumented storage (e.g., EEPROM, CMOS, FLASH, microcode updates, on-CPU storage, etc.) Once you've got undocumented persistent writable memory holes, neither end-user nor virus-checker can audit them. You're basically at the mercy of the code written by the vendor, or whoever figures out how to shove unwanted stuff there. Also, you can write protect your cassettes and floppies, and be fairly certain that your wishes will be respected. Can you do that with undocumented persistent memory locations in your Chipset/Motherboard/CPU/PC? Do you even KNOW about undocumented persistent memory locations in your Chipset/Motherboard/CPU/PC? And... are you sure? How sure? You see how far the rabbit hole goes?

</comment></comment></comment><comment><USER7> It's frustrating that the author is using the word "stateless" because it usually means something different in the context of computer-related topics. Maybe the title of the paper should have been something like "A proposal for an ephemeral-storage laptop" or something along those lines.

<comment><USER8> The meaning of the title was not obvious to me either. Stateless in programming means pure functional, so the first thing I imagined from the title is some sort of new pure functional CPU.

This laptop also has a state, the post-boot state is just fixed and repeatable. And, of course, the underlying technology is not different, it makes use of a lot of state, so using the word "stateless" here is certainly not the clearest language possible.

<comment><USER9> To be fair, though, not even functional programming is truly "stateless." The program has a state as it's actually executing a function. It's still remembering the functions arguments, etc. It's just that the state is extremely ephemeral, and is lost by the time the function returns.

I think this is using the word "stateless" in the same way, only over a slightly longer timescale.

</comment></comment></comment><comment><USER10> This is a particularly appropriate link right now, given that the core idea of "saving data and state is something which should be avoided" is seeing a renaissance in both privacy-focused circles and in privacy-focused regulatory policies. I love the idea that saving state is to be avoided, and I hope to see it implemented with increasing granularity, both on other people's computers (e.g. web services) and locally.

Remotely, a trend away from "You must create an account to view this cat meme, now enter your date of birth and present a working email address which we'll send a message to" is particularly appealing. And with hosted services, particularly paid ones, I'd love to see privacy policies focused on how _little_ data is kept, rather than how much. I keep hoping that the regulatory or legal or insurance environment will change such that sooner or later, companies will view stored user data as a liability more than an asset, and 'zero knowledge' will be a desirable thing.

Locally, as per-application permissions and sandboxing grows stronger, I can picture a class of applications which would be hard-restricted from saving data between sessions (e.g. the browser, a calculator, a scratch-pad app). Or perhaps, "the only data you can save must be XML, in this plaintext file, so that preferences are saved, but nothing else. Qubes (OP's baby) does this already, but I think a dash of this in existing OSes would be a small step towards big security.

As an aside, in my estimation, Joanna Rutkowska is one of the most compelling computational thinkers today. Although her work tends to be at the most elaborate-threat-focused edge of computing security, reading it, it often feels like she's already running "where the ball is going", and I wouldn't be shocked to find that in 20 years, some of the 'whoa, crazy' things from Qubes or this stateless approach are actually regularly used in mainstream computing. I have no particular threat, and no particular need, and I suspect that many of the programs I use regularly wouldn't work there, but there's a part of me that would love to spend more time in Qubes.

</comment><comment><USER11> I actually would like a stateless computer. A pure functional laptop. It could store state on the cloud as a series of changesets, and each boot would be a "checkout" of the top state. Then as you compute, you make to make new changesets.

<comment><USER12> You might be in the market for a Chromebook. Keep in mind that this isn't really what the author is talking about, though–a significant part of her paper is a desire for the ability to keep her information private, which includes measures such as removing wireless functionality.

</comment></comment><comment><USER13> It's called a 'terminal'

<comment><USER14> Or a Chromebook.

</comment></comment><comment><USER15> Interesting! I hadn't seen this work before. Honestly this seems exactly like the kind of service that would get heckled on HN in the classic Dropbox-Show- HN style. So much so that a couple of my friends and I tried to build something like this a few years ago, essentially outsourcing the end-to-end- encrypted transport of sensitive information via a user-friendly service. We thought a user should be able to designate data for transport, and then click a button, and it gets moved off the machine until some conditions are met at a later time (once you're through the border or whatever) when the data gets moved back onto the machine. Super user-friendly and built for plausible deniability. Our effort sort of trailed off into nothingness in the face of so many other random cool project ideas, in that particular way which probably most of you reading this know quite well. Though as much as people like to joke and cajole about this, it's actually a pretty interesting problem and an excellent thought experiment. If you shed your expectations, it'll send you down some pretty cool rabbit holes. PS: We sometimes use "Seems like a great Dropbox Show HN idea" as a kind of funny emphatic for project ideas when they go on the whiteboard.

<comment><USER16> I don't see the connection with "HN+dropbox". Dropbox was/is easy to do by yourself as a techie depending on your usecase.

This is not easy/possible at all and the closest I can think of, which has long ways to go in pursuit of this (and they aren't pursuing this directly (I think)), is something like NixOS - which seems to be quite popular on HN.

<comment><USER15> That's the joke [0]. But otherwise this is what I meant by "shed your expectations". Even if it were possible to prove something was not possible, how would _you_ build it? There might be some free money in there somewhere.

[0] [https://news.ycombinator.com/item?id=8863](https://news.ycombinator.com/item?id=8863)

<comment><USER16> I know(? it feels like I'm missing something). It is just that I feel the opposite. This is exactly the type of project that HN would like. And not heckle, because there are no similarities with the Dropbox case.

<comment><USER15> I mean, at the time of my posting this, literally _every other top-level comment but two_ are kind of heckling the idea. I agree that a (working) project would be very interesting to the HN crowd. But it definitely also is an idea that many of those same people would have doubts about, very much like the Dropbox Show HN comment.

</comment></comment></comment></comment></comment><comment><USER12> Of course, even with a truly airgapped computer, people have developed side channel attacks to exfiltrate information by listening to things not generally considered to be part of the "networking" portion of the computer, such as radio signals generated by the operation of the processor.

<comment><USER17> Or using distortion in WiFi signals to record keystrokes.

[https://www.schneier.com/blog/archives/2016/08/keystroke_rec...](https://www.schneier.com/blog/archives/2016/08/keystroke_recog.html)

</comment></comment><comment><USER18> I think I must be missing something fundamental. As far as I can tell, the core notion is to move all laptop firmware to an external storage device that has a write-protect switch.

How is this better than an external write-protect switch for the firmware on the device itself? Considering my normal patterns of device usage, I'm just going to put the laptop-specific Trusted Stick into each of my laptops and leave it there. In which case I'm not seeing why it should be removable at all.

And regardless, I'm not seeing how a write-protect switch for firmware, whether on a stick or in the device, is actually better for the average user. At some point the computer is going to tell them, "Hey, you need to allow this security upgrade." How do they know when to allow writes?

<comment><USER19> Evil maid can flip your write switch.

Longer version: Boot firmware and possibly OS boot loader must be unencrypted, thus attackable by an "evil maid" if left on device. Evil maid can flip the write switch. All other storage can be encrypted and is safer to leave on device.

Alternative approach, validate state of firmware on each boot with a TPM and a 2nd trusted device that you do keep with you such as a cell phone running Google authenticator or a hardware security module (HSM). See Trammell Hudson's Heads [https://trmm.net/Heads](https://trmm.net/Heads) and what's going on with Purism and Librem key [https://puri.sm/posts/the-librem-key- makes-tamper-detection-...](https://puri.sm/posts/the-librem-key-makes-tamper- detection-easy/)

</comment></comment><comment><USER20> This was in 2015. Did he ever develop a stateless laptop?

It would be useful to have one. Too many governments want to snoop on your devices at border crossings.

<comment><USER7> I know it's not exactly the same thing but you could check out something like the Purism laptop[1] and you could run Tails from a USB key[2]

P.S. I wouldn't assume that someone called Joanna is a 'he' LOL

[1] [https://puri.sm/learn/why-purism-computers-are-better- than-p...](https://puri.sm/learn/why-purism-computers-are-better-than- proprietary-devices-from-other-vendors/)

[2] [https://tails.boum.org/](https://tails.boum.org/)

<comment><USER21> > P.S. I wouldn't assume that someone called Joanna is a 'he' LOL

There are no girls on the internet.

Joking aside, as for Tails, Whonix has advantages and drawbacks:

"Unlike Tails, Whonix is not "amnesic"; both the Gateway and the Workstation retain their past state across reboots. Not being amnesic improves security on the Gateway, by allowing Tor's "entry guard" system to choose long-lived entry points for the Tor network, reducing adversaries' ability to trap users by running malicious relays.

On the other hand, a non-amnesic Workstation could possibly allow attackers, especially operators of Web services, to inject state and associate a user's sessions with one another, despite the Tor Browser's safeguards; for some users, this could be a serious security exposure. It is possible for users to force the Workstation to be partly or wholly amnesic by manually resetting it to old states after use, although the developer does not suggest this. It is also possible to run more than one Workstation VM with a single Gateway." [1]

[1] [https://en.wikipedia.org/wiki/Whonix](https://en.wikipedia.org/wiki/Whonix)

</comment></comment></comment><comment><USER22> Direct link to the actual content: [https://github.com/rootkovska/state_harmful/blob/master/stat...](https://github.com/rootkovska/state_harmful/blob/master/state_harmful.md)

</comment><comment><USER23> I can see it now, Dumb terminals for everybody, and administered by the free country of the US of A

<comment><USER24> pay for everything you want to save, poor people screwed in yet another way by software.

</comment></comment><comment><USER25> Fedora Silverblue - [https://silverblue.fedoraproject.org/](https://silverblue.fedoraproject.org/)

</comment><comment><USER26> Why not use a normal laptop, but enable it to boot from an encrypted partition of an external drive?

<comment><USER27> How do you prevent software compromising the bios? Or SSD-Firmware? Or whatever hidden storage else is builtin?

</comment></comment><comment><USER28> Chromebook

<comment><USER29> Then all your data belongs to the web app servers.

</comment></comment><comment><USER30> I would like a phone/laptop where you can take sexy pictures and be sure they stay on the phone, and be sure they get deleted when you delete them.

Think I can get VC money for this idea?

<comment><USER31> A camera with an SD card is hardly revolutionary stuff.

</comment></comment><comment><USER32> Sincerely, with rampant hacking by nation state actors and uninspired pragmatism winning ground, I would definitely be interested in an article on "The Nation State considered harmful". Unfortunately that's not what the title was about.

</comment><comment><USER33> Can't this kinda be achieved with Windows and Windows Server with AD? You login to the server and it downloads the content for the session and when you logout the content is removed from the local computer?

I remember when in school they used to have this, which made logins take forever.

<comment><USER34> That's also the model of the popular anonymity OS Tails, but if you'd read the paper OS-level state is not being discussed at all.</comment></comment>


Google Trends - what people are searching for right now  - <AUTHOR> http://www.google.com/trends/hottrends/visualize?nrow=15&ncol=15

<comment><USER2> That's impressive. Actually found about news I haven't known (by watching what other searched for).</comment>


Germany's New Crowdfunded Train - <AUTHOR> http://www.citylab.com/commute/2016/12/locomore-germany-crowdfunded-train/510752/ <comment><USER2> While I like the idea and will probably try it out in January, I think this article takes it bit too easy. The price of the cheapest ticket maybe €22, but by that measure, I was also able to do the same journey for €14.25 with Deutsche Bahn this year. They are mostly cheaper but not that much as the those tickets are for particular trains which are also cheaper on DB. And other admenities like Wifi will also finally come to ICE this year, there are already family zones. Besides maybe the seat gurantee, the other features sound more like gimmiks to me, nice on the first look but not really world changing. I like the croudfunding aspect though.

<comment><USER3> The article is misleading the price of travel via DB, but OTOH price of DB is rather complex (its variable, and there are also options for discounts).

It is important to note the price of travel by train in Germany varies _a lot_ depending on variables. You can order your ticket months in advance and get a specific seat (in the ICE) at a specific fare (ie. a trainseat at a specific time & date). This allows for massive discounts. However you're inflexible in your schedule and spot. Consider the following hypothetical examples:

1) You order 3 months in advance and can get a discount of 75%. 2) You order 3 weeks in advance and can get a discount of only 25%-50%. 3) You want to order 2 days in advance and can't even get on the train anymore since its full (ICE). You think you can travel by ICE and buy your ticket on the spot and can't since its full. Grumbled you buy a ticket -at full price- for the RE/IC and have to swap trains all the time which also stop more often.

Note that right now its mid december so it is going to be difficult to book cheap for end of december.

Since Germany is a large country you'll practically end up travel by ICE if you travel through the country. For example, the full price of a one way ticket from Ruhr area to Berlin is ~115 EUR.

So, it is interesting how much time in advance one has to order with Locomore. Apparently one can only order online and not via DB sale points. But how does the ticket work then? Does one have to print it out or can it be shown on a smartphone?

I don't know how pricing works in other countries apart from The Netherlands. IC in The Netherlands have free WiFi, but it requires one to log in with a web browser. No cryptography is used in the connection either.

The article mentions the following:

> and a journey on a recycled (dare I say vintage) train that runs entirely on > sustainably sourced green electricity.

I'd like to know which sustainably sourced green electricity. Because nuclear energy is also considered 'green' these days. Not sure if that is true in Germany.

> Europe's railways have already seen substantial deregulation and > privatization—often, as in Britain, with highly negative results.

Yeah, there's a national system akin to Oyster card in The Netherlands. Easy to log in and out and once they swapped from Mifare, more secure. Yet if you swap train of a different company (and they're more rampant here than in Germany, apparently) you need to log out and in. If you don't, you are considered free riding and get a fine of 35 EUR plus the fare price. If this ever happens to you in The Netherlands know that you can appeal a fine once a year by phone or the website. So you can get your money back.

<comment><USER4> > I'd like to know which sustainably sourced green electricity.

They use dirty energy and buy some sort of "certificates" that are supposed to guarantee that somewhere, sometime, some sort of green electricity has been produced.

[https://en.wikipedia.org/wiki/Renewable_Energy_Certificate_(...](https://en.wikipedia.org/wiki/Renewable_Energy_Certificate_\(United_States\))

It's the same in Germany and many believe it to be a scam.

<comment><USER5> It's not a "scam". Electricity is fungible, there's no such thing as "dirty" electrons. Everything feeds into the same grid, and the math works out. Germany buys a ton of hydroelectric power from Norway, and generates its own wind and solar. What more do you want, exactly?

<comment><USER6> Could you please -- by way of the principle of charity -- assume that readers here know what electricity is?

1) It does not help the German people if green energy is generated in Norway or someone puts up a solar panel in the Sahara if _they get to breathe emissions from coal power plants_.

2) Any overly complex scheme is likely to be gamed. Any German household can order "Öko-Strom". I don't believe for a second that enough real "Öko-Strom" is available to fulfil that demand in a legitimate manner.

<comment><USER7> In (1) you assume that people buy green energy mainly or to a large extent to reduce the emissions they personally suffer from. Have you considered that a big reason for many people to buy green energy might just be to provide incentives for green energy production in order to combat emissions globally without regard for whether they personally benefit from it? If everyone consumes energy "covered" by certificates, this increases viability of producing green energy.

In (2) you say that the scheme is likely to be gamed. Can you elaborate on how that would look like? Does this "Occam's razor" necessarily mean that only simple laws are effective?

Also in (2) you claim that there is not enough real green energy available to satisfy the demand. This is obviously true but this means that the demand creates an incentive for companies to produce green energy wherever possible.

Overall what this system really provides is an option for consumers to optionally subsidize green energy producing companies and so far I have not really heard of any concrete case in which this system has been gamed. Do you know any?

<comment><USER8> I don't feel like discussing this any further after the usual stupid down- voting and rationalizations.

Go and continue to believe that the world is just, no gaming of the system occurs, as clueless and highly paid A12-A16 civil servants [1] have told you in school.

[1] German teachers are paid well in return for their indoctrination.

<comment><USER7> So, basically you believe that people are gaming the system but you have no examples of how this happens or which companies might be doing this?

<comment><USER9> Well, if the down-voters are unable to operate Google-search (as expected), here is one of the first links:

[http://www.energieverbraucher.de/de/gruener- strom__377/](http://www.energieverbraucher.de/de/gruener-strom__377/)

<comment><USER7> So now after 3 layers of us trying to coax you into giving us a little bit more concrete detail on your argument, you link an article in German which a lot of people here cannot read?

Anyway, the article's argument is that the certificates for renewable energy are created in e.g. Norway and Switzerland where it is easy to produce cheap hydropower which cannot be transported to Germany. Meanwhile the Norwegian and Swiss do not buy energy with certificates because they "know" that their energy is clean.

This is indeed true and a valid argument. However Norway and Switzerland produce only a finite amount of these certificates. If demand for certified green energy does not exceed this supply then this is simply a sign that not enough people are willing to pay extra for certified green energy which is regrettable but not a fault of this system.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Way more interesting than this is the upcoming plan to liberalize rail transport across the entire EU. This should allow effectively anybody (meeting certain standards) to operate services on common infrastructure, introducing actual competition to the passenger rail market.

[http://www.europarl.europa.eu/news/en/news- room/20160420IPR2...](http://www.europarl.europa.eu/news/en/news- room/20160420IPR24132/agreement-on-opening-up-of-the-eu-passenger-railway- market)

<comment><USER11> Are there any good studies on countries where this has already been done? Looking at the situation in Sweden where there has been rail liberalization, it seems like it mostly leads to underinvestment in the infrastructure because you can always just blame the passenger train companies... I haven't heard any happy stories from the UK either.

I'm for it in principal (especially harmonization - any train border crossing in Europe can be a nightmare) but the incentives need to be engineered _just right_

<comment> vertex-four I got shown a graph recently, when arguing for renationalisation of passenger train services in Scotland, that passenger use of the rail network started climbing significantly higher when the current franchise system came into play.

Though the franchise system isn't "liberalisation" \- it's just granting near- monopolies over certain routes in most cases. As a result, we have Virgin/Stagecoach providing the only reasonable routes from Scotland to London.

And, of course, the network in England only ever seems to receive investment where it affects Londoners. But we tried to privatise the rail network itself once, and that went very, very badly.

<comment><USER12> >use of the rail network started climbing significantly higher when the current franchise system came into play

I know more people who have long train commutes these days than I used to. That's not a function of how much better run the network is though, it's a function of rising house prices (which has been going on since the 90s) driving people further and further out.

With a nationalized rail system the same thing would have happened.

<comment> vertex-four Or did the privatised rail system allow people to more reasonably travel long distances for work, allowing people to move further out, allowing cities to grow and require more workers and thus raising house prices further out with increased demand?

Personally, I'm not really in favour of the franchise system - a concession system a la London Overground would work better in many places (inc Scotland) IMO - but I don't think it's as simple as "the franchises are doing exactly what British Rail would've done".

<comment><USER12> >Or did the privatised rail system allow people to more reasonably travel long distances for work, allowing people to move further out, allowing cities to grow and require more workers and thus raising house prices further out with increased demand?

No. The increase in house prices was both _staggering_ and coincidental with investors buying up properties an leaving them empty.

>don't think it's as simple as "the franchises are doing exactly what British Rail would've done

British Rail was neglected and lacking investment. This is part of the privatization handbook - intentionally underfund and then use that as a pretext for pushing privatization.

I think if it was well funded we'd have a cheaper, better system.

</comment></comment></comment></comment></comment></comment><comment><USER13> I think there's a market for a one route alternative "experience" train where the train isn't only the means to get from A to B but the journey itself provides value. I still vividly remember travelling to a Chaos Communication Congress on a privately operated "hack train". Must have been around 2000. Not the fastest connection but loads of fun :)

</comment><comment><USER14> I think this is more of a statement to how bad DB is. In Germany traveling with blablacar or mitfahrtgelegenheit is still very very popular, because trains are slow and incredibly expensive. Even if in my own country (Italy) people love to say that everything in Germany is better, but it's incredible to see how much worse trains are, and for 3x the price!

<comment><USER15> Imho DB is the best means of transportation in Germany, in my experience only people travelling with DB once every one or two years are complaining about it, because they don't understand how it works.

You cannot compare the standard DB fares with anything competitors offer, because they include an amount of flexibility no one else offers by a long shot.

Even if you only take 2-3 trips per year it already makes sense to get the 25% or 50% discount cards. A massive amount of germans have these cards (see [https://infographic.statista.com/normal/infografik_3025_Besi...](https://infographic.statista.com/normal/infografik_3025_Besitzer_einer_BahnCard25._BahnCard50_oder_Bahncard100_n.jpg), over 3 million BC25, 1.4 million BC50 owners).

If you know when exactly you want to travel, which exact train and hour, then you can easily get a 62.5% discount and you are only at ~45 instead of 125€ for the trip, which given the comfort of DB vs all other means of transportation is well worth the price.

I myself prefer to be flexible and have a BC50 which includes 50% discount on every trip. But that means I can take any train on the date of my ticket or even up to 5 days later, leave at any station in between for as long as I want.

My sister had an accident with car share service, which kind of turns me off these services. She now often takes the bus that is much cheaper than DB. But then you have to have someone bring you with a car to the off site locations that bus often stop and it still takes several hours longer than DB for most destinations.

<comment><USER16> > Even if you only take 2-3 trips per year it already makes sense to get the > 25% or 50% discount cards.

I'm not sure how you're calculating that, but when my wife did the math she ended up ditching the 25% card because it would have only been profitable for her if she took at least one trip a week.

I guess you're thinking ICE (inter-city high speed trains) not RB (regional transport)? I guess at >€100 per ride the numbers work out but most "normal people" I know think of ICE as equivalent to travelling by plane, i.e. something you may do for vacations but very much out of the ordinary for regular travel.

> in my experience only people travelling with DB once every one or two years > are complaining about it

I take a two and a half hour commute roughly twice a week (in addition to a daily tram commute of half an hour or so). There's no direct route and one of the two stations isn't serviced by ICE.

I could take an ICE to the interchange station but that would barely save me any time due to the long transfer wait, so instead I'm travelling by RB or RE.

The trains haven't been replaced in ages (I'd say on average at least one door is out of order on every train I've used). The RBs often don't even have working toilets. Outside periods with extremely light traffic there is generally not enough seating to accommodate all (2nd class) passengers (though 1st class is nearly empty because there's no practical difference between 1st and 2nd class service outside ICEs).

And of course trains are routinely late or delayed. Delayed trains often add insult to injury by being delayed further when they have to wait to be overtaken by an ICE. So because I know I have to switch trains I always plan for an hour longer in case I miss a connection or end up having to switch trains again.

Let's also not forget that unlike with long distance busses, "WiFi" doesn't mean "Free WiFi". There's only WiFi on the ICE and it's decidedly not free (nor significantly better than cellular) and requires you to jump through hoops if you're not already a Telekom customer (which seems anachronistic in the times of Freifunk & co).

I'm very happy that UK's National Express recently started servicing two lines in my region (RE7 and RB48). Their trains are brand new, they waste very little space on first-class seating (which is still enough for the few people travelling first-class on REs and RBs) and they provide wall outlets for charging laptops and mobile devices.

DB's ICE lines may be somewhat laudable (though still disappointing compared to the Thalys) but DB Regio's service is ripe for disruption.

Let's also not forget that DB has a track record of letting stations and infrastructure fall into disrepair to cut costs, especially the smaller stations not serviced by ICEs or ICs (which btw, look about as vintage as Locomore).

<comment><USER15> I take around 10-20 personal trips to family and friends every year, for around 1000-1500€ of "standard" fares, but pay only half with the BC50. I don't own a car. The card would cost me 250€/year so its quite a big saving. Its mostly long distance, so just for regional you are probably right it wouldn't matter.

I can't comment much on the regional experience, especially when living outside a large city. I have 3 train stations in distance of different trams. So you can be right. Although here the National Express won a contract as well and their trains are bad compared to the DB regional ones, so maybe DB is running the old trains in your region, where here in Bonn/Cologne they have very modern ones.

DB internet changed providers just some weeks ago, they now have a multi provider approach and Telekom isn't the only one anymore. Its also free for everyone even in second class on the Telekom served ones and ICs are supposed to get internet next year as well. They are even talking about adding it to regional ones.

Like with Deutsche Telekom who was government monopolist before, the competition will push the DB in a 10-20 year change cycle and after that it will be on top again with the best service and offer across the board. That kind of investment and change just takes a long time for this kind of big company.

<comment><USER16> For context: I travel between Cologne and a city near Gütersloh, which means switching trains in Hamm.

The National Express trains I'm talking about are the RB48 and RE7. There are two ways to get to Hamm besides the ICE: RE7 (National Express) and RE1 (DB Regio).

Although the RE1 is a double-decker, most of the extra space is wasted on first class seating. They do have toilets but they're tiny and usually extremely filthy. Maybe I'm particularly unlucky but as I said, the average train seems to have at least one door marked as out of order at any given time. I've actually seen an RE1 leave Hamm with an open door once (I was too surprised to take a picture though).

The main reason I prefer the RE7 is the ability to charge my laptop (allowing me to get actual work done). I also find the trains much nicer in general. The only exception was during Karneval because there is sadly no ban on drinking alcohol on regional trains (unlike trams in Cologne).

My worst experiences with DB Regio have been on RB and S trains though. I had a daily from Cologne commute to Neuss for a year and a half and none of the trains had toilets even though some of them still had signage directing you to non-existent toilets. Officially they were no longer offering toilets on S trains because travel times were short enough that passengers don't need them -- which certainly comforted me while routinely spending roughly an hour on those damn trains.

</comment></comment></comment></comment></comment><comment><USER17> It's really nice to see a project like this crop up after the rail privatisation. In the EU countries that have gone through that transition the situation for the passenger hasn't improved much and since there usually still only is a single provider for most routes the prices tend to only go up without much for it in return. That's not to say it would necessarily have been better to keep it public, just that the promise of privatisation hasn't really delivered, in my experience.

This might not be groundbreaking, it might not even work but I'm really happy to see someone try something new(ish) in this arena.

Also, trains are the best. Choo-choo!

<comment><USER16> The only thing the privatisation originally did was eliminate DB's accountability and allow them to cut costs like infrastructure maintenance. I think the mistake was to turn a state monopoly into a private monopoly.

I'm still not convinced privatising infrastructure like rail passenger transport is better than socialising it and at least on the communal level I'm convinced socialised public transport would be a better approach (i.e. treat trams and roads equivalently). But DB only really cares about their high speed trains, so it's good to see someone try to improve the rest.

</comment></comment><comment><USER18> "speed or price? A new, crowdfunded entrant in Germany's passenger rail scene is betting on the former, offering low-price but slightly slower than average"

Betting ON the former or Betting AGAINST the former?

<comment> dao- Probably confused "former" with "latter" rather than "on" with "against" :)

</comment></comment><comment><USER19> It kind of baffles me that the only long distance trains that are still being done on European scale are prestigious high speed trains (usually connecting Brussels to X) that are much more expensive than plane tickets or anything else really.

I wouldn't mind to take a trip to Paris from Amsterdam in a slower train for 20-30 euro, but this is really impossible unless you spend almost a day piecing badly connecting trains together.

Especially when it's slightly more entertaining with draft beer, coffee, wi-fi and such.

<comment><USER20> > It kind of baffles me that the only long distance trains that are still > being done on European scale are prestigious high speed trains (usually > connecting Brussels to X) that are much more expensive than plane tickets or > anything else really.

> I wouldn't mind to take a trip to Paris from Amsterdam in a slower train for > 20-30 euro, but this is really impossible unless you spend almost a day > piecing badly connecting trains together.

Looking on the SNCF website, the cheapest Thalys (i.e., "prestigious high sped trains") tickets are 35 EUR each way, which seems to require booking about a month or two in advance to get. The cheapest flights are 34 EUR each way, which seemingly similarly requires booking about a month or two in advance. So, uh, it doesn't seem like they're much more expensive than plane tickets—and the cost of getting to/from airports is likely far more than 1 EUR (given travel to/from airports tends to be more expensive than travel to/from city centres).

Obviously dynamic pricing as practiced by both airlines and train operates makes it hard to tell what's generally cheaper, but the fact that on many routes high-speed rail has caused airlines to drop routes due to lack of custom tends to imply they are competitive: if they started yanking up the prices after the airlines had dropped their routes, one would expect the airlines to reintroduce them and take back marketshare.

<comment><USER21> From experience, I can say that even if it isn't cheaper than flying, it's definitely less convenient. Amsterdam and Paris are close and popular so the trains run well, but try Echt (NL) and Meckenheim (GER) by public transport. Or Echt to Modane (FR). As soon as you cross borders it's a nightmare.

The German trains website (db.de) does a surprisingly good job (after recently having a _terrible_ experience with Belgian and, three years ago, French public transport websites) of piecing together connections, but that also means it'll happily tell you go take a bus, e.g.: bus-train-train-bus-train- train.

</comment></comment></comment><comment><USER13> I was wondering how they crowdfunded this and expected some sort of ticket prepurchase kickstarter. It seems that you can actually loan them money instead (over five years): 1500 Euro: 3,45% (6,9% if you take tickets not cash) 2500 Euro: 3,75% (7,3%) 5000 Euro: 4,15% (8,3%)

Max. of 100k

</comment><comment><USER22> I think the bus vs train analysis is missing an important dimension: travelling on the bus is unpleasant. You can't stand, your kids feel sick. The same amount of time on a train is vastly preferable.

<comment><USER23> i regularly travel from karlsruhe to munich and i can't work on the bus, since there is not enough space for my laptop. Working inside the train is pleasant and after christmas every ICE has free wifi (wow, that took forever for them to decide to implement it! Rolling out was rather quick)

</comment></comment><comment><USER24> I do the Berlin-Stuttgart train journey regularly to visit my parents and quite like taking the train as it gives me a block of uninterupted time to read, work and just plain relax that I usually take for myself.

So this sounds like an excellent way of making this even more enjoyable. I think I will give this a try next time I'm travelling south.

</comment><comment><USER25> The idea of having "zones" for people with different interests sounds good. Given the sort of amenities on offer and the unusual founding route, not to mention its Eastern endpoint, it would have been more accurate to refer to this as "zones for hipsters with different interests" though. :-)

Piss-taking aside, I think it's nicely representative of a certain "Germanness" trait which is perhaps not so well-known outside the country, where the stereotype of a population of humourless engineers still prevails.

</comment><comment><USER26> "Runs entirely on green electricity" \- so is Deutsche Bahn at times, as Germany has been reported to produce more renewable electricity than they can consume.

<comment> iso-8859-1 When the weather is nice...

See these graphs: [https://www.ise.fraunhofer.de/en/news/news-2016/germanys- ele...](https://www.ise.fraunhofer.de/en/news/news-2016/germanys-electricity- exports-surplus-brings-record-revenue-of-over-two-billion-euros)

Why would Germany sell electricity to the Netherlands but buy it from France?

Because, when the weather is bad, Germany can't produce enough to cover its own needs.

So Germany is still involved in nuclear power.

</comment></comment><comment><USER27> The 'idea' is not new, it recalls me Polish trains: old and slow but so cheap that everybody can afford them. Few years ago you could travel 500km for 15€. Despite that, there were still massive discounts (50%) for students and elders. Who cares if the trains are the fast/most comfortable if you can't afford to use them regularly.

<comment><USER28> > Who cares if the trains are the fast/most comfortable if you can't afford to > use them regularly.

People who don't need to travel 500km regularly.

</comment></comment><comment><USER16> More competition might help DB to address some of its problems, but as a commuter one of the most frustrating problems with public transport is the chaotic pricing.

Others have explained why DB's own pricing is a mess, but on a communal level public transport is even more of a mess[0]. You might think getting a "BahnCard 100" (a 100% discount card that costs ~€400/month) might be worth it if you travel a lot but if you routinely travel by train you'll also likely have to rely on public transport at your destination but bus and tram are often not part of the deal (i.e. no discount is applied whatsoever).

I live in Cologne in NRW. If I only moved around within Cologne, I could get a monthly ticket for all tram and bus transport (for ~€100/month) in Cologne from the KVB (the city's privatised transport agency). If I want to go beyond that, I could instead get a monthly ticket for the regional railway from the VRS (the regional privatised transport alliance that includes the KVB).

But although I generally stay within NRW I regularly commute to a city that's not within the boundaries of the VRS (or its parent alliance, the NVR). It's actually part of another alliance, the NWL. So I would need a ticket to move within the VRS region and then another to move within the NWL region.

But there are actually three such alliances in NRW and I need to cross the region of the third alliance to get from one to the other, which is the VRR. So I would need a ticket for the VRS, another for the VRR and then another for NWL.

But that's obviously silly, so there's also the NRW-ticket which covers the regions of all three alliances as a yearly subscription (which works out to ~€300/month).

But of course that's only for NRW (one of the sixteen states/counties in Germany) and only for busses, trams and regional rail. If you want to use the intercity or ICE trains, even within NRW, you still need an extra ticket at the full price. Likewise if you ever need to cross the borders of NRW.

As for the joys of actually using and validating the various tickets you might have to buy in addition to whichever subscription you end up with, that's what the article I linked to is about.

[0]: [http://www.wiwo.de/unternehmen/dienstleister/werner- knallhar...](http://www.wiwo.de/unternehmen/dienstleister/werner-knallhart- das-ticket-chaos-bei-bus-und-bahn-macht-arm-und-krank/9984412.html) (German)

<comment><USER29> > You might think getting a "BahnCard 100" (a 100% discount card that costs > ~€400/month) might be worth it if you travel a lot but if you routinely > travel by train you'll also likely have to rely on public transport at your > destination but bus and tram are often not part of the deal (i.e. no > discount is applied whatsoever).

What? BC100 gets you onto every DB train and also all public transportation in Germany.

"Bei der BahnCard 100 ist das City-Ticket automatisch integriert. Die BahnCard 100 gilt in den Geltungsbereichen der teilnehmenden City-Ticket Städten für beliebig viele Fahrten."[0]

[0] [https://www.bahn.de/p/view/bahncard/vorteile/cityticket.shtm...](https://www.bahn.de/p/view/bahncard/vorteile/cityticket.shtml)

<comment><USER16> Interesting. The article I linked to suggested that the general conditions for the City Ticket also apply with the BC100 (i.e. only for the destination city when travelling more than 100km).

The page you linked to also is a bit ambiguous about whether the BC100 follows those restrictions of the City Ticket or not. If what you say is true, that's pretty awesome.

<comment><USER29> > The page you linked to also is a bit ambiguous about whether the BC100 > follows those restrictions of the City Ticket or not.

Yes, and unfortunately I don't have a BC100 so I can't say anecdotally if it's true or not.

> If what you say is true, that's pretty awesome.

Since the BahnCard 100 is created for people who are traveling quite frequently, I don't see how it would make any sense unless it also included free local transit. However this is Bahn, so it may well be nonsense!

<comment><USER16> > I don't see how it would make any sense

> However this is Bahn, so it may well be nonsense!

Exactly. That's always the problem with using common sense to figure these things out.

</comment></comment></comment></comment></comment><comment><USER30> I don't know if this is still a thing in German trains in general, but the main selling point for me would be the fact that it looks like the train has coupes. A coupe is so much nice than a big open carriage.

</comment><comment><USER31> I love the idea of having a car specifically for children to play. I'd pay extra for my kids (5 and 2) to have a place to play. Just a carpeted car with basic toys like many airports have.

</comment><comment><USER32> Weird train rides in Germany?

I guess you could give this a try: [http://www.un- verschaemt.de/](http://www.un-verschaemt.de/)

</comment><comment><USER33> I own a Bahncard 100 which is a rail pass for the entire country. Unfortunately due to wtf, I cannot use it on this train. There's still a lot to be done.

<comment><USER34> Your BahnCard 100 is only for DB trains, and their partners like regional transport associations. Not sure why you suspect it to be valid for a competitor's service. And I doubt Locomore will ever partner with DB...

<comment><USER33> That's not how it works. There's the tariff union TBNE which covers almost every train in the country. I can use non DB trains without a problem (e.g. the HKX) - just not this one (and Thalys).

<comment> dao- I suspect TBNE is pretty much what your parent comment meant by "...only for DB trains, and their partners like regional transport associations."

I.e. DB would only partner with regional operators on tracks where DB itself doesn't operate anymore.

<comment><USER33> no. it's up to locomore to join, they just don't want to. same with HKX, in the beginning they didn't want to join, eventually they did.

</comment></comment></comment></comment></comment><comment><USER35> Crowd funding the new word for financed by shareholders.

<comment><USER36> Bondholders, according to a very interesting parent comment [https://news.ycombinator.com/item?id=13200369](https://news.ycombinator.com/item?id=13200369)

</comment></comment><comment><USER37> Aren't all trains crowdfunded? Isn't that what tax is?

</comment><comment><USER38> AFAIK it is not just Germany trains that are a mess (regarding fares), it is the same all over the world.

What I really hate is that every time I take a train (in Italy) I can be sure that:

1) the lady in front of me payed 30% less than me (OK, she is elderly and some discount may be fine)

2) the guy on my right payed 25% less than me (OK, he is a student, and has one of those cards)

3) the girl on my left has payed 45% less than me (OK, she has a special discount as a woman and booked the ticket in large advance)

4) the guy in businessman suit on the seat on the other side of the aisle has paid anyething between 50%, 80% or 100% less than me (OK, because he is an employee of the railway or of the government)

5) etc.

Simplified, I am the only one that is paying the full fare.

<comment><USER39> > OK, she is elderly and some discount may be fine

And who reimburses the rail company for those discounts?

> the girl on my left has payed 45% less than me (OK, she has a special > discount as a woman and booked the ticket in large advance)

"she has a special discount as a woman" \- What? I call BS.

"booked the ticket in large advance" \- better. And what's stopping you from doing the same?

> (OK, because he is an employee of the railway or of the government)

And how many of those there are?

> Simplified, I am the only one that is paying the full fare.

Simplified, you are someone who exaggerates to use as an excuse for whinging about non existent unfairness.

<comment><USER40> Thank you for responding. The parent comment has to be one of the worst HN comments I have ever read.

It is important that people who exaggerate and lie are held accountable for their words.

</comment></comment></comment><comment><USER41> Yeah, let's waste energy operate trains from the 1970's (or buses) and pretend it's a good thing because "look it's cheaper and you get organic food inside".

<comment><USER33> The locomotive is brand new. The only thing missing is regenerative braking in the carriages which DBs long distance carriages also don't have.</comment></comment>


Searchify hits a million queries a day to IndexTank search API - <AUTHOR> http://blog.searchify.com/2012/03/searchify-serving-a-million-queries-per-day/

<comment><USER2> Really confusing title. Searchify is hitting a million queries a day to their own API, and also selling themselves as an IndexTank replacement (since IndexTank is shutting down.)

Your title makes it seem like there's an IndexTank Search API.

<comment><AUTHOR> Sorry about that, I see what you mean. Wasn't trying to mislead, I just suck at titles :)

</comment></comment><comment><USER3> Is Searchify a new installation of IndexTank? It displays IndexTank "white papers" on its site...?

<comment><AUTHOR> We are running the IndexTank open-source project. We link to those white papers on indextank.com - we plan to either update those white papers or remove them. thanks for pointing it out</comment></comment>


Better dead than bad: Status competition among German fighter pilots in WW II - <AUTHOR> http://voxeu.org/article/how-status-competition-killed-german-wwii-fighter-pilots <comment><AUTHOR> > A growing literature argues that status competition can have corrosive > effects. Neighbours of lottery winners often make extravagant status good > purchases (Kuhn et al. 2011) and are more likely to go bankrupt (Agarwal, > Mikhed, and Scholnick 2016). Card et al. (2012) and Ashraf et al. (2014) > show that job satisfaction and performance suffer when there are direct > rankings and explicit comparisons with others in the same group.</comment>


Coroutines in C (2000) - <AUTHOR> http://www.chiark.greenend.org.uk/~sgtatham/coroutines.html# <comment><USER3> Some extra fun (and obscene) things along this line:

\- Use __LINE__ to make it so you don't have to manually specify the continuation number (with the caveat that you can't have more than one on a line).

\- Use computed goto and labels rather than a switch and you can make it work even inside a switch (&&label to take the address, goto *addr to goto). This is a gcc extension.

\- Use clang blocks to save state and return the block for continuation, saving you from needing to use static functions. Perhaps you could also use C++ lambdas along the same line, but I'm not sure if they mix well with the &&label thing.

<comment><USER4> I'm pretty sure the code in the article could use __COUNTER__ followed by __COUNTER__-1 in the macro to avoid the __LINE__ collision and allow more than one yield on the same line.

</comment></comment><comment><USER5> Let me rant about a bigger point: What are coroutines conceptually? Well, it's a "thing" that we use in order to express sequential code (I'm sure there is more abstract definition).

What is a difference between Erlang Proc, Golang Goroutine, Operating System Thread, and this kind of Duff's device - not much if you think about it. It's all about sequential code with a bit of context (variables) attached - <USER2> closure.

The only difference between a thread and asynchronous programming is how you deal with the context - is it explicit or implicit?

In this Duff's device, the context is passed explicitly. It's an (arguably nice) syntactic sugar over a trivial state machine.

The main point here is - how large is the context? If that's a few variables, sure you can pack them on a struct, or just async programming. If the context is somewhat non-trivial, having it implicit makes sense. If the context is really large you probably _must_ use OS / programming language help.

The problem - the larger the context, the costlier the context switch. It would be nice to have some kind of magic that would be able to chose the optimal coroutines hardware implementation based on the size of context.

<comment><USER6> > The only difference between a thread and asynchronous programming is how you > deal with the context

Coroutines are not threads. Each serve vastly different purposes. Coroutines are basically an easier way of expressing certain kinds of state machines. They're great for games when you need a character or other game object to progress through different states. They free you from 3-10x boilerplate that would be required if you had to write and manipulate a state machine directly. They're not related to threading whatsoever.

</comment></comment><comment><USER7> Today I learned: "PuTTY is a Win32 Telnet and SSH client. The SSH protocol code contains real-life use of this coroutine trick. As far as I know, this is the worst piece of C hackery ever seen in serious production code."

<comment><USER8> Wow,no kidding [https://github.com/Yasushi/putty/blob/31a2ad775f393aad1c31a9...](https://github.com/Yasushi/putty/blob/31a2ad775f393aad1c31a983b0baea205d48e219/ssh.c#L414)

It's beautiful and incredibly scary at the same time.

<comment><USER5> just wow, from the snippet you linked:

      *  - right-click ssh.c in the FileView
      *  - click Settings
      *  - select the C/C++ tab and the General category
      *  - under `Debug info:', select anything _other_ than `Program
      *    Database for Edit and Continue'.

Right, so in order to compile the thing you need to click "something other than". That doesn't sound deterministic.

<comment><USER9> That's ensuring the compiler obeys some behaviors of an ANSI C compiler when debugging in MS Visual Studio. That strikes me as the kind of practice that would improve determinism. The explanation is given on the line before your quote.

That said, I can't believe this exists in the wild.

</comment></comment></comment></comment><comment><USER10> And people are giving shit to VB for having a GoTo statement!</comment>


Judge my start up idea - <AUTHOR>

Get your own personal assistant
Imaging waking up in the morning and having your personal assistant tell you what is your schedule for the day and other information that are useful to you. Personal assistants aren't cheap, but having such service is priceless. We are currently developing a virtual personal assistance. In the morning or on your way to work, your assistant can report you the important emails, interesting news headlines, the important tweets you follow, even weather and traffic. Through configurations, you can even set up scheduled reporting and have your virtual personal assistants call you in the morning to wake you up and remind you of your daily agenda.
I am interested in what you think about this application. What do you think about this idea? What can i improve? Who do you think will buy this application? <comment><USER2> This would be tremendous, BUT, many companies have struggled and do struggle to do one of these things right, i.e., determine most important emails, most interesting news headlines, etc

Trying to do all of these is much easier said than done.

I'd personally focus on one key pain point a PA can solve (which people might pay for ideally), do that really well and then grow into other areas. Jack of all trades, master of none is not where you want to be.

Good luck! Again, in theory, the idea is great.

</comment><comment><USER3> You'll get selection bias on your feedback here, so I'll try to provide some balance.

I wouldn't use it. Verbal information is way slower for me than written, and distracting when I'm driving. I also wouldn't trust the system to prioritize correctly.

You're not removing a pain point I personally experience. If the technology works it could be cool, but it won't help me.

</comment><comment><USER4> This sounds like a very cool idea! I would love to wake up by a nice sensual voice telling me my news updates and unread emails and new facebook notifications etc. Its much better than my annoying alarm clock im using now. It would also wake me up, because i will be listening to the message for a while instead of just turning my alarm off.

Good idea! I hope it gets launched.</comment>


AppFS, a FUSE filesystem via HTTP for running software without installing it - <AUTHOR> http://appfs.rkeene.org/ <comment><USER2> This is built into OS X:

hdiutil attach [https://adiumx.cachefly.net/Adium_220.127.116.11.dmg](https://adiumx.cachefly.net/Adium_220.127.116.11.dmg) -shadow Adium.shadowfile

The -shadow option allows the image to be mounted read-write, with writes being redirected into the shadow file.

<comment><USER3> I'm not an Apple guy so let me ask a naive question: is this even close to a functional equivalent? Quick research makes this look like just mounting a remote filesystem.

That's very different than being a package format, with dependency resolution, caching equivalent files, etc.

<comment><USER2> Yes it is mounting a remote filesystem, it does not have all the same features. I was replying to the title "a FUSE filesystem via HTTP for running software without installing it," which the above command permits; the linked page (at least without exploring deeper into the site) doesn't describe dependency resolution. Caching will performed by the kernel, but I don't know how it operates in a multi-user environment.

<comment><AUTHOR> Dependency resolution is implicit to the design -- the entire global namespace is available on every system so any dependencies are resolved as they are requested.

That is, if you have an executable such as "ls" that relies upon the dynamic linker provided by "glibc", then the glibc requested will be fetched automatically because you attempted to open the dynamic linker.

Additionally, the design is superior to the single-user nature of a remote disk image in that each user's writes are redirected to their own home directory (by default, you can change this in a config file).

Even further, it allows for setuid files to be handled safely which is sometimes needed (e.g., "sudo" or "chrome-sandbox").

Caching is handled by the kernel for the VFS cache but also by a more persistent disk cache so that you can use applications offline as long as you have cached them (by running them, usually) ahead of time.

</comment></comment></comment></comment><comment><USER4> While I like the foundation of this idea, I'd love to see it taken to the next logical conclusion: Drop HTTP for a better suited protocol (like 9P), and correctly handle the interaction of union'd (namespaced) filesystems.

<comment><AUTHOR> The backend actually doesn't care about the protocol used and indeed any protocol could be transparently substituted in using the config file... However there is nothing that makes 9P better suited in this particular case since the resources requested are completely static URLs with the exception of the "index" resource which lists the SHA1 of the list-of-packages as well as the digital signature of the "index" file itself.

</comment></comment><comment><USER5> from a security standpoint, this is terrifying. one infected application over FUSE could potentially compromise thousands of users.

<comment><AUTHOR> It's the same as any other package repository being compromised. There's currently no key revokation, like most package systems but being based on X.509 it certainly supports it.

Additionally the only part of AppFS that runs as a privileged user is the daemon itself, unlike most package systems where there is an install step that can run arbitrary scripts as a privileged user.

<comment><USER5> Sadly, X.509 has been rendered useless due to certificate authority compromises, and the need to trust keys from those CA's. if something else was chosen, it might be far less terrifying.

<comment><AUTHOR> What ? The CA AppFS trusts has never been compromised and you are free to replace it. It sounds like you think SSL/TLS is being used or something or that many certificate authorities are trusted.

</comment></comment></comment></comment><comment><USER6> is this another implementation of zero-install, by the guys who did the rox filer (port of riscos file manager to *nix) ?

<comment><AUTHOR> It is very similar with some small (but significant) differences: 1\. It doesn't require a huge manifest per site, instead the manifests are broken down into: list-of-packages-per-site and list-of-files-per-package 2\. There are no special directories in the same namespace that regular files can live in 3\. It is deduplicated (every file is referenced by its SHA1) making the need for making packages share files that they have in common unnecessary. 4\. It lives in a more sane place in the UNIX filesystem (/opt) 5\. It doesn't use special characters to denote special meaning (this is why I stopped using LazyFS) 6\. It uses FUSE instead of its own kernel module</comment></comment>


PHP Q&A website - <AUTHOR> http://phpispoetry.com/

<comment><USER2> Hmm, interesting site. Looks familiar ... almost too familiar ... waaaaaitaminute: <http://phpispoetry.com/question_page/question/16> looks _just_ like [http://stackoverflow.com/questions/2283937/how-should-i- ethi...](http://stackoverflow.com/questions/2283937/how-should-i-ethically- approach-user-password-storage-for-later-plaintext-retrie) . Yup, an exact copy, right down to mentions of "bounty system" and "thanks to all the Stack users", and the only answer you have is likewise word-for-word identical to SO's highest voted answer. Is that both _your_ question and _your_ answer that _you_ asked on SO, back there in 2010? If not, see this for proper CC- attribution guidelines - SO allows for republishing of user contributions, it just requires a few simple rules to be followed for it: <http://blog.stackoverflow.com/2009/06/attribution-required/> Quote:

"If you republish this content, we require that you: \- Visually indicate that the content is from Stack Overflow, Meta Stack Overflow, Server Fault, or Super User in some way. It doesn't have to be obnoxious; a discreet text blurb is fine. \- Hyperlink directly to the original question on the source site (e.g., <http://stackoverflow.com/questions/12345>) \- Show the author names for every question and answer \- Hyperlink each author name directly back to their user profile page on the source site (e.g., <http://stackoverflow.com/users/12345/username>)

Alas, you aren't doing any of these things on the site; worse, the texts seem to suggest that you and "peter" have written all of that yourself. <http://phpispoetry.com/user/best> That is an unfortunate issue that you've overlooked; people tend to get all possessive of the stuff they're written ;)

As for the site, it looks nice and clean, and feels very responsive. Perhaps making the tags interactive would be good - but I feel you're working on that even as I'm typing this :)

<comment><AUTHOR> There are just 6 questions, I copied it from SO just to test it. :)

<comment><USER2> Yup, I was thinking that was the case, and that you didn't "act in bad faith", so to speak :) In other words, copying SO's content would actually be a good way to "preseed" the site with interesting q&a - if the attribution requirements are followed (some people get really angry when they see their own content misattributed).

Anyway, I was a bit confused about the +1/+share buttons; you might want to differentiate them a bit further. Apart from that, I like the site's extreme simplicity, both in look and operation.</comment></comment></comment>


My 3 hour weekend project: Fix My Movie Subtitles - <AUTHOR> http://www.fixmysubs.com/

<comment><AUTHOR> Being a non-native english speaker I often like to use subtitles for watching movies. While there are some very good sites like podnapisi, subtitlesource, etc unfortunately it is sometimes still hard to find matching subtitles and the sync is usually out.

So to fix this problem I wrote a Perl script for my weekend project and it was surprisingly easy to port to the web thanks to Twitter's bootstrap CSS. So here is the site. Even the domain name is merely 1-hour old!

Your questions / comments are welcome. I hope this is useful to people like me who have had trouble finding movie subtitles and also people who are hearing- impaired.

<comment><USER2> I have used dvds with foreign subtitles to learn languages. One thing I don't like is that the spoken translation is usually different than the subtitled one. I think it would be a nice learning aide if the two translations could be made to match. Or to at least have the option to put in alternate subtitled translations.

<comment><USER3> Translated words and phrases often have to be very different than the literal translation. For example: "sack" in english can also mean firing a worker, or plundering a city. The word for "a large bag" in most languages will not have these same extra meanings.

Also, you may even need 3 subtitles:

\- transcription of the spoken language: _les jeux sont faits_

\- literal translation: _the games are made/done_

\- correct/useful translation: _the chips are down_

<comment><USER4> I'm not 100% sure since I'm not the guy you responded to, but I think his situation is that he's listening to the audio in the same language as the subtitles, and they are different.

I've seen this happen when English subtitles were enabled for an English language movie I've been watching. Sometimes what is transcribed in the subtitles is different than what people are actually saying (though the gist is the same) even though both are in English.

In any case, this is clearly not something easily fixable by a website script.

<comment><USER3> Good catch. That looks right now you've pointed it out. I was thrown off by the word "translation".

</comment></comment></comment></comment></comment><comment><USER5> While I'm sure this would probably violate all sorts of copyright, I'd love a site that could provide alternate dubbed languages (specifically Spanish, German and Portuguese) for movies.

The dubbing is never quite right or simply not included (for the media I'm looking at purchasing, I always ensure that at least Spanish is covered). I'm using television shows and movies that I have nearly memorized the script to help with "immersion" between more traditional study (I took many years of Spanish and gave up ... this hack wasn't mine, it was mentioned by a coworker and it turned out to be a very clever one). In the US, it's easy to find DVD/BD versions that include Spanish (to a lesser extent, French, which I'm not interested in), but rarely include anything else in the US (and most of the stuff I want to watch includes neither).

This service is intriguing to me. I don't routinely download movies, and I'm unfamiliar with .srt and .sub formats, but I'm wondering if this could help assist reading in another language the same way it has helped in listening/comprehension and it certainly seems like your site is solving a problem I've seen when transcoding DVDs ... it used to be audio mismatch (largely a problem of the past with modern container formats), now it sounds like the same pain point exists with subtitles.

Well done.

<comment><USER6> <http://www.yabla.com> might be what you are looking for -- it's great for learning via subtitled foreign clips. The content isn't dubbed however, rather it's from those countries that speak the language natively.

</comment></comment><comment><USER7> Nice idea -- more automation would be awesome.

I wrote a simple script at one point for dealing with constant offsets by doing simple analysis on the audio track of a movie and the subtitle file to match up peaks. It worked...okay, although I was using very simple features.

It would be great to make it more robust, although I don't know if there's an easy way to upload some audio from a movie to a website (that wouldn't be a lot of work for the user).

</comment><comment><USER8> I'm also missing captions (Netflix for TV, for other devices certain movies have them).

Me & my wife used to (and still do) learn quite a lot new words from there, and also how to pronounce certain words, and understand.

Lately it was very useful for us, as we can turn down the volume, and not disturb our son while he's sleeping. Just a notch up & down for music/sounds, and reading the rest of the movie.

</comment><comment><USER9> Nice weekend project!

My current workflow to sync subtitles is to find one sentence in the beginning of the movie and one near the end, and search the subtitle text for these sentences. The four timestamps are then ran through the perl program subs (see <http://search.cpan.org/~karasik/Subtitles-1.03/subs>).

Perhaps using a search based interface, instead of letting the user pick from all lines, would be a nice extension.

</comment><comment><USER10> Hmm, good solution for the times when you can't find subtitles that match. Often VLC's subtitle sync works though (lets you adjust in hundreds of ms each way).

<comment><AUTHOR> Thank you :) Yes, there is an option in KMPlayer too (for subtitle fps conversion and time shifting) but sometimes trial and error just doesn't seem to work for me. So, I wrote this script instead (it was good fun).

As of now I've tried many different movies and deliberately downloaded the wrong FPS and time shifted it using the subtitle tool but so far it is working as it should be :)

</comment></comment><comment><USER11> It's been a while since I last used third-party subtitles for a movie but as I recall, it rarely happens that all captions are off by a constant offset. Usually the desynchronization itself stems from a movie version having longer gaps between scenes, for instance. In that case, this won't be much helpful but otherwise, good job.

<comment><USER12> That's a framerate issue, e.g. 23.976 frame/s vs. 25 frame/s. Easily correctable, not sure if this service can handle that though.

<comment><AUTHOR> Yes, it can automatically handle all frame-rate issues with time-shifting. What it can't handle is if there is an irregular break in between (say extra subtitles in between, extended versions, etc).

</comment></comment></comment><comment><USER13> I had the same need and found this a couple of years ago:

code.google.com/p/subeditor/downloads/list

Have been using this since then. It seems to take first two times to calculate the difference in speed, while third onward it just adjusts the starting point maintaining the same speed.

</comment><comment><USER14> Question: How did you know a "well" css class exists in Twitter Bootstrap. I cannot find it in the documentation, but it's in your code and it's in the Bootstrap file!

<comment><USER15> I found it in one of their demo applications. They hide a lot of stuff in there.

<comment><USER14> Got a link to their demo apps? I just have the 3 html examples linked in from the main doc sheet.

</comment></comment></comment><comment><USER16> There are sites that do this. I don't remember which but one of the sites where you can download subtitles already has a little javascript app that does the same.

</comment><comment><USER17> could you add some screenshots to explain the process?

I'll test it on my next subtitle issue :)

<comment><AUTHOR> Yes, I am hoping to add a 30 second video to explain the whole process. Basically you upload a srt file in the first screen and then match any 3 subtitle text to the correct time (as determined from watching the video).

Based on that information the script calculates the discrepancy in the frame rate or time shift by comparing it with the original file and then fixes that for you (also gives you two different versions if more than one solution fits)

<comment><USER18> Are you going to have subtitles for your 30 second tutorial video? ;-)

</comment></comment></comment><comment><USER19> I had the reverse idea. A plugin for VLC that takes the MD5SUM of whatever file you're watching and looks for the matching/appropriate subtitle file and autoloads it.

<comment><USER20> SMPlayer [1] searches opensubtitles.org with a simple hash [2].

[1] <http://smplayer.sourceforge.net/>

[2] [http://trac.opensubtitles.org/projects/opensubtitles/wiki/Ha...](http://trac.opensubtitles.org/projects/opensubtitles/wiki/HashSourceCodes)

<comment><USER19> Fantastic. Thanks for this!

</comment></comment></comment><comment><USER21> My movie player should have this integrated. Nice idea.

</comment><comment><USER22> Copyright 2012? Really?</comment>