ECDSA Key Extraction from Mobile Devices via Nonintrusive Physical Side Channels - <AUTHOR> https://eprint.iacr.org/2016/230 <comment><AUTHOR> From the abstract "We show that elliptic-curve cryptography implementations on mobile devices are vulnerable to electromagnetic and power side-channel attacks. We demonstrate full extraction of ECDSA secret signing keys from OpenSSL and CoreBitcoin running on iOS devices, and partial key leakage from OpenSSL running on Android and from iOS's CommonCrypto. These non-intrusive attacks use a simple magnetic probe placed in proximity to the device, or a power probe on the phone's USB cable. They use a bandwidth of merely a few hundred kHz, and can be performed cheaply using an audio card and an improvised magnetic probe".

</comment><comment><USER2> This is a really impressive piece of work. Unfortunately, the authors completely ignore Curve25519[0], which was designed by DJB (and implemented as NaCl[1]), with the goal to reduce side-channel vulnerabilities.

From a random Curve25519 presentation [2]:

\- No data-dependent branches.

\- No data-dependent indexing.

I really wonder how much can be extracted from a NaCl implementation under the same conditions.

[0] [https://cr.yp.to/ecdh.html](https://cr.yp.to/ecdh.html)

[1] [https://nacl.cr.yp.to/](https://nacl.cr.yp.to/)

[2] [http://cr.yp.to/talks/2006.04.25/slides.pdf](http://cr.yp.to/talks/2006.04.25/slides.pdf)

<comment><USER2> Please elaborate the downvotes. While not actually testing Curve25519 is perfectly valid for the authors, comepletly ignoring its existence is a bit far-fetched, as it is clearly in scope. To quote the first sentence of the paper: _" We show that elliptic-curve cryptography implementations on mobile devices are vulnerable to electromagnetic and power side-channel attacks."_ At least they should have said "some implementations" or "widely-used implementations".

<comment><USER3> Upvoted, you're totally correct. Each of these attacks is providing support to DJB's focus on constant time implementations of everything.

<comment><USER4> Does constant time mean constant power usage and constant EM emission? It seems like those would be separate problems.

<comment><USER5> They are highly correlated.

The best way to achieve constant time is making your code paths data independent, that is, it always execute the same instructions, whatever the data. This code will also use constant power and have constant EM emission. (Except for low level optimizations in hardware, that may break any of those characteristics.)

<comment><USER4> That parenthetical sounds extremely important! Won't executing the same instructions on different data use different amounts of power and emit different amounts of EM? For example, I would think (naively, I'm only familiar with the most basic of hardware whatnot) that multiplying 0 and 0 would not use the same amount of power and emit the same EM as multiplying 0xffffffff by 0xffffffff.

<comment><USER6> Yes, this exactly the basis of differential power analysis. This was first demonstrated back in 1999 by Kocher et al [0]

[0]: [https://www.cis.upenn.edu/~nadiah/courses/cis800-02-f13/read...](https://www.cis.upenn.edu/~nadiah/courses/cis800-02-f13/readings/kocher- jaffe-jun.pdf)

<comment><USER7> and in a video: [https://www.youtube.com/watch?v=gbqNCgVcXsM](https://www.youtube.com/watch?v=gbqNCgVcXsM)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> It's great to see this kind of work published. It is worth noting however that the US government is well aware of these kind of attacks. The Snowdon docs show that the CIA have been performing side-channel analysis since 2012 on the Iphone 4s and Ipad 2: [https://theintercept.com/2015/03/10/ispy-cia-campaign- steal-...](https://theintercept.com/2015/03/10/ispy-cia-campaign-steal-apples- secrets/)

Cryptography Research demonstrated this on an ipod in 2011: [https://www.youtube.com/watch?v=4L8rnYhnLt8](https://www.youtube.com/watch?v=4L8rnYhnLt8)

In any case, great stuff.

</comment><comment><USER8> This work is very important.

Some might dismiss it because it is no surprise that these implementations would have serious sidechannel vulnerabilities, and --indeed-- in Bitcoin Core we stopped using OpenSSL for signing two years ago for this reason. But, as cryptographers ourselves, our choices aren't all that representative of application authors in general.

I've found it to be difficult to get parties to stop using obviously vulnerable crypto code-- even businesses making "high security" hardware wallets. Everyone has many other priorities, and without a demonstration the attacks are "too theoretical" to spend time on, or to justify a software slowdown, for many people.

<comment><USER9> What was the process of learning about side channels and techniques for mitigating them when developing libsecp256k1?

It's an area I'd love to better understand.

<comment><USER8> For us it was an iterative process that started with making a commitment to do our best to do the right thing-- accepting that we don't control how the users us the software and that to do a good job we must defend against a very broad class of attacks... and that it's a good investment of time to really refine the tools here so that the users have the least time lost to worrying about the details of the underlying behavior. The earlier work on cache sidechannel attacks against OpenSSL also helped convince other people that this was important.

Pieter did a cache timing attack project against DES at his university in 2004\. I had experience with modeling fine scale algorithm delays as part of ultra-low latency audio codec work. So we had a little bit of additional background beyond regular systems programming and mathematical experience.

We spent time studying other implementations and academic papers on the subject-- just a product of searching and following citations-- and we implemented and measured (both in timing form and 'read the assembly' form). Pieter had to do some algebraic work to adapt a 'unified' group law approach to our curve and coordinate system. [Then all of this also presented additional verification work to validate that the new group law was algebraically correct.]

Because we accepted that this was going to be a considerable amount of work, we didn't refrain from trying multiple ideas and throwing things away. The libsecp256k1 codebase is written in a clean (IMO), typesafe, heavily tested way that makes iteration easier.

We initially implemented a bit-slicing approach to achieve memory access uniformity. After we thought we were at least a strict improvement over OpenSSL, we contacted an outside expert (Yuval Yarom, one of the authors of this paper, in fact) and they were kind enough to give our implementation a look-- and pointed out some additional research that showed our particular bit slicing approach was not quite constant time on common hardware. So we fixed that too.

I don't consider our work done on this-- we are likely vulnerable to differential power analysis on at least some hardware. We've implemented a basic level of blinding to harden against that-- but without a good measurement setup it's hard to tell if our efforts are helping (or maybe hurting, though that's unlikely). I loaned Thomas Daede a USRP, and he's been attempting to set up a DPA continuous integration rig for us ([https://bitcointalk.org/index.php?topic=1319848.0);](https://bitcointalk.org/index.php?topic=1319848.0\);) but it's effort that is competing with a lot of other projects for attention for all of us. Similarly some (now uncommon) hardware has things like data- variable time multipliers, and on that hardware little can be done beyond blinding; but again, without more analysis it's hard to know exactly where that stands.

</comment></comment></comment><comment><USER10> Silly question based on my layman's understanding of the attack:

Can you impede the extraction process simply by having your phone/tablet/laptop generate interference while the decryption process is happening? For instance, if your laptop is simultaneously playing music through its speakers, would the analysis still let them definitively pick out the signing key?

<comment><USER6> Valid question. You shift the burden from being a cryptography related problem to signal processing related problem.

<comment><USER11> This isn't exactly a cryptography related problem to begin with, it's an implementation issue which inherently all side channels attacks are. This doesn't mean that you can't add some resistance against side channel attacks to your cryptographic algorithm but it will cost you quite a bit in terms of performance, and for the most part it's not where it should be.

Better silicon should solve some of these issues, for example adding some additional isolation between the power section and the logic a small super-cap with decent in-band filtering might do the trick.

As far as radiating EM goes I'm not sure what can be done but some more additional shielding and EM noise reduction should add some degree of protection.

Most implementations will eventually be vulnerable to some type of side channel attacks, the complexity and cost-vs-benefit is important here.

Launching an evil USB attack on the off chance of getting a key is most likely not very scalable, but considering that NFC/wireless payments for phones will become more and more common, and that crypto-currencies might actually end up being in common day use being able to extract keys during signing from EM leakage might just be the natural evolution of ATM/Payment Cards skimmer attacks.

In the past 2-3 years we had various key extraction attacks using "strange" vectors like EM/audio extraction, temperature, cpu usage, cross platform cache attacks, these attacks can threaten cloud computing and mobile computing quite severely unless we can root them out and being to modify the devices and platforms to be much more resistant to them.

</comment></comment></comment><comment><USER12> I always see these non-intrusive side channels being applied to asymmetric cryptography. From using a microphone to listen in on GPG RSA private keys, to now the difference between point adding and point doubling in ECDSA.

But I wonder if there are feasible, modern attacks against software using symmetric encryption. For example products offering full disk encryption, or encrypted volumes. Or are the operations in symmetric ciphers so 'constant' as not to reveal anything about the master key?

<comment><USER13> From one of the same authors:

[https://www.tau.ac.il/~tromer/papers/cache.pdf](https://www.tau.ac.il/~tromer/papers/cache.pdf)

</comment></comment><comment><USER14> Side-Channel attacks are nasty. Wonder why the FBI wasn't able to use this to hack the San Bernardino iPhone 5C, the NSA must be aware of this? From the article

 _In the sequel, unless stated otherwise, the experiments were performed on Apple iPhone 3GS which exhibited a particularly clear signal._

Hope Apple fixes this in future models, even when opened.

<comment><USER15> San Bernardino 5C could be cracked in two days using a NAND flash write blocker. You only need to program an FPGA to buffer writes to NAND chips in RAM instead of passing them through and to allow the reads, then you just try N PIN codes and reboot while resetting the blocker state cache. N is 4 if they haven't tried any PINs and 1 if there are delays after each because they've tried a couple PINs already. Phone boot time is ~1 minute, T(10000) = 10000 minutes / N (= a week if N==1)

<comment><USER16> Do you have a good citation for that or is it just a personal theory?

<comment><USER4> Apple used to have a bug where they'd report PIN failure before writing that failure to nonvolatile storage. Somebody took advantage of this by building a box that cut power before the write could be performed, allowing a brute force attack:

[https://www.intego.com/mac-security-blog/iphone-pin-pass- cod...](https://www.intego.com/mac-security-blog/iphone-pin-pass-code/)

The proposal here is similar, just using a different technique to prevent the write.

There isn't any nonvolatile storage besides the flash memory, so if you can reset that then the software has no way of knowing what happened before.

<comment><USER17> Note that this was patched and is no longer feasible.

</comment></comment></comment></comment></comment><comment><USER18> This paper seems to focus on old Apple hardware (the newest I can find is the iPhone 5s). I wonder what the results would be on Apple's newest hardware (6 and above).

<comment><USER6> The Apple hardware perspective is mostly just a gimmick. The side-channel leaks are a direct result of the ARM IP core (also not Apple proprietary). This is arguably old news, people have been attacking ARM based mobile devices for years now.

It would be far more interesting to see if they could attack the Apple crypto hardware accelerators which AFAIK are hardened against these types of attack (as is the Apple CommonCrypto framework as of IOS 9). Apple seems to have ramped up their side-channel game in recent years.

</comment></comment><comment><USER19> What sorcery is this?!

</comment><comment><USER20> Oh if only there were a elliptic curve digital signature algorithm that was side-channel resistant and well studied by cryptography experts.

[https://en.wikipedia.org/wiki/EdDSA](https://en.wikipedia.org/wiki/EdDSA)

(Fortunately, we should see its adoption when TLS 1.3 is standardized.)

<comment><USER8> EdDSA is not fundamentally more sidechannel resistant; sidechannel resistance is a function of the implementation.

EdDSA's authors make a reasonable argument that it takes less work with their parameters to make a timing sidechannel free implementation which is also fast (at least for secret key operations); but "less work" isn't really the problem when comparing to a grotesquely vulnerable implementation, especially where it would be perfectly acceptable to take a slowdown implied by an especially simple way of making the operation constant time.

It would be more accurate to say that so far EdDSA has had a more conscientious implementation culture around it. But I think that won't last if too many people misunderstand sidechannel resistance as automatic there (even now one can go to lists of ed25519 implementations and get linked, without warning, to implementations which are not sidechannel resistant at all).

<comment><USER20> > EdDSA is not fundamentally more sidechannel resistant; sidechannel > resistance is a function of the implementation. > ... > It would be more > accurate to say that so far EdDSA has had a more conscientious > implementation culture around it.

Your assessment is correct. EdDSA is deterministic which eliminates the nonce- reuse concerns, but deterministic EdDSA/ECDSA requires side-channel resistance. I erred in my previous comment.

<comment><USER8> Right.

One can easily implement EdDSA without deterministic nonce generation or with insecure nonce generation (it would be an error to call it EdDSA: but no verifier could tell; and if the signature is accepted that is EdDSA-enough for people to call it that in practice); likewise one could implement ECDSA with deterministic nonce generation (e.g. as specified in RFC6979).

It's not hard to find examples of both.</comment></comment></comment></comment>


What Caused the Apollo 13 Accident? - <AUTHOR> https://www.space.com/8193-caused-apollo-13-accident.html <comment><USER2> This was a nice read.

I really enjoyed the 1995 movie about the Apollo 13 mission. It struck me that it provides a mental model for critical internet infrastructure or for relating to an online audience that you want to share anything important with.

They couldn't give the astronauts anything physical. They could only transmit information.

Yet, they did research on how to address some of the problems, wrote instructions and relayed them. This was crucial to their survival.

If you do anything of any importance online and need a little inspiration, I highly recommend watching the movie with that mental framework in mind. Ever since I watched it, I tend to gravitate towards to articles on the mission that show up here because it was a huge mental paradigm shift for me, for lack of a better term.

</comment><comment><USER3> Space Rocket History podcast is in the middle of a very long breakdown of the Apollo 13 flight. highly recommend, but the host has quite the accent.

[http://spacerockethistory.com/](http://spacerockethistory.com/)

<comment><USER4> Thanks for the link.

> quite the accent

Sorry, I disagree. He sounded clear, overall. There are some words where he sounds a bit unclear but overall he is good.

</comment></comment><comment><USER5> > When the fan inside the Number 2 tank was turned on, the damaged wiring > caused a spark, starting a fire inside the oxygen tank.

Why wouldn't there be a pre-launch test like "turn on Number {1,2} oxygen tank fan"? You'd think they would test everything that they could.

So giving NASA the benefit of the doubt, they either really couldn't do that as an integration test for some reason, or they did and the test run damaged it, or post-launch conditions were too different.

I am very glad that none of the code or tests that I write can kill anything more critical than a web site.

<comment><USER6> > I am very glad that none of the code or tests that I write can kill anything > more critical than a web site.

Why? You don't trust yourself writing critical code? Maybe you think others are better qualified for that? Or maybe you just don't want to apply corresponding efforts to make systems work in this case?

<comment><USER5> > You don't trust yourself writing critical code?

Absolutely this. There have been many occasions where a piece of code was business critical, I made every effort to get it right, tested exhaustively, and it still failed. Once only dumb luck saved my employer from financial disaster. I am not competent to write code that is critical for life, and doubt I ever will be. Still I think I'm a good coder, which means I think that most coders are in the same boat.

NASA has coders that are far better than I ever was or will be. Still, it's an act of great bravery or foolishness for anyone to blast off in an experimental spacecraft that depends on software for survival.

</comment></comment></comment><comment><AUTHOR> Often when something goes wrong people give a simple answer and try to assign blame to one person or system. I really enjoyed this piece because it reminds you that every accident involves multiple points of failure. This one is especially interesting because it involved a design decision made years before the Apollo 13 mission.</comment>


A fun modern way to trade: math trades - <AUTHOR> http://boardgamegeek.com/thread/93555

<comment><AUTHOR> These are not new, but I have liked the idea ever since I encountered it, and I have not seen it mentioned on news.yc before. So far I have only seen it on boardgamegeek, although I think there is independent software for conducting such trades (so people outside of boardgemgeek seem to know and care about it).

What I like about it: it might be a more optimal form of trade, that has only become feasible with the access to adequate computing power (100 years ago, there wasn't an option to trade like this - I think calculating the optimal trade is a NP complete problem. Haven't checked this now, though).

And furthermore, it is simply fun: it adds an element of suspense and excitement to the trade, while you can still be sure to not be screwed over.

I was inspired to post this because of the "auctions" in the YC list... A part of me wanted to remain quiet, but we'll see ;-)

<comment><USER2> There's a new startup, BarterQuest (<http://www.barterquest.com/>), that aims to do the same sort of math trades, craigslist-style.

Sounds like a really neat idea if you could get enough people involved...

<comment><AUTHOR> Interesting, but too bad that you can't even browse the items without signing up. Hopefully that is only because it is still beta (I didn't sign up).

<comment><USER3> Hey Tichy,

I'm a developer at BarterQuest, and I stumbled upon this post from you recently. I wanted to try and clarify some of the things mentioned in this post and in your comments.

During our Invitation-Only Beta Testing period, we are requiring users to sign up to do most activities on our site. This is mostly due to the fact that we want to measure how our site performs with signed-up users who will have access to all of our sites features.

As it relates to the article linked here, BarterQuest has a patented Matching Engine, which depending on what you have to trade and what you want to trade it for, among other things like specific attributes for your item, it will calculate the best matches for you, so you won't have to be searching all over the site for that item you're looking for. Of course, you'll be able to do that too, but we're confident our Matching Engine will be able to do the job for you. Right now since we're still in testing, the match results won't be plentiful, but as time goes on and we roll out of Beta testing and more users post more items, it'll be relatively easy to get accurate matches.

I encourage you (and to sign up during this testing period. Right now the site is totally free of cost, and if you're able to complete a successful trade during the testing period, you'll get free trading for an entire year. We also have some additional bonuses for signed-up users as well, which will be announced in our blog (<http://blog.barterquest.com>) soon.

We hope to see you there!</comment></comment></comment></comment>


MuJS: an embeddable JavaScript interpreter - <AUTHOR> http://mujs.com/ <comment><USER2> How does it compare with duktape: [http://duktape.org/](http://duktape.org/) ?

<comment><USER3> One immediately apparent difference: duktape has a more liberal and commercial friendly license (MIT), while MuJS has a much more restrictive license (AGPL).

<comment><USER4> This is a pretty big deal for me. MuJS is a non-starter if I can't even use it in GPL'd software (let alone copyfree-licensed software; my preference for my own projects is the MIT license, so being able to include something without having to change that - as duktape offers - is ideal).

<comment><USER5> Sure you can use it with GPL'd software[0] or MIT licensed software! It doesn't stop the GPL from applying to any GPL'd code, nor the MIT license to any MIT'd code. The AGPL does say that when it is used, the sources must be available to the users; but that doesn't mean that when someone takes your (MIT or GPL) code and changes it, and uses it [without MuJS or other AGPL code], that the AGPL applies.

[0]: GPLv3, that is. Fortunately, most GPL stuff is "v2, or at your option, any later version." Unfortunately, there is quite a bit of just v2 stuff out there.

<comment><USER4> AGPL code can be dynamically linked to GPLv3 code. That's about the extent of their compability. Statically linking MuJS in even a GPLv3-licensed program would be a violation of at least one or the other, and virtually all other cases of linking - dynamic or static - with AGPL code would also be a violation of at least the AGPL (and possibly the other license, depending on its terms).

So yeah, sure, you can incorprate MuJS in an MIT-licensed project, but by doing so, you're effectively required to license the entire work (your code + MuJS) under the AGPL (or a license - like the GPLv3 - that's explicitly authorized for dynamic linking; this, again, doesn't apply for static linking).

</comment></comment></comment></comment></comment><comment><USER3> If you are considering using this, please consider using Lua instead. Lua has decent performance on its own, great performance for a scripting language when using LuaJIT, plays well with others, is insanely embeddable, and is much easier to learn and work with. No language is perfect, but Javascript is a bit mediocre.

<comment><USER6> You are making assumptions about the needs of a project to endorse your favorite language.

Remember that languages are tools, not sport teams.

There are needs that completely disregard any of the benefits you mentioned with lua, for example:

      a) How can Lua help me run existing JavaScript code?

      b) Why is Lua more cost-effective than embeddable JavaScript interpreters considering the
         following:
         1. the cost of learning how to embed and work with the Lua interpreter
         2. the cost of learning the scripting language with all its implications: a different
            syntax, a different way to work enforced by its standard library (ex. 1-indexed
            arrays), new quirks (ex. commenting nested arrays), etc.
         3. the cost of training people from other areas which are already accustomed to
            JavaScript

<comment><USER7> (a) Tessel produced a pretty complete open source JS to Lua converter, which runs node[1]

(b) People are not dumb, they can learn Lua. It is easier than learning JavaScript.

[1] [https://github.com/tessel/colony- compiler](https://github.com/tessel/colony-compiler)

<comment><USER6> > (b) People are not dumb, they can learn Lua. It is easier than learning > JavaScript.

I was not saying that people is dumb, I was saying that learning it requires extra time and effort, and that increases the cost of a project.

</comment></comment></comment></comment><comment><USER8> Coming from the Artifex people, I suspect MuJS will be used by MuPDF to implement PDF embedded JavaScript forms.

</comment><comment><USER9> I see hate for the licensing model they chose. But think of it this way: who is their target audience? Who would want a small, embeddable JS engine? I think they're targeting businesses who want to deploy node.js code on micro to small devices. Routers, NASes, that sort of thing.

In that light, it's great they even decided to publish the source under AGPL at all. They could just as well have kept it "all rights reserved".

<comment><USER10> And what if those companies wish to provide their software to customers? Enter a terrible hell of "how are we going to relicense our stuff", that'll most likely end up with said companies switching to a different library.

No, the GPL, _especially_ the AGPL is inherently bad for libraries. Libraries, mind you, not software in general. Like I've written in my other comment, the LGPL solves this issue painlessly.

Besides that, node.js won't run with MuJS, because node.js depends on V8 and libevent. Unless some poor sod actually reimplements the entire nodejs stack... but I hope people are smarter than that. :-)

<comment><USER9> Guys, it's _double licensed_. You are describing exactly the point: they don't want companies to use this without paying. Pay, and you can redistribute it to your clients.

This is basically for-profit code from a for-profit company, with a side dish of "open source for open source projects." It's like... like Github. Like Travis-CI. Like QT.

<comment><USER11> > Guys, it's double licensed. You are describing exactly the point: they don't > want companies to use this without paying. Pay, and you can redistribute it > to your clients.

Or you can release your code under the AGPL and keep all your money.

> This is basically for-profit code from a for-profit company, with a side > dish of "open source for open source projects." It's like... like Github. > Like Travis-CI. Like QT.

This is not like Github. Github does not release all of the source code powering their app.

</comment></comment></comment></comment><comment><USER10> Maybe it's just me, but I'm not a particular fan of Lua-inspired pseudo- stackbased APIs.

I'm not sure why so many language devs insist on this terrible design. I fail to see anything good about it; It doesn't make the code smaller, it doesn't make the code faster, but it _does_ make abstraction a royal pain in the buttocks.

Also, they couldn't have possibly chosen a worse license for a library that is going to most likely embedded statically in a program. Of all licenses, why AGPL? If it has to be GPL (whyever is none of my concern), why not LGPL?

<comment><USER12> Explicit stack-based interfaces are used for good reason: This allows simple accurate garbage collection (see eg. the Ruby API which requires somewhat error-prone conservative GC, Python which requires refcounts all over the place, or OCaml which requires annotating all local variables in a special block). A custom frame stack is also needed to have coroutines in pure ANSI C (two of the reasons Lua is popular).

<comment><USER13> I don't believe non-stack based APIs prevent the implementation of the features you just mentioned. You don't necessarily have to expose the underlying stack manipulation routines as your defacto API although it is easier to do so. My gripe with this technique is that it makes it much harder for the compiler to catch errors. Personally, I think it would be better to expose the API as helper functions that compose (and hide) the underlying stack routines.

</comment></comment></comment><comment><USER14> So I guess this is slower than JavaScriptCore and you have to get commercial license to actually embed it. Why would one choose it at all?

<comment><USER15> From the linked site:

"Why? Because V8, SpiderMonkey and JavaScriptCore are all too big and complex. MuJS's focus is on small size, correctness and simplicity."

<comment><USER10> About 'correctness' and 'small size' ... as soon as they'd add unittests as extensive as V8, JSCore, or SpiderMonkey, it'd grow big quite dramatically. :-)

I'd be interested to see how ES5-compliant MuJS really is. My guess is probably different from what they claim.

<comment><USER16> surely unit tests don't get compiled in?

</comment></comment></comment></comment><comment><USER17> I understand the AGPL and the want to monetize the work, but it just feels so disingenuous to have to contact for commercial details.

<comment><USER15> How is that disingenuous? It seems pretty forthright about its licensing to me.

<comment><USER17> Because they have to be contacted to determine a price instead of making pricing clear. (I am not saying that they will not price consistently, I'm just saying it's a bit off-putting)

<comment><USER15> That's pretty common in enterprise sales. It's a way to have some leverage in implementing pricing gradients. For example, you might want to charge $200k to Microsoft for a given technology, but charge much less to an indie game company since there's no way in hell they could swing $200k for whatever you're selling. Different companies often even want different terms in their contract, so it makes decent sense.

</comment></comment></comment></comment><comment><USER18> Oh, is this from the ghostscript people?

</comment><comment><USER19> Pretty good implementation:

        > [] == []
        false
        > [] + []

        > {} + []
        0
        > [] + {}
        [object Object]
        > {} + {}
        NaN

Although it fails in this part (should be [10, NaN, 2]):

        > [10, 10, 10].map(parseInt)
        10,0,2

</comment><comment><USER20> Strange that the example has 'js_dofile("config.lua")'... Is there lua in here?

<comment><USER21> Which begs the question: why not use Lua to begin with, at least when starting a project? I totally get the use for this if you've got some existing JS and for some reason you need to talk to C. I've seen crazier things.

But I'd say the solution to 'I need a scripting language to talk to C' is solved very well by Lua.

*Edit:

After looking at the example it's C API is surprisingly similar to Lua's, even using such keywords as userdata. So that's interesting, considering they're really similar languages.

The function js_dofile doesn't look like it's doing anything with lua, nor can I find any use of lua at a cursory look at the source. I'd guess that since Lua and JS share syntax they are loading a .lua file with valid JS syntax.

<comment><USER22> Seeing as this was built by the creators of MuPDF [1], I'm guessing they built this because they _need_ to use JS to support embedded JS forms.

1: [http://www.mupdf.com/](http://www.mupdf.com/) (artifex)

</comment></comment></comment><comment> Julio-Guerra I just embedded it on a PowerPC P2020DS processor as a baremetal program (using the newlib and by stubbing the syscalls) and it works, I get a baremetal javascript interpreter ;)</comment>


Boeing Crashes: $43B in Share Buybacks Turn into Existential Threat - <AUTHOR> https://www.nakedcapitalism.com/2020/03/boeing-crashes-43-billion-in-share-buybacks-turn-into-existential-threat.html <comment><AUTHOR> Another company playing the "Heads our shareholders win, tails the taxpayers lose" game.</comment>


Welcome to Our Sampler of Ancient Egyptian Supernatural Beings - <AUTHOR> http://aedp-2k.swansea.ac.uk <comment><USER3> For the sake of anyone uncertain what to search for: hit 'start searching' and then 'random result'.

It's a worthwhile endeavour.

<comment><USER4> I had to reload the page or it would generate the same "random" result... but that's exactly the way I found interesting beings!

<comment><USER5> It shows a placeholder if no image is available, so i too thought at first it were repeatedly showing the same result.

</comment></comment></comment><comment><USER6> It's always fascinating to see how innovative ancient Egypt was. This makes me identify with them as normal people that share the same feelings with us. They dreamt like us and imagined stuff like us. I wish I could go back in time and live there for a while.

<comment><USER7> It's hard to imagine that we aren't somehow "more evolved" than people in the past, but then you see something like the wall graffiti in Pompeii and realize that even our most evolved trait of shit-posting was well established thousands of years ago! [[https://kashgar.com.au/blogs/history/the-bawdy- graffiti-of-p...](https://kashgar.com.au/blogs/history/the-bawdy-graffiti-of- pompeii-and-herculaneu)]

<comment><USER8> That's an interesting phenomenon - assuming that a modern trait is derived from the modern era, until one leaves the modern era with sufficient interest to discover the same trait in earlier cultures.

I've been quite hooked on the "Evidence of Ancient Civilisations and Advanced Technology" series of youtube videos that are there for the watching - <USER2> because it truly is interesting to think about. We still can't produce buildings as advanced as some of the ancient examples out there in the jungles - we just don't have the technology to do the things to stone that the ancients did. So, there's something else at factor here - the deleterious effects of civilisation.

At some point, we lose the edge. I blame shitposters.

</comment></comment></comment><comment><USER9> It took me a few rounds to get a non-placeholder image, hopefully they flesh out the rest soon! None of the images I got were for hybrids, but some of the descriptions over placeholder image sounded interesting.

</comment><comment><USER5> Some of the bunny heads could be donkey heads. The staffs with bunny ears remind of the was scepter.

</comment><comment><USER10> They could have saved a significant amount of bandwidth by scaling the placeholder image appropriately.

</comment><comment><USER11> Looks like the server is down.</comment>


LINQ To SQL Vs Entity Framework - <AUTHOR> http://jinaldesai.net/linq-to-sql-vs-entity-framework/ Entity Framework is ORM(Object Relational Mapping) introduced by Microsoft. It proves very useful for new developers for it's simplicity to query against conceptual schema and also has rich feature set. Many time the question has been asked in the interview to explain differences between Entity Framework and LINQ To SQL to the developers who has work experience in Entity Framework. I have made table of differences between these two technologies. <comment><USER2> Good comparison. Linq to SQL is not deprecated but it is in maintenance mode. My take is: if you're there, plan to move out; if you're building new projects, don't use it.

</comment><comment><USER3> LinqToSQL 4 Life! Seriously though, EF confuses me as a DB architect. With LinqToSQL I can drag may tables over from the DB, set up the relationships and I'm done. I can understand EF from a code first standpoint, but my fear, as with other MS techs is that when it comes time to optimize your DB layer you are going to have issues.</comment>


Why doesn't this exist yet: Syntax-aware merge - <AUTHOR> http://blog.locut.us/2011/02/06/why-doesnt-this-exist-yet-syntax-aware-merge/

<comment><USER2> imho, one non-trivial issue that i can see with the whole thing has to preserve the formatting of the code while converting it back from an AST. for languages like google's go or python where indentation is kind of mandated it might be easier...</comment>


Ask HN: Is there a tool for getting notified about updates to HN threads? - <AUTHOR>

<comment><USER2> [http://hnnotify.com](http://hnnotify.com)</comment>


Transistor Production Has Reached Astronomical Scales (2015) - <AUTHOR> http://spectrum.ieee.org/computing/hardware/transistor-production-has-reached-astronomical-scales <comment><USER2> Interestingly, the number of transistors made on entire planet is now comparable to number of DNA base pairs created in a single human body.

<comment><USER3> Maybe this is how life forms are created.

<comment><USER4> ... life forms? Oh you mean _these_ life forms![1]

[1] [https://www.youtube.com/watch?v=eT_Q_iAnmys](https://www.youtube.com/watch?v=eT_Q_iAnmys)

</comment></comment></comment><comment><USER5> > More transistors were made in 2014 than in all the years prior to 2011.

That is an incredible bumper-sticker factoid.

Does that pace keep up, that in any given year N we're manufacturing as many transistors as year(0 .. N-4) combined?

<comment><USER6> > Every second of that year, on average, 8 trillion transistors were produced.

Literally unable to imagine these numbers.

<comment><USER7> Well, they are quite tiny. A billion transistors fit into the area of your thumbnail. A typical wafer used for lithography has a diameter of 300mm. You can fit quite a few processors on such a wafer and you only have to expose once at each lithography step to create all of them.

<comment><USER8> I have no idea how one can get a billion transistors to work. Even an extremely small failure rate can render it impossible.

<comment><USER9> Yes, it's an extremely technologically difficult process. That's why building a new fab cost _billions_ [1].

1\. [https://en.wikipedia.org/wiki/Semiconductor_fabrication_plan...](https://en.wikipedia.org/wiki/Semiconductor_fabrication_plant)

<comment><USER8> I remember back in the 80s when engineers speculated that anything bigger than a 64K DRAM would be impossible because nobody could get that many transistors all working at the same time.

<comment><AUTHOR> Technology is one challenge. I wonder what other kinds of scaling must take place to sustain such industries? Like, how do you scale learning, so that a single person or a small team is able to have a good overview plus detailed know-how on the these complex devices.

I remember Linus Torvalds mentioning, that while the 386 was a complex CPU, he was able to understand it on a sufficient level. But this time seems to be gone.

<comment><USER10> It's exactly like software: hierarchical design. You have a number of subsystems on a chip, each one of which has interfaces and resources requirements, the implementation of which is delegated down to teams and individuals or composed from pre-existing pieces.

DRAM is even "easier" because it's just a repeating grid pattern. Tuning the cell design is important for performance, as are the read sense amplifiers at the end of each row, but once the tuning is satisfactory you just get the software to make N copies.

Possibly the most overlooked part of the process is the bits that aren't either taught or written down but passed on in the oral culture of the engineers. Analog IC design is a lot more like this.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> One transistor for each bacterium in every person's gut.

</comment><comment><AUTHOR> If we are currently at 35B transistors per person on earth produced per year, back-of-the-envelope calculated, in 2025, we will probably have 200B transistors per person running on this planet. Or about two DGX-1 for every single human.

</comment><comment><USER12> 10^20 billionths of $1 is a hundred billion dollars.

So transistors cost 100 billion each in 1955?

<comment><USER13> Isn't the black axis the axis for the black line?

<comment><USER14> This chart is poorly implemented.

TLDR: The chart attempts to show the relationship between Transistors Produces per Year and Transistor Cost per Year, but confuses the relationship by denoting the latter quantity in units that require mental multiplication to understand (transistor per $1.0 * $0.000000001)

\---

I see two curves, red ("Transistors Made Per Year") and black (Price Per Transistor (Billionths of $1)), both plotted versus a common range - "years," \- with plot-lines horizontally and vertically to help me trace points on the curve to their respective values.

Thank you, authors, for providing labels for the horizontal scale-lines on the graph (the vertical axes). You've understood that I might want to understand the relationship between different pairings of points between the red and black curves, and the horizontal lines help me rapidly estimate y-values for both. Or at least for the left-side y-axis (the red curve): "Transistors Made Per Year."

To be honest, I'm having difficulty relating the the quantities denoted in the units of the right-hand y-axis (the black curve), "Price Per Transistor (Billionths of $1)," with both the red curve AND the x-axis.

Here's why:

I had trouble efficiently internalizing what the units of the black curve - "Price Per Transistor (Billionths of $1)" \- really meant. I am lazy, so I only figured it out on the third paragraph of my comment. I kept glancing at the red curve, then the black curve and thinking something like "ok... in 1965 it looks like the red curve was about 10^9 "Transistors made that year"... and for the black curve, it was $10 Billion per Transistor... oh wait. I mean ($10 Billion * $0.000000001) per Transistor. So I guess thats.... uh... $10/Transistor($1)? I.e. each transistor cost $10 and $10 billion were made total that year (ah ha, for a total silicon market cap of $10/transistor * 10,000,000,000 transistor = $100B).

Please don't make us do math to understand the units of one of the axis, if possible.

Also, labels to denote the values of the vertical gridlines (ticks on the x-axis) would have been helpful. Without them, we have to mentally estimate their value by subtracting the high-side of the domain from the low-side, then dividing by the number of tick marks (alternatively, counting from 0 the number of vertical lines across the whole graph. In this case: (2014 - 1955)/(11 tick marks + 1) = 4.9266666... years ~5 years.

That said, I'm pleased to see more transistors were manufactured in the last year than there are stars in several galaxies! Wow. But Kanye won't be impressed until the number exceeds the number of all KNOWN STARS in the UNIVERSE. So keep at it.

Lastly... Isn't VLSI so 80's? Isn't there a VLSIVLSI now or something? Maybe VLSI^2?

<comment><USER15> > Lastly... Isn't VLSI so 80's? Isn't there a VLSIVLSI now or something? Maybe > VLSI^2?

The progress from discrete transistors to small-scale integration up through VLSI brought with it major changes in what kind of functionality could be integrated on a single device. That's mostly stopped: early VLSI chips were things like CPUs, and our largest chips today are still usually just processors (or FPGAs) with a similar role in the system as a whole. We've integrated all the co-processors and much of the I/O onto SoCs that largely aren't pushing the limits of transistor count or die size, and there are some instances of bringing more analog stuff like some power regulation and radios onto the chip. But for the most part, we're still using separate chips for the processor and the RAM and a bunch of smaller chips for various I/O tasks, even on tiny embedded systems like smartphones.

<comment><USER16> Smart-phones aren't _" tiny embedded systems"_.

Also, smaller embedded systems do have RAM and various I/O on-chip (but not necessarily on-die).

To grab a random (not even really tiny) one, [http://www.atmel.com/devices/ATSAMB11.aspx](http://www.atmel.com/devices/ATSAMB11.aspx):

 _" The SAM B11 is an ultra-low power Bluetooth® SMART (BLE 4.1) System on a Chip with Integrated MCU, Transceiver, Modem, MAC, PA, TR Switch, and Power Management Unit (PMU). It is a standalone ARM® Cortex®-M0 applications processor with embedded Flash memory and BLE connectivity."_

All in 6x6 mm.

<comment><USER15> Smartphones are tiny embedded systems in the sense that they are embedded systems, and their total circuit board area is a small multiple of the die size of their larger chips. They're physically quite space-constrained and don't have room for very many separate components, and the larger ones usually end up stacked.

</comment></comment></comment></comment></comment></comment><comment> a-no-n TL;DR - humans are f'd*

*maybe, if not wise/able to constrain AI

Non-humans maybe (t/quad)rillionaires to eclipse us within our lifetimes because of the likelihood of runaway technological acceleration.

At the 1e9m systematic level, inorganic and hybrid sentient, self-replicating, self-improving systems seem an inevitable stage enabled by organic life.

<comment><USER17> To be fair, we're fucked if left to our own devices; maybe creating a new form of life wouldn't be the worst thing we could do on the way out.

<comment> a-no-n Not necessarily. Japan recovered from nearly deforestation a-la Easter Island. Penalties and enforcement are required to prevent consequences of individual and collective externalities.

</comment></comment></comment><comment><USER18> The number given in the article is really not that big considering that most of these transistors are made as part of integrated circuits rather than in the form of discrete components. A modern large-scale integrated circuit can easily contain more than a few million transistors each.

<comment><USER19> You are off by a factor of 1000. Top end CPUs and GPUs are in the billions of transistors. I believe 8Gb DRAMs are shipping commercially now (so 8G transistors and then some)

<comment><USER18> Sure, but this only supports a simple point I tried to make. Let me try again: today transistors are so small and appear in such large quantities as part of large-scale integrated circuits that counting them is almost like counting molecules (or, let's say, bacteria, as one commenter has pointed out earlier). Such "astronomical scales" make for catchy headlines, but that's about it. (Not a very interesting observation on my part, I admit.)</comment></comment></comment>


The Online Dating Industry Loves Artificial Intelligence - <AUTHOR> https://syncedreview.com/2019/06/15/the-online-dating-industry-loves-artificial-intelligence/ <comment><USER2> Not hard to imagine one could deduce one's partner preferences based on cultural facts.</comment>


US Internet to Offer 10Gbps Internet in Minneapolis - <AUTHOR> http://www.startribune.com/business/286680241.html

<comment><USER2> This is a great idea! They've invested $$$ into their network. Why not sell the extra capacity for some extra price?

Not like AT&T, which has had BPON since ages ago, yet they've never provisioned any of it with anything remotely close to 100Mbps, until Google went to Texas.

</comment><comment><USER3> At those speeds, you'd likely outpace any site you connected to.

I wonder how heavily oversold this bandwidth is?</comment>


Thinking about quitting your job? Go tell your boss - <AUTHOR> http://www.ronsho.com/2014/10/quitting-job-tell-boss/

<comment><USER2> This advice is only for a very specific situation. If you can certainly find a better position quickly, but your boss is a decent person who's interested in your success, then absolutely tell them that you're thinking about leaving.

But that's a rare situation. Basically, it's people who were hired as junior engineers and have leveled up. Years 2-5 of your career are when your position can become mismatched with the broader market.

If you're just testing the market, and you might find that your current job is your best available option, don't tell your boss. Similarly, if you're fleeing a bad situation but you need the paychecks for a little while, don't tell your boss.

</comment><comment><USER3> This is horrible advice! In the real world, you will encounter a variety of bad outcomes utilizing it.

If you are ready to leave, you're giving up control of when and how once you tell your boss.

It's exceptionally naive to think that everyone will structure the nature and timing for your benefit instead of theirs and/or the company. You may be asked to resign on the spot or give notice. In some secure environments you may be walked out by security on the spot.

Additionally, if your plans fall through or you have a change of heart, you will be regarded as disloyal, which may follow you and impede future promotions or assignments.

Finally, if you have a vindictive boss with contacts in the industry or destination company, they can quash existing or pending job offers to keep you or punish you. Cf. Jobs/Apple/Google

</comment><comment><USER4> I think this is fairly naive and depends a _lot_ on your boss and company. I've worked at places where interviewing elsewhere is seen as disloyal. I know of places where giving your two weeks means getting escorted out on the spot.

I'm not saying these are great places to work, but they exist, and I bet they're not the minority.

<comment><USER5> I've been fired for quitting, i.e. giving my two weeks notice.

<comment><USER6> I've worked places that walk folks out the door when they give notice.

</comment></comment></comment><comment><USER7> Bad advice!

In engineering this may apply, as it's a buyers market. Most bosses (in engineering) understand that they need to convince you to work for them.

It's possible that "Ronsho" could use a little more exposure or real world experience before making blanket statements.

</comment><comment><USER8> If you are leaving to get a better salary, you can get a better deal from your current employer if you have an offer letter in hand. If you tell your boss first, you might be settling for less.

<comment><USER9> I assert that by the time it's gotten to the point that you have gone out, slogged thru hundreds of job postings, had interviews, negotiated a new position, YOU'RE DONE AT YOUR OLD JOB. And there's no going back.

Something had to have pushed you to do all that work to find a new position; are a few thousand more a year going to fix it?

Never mind you'll forever be marked as the "one who will leave".

<comment><USER8> _I assert that by the time it 's gotten to the point that you have gone out, slogged thru hundreds of job postings, had interviews, negotiated a new position, YOU'RE DONE AT YOUR OLD JOB. And there's no going back._

I could be alone here, but I never _stop_ looking at job postings. If I ever see something more interesting than my current job, why not explore it. Chances are you would miss the most interesting opportunities if you weren't looking 90% of the time. The best time to search for jobs and interview is when you already have a comfortable job. Then your desperation doesn't force you to take something you don't love.

<comment><USER10> You're not alone. I've been in my current job ~3.5 years - every day I've read through (and sometimes speculatively applied for) many job postings.

I like my job, but that doesn't stop me keeping an eye out for something better.

</comment></comment></comment></comment><comment><USER11> And then there's always the scenario where your boss guilt trips you, then when that fails - threatens you. Don't tell your boss

<comment><USER12> Depends on your boss and where you work. I think lots of people & businesses appreciate a bit of extra heads-up above & beyond the required notice period.

<comment><USER5> Never feel obligated to give more than two weeks, and then only when you're definitely leaving.

Imagine the flip side conversation: "We're thinking about firing you, so we're interviewing people. Not sure, we'll see how it goes. I suppose we might be convinced to keep you if you work an extra 20%."

It's an extremely asymmetric relationship. Recognize which side of that relationship you are on.

<comment><USER11> Completely agree - and only 2 weeks if you expect your employer to behave calmly

</comment></comment></comment></comment><comment><USER13> I don't think I have ever worked for anyone that I would feel comfortable telling them "Hey I feel like quitting".

</comment><comment><USER5> "It's important for me to say that this relates to employees who are good at their job. If you aren't – just do everyone a favor and quit.."

I would normally be reluctant to tell a boss that I'm looking. I'm pretty sure that I would _never_ tell someone who could say this; in fact that there's a good chance that person might already be driving me out, whether I was good or not.

</comment><comment><USER14> What about those who want to look around while keeping the current job on the hook? I think this happens more often than not - it's the only good way to assess your own value in the market.</comment>


Tether, EURT, and the BTC price spike - <AUTHOR> https://notehub.org/bk3sr <comment><AUTHOR> Hi HN. I know you don't like cryptocurrency discussions, but I found something curious, and am looking for some thoughts on my reasoning. In essence the recent BTC price spike is closely correlated in time with a Tether token destruction.

I am looking to understand these events better, and if it is possible that in this case correlation does imply some sort of causation.

</comment><comment><AUTHOR> Well it seems that notehub is some sort of spam site, didn't notice because of adblock. Too late to delete post, Doh!</comment>


Is it safe to use JavaScript to eval JSON-like data from your own servers? - <AUTHOR>

<comment><AUTHOR> Scenario: I've got a page which does an Ajax request and eval()s the response. I trust the response, because it's from our own servers (and simply contains a dictionary). But are there any possible issues I'm forgetting?

<comment><USER2> proxies. Is what the client receiving actually from your server and not from something between them and you.

<comment><USER3> But a malicious proxy doesn't need to insert Javascript to get your browser to do naughty things, since it can just manipulate the upstream anyway. Not to mention inject Javascript into HTML pages as they come down.</comment></comment></comment>


Lockss: A Permanent Web Publishing and Access System (2001) - <AUTHOR> http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.68.7907&rep=rep1&type=pdf#page=430 <comment><AUTHOR> This 2001 paper describes a system which allows journal articles to survive on the Internet even though copies are removed and the hosting journal disappears.</comment>


Brackets, an open-source editor built with the web, for the web - <AUTHOR> http://brackets.io/

<comment><USER2> duplicate: <http://news.ycombinator.com/item?id=4159552></comment>


PowWow - Collaborative Screen Sharing - <AUTHOR> http://powwow.cc/

<comment><USER3> I remember the PowWow McAfee founded that did collaborative web browsing.…

<http://en.wikipedia.org/wiki/PowWow_(chat_program)>

<comment><USER4> That was my thought, is this a renewal of a 90s brand? The original PowWow was something that our QA people used for reasons I can't recall.

<comment><USER5> Probably because it had the PowWow Robot Voice to read your chats for you. Not that it was super useful, it just sounded funny.

</comment></comment></comment><comment><USER6> Hey all! I'm one of the co-founders of PowWow. This has caught us all by surprise, but we're thrilled to see the response we've been getting so far. If you guys run into any issues, please let us know. We're in very early beta right now, so your feedback is very important. Feel free to reply in the comments here, or email us at firstname.lastname@example.com. Happy PowWow-ing :)

<comment><USER7> Great looking product guys! My old life was as a Collaboration Researcher and this is far better than many of the enterprise tools I saw in my day. The get- started quick aspect is great and a tremendous decider in which, if any, of these kinds of tools actually get used.

</comment></comment><comment><USER8> This is super slick. Just played around with it with a friend and there's almost no lag. My CPU spun up quite a bit but nevertheless color me impressed. I'm curious how this is implemented though?

<comment><USER9> The networking is P2P (most of the time). The screen sharing is VP8 video compression. Presence is XMPP. The multiple mice, separate dock icon, and a lot of other little things are the result of a lot of hacking :)

We're going to be working on making the encoding more CPU efficient. (btw if anyone has any expertise in real-time video codecs we'd love to talk to you)

<comment><USER10> > P2P, VP8

So is Chromium Remoting. [http://git.chromium.org/gitweb/?p=chromium.git;a=tree;f=remo...](http://git.chromium.org/gitweb/?p=chromium.git;a=tree;f=remoting)

</comment></comment></comment><comment><USER11> Interesting on how no replies have been received on how it works. Mind it, I have not installed it, but, is there a server(s) to connect to, is it peer-to- peer? Care to provide more details? Thanks!

<comment><USER12> It is peer to peer when possible (>90% of the time). Otherwise it is relayed.

</comment></comment><comment><USER13> Looks nice! I wish it gives support for Linux as well. Good screen sharing tools for Linux are virtually non-existent (and I am often ridiculed for it).

<comment><USER14> Have you tried Chrome Remote Desktop? <https://chrome.google.com/remotedesktop>

It has two modes of operation. One is where you work with a different person - whoever shares their screen starts Chrome and it generates a random access number which the other party enters.

The other mode is accessing your own machines which means there is no other party and chrome doesn't need to be running (the desktop is exported as a daemon/service).

It works really well in both modes, and supports Linux (which I use), Mac (also have one of them) and Windows. The viewer and sharer can both interact. The viewer is a tab within Chrome which you can also make fullscreen.

If you don't need to remotely interact then Skype works just fine and again has cross platform support.

<comment><USER14> One clarification - CRD turns out not to support exporting a Linux machine that is your own (unattended). They do not have the daemon/service code for that. Sharing with other people works fine.

</comment></comment></comment><comment><USER15> You know, you probably could have chosen a better name. If for nothing else you are competing on searches with all of the actual Pow Wow websites that tribes and dancers have set up to catalog their events.

</comment><comment><USER16> <http://i.imgur.com/RbPQ8.jpg>

PowWow is trippy.

<comment><USER17> why would you upload to imgur when you have droplr running?

<comment><USER16> You're looking at the menu bar of my screen sharing buddy.

</comment></comment></comment><comment><USER18> > It's like Google Docs for any application

Isn't this a bit too misleading? The appeal of Google Docs is that two people can work on a spreadsheet at the same time. They can be working on different cells or even different sheets of a workbook. PowWow allows one person to work on a spreadsheet at a time but allows you to quickly and seamlessly switch who is working on it. In other words, only one person can type.

<comment><USER19> I agree, it's not a perfect comparison. It's appropriate, though: I can quickly understand what it's about. And they do use the word "like" - it's not exactly Google Docs, but it's LIKE Google Docs and can (for certain apps) be a great alternative.

</comment></comment><comment><USER20> Looks great! The two-cursor feature would also be extremely useful when two mice are connected to one computer. We do pair programming at work and I could see a tool that allows two people sitting at one machine to each have their own cursor totally transforming the way we work. Is this a feature you plan on developing?

<comment><USER9> We've found that since we've starting using PowWow, we don't need to sit at the same computer when we're working together. In fact, we prefer to stay at our computers, even if we're sitting next to each other :) Being able to use our own screen, with our own particular hardware setups is really nice. It also avoids having to reach over the other person to use the keyboard, or squint at the screen because it's too far.

</comment></comment><comment><USER21> Are you guys aware of powwownow? it's has voice/video conferencing. Although not exactly like your product, it does share some similarities.

<http://www.powwownow.co.uk/>

</comment><comment><USER22> I've been using powwow since early development days. It is a great product, been useful to me many many times. it is good to fix your mom's computer or to help your peer programmer across the sea.

</comment><comment><USER23> Looks great. There's a UK company with similar branding doing conference calling (they advertise all over the tube with really terrible posters). Called PowWowNow.

</comment><comment><USER24> Really like the concept and the product feels great. I'm curious as to why voice chat was not included though. Is that planned in an upcoming release, because it seems like a pretty big setback. You may not be fighting over a single cursor anymore, but you're still fighting for control, and it's hard to coordinate that without talking to one another. I don't want to have to use up additional resources by entering a Skype chat either.

<comment><USER25> I'm a co-founder/dev at PowWow. VoiceChat is going to be in the next major release. We already have system audio being ogg/vorbis'ed to you so its not a question of expertise but simply time allocation. I completely agree that whenever we have PowWow'ed, we would have a active skype session since that's much easier than chat. That's also what a alpha release is supposed to be - <USER2> gather your inputs! So if everyone agrees that Voice chat is a must have it'll definitely be there in the general release!

<comment><USER26> Have a look at Opus, another free audio codec that provides lower latency (~22ms) and better quality than Vorbis.

It also scales down to low-bitrate speech, but I doubt you need that for your application.

<comment><USER25> Yup - we are actually using webRTC under the covers for video/audio RTP and webRTC itself uses Opus (or recommends) so we'll probably be switching to that for audio chat when we go that route. Thanks!

</comment></comment></comment></comment><comment><USER27> We cannot work parallel with this screen sharing right ? So it just looks juicy with cursor look like google docs :D

<comment><USER9> That's correct, two people can't be doing 2 different things at the same time (i.e., there is one keyboard). However you do have 2 mouse pointers and you can move/point/click with them independently. We found that in practice we actually preferred this because it's valuable to know that everyone is looking at the same thing at the same time.

<comment><USER27> yeah, that's why I say it just looks juicy because when using teamviewer or another screen sharing, we still talk discuss. Then knowing each other mouse is not necessary anymore :)

</comment></comment></comment><comment><USER28> Does this differ from Goinstant (<http://www.goinstant.com/> )? It was aquired by Salesforce in July 2012 for $70MM.

<comment><USER6> I'm one of the co-founders of PowWow. We're a lot like GoInstant — in fact their demo video does an even better job than ours does of explaining the concept to a layperson. It's interesting that while their product and ours have very similar use cases, the technology stack is completely different. They have a browser-within-the-browser, while we have an interaction layer over the OS — and we both do crazy hacks to make multiple-mouse live collaboration work. We've met the GoInstant guys, and they're an awesome team with a great product, and we're definitely fans of theirs.

<comment><USER29> That's great hacking guys. I am waiting for the Windows version, where i think you'll have a hard time escaping the "only one window has focus" dogma. Btw, if you need beta testers i am here.

</comment></comment></comment><comment><USER30> pair programming with this has the potential to be awesome

</comment><comment><USER31> favicon.ico for my label-less bookmarks please :)

<comment><USER6> Fixed :) Thanks for pointing that out!

</comment></comment><comment><USER32> I wish someone thought me code with this.

</comment><comment><USER33> Cool product, not so great name. Using pow wow like this can be considered offensive to native peoples.

</comment><comment><USER34> mixergy has a great interview with the founder talking about hitting $1M+/year for the product that started it all (ios), and a phd's journey from pakistan to the bay area.

just search for "iteleport mixergy interview"

very inspiring story. congrats to J & team.

~B

</comment><comment><USER35> no linux, android, ipad support

<comment><USER9> Mobile support is on the horizon, though Windows is coming first.

<comment><USER36> I am glad its coming to windows first, I hope you mean windows 8 for touch ( read RT )

</comment></comment></comment><comment><USER37> Very impressive! I can see myself using this someday!

</comment><comment><USER38> Two mice but surely not two cursors?

<comment><USER39> Two cursors. However, only one application can be active at any one time, so two people can't type at the same time.

</comment></comment><comment><USER40> any version for ubuntu/other debian derivatives?

</comment><comment><USER41> this is awesome, any chances for a PC version?

<comment><USER6> It's in the pipeline :)

</comment></comment><comment> saiko-chriskun awesome!!! been wanting something like this ;)

</comment><comment><USER42> Very cool.

</comment><comment><USER43> "You are both always in control"

First thing you see in the video is that this isn't true</comment>


Piwik: Open Source Google Analytics Alternative - <AUTHOR> http://www.readwriteweb.com/archives/piwik_google_analytics_alternative.php <comment><USER2> We just added support for Piwik to Virtualmin. It's got a little while to go before it's a match for Google Analytics, but it makes great use of the latest in Open Source tools (like Open Flash Chart, which is a nice charting library)...and it still has the "needs a JavaScript bug" negative, though, realistically, there's no way to get all the data without one...but if you use more than one analytics package you end up spending a lot of time loading JS bugs on first visit.

I think I'd generally prefer locally generating my analytics reports. All that data has value (otherwise Google wouldn't want it so badly), and it probably has more value if it only belongs to me, though I may not be sure exactly how to make use of it.

</comment><comment><USER3> I think its really cool. Question is can they make it as good as google analytics.

<comment><USER4> Nah, question is can YOU make it as good as google analytics. It's open source

</comment></comment><comment><USER5> One of my favorite open source Google Analytics alternatives is phpTrafficA. You don't need to agree to Google's TOS to use it, and you can integrate it easily via either Javascript or two unobtrusive lines of PHP code. <http://soft.zoneo.net/phpTrafficA/>

</comment><comment><USER6> We've been hesitating letting Google Analytics into our secured site. This looks like a great alternative.</comment>


Amazon Prime Video now does what Netflix won't: offline playback - <AUTHOR> http://www.theverge.com/2015/9/1/9236971/amazon-prime-video-offline-playback

<comment><USER2> But does it work with Chromecast yet? I have had Prime for a long time, and as long as the terrible Silverlight/Flash players are the only way to view the content, I find myself leaning towards Netflix and my Chromecast.

<comment><USER3> I have Prime and the Amazon Instant Video app on a Roku 3. I rented one movie on it right after I got it (about two years ago) and haven't used it since then, but my girlfriend uses it once or twice a week and hasn't ever complained about it.</comment></comment>


Plastic surgery for Bitcoin in Miami - <AUTHOR> http://bitcoin-square.com/plastic-surgery-for-bitcoin-in-miami/ <comment><USER2> I'm waiting for the day when a big retailer (ex. Amazon) starts accepting bitcoin as payment for its' goods and services. I feel once this happens, bitcoin acceptance amongst businesses will surge.</comment>


How a Danish Town Helped Young Muslims Turn Away from ISIS - <AUTHOR> http://www.npr.org/sections/health-shots/2016/07/15/485900076/how-a-danish-town-helped-young-muslims-turn-away-from-isis <comment><USER2> Fascinating, and worrisome.

This paragraph jumped out at me because of the numbers involved:

"Starting in 2012, 34 people went from Aarhus to Syria. As far as the police know, six were killed and 10 are still over there. Of the 18 who came back home, all showed up in Aarslev and Link's office, as did hundreds of other potential radicals in Aarhus — about 330 in total."

If a small town like Aarhus harboured 34 people that joined ISIS and 330 potential radicals in total that does not bode well for the rest of Western Europe.

Those numbers, when extrapolated make the problem a lot larger than I thought it was (and I actually thought I was over-estimating).

Aarhus has a population of only ~320K, so that's 1:1000.

<comment><USER3> Going to Syria isn't necessarily joining ISIS. There are many rebel groups, some directly fighting _against_ ISIS.

<comment><USER4> I keep hearing this and it does not comfort me much.

Remember how the West had a problem with...

The Taliban... then Al-Qaeda...... then ISIS.......... then ??

The names are changing but something else remains constant or is getting worse.

<comment><USER5> One constant factor is strife in the region. Provides a constant source of enraged youngsters seeking revenge after being hard done by an outsider (death in family, unemployment, living under an authoritarian govt, illiteracy, etc).

This will continue until weapons need to be sold. Military Industrial complex is a thing and it needs blood to lubricate its wheels.

<comment><USER6> There are plenty of other countries which are considerably poorer than the middle east. Circa 2010 Syria wasn't a "bad" place, the average income was greater than that say of India, it was about equal to that of Moldova and the Republic of Macedonia both which are both EU accession candidates.

Syrians (and Saudis) who joined the insurgency in Iraq weren't disenfranchised infact they were from the elite, often dropping out of university to go and join the "cause". Osama Bin Laden who founded AQ was born into one of the richest families in the world, had higher education and really had no hard done to him by anyone.

Europeans who join ISIS are mostly 2nd and 3rd generation "immigrants", often to mixed families and "fresh converts", they aren't particularly disenfranchised either.

Geopolitics and economics do have a role in conflicts everywhere, but the sooner you stop blaming everything on people being poor, oppressed and "western expansionism" the sooner we might actually be able to start working on a solution.

Last time I've checked Tibet is effectively poorer than Lebanon, Syria, Iraq, Iran, and Saudi Arabia, not to mention the smaller gulf states (and I'm not counting the average which is skewed because of how the wealth is distributed) and it's quite objectively oppressed but I have yet to see Tibetans blowing up restaurants in China.

<comment><USER4> If you read enough old books you'll notice that the authors ascribe a general temperament to each European nation. The word temperament today is not in common use except in animal breeding and the nearest equivalent we have today is the word stereotype, which captures some but not all of the meaning.

Here is a formal example of what I mean:

[http://i.imgur.com/r3bom1c.jpg](http://i.imgur.com/r3bom1c.jpg)

[http://i.imgur.com/Qen8lBA.png](http://i.imgur.com/Qen8lBA.png)

While some of this is hilariously old fashioned or historical period specific, it is also interesting just how many traits are consistent enough that we recognize them centuries later.

This could be astrology or tea leaf reading, but I think it merits a genuine scientific investigation. It may be anecdotal but far too many people agree the Italians are very fond of chatting, including the Italians.

All of this is to say, while it is true that Islam is dominant in countries where periodic religious warfare breaks out, it is possibly Islam is derived from collective temperament and not the other way around. It should definitely be treated seriously as a hypothesis.

</comment></comment></comment></comment></comment></comment><comment><USER7> I love how it's always others being evil and 'discriminate' against the muslims that then become terrorists. Like, 'Those evil, evil westerners rejected him and did not appreciate his culture. That was the catalyst for him wanting to become a terrorist.'

Imagine this: You go to a foreign country or are raised in a foreign culture (because things in your own country are horrible at the moment). You feel mistreated (even though they provide you with asylum and quite literally save your life and provide you with all you need), for example in a job or at school. _This makes you feel like you have to kill people to make your point, and you have to be a terrorist, so you set out to wage this war._ This is utter lunacy. This is not the spark for terrorism - a careless upbringing without proper values and with extremist ideologies is. Let me tell you something: Culture matters. A lot. Not race and not birthplace. But what you believe to be moral and true fundamentally shapes not only how you view the world but how you interact with it. What we need is moral education, a reform (enlightenment) in muslim culture and stop being apologist by blaming ourselves.

<comment><USER8> Let me guess - you've never been in a large group situation where you are seemingly accepted, but nearly everyone looks down upon you and treats you with constant suspicion and questions your motives and reminds you on a regular basis that you are different, and that you are lucky to be part of the group. Have you?

<comment><USER9> Seriously, who cares? Everyone of us will have to deal at some point in life with people that look down upon us for stupid reasons.

That doesn't give you an excuse to kill 100 random strangers!

It is their culture that causes this, as they have a loud group that constantly calls for these massacres and generally very few of them speak up against this loud group of fanatics.

We don't have anything like that in our culture, that's why it's so rare that somebody from us ends up mass murdering 100 random persons.

If someone from us tried calling for mass murdering some minority he'll actually be locked up in no time and attacked harshly by the media. That's how we effectively deal with our radicals.

I'm tired of all these attempts to appease members of this culture as it is clearly a much worse culture than ours and they could actually learn something from us.

Where ever Muslims are the majority you always see the same result: Poverty, cruel law system, oppression, massacre and often civil war

And somehow no one seems to be willing to accept that this is the direct result of their value system and their culture.

How are they ever going to improve their societies if we help their fanatics to keep oppressing dissenters by constantly repeating that their culture is great and everything's fine?

Edit: And because I'm sure someone will state that this is unfair because we constantly meddle in their affairs: We also constantly meddle in Russian, Chinese, Indian, Japanese and EU affairs and vice versa.

Still these societies seem to be sufficiently resilient to not collapse in mass murder and total chaos.

Muslim societies constantly collapsed when Socialism was en vogue 50 years ago same as they collapse today with Islamism. You can promote any -Ism you want there, nothing will change as long as the oppressive nature of their culture doesn't change.

<comment><USER8> > We don't have anything like that in our culture, that's why it's so rare > that somebody from us ends up mass murdering 100 random persons.

The USA has something endemic in their culture which results in toddlers killing more people that terrorists have in their country this year.

People in other countries without this same culture try telling the US how that can stop it by trying the same things that worked in their own countries but keep being told to go away, there is nothing wrong and to mind their own business.

> We also constantly meddle in Russian, Chinese, Indian, Japanese and EU > affairs and vice versa. Still these societies seem to be sufficiently > resilient to not collapse in mass murder and total chaos.

Does the US 'meddle' in those countries to the extent of placing troops on the ground within their borders in order to shoot at citizens of said country? Does the US conduct drone strikes against people of those countries?

<comment><USER9> > The USA has something endemic in their culture which results in toddlers > killing more people that terrorists have in their country this year.

Every society that gives it's citizens the right to bear arms will have accidents. I also doubt that toddlers will have killed more persons than terrorists this year.

> Does the US 'meddle' in those countries to the extent of placing troops on > the ground within their borders in order to shoot at citizens of said > country? Does the US conduct drone strikes against people of those > countries?

Today the West does so in the Middle East, but there is also a real threat to us. 30-50 years ago it wasn't so and there were few soldiers placed in these countries, except for Saudi Arabia because they are apparently incapable of upholding their fine system without Western help. Still their countries were a total mess like they are to this day.

Of course there was meddling and certain groups were supported like the West always does everywhere. But what those groups did with that support in terms of cruelty when compared to other cultures is not comparable.

I guarantee you this, if every country stopped meddling in the Middle East first thing they would do is getting weapons of mass destruction and then they'd proceed to annihilate each other.

</comment></comment></comment></comment></comment><comment><USER10> _Hearing a policeman take responsibility for his life getting derailed really moved Jamal. He agreed to come into Link 's office._

They are doing good work. This all fits with everything I have ever read about how to undermine extremism, radicalization, etc. Time does not tend to heal such wounds. It tends to make them fester. That doesn't mean they cannot be healed.

<comment><USER11> Unfortunately, this section is becoming a political thread while I feel like there is more to be said about psychology here. It feels unnatural especially to accept someone back when they've essentially fought against you. At worse, one would wonder if you embolden criminals when you do this.

I think it comes down to motivation. If a criminal is say like a sadist rapist, giving him a hug after he rapes will just embolden him to commit more crime. That's because his motivations are due to internal forces/perversions. However, if someone is motivated like Jamal due to discrimination, the thing he wanted in the first place was acceptance, so accepting him leaves him with no reason to commit crime.

Unfortunately, you can't read inside someone's head. Some people just want to be a Jihadist. Some want to see blood and kill. Some just want to belong. I think the best thing to do is to do both...help those who want to be helped and reach those who could be reached, and fight vehemently those who simply want glory or want to get their kicks. How do you know when or when not for this or that case? I guess you pay investigators a nice salary to figure that out because blanket policy is only so effective.

<comment><USER10> This is something that can be studied. Social psychology. Negotiation and conflict resolution. Etc. I have had such classes.

First, he reached out to him with his own agenda. Naturally, having been crapped on by so many people, the young man was suspicious. So, he apologized specifically for the role his own department had played in the ongoing tragedy of this guy's life. He did not just say "Sorry your life sucks." He distanced himself from the wrongdoing of the officers the guy had previously interacted with, showed that his agenda was not harmful, it was a good faith agenda.

Then he hooked him up with a role model who could provide social proof that there was real hope that this could be resolved. He gave him a model for how to solve. He gave him an attractive alternative to becoming a terrorist. The young man did not previously have an attractive alternative.

The article seriously simplified the process. Since this unit is successful in what it does, presumably they are more informed about the various pieces of this than whoever wrote the article.

The forgive and forget model does not work. But this kid was turning bad largely due to bad things happening to him. He was mistreated by the police the first time. His pissed off remark at school should have never turned into so much trouble for him. To some extent, his second contact with the police redressed this wrong. The apology was not just empty words.

</comment></comment></comment><comment><USER12> I'm astounded at the lauded idea that these guys are radicalized or it is some unfortunate circumstance of Western (white) oppression. In all its wonderful building of the multicultural fabric, the west continues to paint with the wide stroke that all cultures are great and morally equivalent. Thus, when there is an attack from these 'poor disenfranchised' individuals upon our freedoms and people, the west is quick to attack everything but the true problem, which is Islam. I mean all we have to do is look at Mohammed to understand what it means to be a truly honest, moral and exemplary Muslim.

\</comment><comment> 9:29. Fight against those who believe not in Allah, nor in the Last Day, nor forbid that which has been forbidden by Allah and His Messenger and those who acknowledge not the religion of truth (i.e. Islam) among the people of the Scripture (Jews and Christians), until they pay the Jizya with willing submission, and feel themselves subdued. \</comment><comment>

<comment><USER13> Why must it be either/or? One can critique (certain tenets of) Islamic thought, yet recognize that there's an interaction between the narrative an individual has about their life (i.e. I'm being disenfranchised) that interacts with their cultural/religious background, making them more prone to certain interpretations of their faith and more committed to these interpretations and their behavioral consequences. You can empathize with an individual that feels like an outcast while not necessarily making a positive moral judgment of their religion or their subjective interpretation of their own predicament. Without "appeasing them" (whatever that means). Nobody in the article you are replying to has made any argument about moral equivalence. To me, they seem to be mostly pragmatic and interested in preventing crime, and the article makes it seemingly effective.

Generally I experience that wanting the world to be a certain way does not necessarily make it so. The act of judging Islam, does not necessarily transform it, or its followers. To sway people, you have to understand how they are swayed. I do not discount that some might be swayed by criticism, threat or use of force (i.e. dealing with _potential_ extremists), but these are not necessarily the actions that have the best outcome. I think the "Aarhus model" is interesting in so far as that the officers involved seem to be pragmatical: hey, if we do this, then, in our experience and according to this science, we might very well achieve this certain desired outcome. So let's debate if that is true - instead of getting into this tiresome debate about how people need to be more negative about islam, which in no way I can ascertain contributes to change.

I do not believe in the "debate model of change": that people change when they "lose" a debate, and therefore we must all be voracious in our judgment of those people. The model seems to say: if only the entire western world voiced, in harmonic unison, this grand thesis that Islam itself is the problem, by sheer force of this combined act of judgment, the Islamic world would think "dude, I really think these people are on to something. They are right" and cast off their shackles and their cultural heritage. In fact, I find the model frightening because it says: "unless you join me in disparaging another people's culture, you are part of the problem". Which makes it impossible to have a debate on how to engage with people, because somehow engaging with them is seen as appeasement or agreeing with them (I can empathize with someone I do not agree with). Which limits the options we have in pragmatically working on changing our world: by engaging those people that are problematic, trying to find out why they think a certain way, and intervene in a way that maximises effect.

 _" In order to be involved in, or be a guide to, the transforming of the present into the future state - the essence of our work - one must have the skill to do this in such a way that the object with which one is working is not violated, but is transformed according its own laws" \- Kaplan_

EDITED to add: If I interpret you correctly, your argument is that these youngsters are not radicalized, because islam itself is radical, so "radicalized muslim" is a pleonasm of sorts. This is a flawed argument because it can not explain why some Muslims commit to violent action while others do not (reminder, there are hundreds of millions of muslims). For any productive discussion on change to take place, one will have to try and find the x here: "follower of islam + x = commits to violence". I do not know what exactly the x is, but I call people where x exists radicalized.

<comment><USER12> True, the article spoke nothing of moral equivalence. Glancing at commentary here I felt it needed to be said. I also agree it's not completely binary, as beliefs are contrasted over a highly myriad of interpretations coming from ones understanding of their faith and how it fits into their world view. I feel however to say nothing or contribute only in a form of western apologia, well it is disingenuous and should be shameful. If only we could be honest about the realities we are facing in the west. Additionally, those who are in their communities aware of the kind of individuals harboring doctrinal adherence should be willing, I mean if they truly have secular and pluralistic values in mind, to speak outwardly against it. Yet, I fear that to do so is extremely costly (death/physical harm/reputation) and so it continues to proliferate. Unfortunately, even if the debate model of change were to work the current debate is out of focus. I still think that debate is of little use other than to get your 15 mins at this point and that it is more important to speak outward against bad ideas in an honest and non-threating manner.

</comment></comment></comment><comment><USER8> A fascinating story, and a great initiative by the town police. The world needs more role models for non aggressive activism - we lack a Ghandi or MLK of our generation...

<comment><USER14> You mean someone that would argue against economic injustice, racism, violence, and had a decades old track record of doing so? (even to the point of marching with MLK himself)

Yes, if only our generation had someone like that running for president in the US.

<comment><USER15> Instead, we have people like that selling out to corrupt career politicians who can't say two sentences without lying through their teeth.

<comment><USER16> I get the impression that Jeremy Corbyn (in the UK) is much better than Bernie Sanders at helping build grassroots organizations that hopefully persist without him. I heard Bernie Sanders compared with Jesse Jackson's Rainbow Coalition, whose energy & commitment faded away after Jackson wasn't elected. Same with Ralph Nader, apparently.

<comment><USER11> It is a little too early to discount Sanders. Just because the media buzz around him isn't as strong doesn't mean many still don't respect him and he doesn't have influence amongst his supporters before he endorsed Clinton.

</comment></comment></comment></comment></comment><comment><USER11> It seems like no one realizes that this is a audiocast. Yes it's an hour, but listening to NPR is the thing to do on Sundays!

</comment><comment><USER17> This is a story about Somali Jamal in Denmark, who planned to join ISIS with his friends. But a cop called him, and apologized for uh.., thinking he might be a threat. So Jamal uh, changes his mind, but two of his buddies don't and die in Syria.

So if you hug a terrorist, he might not want to kill you as much, maybe.

You know who doesn't have this terrorist hugging problem?

Japan.

<comment><USER18> Could you describe Japan's approach in greater detail?

<comment><USER19> _Japanese society is one of the most ethnically, linguistically and culturally homogeneous societies in the world, composed of 98.5% ethnic Japanese._

[https://en.wikipedia.org/wiki/Japan](https://en.wikipedia.org/wiki/Japan)</comment></comment></comment>


Show HN: A "hacky" multiplayer version of the AI experiment "Quick, Draw " - <AUTHOR> http://quickdraw-withfriends.herokuapp.com <comment><AUTHOR> source: [https://github.com/zhirzh/quickdraw- withfriends](https://github.com/zhirzh/quickdraw-withfriends)</comment>


Tell HN NYC: Hackers & Founders NYC Meetup #5, 9/24 at Stand Burger - <AUTHOR> http://anyvite.com/tkozcje35z

<comment><USER2> Also, see <http://news.ycombinator.com/item?id=836283> if you're in NY and want to demo next month!</comment>


Ask HN: What is the Tech Scene in Switzerland like? - <AUTHOR> Hello HN ! I would like to have an overview of the tech and startup scene in Switzerland. Are there any so called "Unicorns", When and what was the biggest exit there and what the job market in the field is like there. Thank you. <comment><USER2> If you haven't seen it yet, check out Swissnex - [https://www.swissnex.org/](https://www.swissnex.org/)

<comment><AUTHOR> Thank you !

</comment></comment><comment><USER3> I am a programmer, turned tech recruiter and know most of the local IT firms.

Actually I have a draft blogpost written about tech firms / startups in town.

Ping me at firstname.lastname@example.com, I can give a good overview via email.

</comment><comment><USER4> 42 work week vs 40 in the states I live and work here and can say the tech seen is pretty bland compared to say NYC, Denver, SV etc. There is technopark zurich but even that is pretty slow, not much going on. I also read recently that Swiss investors still choose to invest in US startups rather than swiss.

</comment><comment><USER5> Earnings should be competitive but beware that the living cost is higher than the most.</comment>