Zombies once destroyed Japan's economy, now they're infecting China's - <AUTHOR> http://qz.com/198458/zombies-once-destroyed-japans-economy-now-theyre-infecting-chinas/ <comment><USER2> This is well written argument, but there is one big difference between China now and Japan then.

China is still going through urbanization in unprecedented scale. About half of the Chinese live in cities now. By 2030, cities will be home to 70 per cent of China's population and generate 75 per cent of its GDP. There will be 200 million Chinese moving into cities in next few decades. China can be close to where Japan is now in the 2040 banking crisis. For now, even massive crisis just delays the inevitable increase in demand that eats away all mistakes in fiscal and monetary policy.

[http://insights.som.yale.edu/insights/what-should-we- underst...](http://insights.som.yale.edu/insights/what-should-we-understand- about-urbanization-china)

[http://www.cn.undp.org/content/china/en/home/presscenter/pre...](http://www.cn.undp.org/content/china/en/home/presscenter/pressreleases/2013/08/unprecedented- pace-of-urbanization-presents-challenges-and-oppor/)

[http://www.cn.undp.org/content/china/en/home/presscenter/pre...](http://www.cn.undp.org/content/china/en/home/presscenter/pressreleases/2013/08/unprecedented- pace-of-urbanization-presents-challenges-and-oppor/)

<comment><USER3> Yes, the urbanization argument for this time it's different. There is bound to be massive urbanization in China. However what it ignores is the price of housing the newly urbanized can afford. Eventually it will have to settle to the economic value they add in the global marketplace. The price of housing at many of these new ghost cities is already close to the level of heavily developed western cities. So that leaves two possibilities

1\. Every newly urbanized Chinese person moving from the country side will generate the economic potential of a Chicago or London person. So another 200 million investment bankers I suppose.

2\. The property values of these ghost cities will dramatically deflate to measure up to the economic value added by the newly urbanized. Which means the value of these massive properties needs to written down by the banks.

Most people making the urbanization argument assume that option 1 will invariably occur. When in fact it is overwhelming likely that option 2 will occur looking at the massive number of people being urbanized and the massive deflationary pressure on every occupation. Urbanization per se will not cure the ghost cities problem. You have to look at the prices too.

<comment><USER2> There will be #2, but coming banking crisis will be temporary, not decades long zombie slump like in already developed and urbanized Japan.

<comment><USER3> The situation in Japan developed because the real estate got disconnected from its economic potential by a large margin. At the peak of the bubble in the mid-80's the land value of just the imperial palace in Tokyo was worth more than the entire land value of California. A million times ratio!!. There is no amount of urbanization that could have solved this problem for you because the underlying economics did not make sense. In the end, I'm not sure the Japanese had a choice, maybe they could have let some banks fail earlier but the size of the bubble was so massive that immediate deflation would have triggered a Lehmann like moment for them.

In fact, if Option 2 is correct I'm pretty sure the Chinese leadership has no other option but to deflate the economic gap with a zombie like situation for decades. If you think they will let a Lehmann-like moment to happen and quickly reset prices back to the 'right' level you are mistaken. It would put the financial system at risk; the entire legitimacy of the CCP in danger and that would mean blood on the streets. They will keep shutting down the smaller non-state banks and keep rolling the loans of the bigger state banks and gradually write off the debt over several years. There is definitely no shock therapy of short-term pain that makes sense.

<comment><USER4> The land value of Beijing is now 60% of US GDP, the same ratio Tokyo was at at its peak (its a somewhat odd measure, but hey).

</comment></comment></comment></comment></comment><comment><USER5> This is a superb article but it's scary how many of the points made apply directly to the US economy as well: zombie banks, real estate bubbles, a declining currency, faith in the bureaucrats and so on.

<comment><USER6> I think the underlying mechanism here is a centralized banking system in all three countries. Without getting into the religious discussion of whether a central bank is "right or "wrong", I would suggest that any system that relies on a small group of unelected humans making decisions on the supply of the underlying medium of exchange is imperfect and prone to favoring one group over another for reasons that are not positive for everyone.

<comment><USER7> In other words...we all agree that price fixing leads to either shortages or surpluses..but we all agree that fixing the price of money in a central bank is the right way to go. And we are not able to see the contradiction therein.

<comment><USER6> In the end it's a question of alternative mechanisms. Either we use the current system or we go with a "backed" medium of exchange. The "backed" version suffers from elasticity (but that may or may not be a good thing). So the issue becomes what are some other alternatives that aren't just derivative of the first two?

</comment></comment></comment></comment><comment><USER8> There is no need for a zombie China. Japan became a zombie due to terrible monetary policy. Ben Bernanke wrote a big paper about it: Japanese Monetary Policy: A case of self Induced Paralysis?

So even if China found itself in the exact same situation as Japan was that day, we'd only see the equivalent of a lost decade if the Chinese monetary policy was as backwards as that of the Japanese back then, and after that, and the latest world financial crisis, I'd be shocked if China repeated the behavior of yesteryear. This is especially true due to China's love of playing with the country's exchange rate. The Chinese central bank would not bat an eye if it had to devaluate the Renminbi forty percent.

So while the article describes the current situation very well, the predictions aren't really necessary given the premises.

<comment><USER9> Aren't they following the same path already? The massive dump in credit (cheap money) into the Chinese Banking system after 2008 seems to be following the same path that America/UK took after 2001. A recession causes the central bank to ease and real estate/asset bubbles begin to blow up but external factors (chinese export deflation in the 2000's, and weak global demand today) keep inflation low.

The cheap money effectively subverts large parts of the economy because they become dependent on it, but it only works while there are asset classes that can continue to rise and can be easily traded into and out of e.g. real estate.

Mr Bernanke as you quoted wrote a paper about this and yet in the end the Central Bank alone in the US could not contain the fallout when the bubble could blow no bigger. The US government had to absorb the losses by writing cheques to bailout the institutions that were failing until they reached a point where it was no longer politically feasible.

I don't see an easy solution to this, the issue is not just bad debt, it's that there won't be an asset class to bid up anymore, there won't be a practical way to get that easy credit into the system anymore.

</comment></comment><comment><USER10> The common factor across most political systems is that political/economic systems tend to carry on with the way they are going until they either proactively reform or hit a wall (a crisis or crash). The article explains well Japan's faults - without a definitive crash, politicians continued in their support of poor economic policies for a long, long time.

A few commenters argue that China is different - it has different features, but the above tendency will prevail here. Chinese politicians, businessmen and economists are hugely invested in a system that is top heavy, vastly corrupt and built around pillars of cheap labour, property/development and credit- based investment. Politically speaking, they are also committed to a system based around media control, repression, lack of debate and 'stability' (ie. no change of the political status quo).

My personal fear - my house, family and business are all in China - is that in the face of an economic crisis, we will also see a backwards slide into repression as the party attempts to put an iron grip on the economy AND public opinion.

My great hope is that China will see a few years of correction - letting the people's income catch up with the bubbles, supported by a government that is aware of the problems and motivated to act. Let's see...

</comment><comment><USER11> I read the Quartz regularly and enjoy much of what they write. However, they do appear to have an obsession with China and are nearly all doom and gloom. Maybe that's because they're right and China is a house of cards about to fall but I've found I have to take everything they write on China with a pinch of salt as they write 1 or 2 articles per week on how screwed China is.

<comment><USER12> Is Quartz biased against China or are other news organizations restricting their reporting in order to ensure maximum access to the Chinese market?

[http://www.nytimes.com/2014/03/21/business/international/blo...](http://www.nytimes.com/2014/03/21/business/international/bloomberg- should-have-rethought-articles-on-china-chairman-says.html)

</comment></comment><comment><USER13> First I read all the comments already posted here. Then I read the fine article from beginning to end. This is a good article, and well worth a read. I am old enough to remember the kind of reporting that was done about Japan in the English-language press back when the book _Japan as Number One_ [1] had just been published. Japan used to look unstoppable in the same way that China looks world-beating to many people now. But Japan's "lost decade" of minimal economic growth and declining soft power in the world has lasted a lot longer than just one decade.

Japan in the 1980s already had significant advantages that China still lacks in the 2010s. First of all, it had a political system with actual elections that weren't wholly rigged. (The political system in Japan has opened up more since then, but even thirty years ago it was well ahead of where China's political system is now.) Second, Japan had a free press and unfettered access to foreign reporters and foreign news media for decades by the 1980s. China still doesn't have either of those information channels for correcting problems in sufficient degree. Third, although primary education in China is quite good in urban areas, good primary education in China is still not as pervasive nationwide as it was in Japan by the 1980s. That's illustrated in part by how few people in China (compared to Japan) are even conversant in the national language. Barely more than half the population is conversant in standard Mandarin Chinese.[2]

China is at risk. The "socialism with Chinese characteristics" (中国特色社会主义) economic policy it officially now has cannot be sustained. It looks like it has been growing rapidly in recent years for some of the same reasons that Spain looked like it was growing rapidly a decade ago--a housing bubble. The inevitable correction that has to happen in the investment markets in China may not bring about a recession, but it can't help but bring about a change of investment priorities that may make China look less amazing for a while. China will really rise to world prominence when its common people enjoy free and fair elections, a free press, and good educational opportunity all over the country, something I hope they experience sooner rather than later. Meanwhile, I'm actually more optimistic about India during my lifetime.

[1] [http://www.amazon.com/Japan-Number-One-Lessons- America/dp/15...](http://www.amazon.com/Japan-Number-One-Lessons- America/dp/1583484108)

[2] [http://www.bbc.com/news/world-asia- china-23975037](http://www.bbc.com/news/world-asia-china-23975037)

[http://news.xinhuanet.com/english/2007-03/07/content_5812838...](http://news.xinhuanet.com/english/2007-03/07/content_5812838.htm)

<comment><USER14> > China will really rise to world prominence when its common people enjoy free > and fair elections, a free press, and good educational opportunity all over > the country...

Why?

<comment><USER15> People were saying the same thing about the USSR half a century ago ("I have seen the future..."), and we all know how that turned out. The simple fact is that sustained growth is not possible under oppressive governments because they don't permit creative destruction. Those who are in control will fight to maintain the status quo once they can no longer create further growth in a non-disruptive manner. We see this in America as well, as a result of regulatory capture.

The role of government should be to provide for the less fortunate (but only where they are in that situation for reasons out of their control) and to create a level playing field for all entrants (whether that be workers entering the labor market or companies entering industrial markets), no more. Of course, the devil is in the details, since what sort of intervention is required to create a level playing field varies wildly by industry/market, and it gets constantly reshaped as technology advances. And of course, no one has so far found a good solution to regulatory capture.

<comment><USER16> I think the natural distinction to make here is that the USSR had a poor economic system, but that this is independent from whether their government is autocratic or not. You can have a non Democratic government but still have a high-growth economic policy, which the Chinese have arguably attained.

<comment><USER15> My whole point is that the contemporary understanding that the USSR's economic system was flawed was not apparent to Westerners half a century ago. This is exactly the "I have seen the future" sentiment that I previously referred to. Many Westerners, including Americans, were genuinely afraid that the USSR would come to economically dominate, that they had developed a superior system. The fact that so few people realize that these days is a testament to the enduring success of the Western system.

In the 30s (yes, during the Great Depression), 40s, and 50s, the Soviets achieved rapid economic growth, largely because they were starting from such an economically backward situation (ring any bells when it comes to China?). But when growth on the basis of "catching up" started to plateau, they could make no further progress.

<comment><USER17> > But when growth on the basis of "catching up" started to plateau, they could > make no further progress.

That's a bold statement, the Soviet Union was far too big and non-homogenous a construct to easily hand wave such generalizations. The post Soviet states are (and were) rich in natural resources and before the exodus of the last 25 or so years, had a very strong engineering and scientific base. You'll have to be a lot more specific about when "cathing up" is supposed to plateu because much, if not most of, the soviet republics had (and still have) a long way to go to catch up with the western world.

I also don't see how it applies to China. Just like it was with the Soviet Union, China's success or failure will depend on their leadership but they are in a very different situation. The Soviet Union's entire political and social structure was in upheaval in the 1980s and all sectors of government suffered as a result, especially the ones in engineering, with wildly mismanaged civil and technological projects. China, although I'll admit I have little confidence in the accuracy of media analysis of the political situation there, doesn't seem to have anywhere near the systemic instability that the USSR did since it's population, although bigger, seems far more homogenous and united under the state. Even though they aren't as resource rich relative to the size of their population, they happen to be a major economic economic partner ( _supplier_ ) not only of many of its allies, but also its rivals (the US & Europe).

<comment><USER15> > You'll have to be a lot more specific about when "cathing up" is supposed to > plateu because much, if not most of, the soviet republics had (and still > have) a long way to go to catch up with the western world.

The plateauing process is gradual, so stagnation started long before they finished catching up (not to mention the chaos of the post-Soviet era resulted in a few steps backwards). When you've got an oppressive government that justifies its legitimacy on the basis of growth, people are going to get antsy from the slowdown long before you actually reach 1st world levels.

> I also don't see how it applies to China.

It applies to China because the authoritarian Chinese government results in the politically powerful directly benefiting from the economic growth. Like I said, innovation requires creative destruction, and this won't happen when the political (and therefore economic) system is controlled by those who benefit from maintaining the status quo.

This is not all that different from how the Japanese government and banks (many of which were nationalized) propped up the "zombie" companies for years, rather than investing that capital in newer firms.

> China, although I'll admit I have little confidence in the accuracy of media > analysis of the political situation there, doesn't seem to have anywhere > near the systemic instability that the USSR

Because China hasn't yet reached the state that the USSR was in in the 80s. It's still growing, even if not at the same clip that it was a decade ago.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> I'm not too impressed by this argument. You could easily compare China with South Korea or Taiwan and come to the opposite conclusion. This is why you should never trust an argument that relies on two data points.

In fact, don't trust macroeconomists in general: individual preferences cannot be aggregated, at least not with our present mathematical tools. As a result, micro-founded macro models (99% of them) are complete nonsense: that's why Caltech doesn't even bother teaching macro to its PhD students anymore. It also explains why DSGE models have no predictive power whatsoever. Rant over.

<comment><USER19> indeed

[http://econlog.econlib.org/archives/2008/03/junk_macroecono_...](http://econlog.econlib.org/archives/2008/03/junk_macroecono_1.html)

</comment></comment><comment><USER20> One important point not mentioned: Japan were alone when the country's economy collapsed in late 80's. Today's China is surrounded with relatively strong peripheral economies (Taiwan, Korea, etc.) The support is there. Also, do not discount black-market economy. It's difficult to keep track of economic progress in a cash-based economy. The strength of China's domestic economy is often discounted by foreigners because of economic activities unaccounted for. The real worry is the aging population and the lack of social welfare.

<comment><USER21> While the lack of social welfare could be considered a problem from a moral perspective, in terms of the national economy it's not a negative.

Compare for instance the situation where 50% of elderly Chinese starve after they stop working, and the situation where 50% go on extensive state welfare. In both situations the elderly aren't producing anything, but in the latter they're consuming national resources and in the former they aren't, so from an economic perspective the former would produce better results.

Of course this isn't a very humane way of looking at it, but the Chinese leadership don't have a history of particularly humane behaviour.

</comment></comment><comment><USER22> Even if it starts stagnating it will pass the US in total GDP. China has 10x the population of Japan. Not that it matters. The average Chinese will still be a lot poorer than the average American.

<comment><USER23> However, thanks to the PRC's 1979 "one-child policy", they look to be the first country to skip from the "industrializing" stage which generally has reasonable population growth (weasel wording since Japan's fertility started declining in _1974_ and has yet to stop), to the sort of modern social welfare state we see in the West with too few producers trying to support too many dependents. Except of course they don't have much of a welfare state.

It's sometimes called the 4-2-1 problem: 4 grandparents produced 2 parents who produced 1 child. It's one of the reasons for their very high savings rates, even with negative real returns. And like Japan, the retirees are in for unpleasant times when they try to turn paper wealth into real consumption.

</comment></comment><comment><USER24> That's a really nice piece, specially given the comparisons used in the article. However, as a layman, I wonder whether 1) chinese socialism and 2) its ownership of other major countries' debt make it all different or not. I suppose it does. Their government seems able to do "magic" tricks with its economy without pretty much any foreigner nosing around, and it also seems to me that the chinese are everywhere. I don't recall japanese companies owning so much of the world back in the 90's as the chinese do now with their infrastructures projects in South America and Africa, the US's debt thing etc. I think if they ever fail like the japanese did, they'd eventually drag a lot of countries with them down the hole because of these global tentacles.

Except if the only part of this article worth analysing is its very end: "[...] or permitting foreign banks to compete [in the chinese market]", then it's case closed and it was just a piece of banking propaganda against China.

<comment><USER25> Japan is actually the second biggest foreign holder of US debt. As of February 2014, Japan held 1.210 trillion of US debt while China held 1.272 trillion.

[http://www.treasury.gov/ticdata/Publish/mfh.txt](http://www.treasury.gov/ticdata/Publish/mfh.txt)

I am having trouble finding historical data, but what I can find from the 90s indicates that Japan alternated for the top foreign US debt holder with the UK. I am not really sure what data to look for general Japanese foreign investment.

</comment></comment><comment><USER26> These "We're #1 and they're going down" articles irk me. Look at the last decade:

[http://snbchf.com/global-macro/gdp-growth-per- capita/](http://snbchf.com/global-macro/gdp-growth-per-capita/)

As the proverb goes, we need to take the plank out of our own eye. Those commies in Sweden are kicking our libertarian asses.

<comment><USER27> Of course, in terms of raw dollars US GDP annual _growth_ is the same or higher than Sweden's _entire_ GDP.

<comment><USER26> Even the GDP per capita number is misleadingly optimistic if the 0.01% are taking the lion's share of growth that I'll stipulate might be "the same or higher than Sweden's _entire_ GDP."

If the typical American isn't prospering, what good is it?

<comment><USER28> >If the typical American isn't prospering, what good is it?

Well, neither is the typical Swede. They have an astronomical housing bubble that's just waiting to burst, the average household has a debt around twice the income, while the gap between rich and poor has been widening for a long time now.

It's not all roses and relative to where they are, most seem to be preparing for worse days ahead, rather than better ones.

<comment><USER26> The reason I used Sweden as an example is that many Americans think commerce in Sweden must be hobbled by taxes and regulation. It must surprise some people that Sweden's GDP per capita has grown the most among Western industrial nations, and much more than the US.

I'm not claiming the wealth gap in Sweden is healthy on an absolute scale, but relative to the US it's about half. Every economy has challenges, but the historical results I posted show that US chest-thumping is exceptionally silly.

</comment></comment></comment></comment></comment><comment><USER29> Yeah that's great. We're well on our way to a lost decade or two ourselves, replete with zombie banks and corporations. This might as well be an indictment of the decline of the US rather than the decline of China or Japan.

</comment><comment><USER30> China's GDP has grown 7% or more every year since 1991. It had an impressive economic record before that as well. You can read gloomy articles like this going back to 1949. In that time, China has become the second largest economy in the world. I was reading articles like this a decade ago, I was reading articles like this two decades ago. People have been saying the sky is falling since 1949. Despite all of that, China's GDP will probably grow 7% this year, as well as 7% next year.

</comment><comment> Al-Khwarizmi This Quartz website, often linked in HN, is a usability nightmare. In my Android phone's browser, I just cannot see any text at all, apparently I see a sidebar full-screen. In my choice desktop browser (Opera 12), I do see the article but for some reason it auto-scrolls up every few seconds, so I cannot read it.

I can read it in Firefox but with noticeable UI latency when scrolling, as if my computer was 3 or 4 years older than it is.

Seriously, these guys should fix their website...

<comment> T-hawk Quartz does the same thing in Opera 12 for me. (Hooray, I'm not the last Opera 12 holdout on the planet.) Turning off Javascript for the site makes it readable normally, though.

</comment></comment><comment><USER31> A well written article, I liked that it avoided jargon.

<comment><USER23> Indeed, although there's one bit of jargon I recently learned that I think is really useful: financial repression ([https://en.wikipedia.org/wiki/Financial_repression](https://en.wikipedia.org/wiki/Financial_repression)).

Ask anyone in the US trying to live off interest income right now, like my 77 and 80 year old parents. Aren't that real interest rates in the US negative or thereabouts, and I read that was true following the bust in Japan.

(Except of course in the US as of now our money isn't trapped in the country, unlike Japan's back then for individuals and small business as mentioned in the article, or China, who's currency wasn't even internationally traded until a pilot scheme started in 2009, and is still, in the scheme of things, taking baby steps.)

</comment></comment><comment><USER32> It's funny, but the banks in the US are not being allowed to die either. Could we be in the same boat?

</comment><comment><USER33> Well, I can't comment on the macro economics, but on the small business side, I can say that China will do much better than Japan. The Japanese are deadly afraid of commitment and responsibility for some reason (the culture, likely), which is not the case with the Chinese, who can bootstrap like crazy and are less afraid of taking risks - although the latter might be because they have nothing to lose. Plus, China's got 10x the population...

<comment><USER34> The Japanese are afraid of responsibility since what century exactly? I've never heard of that. I've only heard the opposite in fact: that being responsible is among the most important cultural things to the Japanese. You see it in the history of how they view employment between employers and workers for example. A general sense of making things right.

I think you'd be very hard pressed to find a people more responsible than the Japanese.

<comment><USER35> Probably has something to do with their high national debt. Many people seem to believe that high national debt reflects a population that chooses government subsidies over employment. You see that with Greece and Spain a lot.

<comment><USER36> Huh? Japan's employment rate remains extraordinarily high (3.6% unemployment, after ~20 years of recession!), and Japan's government debt is almost entirely to Japanese investors.

<comment><USER35> Indeed it is. Perhaps I wasn't articulate enough; I disagree with the notion that the Japanese are "deadly afraid of commitment and responsibility."

</comment></comment></comment></comment></comment><comment><USER37> Why no one mentioned the big difference between china and japan? Japan is actually a dependant state of usa. So usa can take advantage of japan whenever it wants, consider the Plaza Accord when usa destroyed japan's economy. China, whatever you name it, is a independent nation. It is not easy to order China to do something, not like japan.</comment>


The Virus That Blocks Itself - <AUTHOR> http://www.f-secure.com/weblog/archives/00002138.html

<comment><USER2> I'm starting to gain a lot of respect for F-Secure. First catching the false- positive on the Samsung "SL" keylogger debacle, and then further reporting on other virus traits.

I think i'm going to move over to them pretty soon since Avast let me down quite a few times recently.</comment>


Learning how to program in Oman in the 90's - <AUTHOR> http://vivin.net/2016/07/26/learning-how-to-program-in-oman-in-the-90s/ <comment><USER2> I can one up you. I learned how to program in Oman in the 80's.

Most of what I learned was on a C64, initially basic but very quickly switched to assembly.

Coding involved waiting for 1-2 month old magazines arriving and painstakingly typing in all the code to eventually end up with a snake game or similar.

In terms of actual games, there were two avenues:

\- Mail order from the UK (takes roughly 2-3 months for it to be shipped and arrive). I still very fondly remember the rush of adrenalin when my dad would say 'there's mail for you'.

\- There was a Chinese antiques shop in Ruwi that had a back room with some Chinese enthusiast computing guy who sold games. He eventually got me hooked onto PCs (showed me a mindblowing 286 with CGA graphics which I graduated to after my C64, my parents refused to buy me an Amiga as they thought I'd just use it for gaming).

I ended up becoming quite good at cracking software protection (pretty easy when all you had to do is look through 64kb of ram, you could literally read the whole thing in a few hours), and setting up a dodgy business selling games to everyone at school.

I always felt very out of place though as few people shared the passion I had for this stuff. Moving to the UK after high school for A levels/university and discovering like minded people on BBSs and then the internet in the early 90's was pretty life changing. Suddenly I was not alone, it turns out there's a huge swathe of people that have the exact same passions!

<comment><AUTHOR> It's crazy how much motivation and passion you can get when information is so scarce, and you just want to play games :D I don't regret what I had to go through either.

</comment></comment><comment><USER3> > But even that was a non-trivial endeavor in those days. You couldn't just > click or touch an icon on the screen to launch the game; you had to use > command-line.

I hear this a lot in retrospectives but was this really that challenging? I remember using DOS when I was in grade 3 (7-8 yrs old) and being able to easily navigate around the primitive computer that was at my moms house most of the week, while using windows 95 at my dads on weekends.

I remember learning to type `help` and running the various commands that appeared with trial/error as an enjoyable experience, not one that was intimidating. And I wasn't a particularly precocious kid, my nerd-dom was late blooming.

I actually found it made me want to explore the depths of the computer more than Windows 95 where I would mostly just click the Doom icon and maybe tinker around with creating a few briefcase folders (which I only just learned the functionality of recently :P).

<comment><USER4> Same, I learned DOS, BASIC and a bit of asm when I was 9 or 10 (late 80s), from a single book and mucking about. So did a lot of my friends. Kids learn pretty quick.

Good memories in the article, interesting how people went through the same stuff around the world

<comment><USER3> > BASIC and a bit of asm

Lucky. I unfortunately picked up a C++ book from the library as my first coding book around that same age and was intimidated away from programming for a few yrs until high school. I wished I grabbed the BASIC book instead, which would have been far more accessible, but I had read somewhere that video games were made in C++ which led me astray.

</comment></comment></comment><comment><USER5> Hey Vivin! Great to see this. Also grew up in Oman (went to ISM). Good old days! Times when the only games you could get were from some shady stores in Ruwi or in CCC or Al-Harthy Complex. So so nice to see all the hacks you were up to be able to play cool games.

<comment><USER6> This hits close to home. I grew up in Saudi in the 90s and had a very similar experience - stared out on an Atari 65XE, moved on to a 486 with QBasic, then QuickBasic, Turbo Pascal and later Visual Basic and VC++ (with a detour to Borland C++).

The jump from QBasic to Quick Basic and understanding .EXEs, compilation etc was the turning point for me in understanding programming, debugging and operating systems.

Your note on the shady stores reminds me of doing the same - in the pre- internet/warez era, the only place to get software in the Gulf was in shady malls selling floppies (and later CDs) chock full with pirated software for 10 riyals/dirhams

<comment><USER7> >The jump from QBasic to Quick Basic and understanding .EXEs, compilation etc was the turning point for me in understanding programming, debugging and operating systems.

That's hilarious. I remember I was pissed off: why certain files do stuff and are games and all. How do they do that!

So I created a new .TXT file and changed its extension to .COM and tried to execute it. Then to .EXE.

It didn't work. I don't know what I expected back then, for it to magically do something cool I suppose.

The executables came when I got Visual BASIC for DOS. Wow! You could also make forms with buttons!

It was in on a CD that had a bunch of software on it that came with .NFO files I'd read and wonder "what was that BBS stuff they were talking about. They seem to get together and have fun with computers". They were crews who crack stuff.

<comment><AUTHOR> Oh, wow! I did the exact same thing! I remember thinking why some files would just "run" from the command-line and why others wouldn't! I remember renaming a .TXT file to .COM or .EXE and also wondering why it wouldn't run!

</comment></comment></comment></comment><comment><USER8> Hah I think we must have had the same Logo teacher. I vividly remember him telling us that the computer is stupid and that it would only do what we told it to. I must have been around 8 years old, late 80's I think.

My interest in computers only resurfaced around 5-6 years later, complete with Geocities and Xoom experiments! How I wish I could find those first sites I made using Frontpage and copying HTML from other sites.

That was a nice read!

<comment><USER9> I read once that computers are like magic genies: they will grant your every wish, so long as you are able to carefully articulate what you want in such detail and with so little ambiguity that they cannot possibly misinterpret what you wish for.

</comment></comment><comment><USER10> Sometimes the lack of resources makes life simple and fun. I miss the feeling of doing things aimlessly just for the sake of doing them. Not for some reward or even the perceived value of what the task is. Nostalgia is the word that best describes this post :)

</comment><comment><USER11> For the slighter earlier Late 70's & 80's era, I think the magazines provided the most information on programming. I think I bought one book, but spent a lot of time typing in programs from magazines and learning how it all worked.</comment>


Ask HN: Kickstarter for Data Science? - <AUTHOR> With OpenAI's decision not to release the fully-trained model for their GPT-2 NLP model, some ambitious people have attempted to 1) build a similar dataset (40G of text), and 2) find funds to train the model (~$40,000).
1) https://github.com/jcpeterson/openwebtext
2) https://www.reddit.com/r/MachineLearning/comments/av7s38/d_i_won_20000_maybe_120000_of_google_cloud_credit/
Over the past year I've noticed that the best ML work requires scale that is impractical to individuals working without corporate funding. If this trend grows, it seems to me that innovation will be stifled. OpenAI wasn't wrong to be cautious about releasing an OP NLP model, because innovation is intrinsically amoral. A fine-tuned GPT-2 model for spear-phishing attacks could cause havoc. However, a GPT-2 model for identifying spear-phishing attacks could be inversely useful. But the question of distributing power verses centralizing power is settled among Hackers: distributing power (i.e., solutions) is always better, because "no problem should be solved twice" and "drudgery is evil".
Which is why I offer this question to Hacker News.
Would a "Kickstarter for Data Science" work? What would it have to look like to work? And by "work", I mean that models like the GPT-2 would be efficiently funded, trained, and released to the public. <comment><AUTHOR> Some thoughts on implementation, on the spectrum of automation:

\- No automation: run a real Kickstarter project, which would serve to test the concept itself.

\- Light automation: recreate Kickstarter (UI + finance), but fine-tuned for Data Science.

\- Full automation: Along with the DS-Kickstarter website, automate the training of models with the use of Github repos and Kubernetes/TPUs.</comment>


Ask HN: Looking to freelancing as a source of income - <AUTHOR> Hi, I currently live in a place where the tech industry is pretty... well, nonexistant to say the least. This doesn't bode well for me given my interest in web development. So, instead, I've looked to freelancing as a source of income. I'm curious as to see if it'd be enough to support me without any other source of income. Also if you could tell me where/how you freelance (such as upwork) that'd be greatly appreciated, thanks! <comment><USER2> Definitely not upwork and all these freelancer websites. Most of the projects are unverified and fake.

Word of mouth is the key in the freelance world. The other key is to create your network before moving to an isolated and cheap place. In your case I have to say... oops

</comment><comment><USER3> My previous company have several people full time through upwork. Where are you located? It can be enough income depending where you are. It should be easy to clear $50k USD per year.

</comment><comment><USER4> "Enough."

None of that through Upwork and all of it through personal connections.

</comment><comment><USER5> telling someone who doesnt have industry connections to get work through industry connections is a bit lame.

first of all, quit calling it freelamce. freelancers build websites for small businesses who think 2k is way too much for a months worth of work.

if you want to pursue this, you are a consultant. ever heard of a freelancer as a tech company? exactly.

if youve got skills, toptal can be a good place to get started with contract work. the signup process is lengthy. you will have to solve the usual programming and algorithm tests. the projects on toptal are certainly not fake.</comment>


Getting into the Habit of Reading - <AUTHOR> https://blog.phuaxueyong.com/post/2020-07-20-articles-of-july/ <comment><USER2> Does anyone have a problem with getting into reading?

My problem is not about making myself read, but how to find time for all the technical and business skills that I need to read.

And I am not even talking about fiction books, that I want to read, but put aside for now.

I am more curious to see how other people find time for reading?

Business oriented books I tend to listen as audio books while driving. But technical literature could not be addressed this way.</comment>


Police arrest 12-year-old boy after racist messages are sent to Wilfried Zaha - <AUTHOR> https://www.theguardian.com/football/2020/jul/12/police-arrest-12-year-old-boy-after-racist-messages-are-sent-to-wilfried-zaha <comment><USER2> I wonder on what grounds they arrested a minor for private speech (sounded like a DM), which is more protected than public speech? True we don't want to condone such behavior, but we cannot start sidestepping laws which have more broad contexts. This seems like a slippery slope into rules which no longer matter.</comment>


Kit Programming Language - <AUTHOR> https://www.kitlang.org/ <comment><USER2> >designed with game development in mind

What design decision and features were made according to that? Basically, what "designed for game development" means?

Also checking the commit history, first commit [1] says that it is after a rewrite in Haskell. What was the original language and why made the change?

[1]: [https://github.com/kitlang/kit/commit/4d3de98f218f2427529ac4...](https://github.com/kitlang/kit/commit/4d3de98f218f2427529ac4af098d8398434ebbef)

<comment><USER3> Hi, creator here.

>Basically, what "designed for game development" means?

I've been doing a lot of work in Haxe, but have struggled with performance issues due to GC and memory churn. I wanted a lower level language with more control, but without sacrificing the ergonomics and abstractions I'm used to. Term rewriting and implicits are examples of features that let me layer abstractions onto a language but still maintain complete control.

>What was the original language and why made the change?

It's not up on GitHub, but the prototype was begun in Rust. Ultimately I found I'm much more productive in Haskell and made the switch.

</comment></comment><comment><USER4> This looks like it takes influences variously from Haxe, Rust, and Haskell, which are all great in my book. But the first thing that crossed my mind was, "could it compile to other languages besides C?"

The reason being that I think the way to really move up the baseline is to take another page from Haxe and aim for cross-compatibility between different systems languages, becoming a "language that unites them all". So that could mean relatively new and hip ones like Rust, D or Zig, or older ones like Pascal(Delphi), Fortran, Cobol...

And those are niches relative to C, but they're nearly unserved niches AFAIK.

<comment><USER5> AFAIK languages "compile to C" mainly because they use C as an intermediate representation and the C compiler as the last stage of the compile/link process, so kitlang itself doesn't need to support code generation for various CPUs, and also doesn't need to implement an LLVM frontend. Instead it uses the target platform's C compiler, which is a lot less work but has basically no downsides.

Also the C IR code might make it easier to interop with other languages, since C is basically the 'lingua franca' that all other languages can talk to in some form.

<comment><USER6> _> Instead it uses the target platform's C compiler, which is a lot less work but has basically no downsides._

The downsides of leveraging a platform's given C compiler as your backend is that now you'll be spending a large chunk of time learning the hard way about all the various incompatibilities in C compilers, and adding workarounds in your frontend for the otherwise-unpatchable behavior encountered in every old version of every major compiler on every platform you wish to support.

Conversely, the advantage of using a single known backend is that you can automatically know what code your users are running when they submit a bug report, and you can fork and ship the patch yourself rather than trying to convince an upstream C compiler to accept the patch, then convince the upstream distro to ship the new version of the compiler, then convincing all your users to update their platform C compiler.

Walter Bright concurs: [https://news.ycombinator.com/item?id=16195031](https://news.ycombinator.com/item?id=16195031)

Kit may have an easier time of it if it's intended only for games, since that narrows down its supported target platforms substantially. The harsh truth is that most game devs only care about one platform (Windows) and one toolchain (MSVC), so at least it can tailor its output to appease MSVC specifically.

<comment><USER7> No, I'm targetting C89 (because of msvc) and there almost no platform quirks than some line length limit on msvc. c99 would be nicer of course.

</comment></comment></comment></comment><comment><USER8> > "Memory management in Kit is manual (no automatic garbage collection), with > some convenience features to make this easier."

I was curious, but there aren't any examples of this on [https://www.kitlang.org/examples.html](https://www.kitlang.org/examples.html)

</comment><comment><USER9> I am far more interested in the comparison between kit and Zig.

<comment><USER3> I'm planning to get a more detailed comparison with languages in the same space. Kit and Zig overlap quite a bit; the main difference I see is philosophical. A major goal in Kit is to be concise, expressive and eliminate boilerplate; Zig perfers to be straightforward and readable, where a function call at runtime always looks like a function call in your code. Term rewriting and implicits are examples of features in Kit that probably wouldn't be implemented in Zig. Also, Zig aims to replace and compete with C, Kit just wants to leverage it, so the scopes are quite different.

Zig is awesome - I've used it and would use it again, I'm funding the creator on Patreon, and I see these two languages as filling slightly different niches and having different pros and cons.

<comment><USER10> Jai is another popular one that originally compiled to C and is aimed at game development. Any thoughts on that?

EDIT: Your responses in these threads have been great, by the way!

<comment><USER11> it's a bit of an overstatement to call jai popular, seeing as how it hasn't benen released yet. but yes, it's a very interesting looking language, and the development notes are great.

</comment></comment></comment></comment><comment><USER12> I like how clean the lexer is: [https://github.com/kitlang/kit/blob/master/src/Kit/Parser/Le...](https://github.com/kitlang/kit/blob/master/src/Kit/Parser/Lexer.x)

</comment><comment><USER13> Ben, could you go a little into detail on what you had in mind with the term rewriting system? The sin/cos example seems a little underwhelming, since these should be evaluated at compile-time in the first place.

They seem like a variant on C macros, but without the restriction on function syntax. Maybe one could implement Python's with statement in userland, which is very nice.

It also seems to me that you could replace C++ templates, yet you do have generics. How come? What's the difference?

My intuition is that ambiguities are at least possible, so what about precedence, which AST term is evaluated first? I'm thinking of some situation where two subtrees match the rule, but you end up with different results depending on which is transformed first. E. g. if you were to define a cross product rule, and apply it to a × b × c.

What about infinite loops in rule sets? What about recursion?

What about a situation where multiple rules could be applied? Is there any way to debug the transformations? Is that what the `using` scopes are for? If the compiler was to detect ambiguities, that seems pretty expensive, because it would need to match every rule to every subtree, right?

This thing seems very, very powerful, I just find it a bit hard to grasp what you can do with it in practice, and what the limitations are. I would be very interested to hear what you ran into so far.

<comment><USER3> I think this thread captures a more interesting application of term rewriting: [https://twitter.com/bendmorris/status/1041130408463687681](https://twitter.com/bendmorris/status/1041130408463687681)

>My intuition is that ambiguities are at least possible, so what about precedence, which AST term is evaluated first? I'm thinking of some situation where two subtrees match the rule, but you end up with different results depending on which is transformed first. E. g. if you were to define a cross product rule, and apply it to a × b × c.

This is absolutely a potential issue, and the examples I have up now are quite bad. This is why it's important for rules to be strictly scoped. The only rules that can affect an expression are the ones you've explicitly brought in with a "using" block, or those that are defined for the types you're directly working with. Given the scoping, I think overlapping rule applications will be uncommon in practice.

>What about infinite loops in rule sets? What about recursion?

There's a sanity limit on the number of times an expression can be rewritten, and it'll show an error in that case which displays the transformations that triggered the limit (including the first, last, and any non-repeating transformations going backward from the last - so it should be very clear.)

>Is there any way to debug the transformations?

This is definitely an area for improvement. I'm planning to (1) add enforced "rewrite this" metadata that will fail to compile if the expression isn't rewritten, and (2) enable dumping not only the final AST but also all of the transformations that occurred.

<comment><USER2> It seems you've independently rediscovered extensible programming which had seen much research in the past and again a few years back. There have been a number of languages that did same thing as in your tweet (e.g. [1]) but most aren't developed anymore.

[1]: [http://seed7.sourceforge.net/examples/declstat.htm](http://seed7.sourceforge.net/examples/declstat.htm)

<comment><USER13> Neat, another one for my list. Seed7 allows the extension of the grammar [1]. The compiler understands a simple EBNF which doesn't distinguish between different non-terminals. The semantic checks and the transformation into a known AST are deferred to another stage.

[1]: [http://seed7.sourceforge.net/manual/syntax.htm](http://seed7.sourceforge.net/manual/syntax.htm)

</comment></comment></comment></comment><comment><USER14> Well designed language! I particularly like that you took great features from Haxe such as Abstracts. So far i didn't see any WTF!?'s in the language syntax, which is rare these days. People these days can get too inventive when designing new languages. I like that you kept things readable (looking at you Rust :) . Nice work!

</comment><comment><USER15> How is this better than Clay, other than the fact it is being maintained?

[http://claylabs.com/clay/](http://claylabs.com/clay/)

[https://github.com/jckarter/clay/wiki/Avoiding-generic- progr...](https://github.com/jckarter/clay/wiki/Avoiding-generic-programming- pitfalls)

</comment><comment><USER16> Anyone is actually using it? If so, could you compare it to Nim that also compiles to C?

</comment><comment><USER17> If it is truly embeddable in a C program (there was some note about using this as a library in a C program), then this would be a fantastic way to augment development of software in C -- it seems to improve on the C programming language. I like the support for generics and type inference and have always wished C had that. The C interop story looks very good too.

</comment><comment><USER18> This seems to be competing in a similar space to Zig, and especially Jai. How does it compare to them?

<comment><USER3> I commented on Zig elsewhere in this thread. Since Jai is unreleased I don't know a lot about it, but their AoS/SoA convertibility was an interesting feature (you can do this in user space in Kit via term rewriting) and I wanted to make it similarly ergonomic to pass around custom allocators.

</comment></comment><comment><USER19> Interesting language! I saw a "throw" in an example, but I don't see exeptions mentioned anywhere? Woulb be interesting to know why a language with performance focus has exceptions (or are they implemented differently?).

<comment><USER3> Good "catch" ;) "throw" in Kit is vestigial; there's no error handling mechanism implemented yet, and I've gone back to the design phase to consider some alternatives.

</comment></comment><comment><USER20> This is the first language posted on HN I like. Really nice. How is utf8 supported. What about graphical apps? Android? Web server? How's the performance?

</comment><comment><USER21> This looks amazing! Does it support parallel/multicore programming?

</comment><comment><USER22> Ben, would you cite Scala at all as a source for inspiration?

<comment><USER3> Certainly. I don't used Scala much but the inspiration is probably easy to see.

</comment></comment><comment><USER23> Any examples of games that were created using Kit lang?

<comment><USER2> It seems it is a very new language, started only few months ago so probably there is nothing created with it yet.

</comment></comment><comment><USER24> Kit looks interesting. But i am going to stick with Haskell.

</comment><comment><USER25> Another programming language. God! I have no idea - what's happening to the world?

Are people not skilled enough to propose or send commits to an existing or alternative programming language?

There is Rust, Go, Julia, Clojure, and many other...

What is the primary reason to create a new programming language?

<comment><USER5> Rust, Go, Swift, etc... are like super-tankers compared to those small "better-C" languages. IMHO, having a number of small languages that can be learned in an afternoon is _much_ better than yet another super-tanker designed by huge consensus-driven committees/communities that try to do everything for everybody.

<comment><USER26> Rust has safety and zero-cost abstractions at it's core, they provide a by now quite stable interface. You can't just move fast and break things. You need to stabilize at some point or it's impossible to use it in real world projects that are also commitments of a certain kind. And for that stability you need some kind of consensus of what to work on and what not to do.

I think the primary value of these new toy languages is they can explore aspects freely that can't just be explored in a more mature language. Sometimes after a concept has proven useful a mature language might be willing to incorporate it.

But I wouldn't use them on a serious project, because there will probably be few libraries and maybe no long term support for it.

<comment><USER3> These are valid concerns, particularly stability and long term support. Availability of libraries applies less to Kit or Zig thanks to first-class interoperability with C. I think this is the way forward for small new languages; you can avoid the challenge of creating an entire ecosystem for your language, and just fit it into an existing one.</comment></comment></comment></comment>


Ask HN: Where to learn UX/Design? - <AUTHOR> We are a startup with limited cash looking to boost our site usability on mobile and desktop, but we don't know anything about UX/Design. We'd like to learn ourselves (x2 developers) instead of paying for an expensive contractor.<p>The last time someone asked HN where to learn UX/Design was 10 years ago - https://news.ycombinator.com/item?id=1768358, what are some good teach-yourself resources out there today? <comment><USER2> Learn a prototype tool, like Framer, or After Effects.

Do research, find common patterns.

Use any tool of your liking to design, for example Sketch, Figma are quick to learn and quite popular.

Affinity Design is one of my favourites, for illustration, design, etc.

Read about colour basics, the colour wheel, etc. Contrast, etc. Use www.coolors.co

Read about typography, the most basics.

Keep researching and prototyping.

<comment><AUTHOR> Ok great, thank you!</comment></comment>


Ad Blocking and Native Ads – No Room for Complacency - <AUTHOR> http://nativeadvertisinginstitute.com/blog/ad-blocking-native-no-room-for-complacency/ <comment><USER2> The race to the bottom continues.</comment>


Ask HN: Good, experienced engineer but suck at interviews. Looking for a coach - <AUTHOR> I am an experienced engineer(10+) working as software engineer.
I know all the CS basics and concepts. I can 80% of the puzzles/coding questions in interviews. But I have few blindspots that I am hoping to use a coach for. As I am not a beginner, most online portals are not useful for me. I want to use my time efficiently.
If you guys know anybody who can coach an experienced engineer, let me know. I will probably need a time commitment of 1-2 hours per week from you. I am happy to pay for the service.
All you have to mostly do is curate a few questions in my weak areas and pester me to solve them.
Something like youneedaboss.com but for software engineering interviews.
Please let me know how I can contact you. If you have experience hiring people before, it is even better!
My contact is in the profile. <comment><USER2> Hi,

I think Josh Doody might be the right mentor for you. He definitely offers coaching/mentorship sessions. Check out his writing & work here: [https://fearlesssalarynegotiation.com/](https://fearlesssalarynegotiation.com/)

<comment><AUTHOR> Thanks very much. The website doesn't mention any technical mentoring but since you mentioned, I will directly write a mail to him and find out.

</comment></comment><comment><USER3> Some questions for you:

What are your weak areas/blind spots?

What kind of programming do you do?

Where are you located?

<comment><AUTHOR> >>What are your weak areas/blind spots?

I do trees, hash tables fairly well. When it comes to arrays, I usually do well when brute force takes O(N) but optimal solution is O(logN). I do badly when brute force is O(N __2) but optimal is O(N). Even in interview, I know I should look for O(N) solution, I do get the general solution right but I fail to get the specifics wrong. For example, most O(N __2) solutions include two for loops. You tend to redo a lot of work if you run two loops. But figuring out a subset of indices which do not need to be computed, one must come up with a O(N) solution. This somehow, I fail, consistently.

Graphs are a hit or miss. I do dynamic programming well most of the times.

>>What kind of programming do you do?

I work on a major mail provider's middleware team. I write Java web services code in a distributed environment. My service talks to storage system, notification system etc. Most of the work involves designing and implementing algos for rate limiting, for fetching and caching data from storage system etc. Work also involves scaling to involve increased load etc.Day to day work is all Java. Write REST API code +unit tests + integration tests and then deploy. Worked on compiler frontends before(C/C++).

>>Where are you located? SF Bay area. But I am looking coach from anywhere in the world! Email in Profile.

<comment><USER3> Maybe it's just your misfortune for being in the Bay Area, but...

Google exists. Knuth's TAOCP exists. In such a world, why do interviewers expect you to be able (under pressure at a whiteboard) to come up with the optimal algorithm? How much of the work that you do actually depends on finding O(N) rather than O(N2) solutions?

I think that you are unfortunate in the companies you are interviewing with, not necessarily in your interview skills or knowledge.

Can you fix it by studying? Maybe, with a lot of effort. It might be as easy to find companies that interview with a different approach, and interview there. (Note: Not easy, but _as_ easy.)

<comment><USER4> >find companies that interview with a different approach,

[https://github.com/poteto/hiring-without- whiteboards](https://github.com/poteto/hiring-without-whiteboards)

<comment><AUTHOR> Well, The salary difference between FAANG and most companies on this list easily 100K+/year. And that level, they can ask me to jump through multiple hoops and I will be ready. Its a fairly rational decision on my part.</comment></comment></comment></comment></comment>


Computus is a calculation that determines the calendar date of Easter - <AUTHOR> https://en.wikipedia.org/wiki/Computus <comment><USER2> I still contend that time is one of the most difficult thing to program for/around. Once, I was building a billing system for a company, & they spent WEEKS trying to decide how they wanted the system to handle a recurring monthly bill for someone whose subscription began on the 31st of the month! They didn't like my suggestions, but their solutions always had edge cases that wouldn't work at some point in the year. It's been long ago, so I don't remember their final solution. In other projects, calendars and scheduling are a complete nightmare!

[http://infiniteundo.com/post/25326999628/falsehoods- programm...](http://infiniteundo.com/post/25326999628/falsehoods-programmers- believe-about-time)

[http://infiniteundo.com/post/25509354022/more-falsehoods- pro...](http://infiniteundo.com/post/25509354022/more-falsehoods-programmers- believe-about-time)</comment>


The Internet of Things will aid criminals and burglars - <AUTHOR> http://betanews.com/2015/04/09/the-internet-of-things-will-aid-criminals-and-burglars/

<comment><USER2> This brings a smile to my weary eyes, as it is my most-fervent hope that the Internet of Things will die in a fire.

The article didn't discuss what I expected, that being traffic analysis. Among cryptological problems, traffic analysis is one of the more difficult exploits to prevent, as well as the easier to exploit.

In the military, you don't need to crack any codes at all. Just look at where all the motorcycle messengers are going to or coming from. Must be the command tent, eh wot?

Let's drop a bomb on it, just to see what happens.

In the specific case of the Internet of Things, consider that your Things will be chattering over the Internet far more frequently when you are at home then when you are away. That will be the case for your neighbors.

So one could stand back at a safe distance, then point a few cantennas in the general direction of each house in an upscale neighborhood. You don't need to decrypt any signals, you just need to see how frequently messages are sent.

When all the messages in a general area die down for a little while, you burgle the home in the center of that general area.

For extra credit, you also snoop on the cops, so that you can be sure there are no patrol cars that could possibly respond in time, were you to trip an alarm.

I learned about traffic analysis in 1989. That same Interop Conference UNIX and Internet Security Tutorial also explained that, in secure facilities, ethernet cables run through modestly pressured metal pipes.

There is no real way to tap into the ethernet without drilling into the pipes. When the air pressure drops, men with guns turn up to look into who's holding the drill.

Now we have Bradley Manning downloading 800MB of top secret diplomatic cables, because he was searched on the way in to work each day - but not on the way out.

While I support Manning's particular effort, suppose that was someone who was not such a nice guy, making off with the recipe for nerve gas, or the detailed design of a guided missile.</comment>


The Secret Rules of the Drone War - <AUTHOR> http://www.nytimes.com/2016/07/10/opinion/sunday/the-secret-rules-of-the-drone-war.html <comment><USER2> "officials said they had concluded that between 64 and 116 civilians died in 473 strikes."

This is a shockingly high number when you consider that any male 18-50 with the target is automatically considered to be a combatant. So the real figure it likely to be considerably higher. Imagine if you heard that Vladimir Putin was sending agents abroad to assassinate people that Russia considered terrorists. But they managed to also kill innocent civilians every other time. I suspect most people would condemn that action. Is the drone war any different?

Not to mention that I believe the drone war is actually counter productive in the long term. Imagine you live in a village and regularly hear a drone overhead. Every few months it kills somone in the village. Sure, might have been a bad guy but that's not a great environment for people to live in. Only likely to create resentment and create more terrorists.

America seems to never learn from conflicts like Vietnam and more recently Afghanistan. If you sit in someone's backyard and kill people you create more of the people that want to kill you. Want to bet how many years the drone war continues before you realise it has not solved anything and your just perpetually creating and then killing terrorists.

</comment><comment><AUTHOR> By killing terrorists, drones save lots of lives. By killing terrorist remotely, they save lots of our soldier's lives.

Most of the elites that complain about drones are probably not from the class of Americans that go into the Army to protect our country and/or to pay for college through the GI bill.</comment>


Extracts passwords from a KeePass 2.x database, directly from memory - <AUTHOR> https://github.com/denandz/KeeFarce <comment><USER2> Is this not an instance of "it rather involved being on the other side of this airtight hatchway" [1]?

edited to clarify: I don't mean the specific attack described there, but the general issue that it represents: "X did something insecure because you granted a malicious program permission to alter its operation" doesn't really imply anything about X except that it isn't literally magic.

[1]: [http://blogs.msdn.com/b/oldnewthing/archive/2013/08/02/10438...](http://blogs.msdn.com/b/oldnewthing/archive/2013/08/02/10438842.aspx)

</comment><comment><USER3> I would assume that this only works on an unlocked (unencrypted) database in- memory.

This is a cool tool for an attacker, but I would guess that almost all virtual password managers are vulnerable to it and that this 'vulnerability' is not specific to Keepass, this is just an implementation.

The only way to mitigate this attack vector 'somewhat' is having the database lock after a timeout and don't leave it unlocked all the time. I would guess this is true for all password managers.

But I'm happy to be told differently.

In general, I think a Keepass tool is nice for private use, but because of the nature of these tools, I would use a kind of centralised password server with RBAC to limit the scope of a breach.

</comment><comment><USER4> So if you're capable of injecting code into an arbitrary process (which requires admin privileges if I understand correctly), couldn't you just inject it into a browser and steal them that way

</comment><comment><USER5> If you have the access to the memory, you also have the access to clipboard, and keypress events. In other words, you already have the user's passwords in plaintext.

<comment><USER6> Though KeepPass clears the clipboard (mainly to prevent the user accidentally pasting their passwords somewhere else, like a public forum).

I would think if you had something running locally on a machine with an unlocked password database the KeepPass client would also be vulnerable to all kinds of gui scripting (Applescript, WSH, etc.), it's designed to let users copy and paste passwords, after all.

</comment></comment><comment><USER7> I would recommend unticking application's Options -> Policy -> Export checkbox, or at least Export - No Key Repeat to require entering the Database Password once again to confirm the export.

This extractor relies on KeePass' code itself, so setting that option should(?) render this trick futile.

I will check the source code to confirm this workaround.

<comment><USER8> The injected dll could presumably just uncheck the checkbox/modify the check logic since its running in the same process space anyway

</comment></comment><comment><USER9> This isn't an attack on the KeePass database but on a particular KeePass implementation.

If this attack is a worry, use KeePassX[1], the KeePass implementation formerly only for Linux and now available for WIndows, OS X, Linux and BSD. I am no expert, but it seems this attack is very narrowly targeted and constructed.

KeePassX is currently in Beta 2[2] for those of you who are good at evaluating source code. The world would be a better place if more people took a deeper look at the code: [https://github.com/keepassx/keepassx](https://github.com/keepassx/keepassx)

1) [https://www.keepassx.org/](https://www.keepassx.org/) 2) [https://www.keepassx.org/news/2015/09/514](https://www.keepassx.org/news/2015/09/514)

</comment><comment><USER10> What does this mean: "extraction of KeePass 2.x password database information from memory"?

When is KeePass data held in memory? When the program is simply running or only when you copy a password to the clipboard?

KeePass shows accounts in a ListView type of control and in a dialog, both of which probably store the data in memory. I'm just wondering if this tool can snatch accounts just from simply having KeePass running, in which case this could be bad for malware/spyware. Picture a malware program running, waits for KeePass to show up in the process list, grabs all your accounts and sends them to a remote site. Yikes.

</comment><comment><USER11> Here's a similar case of how one can extract data from RAM. Of course it's more of a proof of concept than anything else, but it does show some inherent vulnerabilities in our systems.

[http://jamesfarrugia.blogspot.com.mt/2015/10/the-volatile- se...](http://jamesfarrugia.blogspot.com.mt/2015/10/the-volatile-security-of- volatile-memory.html)

</comment><comment><USER12> The readme doesn't seem to mention or I have missed it: I assume this works on a _locked_ instance of KeePass (the database opened, but the application interface locked)?

</comment><comment><USER13> I always had a feeling that KeePass was likely not much better than a flat text file, or piece of paper with all my passwords on it. Thank you for confirming this.

<comment><USER14> It's much harder to inject code to a running process and steal information, assuming the user entered the encryption key and didn't close the app in time, than to just look for all text files on the computer and read them.

<comment><USER13> True, thank you for this clarification. I myself use KeePass but it's more for convenience of password generation and storage than anything else.

</comment></comment></comment><comment><USER15> As a countermeasure to this, you can 'pepper' your passes or secrets with reserved letters / symbols that only you know about. For example if a pass is

        _SOSECRETOMG!_

You simply omit the exclamation symbol, and reveal the real pass which is:

        _SOSECRETOMG_

That's a very basic example, and can be made as complicated as your brain will allow. The older you are, the harder this gets to do small byte flips like this.

<comment><USER10> One of the features of KeePass is that you never see or type an actual password. You simply hit CTRL-C to copy the pw to memory and paste into the form. This is a guard against key loggers and visual snooping.

<comment><USER16> Better: Auto-Type. That way it's never even in the clipboard.

</comment></comment></comment><comment><USER17> What is up with all this satanic symbolism ?</comment>


High-Resolution 3D Human Digitization - <AUTHOR> https://shunsukesaito.github.io/PIFu/ <comment><USER2> I've tried many of these papers, and they don't work outside their datasets.

Suppose you tried this on your own camera or maybe in a different lighting: it would totally break this.

Paper definitely seems like an improvement, but I guess no one should get excited to use this in experimentation/production.

<comment><USER3> I've tried a number of ML projects like this too, and sometimes they do work – Bodypix is one example (though not precisely the same thing).

That being said, its usually pretty difficult to get code from papers to build/run successfully due to dependencies (e.g. depending on a specific version of Python and OpenCV 2 and requiring CUDA support)

<comment><USER4> Could anyone explain why version numbers make ML stuff so brittle? Why is the CUDA version supposed to match? Why would a newer version of python (3.7 vs 3.6) would ever break anything?

TensorFlow is a crapshoot as far as I understand, constantly changing making newer versions incompatible; but why do other libraries break backwards compatibility without a major version bump?

<comment><USER5> Because software is hard.

You might be relying on a function that only exists in 3.7 and not in 3.6, code written in 3.6 would work but new code using 3.7 features won't be backwards compatible. With compiled code the errors are usually very hard for "more used to scripts" people to decode. You get stuff like missing symbols in the linker phase.

ML projects usually have a lot of libraries so you also get in the transient dependencies breaking quite often...

<comment><USER6> Yeah, managing dependencies is tricky. I've been super excited about Nix and Guix lately for that reason; if you have a single Nix/Guix revision and a list of packages, you have all the information you need to build exactly the same package tree. (With bit-for-bit reproducibility where possible, no less!)

Some language-specific package managers can do similar things, but you really only get reproducibility for the whole system with a general-purpose package manager. Poetry gets you pretty far within the Python ecosystem, but if you need a specific version of Python/specific native libraries/etc... it doesn't get you all the way there.

</comment></comment></comment></comment></comment><comment><USER7> CVPR 2020 (starting today!) has a lot of papers on the topic for interested people.

Here is PiFuHD: [https://arxiv.org/abs/2004.00452](https://arxiv.org/abs/2004.00452)

</comment><comment><USER8> The next thing might be mapping from that static 3D model to some kind of rigged model that can be animated. Then you would not only need to place the bones and joints but also separate the clothing from the body. Extremely hard but DL has been able to pull off some incredible stuff.

</comment><comment><USER9> Wow. It's such "high resolution" that the distorted triangular polygons of the untextured models are clearly distinguishable and painfully obvious on my phone.

I guess my idea of "high resolution" differs from what the rest of the world describes as such.

</comment><comment><USER10> It's interesting how the legs are often an unequal length in the reconstruction when the person is walking, due to some incorrect interpretation of the camera perspective.

I would have guessed this wouldn't be a problem given that there are multiple photos of the same view, such that you can resolve the depth ambiguity from a single camera. I.e use feature detection to identify feet in > 1 views, and then use the two images to resolve the depth of the epipolar lines that lie on the optical axis and reconstruct the shoe in 3D space.

</comment><comment><USER11> Straight up en route to Ready Player One. Guess this remote thing is happening for real for real

<comment><USER12> More like increased competition and computer generated avatars in the modeling and Instagram influencing industry.

</comment></comment><comment><USER13> I am interested in high resolution 3D mapping of skin surface e.g. for facial scar revision etc - what is the best technology available for this either research or commercial?

</comment><comment><USER14> Pardon me for asking, but isn't the name of the technique a sort of pun? 皮肤 means "skin" in Chinese and romanized as "pifu"

</comment><comment><USER15> The last author and his company were/are involved in scandals about faking results on a large scale:

[https://www.reddit.com/r/MachineLearning/comments/8zm4kl/d_l...](https://www.reddit.com/r/MachineLearning/comments/8zm4kl/d_lawsuit_alleges_fabricated_results_at_pinscreen/)

[http://sadeghi.com/dr-iman-sadeghi-v-pinscreen-inc-et- al/](http://sadeghi.com/dr-iman-sadeghi-v-pinscreen-inc-et-al/)

<comment><AUTHOR> Thanks, I think this deserves an HN post of its own. Some of the things that were done to entice Sadeghi to join sends shivers down my spine.

Edit: I've been looking at the details on the rear view of some of the "Single-View Reconstruction" examples, and I'm starting to worry that this may actually not be reproducible.</comment></comment>


Sherlock Holmes and the Internet of Things: Columbia Digital Storytelling Lab - <AUTHOR> http://sherlockholmes.io/

<comment><AUTHOR> Related site: [http://moc.digitalstorytellinglab.com/](http://moc.digitalstorytellinglab.com/)

This is an interesting opportunity that will culminate in:

"Together teams design and build smart storytelling objects, which are plugged into a massive connected crime scene at Lincoln Center. This presents a unique opportunity to be part of the 53rd edition of the New York Film Festival."

Crowd-sourced art is interesting, and I think this is a project to watch based upon the people and institutions involved.</comment>


On Apple Announcing the ARM Mac Transition at WWDC This Month - <AUTHOR> https://daringfireball.net/2020/06/on_apple_announcing_the_mac_arm_transition_at_wwdc <comment><USER2> I'm excited about this. Can't wait to see what performance looks like. As for the effect on sales, it's probably a wash. For people who know and care about these things, I'd imagine a 50/50 split between people racing to get the last rev of Intel macs to wait out the transition until things stabilize and the other half waiting for the new stuff. macOS app devs won't really have a choice, but iOS devs will.

<comment><USER3> I believe this will enable new form factors given PPW and higher performant systems free of power and thermal constraints on desktop. It may take some time, but I think this will lead to significantly greater long term sales and market share. Apples lead is rather significant in this space and the only computer with that soc will be a Mac.

</comment></comment><comment><USER4> I really believe that the lack of x86 is going to be a big buying problem for a lot of people who need to run software on Windows. Without Boot Camp or x86 virtual machines its going to be a problem to justify the machine with a large group of people.

<comment><USER3> I suspect that for every customer they lose for someone needing to boot natively they will gain more than one from performance, cost and form factor flexibility enabling much more desirable machines. Batteries add both size and weight so you can get thinner and lighter and _still_ have a functional keyboard.

<comment><USER4> Why do people believe Apple will price these machines cheaper than their Intel offerings?

</comment></comment></comment><comment><USER5> I wonder if the image, video and audio processing software vendors will make of this - I would assume a lot of optimizations are tied to the underlying hardware and written in assembly?

This seems to be a golden opportunity for Adobe pay back in some way what Steve Jobs did to them by not supporting flash on iPhone

<comment><USER3> For vendors using metal it could be seamless. There would also be gains had through ML and neural engine in image, video and audio processing. Not to mention dedicated video hardware decode. Time will tell, but I don't see adobe being punitive there. They make money on software subscriptions and are already bringing native photoshop to iOS.

</comment></comment><comment><USER6> Why not just require apps to be distributed as LLVM bitcode, as is done for the Apple watch? That would give Apple the flexibility to change architectures --or even to create its own instruction set, now that it's making its own chips.

<comment><USER7> LLVM bitcode is not that portable in reality. Just like Plan9 assembly intermediary bitcode files are pretty much single architecture, due to containing lots and lots of low-level assumptions about the target architecture, not to mention possible incompatibilities in extended intrinsics (for example for vector units).

<comment><USER8> Most of the portability problems for retargetting to another little endian 64-bit architecture aren't the easy ones of bit widths and integer types, but rather more subtle things like a more relaxed memory model and different performance characteristics.

It's not worth the overhead of attempting to ship bitcode. Apple has shipped products on 6502, 68000, PPC, x86, x86-64, ARM, and ARM64. The transitions have been annoying for the lost software, but that's not an unusual occurrence for an OSX upgrade either.

<comment><USER9> What was the Newton using ?

<comment><USER10> They were also ARM.

</comment></comment></comment></comment></comment><comment><USER11> I sincerely doubt this will show up on anything but entry level products until developers have time to migrate their apps.

In the past, there has always been a period where the current and future architectures were both sold.

The interesting thing going forward is the question of working with Microsoft to get Windows on ARM ported over (assuming Microsoft finally gets the promised x64 app compatibility working) or to fork something like QEMU to allow for x86 virtual machines.

Or both, I guess.

</comment><comment><USER12> Can they source enough chips to do this in the near term? Meanwhile, another major fabless designer (AMD) is ramping up too.

<comment><USER13> Apple ships close to 200 million iPhones a year all with their custom ARM CPUs, fabricated by TSMC. They ship about a tenth as many Macs. I'm pretty sure they can handle that growth, especially as one of TSMC's biggest customers.

<comment><USER3> And the move to 5nm for the A14 (sampling since 2019) will yield more chips per wafer. Either way, Apple is very forward looking on supply chain and has been planning this for a decade. Remember when they owned the majority of the nand market due to long term supplier contracts?

<comment><USER12> Interesting thought. Will the functional yield really be much higher? Because there could be more wasted chips?

</comment></comment></comment></comment><comment> c-smile Smart move...

How would you otherwise convince existing customers to throw away working systems and buy new ones?

I don't think that we should expect new ARM64 to be 10 times better than x64...

The only idea I can think of is if chip will have bult-in hardware-accelerated OpenVG or any other 2D API to replace severely outdated CoreGraphics ...</comment>


Can you say this about your startup? - <AUTHOR>

We are building a " 1/ simple solution(s) 2/ to overlooked problem(s) 3/ that actually need to be solved, and 4/ deliver (it) them as informally as possible, 5/ starting with a very crude version 1, then 6/ iterating rapidly."
If you cannot, "maybe" you should revisit the idea, the implementation or the problem.
EDIT: This quote is PG. To better understand it you may want to read http://paulgraham.com/newthings.html <comment><USER2> Surprisingly (to me), that sounds like a good description of what I'm working on. It's more of a scratch-an-itch, and has no funding (or chance of it in the near future) and no customers. I'm not even thinking of it as "a startup".

I'm doing it now because I'm out of a job, and don't feel like finding another right away. This has been bouncing around my head for months, and I finally have a chance to implement it.

I must have forgotten pg://newthings, because I've read it but I apparently hadn't internalized it.

</comment><comment><USER3> Is this some sort of mantra or are you thinking out loud?

:)

</comment><comment><USER4> Google would've been doomed...

<comment><USER5> Sounds to me exactly like Google was.

<comment><USER6> Even the first Google search algorithm was hardly a "simple solution"....

<comment><USER7> Well I don't think the search algorithm is the simple part of Google.

One example of a simple solution PG used was Viaweb. Viaweb's source code is analogous to Google's search algorithm in that case. I think in the context of that article the user-facing part of Viaweb (and Google) is the simple part.

"Software, to them, equalled big, honking Windows apps. Since Viaweb was the first web-based app they'd seen, it seemed to be nothing more than a website." [From Six Principles For Making New Things by pg]

</comment></comment></comment></comment><comment><USER8> no, yes, yes, yes, no, yes

</comment><comment><USER9> yes

</comment><comment><USER10> 1\. no, it's hella complicated, but we're good enough to get it done

2\. no, this problem has been discussed at length, no one has come up with the right idea yet. (which we have, of course)

3\. yes, i mean it's not world threatening, but it will magnificently enhance shareholder value... :D

4\. no, i think as a social site you have to either give people what they expect, or give them what they don't expect but will definately like

5\. yes, we're going to roll into beta ASAP because it's a competitive market and we need to stake our claim

6\. yes, we plan to grow our company and the community hand-in-hand and push new features as we grow and acquire the right team to accomplish what we intend as the encompasing design of our product (which may change according to user reception, of course. incremental build allows us to gauge user feedback and adapt accordingly).

the startup we're forming is a social networking webapp/site (challenging the myspaces and facebooks).</comment>


Fastly Global Outage - <AUTHOR> https://status.fastly.com/incidents/rp4mvyd4tzx1 <comment><USER2> as a customer:

      13:49 - first errors
      13:55 - first internal report
      14:00 - status page update (acknowledgement)
      14:05 - status page update (identified)
      14:06 - customer support acknowledgement in chat
      14:08 - last errors
      14:16 - status page update (fixed & monitoring)
      14:40 - status page update (resolved)

so, a ~20 minute outage is bad, but man is it a night-and-day difference level of communication and updates than certain other well known status pages.

</comment><comment><USER3> Their conference is today too: [https://www.fastly.com/altitude/](https://www.fastly.com/altitude/)

</comment><comment><USER4> > This incident has been resolved.

>> Posted 13 minutes ago. Jun 28, 2017 - 14:40 UTC

</comment><comment><USER5> Includes services that use Fastly like Imgix.

<comment><USER6> Yeah I was disappointed that Imgix status page was 10+minutes behind Fastly, thankfully through Twitter/HN we were able to get a grasp of the situation before Imgix updated their all green page or responded to our tickets. It shocks me that a large provider like Imgix hasnt got a simple AWS Lambda timer, or Azure Function or whatever Google version is to check the status api or even scrap their upstream providers status page using say Cheerio and post something like 'we are investigating a potential problem, standby' orange alert till a human to get the bottom of the full picture. And yes, I consider 10+ minutes to publicly acknowledge to be poor for any large scale SaaS. I guess this attitude is related to a negative experience years ago with popular transaction email as a service provider that sounds like a poststamp that went down and didn't get fixed to their techs woke up many hours later (albeit all mail was queued - they were still 200ing err.. ) - I want to know you're on it and awake.

</comment></comment><comment><USER7> They provide DNS and possibly more for Rubygems.org

Gonna be a bad day for a lot of folks if that goes down too.

<comment><AUTHOR> They're also in front of PyPi and NPM.

Someone shared graphs of the drop in requests to PyPi at [https://twitter.com/EWDurbin/status/880071713874202624](https://twitter.com/EWDurbin/status/880071713874202624)

</comment></comment><comment><USER8> Strange possible coincidence yesterday evening my iPhone screen kept going on by itself and it would display (with a play button) some weird URL that started with [https://airtv](https://airtv) and then had fastly somewhere in it.

Connected? I know, vague. It's just I've never heard of fastly until yesterday when this happened and today I see some kind of outage notice on hackernews :)

<comment><USER9> If it's working right, you wouldn't hear about it ;)

And if it's broken... well, yeah, I'd expect dependencies with poor error handling to behave unexpectedly.

<comment><USER10> Considering the way people toss around the cloud services they use like they were merit badges in the HN commments, I'd say no, if it is working right, someone who frequents this site should have definitely heard of it..</comment></comment></comment>


Why the "Finnish SOPA" is such a big thing for the country - <AUTHOR> http://www.arcticstartup.com/2012/01/10/why-elisas-blockade-is-such-a-big-thing

<comment><USER2> There was an assumption at the end of that good article that the "music industry" (whatever that broad term means) is trying to save a dying business model.

Actually, music _intermediaries_ such as music publishers and distributors are trying to save their business model, and because the internet disintermediates them, destroying the internet is the logical way to go about it.

The business of making and listening to music is continuing along just fine.

<comment><AUTHOR> I think the assumption in the article was that _music industry_ means the intermediaries, not the artists. Artists seem to have many means to invent new business models (Louis C.K. being a recent example, albeit not from the area of music), but the traditional labels less so.

</comment></comment><comment><USER3> Imagine if someone could get your telephone disconnected by suing you. Not by getting an injunction against you using the telephone, mind you, but simply by filing the suit "in good faith." That's SOPA.

This really isn't like SOPA. The courts were involved, a ruling was made. Maybe it's bad precedent, but due process was provided. SOPA wants to let privileged multi-million dollar conglomerates act as judge themselves and cut people off on a whim.

</comment><comment><USER4> In my opinion blocking sites like TPB and making it such a big deal makes people who do not know the site even more curious of what is going on and will most likely boost the usage of this kind of sites.

And just a note on the EU court of justice decision to case back from 2004: <http://www.bbc.co.uk/news/technology-15871961></comment>


Ask HN: How can I protect my private data on mobile phones? - <AUTHOR> I am looking for solutions and would appreciate some recommendations. <comment><USER2> I don't think it is possible.

Any data on your computer, phone or online is already compromised or can be at anytime.

I don't think private data exists.

There are steps you can do to help keep data more private but nothing reliable or for sure.

If it's online or in your phone I'd assume it's not secure.

</comment><comment><USER3> OP, are you on Android or iPhone? The advice would be OS specific.

In general, use encryption, with a good passphrase[1]. Fully power down your phone in dangerous situations, like when crossing the border or pulled over by law enforcement. Practice data minimization. For example, turn on Signal's disappearing messages feature - do you really need to look back more than a week at your chats?

Install a VPN since you'll be using a lot of suspect wifi.

And personally, I avoid logging into anything super sensitive (ex: retirement account) unless I'm at home.

[https://theintercept.com/2015/03/26/passphrases-can- memorize...](https://theintercept.com/2015/03/26/passphrases-can-memorize- attackers-cant-guess/)

</comment><comment><USER4> Enable encryption on your phone. Limit the apps you use. Limit permissions to apps. Even tho apps can only see their data. You can create separate users to further limit data access.

</comment><comment><USER5> Protect it from whom? Family? Casual thieves? Hackers? Corporations? Governments?

</comment><comment><USER6> Use a VPN client, don't allow location, files or contacts access to applications you don't trust, look for alternatives to software you don't trust.

<comment><USER7> > Use a VPN client

Please stop parroting this fallacy. Unless you operate the VPN server that you are connecting to, which most people won't, then you aren't doing much to improve your privacy at all. You're just redirecting all of your connectivity through some other third-party which may or may not be trustworthy, and from there, onto some other ISPs which may or may not be trustworthy.

<comment><USER6> Not a fallacy if you do your research properly before choosing a VPN.

<comment><USER7> You make the dangerous assumption that a) people research properly before choosing a VPN and b) people even know what to look out for.

<comment><USER6> Actually you are the one that started your argument by making assumptions.

</comment></comment></comment></comment></comment><comment><USER8> Store your key data on disks in your home.</comment>


Oracle's Newest Audit Tactic: Focusing on Java - <AUTHOR> https://www.forbes.com/sites/danwoods/2019/01/31/oracles-newest-audit-tactic-focusing-on-java <comment><USER2> Although, much much smaller, base, but I would not be surprised if VirtualBox audits will be next. I read somewhere they are already scanning IP addresses/ports for virtual box instances, and comparing them to 'is it an enterprise' database of IP addresses.

<comment><USER3> I thought they would be at first given its massive number of installs, but VBox isn't as mission-critical/exploitable for cash as Java is. I predict that Oracle will fully open source it before running audits.</comment></comment>