Banks Enforcing Lower Security for Profit - <AUTHOR> https://www.aaronm.net/banks-enforcing-low-security/ <comment><USER2> It can be quite terrifying to consult for some banks. That's when you get to see how bad things really are in the industry, and how common some bad practices are.

For these banks, anything is okay, so long as the auditor okays it. And the auditors are on the payroll of the bank.

In one case, they wanted OS patching to be done no more than yearly, and they didn't want the OSSEC tools to be run to tell them if there were any vulnerabilities unless they were planning on doing OS patching. But the auditor had okayed it, so that was that.

<comment><USER3> > _... they didn't want the OSSEC tools to be run to tell them if there were > any vulnerabilities unless they were planning on doing OS patching. But the > auditor had okayed it, so that was that._

Well, if they weren't going to bother patching anything anyways, there's really no point in running a vulnerability scan, I suppose.

<comment><USER4> In fact it's probably counterproductive as then you _know_ that there are vulnerabilities and might have more liability for not patching them than if you didn't look in the first place.

<comment><USER5> Why is that counter-productive?

<comment><USER3> _" We didn't know we were vulnerable"_

... versus ...

 _" We knew we were vulnerable but just didn't bother patching"_

<comment><USER5> How does this reduce productivity?

<comment><USER6> "Counterproductive" is a normal English word unrelated to "productivity". Taking an action is counterproductive if it leaves you worse off than you would have been if you hadn't done it.

Note that the _only_ definition of "counterproductive" here ( [https://www.merriam- webster.com/dictionary/counterproductive](https://www.merriam- webster.com/dictionary/counterproductive) ) is "tending to hinder the attainment of a desired goal".

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I've worked for Fidelity and while there's a grain of truth here, this is mostly horseshit and conjecture. Upgrading SQL or whatever isn't going to happen without a very good reason because you risk fucking something up in the process. Enterprise orgs can't move fast and break things. By definition that means they're permanently behind the curve.

<comment><USER8> Ah, this would be the same Fidelity that within the last five years limited users to 12 character passwords?

<comment><USER7> Yes, and yes passwords are encrypted / salted. They're not morons.

<comment><USER9> Encrypted? You mean reversible encryption. I hope not.

Salted? Just once? Or through something like bcrypt or scrypt? Because just salting nowadays is pretty much useless.

<comment><USER10> You're misunderstanding the terms a bit. Salting is only done once because it's a random string you apply to the users password so that if two users use the same password they do not result in the same hash. This is primarily meant to combat pre-generated rainbow tables and forcing each password to be broken individually.

You're thinking of multiple rounds of hashing, designed to increase the computation cost of the hashing. For example Bcrypt has a built in cost factor. While this is definitely important it's not quite the same as salting.

</comment></comment></comment></comment></comment><comment><USER11> Who takes responsibility when a customer loses money because of bank's poor security?

Postbank.de uses a 6-character pasword (!), and they seem to rely on 2 factor authentication for actually moving money. I assume my transaction history is public.

I'd like to know what incentive besides regulation do banks have in order to keep peoples' accounts private.

<comment><USER12> Banks don't have any incentive to do anything that doesn't make them money _except_ for regulation.

<comment><USER13> And competition.

</comment></comment></comment><comment><USER14> Most of the time I check if these articles chastising a particular industry are written after some consulting experience or is it just hubris.

This article seems to be based on the latter - _But for anyone with even a beginners knowledge of security, it's bullshit._

To avoid a rant, let me give an example about a social networking site. Back in 2015 with the announcement of SHA1 vulnerability, the company started systematically replacing stuff with SHA2. The issue came - some users in APAC region were on old mini browsers and _unable to connect to the site_. Given the SHA2 was still 2 years away the company shaped the traffic to accommodate SHA1 users. So the company was doing, as mentioned by the author _minimum possible as required_. But to accommodate all users, there was no other choice.

<comment><USER15> Is anything specifically in this article bullshit? Would it be impossible to support 16-character passwords or prevent logins with old credentials?

</comment></comment><comment><USER16> ING Australia: You can set a pin. As in a 4-digit pin. There is no password. And you can lock anyone out with 3 wrong tries.

But the saving accounts have the highest interest, no atm fees, and it's been featured in the barefoot investor, so loads of people will use them.

(your pin never saves to a password manager though, because they use a virtual keypad that mixes up the key positions and the you cannot auto-fill that entry)

<comment><USER17> Westpac - 6 char alphanumeric password, with stupid virtual keypad.

CommBank - at least last time I had an account with them, I'm fairly sure their passwords were case-insensitive - which can be done while still using hashed passwords, but it's not an encouraging sign.

</comment></comment><comment><USER18> For uk banking systems it is very likely that the passwords are stored symmetrically encrypted with the key stored in an HSM (based on my experience working as an IT security consultant in UK banks).

Whilst limiting passwords isn't good, with storage in that way i'm nt sure I see many viable attacks on a 12 char random password.

Online brute force will hit the lockout on the site, and even assuming you could get access to the server hosting the encrypted passwords and HSM you cant decrypt the passwords (unless they have made some horrific setup errors), so the only offline attack is to try and brute force the encryption key, which is unlikely to be easy.

<comment><USER19> I'm not familiar with HSM [1] but is any internal attack possible, like bribing an employee or getting a trojan on somebody's computer inside the bank?

This is a HSM for people like me a few minutes ago:

[1] [https://en.m.wikipedia.org/wiki/Hardware_security_module](https://en.m.wikipedia.org/wiki/Hardware_security_module)

<comment><USER20> So obviously in cases of personnel threats you need different controls.

On HSM setups I've seen the keys are under dual-control (i.e. two different people have half the key and in the event that it needs re-entered, both have to enter their keys independently), along with other general controls (hiring background checks etc)

That's not to say it's impossible, just there are controls in place.

Now in all this I'm not trying to suggest that bank security is perfect, it's obviously not, but that particular concerns about password strength and threats of attack on this could be misplaced, due to lack of understanding of the controls in place.

</comment></comment></comment><comment><USER21> I think this article is complete nonsense. The author presents no evidence to support the claim that credentials are stored in the clear.

<comment><USER22> What sucks is how hard it is to do anything when you're on the inside and know just how dangerous the systems are, and management has no interest in fixing things.

A former employer of mine is a government agency with millions of accounts, with SSN and every kind of PII imaginable, they have actually been breached (millions of SSNs lost) ... and they still don't hash passwords.

Would love to out them, but the management is vindictive as hell so I can't come up with a good way to out the place without great risk to myself.

I'm sure many have been in this situation - we need a safe way for people like us to speak up before breaches happen.

<comment><USER23> >A former employer of mine is a government agency with millions of accounts, with SSN and every kind of PII imaginable, they have actually been breached (millions of SSNs lost) ... and they still don't hash passwords.

So the costs of the breach haven't been high enough to provoke action, which means they're probably making the right decision if one assumes that hashing the passwords would require a significant modification of their software, infrastructure, or processes.

<comment><USER22> Guessing you'd feel differently if it was you, or a family member, who had their identity breached along with information about every bad situation in your life.

And no, the costs aren't high to change it. The code to do it has been done for a long time. It got mired in political grandstanding, and that's it.

<comment><USER23> Of course I'd probably feel more strongly if I were affected, but that's true of any policy isn't it? That has nothing to do with the correctness of the decision.

I think we should end mortgage tax deductions. Most homeowners would disagree. The fact that they are personally negatively affected is irrelevant to whether or not ending mortgage tax deductions should be done.

</comment></comment></comment></comment></comment><comment><USER24> I'm sorry if it's dumb question, but how could one perform dictionary attack without having access to the hash table? From the login page? Unlikely, it will lock itself after a few unsuccesful attempts. Yet article implies that if password is weak everything else doesn't matter.

<comment><USER25> Bro, totally not a dumb question.

From an Attacker's point of view, yes logging in from the same IP against the same account will get you banned fairly quickly. People put up their best defenses on the most obvious endpoint, which is why a good attacker quickly tries something else. However, two possible routes to circumvent this are

1\. Find a vulnerable API call/Webportal on the bank's other sites that don't have IP banning but require authentication. This happens much more than you'd realize.

2\. A distributed attack, either with a large proxy network or if you have a botnet, in which you bruteforce the credentials with different time intervals/simulated human behavior to not lock out the account.

<comment><USER26> 1\. seems like someone is really screwing up with an API like this.

2\. Ok, for a three word combo with I think >40000^3 =64 billion possibles, so to have a 50% chance of cracking a password you need 32 billion goes, with a human speed api you're talking 5 seconds per go (mean, and probably you'd get caught on this rate) so 1 million bots (and I think the bank would be suspicious if it saw 1 million different IP's trying one account- would need 32 * 5000 seconds.. 2 days to get one account. Doesn't feel remotely feasible!

<comment><USER25> 1\. It happens more than you'd think. Some legacy system is still up and they are connected to the same credential store. You find a hole and get into their internal network and some random webportal that no one maintains still has access to the database.

2\. Yes, so this one is more like you are shooting with a shotgun from a long long range and hoping to hit. You can improve the accuracy by using a password dump on your target. People have a common pattern that they use with their passwords. You can either find one that is still being used or try to find a couple they have used and create a new one. Great site to demonstrate the power of a password dump is [https://haveibeenpwned.com/](https://haveibeenpwned.com/). So in some cases it is possible, but as someone who professionally red teams, I wouldn't bruteforce past a certain time period before trying something else.

</comment></comment></comment></comment><comment><USER27> If someone claims to support industry standards (or best practices), just ask _which_ standard. Is it, for example NIST 800-63B ( [https://pages.nist.gov/800-63-3/sp800-63b.html](https://pages.nist.gov/800-63-3/sp800-63b.html) )?

Of course, they aren't really following any standard or best practice -- but it will be tough to get them to admit that.

</comment><comment><USER28> Vanguard had a tiny size limit for the longest time

</comment><comment><USER29> XKCD - Password Strength (a.k.a. correct horse battery staple)

[https://www.xkcd.com/936/](https://www.xkcd.com/936/)

</comment><comment><USER30> > It's all about making money

Hacked customer accounts likely costs banks lots of money to deal with - certainly more than the extra few bytes of disk space to store longer passwords. This is a simple case of legacy cruft or ineptitude.

<comment><USER31> Yes legacy cruft which would cost money to fix. It is completely about money. Not the cost of storage but the cost of paying people to fix it.

</comment></comment><comment><USER32> Why "avoid repetition"? Entropy does not matter in passwords.

Example: aaaaaaaaaaaaB1! is a perfectly safe password.

Domain of characters: letters(26x2=52) + digits(10) + punctuation(32) = 52+10+32 = 94. Password length: 15. So, size of the password domain: 94¹⁵

The example password is not less safe than any other password in the same domain, but it is certainly much easier to remember.

Why would the attacker assume that the pattern /[a-z]+[A-Z][0-9][:punct:]/ would be any more likely that any other pattern? Therefore, the attacker cannot assume a pattern for non-dictionary passwords. He will only be able to enumerate them using brute force, which is utterly unrealistic for a set with a cardinality of 94¹⁵.

<comment><USER31> To prevent dictionary attacks. Any decent password cracker will use a dictionary before trying brute force attacks.

<comment><USER32> The example password is unlikely to be in the dictionary. I just made it up on the fly. Another example would be:

9999.9999+aaaa.aaaa+B

It is not particularly hard to remember, while it forces the attacker to enumerate 94²¹ possibilities.

<comment><USER15> If an attacker obtains a few of your passwords, they can infer some things about how you're generating them and bring down the number of possibilities closer to the entropy of your method. If you use a high-entropy generation algorithm, no such attack is possible regardless of the information gained by the attacker.</comment></comment></comment></comment>


Optimizing MongoDB Compound Indexes - <AUTHOR> http://emptysquare.net/blog/optimizing-mongodb-compound-indexes/

<comment><USER2> About 2 years ago (time is flying) I explained how I did the same to support range queries over "n" attributes, the method ended up being in the book " _MongoDB, the Definitive Guide_ " by Chodorow and Dirolf (O'Reilly):

<http://chemeo.com/doc/technology>

(Search for "Indexing For High Speed Search" to skip non MongoDB related information).

</comment><comment><USER3> What should be added to this is the ability to tell Mongo to return an error if your query requires a table scan. That one configuration item can be the difference between a request returning an error and a whole site going down for an extended period.

<comment><USER4> There is a config setting for that

      notablescan = true

[http://docs.mongodb.org/manual/reference/configuration- optio...](http://docs.mongodb.org/manual/reference/configuration-options/)

<comment><USER3> Right I was saying that the author should add that to his article. Its a very valuable configuration item and anytime your dealing with optimizing indexes its worth enabling.

</comment></comment></comment><comment><USER5> Is MongoDB actually able to combine 2 or more indices?

<comment><AUTHOR> No - it can only use one for a given query. But a _compound_ index like the ones I describe in the post can index many fields.

<comment><USER5> Yes of course, but it's kinda slow if you have to maintain one compound index for each possible query you're going to run, that's why I was asking.

<comment><USER6> Nope, you can use the compound index 'a,b,c' to query over the following fields:

        a
        a.b
        a,b,c

The manual actually explains it like that.</comment></comment></comment></comment>


Indescribable feelings entrepreneurs go through - <AUTHOR> https://twitter.com/ryan_caldbeck/status/1000757134403846144 <comment><USER2> There _is_ something nerdly satisfying doing something in ascii. I started a Bloomberg text style crypto dashboard. [https://github.com/stevenpack/cryptowarrior](https://github.com/stevenpack/cryptowarrior). No real reason other than... ascii is cool... for some reason.</comment>


Could Online Therapy Be a Good Idea for You? - <AUTHOR> https://www.psychreg.org/online-therapy-good/ <comment><USER2> I tried it. It was too expensive. And most of the communication was terrible. So you could switch to a different therapist and have to start all over again. I cancelled after a week.

</comment><comment><USER3> I know a psychologist who offers this to clients who are moving to another city, seems to work alright if you already have a good therapist.</comment>


Get Clicky with it – Real Time Analytics for your Startup - <AUTHOR> http://thestartupfoundry.com/2011/02/21/get-clicky-with-it-real-time-analytics-for-your-startup/

<comment><USER2> Love this service. I've used it for years on all my sites, great to know if you have a traffic serge before Google Analytics catches up. Amazing UI too. Receives far too little buzz for how great of product it is.

<comment><AUTHOR> We're in process of pushing it live on TSF now. It has been great to work with in the past.

</comment></comment><comment><USER3> I appreciated the comments about staying bootstrapped if at all possible. Often, I hear conversation about landing VC funding as the end goal. While this can help develop a product if necessary, that funding will likely be more trouble than it is worth.</comment>


A list of front end development resources - <AUTHOR> https://github.com/dypsilon/frontend-dev-bookmarks

<comment><USER2> Just a bunch of JS script libraries listed. Where are the other front-end technologies? Welcome to the "open" web, I guess!</comment>


Using Old Cellphones to Listen for Illegal Loggers - <AUTHOR> https://www.nytimes.com/2019/10/15/climate/indonesia-logging-deforestation.html <comment><AUTHOR> Another article without a paywall but from some time ago

[https://nexusmedianews.com/this-engineer-is-using-old- cell-p...](https://nexusmedianews.com/this-engineer-is-using-old-cell-phones- to-stop-illegal-logging-785a7acb3c1f)</comment>


No, licensing journalists isn't the answer - <AUTHOR> http://gigaom.com/2011/09/07/no-licensing-journalists-isnt-the-answer/

<comment><USER2> Wow, the licensing authority could suspend a person's journalist credentials for writing "the wrong thing at the wrong time". This is a great idea! FOR DICTATORS AND FASCISTS, not for the USA. Licensing journalists is most un- American, and I'm ashamed of the Fed who proposed this.</comment>


Decertifying secured Stanford transcript PDF - <AUTHOR> https://www.dzhang.com/blog/2013/03/29/decertifying-secured-stanford-transcript-pdf <comment><AUTHOR> > Removing the following eleven lines is illegal, subject to the Digital > Copyright Act of 1998.

Does anyone know which section of the copyright act makes removing lines illegal?</comment>


Remote pair programming - <AUTHOR> http://andrzejonsoftware.blogspot.com/2008/02/remote-pair-programming.html <comment><USER2> I do this all the time, either with screen or vnc. Even if you're not a believer in pair programming, it's a great option for debugging, code reviews, and training new people.

</comment><comment><USER3> Interesting. I suppose NetMeeting would work for a Windows environment. Not as easy to step in and take over the "keyboard" with that setup though.</comment>


Playing God: Why ethical objections to interfering with nature are too late - <AUTHOR> http://nautil.us/issue/28/2050/the-philosopher-who-says-we-should-play-god-rd

<comment><USER2> So what happens when a few years from now a technology is developed that guarantees that your child will be a 160+ IQ genius but said procedure is only available to a very small percentage of the population?

I think that's what everybody is secretly fearing, honestly.

And maybe, not even money would allow you in on said technology. Why wouldn't for example, the country that developed it keep the technology restricted to its own citizens so that they will, in one generation, gain an advantage over the rest of the world?</comment>


Get Rid of Equifax - <AUTHOR> https://www.nytimes.com/2017/09/21/opinion/get-rid-of-equifax.html?action=click&pgtype=Homepage&clickSource=story-heading&module=opinion-c-col-right-region&region=opinion-c-col-right-region&WT.nav=opinion-c-col-right-region <comment><USER2> This can be fixed by a small change to privacy liability law. Current law requires litigants to show actual economic harm. That is hard to do in cases of identity theft and privacy violations, which is why the OPM case was just dismissed [1]. If this was changed so that a privacy violation could be litigated, companies like Equifax would need to buy insurance against such actions. Alternatively, there could be a new law that any company storing SSN- type data owed some nominal amount (say, $10) to the owner of that data if it is compromised for any reason. Either way, companies that aggregate large amounts of such data would end up buying insurance.

No insurance company would sell such policies without due diligence -- they would establish security requirements and pen testing. Consumers are protected by the existence of an actuarially fair insurance policy. not by the (nominal) compensation. Note that Equifax's customers are (primarily) not consumers. Regulations (in the form of liability law reform or nominal compensation) may not be required in industries where companies only hold the data of their own customers, but such companies could cite their insurance policy to convince their customers that they take security seriously. (Now it's always empty words.)

[1] [https://www.washingtonpost.com/news/powerpost/wp/2017/09/20/...](https://www.washingtonpost.com/news/powerpost/wp/2017/09/20/federal- court-denies-cash-awards-to-22-million-opm-data-theft-victims/)

<comment><USER3> Or you could just do what other countries do, regulate it and make it a government function.

<comment><USER4> So I am _not_ one of those people that says that the government is bad and terrible and evil and can't be trusted to ever do anything. But a government agency that has all the info about all my accounts, and is a reputation agency which basically hands down major decision factors that will affect my life (can I get a car loan? a mortgage?) seems ripe for abuse. Think of how well no fly lists currently work: if your name is on that list, you are fucked. If you end up there by mistake, which apparently happens with some frequency, you have to prove that you aren't a terrorist. If your name matches the name of someone on that list, you can be fucked. I just don't have faith in a system like this.

I don't have a good solution for the recommendation system like this. Maybe we wouldn't need it in the first place if we didn't do so much debt financing of stuff. Or maybe it needs to be less centralized: applying for one loan, you need to show payment history on a few other loans, etc. But I just don't see a centralized government run agency as the solution.

<comment><USER5> Aren't we already sort of in a worst of both worlds situation here? The IDs we are using as primary keys are from the SSA. The FHA is involved in most American's mortgage decisions. The Stafford loan program in most of America's student loans.

But we also have giant for-profit companies aggregating giant databases with little to no oversight, and up until recently no ability to access your own data for free, and still today no straightforward, across-the-board, means to appeal bad data, or collect damages from it (or from leaks of it).

Even with the terrible things associated with the no-fly list there is a TSA appeals process and a court system to challenge it. Do you know how you correct mistakes in your Equifax-TransUnion-Experian composite credit score? You mostly don't, and you most likely can't take them to court, because they think you are bound to arbitration.

I don't know if there is a good solution here either, but at least a government-run solution would have to be accountable to the people as citizens/constituents (even if it would still likely be in the pocket of the banks).

<comment><USER6> > Do you know how you correct mistakes in your Equifax-TransUnion-Experian > composite credit score? You mostly don't, and you most likely can't take > them to court, because they think you are bound to arbitration.

Sorry, that's not true at all. I went to Experian late last week to set up a fraud alert because of the Equifax breach, they showed me my credit report and had a button to mark things that were factually incorrect. I did so and submitted it. They did some sort of investigation and removed the data because they couldn't verify that it was correct. It was as easy as filling out an online form. (Actually, I think I had to call about 1 particular item, but it was handled over the phone.)

<comment><USER5> I was being partly hyperbolic about the worst case. Keep in mind that fixing Experian doesn't fix TransUnion or Equifax, and there's no simple way to correct all three at once.

</comment></comment></comment></comment></comment></comment><comment><USER7> "Any company doing something I don't like should be nationalized."

No. They should be liable for the damage they cause with negligently allowing hacks like this, but the existence of private businesses should be default- allow.

<comment><USER8> I never consented to have my information in their database, and I have no power to get it out of their database. They have roundly and repeatedly demonstrated that they are not fit to hold and be trusted with maintaining the SSNs and other personal information of the entire country's worth of credit holders.

Is there even a license that the Equifax company needs to have, in order to do this type of work, that can be revoked? It needs to be revoked! But I'm afraid they don't need any license, they just woke up like this.

The right to covertly surveil and maintain dossiers on 50%+ of the citizens of this country should not be default-allow. Strongly disagree. People in power holding that kind of opinion, is exactly how we got here.

<comment><USER9> > I never consented to have my information in their database,

Don't you think that somewhere in the T&Cs of a loan you took or a credit card that you got or a phone contract you signed up for (or many other things) are lines explaining that your information would be shared with credit reporting agencies? So legally, you would've consented to the sharing of information at those times. If that isn't true, then I'd assume that you should be able to sue the institution that shared your information with all these agencies.

<comment><USER8> You know the point I'm trying to make, and it's disingenuous to point at some line in some far-away terms and conditions, and say "that authorizes Equifax and two other companies to collect and maintain all information on you, in perpetuity, without any option to revoke this grant."

Are they licensed to do this type of work? Shouldn't they need to be? Should that be revokable? What is the process for revoking that permission, and can we get it started already? It just came out that in their response to the breach, they've been linking their "customers" to a phishing site since September 9. It's time to revoke those grants.

<comment><USER10> I know the point you're trying to make, and I'd say more to that point: we already recognize that you can't sign a contract that strips you of some basic human rights. You can't sign a contract that enslaves you, etc.

With the amount of power these organizations and this information has over each of us, individually, I'd go so far as to say there is a human rights issue at stake. People's lives get _fucked up_ through credit bureau mistakes, and what consequence is there for those bureaux?

Pointing to a subclause in a contract to say "well, here's where you let them potentially fuck up your life with no recourse, and everything is legal" suggests to me that our thinking around the power these agencies, and around ownership of information about our lives, have needs revisiting.

<comment><USER11> What's really at stake here? Your ability to take on debt, which primarily benefits the banks. The bigger problem I think we have here is the cavalier nature in which people view debt. Debt is bad for you. Rather than bringing going into debt under the umbrella of "basic human rights" how about a cultural shift away from debt altogether?

<comment><USER8> Now if we could just do something about those housing prices, that might even be possible. (What percent of homeowners do you suppose bought their homes without taking on some debt?)

Paying rent is also bad for you.

<comment><USER11> Getting a home loan is relatively easier, because plenty of banks still do manual underwriting for things the size of mortgages. And if we had a culture that avoided unsecured debt, car debt, etc. then more banks would have to perform manual underwriting because no one would have a credit score. Instead they would have something better: money.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Now here is a perfect, legitimate use of libel law. If a company with whom you have no relationship is lying about you to people with whom you're attempting to do business, that sounds like libel to me.

Of course, that's preempted by a federal law that Equifax & friends carefully purchased. Perhaps all we need is for them to lose that protection to give them a reason to care.

<comment><USER13> Now you're talkin'! Today, an ordinary person can barely even get inaccuracies in a credit report changed after laborious effort -- to say nothing of being denied a house, a car, or a job as a result of that inaccurate info.

Equifax and the credit agencies only exist because they are allowed to perpetrate great harm spread across millions. They are a giant negative externality.

</comment></comment><comment><USER14> When a private company has a massive failure, customers have the freedom to go elsewhere and the company may go out of business.

When a government agency has a massive failure, we're of stuck with it, short of hoping politicians _might_ do something about it.

<comment><USER15> That's sorta the point – in this case, I have no ability (as a consumer) to "go elsewhere." Aside from the two times I've placed freezes on my credit history, I have no relationship with Equifax, and have never consented in any way to what they collect and share about me.

This contrasts pretty heavily with, say, Facebook – where even though they collect and share plenty of information about me, I'm at least both consenting and continuing to feed them by using a service I presumably find worth the trade-off.

If you are the type of person who gets upset about this dynamic of Facebook, then Equifax should be completely next-level.

<comment><USER16> > and have never consented in any way to what they collect and share about me.

Dont you consent to credit reporting when you sign up to get credit, though.

You can "choose" to not use Equifax by not getting credit from people who report to equifax.

<comment><USER17> > Dont you consent to credit reporting when you sign up to get credit, though.

No, I consent to allow creditors to do their due diligence to see if I'm a viable candidate for their product. Equifax is not required in this transaction, it's just beneficial for the creditor, their customer, to use them to streamline that information collecting process. Loans and credit existed prior to credit reporting agencies and will exist long after.

<comment><USER16> > No, I consent to allow creditors to do their due diligence to see if I'm a > viable candidate for their product.

you do much more than that though , from my card agreement

"We may obtain and review your credit history from credit reporting agencies and others. We may, from time to time, obtain employment and income data from third parties to assist us in the ongoing administration of your account. We may also provide information about you and your account to credit reporting agencies and others. We may provide information to credit reporting agencies about this account in the name of an authorized user. If you think we provided incorrect information, write to us and we will investigate."

> Equifax is not required in this transaction

Thats upto the business to decide, not you. You choose to not get credit from them if you have objections to how they run their business.

<comment><USER17> >Thats upto the business to decide, not you. You choose to not get credit from them if you have objections to how they run their business.

Regardless of what the business decides, no, Equifax is not required to assess my credit. If the business decides to go to McDonald's to get lunch while they are doing this process, that's not required regardless of what the business decides. It may be nice for them, it may make their process easier, but it's not /required/.

<comment><USER16> i agree that its not required.

</comment></comment></comment></comment></comment></comment></comment><comment> matt-attack I don't agree with trying to create a public government-run institution to track how "reliable" each citizen is. The solution to all of this is clear. Credit agencies provide a service primarily to lenders. These lenders count on the agencies' ratings to be a reliable predictor of the reliability of its potential customers. If those companies' products are no longer a reliable predictor, they shouldn't use them.

<comment><USER18> > If those companies' products are no longer a reliable predictor, they > shouldn't use them.

I think this is very optimistic. It's hard for me to imagine a situation in which lenders are questioning the reliability of these credit reports and the only scenario I can come up with is one in which the reporting agency are over-estimating people's ability to reliably repay debt to the point where the lenders are losing so much money that they actually notice. Given that most consumers complain that these reports include erroneous /negative/ information, this scenario seems unlikely.

Lenders will continue to use these reporting companies, no matter how poor their product, because there is no measure against which to judge their product except each other. They'll continue to use them out of inertia, out of erring on the side of caution, and because this is the way they have always done business.

<comment><USER19> Well, I guess the sticking point is that no one has found a better way to measure loan risk. If they had, lenders would work with the agency that more accurately assesses their risk because otherwise they are leaving money on the table by not lending to creditworthy individuals.

<comment><USER13> > no one has found a better way to measure loan risk.

Or rather, that the system which measures loan risk is feasible only because the parasitical entities which run it push the massive negative externalities onto the general population. If the loan risk system actually had to pay for all the harm it does, it would be a loser.

</comment></comment></comment></comment><comment><USER20> The interesting thing about this sentiment and reasoning is that it could equally be said of data brokers in general. Changes here could have big impacts on the ads ecosystem. I don't know my opinion here, but between things like GDPR and op eds like this I have to imagine there are ad and data broker executives doing some worst case analysis and spin/ talking point preparation.

</comment><comment><USER21> I can understand the impulse to want Equifax punished for getting hacked and releasing all of this information. But I think these credit bureaus are small fry compared the size of the companies that are at the root of the problem: banks and other entities that make loans. The reason most people don't like the credit bureaus are the fear of "identity theft" not the spread of truthful information about themselves.

A bank makes a loan to a fraudster who is impersonating you. The fraudster defaults on the loan and the the bank tells a lie about you to the credit bureau, which gets spread around and hurts you in many ways. If we called this situation "bank slander" or "bank libel", the focus would be on who is creating the problem: the bank with its lie. Create high enough penalties for banks reporting false loan defaults and "identity theft" will disappear as the banks become more cautious of fraudsters. This is unlikely to happen as banks are concentrated and powerful institutions. "To big to fail" I believe is the term. I don't think the credit bureaus themselves are that influential in Congress but the banks want them and will lobby on their behalf.

It would be interesting to know how much money the banks get from people illegally each year from people paying off fraudsters debts to clear their credit reports from the false default reports from banks.

</comment><comment><USER22> sp the government is better at security?

[https://www.nytimes.com/2017/09/20/business/sec-hacking- atta...](https://www.nytimes.com/2017/09/20/business/sec-hacking-attack.html)

<comment><USER23> Not to mention the OPM hack

</comment></comment><comment><USER24> I keep seeing calls for the government to revoke Equifax's corporate charter, because we citizens cannot vote with our wallets in this case; we are not Equifax's customers. But I wonder about Equifax's _actual_ customers, the financial institutions that choose to rely on Equifax for credit reporting. What sensible institution would continue to trust Equifax after all of this nonsense? Perhaps banks and the like should all abandon Equifax as a credit reporting source and let the company die of natural causes.

<comment><USER25> Equifax's actual customers face no risk, on the outbound reports side.

Data sources might be another case.

</comment></comment><comment><USER26> The only proposal for any kind of action I have heard on this is the Warren and Schatz legislation which is appropriately titled" Freedom from Equifax Exploitation (FREE) Act"[1]

Aside from Senator Warren I have heard very little concern from lawmakers in Washington regarding the menace that these credit reporting agencies have become and the threat they pose to people.

[1] [https://www.warren.senate.gov/?p=press_release&id=1837](https://www.warren.senate.gov/?p=press_release&id=1837)

</comment><comment><USER27> I think the real problem is that we have no definitive way to prove who we are. A SSN is fine and all but it's just a number that anyone can obtain and say they are me. We need key pairs or some way to prove that when we are requesting credit that we are in fact the person that we say we are. Until that happens the systems is exploitable by even the most inept of criminals.

<comment><USER28> I wrote to my senator about this solution weeks ago and have yet to receive an actual reply.

I think the problem is figuring out the transition from SSN's to something like key pairs/TOTP. How do we securely establish the "new" identity and pair it to the old SSN? Do we even bother and just start from scratch?

</comment></comment><comment><USER29> _In at least 40 other countries — including Belgium, France, Germany, Italy and Spain — credit reporting can be done by a public credit registry._

This is not true for Germany.

[https://en.wikipedia.org/wiki/Schufa](https://en.wikipedia.org/wiki/Schufa)

</comment><comment><USER30> A pipe dream. As evidenced by the stock price, nothing will change. People don't care--at least not enough to _do_ something like call their elected official, if they even know who they are.

Which brings me to a question of the "have things always been like this?" sort. Do we have data on the percentage of any population who's active in politics over the past, say, 7 decades?

</comment><comment><USER31> This is a perfect opportunity for "distrupting" this sector.

Why is no one stepping up and flipping the business model on credit reporting?

<comment><USER32> Disruption solve a problem better for the _customer_. There's little evidence that credit bureau customers (lenders, et al) experience this as a problem. So I don't think this is much of an opportunity for disruption.

</comment></comment><comment><USER33> > _Although they call themselves bureaus, there is nothing governmental about > what these private companies do._

That is a naive statement, perhaps based on an idealized version of a few cherry-picked governments.

</comment><comment><USER34> Individuals should have the option to tell companies requesting credit checks that they do not consent. Further more, it should be illegal to hold non- consent against the individual.

</comment><comment><USER35> _> That's because we are not the customers... but the product._

An increasingly familiar pattern.

The free market is flipping against the people.

</comment><comment><USER36> > Equifax is the oldest of the Big Three credit reporting bureaus, and it got > its start as a private investigator in the late 1800s. A client — a business > or a bank — would ask it about a consumer, and it would go about digging up > dirt on things like marital problems and convictions. That client would then > pay it for its services.

> This questionable business model raised eyebrows in the 1960s, when the > companies were still compiling information on people's "moral character" > such as affairs or drinking problems. At the time, the reports weren't > available at all to the subjects themselves. That changed with the Fair > Credit Reporting Act, which was signed in 1970. But even that reform put > virtually no oversight on the bureaus' practices.

As if there aren't a bunch of companies trying to do exactly this with a combination of tracking cookies, browser history, purchase history, and ML.

Separately, from the article (emphasis mine):

> The United States government is, of course, not impervious to data breaches, > nor does it have a perfect track record of fending them off. In 2015, it > announced that hackers had stolen "sensitive information" on 21.5 million > people. But the government is at least accountable to public pressure. > _Equifax never will be, even under the tightest regulation._

Equifax may not have to change anything as there's a very real chance it goes bankrupt because of this. It's not just from the cost of lawsuits from consumers. There's a longer term cost of businesses not wanting to deal with them.

The risk of that happening to one of the other big credit reporting agencies is the biggest driver for them to clean up their act. The threat to their businesses is real and I'd imagine their internal responses will be as well. I also think regardless of what they do it's only a matter of time till they have a breach as well. You only have to screw up once.

> Credit bureaus have proved to be complete failures at safeguarding the > public.

Nearly all companies are complete failures at data security. There's not special about credit bureaus here. They just happen to have _a lot_ of sensitive data on a lot of people and thus are a hot target. As an example, we've had plenty of breaches in the health insurance industry as well.

Perhaps the best approach would be a "too big to fail" limit on the bureaus. Put a cap on the total size (in accounts / people covered) of a credit bureau. The libertarian in me is screaming at the thought of something like that but at least it has the advantage of limiting breaches to a max number of people.

> Let's demand we get our data back.

It was never your data.

</comment><comment><USER37> "Equifax could easily have patched the hole in its system that hackers exploited, but it simply didn't."

We don't know why, though. Perhaps they were working with law enforcement to track the attacker. Closing the hole would certainly alert the attackers and end the chance to catch them.

This reads just like the Cuckoo's Egg.

<comment><USER38> Your argument is that law enforcement wanted to risk the identities of millions of Americans they're supposed to protect?

That logic is simply broken. Either the argument is strawman or law enforcement is just as guilty of negligence as Equifax is.

<comment><USER39> I don't know about this situation but I'm willing to bet one could find many examples of law enforcement doing that very thing in various different cases.

Law enforcement is about enforcing the law, not protecting law-abiding citizens from criminals.</comment></comment></comment>


Collection of biometric data from refugees puts them at risk - <AUTHOR> https://www.iafrikan.com/2019/09/25/the-collection-of-biometric-data-from-refugees-puts-them-at-risk-another-problem-is-that-when-such-data-is-collected-refugees-are-not-in-a-position-to-make-an-informed-decision-on-wheth/ <comment><USER2> In the USA, green card and naturalization applicants are required to be fingerprinted for FBI criminal background checks.

Cant apply for green card without being fingerprinted.</comment>


Scientology: Operation Snow White - <AUTHOR> http://en.wikipedia.org/wiki/Operation_snow_white

<comment><AUTHOR> After some clicking around from yesterday's Wired article I found this, incredibly scary stuff.

I realize it might be considered off-topic, but I'll leave it up to you guys to decide that. I think the amount of interest generated by the submission yesterday proves that the community in general is interested...</comment>


Valid points in the Google manifesto have been totally ignored - <AUTHOR> http://slashtmp.cloudapp.net/google-manifesto <comment><USER2> I think men are naturally more competitive too. There aren't tons of studies on human competition, but when male dogs go through puberty they become more competitive and aggressive, hence a reason why neutering is so popular (to curb the behavior).

Also a lot of the top contributors to these equality / affirmative action posts seem ignorant of biochemistry. They always sight testosterone and estrogen as the only chemical differences, which is very high-school level understanding of the real gender differences.

You need to look at many androgens (androsenediol, androstenendione, dehydroepiandrosterone, dihydrotestosterone, testosterone), estrogens (estradiol, estetrol, estriol, estrone), progestogens (e.g. progesterone) and other biomarkers like DHEA, adrenals, prolactin to get the full picture.

This is also why the people claiming transgenders are identical hormonally to the gender they are swapping to frustrate me. It's just not the case. There are a huge array of sex hormones aside from testosterone and estrogen (usually referring to e2 or estradiol) that have large impact on an individual. I don't really care what you do with your body, but don't be ignorant to the science of what you are changing / not changing.

Anyway, I am not suggesting in anyway that we discriminate against one group or another. But we should all do our part and try to learn the differences between eachother to better understand these issues.

EDIT: I am quite liberal and don't hate anyone. I just am frustrated at other liberals who opt to ignore science to push their own agendas.

EDIT2: It's really sad that I feel the need to actually have to post the first edit.

<comment><USER3> Liberals eating liberals, its gold, this whole event is pure gold.

</comment></comment><comment><USER3> From the post:

But, could it possibly be that, we don't get to 50% of female employees in tech because, at present, they generally show less interest in those disciplines and are therefore less represented? No? Why should we aim to get to a 50% proportion if the proportion in the pool we are picking from is not even close to that? And why would 50% be a target anyway? The target should be to ensure that good people are hired and that they are able to work well together, regardless of the minority they might be in.

I think tech giants try hard to get that part right and to ensure that discriminations do not happen. Maybe the problem lies somewhere else: universities, or even at a younger age, in families (no we all know education has nothing to do with that kind of thing). Or maybe we could look at marketing and role models in our society. Maybe we just need time to let numbers even out, maybe there isn't even a problem to begin with, because females might actually be 5 times less likely to be naturally interested in tech. Who knows?

<comment><USER4> Of course what they leave out is any justification for prioritizing the demographics of the hiring pool over the demographics of Google's customers. The universe as we know it is essentially 50/50 male-female.

<comment><USER5> Do you have a data and sources on who Google customers are? I bet according to you most of them are Males?

<comment><USER4> Google's customer base is "everybody."

</comment></comment></comment></comment><comment><USER6> Be careful, you might be blacklisted! Remember, thoughtcrime is still crime.

</comment><comment><USER7> Quote from another article: "All of these traits which the manifesto described as "female" are the core traits which make someone successful at engineering. Anyone can learn how to write code; hell, by the time someone reaches L7 or so, it's expected that they have an essentially complete mastery of technique. The truly hard parts about this job are knowing which code to write, building the clear plan of what has to be done in order to achieve which goal, and building the consensus required to make that happen."

There are some good points in the memo - like having training and support for men, but it was largely an exercise in casting doubt on the ability of certain subset of your co-workers to do their job.

</comment><comment><USER8> Everyone line up for the Google blood test that tells you what job you can have.

<comment><USER9> Is that a GATTACA reference? I think that's a GATTACA reference!

Great movie, well before it's time, worth watching for any hacker.

Especially now that sequencing is 100,000 times cheaper than it was 20 years ago.

</comment></comment><comment><USER10> This seems to be reiterating almost exactly the points that the "manifesto" was making. Maybe people will actually read this one before responding without being primed for outrage by Gizmodo.

</comment><comment><USER11> Some folks have set up donations for James Damore to help him until he finds new employment: [https://www.wesearchr.com/bounties/james-damore-official- fun...](https://www.wesearchr.com/bounties/james-damore-official-fundraiser)

Engineers should help engineers in times like these.

<comment><USER4> Just to note the self-segregating perfection of the fundraiser being hosted by Charles C. Johnson[1].

1\. [https://en.wikipedia.org/wiki/Charles_C._Johnson](https://en.wikipedia.org/wiki/Charles_C._Johnson)</comment></comment>


Some US prisons are banning books on coding - <AUTHOR> https://dev.to/ben/some-us-prisons-are-banning-books-on-coding-54jg <comment><USER2> It's proven that access to education and skills development significantly reduce prisoner recidivism, which means less prisoners to house in private prisons. The private prison industry has been lobbying at the state and federal levels for years to create new laws to increase the U.S. prison population (the highest in the world) and eliminate programs that reduce recidivism. This isn't "laughably ignorant", this is intentional and by design.</comment>


Madam C.J. Walker, an early 20th-century black woman who built a hair company - <AUTHOR> http://www.collectorsweekly.com/articles/madam-walker/ <comment><USER2> I found this article difficult and confusing to read. It says stuff like: "beauty standards that placed a high value on lighter skin and hairstyles that imitated white looks,"

then says: "began offering skin-lightening and hair-straightening products to compete with white companies that marketed these items to black consumers" "Walker rebuffed a reporter in response to an article that derisively referred to her as the "de-kink queen." "

I couldn't figure out if the article was saying Walker was a black woman who supported natural hair for black women (which I imagine would be a good thing for black women, and good for the planet as well given the toxic chemicals in hair straighteners, and general waste of resources on hair) or if the article is saying she just built a hair company and provided whatever the masses wanted even if it was damaging to their own self-image and communities?

<comment><USER3> The article states that the company started selling these kind of "looking more whiteish" products after she has already passed away, not during her leadership. Her marketing was focused in making women look more healthy, not more white.

</comment></comment><comment><USER4> magda_wang, God bless you for bringing this piece to HN.Keep it up.

</comment><comment><USER5> > men like Andrew Carnegie and John D. Rockefeller—who cornered emerging > industries and amassed incredible wealth at the expense of the public and > their employees.

That implies that it was a zero sum game. This is far from correct. Standard Oil, for example, drove the price of kerosene down 70%, which was of considerable benefit to the public.

<comment><USER6> Creating the steel industry? Creating the oil industry? Pffft. How does that make anyone proud of their hair? You tell me! Heck, Rockefeller didn't even have any hair, and Carnegie, precious little.

Seriously, how can anyone get past that first sentence in all its brazen stupidity?

<comment><USER7> It's an interesting historical article about someone remarkable. It's unhelpful to flame the entire thing based on one sentence you don't like, and your comment adds nothing but lighter fluid to the GP's observation.</comment></comment></comment>


Show HN: Beeswithmachineguns, lets you use EC2 to DDOS yourself - <AUTHOR> https://github.com/newsapps/beeswithmachineguns

<comment><USER2> There's also Locust, a Python powered load testing tool similar to this. It's focused on simulating user behavior rather than hitting specific URLs. This allows for much more true-to-life testing.

We used it to load test Battlelog (the online service for Battlefield 3) and successfully simulated over 2 million concurrent users hitting the service using EC2. See <http://locust.io> for more info. (Disclaimer: I'm one of the authors)

</comment><comment><USER3> This was used in a AWS demo in re:invent or something like that I recall.

I also recall being extremely impressed (you know, the whole.... autoscaling!!!! thing) and thought it was an internal Amazon product.

</comment><comment><USER4> I like to use <http://blitz.io> for load testing.

</comment><comment><USER5> I have used this for load testing before, unfortunately the project is in need of a maintainer, I don't know python, but from the github page:

"ATTENTION: This project has several open pull requests and is in need of a maintainer! If you have experience with EC2, Python and load testing tools and would be interested in taking it over, please open a ticket telling us why and we'll get back to you. Thanks!"

is anyone fancies it!

<comment><AUTHOR> Seriously, if I were better at python I would do this, I know a few of you could use the experience, go out there and help change the world you awesome person you!

</comment></comment><comment> Aco- beeswithmachineguns is my mainstay, but siege is also a really good tool</comment>


Am I the only one that prefers the stripped down Gizmodo 'emergency' site? - <AUTHOR> http://updates.gizmodo.com

<comment><AUTHOR> Their normal site has become so difficult to navigate, logo overhanging on videos, slow javascript/rendering, etc.

I've visited the basic tumblr site much more than I would normally visit their site.</comment>


Why Obama's Smart Gun Push Will Misfire - <AUTHOR> http://techcrunch.com/2016/01/05/why-obamas-smart-gun-push-will-misfire/ <comment><USER2> As a gun owner, this article is pretty accurate account of why it should fail. The most important thing for a gun is for it to fire when the user wants, everything else is effectively worse than useless. Due to the wide range of operating conditions in which a gun must work, only the most basic of safety measures can be taken (generally a bar preventing the trigger or hammer from moving) to meet this requirement.

As the article states, pretty much the only acceptable way to improve the safety of a gun is to make sure its locked up correctly when not in use. This also has the side benefit of working on all existing guns with a minimum of extra cost to a gun owner. Smarts will add a few hundred dollars at a minimum to a gun design, vs a few 10s of dollars it would be to keep it in a safe along with the rest of the owners collection.

If they really wanted to make things better, they should introduce testing of safes used for gun storage and a set of fines for people selling safes that don't pass the test. A bunch of existing safe vendors attempts at security are worse than useless. See this video of a toddler opening a bunch of gun safes: [https://www.youtube.com/watch?v=erGOJxQIf5c](https://www.youtube.com/watch?v=erGOJxQIf5c) It doesn't matter if the toddler was coached to open them, the point is it must be impossible for them to open the safe regardless of conditions. The FCC tests radios (generally through certified third parties), why cant they introduce something similar for gun safes and other gun safety measures?

</comment><comment><USER3> I have to say that I do agree with many of the points in TFA... most of the gun guys I know would rather have something reliable over extra features. I have a friend who won't keep a gun that's misfired/jammed at the range. The acceptance of glocks over other options comes down to the additional safety features that tend to sometimes not work.

In the end the simpler device is the reliable device. Anything that increases public safety will come down to education, training and citizen responsiveness. In real life, bad things happen... it may be with a gun, or a bomb, or a car, or any number of things that are legal to own. Civil defense is a basic human right, I wish that people understood what that means better.

That said the concept of civics, and civic duty are no longer part of general education in this country. If something is going wrong, and you have the ability to intervene, you have the responsibility to intervene. Taking firearms away from the general population hinders that ability.

I can't even get the biometric entryways at work to register the first time more often than not... I'd rather not have that happen in a crisis.</comment>


3D Modelling in a Browser - <AUTHOR> https://www.vectary.com/ <comment><USER3> See also: Clara.io [0], Onshape [1], Lagoa (bought a few years ago by Autodesk) [2]

I must confess I struggle to see the long-term market for these services - <USER2> was working on a startup in the field for a while, and eventually decided it wasn't worth continuing.

The only thing these services really offer above desktop equivalents (which Autodesk totally dominate) is the collaboration (like Google Docs for 3D). But do you really need to collaborate to create 3D? Maybe to review/annotate etc. but to actually collaborate during the process of creating an object/scene?

To put it another way, are you going to convince your entire art team to leave behind the toolchain they have used their entire career, just so they can 'collaborate'? And if so, do you think Autodesk are going to let that happen? (Obviously not, as they bought in to the field a while ago).

[0] [https://clara.io/](https://clara.io/)

[1] [https://www.onshape.com/](https://www.onshape.com/)

[2] [https://architosh.com/2014/11/autodesk-reportedly- acquires-c...](https://architosh.com/2014/11/autodesk-reportedly-acquires- cloud-based-3d-design-platform-lagoa-for-60-million/)

<comment><USER4> I'll plug our product here as well [https://3dc.io](https://3dc.io)

<comment><USER5> I've recently started using 3DC and find it to be a wonderful creative tool. It's super intuitive and easy to use on the go, on a mobile device. I look forward to using it more in the future.

</comment></comment></comment><comment><USER6> I am a Mechanical Engineer and we use SolidWorks for CAD. I was surprised to find there exists no 3D modeling software (Nurbs / Polygonal based) that I can model using accurate dimensions. 3DSMax, Maya, Modo, C4D, Blender, Houdini, you name it. I understand that they're not doing parametric modeling such as SolidWorks, Inventor, etc. but there has to be a way to merge both modeling paradigms. I was honestly shocked at this fundamental lack of capability.

I wanted to accurately model a product for visualization and there is no way to specify dimensions. Everything is done by "eye" in the visualization industry. When accuracy is required, especially proportions, manual element dimensions are typed in during creation of primitives.

I am used to the extreme discipline and constrain based modeling in engineering. Does anyone know why visualization folks don't care about dimensional accuracy?

<comment><USER7> In blender at least you can specify the size of any primitive, measure the length of any edge, measure between any two points, move a vertice, object, or face by a specified amount etc. so this is just not true for blender at least. You can also annotate any dimension easily with a dynamically updating annotation. What you can't do easily (unless you're prepared to do some serious python scripting) is parametric / constraints based modelling because it's not a parametric modelling program. I'm not sure what else you'd want.

As to why visualisation folk don't care about dimensional accuracy, we do when necessary, but unless we're designing for 3d printing there's no point in worrying about things like clearances and tolerances since we're not making a physical object. Also, especially if we're doing arcvis, the demand is to knock out large quantities of models very quickly, not produce a perfect replica. I'm not going to worry about the exact dimensions of a piece of complex equipment or furniture I'm modelling if I need to produce a fully textured model in under an hour.

<comment><USER6> I've seen countless tutorials - Eames house to Braun products, even full furnished houses on YouTube. _No one_ cares about dimensions. It bothers me so much that it should be _fundamental_ to designing anything - I would argue, even dragons.

I think it's the culture and people involved in 3D modeling that do not have the discipline - at the risk of sounding snobby. If customers demanded a feature, modeling software companies would supply those features.

"Ball park" dimensioning is like nails on a chalkboard.

</comment></comment></comment><comment><USER8> Does per monthly pricing turn off a lot of people?

My usage patterns are pretty uneven and - although I know I can unsubscribe/resubscribe - I end up feeling like I'm probably wasting my money when I'm not using it (despite the low price)

It's irrational but there you go.

Does anybody consider a per-usage pricing model? Is there some reason why that is a terrible idea?

<comment><USER9> Yes, i do not mind paying for quality software, but i want to have control over it. This means payment once (...i am ok with buying new major versions as long as the developers aren't releasing a major version every year or whatever to force people repay) and i get an installer .exe (or whatever) that i can keep on my external HDD for as long as i want and there isn't any need for online authentication/DRM (i am ok with key files as used by Total Commander and WinRAR).

Sadly, as time goes on this is becoming increasingly less common.

<comment><USER10> I don't like that model for anything I want continued support for (excluding things that are more or less complete like WinRAR or games).

The problem with the traditional pay once (with paid upgrades) model is that in order to continue developing the software, developers need to be paid every month. So a hugely variable revenue stream needs to be converted into a monthly one. Maybe by being very conservative about spending on developer resources to leave a big buffer.

There's also mismatched incentives, since if all your revenue is from paid upgrades it might make more sense to focus on flashy new features even if the majority of users care more about stability and bug fixes.

There's the issue of how much effort to spend back-porting bug fixes to older versions. Users will rightly be annoyed with having to choose between bugs and an upgrade that (they consider to be) not worth it, so the devs probably have to put in some effort. But then with the old model the developers are putting in more work _and_ fewer users have access to new features, and the total amount users are paying still has to be high enough to fund everything.

These days I'm happy to pay for things I use on subscription (as long as the total cost is reasonable).

Maybe a good middle ground is something like the JetBrains model, where a 1-year subscription also comes with a permanent license for the version at the time of purchase, so you can at least open your old projects.

<comment><USER9> As a user i do not really care about the developer's business plans and especially i do not care on trying to make my purchasing decisions based on guessing what the developer _might_ end up doing in the future. I prefer to act on what is available for me right now and have control on the software. Hence the preference for pay-once, DRM-free software with an installer i can download and keep myself.

And BTW, a developer focusing on flashy new features instead of stability and bug fixes is something that is independent of the monetization scheme. If the users want stability and bug fixes while the developer provides only new broken stuff, then the developer is simply not listening to their users which can happen (and often happens) regardless of if the software is paid once or subscribed to.

TBH I think you are looking things a bit too much from the developer's side.

FWIW i do not mind 1-year subscriptions with a permanent license, although i'd prefer the permanent license to be for the end of the year, not the start (especially if there is a chance that the files you worked on with the last version wont work with the earlier version). It is essentially "buy once, get free upgrades for a year". Assuming of course the other things i mention (offline installer, no authentication needed, etc) still apply.

</comment></comment></comment></comment><comment><AUTHOR> Here is a video of what is possible inside a browser! [https://www.youtube.com/watch?v=0dC1ZRdf9JM](https://www.youtube.com/watch?v=0dC1ZRdf9JM)

Wow! (not affiliated with them)

<comment><USER11> Wow so it plays electronic music in background while you work. That's different.

</comment></comment><comment><USER12> ...so, what kind of rendering tech does a tool like this rely on these days? WebGL? What's considered best practice on this front these days?

<comment><USER3> WebGL, which is now supported by all modern browsers, with WebGL2 (more flexible, fewer restrictions) around the corner. Most of the professional level tools as exhibited by the OP will be using a custom engine built on top of it.

For smaller projects, the excellent Three.js [0] is an easy way into creating 3D in the browser.

[0] [https://threejs.org/](https://threejs.org/)

<comment><USER13> WebGL2 is not around the corner. Apple has indirectly made it clear they will never be shipping WebGL2.

WebGPU is "around the corner". Apple/Mozilla/Google/Microsoft are all working on it. Google and Mozilla will ship it. Apple and Microsoft remain to be seen.

<comment><USER14> [https://caniuse.com/#search=webgl2](https://caniuse.com/#search=webgl2)

It's supported in safari, currently gated behind a setting though.

<comment><USER13> No it is not. That report is wrong.

Apple added a flag. They didn't add an implementation. There is zero code in WebKit to support WebGL2. All there is is a stub that returns a WebGL1 context when WebGL2 is asked for. Feel free to dig through the WebKit code. You'll see there is no WebGL2 code, all the functions are actually missing and no code has been added in > 3yrs. Try running the tests. ([https://www.khronos.org/registry/webgl/sdk/tests/webgl- confo...](https://www.khronos.org/registry/webgl/sdk/tests/webgl-conformance- tests.html?version=2.0.1)), click off "all" then search for "conformance2", check the box and run. You'll see almost nothing passes.

</comment></comment></comment></comment></comment><comment><USER15> This looks pretty cool. Tinkercad is another tool like this that works in a browser. I find Tinkercad is a little more intuitive but from what I can see this seems to be a little more powerful.

</comment><comment><USER16> To get extended functionality, you need to sign-up for a Premium account. This tool need's to be more open in first place as 'fully functional' before it can attract people to sign up for premium account.

The 'collaboration' aspect isn't what will sell this product. It could have potential when they allow creator's and designers to fully explore it first.

</comment><comment><USER17> So can you actually do useful work in this? Or is it just drag & drop of prefabs like the marketing would lead you to believe?

What about modifiers and tools, what can I actually make with this aside from drag&drop of prefabbed iphones?

Why would I choose to pay for some cloud BS over just downloading blender?

</comment><comment><USER18> We've come a long way since VRML [0] running in java applets!

Re-live the experience: [https://www.youtube.com/watch?v=eghlSdGvuC0](https://www.youtube.com/watch?v=eghlSdGvuC0)

[0] [https://en.wikipedia.org/wiki/VRML](https://en.wikipedia.org/wiki/VRML)

<comment><USER19> > We've come a long way since VRML [0] running in java applets!

I'd argue "yes" and "no" on this at the same time...

With VRML, it was designed so that - like HTML - anyone could easily create 3D objects and "worlds" using a simple markup syntax that was very similar to HTML (IIRC, both are subsets of SGML?).

It was easy to create something really quickly that could be interacted with.

These tools, while they simplify the creation part (somewhat), are more akin to today's "web site builder" systems vs raw HTML in an editor.

What you get out of them, though, isn't anything like HTML - if you are lucky, you'll get a standard file format or maybe JSON - but then what do you do with that? Furthermore, it isn't likely very human readable or editable.

WebGL - and libraries like three.js built on top - are all well and good, and allow for much easier access for 3D graphics work - but neither are anything like VRML.

There are some VRML-like tools out there - one that comes to mind is Google's A-Frame:

[https://aframe.io/docs/0.9.0/introduction/](https://aframe.io/docs/0.9.0/introduction/)

So some stuff like the old-school VRML is out there, and VRML had it's issues, which is part of why it didn't survive (the other part being that it was too early for the available PC hardware - unless you happened to own an SGI workstation at the time).

It's one of those pieces of "pioneering" technology that came too early for the tech - but gave us a glimpse of what might be possible in the future (much like the first "wave" of virtual reality hardware technology).

</comment></comment><comment><USER20> To add to the list of other similar projects already mentioned, Nunu Studio[0] is a solid MIT-licensed tool based on three.js.

[0] [https://nunustudio.org/](https://nunustudio.org/)

</comment><comment><USER21> Dimensions? Master model? Assemblies? Or is this only for pretty pictures?

<comment><USER22> It claims to be for modeling not CAD. Think Blender not Solidworks.

So ultimately yes, it's for pretty pictures.

<comment><USER23> blender can create 3d printable STL files, so if we're "thinking Blender," then that implies we can 3d model for printing, if i understand what you're saying

<comment><USER24> I think a better distinction here is mesh vs. solid geometry. This is a tool for creating mesh-based models and has a focus on rendering. STL is a mesh format that you can print with consumer 3D printers and it looks like Vectary supports that as an export format, but it's not a product built for engineering or mechanical design.

That said it looks really cool and I would definitely print something made with it. Trying that out now, actually.

<comment><USER25> The distinction you are looking for is parametric vs. geometric.

Parametric models such as Solidworks or Creo use complex equations to derive the 3D geometry. Geometric models use a point cloud built from polygons to develop surfaces. These point clouds are defined by the user and are not as "stable" when used in product development setting where you are trying to create multiple iterations/sizes of an object

<comment><USER26> it's more like Brep is the distinction, is the internal representation a list of operations on a Brep model?

But it's true that model history is preferred for mechanics, but I have seen some proto model history in 3DS max with the modifier stack.

</comment></comment></comment></comment></comment></comment><comment><USER27> Amazing choice of typography and design!

</comment><comment><USER28> Oh man I hate receiving spam from these people. They don't provide an unsubscribe link, and when I ask them to stop sending me these e-mails, they say they won't and that I should manually log in to their website and delete my account. I don't have time to deal with this but I hope someone takes them to task for that.

<comment><USER29> If you mark it as SPAM, it should cause their mail reputation to take a hit, and your mail server should prevent their emails from getting to your inbox.</comment></comment>


Text mode 2048 game in C for your Linux console - <AUTHOR> http://www.leaseweblabs.com/2014/03/text-mode-2048-game-c-algorithm-explained/

<comment><AUTHOR> Original game: [http://gabrielecirulli.github.io/2048/](http://gabrielecirulli.github.io/2048/)</comment>


Ask HN: Are you planning to be someone different in the future? - <AUTHOR> If yes, in what way, apart from being older? <comment><USER2> Yap. an EDM DJ!!! Away from software development.

</comment><comment><USER3> No but it'll probably happen anyway.

</comment><comment><USER4> Been planning for years

</comment><comment><USER5> A retiree.

</comment><comment><USER6> Life is too short, ours future is set to ours faith in Jesus. It is wise to be close to our savor and be more and more like him and less and less as we are.</comment>


What Calacanis's Launch Team thinks of Receivd - <AUTHOR> http://launch.is/blog/l012-well-receivd-file-sharing-made-dead-simple.html

<comment><USER2> No. Stacking a new paradigm (iphoto/whatever) on top of an existing one (file folders) is not simplifying, it's complicating.

<comment><USER3> I get your point, but why does Apple then stack photos and mp3s?

<comment><USER4> its the old PARC UI/UX concept..ever see a Lisa Apple computer JC? I know you have seen at least one right? It borrowed some concepts from PARC and that was one of them..

</comment></comment></comment><comment><USER5> While I understand that the file system is the single greatest source of confusion for casual computer users, I definitely do not think iPhoto is the best alternative paradigm. Most casual users that I know hate iPhoto and iTunes with a passion. It's one of those areas (like the file system!) that Apple does really poorly.

I've never used Receivd (hate the name), but it might be able to get over the file system hump. I don't understand why they would encourage comparison to iPhoto for OS X though. Maybe something was lost in translation there.

</comment><comment><USER6> \- "AND ONE MORE THING: We would steer these guys into TechStars or Y Combinator, but they're way too far along. If you're a VC playing catch-up in the cloud space, ship these kids $1.5M and do monthly board meetings."

I don't think they are too far along for Ycombinator.

I still prefer dropbox but that could be 1) because its what I already use 2) the design is too much like Itunes on Receivd</comment>


Learn X in Y Minutes PDF builds - <AUTHOR> https://github.com/aviaryan/learnxinyminutes-pdf <comment><USER2> This is awesome.

<comment><AUTHOR> I know. very helpful to learn new programming languages once you know the basics.

</comment></comment><comment><USER3> Very nice!</comment>


The 2018 MacBook Air is the iPhone X's ASP strategy all over again - <AUTHOR> https://9to5mac.com/2018/10/31/asp/ <comment><USER2> My first reaction to the new MacBook Airs was, gee I could use that to replace my 15" 2015 MBP. I've been wanting a machine with TouchID, but I don't like the touch bar and like a physical escape key. With cloud work becoming more prevalent, maybe 2 cores and 16 GB is enough.

<comment><USER3> Just ordered one for dev work. Hopefully it's enough.

<comment><USER4> I almost did as well, and then I saw that they are equipped with the "Y" series of CPUs, so extremely underpowered 5W-limited series that normally goes in the basic Macbook or fanless tablets. It looks like they have completely neutered the CPU in the Air, where it no longer is a machine intended for anything more than light web browsing. It really shouldn't be called an Air - more like Macbook XL(Or Max, or whatever the current nomenclature is).

<comment><USER3> Yeah, MacBook 13" would have been a better product name. I've read contradictory things online for the projected performance of the i5-8200Y chip. The good news might be it's actually 7W and it has a fan. Maybe we can expect performance closer to the MB pro nTB 13".

</comment></comment></comment></comment><comment><USER5> Not sure I agree that the Macbook is "an inferior machine at a higher price". At 12", it is the only <13" offering currently.

<comment><USER6> What do you gain with picking a 12-inch display over a 13.3-inch display?

<comment><USER7> It's so tiny it's practically the size of an iPad. If you travel a lot this can be a huge deal. I did a ton of development on one and it was great, but I had a beefier machine for visualizations and big compiles. Still, the tiny 12" is my go-to computer, small disk notwithstanding.

It also appears anecdotally that the smaller screen is more popular in Asia than in US/EU (for both Mac and Windows).

<comment><USER8> I used to have the 13" MacBook Air but am now on a 15" MBP. What I found is that whereas I'm reluctant to pull out my MBP on the couch or bed; I used to do that without hesitation with the MBA. There seems to be some threshold of weight/size that produces friction and makes me keep the MBP on a desk instead of using it like a (more) mobile device.

This is bizarre since the 2 machines are not immensely different in sizing, but it's something about the feel. Obviously this is highly subjective but this is making me consider a 12" MacBook to have as my personal, non-workhorse machine.

</comment></comment></comment></comment><comment><USER9> For those who wonder, like me, if Apple is doing Active Server Pages: "ASP" means "Average Selling Price".

</comment><comment><USER10> Interesting theory about the iPhone X being "obviously different" than the lower end iPhones last year, and how it would immediately signal if you had the 'latest' device or not. I suppose that's somewhat inarguable in terms of the iPhone ecosystem, particularly when powered on, but my favorite thing about my X last year (and especially now) is how anonymous it is. With a generic black quad lock case on a black phone, sitting face-up on a table, literally all you can see is black, and a tiny slit for an earpiece. If you look REALLY closely you can see the camera next to the earpiece. There's no home button to say "this is an iPhone", or advertise whether it's a touchID home button or an even older physical home button. It could be absolutely anything. The only real giveaway is when it's on, or if you put it face down; the stacked cameras were fairly distinctive.

I mean, I certainly didn't choose it over some other phone merely because WASN'T flashy, but I'm a lot happier buying something that doesn't advertise itself.

<comment><USER11> imho that is some serious rationalization. you likely don't see yourself as a flashy person so you have to construct a reality where the phone is the extreme of that — anonymous.

i have news for you. for anyone that does care, you can tell an iphone X all the way across the bar.

<comment><USER12> Why are you criticizing someone's personal aesthetic preferences? So you think that the iPhone X isn't understated. Doesn't mean that someone who disagrees is doing "serious rationalization" or "constructing a reality".

<comment><USER11> You've misread. I wouldn't dare to and I'm not criticizing someone's personal aesthetic preferences.

I'm commenting on their projection of their desired reality onto the real reality.

<comment><USER12> What real reality are you referring to? That the iPhone X looks flashy? Thats not an objective truth, its taste.

If someone likes driving Corvettes because they think it looks anonymous and non-descript. Who are you to tell them they're wrong. Its their opinion.

</comment></comment></comment></comment></comment><comment><USER13> I just browsed Apple's site to compare the models and it confused the heck out of me. [https://www.apple.com/mac/compare/](https://www.apple.com/mac/compare/)

The MacBook, new Air, and 13 inch Pro are roughly priced the same with very few discernible differences. An average buyer would be very confused.

<comment><USER14> Best comparison chart I've seen so far: [https://www.theverge.com/circuitbreaker/2018/10/30/18042744/...](https://www.theverge.com/circuitbreaker/2018/10/30/18042744/apple- macbook-air-2018-vs-pro-comparison-specs-features-best)

</comment></comment><comment><USER15> The Macbook and iPhone lines are really mature. They've both been around for a decade now, Apple is doing a good job of continuing to squeeze the juice out of these fruits and these sort of strategies are textbook when it comes to executing on a mature product line.

I think Apple's biggest question is what's next? The Apple Watch is really starting to hit's its groove and I think within the next few years will become a really fantastic product (even moreso than now) but what's next?

<comment><USER16> All of their hardware are mature, what's next need to be the software.

iOS is way too limited for what the hardware can do.

macOS is way too slow compared to what Windows feels like on the same Mac hardware.

They need to focus on the software right now.

<comment><USER17> > macOS is way too slow compared to what Windows feels like on the same Mac > hardware.

What are you smoking?

<comment><USER16> Nothing? What's the problem?

I have Windows running via Bootcamp on the same Mac and Windows feels much faster than macOS at opening stuff. Even faster than I disable animations.

Just because you don't see it, doesn't mean I don't. I know for sure I'm not the only one seeing it.

</comment></comment></comment></comment><comment><USER18> Author is implying that ASP is rising for the Macs, but he didn't look at prices in the last 10-15 years.

<comment><USER19> ASP is rising in the last couple of years, but it's only recently crossed the level it was at a decade ago.

</comment></comment><comment><USER20> The article is wrong when it says: _Absolutely nobody who knows anything about Macs – or computers of any kind – is going to recommend that they buy the old model._

Two things better on the old model: keyboard and MagSafe.

I'm glad I own an older Macbook Pro Retina. I'd always have "keyboard anxiety" with any of the new models: is this the day my keyboard fails? And: do I dare take my laptop outside? Will airborne dust get into the keyboard mechanism?

Bah!

<comment><USER21> I bought a 2017 MBA for $800 a couple of months back for my wife and, with all its faults, I think it's a better deal than the new 2018 MBA.

Other than the outdated display, performance is perfectly adequate, and battery/trackpad/keyboard/SSD speed/ports are still doing great.

<comment><USER10> I'm split. I have a 2011 Air that I rarely use. The 4MB of RAM and slower CPU is the major problem with it; screen resolution is a distant third. I keep thinking of buying the most modern USB-A-and-SD-card-reader-equipped AirI can find, because it truly is the best machine I've owned. On the other hand, new and shiny! And I almost never use the SD card reader or USB port, it's just nice to have. And the keyboard is fantastic.

<comment><USER21> The good thing is now you should be able to find great deals on the 2017 model.

</comment></comment></comment></comment><comment><USER22> I think weight wise MacBook Air is not much lighter than MacBook Pro 13". But it is about 500 dollar cheaper than MBP with newer 8th gen processor. I guess will wait until MBA gets cheaper or cheaper MBPs get new processor and keyboard.

<comment><USER23> > I think weight wise MacBook Air is not much lighter than MacBook Pro 13". > But it is about 500 dollar cheaper than MBP with newer 8th gen processor.

Except it's a dual-core Y-series (same as the macbook) while the 13" MBP gets a quad-core 25W U-series, and the MBP comes with double the storage (that alone accounts for $200) and connectivity.

<comment><USER22> You are of course right. I was mainly looking 12-1300ish MBP with newer processor or about 1000 dollar MBA. Since I can wait for a year or longer, maybe there will be better pricing then.

</comment></comment></comment><comment><USER24> So I did a search in the article for the word "inflation" and found no hits, but I think it's something that the tech world is going to have to start getting used to after decades in the steep part of a S-curve that let it defy the normal. In most of the developed world at least inflation is generally quite low, but it's not zero (nor is zero or worse deflation a healthy sign). For electronics there has been a long time where constant improvements in process technology, efficiency, mass manufacturing tech, and just plain ever larger scales as it went global, meant that every year or two allowed more to be done cheaper.

But at this point that's heavily played out. Progress is certainly not "done" by any means, and the slowdown is uneven (GPUs still scale more easily for example), but it's not exponential or essentially "free" anymore either. Bumping into harder physics means process shrinks keep getting harder and vastly more expensive for less gains, the low hanging frequency improvements and IPC has been picked, a lot of the trivial vectorization and parallelism done, hyper cheap mass labor utilized, the easy parts of the global market gobbled up, etc. There are also softer issues like inequality to deal with and in turn a wider spread in prices people might pay.

So tech companies are going to face a more "normal" world, where no a device from a year ago or two years ago or even 5 or more years ago isn't necessarily "obsolete". That means they'll need to figure out how to start raising prices over time just to keep pace with inflation let alone secure more growth when expanding marketshare or cutting costs is ever harder. But the public has been conditioned for a very long time to expect prices to always stay the "same" (which really means it's falling in real terms over time) or outright drops on the sticker price. Figuring out how to navigate that to a new normal without promoting undue backlash is something everyone will need to grapple with. One approach that Apple may be going for is to just take some pages from mature areas like cars, where there is a huge premium for "brand new", and large percentages of the population are fine getting used or "last year's that didn't sell" (let alone an "old model but newly manufactured" which isn't really a thing with cars) and will never buy brand new their entire lives. But "old" models still get support for a long time and to the basic job fine.

Other strategies of course include trying to shift more into ongoing services revenue, platform monetization (be it a cut of software sales or ads), premium support offerings, etc. Different players will try different mixes. But nobody will be able to avoid it anymore then other industries, at least not unless some other huge productivity shift (automation related perhaps) happens.

<comment><USER25> Inflation has been in the (low) single digits for about 20 years in most developed nations.

An iPhone cost $200 in 2008.

The combined rate of inflation in the US since 2008 is 17.2%. So an iPhone should cost less than $240 today, if inflation were the main driving factor.

The cheapest iPhone costs $450 now. The technological equivalent of that 2008 model costs almost 3x.

Inflation is not a driving factor. You could raise IT prices 5% YOY and nobody would bat an eyelid.

<comment><USER26> No, $200 was the "subsidized price" as part of an AT&T service plan: "AT&T, like most U.S. carriers, offers a variety of phones that we sell below our actual cost when customers agree to sign service agreements." [1]

The cheapest non-subsidized ("no commitment price") iPhone you could get back then was $499. At your 17% inflation rate, that's almost $600 in today's dollar, so Apple's entry level iPhone is actually a little cheaper than in 2008.

[1]: [https://www.att.com/Common/merger/files/pdf/iPhone/Pricing_U...](https://www.att.com/Common/merger/files/pdf/iPhone/Pricing_Upgrading_FAQs.pdf)

</comment></comment></comment><comment><USER27> > the 12-inch MacBook is still there in the line-up, price unchanged. It makes > no sense: it's an inferior machine at a higher price. But it will find a > market with those who know nothing about technology and simply want the > sleekest possible device.

Meh, what a load of BS. I know a lot about technology and prefer the 12-inch. Form factor matters, both to professionals like myself and to "people who know nothing about technology".

</comment><comment><USER28> Apple have created a mess by providing multiple options between Airs and Pros. If you upgrade the RAM to 16GB on Air it surpasses the base model of Pro and similarly other storage options. At that point you should rather buy a Pro over Air because the only major difference is size. Lot of this is totally confusing for non-technical folks and they might just end-up making a wrong purchase.

<comment><USER29> I completely agree. I've been using MacBook Air mid 2013 for the last 5 years and it's a great laptop. Now I'm considering buying a new one, and Airs just don't make sense for me anymore.

In Singapore the difference in price between cheapest Air and cheapest Pro is less than SG$100 (US$70). The only advantage of Air is longer battery life, but that's it.

I think at this point the Air series should be merged with MacBooks. Make it small (12"), give it one more USB-C port, upgrade processor, add TouchID and it's good to go.

<comment><USER25> _> The only advantage of Air is longer battery life_

And less weight.

(I was going to say "and less volume", but one end of the Air is actually thicker than the MBP, so overall volume might not be that different in the end - even though it does look smaller.)

<comment><USER29> I wanted to add this, but the difference is so small now (Air is 120gram / 0.27 pound lighter) that I don't think it is really any advantage

</comment></comment></comment></comment><comment><USER30> What the author is really discussing is Apple's PRICING strategy. This has nothing to do with ASP, which is an internal metric that I doubt external to Apple is privy to.

</comment><comment><USER31> still not sure why we have both a "macbook" and "macbook air". they seem to occupy the same market segment. i thought apple was all about minimizing choices.

<comment><USER32> They are a lot more similar than they were when the MacBook came out a few years ago. However, the MacBook is fanless (which also means much slower) and smaller/thinner/lighter than the Air.

Will the MacBook stay around? I suspect Apple is quite disillusioned with the performance that Intel offers in this TDP range, and the MacBook will either get dropped or go ARM.

<comment><USER27> The MB uses a 5W CPU, the Air uses a 7W CPU, still miles behind the performance of real laptop CPUs like those found in the Pro line.

If you need to decide between MB and MB Air, performance should't enter into it, it's almost the same.

</comment></comment></comment><comment><USER33> Is ASP rising faster than the cost of goods sold?

</comment><comment><USER34> To be honest I think this article is making a lot off nothing. TL;DR: New models, higher prices. Keep the old models just in case someone is super price sensitive. It's not rocket science is it.

<comment><USER35> The worst part is that for many of us, we'd be happier to pay the higher price but Apples giving us LESS. A worse keyboard, no magsafe, no USB-A, worse thermal management, less reliable, more expensive and difficult to maintain.. the list goes on. If the new machines weren't a big step backwards in some areas it would be a much easier pill to swallow.

</comment></comment><comment><USER36> Because it's smaller?

</comment><comment> java-man than

and the original title is different.

<comment><USER37> This. "Then" is also capitalized. I'm glad I'm not the only one who sees this.

</comment></comment><comment><USER38> They use helium to make it lighter (joke)

<comment><USER39> A reference to the article about helium breaking iPhones?</comment></comment>