Microsoft Makes Retail Versions Of Office Single Install - <AUTHOR> http://www.techdirt.com/articles/20130213/10093021963/microsoft-makes-retail-versions-office-single-install.shtml

<comment><USER2> I don't see what the fuzz is about for now.

a. One Copy per Device. You may install one copy of the software on one device. That device is the "licensed device."

b. Licensed Device. You may only use one copy of the software on the licensed device at a time.

c. Portable Device. You may install another copy of the software on a portable device for use by the single primary user of the licensed device.

from [http://www.theage.com.au/technology/technology-news/does- you...](http://www.theage.com.au/technology/technology-news/does-your-copy-of- office-2013-die-with-your-computer-20130208-2e3a1.html#ixzz2Kyfkv9DP)

The original australian article states two non-definitive answers:

A: "A perpetual license of Office 2013 can only be installed on one personal computer. This means that the customer can only install it on one device, either a desktop or laptop, but not both. If the customer has a system crash, they are allowed to reinstall Office on that same computer. If there are problems with this process, customers can contact Microsoft technical support"

B: "No, the customer cannot transfer the license from one PC to another PC."

I would bet on A and and a confused PR department. Of cause if you wan't to report some kind of "news" you would root for B rather than investigate further.

<comment><USER3> Just tell them it is the same computer, just with an upgraded CPU, RAM, mobo, case, screws, cables, ...

Or install office in a VM you can shuffle around at will forever. Perhaps even a Thinapp.

You could even keep your virtualized office on Dropbox and use it on all ten of your personal computers (but not concurrently of course).

<comment><USER4> I never really understood this line of thinking. Rather than trying to "hack" the license terms, you should just buy a new license when you buy a new computer, since that's what you agreed to.

If you're willing to violate the license, why not just pirate the thing in the first place?

<comment><USER5> It's things like this that drive those pirating numbers up!

VM's and the like may be fine for us tech/power users, but for most normal users who just pop the DVD in and install, then to be greeted with a "sorry, buy another copy" this is going to be very annoying!

<comment><USER6> Lots of products/services are annoying. I usually address the problem by simply not using them.

<comment><USER5> I agree, but some things you just cannot get away with NOT using. Too many people are used to using MS Office. As good (or bad) as the open source alternatives are, too many of my friends/relatives are used to the interface. It's a huge re-training exercise to get them to use something else unfortunately.

I still use Office 2007, because there is nothing in 2010 and doubt 2013 that I will use outside of a business environment.

<comment><USER6> So what? I fly commercial airlines even though they are terrible because sometimes I have no alternatives. I still pay for my ticket instead of sneaking on board.

Microsoft gets to extract a high price for Office because its popular and the product has a strong network effect. That's one of the advantages of having an immensely popular product. Either use it or don't--don't try to justify pirating it.

<comment><USER5> I didn't justify pirating it, I said it would drive numbers up, there's a difference.

And your comparison is flawed. When you buy an airline ticket you know you are buying a single use ticket. If you want a travel comparison then it is like buying a car and saying you can only use it in a single state.

 _Microsoft gets to extract a high price for Office because its popular and the product has a strong network effect. That's one of the advantages of having an immensely popular product._

Sure, a high price is one thing but charging people twice for different devices or charging again for changing your machine is going a little too far. The _price_ is not the issue, it's the pricing model.

 _Either use it or don't_

Like I said, it's not as black and white as that. With this pricing model I won't use Office 2013.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> Meanwhile, if you get it online, it's $99.00 a year for up to 5 devices, and moving the license from one machine to another is as simple as logging on and deregistering the invalid device.

Microsoft have been skeevy in the past when it comes to licences, but I've no complaints with the current system.

</comment><comment><USER8> "place their own customers directly in their crosshairs. Your immediate reaction may be to blast the previous sentence as hyperbole, but you would be wrong to do so."

Of course this is hyperbole. Don't be ridiculous.

<comment><USER9> Steve Ballmer literally aiming guns at customers in Microsoft store.

Story at 11.

<comment><USER10> As a Microsoft employee, I can confirm that this is true -- but only when he needs a break from "roaming the halls of Microsoft swinging a baseball bat".

</comment></comment></comment><comment><USER11> Microsoft is _the_ Office company right now. A great many people run windows _just to run Office_. This is not a boat I would rock quite so hard just now if I were them.

<comment><USER12> Office is more important to them now than Windows. I believe that they are pushing the subscription model hard so that people will pay monthly for Office as a cross platform solution.

I hope they succeed in making Office cross platform, but I hate the subscription model and hope they fail in making that the norm.

<comment><USER13> I, on the other hand, want them to succeed with the Office subscription model.

Nothing will doom them so fast than constant predictable revenue.

In fact, I think this will also help Office alternatives, as they could try a cheaper subscription. Nowadays any Office alternative has to be free, and this means almost no funds for development.

<comment><USER12> If Office alternatives can't charge a small one off fee, what makes you think they will be able to charge a subscription?

<comment><USER13> Different business models are evaluated in a different way.

A small one off fee is not a viable business model. You either have to charge small recurrently fees, or have a big one off fee to be able to sell to business.

AFAIK, Google Apps for Business already charges a subscription for some customers.

</comment></comment></comment></comment></comment><comment><USER14> LibreOffice: good as gold.

<http://www.libreoffice.org/>

<comment><USER15> Perhaps as good as gold but not nearly as good as Office 2000 was...

Seriously what is wrong with Libre/Open Office's slow ugly UI? I mean even GIMP finally managed to modernise its look and feel.

<comment><USER14> For every micro-second Libre/Open Office stays ugly or slow, I pass the time by thinking about how cripled/proprietary MS Office is, and time flies fast. YMMV.

<comment><USER12> Proprietary, yes. Crippled, no. Excel is vastly better than anything else out there, and if you want you can even save to open formats.

I hope open source catches up, I really do, but saying MS Office is crippled is plain false.

<comment><USER14> You're replying to a post in a thread about Microsoft limiting the number of installs per license. I don't know about your definition, but that qualifies as "crippling" in my book.

I choose to use Free software because I value my time and freedom. It's Libre/Open Office for me. You are free to choose whatever you want.

<comment><USER16> Enjoy your crippled - functionally - piece of software.

There, I said it. LibreOffice may be alright, but it's certainly not good. It looks like it came out of the 90s, and it, nor anyone else's, spreadsheet making will never even come close to Excel's.

</comment></comment></comment></comment></comment></comment><comment><USER17> My company is migrating away from office. We use google docs and Libre Office for internal documents and only few copies of office for the external.

With html and css, and the paperless office gaining traction Word and Powerpoint will have a hard time defending their existence, as is the majority of other apps. For me it seems that the only really good application that is worth the money right now in the suite is Excel.

<comment><USER12> > the paperless office gaining traction

Really? Is there any evidence of this? Most attempts I've seen at the paperless office have been failures.

Also, even in the attempts I have seen, nobody is writing reports in HTML + CSS. Everything is in Word/ppt/Excel, usually on SharePoint.

<comment><USER17> Not paperless but paper reduced, point taken. I know we are changing toner cartridges less often than a decade ago. So we are using less paper than before.

What I meant for the html + css is that anchoring your documents to the a4 sheet, while people are consuming more and more content on screens of various sizes and less on paper is somewhat strange. Also google docs are html + css and a lot of javascript :)

Office has great advantage and is not going anywhere soon. But while in 1999 it was impossible to not have office, now depending on your company and employees can go from mildly inconvenient to annoying.

5 years from now - will you worry that some content looks great on paper, or that it looks great on the person's tablet or google glass. If your answer is the second - word is in for a rough ride.

<comment><USER12> Depends on the industry. In the financial services industry it is still essentially impossible to not use Windows + Office. Everyone in the industry knows how to use them, no training required, and it ensures everything is interoperable.

Theres also not much of an incentive to change. Using open source software won't save that much money, and would require training almost every employee. If open source office software is ever going to break its way into big enterprise, its going to have to get widely used by consumers first.

</comment></comment></comment></comment><comment><USER18> Straw + Camel's back.

I tend to switch machines at least once a year for various reasons. My office license goes with me and is removed from the original machine. If they won't allow that, then I won't be upgrading and will be preemptively migrating to something else.

I don't think Microsoft realise how easy it is to just move to another platform/tool these days!

</comment><comment><USER19> Microsoft have done a fantastic piece of marketing for OpenOffice and LibreOffice here.

</comment><comment><USER20> Original article referenced: [http://www.theage.com.au/technology/technology- news/does-you...](http://www.theage.com.au/technology/technology-news/does- your-copy-of-office-2013-die-with-your-computer-20130208-2e3a1.html)

My question follows his:

 _Exactly how is this enforced? Is it just "forbidden" or are you actually blocked from using the retail activation code on a new computer? Is it tracked via your Microsoft cloud account? What if you change some of the hardware in your PC, will Office 2013 complain that it's a new computer?_

I'm very interested to see how Microsoft attempts to prevent spoofing. Does anyone with experience in this type of DRM have a comment on how a device with no real unique identifying property is tracked? As mentioned above, using the hardware configuration would have serious issues, and is certaintly not unique. A "cloud account" I can't imagine can tie itself to a device any easier (IP, obviously not, MAC address, not a good idea, etc.). How can MSoft allow re-installing it on a reformatted device, but not taking it to a new device?

<comment><USER18> They already do this with WGA/Activation. It's a combination of disk IDs, MAC address, graphics card etc.

</comment></comment><comment><USER21> Why didn't Techdirt just deactivate Office 2013 and install it on another PC? Uninstallation is a one-click Fixit at <http://support.microsoft.com/kb/2739501> Uninstall Microsoft Office 2013 or Office 365

<comment><USER18> That's only OK if your computer is still working.

<comment><USER21> Which it usually is. If not, I'd expect a phone call to solve the problem, at worst.

Either way, it's something Techdirt should have covered....

<comment><USER18> You've obviously not dealt with Microsoft support then?

I have had an activation issue open for 6 months before I got a resolution in the past and I had to go through my Gold Partner membership to get it resolved.

In that 6 month period, I used a cracked copy of Office.

</comment></comment></comment></comment><comment><USER22> Hmm, this article answers nothing for me since I would never run windows directly on hardware.

What determines if my virtual machine is one "system" across host systems, visible "hardware" changes and/or windows license keys?

</comment><comment><USER23> I have a hard enough time justifying upgrading Office. Versions n-1 are almost always "good enough" and I see no killer features that justify these new licensing restrictions that at a minimum double the cost for the same install base. I usually skip at least every other release. This has given me the justification to stay on Office 2010 indefinitely, particularly given the fact that I will probably rebuild at least 20% of our PCs in the next year, and we take full advantage of the second install on a portable device. Viva la Office 2010!

</comment><comment><USER24> The problem with Office is that it is too good.

Until free/open alternatives like libreOffice or googleDocs catch up MSFT has no incentive to hold down the bloat or demonstrate good customer service.</comment>


Wait Wait Tell Me: The Psychology of Loading Screens - <AUTHOR> https://99percentinvisible.org/episode/wait-wait-tell-me/ <comment><USER2> Video games have the best loading screens at the moment, because people often don't realize they're there. They slow the user down in a way that doesn't feel like a wait.

Elevators are a common mechanic, but I appreciate more creative ones like making the user open a heavy door (God of War), or climb up an obstacle.

<comment><USER3> Even the presence of a plain loading screen like in DOOM can be done well; there it provides a brief pause for the player to calm down again and it prompts for a spacebar so you can grab a drink or check your mail without issue. Plus it's fairly fast so in most cases you wait like 30 seconds.

</comment></comment><comment><USER4> Here's one personal irritation on this subject: Programs which appear to be fully loaded, but don't allow you to do anything for a while. I'm solely a Linux user now, but I recall that Windows would do this before I stopped using Windows entirely in the late 2000s. Firefox does this pretty bad now. I typically wait a few minutes after opening Firefox before doing anything. After roughly a minute Firefox has autocomplete in the URL bar, but no websites will load until I wait another minute or so.

<comment><USER5> > Firefox does this pretty bad now. I typically wait a few minutes after > opening Firefox before doing anything. After roughly a minute Firefox has > autocomplete in the URL bar, but no websites will load until I wait another > minute or so.

Wow! I have maybe a dozen extensions installed, but even on my work laptop (which is not very high spec), I can use Firefox easily within 10 seconds of opening it. Do you have tons of tabs open and have it set to reopen the previous session? I'm kind of shocked to hear that it could take this long

<comment> o-__-o Also the configuration matters. Core 2 Duo with 4gb RAM running Windows 10 will suffer a swapping fate that not even I would wish on my enemies

<comment><USER6> Its a self inflicted problem, nowadays you can get perfectly fine 5-7 year old computers for ~free at the recycling center.

<comment><USER7> Where is this recycling center?

<comment> o-__-o Go look at ewaste companies and find out how they discard computers. Those 200 lot computer sales on eBay come from these companies and they buy old hardware for pennies on the dollar. If you get them before they make it to eBay or other distribution channels you can usually get another 20-50% off (I got a sun fire v20 this way for $200 back in the day)

</comment></comment></comment></comment></comment></comment><comment><USER8> I am a regular 99PI listener and enjoyed this episode, but I was also a little disappointed that they never discussed Sim City's notorious "Reticulating Splines"[1] type loading messages that date back to the early 1990s.

[1] - [https://www.urbandictionary.com/define.php?term=reticulating...](https://www.urbandictionary.com/define.php?term=reticulating%20splines)

</comment><comment><USER9> This article made me aware of how few progress bars I am actually aware of nowadays. There are some, but they finish quite quickly. The slowest one would probably be when IntelliJ is indexing.

Reminds me of all the times when I had to put the cursor at the edge of the progress bar, just to see if it was actually moving or if an installer just got stuck :D

edit: express myself better :)

<comment><USER10> Tip for when you're putting your cursor at the end of a progress bar: Zoom in all the way so you can be sure of any perceived progress.

</comment></comment><comment><USER11> I saw data at a company where adding a fake loading screen to a tech product increased conversion rate 5x - it made the product seem fancier.

<comment><USER12> That's why TurboTax is 90% fancy loading bars breaking up work that takes milliseconds in total.

</comment></comment><comment><USER13> And then there are the ones that are back-loaded.

They zoom straight to 99% and then stay there.... Windows install programs, I'm looking at you.

</comment><comment><USER14> Great article. Can confirm it works. Shared this with our team. We are currently working with a slow loading service and added friendly text during loads. Drastically improved the user experience. It's subtle but provides a good win for our users.

</comment><comment><USER15> That users seem to prefer Buell's "operational transparency" is a good takeaway from this.

A lot of websites and web apps use some spinning animation to signal that something is going on. What exactly isn't clear to the user, and because these spinners have a tendency to keep spinning when something goes wrong, they can't be trusted. There's no sense of progress and really no sense of anything going on in the background either.

If you instead display _what_ you're loading, even if it looks like technobabble to the user, they will at least get a sense of something going on. Even just not hiding what's going on on the page while resources are loading seems preferable to me.</comment>


Progress Towards 100% HTTPS, June 2016 - <AUTHOR> https://letsencrypt.org//2016/06/22/https-progress-june-2016.html <comment><USER2> I keep hoping they will help address non-Internet TLS. For example if you run a HTPC, fridge, printer, device controller or anything similar on your LAN and want to talk to it over the same LAN using TLS. Getting a workable cert is currently not possible: for example the LAN names aren't going to be unique.

Plex did solve this in conjunction with a certificate authority, but that solution only works for them. The general approach could work for others if someone like letsencrypt led the effort. [https://blog.filippo.io/how-plex-is- doing-https-for-all-its-...](https://blog.filippo.io/how-plex-is-doing-https- for-all-its-users/)

<comment><USER3> For local traffic, why do you need a public certificate authority?

<comment><USER4> Because some devices and browsers have difficulty determining if they're talking to something on the local network or not. And they don't try to guess. So if your router requires you to connect via HTTPS, which is a good idea, have fun clicking past a nasty warning and then have nasty icons everywhere telling you that you're not secure.

And before you tell me to set up my own local authority and add it to the chain on every device ... common, really? Nobody wants to do that.

<comment><USER5> That's not a problem of browsers having a difficulty determining if they're talking to something on a local network or not, just because you're in a local network doesn't means you can't be victim of a MiTM.

</comment></comment></comment></comment><comment><USER6> Just at the entire world is going HTTPS, my faith in the system is seriously waning. When Symantec bought Blue Coat, it made me start to think about how fragile this is. How long before Symantec gets an NSL demanding an appliance that can mint bogus certs on the fly for dropbox.com, facebook.com, twitter.com, etc...?

How effective is something like certificate pinning against fraudulent certs?

<comment><USER7> > How long before Symantec gets an NSL demanding an appliance that can mint > bogus certs on the fly for dropbox.com, facebook.com, twitter.com, etc...?

If the bogus certs are not logged in Certificate Transparency, they will be rejected by Chrome: [https://security.googleblog.com/2015/10/sustaining- digital-c...](https://security.googleblog.com/2015/10/sustaining-digital- certificate-security.html)

If they are logged in Certificate Transparency, then the world will know, the offending certificates will be immediately blacklisted, and Symantec will be booted from root programs.

With the ongoing advancements in Certificate Transparency, your faith in the Internet PKI should be growing, not waning.

<comment><USER6> From the link you posted:

> However, we were still able to find several more questionable certificates > using only the Certificate Transparency logs and a few minutes of work. We > shared these results with other root store operators on October 6th, to > allow them to independently assess and verify our research.

So finding questionable certificates is trivially easy, but nobody ever bothers to look? What good is that?

<comment><USER7> "Nobody"? Google monitors for their domains. So does Facebook. I'll bet a lot of other high value sites are monitoring too but haven't said so publicly.

As for everyone else, give it some time. The ecosystem is still very young and we're still developing tooling.

<comment><USER6> I'm happy that Google and Facebook are discovering fraudulent certs. When they pop up, hopefully those companies aren't prevented from going public with the information.

Are there any end-user tools? When I open twitter.com, I would love for my browser (or my phone if I'm using an app) to tell me that the certificate fingerprint has changed unexpectedly since the last time I visited.

<comment><USER8> If you don't mind the risk of false positives (detecting changes that are legitimate), you can get that information from

[https://addons.mozilla.org/en- US/firefox/addon/certificate-p...](https://addons.mozilla.org/en- US/firefox/addon/certificate-patrol/)

</comment></comment></comment></comment></comment></comment><comment><USER9> I'm still bitter about this chain of trust model. The fact that I have to get some other party to tell my users that they can trust me just seems wrong. They trust me because of personal history, not because some banner says they should.

Browsers and OS vendors shipping CAs seems to be the root of the problem, in my mind. Those should be distributed by the service providers, who are the actual trustworthy entities in the user's minds.

<comment><USER10> And when we visit your site for the first time, having never heard of you before, why should we trust you?

That's the point. Having some authority who did at least some minimal checking, to extensive checking, and who will verify you really are who you purport to be. Trust but verify probably plays a part in this.

But, remember, you don't have to go to HTTPS. There is no requirement for you to do so.

<comment><USER9> Why should you trust me if you have never met me? If you like what I do, trust me, and please give me money. :)

Cert companies only do a phone call check for the very expensive EV certs. There is no minimal to extensive checking. That is a scam.

Web tech is all https now. I can't even browse a lot of https sites with some of my older devices. There is a requirement and I dislike it.

<comment><USER11> > _Why should you trust me if you have never met me? If you like what I do, > trust me, and please give me money._

What if a customer who trusts you returns to your site, but ends up on an impostor's site instead? He was no way to discern the difference.

<comment><USER9> I would argue strongly that such users do not have those abilities even with https. A valid cert is a valid cert. My supporting point would be the major browser vendors recent backpedal on throwing mixed-content errors, demonstrating that a smooth ride for the user is far more important than safety to them.

Actually I called shutterfly.com on the phone about that mixed content issue. I emailed them screenshots of the error from 6 different operating system and browser combinations, from 3 other users even. They claimed nothing was wrong. They were serving javascript via http on an https page and told me I was wrong and needed to update java, for weeks, on the phone, in chat, and in email, and declined to send the report to their webmaster. Even those wanting to be trusted are incapable of using these tools, from what I have seen. The whole thing is broken.

</comment></comment></comment></comment></comment><comment><USER12> _Let's Encrypt has issued more than 5 million certificates in total since we launched to the general public on December 3, 2015. Approximately 3.8 million of those are active, meaning unexpired and unrevoked. Our active certificates cover more than 7 million unique domains._

How can you cover 7 million unique domains if you've only issued 5 million certificates?

<comment><USER13> One certificate can be for more than one domain.

<comment><USER14> For example, a single cert can serve www.example.com as well as example.com

<comment><USER15> That is true, but in this case I think Let's Encrypt and also parent to your comment mean different domains as in e.g. one certificate to cover all three of example.com, example.net and example.org.

<comment><USER9> The same mechanism in cert generation provides that functionality. Hostnames are hostnames. SAN certs just take a list of them.

</comment></comment></comment></comment></comment><comment><USER16> This is great, I use LetsEncrypt for my company. _however_ , the graph is a little misleading. Lets look closer:

LetsEncrypt is almost built upon the idea of frequently (and automatically) re-issuing your certificate(s). The graph's line shows what appears to be an accumulated sum of certificates issued by day.

If every 90 days most certificate(s) expire, of course the graph will look like that!

Whats most interesting to me is the steps up in the graph. It appears that the steps in the graph _roughly_ occur on 70-90 day intervals.

Impressive growth for a great mission/service, but I wanted to point out the mechanics behind the graph. Hopefully others can offer some alternative perspectives!

 _edit_ : Grammar, illogical sentence structure.

</comment><comment><USER17> Is it still problematic to issue lots of certs for lots of subdomains? I mean, still no wildcard certs and crazy rate limits, that disallow issuing 1000s of certs per day for user-generated subdomains?

<comment><USER18> If you're generating that many subdomains (and you control the subdomains), it's probably worth investing in a traditional wildcard cert.

Though, it would be nice if the likes of dyndns names were given exception, since they are effectively second level tld's.

<comment><USER19> LE uses the Public Suffix List to decide what's a "domain". Their really-low rate limits have caused a flood of applications which are overwhelming the PSL's maintainers.

[https://community.letsencrypt.org/t/dyndns-no-ip-managed- dns...](https://community.letsencrypt.org/t/dyndns-no-ip-managed-dns- support/883/16)

</comment></comment></comment><comment><USER20> My understanding is for intranet, you could use Let's Encrypt. For example, if I own _.foo.com, and i want my intranet to be_.internal.foo.com I need to make *.internal.foo.com in the DNS in order to verify I own .internal.foo.com, correct? But then doesn't that expose my 'internal' network? Hope there is a different way to solve this problem.

<comment><USER21> You don't need to "open up" your internal network (the ownership validation can happen via DNS), but the hostname would be public through Certificate Transparency.

Generally, if you're relying on your internal hostnames being secret (which is a terrible idea anyway), you should consider using an internal CA, because there's a good chance _all_ public CAs will start logging every single certificate they issue to public logs, and that would include all the domains the certificate is valid for¹. Better yet, don't treat your hostnames as secrets.

¹ I _think_ there has been some discussions about allowing CAs to censor DNS labels after the TLD+1 level for Certificate Transparency. Not sure if that's going to happen, I'm not a fan. This would still require that your CA supports this mechanism, something I don't think Let's Encrypt would do.

</comment></comment><comment><USER22> This is extremely exciting. I've been supporting these folks since the beta. It's great for offering free SSL to clients.

</comment><comment><USER23> Am I the only person that is wary of 100% https ?

Remember, once you encrypt a web resource in SSL, you add a ton of baggage on top of any methods that might be used to access it.

I like a world in which I can 'nc' a web resource and manipulate it with unix primitives _without_ a truckload of software dependencies.

If sensitive information is involved, then certainly - use SSL. I understand that we must give up conveniences for that functionality.

But there are a _lot_ of web resources that have existed, do exist, and potentially exist that are completely benign ... I think we're shackling ourselves by chasing after this perfection.

Or, put another way, we're chaining ourselves to a world where web resources are only accessed by web browsers, and only by those web browsers that are _chaining themselves_ to a fairly dubious security scheme...

<comment><USER24> Just as you can use "nc" for an HTTP resource, you can use "openssl s_client" or "ncat --ssl" (from the nmap project) or "socat" to manipulate an HTTPS resource using the same unix primitives. Which truckload of dependencies does this require? The Debian package for OpenSSL only depends on libc.

I do fully agree that the web is getting more tied to browsers, and to me that's worrying, but TLS is mostly a transparent tunnel over which you can use the same protocols; it's not part of that trend, in my opinion.

</comment></comment><comment><USER25> Is there any alternative to ssl and tls out there? Sshttp anyone?

<comment><USER26> Tor Onions are technically an alternative. You access the hash of the public key? and you are only able to put up that URI if you have control over the private key. I guess something similar based on hashing and public key cryptography might be possible outside of Tor but it's not exactly user friendly to begin with.

</comment></comment><comment><USER27> Blackberry 10 browser refuses to recognize Lets Encrypt certs :(

</comment><comment><USER28> Is there any work being done on being able to easily switch out standards?

That way when https is found to lack some feature, we can easily upgrade to httpz almost immediately?

<comment><USER29> This will likely never be the case due to how HTTPS actually works. As someone else stated, HTTPs is HTTP + TLS.

The "s" in HTTPS is for "secure", and TLS provides that security.

TLS is a evolving standard which is updated over time to add new features when necessary. When HTTPS is negotiated, it can seamlessly choose which version of TLS to use, based off what the client and server want to use.

So, HTTPS will never die due to lack of features. A new version of TLS will just be approved and deployed, and newer devices can use that while older devices can get by on an older version of TLS.

TLS is the successor to SSL. They are backwards compatible, so devices that support TLS also support SSL. The full version history, from newest to oldest, is: TLS 1.2, TLS 1.1, TLS 1.0, SSL 3, SSL 2. In reality, very few servers still use SSL 3 or SSL 2, due to known weaknesses, but colloquially, all the versions are just called "SSL".

TLS 1.3 is underway and will shortly be ready for primetime. Firefox and Cloudflare have already written some implementations based on the draft spec (sorta how routers will implemented the newest 802.11 standards before they are 100% official).

<comment><USER30> Plus, even if we did decide to fully replace TLS, nothing would necessarily need to happen with certificates. We call them "SSL certificates", but the certificate standard - X.509 - actually predates SSLv1 by several years. A TLS alternative/replacement could adopt the X.509 standard as its certificate format and automatically work with the existing CA system.

</comment></comment></comment><comment><USER31> I see this as security theater. Most web pages don't need to be encrypted. Anything with a form should be, but if you're just viewing static content, there's little point. Yes, it obscures what content you're viewing, slightly. An observer often could figure that out from the file length.

Encrypting everything increases the demand for low-rent SSL certs. Anything below OV (Organization Validated) is junk, and if money is involved, an EV (Extended Validation) cert should be used. Trying to encrypt everything leads to messes such as Cloudflare's MITM certs which name hundreds of unrelated domains. This is a step backwards.

<comment><USER32> > Most web pages don't need to be encrypted. Anything with a form should be, > but if you're just viewing static content, there's little point.

Some really cool HTML and JS functionality will only work over HTTPS.

> Yes, it obscures what content you're viewing, slightly. An observer often > could figure that out from the file length.

If you have an attacker than can identify content solely from its length, you have bigger problems than an SSL cert can solve.

> Trying to encrypt everything leads to messes such as Cloudflare's MITM certs > which name hundreds of unrelated domains. This is a step backwards.

I do not see the problem. All those domain owners consciously choose to have Cloudflare host their stuff. The cert might be a few KB bigger, but who cares?

<comment><USER31> _> Most web pages don't need to be encrypted. Anything with a form should be, but if you're just viewing static content, there's little point._

 _Some really cool HTML and JS functionality will only work over HTTPS._

What "really cool" HTML feature requires HTTPS? There can be problems with mixed secure/insecure content, but that's more of an offsite content issue.

 _> Yes, it obscures what content you're viewing, slightly. An observer often could figure that out from the file length._

 _If you have an attacker than can identify content solely from its length, you have bigger problems than an SSL cert can solve._

An eavesdropper knows the IP address and the length of the content, even if it's encrypted.

 _> Trying to encrypt everything leads to messes such as Cloudflare's MITM certs which name hundreds of unrelated domains. This is a step backwards._

 _I do not see the problem. All those domain owners consciously choose to have Cloudflare host their stuff. The cert might be a few KB bigger, but who cares?_

When sites share an SSL cert, and you can break into one of the sharing sites, there's a way to impersonate others. Cloudflare customers for their lower tiers of "security" often don't realize this. The customer doesn't pick which sites share certs; that's up to Cloudflare.[1]

[1] [http://john-nagle.github.io/certscan/whoamitalkingto04.pdf](http://john- nagle.github.io/certscan/whoamitalkingto04.pdf)

<comment><USER21> > What "really cool" HTML feature requires HTTPS? There can be problems with > mixed secure/insecure content, but that's more of an offsite content issue.

One example would be the the Geolocation API, with more to come[1]. Another example (specifically for HTML) would be Mozilla showing a user-visible warning when it encounters a type="password" field in a form served via HTTP (or with a HTTP target - I'm not certain). This is currently only enabled in the Developer Edition, but will eventually land in stable.

> When sites share an SSL cert, and you can break into one of the sharing > sites, there's a way to impersonate others. Cloudflare customers for their > lower tiers of "security" often don't realize this. The customer doesn't > pick which sites share certs; that's up to Cloudflare.

This is a non-issue for services such as CloudFlare. Site owners do not have access to the private key, only CloudFlare does. Breaking into one of the other sites won't give you access to the private key, only breaking into CloudFlare would, and such a vulnerability would have nothing to do with the fact that you're sharing a SAN certificate with other sites. I'm not aware of any other cross-site vulnerabilities that stem from shared certificates in an environment where every site on that certificate is served by the same frontend.

[1]: [https://www.chromium.org/Home/chromium- security/deprecating-...](https://www.chromium.org/Home/chromium- security/deprecating-powerful-features-on-insecure-origins)

<comment><USER23> "One example would be the the Geolocation API, with more to come[1]."

Ugh. Why would they do that ?

I can understand that geolocation could be _tremendously sensitive_ and you absolutely would want to offer the option of SSL ... but why limit it to SSL ?

geolocation is _also_ something that you'd want to hack into and build into things ... and maybe even things with limited processing power and memory.

Wouldn't it be nice to have the option to interact with a geolocation API (over http) with stdio and not include a giant truckload of dependencies and libraries and megabytes of packages ?

<comment><USER21> > I can understand that geolocation could be tremendously sensitive and you > absolutely would want to offer the option of SSL ... but why limit it to SSL > ?

I think you answered your own question. ;-)

> geolocation is also something that you'd want to hack into and build into > things ... and maybe even things with limited processing power and memory.

Presumably, once your device is capable of running a modern browser such as Chrome or Firefox (which is what we're talking about here), TLS is a drop in the bucket in terms of resource usage. Or were you talking about the server?</comment></comment></comment></comment></comment></comment>


1980: "Telefuture" - Everything Old is New Again - <AUTHOR> https://www.youtube.com/watch?v=aJbD00z68JI#! <comment><USER2> Does anyone know what Homecoming Week is?</comment>


Show HN: Top 2017 Websites – With Daily Updates - <AUTHOR> https://statvoo.com/top/sites <comment><AUTHOR> The list is automatically updated daily. If you notice any site that obviously should be there, then it's probably because it hasn't been categorised correctly, this can easily be changed by simply suggesting an alternative category!</comment>


Dairy Farms Fall Victim to the Productivity Revolution - <AUTHOR> https://www.bloomberg.com/opinion/articles/2019-06-05/dairy-farms-fall-victim-to-the-productivity-revolution <comment><USER2> I would imagine it's more due to subsidies.</comment>


Crawling the Android Marketplace; Data and Stats Available - <AUTHOR> http://bionicspirit.com/blog/2011/12/15/crawling-the-android-marketplace-155200-apps.html

<comment><USER2> Thanks for sharing that! Check this out:

      1      1457
      2      2820
      3      4577
      4      3309
      5      1115
      6       186
      7        19

This table breaks down the paid app developers by total gross. The left column is number of digits in total gross, so 7 means the developer made millions, and 3 means the developer made hundreds.

The right column is number of paid developers in the bucket.

The biggest group is 3, those who made $100 to $999.

Is this analysis valid? Or is this there a missing factor, like old apps not showing up in the store?

</comment><comment><USER3> Interesting stats, and thanks for sharing! Now, what conclusions can we take from them?

One that stands out is that people are willing to pay for Arcade/Action and Personalization apps beyond what the download distribution would suggest.

I'm interested in knowing what the Pareto distribution is, are there apps that are skewing categories? (eg: a very popular personalization app?).

Also, knowing that paid apps are less than 1% (0.7%?) of all downloads is interesting.

<comment><AUTHOR> I'm working on gathering more stats; if you'd like you can help out by taking the data available [1] and play with it, as unfortunately these days I'm really busy and this article has already shaved several hours of work ... maybe over the weekend I'll publish more findings.

[https://github.com/bionicspirit/AndroidMarketCrawler/blob/ma...](https://github.com/bionicspirit/AndroidMarketCrawler/blob/master/marketplace- database.json_lines.bz2)

<comment><USER3> Thanks! I'm pretty busy myself, but I might take a look over the weekend :)

</comment></comment></comment><comment><USER4> You should put this up for free on the Infochimps, dataset marketplace!

infochimps.com</comment>


TSMC Nanke 14 Factory Production Interruption Could Affect NVIDIA and Others - <AUTHOR> https://www.hardocp.com/news/2019/01/28/tsmc_nanke_14_factory_production_interruption_could_affect_nvidia_others <comment><USER2> Let me tell you a story about sulfuric acid. When I was working process integration at a fab, I had a long series of meetings about qualifying a new source of sulfuric acid. Not a new supplier even, nothing that risky. Just a new source, meaning the iso (tanker truck) full of sulfuric comes from a different plant owned by the same chemical company.

What it comes down to is that it's basically impossible from a process integration perspective. Sure, you can take assays, and you do. But what about the things you aren't looking for in your assays? All you can do is plug it in, cross your fingers, and look at the yield trends. Not only does sulfuric mix in the supply lines, it gets used throughout the entire process. So if you do have some kind of strange contaminant that you didn't test for, maybe it only actually hurts you pre-gate. And the damage ramps up slowly and unevenly. But if your yield tanks, then you have to scramble to figure out what happened, and sulfuric isn't even your first suspect. (Because there are thousands of things like this that can tank your yields.)

What's worse, you're literally over a barrel. Sometimes Plant A has to shut down and can't send you another iso. Do you take an iso from (unqualified) Plant B? Do you crack open a barrel of sulfuric? You have a stock of qualified sulfuric in barrels, for situations like this, but in practice barrels are worse than isos. Metal everywhere.

I'm not saying it's sulfuric in this case. Lots of chemicals have a story like this one, but it would also not surprise me one little bit.

<comment><USER3> Wouldn't using multiple Spectrometry/Spectroscopy methods help in finding out the impurities in the process chemicals?

ICP-MS and NMR should cover most elemental impurities.

<comment> Const-me I don't have any experience working in that industry.

But based on what I know, modern ICs require exceptional levels of purity of the materials. A single atom can ruin a transistor, and therefore the complete chip.

AFAIK the methods you mentioned aren't sensitive enough to detect individual atoms in barrels of stuff. E.g. ICP-MS detects 1E-15 concentrations, but in absolute numbers, 1E15 molecules is only 1.66e-9 mole, e.g. for iron (55.8g/mole), it translates to 1E+10 defects per kg of stuff. Way too many.

<comment><USER4> Wouldn't you be able to run the test multiple times and increase your sensitivity to an arbitrary level? Too expensive?

<comment><USER5> Studied a fair bit of chemistry, but not a pro, so this is only a rough outline.

A lot of chemical test equipment use semiconductor sensors of some kind - optical or otherwise - and most likely the sensitivity limit is simply the noise floor of the sensors. In good instruments they tend use good, or amazing detectors but they are still operating at the noise floor, or sometimes even below.

So running tests again doesn't really help sensitivity, for that you would most likely have to use some chemical process that amplifies the effect of the contaminants you are looking for. Hence the problem of having to know what to lool for in validating new chemicals, if you need ultra pure chemicals.

</comment></comment></comment></comment></comment><comment><USER6> Every once in awhile, one hears about some accident like this one at a single, physical factory, followed by a laundry list of tech companies that are adversely effected. It powerfully demonstrates how awfully centralized microchip production is; individual plants can account for substantial fractions (or even majorities) of entire product categories, which means that individual incidents can have outsized effects. I don't know if that sort of risk has been fully internalized by the tech sector.

For that matter, how specialized is the market for whichever high-purity chemicals were behind this incident? What portion of the semiconductor industry was purchasing from the same supplier? We may not have heard the last of this.

<comment><USER7> You mean like AWS being down?

<comment><USER8> Or a bad BGP route being broadcasted, whether intentionally or not:

[https://bgpmon.net/bgp-leak-causing-internet-outages-in- japa...](https://bgpmon.net/bgp-leak-causing-internet-outages-in-japan-and- beyond/)

</comment></comment></comment><comment><USER9> I love how Moore's law is a complete marketing gimmick at this point:

\- Intel not only hasn't released 10nm chips yet, they even stopped publicizing transistor count of their 14nm, the node from five years ago.

\- Not to mention their i7 chips node over node being marginal improvements for the past 10 years or so.

\- And all of a sudden, Intel's competitors seem to be right on track with 7nm, with the Moore's law giant itself, and with most resources, is struggling at 10nm.

</comment><comment><USER10> Do TSMC or their customers have insurance for this sort of thing? It would seem prudent given the stakes.

</comment><comment><USER11> Should we expect an increased cost as consumers? I remember when Hynix foundry had a fire, ram prices went up a lot

<comment><USER12> I believe so, yes. Supply and Demand.

</comment></comment><comment><AUTHOR> This does not bode well as well for Nvidia who already had a hard Q4 2018. They expecs to report $2.2 billion in fourth quarter revenue versus the previous guidance of $2.7 billion.

<comment><USER13> I know it's wrong of me, but I can't help but be a bit relieved with the recent bad news for Nvidia. This time last year (and the year before that) it was looking like they were about to have a total monopoly on the GPU market. This will give AMD time to catch up a bit and Intel a good market to release their own GPUs.

With Intel's CPU dominance being withered by AMD and ARM solutions, and Nvidia's own dominance being thrown into question, the hardware industry is getting more interesting all the time.

<comment><USER14> I like seeing underdogs create something better, but a failure like this just holds everything back.

Prices will be higher, and the need to compete on quality/performance will be lower.

</comment></comment></comment><comment> gjsman-1000 Oh, that is absolutely disastrous if true. With their tight margins... oof. What can I say? That is ridiculously bad.

<comment><USER15> Their margins aren't as tight as you might expect. Their last quarter report[1] puts their gross margin at nearly 48% and their operating margin at 37%. That is pretty healthy and suggests they can easily withstand this sort of event.

[1] [https://www.tsmc.com/english/investorRelations/quarterly_res...](https://www.tsmc.com/english/investorRelations/quarterly_results.htm)

</comment></comment><comment><USER16> Primo Levi "the periodic table" has a couple of chemist stories from his post WWII experiences, which go to this problem. unknown adulterants, effects on process chemistry, the wierd moments in "DONT CHANGE IT" culture. Older times, but similer problem? And, beautifully written.

</comment><comment><USER17> What are "wafers"?

<comment><USER18> After a Silicon Crystal with 99.99999999+% purity is grown, they are sliced into large pieces called "Wafers". Transistors are then built on top of the crystal structure. All together, these transistors create chips. Somewhere between 75 to 7500 chips are made per wafer, depending on the size of the design.

Yes, 10+ 9 purity. And the impurities in those crystals were put in there on purpose (to make N-type or P-type Silicon). I never personally understood the chemistry or physics behind the process, but its always cool thinking about how exceptionally pure this whole process is.

In any case, if a run of wafers is bad, that can easily be hundreds-of- thousands of dollars worth of chips per wafer. For whatever reason, it seems like these wafers did not have the 99.99999999% purity needed to successfully make chips, so everyone's chips are ruined. Whatever the issue is, you can rest assured that a ton of business folk are going to be pissed.

<comment><USER19> > This accident stems from the fact that imported chemical materials do not > meet the requirements, resulting in flaws in the wafers produced.

It's possible one of the washes or doping agents was contaminated, rather than the wafers themselves.

</comment></comment></comment><comment><USER20> Oof, I hope they can absorb the cost :-/

<comment><USER21> Since it sounds like they didn't catch it until near the end, it's probably north of $65k/wafer. Probably single digit billions would be an accurate guess for the total loss to TSMC.

<comment><USER22> Worth mentioning that this is TSMC's fuckup, not Nvidia or the other companies using their fab.

This is so incredible it makes me wonder if we're looking at industrial sabotage. I can't believe TSMC wouldn't have safeguards in place to prevent contamination under normal circumstances, much less at this scale.

<comment><USER23> Who benefits from this, though? The first one that comes to mind is Intel... Although I am not suggesting that they did it. It's just a hypothetical question.

<comment><USER24> Anyone that doesn't use the Nanke 14 factory specifically (or uses the factory only for some of their products).

<comment><USER25> Or perhaps even a vendor that had contracted more capacity(in Nanke 14) than the present market demands, could benefit from a delay in production.

</comment></comment></comment></comment></comment></comment><comment><USER26> This could be good for AMD.

<comment><USER27> I thought AMD was using TSMC now?

<comment><USER28> This is about TSMC's "16/12nm process".

AMD is using TSMC's 7nm process and Global Foundries' 12/14nm processes: [https://www.extremetech.com/computing/276169-amd-moves- all-7...](https://www.extremetech.com/computing/276169-amd-moves-all-7nm-cpu- gpu-production-to-tsmc)</comment></comment></comment>


The Big Scoop - <AUTHOR> https://www.theguardian.com/food/2019/jul/09/the-big-scoop-what-a-day-with-an-ice-cream-man-taught-me-about-modern-britain <comment><USER2> In Glasgow around the 1980's there was a series of gang battles, the fights were over the control of Ice cream vans and their distribution areas. It was known as the Ice Cream wars, it nearly killed off the Ice Cream van (there's still a few about in summer).

[https://en.m.wikipedia.org/wiki/Glasgow_Ice_Cream_Wars?wprov...](https://en.m.wikipedia.org/wiki/Glasgow_Ice_Cream_Wars?wprov=sfla1)

<comment><USER3> That's incredible. There's a movie or computer game there.

<comment><USER4> Bill Forsyth's 1984 movie 'Comfort and Joy' is a comedy very loosely based on the Ice Cream Wars:

[https://en.wikipedia.org/wiki/Comfort_and_Joy_(1984_film)](https://en.wikipedia.org/wiki/Comfort_and_Joy_\(1984_film\))

NB I'd recommend his earlier movie "That Sinking Feeling" \- at least if you like Glaswegian crime-based comedies...

</comment></comment></comment><comment><USER5> > "Since Brexit, people have less money, and less confidence in spending > money. They haven't got the money in their pockets they had a few years > ago." (Eastbourne voted to leave the EU.)

England in a nutshell.

<comment><USER6> Most likely it's just complaining of old grumpy ice cream man in dying trade, I don't think there is any significant impact of Brexit in that area yet.

</comment></comment><comment><USER7> _Although Roach's products are keenly priced – £2 for a small cone with flake, up to £3 for a large_

Our local ice cream van is ridiculously cheap: 50p for a kid's cone, £1 for a normal ice cream. But the local rumours are that he makes his real money with "side ventures" from the same van (if you've played GTA Vice City you'll get the idea).

<comment><USER8> Is that a common rumour for ice cream vans? I remember growing up there were the same things said about our local one.

<comment><USER9> It can be more than just a rumour:

[https://en.wikipedia.org/wiki/Glasgow_Ice_Cream_Wars](https://en.wikipedia.org/wiki/Glasgow_Ice_Cream_Wars)

</comment></comment></comment><comment><USER10> ice cream vans (and hand car washes) carry modern slavery risks in the UK - this company still have an ice cream van parked every day next to the park near my house: [https://thebristolcable.org/2019/05/ice-cream-boss- lopresti-...](https://thebristolcable.org/2019/05/ice-cream-boss-lopresti-is- slavery-risk-and-banned-from-business-following-cable-expose/)

Personally, I dislike them as they specifically target play parks, school gates and areas where children gather frequently, and often they leave their diesel motor running constantly next to these areas. I understand that they carry a sense of warm nostalgia for some (particularly the generation prior to my own, who grew up when ice cream vans were popular), but I see no sense in them myself.

<comment><USER11> >> I see no sense in them myself

Cool. Don't use them.

>> often they leave their diesel motor running

Seems a genuine concern. I suggest you voice your concerns to the operator whenever it happens. Escalate to authorities if it becomes a serious problem.

>> ice cream vans (and hand car washes) carry modern slavery risks in the UK

Not cool. Please don't denigrate an entire class of something you dislike using FUD. Even if it's true occasionally, it's certainly not true in general.

<comment><USER10> I didn't say all ice cream vans or hand car washes are run by slaves.

I said that they carry modern slavery risks in our country at the moment. There is plenty of data to support the claim that hand car wash businesses carry this risk; there was recently an initiative to help identify known problem businesses with an app: [https://www.bbc.co.uk/news/uk- england-47829016](https://www.bbc.co.uk/news/uk-england-47829016)

I recently found out that the ice cream van near us that I have used before is part of a network of vans all around my city that has been linked to modern slavery. It's not an isolated incident in my part of the country.

I don't think my statement in regard to the modern slavery risks denigrated the ice cream van industry. If I said 'don't use ice cream vans because they are all run by slave masters' then I would have been tarring the whole industry with the same brush. But I didn't say that.

<comment><USER12> What does it mean to "Carry modern slavery risks"? Do you mean "they employ slaves, e.g. the owner took their passports and controls them like slaves?"

<comment><USER13> > What does it mean to "Carry modern slavery risks"? Do you mean "they employ > slaves, e.g. the owner took their passports and controls them like slaves?"

Human trafficking is a real thing. Coffeedoughnuts provided a link with a news story about an app that has been used to report businesses suspected of engaging in that industry.

<comment><USER11> Having the means to be reported and actually doing the crime are not causally related.

My proximity to your smoke machine does not prove that I am on fire.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> >> At the Kingsmere estate, we sell three ice-creams and a slush puppy to 51-year-old reiki master Russell Dobson. "When they hear the noise," Dobson says, gesturing to his son, "you tell them: 'There's none left.'" "You can't do that!" Roach exclaims. "That's what everyone tells them," Dobson says. "Did you not know that?" (Later, at a playground, a girl of about five or six runs up to the van and asks if we've sold out. When Roach shakes his head, she looks confused, then enraged.)

I'd call that a man-in-the-middle attack. Is that too much abuse of terminology?

</comment><comment><USER14> Ice cream vans are one of the many small business ideas that make me say "how on earth is that viable" and simultaneously "you're charging WHAT?!"

<comment><USER15> > "how on earth is that viable"

Visit a London park on a hot day and the queue for ice cream vans is amazing. Even though people could probably walk for <5 minutes and get something from a shop cheaper.

> "you're charging WHAT?!"

Yeah, last time I looked at one (couple of weeks ago), it was getting on for a 50% premium over the local corner shop (<5 minutes from the van!) which is _already_ a 50% premium over a supermarket.

<comment><USER16> Soft serve ice cream is decidedly different to the regular ice cream you are likely to find in a shop.</comment></comment></comment>


We are not mostly empty space - <AUTHOR> https://medium.com/starts-with-a-bang/you-are-not-mostly-empty-space-b836ca510313 <comment><USER2> Empty space, by definition, is space that can be filled by something. So how closely can atoms pack together? A neutron star has a density of 10^17 kg/m^3, whereas the typical human being is about 10^3 kg/m^3. I could fit the matter of trillions more human beings in the same space I'm taking up now. So yeah, I think there's some empty space in me.

<comment><USER3> So the author is saying fields are already filling things up, right? To compare this to the "we can pack them atoms tighter" model seems to be confusing the author's model with another, separate mental model, one in which we can fill up more. But the author's model says we're full. Full of this field stuff. Not so? IANAS

<comment><USER4> Yeah, they're probability distributions, not fields. So electrons, protons and neutrons are still tiny, even though their positions are uncertain. And so atoms are still mostly empty space.

<comment><USER5> Rather than thinking of space as empty vs non-empty, it might be better to think of space as a relationship between things.

I think you make less commitments of space this way.

<comment><USER6> That's also the difference between raster and vector modeling of virtual geometry. There is an area on a graph where one literally takes less space on a computer's memory than the other, for representing essentially the same information.

But there are other trade-offs.

<comment><USER5> Thought you might find this interesting.

[https://www.quantamagazine.org/coder-physicists-are- simulati...](https://www.quantamagazine.org/coder-physicists-are-simulating- the-universe-to-unlock-its-secrets-20180612/)

</comment></comment></comment></comment></comment></comment><comment><USER7> Is it just me who found the technical description and analogy here lacking?

There's nothing that suggests electrons are a cloud. Yes, a "cloud" defines the probability where they can be found, but electron doesn't occupy the cloud.

Electron is always a point, no matter what wave function it has. Therefore, from this perspective space is all empty.

If you invoke path integrals and infinitely many things bubbling in and out of existence, space suddenly fills up. But the author doesn't even mention that.

If you want to understand this stuff, read up Feynman's descriptions & lectures on QED.

Downvote for this article (sorry).

<comment><USER8> Some think that electron is a string!

<comment><USER7> Let's argue about that when there's a modicum of evidence :)

</comment></comment></comment><comment><USER9> Language is ambiguous and we are debating between two meanings of empty - nothing there or nothing there, but can be replaced with something else. And we have the added distraction of what nothing means - no physical, permanent "particles" or the abstract empty space.. We can go down the rabbit hole of parsing semantic meanings.

</comment><comment><USER10> How often do objects interact with our bodies when passing through us? Neutrinos, very rarely. The atoms of an aluminum bat, very commonly. Light? It depends.

Something being "empty" or "full" all depends on spatial and energetic scale.

<comment><USER11> Yeah, the fact that neutrinos pass through us largely validates the notion that we are in fact mostly empty space.

<comment><USER12> But visible light can't get through us at all. Does that prove that we _aren 't_ empty space? The whole point is that this criterion is incredibly ambiguous.

<comment><USER13> > But visible light can't get through us at all.

visible light definitely gets through me when I put my hand in front of a bright light source

</comment></comment></comment></comment><comment><USER14> All the article says is that "empty" isn't enough information.

If "empty" means "I can put electrons in there", then it takes more binding energy to pack more electrons into the same space. If you want to pack more electrons in, you have to squeeze harder.

Example: you _can_ confine an electron to a tiny part of an atom (electrons in inner shells of heavy atoms, for example) but those electrons are very tightly bound (held in by very high ionization energies).

Or the "emptiness" of an atom could be measured using neutral particles, which don't interact with the electrons at all and sail right through as if the electrons were empty space.

For what it's worth this is normal sophomore physics. There's no way to just dismiss it. But there's also no way to claim it's less than a hundred years old.

</comment><comment><USER15> > For non-quantum objects, this isn't a problem, as different methods of > measuring an object all give you the same answer. Whether you use a > measuring stick (like a ruler), high-definition imaging, or a physics- > reliant technique like Brownian motion or gravitational settling, you'll > arrive at identical solutions.

Right off the top, it's made clear this author doesn't know what he or she is talking about. From at least the time of de Moivre, around 1740, the problem of estimating an accurate true value from multiple differing measurements was recognized in its own right as a problem. By 1810, Gauss and Laplace had discovered the basics of statistical estimation, the form of the normal distribution, results including the central limit theorem, and regression techniques such as non-linear weighted least squares. Now, almost 200 years later, the problem still exists, and is being worked on in various forms and circumstances.

To give a simple example, take 1000 frames of well-exposed video of a still scene, with constant illumination, and constant exposure settings on the camera. Now try to estimate how many photons, within a constant multiplicative factor, are coming from each point in the scene. Most of the measurements will show a normal distribution, but at the extremes of exposure, something more complex is going on (perhaps to do with sensor non-linearity, censored sampling, or something else). This is one of the basic theoretical problems in HDR imaging, and is an active area research (i.e. unsolved, as of today).

It's very hard to get past that paragraph -- which is the first one in answer to the question "why?".

</comment><comment><USER16> So, in an atom, how much volume does the electron cloud occupy? It's more than the volume an electron occupies, but, in the upper end, does it occupy all the space from the electron to the nucleus? (And also because it is rotating, that space then occupies all the area surrounding the nucleus as well?)

</comment><comment><USER17> This has the sound of _grooviness_ to it.

One on hand, electrons as point particles sure sounds empty enough. On the other hand, the fields fill everything.

But on the gripping hand, you could set the volume of the electron to something ludicrously large, like the volume of a proton, then use the charge distribution of whatever "orbital" to trade that charge for an equivalent amount of proton-volume, as sort of a percentage filled of unit volume ... integrate, and you could get a sense of the density.

That, I think, is about as fair as you could ask for when dealing with point particles that are still smeared around.

</comment><comment><USER18> Excellent explanation. My question after this is, at a macro level,how much of space is actual pure space. Pardon the childish question but how exactly would one measure space (nothing exists at this point) without introducing something that might be displaced by the measurement,or how can one be sure space isn't made up of lower energy qanta that are displaced by higher energy particles,much like how solids displace gases and liquids?

<comment><USER19> Yeah, agree with this and disagree with other comments, thought this was a very effective communication of a better thought-model for understanding- still in largely colloquial terms- what is going on.

To the point about "pure space"\- I suspect the colloquial answer is that there isn't any pure/just space. I know that Wolfram is also not respected on here much but I like his- not intentionally metaphorical- arrival at a story for space being a process.

</comment></comment><comment> Digit-Al My understanding of quantum physics is miniscule; so a question: would it be potentially true to say that the concept of "emptiness" as we define it is essentially meaningless at the quantum level?

<comment><USER20> Yes. Concepts can stop making sense in situations that take them apart. For example, it makes sense to ask whether an apple is a fruit, but it doesn't make sense to ask whether an atom inside the apple is a fruit.

Even if you'd take just one electron, its cloud is infinite. Like, really, when people talk about things like shape of the cloud, what they mean is the density of the cloud, or the shape that you get when you only take the region where the density exceeds some arbitrary level.

So, from this perspective, as long as at least one electron exists in the universe, there is no empty place in the universe. Because, with infinitesimal probability, the electron could be anywhere.

Obviously, this is NOT what we mean by emptiness in everyday life.

(The article is okay, but its title is pure clickbait.)

</comment></comment><comment><USER21> > But until such an interaction occurs, the electron has been acting like a > wave all along.

What does that mean? Most interpretations of quantum mechanics consider the wave function to be an abstraction to model the system, not something that is actually tangible. Even in theories that consider it real (e.g. De Broglie- Bohm) it acts as some sort of field, not something that actually occupies space.

<comment><USER22> That's rally not correct. Interpretation of the double-slit experiment relies on the electron (or photon) wave actually spanning both slits. It's not enough to treat the electron as a point particle and the wave as being something we pretend exists to explain it's wave-like behaviour. If the wave wasn't real, we wouldn't see the behaviour.

</comment></comment><comment><USER8> "Empty space" is a completely relative notion. If I have a heavy steel safe which I do not have the key for, whether there is an empty space inside it is irrelevant, and the space occupied by the safe cannot be seen as being (partially) empty in any practical sense.

<comment><USER23> You can easily tell if it is hollow without opening it, however.

<comment><USER24> Just wait until you come across my safe, protecting my extremely rare and valuable collection of packing peanuts...

</comment></comment></comment><comment><USER25> > Atoms exist on extremely tiny scales, just 1 ångström across...

I may be misinterpreting, but it sounds like he's saying all atoms are 1 ångström in diameter.

<comment><USER23> That sounds within one or two orders of magnitude?

<comment><USER26> just one order of magnitude actually

<comment><USER23> One on each side, I guess.

</comment></comment></comment></comment><comment><USER27> how much volume does a wave take up in the sea?

</comment><comment><USER28> "The Medium is the Message" \-- Marshall Mcluhan

What is it about Medium that produces less than stellar articles? Because it is a paid blogging service so people just blow out some smoke and hope to make a little money?

<comment><USER29> because it resembles an old 2003 sensibility of blogs which resonated with a pseudo sensibility about certain types of New Yorkeresque/90s WIRED vibe. Medium is not good, I use it right now to create synopsis for YouTube videos I make, it's basically Myspace, which was useful for non professional and pro musicians to just get the music out.

</comment></comment><comment><USER30> This article is silly. 7/8th of it recapitulates what is already commonly known. Then it doesn't go on to show a new result.

</comment><comment><USER31> > Inside your body, you aren't mostly empty space. You're mostly a series of > electron clouds, all bound together by the quantum rules that govern the > entire Universe.

So we are mostly electron clouds... and clouds by definition are mostly empty space.

<comment><USER32> From what I understand, the idea of "empty" no longer makes sense at that level. All you have are fields. There, everything is made out of fields and fields are everywhere. There is therefore no "empty" really anywhere, including inside yourself.

<comment><USER33> Physics is all based on predictions not arbitrary definitions. To suggest something is filling space you must be able to hit it with something else. This talk of empty space, comes from actual experiments.

Shoot a neutral particle through that cloud and you generally find it really was empty. Wave particle duality doesn't mean a particle is in every location, just that it could be in every location. After detection you generally find all the places it was not.

<comment><USER14> Right ... except that if I want to put more _electrons_ in the same space I'm going to have to confine them more tightly. That prediction works.

<comment><USER33> An oxygen tank where you can safely add more oxygen by increasing the pressure is not considered full. The percentage of how empty a container is can be considered 1 -(amount of stuff in it) / (maximum stuff possible).

<comment><USER14> I think possibly you've defined "full" two different ways. Is it maximum safe pressure or maximum stuff possible?

<comment><USER33> I don't see the contradiction, Space unlike a gas tank is not going to fail.</comment></comment></comment></comment></comment></comment></comment>


Chest Drain (Thoracostomy) Pump as Alternative to Ventilator? - <AUTHOR> I had a needle thoracostomy for a collapsed lung (pneumothorax) when a teenager. The operation took 5 minutes, was done in my hospital room as I watched and was almost painless (OK the initial anesthetic hurt a bit). They slid a metal needle between the ribs into the pleural cavity. It was attached to a hose and a small pump (looked like an aquarium pump) that provided negative pressure. I spent 3 days in the hospital. Use and removal was painless: they slid the needle out and put a bandaid on it.<p>Rather than build complex, cumbersome and expensive to run ventilators for Covid-19 patients, why not use the far simpler chest drain to remove fluid from the lungs? <comment><USER2> the interior of the lung must be drained in the case of pneumonia, covid or otherwise. the alveolar sacs filled with fluid are difficult to drain due to the viscosity and surface tension.

this is why oxygen delivery at higher than atmospheric concentration may be required for diffusion across the alveolus

thoracostomy only drains the space between the lung and the pleural membrane.</comment>


Subject: We didn't think thermostats matter either - <AUTHOR> http://kelseyfalter.posterous.com/

<comment><USER2> "It's something that will go unnoticed by 99% of people. But the few who notice our attention to detail will evangelize it. They will shout their discovery. If I saw one of those gorgeous thermostats, I'd sure as hell tell someone -- about a THERMOSTAT."

When I saw this earlier today I thought the exact same thing and in fact I shared it with a few people because I was so impressed with the design and experience they created. It's just a thermostat but it looks so different and it comes with a screw driver to install it, peel off labels to label the wires when you install it and it even has a built-in level to make sure it is installed level. What an amazing design. To top it all off I really love the business model, not only are they helping their customers save money on their electric bill but they are helping a greater cause by saving the environment. I've become a huge fan of this product in just a few hours. Very well done.

<comment><AUTHOR> Totally agree. It is a great example of design. Design today is thrown around as something that looks almost Ikea-esque. But in actuality design is the user experience. Design is being thoughtful about the full process associated with a product. They thought of everything.</comment></comment>


What gun control advocates can learn from abolitionists who helped end slavery - <AUTHOR> http://www.slate.com/articles/news_and_politics/history/2016/06/what_gun_control_advocates_can_learn_from_the_abolitionists_who_helped_end.html <comment><USER2> would slavery have ended without the Civil War? It seems unlikely.

Now can we pass substantive gun measures that will reduce gun violence in America without having another Civil War? Probably... But I doubt some of the gun advocates would give up any of their arms willingly.

<comment><USER3> Most people (including gun owners) in the US support closing loopholes and increasing background checks. I believe it's over 70% of all Americans.

The reason those things haven't passed is because of powerful lobbying by the NRA.

I don't think any mainstream politician has proposed taking guns away from legal, non-convict gun owners.

<comment><USER4> Not in so many words--but then again, there is a lot of dog-whistling going on, intentionally or not.

I really hate to link to some of these, but Red State does a decent summation of the "loopholes" as they apply to the executive actions took in January of this year ( [http://www.redstate.com/absentee/2016/01/05/obamas- executive...](http://www.redstate.com/absentee/2016/01/05/obamas-executive- action-guns/) ).

It's not just the adoption of simple measures, though. There is a lot of resistance to wider-spread bans that are kinda just waiting in the wings ( [https://en.wikipedia.org/wiki/Arms_Trade_Treaty](https://en.wikipedia.org/wiki/Arms_Trade_Treaty) ) to remove the self-determination and ability to self-arm. Sure, a lot of kooks are the ones resisting, but there are legitimate concerns there. Those bans are made possible by slow harmonizing measures, as weapons are restricted bit by bit by bit.

The basic problem in all of this is that the lies have been _pervasive_ on both sides, and have been egregiously so in the case of proponents of gun- control measures. The phrase "assault weapon" was adopted literally to ban weapons that looked scary or military irrespective of their functional abilities. The phrase "commonsense measures" is specifically done to make a massive erosion of freedoms seem noncontroversial.

The entire posturing of gun control has been to either fear-monger or to smear as ignorant people who appreciate the value of retaining their right to self- defense and to do with their property what they will.

EDIT:

Loathe as I am to mention them, Breitbart has a useful quote showing exactly the mainstream politician talking about seizing weapons:

[http://www.breitbart.com/big- government/2015/10/16/hillary-c...](http://www.breitbart.com/big- government/2015/10/16/hillary-clinton-australia-gun-ban-worth-looking-u-s/)

Washington Post had an interesting bit here as well: [https://www.washingtonpost.com/news/wonk/wp/2016/01/08/why-s...](https://www.washingtonpost.com/news/wonk/wp/2016/01/08/why- so-many-americans-think-the-government-wants-their-guns/)

<comment><USER5> _" I really hate to link to some of these"_

 _" Loathe as I am to mention them,"_

You know, just don't do that if you really dislike those publications so much.

 _" The entire posturing of gun control has been to either fear-monger or to smear"_

No fear mongering is required. Simple data mongering is enough

[http://www.cnn.com/2016/06/13/health/mass-shootings-in- ameri...](http://www.cnn.com/2016/06/13/health/mass-shootings-in-america-in- charts-and-graphs-trnd/)

<comment><USER4> When those publications are as generally biased and nutzo as they are, I feel the need to disclaim referencing them even for direct quotes and facts. They had the information I needed, but I still don't want to act like they're gospel for anything else!

As for the data mongering, your link notes that (ignoring gang violence), there have been only 3, not 136, shootings this year. It's a bit curious that such a large order of magnitude change can be had by changing the definition slightly--and yet, it's nearly always the more dramatic number reported and reported as an imminent threat!

</comment></comment></comment></comment></comment><comment><USER6> It fascinates me that anyone smart enough to be in tech seems to think banning a type of weapon solves any evil.

<comment><USER5> Yeah... especially when there's absolutely no precedent for such bans solving exactly such problems in other countries.

[http://www.nytimes.com/2015/12/05/world/australia/australia-...](http://www.nytimes.com/2015/12/05/world/australia/australia- gun-ban-shooting.html?_r=0)

<comment><USER6> United Kingdom: The UK enacted its handgun ban in 1996. From 1990 until the ban was enacted, the homicide rate fluctuated between 10.9 and 13 homicides per million. After the ban was enacted, homicides trended up until they reached a peak of 18.0 in 2003. Since 2003, which incidentally was about the time the British government flooded the country with 20,000 more cops, the homicide rate has fallen to 11.1 in 2010. In other words, the 15-year experiment in a handgun ban has achieved absolutely nothing.

Ireland: Ireland banned firearms in 1972. Ireland's homicide rate was fairly static going all the way back to 1945. In that period, it fluctuated between 0.1 and 0.6 per 100,000 people. Immediately after the ban, the murder rate shot up to 1.6 per 100,000 people in 1975. It then dropped back down to 0.4. It has trended up, reaching 1.4 in 2007.

Australia: Australia enacted its gun ban in 1996. Murders have basically run flat, seeing only a small spike after the ban and then returning almost immediately to preban numbers. It is currently trending down, but is within the fluctuations exhibited in other nations.</comment></comment></comment>


Crab – SQL for your filesystem - <AUTHOR> http://etia.co.uk <comment><USER2> > Just try these in Bash or PowerShell! > select fullpath from files where > fullpath like '%sublime%' and fullpath like '%settings%' and fullpath not > like '%backup%';

This isn't a very good example, because it's trivial to do in bash:

        locate sublime | grep settings | grep -v backup

(Replace `locate sublime` with `find / | grep sublime` if locate's results are too old.)

> select fullpath, bytes from files order by bytes desc limit 5;

This is better. Here it is in bash:

         find / -type f -exec stat -c '%s %n' {} \; | sort -nr | head -n 5

Cherry picking another one that stood out to me.

> select writeln('/Users/SJohnson/dictionary2.txt', data) from fileslines > where fullpath = '/Users/SJohnson/dictionary.txt' order by data;

        cd /Users/SJohnson/; sort dictionary.txt > dictionary2.txt

Some of the rest of the examples are trivial in bash, and others look potentially useful. Of course they are trying to demonstrate its capabilities so the examples are contrived. I can see how this would be useful for someone who doesn't know the command-line, but as someone who is proficient in both SQL is pretty verbose.

In the real world I'd switch to a scripting language for some of the more complex cases, since they'd be rare.

<comment><USER3> Sure, if you already know all that. But

        select fullpath, bytes from files order by bytes desc limit 5;

is infinitely more readable/parseable than:

        find / -type f -exec stat -c '%s %n' {} \; | sort -nr | head -n 5

Just something exists doesn't mean it isn't an incomprehensible pile.

<comment><USER4> I think powershell still isnt really that hard for this (and was mentioned earlier)

Something like:

      gci / -recurse | sort fullname | select fullName, length -first 5

Really doesnt seem that hard in comparison.

<comment><USER3> Agreed. It's interesting - last time I looked at PowerShell it seemed insanely verbose, but maybe I was looking at some odd examples.

<comment><USER5> As pointed out a lot of the verbosity in PowerShell is optional these days as there are a good number of aliases for common commands.

The nice thing about the verbosity is kind of similar to the point of SQL in that it too has something of a natural language DSL intent (in PowerShell commands are expected to be "Verb-Noun" and verbs for the most part are encouraged to be from a relatively small set of common verbs). This can make it a bear to fully write out without an IDE (and there are multiple choices these days) or tab completion (which gets better with each release).

The benefit however, is that typically you can very easily read someone's PS1 script if it has been written at full verbosity and know what it is doing. It's often very close to self-documenting at that point.

</comment></comment></comment></comment></comment><comment><USER6> Reminds me of facebook's [https://osquery.io/](https://osquery.io/) does this offer anything different?

<comment><USER7> osquery also has some level of setup overhead and requires a daemon running in the background. I don't think this is true of crab.

<comment><USER8> You don't need to run the daemon. It's also possible to just use it interactively via osqueryi.

<comment><USER7> Thanks for clarifying. I haven't actually used osquery myself so I wasn't aware.

</comment></comment></comment></comment><comment><USER9> As a reminder, we actually did have a filesystem with integrated SQL (-like) query features in BeFS, in 1997.

</comment><comment><USER10> This is pretty cool, I have find myself wanting a tool like this for ages. However, does anyone know of a pure open source alternative (just for Linux) ?

<comment><USER11> A more unixy alternative to osquery is termsql ([https://github.com/tobimensch/termsql](https://github.com/tobimensch/termsql)): it works with anything on the input, so it's a matter of "ls"-ing the correct folder and then using SQL to output what you want.

</comment></comment><comment><USER12> This is a brilliant idea!

You can do most of the same kinds of things via find and grep and some shell foo, but honestly who can remember all of that? Maybe someone smarter than me, but every time I need it I am reading man pages.

The find syntax to get files modified more than 20 minutes ago? How can you remember that? But modified > now() - interval '5 minutes' (well that's postgres but still), I can remember it and I haven't used it in 2 or 3 years, because it's slightly less arbitrary and doesn't have 8 different gotchas.

EDIT:

find . -mmin -5 # that gets you files modified in the last 5 minutes. The part I can't ever remember:

find . -mmin +5 # that gives you files last modified more than 5 minutes ago

find . -mmin 5 # apparently this is files modified exactly 5 minutes ago? The fact that this syntax exists (and is different from +5) seems absurd to me. What is the resolution? It must be minutes. This option exists only to confuse people.

<comment><USER13> may be an alternative

find . -mmin <5 # less than 5mins

find . -mmin >5 # more than 5mins

find . -mmin =5 # exact 5mins

</comment></comment><comment><USER14> "Multi platform" ... only runs on OSX.

<comment><AUTHOR> We're working on Windows, the query syntax and the functions are going to be the same.

</comment></comment><comment><USER15> I like to use ad-hoc linq queries with linqpad to get this type of stuff done.

Ex : Directory.GetFiles(theDirectory).Take(50).GroupBy(a => ...)

</comment><comment><USER16> Log Parser does this too (Windows only). [http://www.microsoft.com/en- us/download/details.aspx?id=2465...](http://www.microsoft.com/en- us/download/details.aspx?id=24659)

<comment><AUTHOR> We looked at Log Parser before building Crab. The syntax was far from standard SQL, it didn't have joins etc.

It didn't use string matching to identify subsets of files to query.

And maybe the most important thing, it doesn't have the exec function to run operating system commands on the files you get back in your query results.

</comment></comment><comment><USER17> I've been looking for something like this (and thinking about developing something if I can't find a satisfactory solution) to use across many different hosts to identify duplicate files, etc. I've got media spread across many different linux and os x machines. Can crab handle this?

<comment><USER18> Well a workaround is mounting and using joins ?

Now, be careful the example find duplicate file names (with equal size). Not duplicate files ! Those would require check of the contents of the file.

Also there are tools like fdupe, same problem regarding remote hosts though. Some tools use xattr to store hashes. Some might use DB's. (With xattr tools, you just run the tool on the remote host first, then on the local host, if you need to save bandwith.)

I however don't have the perfect answer.

<comment><USER17> Yeah, ideally what I want is a daemon which hooks into libevent or something similar, and each time a file changes or is created, calculates a checksum and updates other metadata, and then finally provides this information back to a central queryable database.

</comment></comment></comment><comment><USER19> Makes me think of txt-sushi ([http://keithsheppard.name/txt- sushi/](http://keithsheppard.name/txt-sushi/)). Can be pretty useful instead of using awk.

</comment><comment><USER20> Reminds me of WinFS, which was cancelled but I always thought it was a brilliant concept.

[https://en.wikipedia.org/wiki/WinFS](https://en.wikipedia.org/wiki/WinFS)

<comment><USER21> I think it was abandoned when Microsoft realized they could achieve similar object orientation built on the same old file system (so no incompatibilities), just with the .NET layer in between. See also PowerShell and the example above. :)

</comment></comment><comment><USER22> IMHO ... doesn't replace the good old for,find,grep etc..

</comment><comment><USER23> Does this maintain an inode metadata index as well? Otherwise how will you avoid stat'ing the whole filesystem (or a branch thereof)?

Does it handle extended attributes?

<comment><AUTHOR> Crab doesn't pick up metadata during the scan, because this would slow the scan too much.

There is a wrapper function 'metadata' which returns a specific metadata item from a file at a given path at query run time, but this basically runs mdls under the hood.

Crab can handle extended attributes using the EVAL function function which runs an OS command and returns the result as a string. But you have to parse the string, for example to return the size of a resource fork:

select bytes + coalesce(matchedgroup(eval('ls','-l@',fullpath),'.com.apple.ResourceFork\t(\d+)'),0)

</comment></comment><comment><USER24> Yay for commercial open source!

<comment><USER25> It doesn't like it's open source - you download a time-limited trial version, after which you need to buy a license. And there's no link to the source.</comment></comment>


California man who lasered two helicopters to face 14 years behind bars - <AUTHOR> http://arstechnica.com/tech-policy/2014/03/california-man-who-lasered-two-helicopters-to-face-14-years-behind-bars/

<comment><USER2> It amazes me that someone can get sentenced 14 years for shining a laser at an aircraft and there are people who get a DUI and don't face close to that amount of time. I'm actually surprised there hasn't been a movement to make possession of high powered lasers illegal without a special permit.</comment>


Software Patents as Innovation Tax, Rather Than Catalyst for Innovation - <AUTHOR> http://thenoisychannel.com/2011/03/07/a-practical-rant-about-software-patents/

<comment><USER2> For anyone interested, I expounded at some length a while back about why method patents are well-entrenched in U.S. law and about the philosophical debate surrounding them over the years (see <http://news.ycombinator.com/item?id=1171821>). Software patents, of course, fit within that mold and, in light of _Bilski_ , will not be subject to any form of categorical challenge for years to come in the courts. The issue lies with Congress, and this piece sets forth an excellent way of making the right kind of policy challenge (in contrast to the more superficial "this is ridiculous" kind of point which, though sometimes true, the patent bar is usually quite good at rebutting, at least based on existing legal standards - see, e.g., <http://hallingblog.com/2010/05/26/patent-ignorance/>).

In the analog era of patents, the U.S. courts went nearly two centuries in which the idea of a patent was strongly tied to that of a "machine" and where they often held that, while an original invention was in itself patentable, an improvement upon that invention was not. For example, in 1875, the Supreme Court held that "it is no new invention to use an old machine for a new purpose" (I cite and discuss this in the linked item above). It was not until 1952 that Congress overruled this line of cases in amending the patent statutes, setting the stage for what became an eventual flood of software patents as the digital age began.

The policy issue making software patents problematic in our digital age is that patentable software innovations, though supportable under current legal standards, basically are creating an ever-complex web of closely-interrelated and incremental improvements in any given area (e.g., mobile devices) such that no one can develop anything there without getting entangled in the web. It is not just tricky. It is impossible. The only way to defend is to make your own web (your "defensive patent portfolio" or your "defensive pool") and use that to catch others before or as they catch you. If you don't have that, you are in trouble.

Is _this_ , then, what was intended by the Progress Clause of the Constitution (Article I, sec. 8, cl. 8) when it provided that the Congress shall have the power "to promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries"? Just how do these tangled webs of 1-and-0 based incremental improvements that are a normal part of all software development in the first place manage to promote the progress of science and useful arts?

The cause for reform in this area will be won or lost based on how the issues are framed and here we have a good example of how to begin to mount an effective challenge.

<comment><USER3> > here we have a good example of how to begin to mount an effective challenge.

If you want to successfully make something sound like a problem to a government, don't describe it as a "tax" and expect them to think of that as bad.

</comment></comment><comment><USER4> The amazing thing to me is the extent to which companies can't solve elementary coordination problems, and so stay in a Hobbesian state where entities just randomly attack other entities with patent-clubs and there's nothing resembling law or police entities. Step one would be banding together, not just with a centralized defensive patent portfolio, but with a centralized legal defense fund. As for the NPEs, patent the business method of patent trolling (I think somebody already did this, so just keep applying until you get another patent for the same thing), then sue them for violating it. After they're convicted by the central court of patent trolling, of course.

Astounding how the insight of law and centralized police, in just a slightly different domain, is so counterintuitive that companies still farm the lands as individuals, prey to whatever bandits stalk their way.

</comment><comment><USER5> John Walker's PATO (described in the post) seems like it might be a good idea.

Here, just to brainstorm a little, is another idea I was kicking around the other day. I'll call it the Rational Software Patent Alliance. The basic idea is that any patent dispute between two RSPA members is settled by binding arbitration performed by the RSPA. Unlike the current system which foists technical decisions of obviousness and infringement on judges and juries who are not competent to make these decisions, the RSPA arbitration team consists entirely of experienced (and very well paid) developers and computer scientists. The arb team will form its own opinion of the validity of a patent, very much including its judgment of the obviousness of same; and everyone should know that only a minority, possibly a small minority, of software patents issued by the PTO are likely to pass the much higher bar of the RSPA.

Of course, there's some risk that a patent holder, unhappy with their patent being considered invalid by the RSPA, would quit the organization so they could sue another RSPA member in the courts. To deter this behavior, we say that an entity can join the RSPA only once; you can't get back in after leaving, and what's more, if someone acquires you after you leave, _they_ can't join the RSPA either, and if they're already a member, they're kicked out.

The incentive to join RSPA is simple: it removes some fraction of the risk of being sued -- said fraction being a function of how many other companies join -- and it wouldn't be expensive unless you actually avail yourself of the arbitration process, and even that would be far cheaper than litigation.

I think this idea is actually complementary to PATO, as it's an idea about how members should resolve disputes among themselves, where PATO is more about how members should help one another in disputes with nonmembers. Walker suggests that PATO members should never be able to assert patent rights against other members, but I think that's going to be a harder sell than what I'm proposing, where companies do have some chance of protecting their real innovations from other members. I think there has to be some chance of that if we're going to get the big players -- Microsoft, IBM, Oracle, etc. -- to join.

So I think there should be one entity -- and "PATO" is definitely a better name than "RSPA" :-) -- that has both of these functions, to help defend members against nonmembers, and to arbitrate disputes between members.

Alas, neither of these functions does a good job of addressing the NPE problem, as NPEs would obviously never join such an alliance, and they aren't vulnerable to countersuits precisely because they're non-practicing. I think if anyone is going to fix the NPE problem, it's going to have to be Congress.

</comment><comment><USER6> Patent insurance is the knee jerk reaction to patents, and more or less impractical.

However, the patent pool concept this article discusses sounds like a way to more or less provide patent insurance, which would be an amazing thing if it reached critical mass.

<comment><USER7> Really sounds to me like a consortium that would end up using its collective power to destroy non-members. Would be easy enough at some point to make sure only large corporations can afford to be members, and go after innovative small companies with their shared portfolio.

Legal reform makes a lot more sense to me and is less fraught with potential with abuse.

<comment><USER6> The nightmare scenario you describe is already the current situation. There is already a "boy's club," you automatically become a member when you have acquired enough patents. The consortium is simply a way to lower the barrier to entry to be "one of the boys."

The problem with legal reform is that it won't happen, not that it isn't the right thing to do.

The consortium as an intermediate step would be a good way to slow roll reform. Once a critical mass of companies is part of the consortium, intellectual property value would start decreasing, due to the decreased offensive effectiveness, and legal reform would become more feasible.

<comment><USER8> Exactly. I prefer legal reform too, but something is better than nothing.

</comment></comment></comment></comment><comment><USER9> However you interpret the current situation, the patent and copyright clause is certainly not operating as intended by its authors.</comment>