Use DuckDuckGo to improve your privacy online (2018) - <AUTHOR> https://spreadprivacy.com/privacy-simplified/ <comment><USER2> I first tried DDG in its early years and it just didn't yield the results I needed, I tried it again a couple of years ago and have stuck with it ever since as it has must better results these days.

<comment><USER3> Every now and then I search for something and don't get the results I'd expect. So I turn to Google, but for the past year or so I noticed that Google can't find what I expect for those search terms either. The difference seems to be that Google starts guessing and excluding keywords, without understanding that those keywords where important.

For me personally, Google is a less pleasant experience these days.

The DuckDuckGo privacy extension is currently the only type of "ad-blocker" I currently use. I really like the look and feel, as well as the functionality. The automatic downgrade from an A rating for the lack of an entry on [https://tosdr.org/](https://tosdr.org/) is a little over the top for me though.

<comment><USER4> THANK YOU. I feel crazy when I tell people this but I 100% agree. Google seems to look at your search as a general guide now rather than actual parameters. I also have to surround each word in quotes or they get excluded on the SECOND OR THIRD RESULT.

I'm very upset because this hinders my daily work and research. I'm starting to rely on Bing which is definitely worse than old Google but may be better than current Google.

I want to like DDG but it's normally missing article dates or other small features I depend on. I'll keep checking in to see if this changes.

<comment><USER5> Is there any possible way the old google could be resurrected? By google themselves or just someone cloning the tech? My google-fu keeps getting worse, on pages I know I've found handily in the past. I'd almost pay for a good search, cash or personal data or whatever.

<comment><USER6> Google offers the verbatim mode (search for exact words of phrases) which you can activate in tools or by adding the tbs=li:1 parameter to the URL.

<comment><USER7> I've always used that, but it annoys me that verbatim can't be combined with e.g. restricting the date on a search, because both use the 'tbh' parameter.

</comment></comment></comment></comment></comment></comment><comment><USER8> If the user submits a GET request to DDG from the commandline with Javascript disabled, then all results links are prefixed with the address of a DDG server, e.g., [https://example.com](https://example.com) becomes [https://duckduckgo.com/l/uddg=https%3A%2F%2Fexample.com](https://duckduckgo.com/l/uddg=https%3A%2F%2Fexample.com)

Whatever the reasons may be for this decision, it allows DDG to track all links that the user follows from the results page. That is no better than Google. It is not a privacy improvement in that regard.

If the user submits the request via POST, then the results are not prefixed. For example, if the request is submitted from an html form with method set to "post".

I submit that allowing users to GET (clean) results without using Javascript would be a privacy improvement over Google. Not to mention that it would please many users who get frustrated when trying to copy links from a Google results page only to find they have been prefixed and loaded with Google url parameters.

Users deserve clean result links.

To see the difference between prefixed and non-prefixed result links:

       curl -o a.htm https://duckduckgo.com/lite/?q=example.com

       grep -m1 .=result-link a.htm

       curl -o b.htm -d "q=example.com" https://duckduckgo.com/lite/

       grep -m1 .=result-link b.htm

<comment><USER9> Here it is with piping so you don't have to litter your working directory:

        curl -s https://duckduckgo.com/lite/?q=example.com | grep -m1 "'result-link'"

        curl -sd "q=example.com" https://duckduckgo.com/lite/ | grep -m1 "'result-link'"

<comment><USER10> And for xpath lovers

        curl -sd "q=example.com" https://duckduckgo.com/lite/ | xmllint -html -xpath '//a[@class = "result-link"]/@href' -
        curl -s https://duckduckgo.com/lite/?q=example.com | xmllint -html -xpath '//a[@class = "result-link"]/@href' -

</comment></comment></comment><comment><USER11> I've stopped using Google and moved to DDG not because of privacy, but because the results on Google just seem the same everytime even when I use different wording, making it feel like Google has been becoming a "recommendation engine" rather than a "search engine".

<comment><USER12> If you feel like Google is excluding certain keywords you very much like to include, you can wrap the word/sentence in double quotes, this tells Google to show results that certainly include these keywords.

For example, searching: "word x" "sentence a" would prompt Google to show only pages that include both the word and the sentence in the same page.

<comment><USER13> If only. It's a bit more fuzzy than that now.

<comment><USER14> Nope! :)

Its actually part of the syntax of search queries for google. That said, it still isn't always the best results.

<comment><USER15> That's anecdotally false. I've had Google use synonyms for words I put in quotes instead of the words themselves.

</comment></comment></comment></comment></comment><comment><USER16> I love DDG (and have been using it as my primary search engine for about six months) but I feel like the hacker community (including me) forgets that DDG _is_ a for-profit corporation, and that at some level posting these kinds of links is more or less the same as just giving them free advertising.

<comment><USER17> The quality of DDGs results is related in part to the number of users they have:

\- they use link clicks to determine coherence between query and result. More users => more clicks => greater coherence

\- they fund themselves using advertising, so their revenue is roughly proportional to their number of users. Increasing users => increasing money => more money to devote towards improving results

If one is interested in improving the results of DDG, then providing them with free advertising is an easy way to do it.

<comment><USER16> I'm not disagreeing with your point (or the network effect in general), but I guess I worry that if we don't engage in some early skepticism, we're going to end up with another Google or Facebook on our hands.

</comment></comment></comment><comment><USER18> Switched to DDG for my defaults over a year ago now. Still occasionally have to append a !g to my search, and Google Maps is still unmatched, but for run of the mill searches it's been working out. Google lost my trust, so if I can avoid using a service of theirs with a viable alternative, I do so. Go, OpenStreetMap!!

<comment><USER19> > Google lost my trust

you might want to try occasionally using !sp instead of !g -> same results, no google.

<comment><USER20> Just !s will do actually.

</comment></comment></comment><comment><USER21> DDG has been my default search in FF for a very long time now. If I can't find what I'm looking for with ddg, I'll simply add !g to my search, and it will redirect to Google.

</comment><comment><USER22> I can't tell if everyone here is serious when they say they haven't looked back.

Google knowledge graph is years ahead of DDG. Average person does not want to click through results, s/he just wants the answer. Compare these queries in Google vs. ddg:

      - nba scores
      - 2018 super bowl
      - lakers roster
      - movies in theatres
      - game of thrones cast
      - $aapl
      - where is my phone
      - 2019 thanksgiving

etc

<comment><USER23> I can't say I haven't looked back; occasionally I'll fall back to Google when DDG is having trouble finding what I want to find. Even then, it's certainly less than 10% of the time (maybe even less than 5%), and I find when I have to do that, Google's results aren't super high quality either (though most of the time the quality is just better enough that it turned out to be useful to have the Google fallback).

As for just "getting the answer", I suspect you're right most of the time, but I really don't mind clicking through the first few results links to see the answer. Figuring out the best answer and putting it in-line with the search results is a nice-to-have for me, but certainly not essential.

Also note that I'm making a trade-off here: lower search result quality in return for not having my search history tracked. For many people, I imagine they don't care about their privacy as much and will make the opposite trade- off. That's fine; I'm just glad we have good enough options so people can make that decision and not be forced one way or the other.

</comment></comment><comment><USER24> All hail the duck! (Not tongue in cheek. I'm a fan of the duck)

</comment><comment><USER25> Also available at [https://duck.com](https://duck.com) now, after much ado.

<comment><USER26> Why are they redirecting it to duckduckgo.com, why not just use duck.com? Short and simple.

<comment><USER27> they only recently acquired that domain. That too from google!

</comment></comment></comment><comment><USER28> I'm not trying to defend Google by any means, but I've always wondered how DDG can be as profitable as Google if they take into account less information when showing you ads. Surely using more information allows you to more efficiently match supply with potential demand, which is the point of ads. Is there any research out there that shows that this efficiency gap does not exist?

I don't use or follow Facebook that much, but every time I hear Mark Zuckerberg defending Facebook's business model, he always says something like "we want to make sure the ads you see are actually useful/relevant to you". Is there a way to achieve this outcome without taking into account more personal information?

<comment><USER29> > I've always wondered how DDG can be as profitable as Google if they take > into account less information when showing you ads

AFAIK, no one has conclusively shown that highly targeted ads perform better than interest-based ones (as in, putting ads for cars in car magazines). In fact, I'm under the impression that "we don't really know what we are doing" is the ad industry's secret.

The Atlantic calls this Wanamaker's Paradox[1], in honor of a retailer that said "Half the money I spend on advertising is wasted, the trouble is I don't know which half". If DDG is right and showing ads based on your search terms is enough, then you'd expect them to get _ahead_ of Google, because they would have similar profits with less overhead.

Of course, there is much more to Google's dominance than "because they show better ads", so I don't think "efficiency gap" is the best way to look at it anyway.

[1] [https://www.theatlantic.com/business/archive/2014/06/a-dange...](https://www.theatlantic.com/business/archive/2014/06/a-dangerous- question-does-internet-advertising-work-at-all/372704/)

</comment></comment><comment><USER30> Switched to DDG about two years ago. First, it was worse than Google. However in the meantime, DDG has improved a bit and Google got worse, showing a lot of performance devrading crap/boxes/large text instead of search results.

So DDG is now all around the better choice.

</comment><comment><USER31> I love DDG! Switched to it about a year ago and haven't looked back. The odd time I need to use Google at work for a specific technical lookup but otherwise I don't need too. I love to support the underdog who values privacy. I recommend it to everyone.

</comment><comment><USER32> Does this offer anything unique that other content blockers cannot? From what I can see it would only be the forced encryption and I guess the letter grade.

I love DDG for search but not sure this browser competes with 1Blocker X Safari integration on iOS.

<comment><USER33> It's not a content blocker. It does have a lot of "instant answers" with information put in a box next to search results so you don't even have to click through. e.g. [https://duckduckgo.com/?q=who+is+the+prime+minister+of+malay...](https://duckduckgo.com/?q=who+is+the+prime+minister+of+malaysia)

Also it has "bangs" which give you shortcuts to lots of other services. [https://duckduckgo.com/bang](https://duckduckgo.com/bang)

<comment><USER32> Guess I worded it a bit strangely but this acts like a content blocker on iOS, but in it's own browser. Most commenters are just commenting on the search engine but this post is about their mobile browser.

I was just curious what benefits you get from switching to this browser vs. using a content blocker with Safari.

</comment></comment></comment><comment><USER34> I'm glad most a lot of these comments are saying DDG works for them; I still have a lot of issues with the search quality and switched to Startpage a while ago which uses anonymized google results.

<comment><USER35> I'm with you. I switched to DDG, and within a day i started subconsciously adding `!g` to my query. And it's for simple things, not even complicated programming queries. For example, if i wanna see what the weather is, typing "Toronto weather" in google gives me the current weather right on the front page, whereas with DDG, i have to scan for weather network and click on it to actually get the information. Same goes for a TV show/movie/sports score. Google has Imdb rating/current live score right there on the home page.

<comment><USER36> "toronto weather" gives me the weather now and the 7 day forecast in a widget on the top of the search page. If I search "packers" it gives me the latest packers scores on the top (and if a game is ongoing an indicator of the time, who has the ball, and the score), if I search "patriots", there is an nfl tab on the top that I can click and it gives me the scores. I'm not saying you're wrong, but DDG has been working on some of those issues. You can always add !imdb or !rt in front of your shows/movies for rottentomatoes or imdb.

<comment><USER35> Hmm, you are right it shows correct weather now.

But here[0] are the examples of sport and movies/tv shows that i was talking about.

[0] [https://imgur.com/a/vBWh6rN](https://imgur.com/a/vBWh6rN)

</comment></comment></comment></comment><comment><USER37> I'm glad they're moving forward, but I still don't buy it. Someone is tossing a big load of money on them (you know that when you see their ad in twitter every day, and articles like this), specially in the last year. When that happens, investors will want their return, no matter what.

People saying they respect your privacy, but... how do you _really_ know? Also because "improved privacy" != "no targeted ads". They can still do massive amounts of money from the data we provide.

At some point:

1) they would have to comply with some law somewhere, handling user data (logs). 2) they may become the number 2 search engine. Spammers will target them and they would have to start doing some behavioral analysis on "what links worked well to those kind of users" to fix that.

Are they so transparent and well intentioned? Is their system so simple, so innocuous and filled only with anonymous data? Fine, they should Open-source the engine and servers, prove that they are using the same code we see, give us RO access to the DBs, and the equivalent of a MacDonalds kitchen tour.

Otherwise, they are just relying on nice words.

<comment><USER38> > how do you really know?

You don't _really_ know. However, when your entire USP is being privacy- friendly (and really, that's the primary feature that Google can't copy), it would be incredibly damaging if word got out that that wasn't true. And we can be reasonably certain that, if it wasn't true, word _would_ get out.

Also note that DDG explicitly says they don't do user tracking. So while ads are targeted in the sense that you'll see ads relevant to the search term you're using (and your location and other data attached to the query), they're not keeping a profile of you and targeting ads based on that. In other words: there should be no significant user data for them to hand over.

I'm not sure why they would have to become the number 2 search engine at some point, although regular search engine manipulation does already seem to affect them sometimes. I don't see why they would have to track users to combat that.

Sure, open source would be nice. But right now, we do have reason to assume that they're at least significantly better than Google, without having to sacrifice a lot in search result quality.

<comment><USER37> > we do have reason to assume

> word would get out

> no significant user data

These, as you say, are assumptions. That's why I don't (still) buy it.

They are in "sell" mode right now. They would say anything to gain traction, and it's working. That's why they are pushing hard and investing a lot. Remember it's about making BIG money through an advertisement-based business, what could possibly go wrong?

Imagine that you are magically handled the DB for the searches done today. What would you can possible learn from that information? Perhaps you can't track what searches did HN user Vinnl, but the info has surely a value. They may not be honest about what are they doing with that information.

<comment><USER38> Absolutely those are assumptions - hence my first sentence. That's still more reliable than trusting Google, about whom we don't need to make assumptions.

Another assumption I make is that I don't expect then to seriously displace Google any time soon,but rather remain a player that fills the niche of private search. If that ever appears to change, we can always adapt - let's not make perfect the enemy of the good :-)

</comment></comment></comment></comment><comment><USER39> Why is this suddenly on the front page?

<comment><USER40> This is a Browser from DDG, not their search engine.

It claims to block trackers like Google and FB, and provides other privacy related features.

Does not say what it's built on... Probably chromium.

<comment><USER41> lol I know right, same with Brave.

</comment></comment></comment><comment><USER42> I believe in everything DDG stands for but just earlier I did a search comparison to see which search engine provided the most helpful results. I searched 'asus block third party firmware' (no quotes) and objectively I have to say that Google provided the most helpful results. Search yourself and see if you come to the same conclusion.

</comment><comment><USER43> Missing features I wish DuckDuckGo had (and reasons why I manually type google.com even though I have DDG set as my default browser: \- sports searches. If I search for "Washington Capitals", I want to know when they're playing next and what channel it's on, as well as the results of their past game. This goes for any time I search for a sports team. \- searches for dictionary terms should one-box the definition (for instance, today I looked up mortified with "mortified definition"). I should see the one-box of what I'm looking for. \- one-boxing in general: stack overflow answers, definitions, calculations (feet to meters, grams to pounds, etc), sports, time zones, cities, monuments, etc.

The search results from DDG just feel "off" compared to google search. I want to like DDG and I keep attempting to use it; but it's failing at making relevant information immediately available at my fingertips.

<comment><USER44> If you're willing, consider using the 'Send Feedback' link in the lower right corner of the DDG results page to inform them when you were 'reaching' for a given helper-box and didn't get what you were hoping for.

</comment></comment><comment><USER45> I switched to DDG for two reasons:

\- Privacy

\- It doesn't try to be smarter than me

More often when I use Google to search (e.g. for research), it decides to ignore one or multiple words, yielding irrelevant results. It's fixable, I can quote them, it even offers to do that, but it drives me nuts.

</comment><comment><USER46> As usual most of the comments here are "I made the switch and couldn't be happier" and have nothing to do with the actual submission. Therefore I feel obligated to post my usual rant about DDG just being a wrapper for Bing.

<comment><USER47> Bing or not. For me important is that it is outside Google's reach. This prevents aggregating search (history) with e.g. gmail, contacts, location etc. Also important is, that DDG now works reasonably good in most cases.

<comment><USER46> Thank you. I support that. What I don't support is people saying it's a false claim when DDG is completely transparent about it themselves.

<comment><USER48> Does Bing offer the same privacy advantages (no tracking, no history based ads, etc.)?

EDIT to add: I think nobody disputes or cares that most results come from (or equal) Bing results, as long as they're good enough.

<comment><USER49> DDG basically acts as a vpn proxy. Bing sees all the traffic as from DDG the same, they can't differentiate the individual requesters. Assuming DDG does what it says it does anyway.

<comment><USER48> Right, so that's a valuable service in itself, as far as I'm concerned.

</comment></comment></comment></comment></comment></comment><comment><USER50> How does DuckDuckGo make money?

<comment><USER51> The ddg CEO (and others) have answered this question here: [https://www.quora.com/How-does-DuckDuckGo-make- money](https://www.quora.com/How-does-DuckDuckGo-make-money) tl;dr: They serve ads based on keywords and not by tracking your interests.

<comment><USER52> So how does this fit into it?

<comment><USER53> How does what fit into what?

It's possible to serve ads without being creepy if that's what you're asking.

<comment><USER52> No, I meant how does this extention/mobile browser generate money for them?

<comment><USER53> It's marketing for their search engine

</comment></comment></comment></comment></comment></comment><comment><USER54> I started using DDG everywhere in December after reading a story how Google tried to steal a MIT researcher's work.

I thought they "Do No Evil," were all about corporate and social good? That's the image I once had!

</comment><comment><USER55> Google built things that circumvent it.

I love how commercials "follow you around". If I search for diamond rings in a browser on one computer, they suddenly materialize everywhere.

I tried it with Duck-Duck-go, searching for something I nearly never search for, something such that the ads follow you around. I just searched in DDG, but did not go to the end website. I then resumed non-DDG browsing, and those came up as ads. I don't know if they are looking at image caches, or loading javascript libraries.

They have a way around it already, and it runs.

</comment><comment><USER56> I switched my browsers to using DuckDuckGo as the default search engine and almost miss never Google at all. Any time I do miss Google, I just manually navigate to Bing and use that instead.

</comment><comment><USER57> I deliberately look for DNT (do not track) header and don't load any analytics for those users. As far as I can tell, the ddg app does not send those headers, which could be helpful.

</comment><comment><USER58> >improve your privacy by downloading another app I don't see how piling even more technology onto privacy unfriendly internet habits helps. You're not going to get more privacy by using this on a site like Facebook. The real solution is to simply remove them from your life. See if there's something you can remove to improve the situation first instead of adding stuff.

</comment><comment><USER59> If you're looking for privacy, you shouldn't use DDG as it's based in the US. Consider searx or startpage instead

<comment><USER60> What's so bad about being based in the US?

<comment><USER61> Might just be that US companies are known to be subject to National Security Letters

<comment><USER62> Not really a worry because they cant get what ddg doesn't have.

<comment><USER63> Is there even evidence they don't keep anything?

Edit: Okay, you can't really have evidence of absence, but good reasons to believe they don't log?

<comment><USER62> They state all over in their website that they don't log.

Though I have no way of verifying they don't keep logs, if I discover they do: at least I can sue them for it.

</comment></comment></comment></comment></comment></comment><comment><USER64> I have been using it for the last month, thanks to HN, but also those who contribute. :D

</comment><comment><USER65> We changed the URL from [https://duckduckgo.com/app](https://duckduckgo.com/app) to the page that explains what that app does.

</comment><comment><USER66> Why would I use another AMERICAN / Western search engine? I personally feel we would be better off using Yandex (Russian) or Baidu (Chinese) search engines. We need more COMPETITION to reduce our reliance on parasites like Google / Microsoft / FB etc and thus force the industry to reevaluate their business model on how they make money from us.

Yandex has a pretty decent search engine, and also helpfully provides a link to Google / Bing too, in case one isn't satisfied with their search results. This is smart of them as they still get data to improve their search engine, but also don't leave their users disgruntled when the search results aren't relevant.

<comment><USER67> I agree about being mindful about using services of US companies, possibly preferring alternatives, however using a Chinese or a Russian alternative instead is just plain stupid.

Two reasons:

1\. The US is a functional democracy, with a bill of rights and privacy laws which aren't perfect, but exist; California even has its own version of the GDPR

2\. They have strong trade agreements with the EU and if you're an EU citizen this matters, as companies found to violate the GDPR will get screwed; GDPR which also makes the export of data very complicated, so US companies are increasingly keeping EU data on EU servers

Speaking as an EU citizen, the NSA is not my enemy. But companies like Facebook are. So for me a company like DuckDuckGo is still acceptable because without privacy, they offer nothing of interest, so they won't do anything to jeopardize their reputation.

Speaking of which, DuckDuckGo can exist in the US, but not in China or in Russia, both being jurisdictions that are ... challenging, to say the least.

If you insist on not using US services, then the only alternatives worth looking at are in Europe, because we have strong privacy laws and we aren't being led by dictators. And you'd better not look at a "five eyes country" ;-)

Here's one: [https://www.qwant.com/](https://www.qwant.com/)

<comment><USER66> > however using a Chinese or a Russian alternative instead is just plain > stupid.

No, it is not. By using non-american alternatives, you ensure fragmentation of your personal data, thus making it harder to build a better / more accurate profile of you.

Moreover, I personally don't like the fact that using DuckDuckGo still helps the other major search engines - they still get data from DDG that helps them improve their search engine, thus contributing to their monopoly.

> The US is a functional democracy ...

Good for the Americans, then. Not for us who live elsewhere. The US government and courts have repeatedly applied different legal yardsticks when it comes to a citizen vis a foreigner.

> as companies found to violate the GDPR will get screwed; GDPR which also > makes the export of data very complicated, so US companies are increasingly > keeping EU data on EU servers

I don't see why you think this doesn't apply to Chinese / Russian businesses too. Ultimately if they want to do business in EU or elsewhere, they will have to follow the law of the land. Right?

> Speaking as an EU citizen, the NSA is not my enemy.

I disagree. The Five Eyes spying program is designed to indirectly spy on the citizens of their country using each others government agency, and sharing that data.

> Speaking of which, DuckDuckGo can exist in the US, but not in China or in > Russia,

And this brings another important aspect on this debate - we shouldn't be trusting private companies to protect our privacy rights and instead should be pressurizing our own government to legislate laws on this.

Most Americans somehow seem to naively believe that Apple and DuckDuckGo (for example) are working more to protecting your privacy, whereas all they are doing is slowly trying to gain your trust to get you to share more data with them. And ultimately, like Google betrayed all of us and went fully "evil", so will Apple and DuckDuckGo.

(And notice that they have already started being more invasive).

</comment></comment></comment><comment><USER68> I use bing. I dont really mind that someone is monitoring my searches and tracking my usage. I just dont want Google to dominate, so hopefully using bing helps to balance the world.

</comment><comment><USER69> Startpage.com is better and has better privacy and search results

<comment><USER70> You can use !sp from DDG.

<comment><USER71> Or just !s :)

</comment></comment></comment><comment><USER72> DDG is absolutely great! I am not sure if they are a profitable company yet? It would be great to have different players on the www again, not just monopolies...

</comment><comment><USER73> DDG gets simple things right, but for more complex queries I still have to fallback to google sadly

<comment><USER74> Can you give an example of such a complex query which performs better on google than DDG?

</comment></comment><comment><USER75> I want to use this but the scroll responsiveness is slow and it lacks a solid way to refresh.

</comment><comment><USER76> How do I make ddg the default on my old android phone?

</comment><comment><USER10> ddg is nice for the bangs (although sometimes they drop some) and for very simple queries

for the rest you're only one !g away from the usual

</comment><comment><USER77> I tried. No maps.

<comment><USER49> try again. they just incorporated apple maps

</comment></comment><comment><USER78> Startpage.com ?

</comment><comment> lota-putty searx anyone?

</comment><comment><USER79> DDG has the most aggressive and adversarial marketing by an internet company I've ever seen that's only matched in intensity by Brave browser's company. Is Gabriel trying to sell before the end of the business cycle?</comment>


MongoDB 3.2 Press Release - <AUTHOR> https://www.mongodb.com/press/mongodb-moves-deeper-within-the-enterprise <comment><USER2> Really looking forward to working with im-momnory, $relational and the BI connectors!</comment>


Intrinsic: An Open-Source, Cross-Platform Vulkan Game Engine - <AUTHOR> http://www.intrinsic-engine.com/intrinsic-available/ <comment><USER2> A game engine is mostly tools, foundations (containers, serialisation), gameplay frameworks (entities, components, AI). This is not a game engine by my definition if it's marketed as "Vulkan only". Also, I have the feeling that every game should look different and have its own art direction, being able to switch the whole rendering pipeline is essential. Why not contribute to bgfx[1] really? It's a "Graphics API", not a "game engine"...

[1] [https://github.com/bkaradzic/bgfx](https://github.com/bkaradzic/bgfx)

</comment><comment><USER3> Cached copy: [http://webcache.googleusercontent.com/search?q=cache:a-ZEjYA...](http://webcache.googleusercontent.com/search?q=cache:a-ZEjYAwxRsJ:www.intrinsic- engine.com/+&cd=1&hl=en&ct=clnk&gl=us)

<comment><USER4> also [https://github.com/begla/Intrinsic](https://github.com/begla/Intrinsic)

</comment></comment><comment><USER5> Linux section says it's coming soon.

Android says almost the same in even less certain terms.

OSX not even mentioned.

VS based builds.

Is this really cross platform?

<comment><USER6> > OSX not even mentioned.

That's because OSX does not support Vulkan.

But yeah, I hate it when projects claim to be cross-platform but what they really mean is "hope to be cross platform one day"

<comment><USER7> > _OSX does not support Vulkan_

[https://moltengl.com/](https://moltengl.com/)

<comment><USER8> Is it really accurate to describe this as a "Vulkan implementation", or would it instead be considered a "Vulkan wrapper/translation layer"? It appears to be the latter:

 _MoltenVK is an implementation of Vulkan that runs on Apple 's Metal graphics framework._

</comment></comment></comment></comment><comment><USER9> Just having taken a very quick look through the source, you should not really be doing individual memory allocations per-resource.

</comment><comment><USER10> Is Visual Studio truly a requirement? If so, no thanks.

<comment><USER11> Isn't VS the way to go for building the Windows version for many projects? Are there ways around it?

<comment><USER10> Because it says 'Cross-Platform' and is anything but with that requirement.

<comment><USER12> It says it is early and linux support is coming soon. It is open source, so you can help speed up the linux support.

</comment></comment></comment></comment><comment><USER13> Most games developers won't touch GPL3, why not LGPL? Also should games engines really have *Player.cpp/.h files?

<comment><USER14> From the home page:

OPEN SOURCE Intrinsic is available to the public domain under the GPL v3. If you're interested in licensing Intrinsic for your commercial or closed-source project (without the restricitions of the GPL), just contact me.

<comment><USER15> that's... a weird usage of the words "public domain"

also for some reason Qt is listed as a "proprietary" dependency in the readme

<comment><USER14> That's maybe because, since he's also selling commercial license, Qt must be paid for(Qt is only LGPL/GPL for OSS). Some people refer to anything not "completely" free to use, as proprietary.

It funny because his software would be "proprietary" in case that's what he actually meant.</comment></comment></comment></comment>


Partner  - <AUTHOR>

Hey Guys
I am looking for a partner who acknowledges api programming. The idéa is on paper, simple, fun and ready to go. I am based in Sweden, Stockholm. Please contact me for more information at:
email@example.com
Cheers <comment><USER2> If it's that simple I'd suggest coding it yourself.

I'm a programmer/entrepreneur and was recently approached for a 3-way split in a mobile game startup. As it stood 33% would go to an illustrator, 33% to an idea guy and 33% to me. Reviewing the situation it was obvious that only I was really bringing anything to the table (experience in the mobile market, numerous shipped software products) and that I could replace the others easily (plenty of ideas, ongoing relationships with freelance artists). Neither the illustrator or idea guy had an experience in mobile or games. So, it was likely to end up that I would contribute most of the knowledge and 80% of the work -- all for 1/3 of what I would make doing it on my own.

My point is you have zero leverage as an idea guy. If you have more than that, say, you're an artist, have plenty of money on hand or have some other skill that will make your business successful, you should talk about that. I doubt any programmer is willing to invest her time (which will be substantial, "simple" or not) in order to figure out if your idea has legs.

If you have any chance of making your project successful, you probably also have the mental tools you need to program something simple yourself. Try it out!</comment>


Earth's got a new 'moon' – here's what to expect - <AUTHOR> https://theconversation.com/earths-got-a-new-moon-heres-what-to-expect-132554 <comment><AUTHOR> Space never ceases to amaze me. This is the first I've heard of temporary mini-moons.</comment>


EverCam - <AUTHOR> https://www.kickstarter.com/projects/1116368506/evercam-the-wirefree-security-cam-with-365-day-bat <comment><USER2> The power budget is impressive to impossible. They show 4 cells of unknown specifications. Let's suppose they're 32650s, the largest listed at [https://en.wikipedia.org/wiki/List_of_battery_sizes#List_of_...](https://en.wikipedia.org/wiki/List_of_battery_sizes#List_of_Li- ion_sizes) so you get 4 x 3.7V x 6000mAh/year ~= 10milliwatt average power consumption. (or 2.7mA @ 3.7V)

Curiously, in the only datasheet I found for the IMX323 sensor, sony hasn't yet characterized the current or power requirements of the sensor -- but it's a datasheet hosted by a third party so who knows. [http://support.hkvstar.com/file/IMX323LQ-C.pdf](http://support.hkvstar.com/file/IMX323LQ-C.pdf)</comment>


Vinod Khosla: Maintain the Silicon Valley Vision - <AUTHOR> http://bits.blogs.nytimes.com/2012/07/13/khosla-the-silicon-valley-vision/ <comment><AUTHOR> I really like this quote from Vinod Khosla:

In my view, it's irreverence, foolish confidence and naivety combined with persistence, open mindedness and a continual ability to learn that created Facebook, Google, Yahoo, eBay, Microsoft, Apple, Juniper, AOL, Sun Microsystems and others.

<comment><USER2> me too</comment></comment>


Earth-sized exoplanet 'habitable zone' - <AUTHOR> https://www.nature.com/articles/d41586-020-00014-7 <comment><USER2> > _Astronomers have discovered a world only a little bit bigger than Earth, > whirling around a bright star about 31 parsecs from our planet._

Parsec is one of those units that is difficult to remember if you just look at the conversion (1 parsec = 3.26 light years). If you remember how it's defined, however, it somehow becomes easier (for me anyway). One parsec is the distance at which one astronomical unit (AU, mean distance between earth and sun) spans one arcsecond in the sky. One arcsecond, in turn, is 1/3600th of a degree, and is approximately the width of a human hair from 20 meters away.

On a side note, if you think that's small, many stars in the night sky have apparent diameters measured in thousandths of an arcsecond.

<comment><USER3> I just remember that a parsec is the same as a light year. By astronomical standards of precision, that's about right.

<comment><USER4> I remember it as 1/12th of a Kessel Run, easy peasy

<comment><USER5> The Kessel Run as performed by the Millennium Falcon; not just any ship can do that!

</comment></comment></comment></comment><comment><USER6> I've been pondering this for a while: once we have artificial gravity in space (from rotation, for instance), would we ever want to shackle ourselves to the gravity of a foreign planet? It would be so much easier just to create the ideal environment in a large, rotating cylinder instead of having adjust a planet's environment to our needs.

Take this new discovery for instance. Imagine that this planet is 400m years younger than earth. Would it have the necessary composition in its atmosphere to make it breathable? Does it share our gravity? Does it deflect enough stellar radiation?

I doubt we'll find earth 2, but we can recreate a comfortable environment in our own solar system. We just have to let go of the notion that we will colonize another planet for more than just curiosity-sake

To give some idea of what I mean by rotating cylinder, check out the O'Neill Cylinder [https://en.wikipedia.org/wiki/O'Neill_cylinder](https://en.wikipedia.org/wiki/O'Neill_cylinder)

<comment> ur-whale I think the reason earth-like exoplanets generate so much interest is not because of the terraforming / colonization potential but rather because they are more likely places where we might find alien life.

<comment> blaser-waffle We have to wonder if they're thinking the same about us.

"That 3rd planet looks easy to colonize. I wonder if there are any upright, talking primates there?"

</comment></comment></comment><comment><USER7> According to this [1] it's probably tidally locked, which means that despite being in the goldilocks zone, the environment is likely problematic for life.

[1] [https://www.sciencealert.com/nasa-found-a-tatooine-like- plan...](https://www.sciencealert.com/nasa-found-a-tatooine-like-planet-and- an-earth-sized-word-in-the-habitable-zone)

<comment><USER8> People keep saying that for extreme climates on Earth and are then constantly surprised by the variety and abundance of life - admittedly sometimes just microbiology - found in those locations. So I wouldn't write off a planet just for tidal lock.

<comment><USER9> The problem is that the atmosphere and weather is global. Meaning that snow that falls on the cold side will never melt or evaporate. Therefore there's probably no liquid water.

Liquid oxygen is dense enough for icebergs to float over to the warm side, but there won't be any oxygen before life can start photosynthesizing, and it would boil off long before ice could float close enough to the hot side to melt or evaporate. Liquid nitrogen is less dense than ice, so that doesn't help. Most other plausible liquids (methane, ammonia) are also less dense than ice.

It's difficult to say life would be impossible on a tidally locked planet, but it's certainly very unlikely. Remember that it took Earth something like two billion years to develope life, and this place is downright cozy.

<comment><USER8> Last year there was a discovery where some single cell organisms were extracting electrons directly from solid rock. So I don't think ice is a barrier.

I do agree that it's unlikely that life would exist on that planet. But I think the chances of life being slim are more down to the difficulty in the bootstrapping stage rather than the environment being too inhospitable to host life. By that I mean DNA forming (for example) might be 90% of the problem and survival might be 10%. Figures obviously made up but I hope you understand my (crudely expressed) point.

There's also the point that extraterrestrial life might not mimic the typical examples we see on Earth. In fact in plausible for silicon and/or arsenic to be building blocks for DNA and that's only narrowly widening our expectations of life.

<comment><USER9> > But I think the chances of life being slim are more down to the difficulty > in the bootstrapping stage rather than the environment being too > inhospitable to host life.

I'm 100% in agreement on this.

My argument is that with no oceans, abiogenesis is basically impossible. There's not really a useful starting point if everything is rock and ice.

I have no doubt that in 200 years a prepared group of humans could be dropped there and thrive. (transportation issues not withstanding) But life couldn't start there from nothing.

I don't think silicon based life is plausible. It can't form double silicon silicon bonds. Overall its chemistry is utterly boring compared to carbon's, and carbon is far more common than silicon is. Again, same argument. If silicon based life were intelligently created, sure, it would probably thrive. But there's no way it would spontaneously create itself. And honestly, it would probably evolve to being carbon fairly quickly.

<comment><USER8> I've read plenty of material which would disagree with your skeptisim there eg (top link in DDG)

[https://www.astrobio.net/news-exclusive/possibility- silicon-...](https://www.astrobio.net/news-exclusive/possibility-silicon- based-life-grows/amp/)

Regarding life, I don't just think human life could thrive in such environments, I think even single cell organisms could...if implanted there that is. As I said earlier, we have life on Earth in seemingly less hospitable environments like naked rock faces, sulphur-rich volcanic lakes, etc. We even have microbial life on Earth that uses arsenic as one of the chemical elements for DNA. So while 99.99% of life here does fall into a narrow spectrum, even on Earth we are constantly surprised by the ability for life to thrive and adapt in environments it classically shouldn't. Therefore I think we should be open minded to the possibility of surprises outside our own ecosystems. Albeit bootstrapping aside.

</comment></comment></comment></comment></comment></comment><comment><USER10> Not sure on the social norms here, I commented on the post of this news that didn't rise to the front :

'completes one orbit every 10 Earth days' Excellent news for fans of the French Revolutionary Calendar. 'The French Revolutionary Calendar, created at the same time as the metric system, was an attempt to create a metric calendar and time system.' [https://www.cooksinfo.com/french-revolutionary- calendar](https://www.cooksinfo.com/french-revolutionary-calendar) [https://en.wikipedia.org/wiki/French_Republican_calendar](https://en.wikipedia.org/wiki/French_Republican_calendar) [https://twitter.com/sansculotides](https://twitter.com/sansculotides)</comment>


New Zealand to sneak in Internet disconnection with quake emergency legislation - <AUTHOR> http://www.boingboing.net/2011/04/13/new-zealand-to-sneak.html

<comment><USER2> After the middle east, a lot of "democracies" are considering shutting down citizen's voices. India recently did so. Democracy's representatives find it inconvenient that citizens have a voice after elections.

<comment><USER3> Disconnecting the county's Internet from the wider Internet is not the same as 'turning off the Internet.' Citizens can still communicate with each other to organize, which is what you seem to imply that the New Zealand government is attempting to prevent.

</comment></comment><comment><USER4> Why is it acceptable in any country to sneak legislation through in unrelated bills?

Genuinely interested in how this came to be/ what can be done.

<comment><USER5> It wasn't done in the same bills related to Christchurch. Rather, during the 'overtime' to deal with the aftermath of the Christchurch quake, this bill was promoted quickly also.

Doing this speeds up the process and avoids a huge amount of oversight, consideration and public input, and has very much caught the NZ public by surprise.

It's unlikely we (NZ public) will get organised enough to change this, and past laws with significant public outcry (which this doesn't have yet) have stayed without review, as referendum's are not binding in NZ.</comment></comment>


Show HN: Perform faster root cause analysis with machine learning - <AUTHOR> http://overseerlabs.io/ <comment><AUTHOR> Hey everyone,

I was wondering if you guys could give me feedback on my latest project. We want to help metric driven companies perform faster root cause analysis. Basically what that means is when their site or service goes down, we want to dig through their metrics and help them understand what happened, so they can get things back up faster. It's a pain point that I've struggled with and now I want to solve it.

Check us out! You guys can also play with an alpha version of the product.

</comment><comment><USER2> Looks cool. It would be nice to know what the input format of the metric data is.

<comment><USER3> Thanks for the feedback! Right now, we're extracting data from New Relic/Librato, so the code expects JSON format. However, the plan is to write plugins to convert arbitrary data formats to something that the core ML stack can operate on.</comment></comment>


Sony's new PlayStation 4 and open-source FreeBSD: THE TRUTH - <AUTHOR> http://www.theregister.co.uk/2013/11/16/sony_playstation_4_kernel/

<comment><USER2> Great news! No longer to be strangled by the GPL. Erh, I guess except for the bootloader. But still :)</comment>


Don't Fear the Press - <AUTHOR> http://benhuh.org/don-t-fear-the-press <comment><USER2> Not trying to be mean here or anything, but I think this is ridiculous.

Reporters have to earn the right to have "open, real and fair" sources. Many reporters (especially unpaid bloggers) are shitty at their jobs. I'm sorry random people you interview don't trust you with their entire life story.

I'd say try harder -- whether you like it or not the person being interviewed has all the power, and that will never change.</comment>


HackrTrackr Adds Disqus forum for meetups for YCombinator Readers - <AUTHOR> http://hackrtrackr.com/ycombinator-meetup-forum.php

<comment><AUTHOR> I created a forum for meetups real fast to test the disqus software and I gotta say thats some pretty sweet stuff. This should make getting meetups planned a little easier I hope.</comment>


Security Bugs in Google Chrome Extensions (And How To Avoid Them) - <AUTHOR> http://www.adrienneporterfelt.com/blog/?p=226

<comment><USER2> It sounds like Google should be more aggressive with default CSPs.</comment>


iPhone 7 Plus: A Tale of Two Personalities - <AUTHOR> http://cellularinsights.com/iphone7/ <comment><AUTHOR> I know it's probably a bit late for iPhone 7 related reviews, but I found this website interesting in that they actually review cellular reception. It's somewhat humorous that in most smartphone reviews, actual cell reception is rarely given much attention. They have a great article on the Samsung Galaxy S7 as well.</comment>


OpSource Launches Virtual Private Cloud, Says It's Better Than Amazon's - <AUTHOR> http://www.nytimes.com/external/venturebeat/2009/08/28/28venturebeat-opsource-launches-virtual-private-cloud-says-51676.html <comment><USER2> here is the company mentioned:

<http://www.opsourcecloud.net/>

It appears they're in private beta right now.</comment>


Picture storage web site? But not flickr or picasa! - <AUTHOR>

Any good site for free pictures upload & organize & sharing that is NOT connected with Yahoo (Microsoft) or Google? <comment><USER2> <http://imgur.com> was created for Digg and Reddit about a year ago. It's _really_ simple to use and recently has seen some new features, like albums. I'm not sure if there are privacy settings of any sort, since I haven't uploaded anything recently, with the new revision of the service.

<comment><USER3> As I understand it, its privacy by obscurity. There's no search, so unless you share the URL or its discovered, it would be private. That may or may not work for you.

They have a $3/month plan that gives you flickr like features (large uncompressed images, unlimited storage), and an API (free, but no commercial use w/o consent). Looks pretty solid if you're intent on avoiding a large company.

</comment></comment><comment><USER4> I know it's not free, but I use and love SmugMug. Granted it is targeted toward amateur and pro photographers.

It's only $40 a year. The galleries look awesome. There are no ads. Unlimited storage. No limits on image sizes. Galleries can be viewed as a slide show. There's an iPad app (Meh).

You can also upgrade to a pro-level account and actually sell your pics for a profit, as digital assets, prints, or merchandise.

<comment><USER5> Another vote for SmugMug. Pro accounts can also do custom homepage design, you can create a CNAME for a domain you own that points to your SmugMug homepage, the forums are great, and they offer an extra-cost "vault" feature for backing up RAW images or other originals.

</comment></comment><comment><USER6> photobucket?

If you're not adamant about 'free', zenfolio [<http://www.zenfolio.com/zf/pricing.aspx>] is very nice, and quite affordable.

<comment><USER7> If he doesn't like Yahoo, Microsoft and Google he sure isn't going to like News Corp. That and Photobucket is a bucket of crap.

<comment><USER8> I believe NewsCorp just sold Photobucket?

</comment></comment></comment><comment><USER9> zooomr.com is worth a try. 23hq maybe too. tried photobucket?

<comment><AUTHOR> zooomr.com is currently not open for registrations - they will be soon. I will keep an eye on it.

</comment></comment><comment><USER10> Why did you put "Yahoo (Microsoft)"

Yahoo doesn't own Microsoft.

<comment><AUTHOR> Microsoft owns Yahoo. And thats enough for me to stay away form Yahoo. But thats just me. Everyone is free to decide whats good for him...

<comment><USER11> I'm sorry that Yahoo hasn't invested enough in evangelists to stop people like you from spreading FUD like this.

* Yahoo established a relationship with Microsoft. The relationship involves refactoring both Bing and Yahoo Search to use the same web index.

* The crawler, storage and serving infrastructure for web indexes are capital intensive. It has nothing to do with technology -- it amounts to buying up farmlands in Idaho to store millions of computers.

* Hence, it's simply about whoever has the largest pile of cash. Since Yahoo's pile of cash is tiny compared to Google, the ONLY way to stop Google from a monopoly is Microsoft.

* This lets Yahoo concentrate on improving search outside of the boring parts of search. They're calling this the "death of the 10 blue links". If you see yahoo search today, they're ahead of Google on this.

* Outsourcing capital-intensive parts allows Yahoo to innovate on things that they are VERY good at: content optimization, display advertising, and editorial content.

* Thanks to this deal, Yahoo also now owns 100% of the display advertising market outside of doubleclick. This includes all Microsoft properties. What's important to note is that Facebook has a display deal with Microsoft till 2011.

I hope that makes it clearer. Yahoo is not MS's bitch. MS is not Yahoo's bitch. This is a strategic partnership. This happens in business.

<comment><AUTHOR> Thank you. You're all right of course - I don't argue. You have my 1 point for your evangelism.

As I say before - I expressed only my personal opinion and I don't have any intention to start discussion or flame war on that matter. Can I express my opinion or it's not allowed? I simply don't like Microsoft/Google and the way they do business - is there anything wrong with that? Or we all MUST adore and love Microsoft and Google? Of course all these questions are rhetorical and I don't demand answers.

Wish you all the best.</comment></comment></comment></comment>


Facebook's Thrift Project officially in Apache Incubator - <AUTHOR> http://www.facebook.com/note.php?note_id=16787213919

<comment><USER2> I really admire the Facebook developers for this kind of thing.

It's great that they give away cool stuff they've developed.. as well as contributing to other open source projects.</comment>


Show HN: Meekan, Slack scheduling robot: matches availability, syncs calendars - <AUTHOR> http://meekan.com/slack

<comment><USER2> Hey, not OP, but dev and founder here.

What do you think of the domain? Of the bot approach? Of scheduling meetings in general?

Thanks!</comment>


New York Times Launches Facebook App - <AUTHOR> http://www.readwriteweb.com/archives/new_york_times_launches_facebook_app.php <comment><USER2> Well, I need this explanation. Do Facebook Apps need to drive revenue or page views on the sponsor's website to be valuable? Aren't they valuable enough as a matter of branding?</comment>


Peeking under the hood of redesigned Gmail - <AUTHOR> https://medium.com/@boriscoder/peeking-under-the-hood-of-redesigned-gmail-dd84b532e0f5 <comment><USER2> It's surprising to me that Gmail doesn't take more advantage of code splitting and lazy bundle loading -- I wonder if it's common practice among "modern" JS apps (i.e. the Angular-using ones like Cloud Console), but difficult to do with GWT.

</comment><comment><USER3> This article barely mentions GWT. Is Gmail still officially a GWT app? Wappalyzer seems to think so, if not GWT by name, it identifies the programming language as Java.

</comment><comment><USER4> What was the goal of the redesign? Did anything positive come from it?

<comment><USER5> Someone's promotion.</comment></comment>


Here Is The Plan Marissa Mayer Just Announced To Yahoo Employees - <AUTHOR> http://www.businessinsider.com/here-is-the-plan-marissa-mayer-just-announced-to-yahoo-employees-2012-9#ixzz27Z0TXfHV

<comment><USER2> It all sounds very great without anything really insightful (and of course implementation is the real hurdle). Except I'm unsure of doing pure "acqui- hires". If you're not interested in the project you just get people you risk loosing in the near future once the handcuffs come off. It seems an potentially expensive medium term strategy that is not scaleable. Why not put that money into teams and projects you want? Or fund your employees that have ideas?</comment>


Introducing Passion Projects: A Short Documentary Series - <AUTHOR> https://github.com/blog/1637-introducing-passion-projects-a-short-documentary-series

<comment><USER2> Embedded video isn't displaying in Firefox, due to mixed content. Edit: Fixed

Here's a direct link to the video. [http://www.youtube.com/watch?v=3GeKarLwfqA](http://www.youtube.com/watch?v=3GeKarLwfqA)</comment>


Hacking BIOS chips isn't just the NSA's domain anymore - <AUTHOR> http://www.wired.com/2015/03/researchers-uncover-way-hack-bios-undermine-secure-operating-systems/ <comment><USER2> Automated discovery and exploitation of architectural flaws is merely the next step in the evolution of software. For the past few years we have been witness to a 'whack-a-mole' type of dynamic in the field of computational security. Exploits are published, a day later they become a Metasploit module, and a day after that anybody in the world can use it on everyone else in the world at the click of a mouse. If you are a full time sys-admin plugged into all the advisory mechanisms you may, for a time, be able to keep your systems patched, but the machines never sleep, they never blink, they never forget, and apparently, they never die.

In the race against time, it is fair to say at this point that the machines have won. It may not be completely obvious yet, in the way that a tidal wave out at sea is only a small hump under your individual ship, but when it comes ashore, when the confluence of terrain and massive liquid power becomes manifest, then, of course, it is obvious.

What appears to be happening is a kind of terra-forming activity, a new software layer is spreading, one that has the keys to everything - our social lives, our morning cup of coffee, our cars.. our nukes.

This has an end condition, of course - and that is the total loss of control over our technological infrastructure.

<comment><USER3> "It might be argued that the human race would never be foolish enough to hand over all the power to the machines. But we are suggesting neither that the human race would voluntarily turn power over to the machines nor that the machines would willfully seize power. What we do suggest is that the human race might easily permit itself to drift into a position of such dependence on the machines that it would have no practical choice but to accept all of the machines decisions. As society and the problems that face it become more and more complex and machines become more and more intelligent, people will let machines make more of their decision for them, simply because machine-made decisions will bring better result than man-made ones. Eventually a stage may be reached at which the decisions necessary to keep the system running will be so complex that human beings will be incapable of making them intelligently. At that stage the machines will be in effective control. People won't be able to just turn the machines off, because they will be so dependent on them that turning them off would amount to suicide."

<comment><USER4> is that from the unabomber manifesto?

<comment><USER5> For those wondering whether parent comment is hyperbole: yes, that is quoting Ted Kaczynski's manifesto.

</comment></comment></comment></comment><comment><USER6> In my view this is a result of hardware not actually being "hard".

It would be far better to have a bug that comes back after a cold boot, as part of a known starting state, than to have a mechanism for "updates" (running software) that is inaccessible to the user/programmer. A static bug can be worked around, but a moving target is harder to compensate for, particularly if it is not viewed as user-programmable (for lack of documentation, or license, etc).

To me, this demonstrates that the proper place for security is in software, at as high a level as possible for the purpose. Even secure boot is too low. Boots should be insecure, but repeatable. Turning a computer on should give full control - only then can you lock it down (whatever that means to the user...). Secure boot, if you want it, should just be a bootloader that verifies a payload, thereby protecting itself - not a BIOS-integrated feature, where the BIOS is opaque.

A feature-full BIOS would only makes sense if it were immutable (and even then, there would be disadvantages), or (at the other end of the spectrum) if it were as programmable as the rest of the system - but until then, any unnecessary complexity or "features" are downright harmful.

<comment><USER7> To do that, you'd also have to harden everything - including the hard drive's firmware - so you get the proper boot sector.

Not all bios bugs can be worked around in firmware -- if the memory controller isn't initialized correctly, all processing is suspect. And if the manufacturer can't fix a bios, then it falls on the shoulders of the OS writers -- who do not have neither the motivation to fix 100's of board- specific problems. Worse yet, if I wanted to inject malware, I would pretend to be a motherboard manufacturer and submit bad kernel code to beleaguered OS people.

</comment></comment><comment><USER8> In my opinion it isn't a bad thing because in the future, when Microsoft disallows disabling secure boot, using BIOS vulnerabilities will be the only way to install an unsigned operating system.

<comment><USER9> > it isn't a bad thing

What isn't a bad thing? Shitty security in BIOS chips? Instead of reformatting your disk you have to detach eeprom chip that holds bios from mobo and connect it to another system to inspect it for infections / changes. I'm not sure this is even possible for most mobos and it doesn't cost nothing like reformatting disk costs nothing.

EDIT:

> using BIOS vulnerabilities will be the only way to install an unsigned > operating system.

Then I would rather not use those systems.

Android phones are already at this level - I could run CyanogenMod but I'd have to first run a random blob I refuse run because there is no way to verify what that blob does. I'm screwed both ways. At these moments I remember Stallman wasn't completely crazy and wish Linux was licensed under GPLv3 so that the phone I bought wasn't tivoized.

<comment><USER10> >At these moments I remember Stallman wasn't completely crazy and wish Linux was licensed under GPLv3 so that the phone I bought wasn't tivoized.

In which case Google would most likely simply have used a BSD variant as Apple did.

<comment><USER11> Ha. The strange thing about stallman is that his words of 'craziness' magically convert to words of wisdom, but there is always a delay in that process, which can go up to decades. This happens _always_. Joke's on us, despite knowing about this phenomenon, we never adjust for it.

</comment></comment></comment></comment><comment><USER12> I'm reasonably technical but had no idea I was supposed to be security- patching my BIOS. I googled and found that (1) most of the articles about updating BIOS don't mention security, (2) finding BIOS updates for your hardware isn't necessarily trivial, and (3) applying the update is a fairly involved process with some risk of bricking your computer.

Is there any way hardware manufacturers could make it as easy as OS updates?

<comment><USER13> The mainboard I use has an autoupdater in the setup screen. Connects to LAN (DHCP), requests updates, installs them.

UEFI also allows updating from within the OS, and it looks like they formalized things a bit more, so that can be streamlined. (see [https://blogs.gnome.org/hughsie/2015/03/03/updating- firmware...](https://blogs.gnome.org/hughsie/2015/03/03/updating-firmware-on- linux/))

Then again, this is only necessary because UEFI is more complex than some operating systems, and thus provides the attack surface that they then have to defend like that.

</comment></comment><comment><USER14> A lot of these reflashable ROM exploits can be prevented with the simple addition of a physical switch or jumper that controls the write signal. With the writes physically disabled, no exploit would survive rebooting the system.

Device makers can add such switches as a simple way to advertise being secure. I'd pay a few dollars extra for such, for example, hard disk drives that cannot have their firmware altered, and car computers that cannot be altered, etc.

</comment><comment><USER15> Naive question: Is Core Boot in any way a potential remedy for the sad, sorry situation we're in here?

I wonder when there will become a market for manufacturers to start releasing devices with hardware DIP switches or jumpers that need to be bridged for flashing purposes.

<comment><USER13> coreboot has a very different architecture, and we try to avoid having it parse external data (except for hardware registers). It also has next to no presence during the runtime of the OS (no API for the OS to call into, and to exploit) - which is part of the "no external data" approach.

It's also much smaller: A minimum UEFI for QEmu that can barely boot into Linux loaded from SATA is 120kloc, coreboot (plus payload) for the same purpose are about 20kloc.

These differences should stop some of the exploit approaches right from the start.

Regarding the switches/jumpers, hardware is now complex enough to set up that a wakeup after suspend requires more data than what CPUs can store by themselves to revive memory without data loss. That data ends up in flash, so something needs to change in that area before a flash chip could be write protected with a jumper.

(Disclosure: I'm a coreboot developer and no fan of UEFI)

<comment><USER16> Motherboards were produced with flash write-enable jumpers around the end of the last century, but my guess is that the cost savings of omitting the part and not requiring users to physically move the switch whenever reflashing BIOS, combined with what seems to be now perpetually buggy BIOSes needing constant updates, made them disappear. I think it's still a good idea, however.

 _Regarding the switches /jumpers, hardware is now complex enough to set up that a wakeup after suspend requires more data than what CPUs can store by themselves to revive memory without data loss. That data ends up in flash, so something needs to change in that area before a flash chip could be write protected with a jumper._

How much data is this? I thought it'd be stored in the CMOS NVRAM, which could be a better design.

<comment><USER13> CMOS NVRAM addresses 256 bytes (minus 16 for the clock).

Unfortunately that's not enough. Maybe things could be stored smarter, given that the data should have some structure, but the raw format is ~2000 bytes, IIRC.

</comment></comment></comment></comment><comment><USER17> so...I see a nice thread here without a link to the researcher's actual work... speculate and bloviate much? [http://legbacore.com/Research.html](http://legbacore.com/Research.html)

</comment><comment><USER18> Are these vulnerabilities exclusive to UEFI BIOS? The more I learn about UEFI, I am left with the feeling it is nothing but a wide open back-door and a method to "brick" pc's.

<comment><USER13> UEFI is designed to scale up - servers that can boot from network, which brings a certain baseline complexity. It doesn't help that the designers didn't want to set any rules and run everything through a central, extensible function call dispatch.

The effect is that UEFI can load and run executables (from flash, disk, network), has a network stack and things like openssl (when did you last update your firmware's SSL implementation? :-) ), all of which process lots of ingress data - while maintaining a larger degree of control over the system than the OS that comes after it.

So, it's not UEFI-specific per-se, but UEFI's design was optimized for the large scale (it pretty much started on Itanium, so there) and at a time when security wasn't much of a priority.

Now they sit in that corner and look for ways out. Such as signature checks on executables (Secure Boot).

</comment></comment><comment><USER19> These are really stupid people who want to fight God, LOL.

Guess who wins when you fight God?

<comment><USER20> No one, because God doesn't exist.

<comment><USER21> _tips fedora_

<comment><USER20> your preference for linux distributions is unrelated to my comment</comment></comment></comment></comment>


GitHub Styleguide - CSS, HTML, JS, Ruby - <AUTHOR> https://github.com/styleguide/ Welcome to the GitHub styleguide. This is where you should look if you're interested in how to write code. We have a living CSS styleguide, JavaScript styleguide and some recommendations on how to write Ruby code. <comment><USER2> The HTML guide should say: don't write <img> tags which set an image's size to 4x less than its original size, it will look pixelated.

Also, the first page says _Contribute!_ , but there's no link to any sources.</comment>


Wolverines: The Future of Search and Rescue - <AUTHOR> http://www.outsideonline.com/2067281/wolverines-future-search-and-rescue <comment><USER2> There was a Soviet study back in the day that domesticated wild foxes in just a few generations. While the article talks about training them in captivity, a few generations of selection for human-friendliness might do an even better job of ensuring they don't injure their handlers or avalanche victims.

[https://en.wikipedia.org/wiki/Russian_Domesticated_Red_Fox](https://en.wikipedia.org/wiki/Russian_Domesticated_Red_Fox)

</comment><comment><USER3> Wolverine's are awesome and I have no doubt they could be be trained for this.

However I'm not sure it makes any sort of economic sense due to the difficulties in breeding and keeping wolverines and the need for avalanche rescues to happen extremely quickly.

Statistics show that avalanche rescue needs to happen in less then 10-15 minutes for a victim to have a good chance of survival. Backcountry skiers wear radio transceivers so their partners can respond instantly for this reason.

Big ski areas will have a few trained dogs who hang out in ski patrol shacks at the top of runs so they can be deployed quickly in the event of a rare inbounds slide that traps people not wearing beacons.

Any backcountry skier who takes risk and safety seriously will tell you that dogs, and even beacons are really just for body recovery though and avoidance is key.

<comment><USER4> The dogs are the product a thousand generations of selective breeding. Both a labrador and a wolverine could kill me, but I wouldn't want to be stuck in a gondola with the later.

> even beacons are really just for body recovery though and avoidance is key.

In my day (more than a decade ago) there was much debate about the beacons giving people too much confidence, that they caused more accidents than they saved lives. I always used them, but understood why some disliked their effects. I shutter to think what would happen should someone develop a smartphone app to 'replace' traditional radio beacons.

Imho the real dangers came from speed. Snow machines and helicopters moved people through terrain without them spending the time to know the snow. When you spend most of the day walking up a hill you have a better appreciation for what is happening under your feet.

<comment><USER5> A lab, kill a person? An adult?

If you've ever had large dogs, and played with them - they're really not remotely formidable opponents. Anything but maybe the largest breeds bred for fighting doesn't stand a chance against a person who's wrestling/grappling them, they're not flexible or muscled in the right ways.

A wolverine though? I've never interacted with one, but I do know what ferrets are like - small, terrifying balls of pure muscle that can bend and twist every which way and are unbelievably fast. That's scary enough in a ferret size package, but a wolverine? Oh HELL no.

<comment><USER4> My lab-bernese cross is 80lbs. She's a big puppy, but her arms are as long as mine. If she was so inclined, she has the teeth to tear my throat out. We forget how powerful a dog can be because that part of them hides behind the breeding. We have both evolved to not be afraid of each other.

I once read an old army survival manual that mentioned fighting guard or search dogs. If one dog, attack from low upwards. Go for the soft parts of the throat, rather than raining blows from above. But if facing two dogs, run.

<comment><USER5> You must have play fought with your dog from time to time though, right? You certainly have an idea of your relative strengths. How does it usually go?

I've had dogs and had experience with many more, often playing very rough with them, and I've had to break up fights between dogs which generally meant me being directly in the middle. A dog is remarkably easy to pin and subdue such that they are completely at your mercy and those teeth can't do one bit of good.

Yes, if it's a dog that actually wishes you harm you're going to get chewed up in the process, but still - worst case, as long as you keep your head you can end the fight with at worst a chewed up arm.

Btw, I completely agree with what the survival manual says, including if there's two dogs.

I maintain that a wolverine that actually wanted to kill you would be a completely different story. WTF would you do? I have no idea. How would you fight an animal that's been known to kill bears? Dogs (singly) don't fight bears and win, ever. Wolverines do.

Which would you rather fight?

</comment></comment></comment></comment></comment><comment><USER6> I just found a beautiful red fox in my front yard. It was stretched out as if sleeping on the grass: dead and probably hit by a car, sad.

It really was a lovely animal except for one thing, in comparison to a similar sized dog its mouth was full of sharp teeth and the muzzle gave the impression of being more feral. I think a live wolverine's mouth would be even scarier. Maybe a muzzle with a red-cross on it over the wolverine's mouth would make it less terrifying to a trapped victim.

Dogs have teeth smaller than similar wild canine species. The suggestion is that there has been (human driven) selective evolutionary pressure during the 20,000 years or so of dogs domestication to make them more compatible with life around humans. [1]

[1] [https://en.wikipedia.org/wiki/Origin_of_the_domestic_dog](https://en.wikipedia.org/wiki/Origin_of_the_domestic_dog)

</comment><comment><USER7> The linked video in the article isn't very impressive from a scientific point of view (i.e. it could smell the owner doing the burying etc).

But it is super cute! [https://youtu.be/nNgv3opJqoQ](https://youtu.be/nNgv3opJqoQ)

</comment><comment><USER8> Very interesting, but one more snag might be the way people will tend to react to a wolverine snout suddendly erupting through the pile of snow trapping them (like in the video). Personally, if I was ever trapped and any wild animal came near me I'm pretty sure I'd scream my lungs out and kick with all the strength left to me. Trained wolverines will have to be marked very, very clearly to avoid this sort of reaction.

<comment><USER9> Looked at some pictures, they don't look that much scarier then a dog. I would probably like YES I am free, with a CRAP what is that ?!?

<comment><USER10> They're fascinating animals. They are also apparently one of the most aggressive animals in the world, and pound for pound the most formidable. I'd be much more scared of a wolverine than any dog. Besides the teeth, with which they can crush bones like a hyena, they also have huge claws. They're worth reading about (and avoiding fights with).</comment></comment></comment>


Fyre Festival founder arrested, charged with wire fraud - <AUTHOR> https://www.engadget.com/2017/06/30/fyre-festival-founder-arrested-billy-mcfarland/ <comment><USER2> From section 1394 of the penal code (FyreWire (fraud)) ;-)

</comment><comment><USER3> Aha, I _knew_ there was a name for that!

</comment><comment><USER4> He's gonna be a legend, bro!</comment>


The smug style in American liberalism - <AUTHOR> http://www.vox.com/2016/4/21/11451378/smug-american-liberalism <comment><USER2> Note though you have to divide it into two camps: there is a "smugness" associated with Hillary Clinton and a "smugness" associated w/ critics of Clintonism such as Thomas Frank and those aren't the same thing.

Note the Republican establishment also is "smug" towards Trump voters.

Practically both sides of the establishment "use" voters by pushing a few hot button issues. For instance, the Keystone XL pipeline was neither going to destroy the Earth nor was it going to revitalize the US economy. While people were arguing about that, they were not talking about any real environmental or economic issues. (Looking at the oil price drop recently, I wonder if the government saved Transcanada a huge amount of money by stopping Keystone XL.)

<comment><USER3> > there is a "smugness" associated with Hillary Clinton and a "smugness" > associated w/ critics of Clintonism such as Thomas Frank and those aren't > the same thing

That's just internecine strife between the centrist and radical wings of the party. Contempt for those who don't embrace the same precepts they do is common to both.

<comment><USER2> This is true for the right wing too. For instance, I remember Rush Limbaugh talking in 2008 about how he wanted the Obama administration to fail, which unfortunately is a matter of our people failing, our armed forces failing, our businesses failing, etc.

</comment></comment></comment><comment><USER3> Dup checking seems like it should've caught this: [https://news.ycombinator.com/item?id=11545169](https://news.ycombinator.com/item?id=11545169)

<comment><AUTHOR> I was under the impression that HN warned about submitting dups, so I didn't search for any duplicates. Regardless, HN also allows for resubmissions if something doesn't get "enough" burn during previous submissions. I think this might thus qualify for a duplicate submission.</comment></comment>