The most important entrepreneurial lesson I've learned. - <AUTHOR> http://www.workhappy.net/2012/03/the-most-important-entrepreneurial-lesson-ive-learned.html

<comment><USER2> "This is why building an MVP, and validated learning are so important. Before we get too carried away, we have to find out if the market wants what we're building." Spending more time on an idea without getting substantial success may lead to 2 things... 1. Either you loose interest and quit where the product actually might have been valuable if it would have seen the light of the day. 2. You take it to your heart that even if there is no real market-fit you still keep working on it.

Either of them are dangerous for an entrepreneur. "Fail fast fail often" is the way to go.

"Speed is the essence of war" - Sun Tzu (The Art of War). We can safely say that it applies to startups too.</comment>


Ask HN: What's the most expensive physical item that can be bought online? - <AUTHOR> - There has to be a URL to a webpage indicating that a particular item (not a quantity or bundle) is for sale, along with a specific price.
- You have to be able to add it to a shopping cart and checkout with payment by cc or wire transfer.
- You take delivery and physical possession of the actual item, and that is the end of the transaction.
- Must not require any interaction with a salesperson, no extra contracts that need to be signed, etc
- No equities, real estate, or intangibles.
- Must be multiple available (no one-of-a-kind items, no bay, etc).  Enough for anyone in this thread who can afford one to be able to get their own.
- No simple pricetag mistakes.
- The price can be in any currency but should be converted to USD in the comment.
- Must be able to order in the U.S.
- Extra credit if they accept bitcoin or international orders.
This rules out all of the entries on the "most expensive things ever purchased online" lists and everything else that comes up from a cursory search.
The best I've found so far is a 1 kilo gold bar: http://www.jmbullion.com/gold/gold-bars/ for $40k <comment><USER2> There is a Sony television (FWD100Z9D, 100 inch) that, for reasons I do not understand, sells for $50.000+ ($55,372.49 at [https://www.bhphotovideo.com/c/product/1294133-REG/sony_fwd1...](https://www.bhphotovideo.com/c/product/1294133-REG/sony_fwd100z9d_100_uhd_hdr.html))

I won't try, but I think googling for a NAS with terabytes of SSD (or maybe, even RAM) could give a good contender, too.

</comment><comment><USER2> BMW sells online (example:'[http://www.bmw.co.uk/vc/ncc/xhtml/start/startWithModelSelect...](http://www.bmw.co.uk/vc/ncc/xhtml/start/startWithModelSelection.faces?productType=1&brand=BM&market=GB&country=GB&locale=en_GB)), and has more expensive cars.

I'm not sure they sell in the USA, though.

</comment><comment><USER3> Didn't spend a lot of time on this, but most expensive I could think of was this PoE card which could be yours for a measly $50.000 USD: [https://www.amazon.com/NETWORKS-BlackDiamond-1000BASE-T- opti...](https://www.amazon.com/NETWORKS-BlackDiamond-1000BASE-T- optional-41517/dp/B00FMNIV56/ref=sr_1_1?s=pc&ie=UTF8&qid=1488447527&sr=1-1&keywords=monitor)

</comment><comment><USER4> Oh, that's easy. Just take a look at camera (tele) lenses: [https://pixsy.com/most-expensive-camera-lenses-ever/](https://pixsy.com/most- expensive-camera-lenses-ever/)

<comment><USER5> 1\. Is a custom job

4\. and 5. are cheaper than OPs gold bar example

2\. likely was never regularly sold online, and if it were newer it would be similar to 3.

3\. might qualify, depending on how the ordering process actually went -> back when it was available I've seen it in camera sellers catalogues, but it was made only when somebody ordered one, so it quite likely wasn't just shipped out without any extra process.</comment></comment>


Ross Ulbricht Sentenced to Life in Prison - <AUTHOR> http://techcrunch.com/2015/05/29/the-silk-roads-ross-ulbricht-sentenced-to-life-in-prison/?ncid=rss <comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=9626985](https://news.ycombinator.com/item?id=9626985).

<comment><USER3> And bury the thread people actually care about. Way To Go.

<comment><USER2> I don't know what thread you're referring to, but [https://news.ycombinator.com/item?id=9626985](https://news.ycombinator.com/item?id=9626985) is at #10.

<comment><USER3> sorry, I'm newish to HN but when you merged the threads it had been off the front page

</comment></comment></comment></comment><comment><USER4> In case anyone wondering why there's so little discussion in this thread: There's another thread that has many more points and has a shorter age than most stories on the HN front page that (apparently) the moderators of HN have chosen to penalize for unknown reasons: [https://news.ycombinator.com/item?id=9626985](https://news.ycombinator.com/item?id=9626985)

<comment><USER5> Welcome to ycombinator where things get moved on a moderators whim. I am working on a analysis of how often this occurs btw so we shall see soon how prevalent this is</comment></comment>


Will you become a citizen of Asgardia? - <AUTHOR> https://www.theguardian.com/science/2016/oct/12/will-you-become-a-citizen-of-asgardia-the-first-nation-state-in-space <comment><USER2> This is an interesting concept. And while I feel that of course this one will be doomed, maybe it can open discussion on what we will do with the concept of nations once we enter space.

For example: a colony is settled on Mars, with astronauts from various countries. They stay, what would their, or their children's nationalities be?

And yes, I did sign up to become a citizen :)

<comment><USER3> They'd be a colony only until they were self-sufficient. Then they'd become a nation through declaration and maybe war.

</comment></comment><comment><USER4> Their founder are planning to use URBOCOP (as I understand) -[https://room.eu.com/article/urbocop-saving-planet- earth](https://room.eu.com/article/urbocop-saving-planet-earth)</comment>


Your data was probably leaked with 200M records from mysterious database - <AUTHOR> https://cybernews.com/ <comment> java-man I don't undertsand how this database can be "mysterious". There are logs, accounts, playment records - a single subpoena should resolve the mystery in 10 minutes (or whatever time is required to pull the data).

Or am I totally wrong?

</comment><comment><USER2> At this point i think everyone had their data leaked

<comment><USER3> It's crazy when you strat thinking how easy these things are really, just need a motivated person to fuck shit up and youre there

</comment></comment><comment><USER4> That's a lot of tax records... Just in time for tax season</comment>


Turn Your PC into a DVD Ripping Monster (Linux Version) - <AUTHOR> http://www.linuxhaxor.net/2008/03/26/turn-your-pc-into-a-dvd-ripping-monster-linux-version/

<comment><USER2> dvd::rip is a decent piece of software and all, but to be honest I think 99% of people here could type 'rip dvd linux' into google, so I'm not entirely sure how a simple how-to warrants a post to HN.

There, I've done it. I've degenerated into bashing the quality of submissions here too now.</comment>


Ask HN: Xcode 4 Instructions? - <AUTHOR>

Does Xcode 4 have any documentation or instructions available? I've looked, but can only find tutorials for Xcode 3. <comment><USER2> Help menu -> XCode User Guide ?

You can also get it all offline by going to Preferences -> Downloads, clicking the Documentation tab and selecting what you want installed e.g. iOS 6.0 Library.

<comment><AUTHOR> Thanks. I didn't know about the downloads.</comment></comment>


Google cancels domain registration for Daily Stormer - <AUTHOR> http://nordic.businessinsider.com/google-cancels-domain-registration-for-daily-stormer-2017-8?r=US&IR=T <comment><USER2> This seems like a clear case of GoDaddy and Google stopping political speech they disagree with, not because of illegal activity.

"The story, which attacked Heyer for her physical appearance and referred to her using various offensive epithets, prompted GoDaddy to give Daily Stormer 24 hours to find a new host for its domain."

They'll remove your domain for insulting someone? The internet is full of personal abuse. That can't possibly be the reason.

<comment><USER3> Go to the website yourself if you'd like to see what kind of stuff they are up to.

<comment><USER2> It seems to be down at the moment. But any amount of insults are still just insults. Illegal activity is different, but they're not claiming that's the reason, and it it was, the police should handle it.

I can understand a more "private" service like Twitter blocking cyber bullying, but domain names are part of the infrastructure. People depend on them much more.

<comment><USER4> Google and GoDaddy are private businesses. They are allowed to not do business with sites they find repugnant if they like.

The current headline on the Stormer is "Badass Cop Expresses Full Support for Running Over Fatties Charlottesville-Style" by the way. If I was running the domain registrar I'd have little enthusiasm for Nazi enthusiasts encouraging murder either.

</comment></comment></comment></comment><comment><USER5> So you may like Google's and GoDaddy's reaction in this case. be But try to think what could happen if this was the norm. Comcast could refuse to provide their services to sites that talk about Google fiber. Google could remove Bing from 22.214.171.124. T-Mobile could block calls to Sprint.

Some of what I listed are currently illegal, but are they in essence different? With rumors that the current administration might remove net neutrality, things like this will only encourage them to.

<comment><USER6> You're equating racists crowing over the death of someone at the hands of a racist (that was in all likelihood a reader of their site) with "sites that talk about Google fiber".

I mean, I've seen some daft "whataboutisms" this past week but this is amazing.

<comment><USER5> Lets say that in this case you are right. Who decides where to draw the line between talking about Google fiber and "crowing over the death of someone"? If we were in Italy in 1610 writing that the Sun was the center of the solar system would be hate speech. If we were in Germany in the 1930s the government would tell us that writing that Germans are not the master race is hate speech. If we were in the US in the 1950s saying that Communism is good would be hate speech. If we were in current China saying that the Tibet is not part of China could be considered hate speech. Maybe in a little while the current US administration will say that writing that climate change is caused by humans is hate speech.

But more importantly, Google made the decision not due to laws that were created by the elected officials but rather based on how they felt. Imagine if a Catholic hospital refused service to anyone who suggested that people should read books from the banned book list. After all, the reason that they are on the banned book list is because someone decided that those books were hateful.

I don't understand how this is whataboutism.

</comment></comment></comment><comment><USER7> I have several domains with light use or "parked" with Namecheap. A month or two ago, there was a story about their giving someone the boot because they "violated Namecheap's TOS". I seem to recall that said "breach" was weaker and more questionable as well as being based in apparent mis-understanding on Namecheap's part.

At the time, this caused me concern WRT whether more or _all_ domain name registrations might end up subject to the will and whim of individual registrars.

Might I lose a domain due to some arbitrary decision by Namecheap? How long would I have to "rescue" it? What if I was traveling? I do travel to some remote places, occasionally.

Now, it starts to seem indeed more like one's presence in the DNS is or will be subject to the tastes and discretion of the private companies that are the registrars taking, holding, and managing these registrations.

As a famous movies says, "I hate Illinois Nazis."

But DNS should be managed technically, not emotionally.

Not looking forward to the "Great Corporate Firewall" any more than I've not enjoyed the Great Chinese Firewall, et al.

P.S. I guess I should read the article. It will probably be some disgusting behavior that more than half makes me want to change what I've just written.

But, I keep seeing the "open" net being chipped away at. And I'm not sure how or who we trust to draw the line between what's acceptably open and what's not.

P.P.S. Oops, I did already read it. But I didn't see the denigrating article nor much detail about that article, in it. However, I'm guessing it may be the one that a friend shared -- copy/pasta, without linking, by the way; no brownie points for the authors -- because it was so disgusting and offensive, she thought all her friends should be aware of the filth emanating from these people.

It was really damned offensive, and cruel.

Makes me a bit worried about what I wrote, above. Nonetheless, I'm also very worried about DNS becoming a political and emotional football.

<comment> g-clef Everything you do is political in some way. Saying that you're worried about DNS becoming a political football implies it isn't already. It is. From ICANN's self-serving lunacy (don't lift that rock unless you have time to go down some very deep and fairly scuzzy rabbit holes), to domain seizures by governments (and private companies like Microsoft), DNS is already political. So is every other part of the internet infrastructure. Examples: the great firewall of china, registering to get porn in the UK [1], payment processors refusing to handle donations to Wikileaks [2].

The question isn't "should DNS and/or Internet infrastructure be political?"...because it already is. The question is "whose politics should it follow?"

[1]: [http://www.businessinsider.com/uk-government-force-porn- site...](http://www.businessinsider.com/uk-government-force-porn-sites-age- filters-credit-card-checks-2017-7)

[2]: [https://www.wired.com/2010/12/paypal- wikileaks/](https://www.wired.com/2010/12/paypal-wikileaks/)

</comment></comment><comment><USER8> It's more concerning that we oppose censorship until the censorship starts aligning with our moral compass.

<comment><USER4> Dunno - I'm fine with opposing censorship apart from stuff like child porn. What's so bad about moral compasses?

<comment><USER9> Everyone has a different one.

</comment></comment></comment><comment><USER10> The site has been organzing and inciting a political movement whose endgame is genocide. They are not coy about this. Inciting violence is not legal.</comment>


iOS 10 to Feature Stronger "Limit Ad Tracking" Control - <AUTHOR> https://fpf.org/2016/08/02/ios-10-feature-stronger-limit-ad-tracking/ <comment><USER2> My expectation is that more and more apps will push for user authentication, at which time they will send some sort of hashed identifier to any number of cookie onboarding services that can then identify the user for ad networks (and pay the game owner a CPM rate based on successfully matched IDs).

A large part of the reason Google has been pushing to search while signed in over the past few years has been related to cross-device tracking and attribution.

For those that are not familiar with the problem advertisers face here... In short, if someone sees/clicks an ad on one device, and then converts on another, most of the time that tracking is lost unless you have the right tech setup and are passing some sort of unique identifier. This can have the effect of causing mobile or tablet traffic to look like it doesn't perform, just as an example. That in turn impacts budgeting and optimization decisions that could cause an advertiser to shoot themselves in the foot due to reporting limitations. Frequency capping is also important. Advertisers don't want to show more ads than they need to, and without the ability to identify a device, they can't set that limit, so you might see the same ad for the same advertiser nonstop.

Not arguing whether more tracking and ads are good or not as everyone has their own opinions there, but the technical challenge from an advertising and analytics standpoint is a tough and interesting one.

<comment><USER3> More than just a channel appearing to underperform, you can get misleading information without cross-platform attribution. Many common user behaviors for online shopping consist of browsing/searching on a mobile device, and then converting (buying) on their desktop computer when they get home. This type of behavior is very valuable to know about, but difficult to track properly and may lead you to believe you have little mobile engagement and that your web traffic is killing it with the organic conversions, when really it's totally reversed and your mobile product is the major driver for desktop conversions.

<comment><USER4> TV advertisers knew this - called Effective Frequency - the "number of times a person must be exposed to an advertising message before a response is made and before exposure is considered wasteful."

Thing is, we try to track every damn thing, when there's still effective audio and visual advertising that, while not necessarily driving a measured online conversion, may still have you reach for a Pepsi over a Coke at a Wawa while getting gas. So where naive advertisers might make such a correlation and believe their organic traffic is spectacular, I would think season advertisers would know an ad campaign's effectiveness isn't always in an immediate and wholly measurable conversion. I could be wrong.

[https://en.wikipedia.org/wiki/Effective_frequency?wprov=sfsi...](https://en.wikipedia.org/wiki/Effective_frequency?wprov=sfsi1)

<comment><USER2> So I would humbly consider myself a seasoned advertiser. I know there's a major cross-channel and cross-device picture happening. The challenge often comes when needing to report on metrics. Unfortunately, the saying "what gets measured gets managed" cuts both ways. So I can know with all my heart that something is driving latent activity, but if I can't report on it, often times that isn't sufficient because people want to see measurable ROI when it comes to digital media.

View-through and assist conversions try to help with this, but then you get into the valuation question of "what is the value of a view-through or assist conversion?" Similarly, "what is the value of a Like?"

Ultimately a company needs to build a model to back things out against their targets, and so unless you have solid incremental lift testing data, or other MMM-type data, you're faced with the really hard task of trying to justify this stuff that isn't always showing measurable performance.

</comment></comment></comment></comment><comment><USER5> I'm really happy to see a company so large taking a stand on privacy.

Even if most of their users are unsavvy and don't understand/care about the implications, Apple is making an example that other companies can now follow.

<comment><USER6> Agreed, but this is also classic business strategy (think Sun Tzu's Art of War --Attack where your enemy is weak).

Specifically, Google and Apple are competitors in the mobile space. Apple is creating a product differentiator by including strong privacy controls. Google as an advertising company risks its revenue base if it were to include string privacy controls. So, it's smart business by Apple to compete in an area where their competitor cannot.

A good lesson for startups to reflect on.

</comment></comment><comment><USER7>
        Beginning in iOS 10, when a user enables "Limit Ad Tracking," the OS will send
        along the advertising identifier with a new value of
        "00000000-0000-0000-0000-000000000000."

I think it would be better if iOS just generated a new, random ID every time. If the app knows that the user has disabled ad tracking, it could change the behavior or prevent the user from using it until tracking is turned back on.

<comment><USER8> The latter at least would lead to App Store rejection.

<comment><USER3> And the former would probably lead to your bundle ID being banned from the app store if they catch you doing something shady like that.

Every time you submit an update to the app store for review you have to check a box that says that you acknowledge that you are using the advertising identifier in some capacity in your app, and another that says that you are faithfully abiding by the user's "limit tracking" iOS setting. If they catch you lying about these things they say they will remove and ban your app (no future updates either) from the store.

<comment><USER9> Will Apple enforce it? That sounds like a lot of work for them to check. Apple is really strict about some rules, but others they just don't care. Push notification spam, for example, is a constant problem even though it's against the rules.

<comment><USER10> Even if they don't catch bad developers at the time of submission, once users start complaining, that will trigger an investigation and the developer will eventually be caught.

<comment><USER9> Hasn't happened for push notification spam.

<comment><USER11> So enforcement really depends on whether Apple themselves would limit functionality in their own apps if ad tracking is off.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> As a user who hasn't yet developed a lot of trust with most adtech companies in the mobile space today, I'm happy to see this. (By not yet developing trust, I mean across several fronts: their security rigor, their concern for end user privacy, their business practices and ethics broadly, etc. Would be happy for companies in the space to prove themselves out on these fronts, but it hasn't happened broadly yet, imo.)

This will cause some hacks in the industry, though. We might see a resurgence of device fingerprinting within apps, and it might lead to an increase brand- like advertising vs pure performance marketing. Also, users that have ad tracking enabled might be considered more valuable and unless the practice is banned by AAPL (or maybe it already is), I could see apps that rely on ad revenue to a large degree incentivizing users to enable ad tracking.

I wonder if the default setting will be to limit ad tracking or not. I assume not, but this could have a really large impact if it's on by default.

<comment><USER13> > I could see apps that rely on ad revenue to a large degree incentivizing > users to enable ad tracking.

This is exactly what I thought of when I saw the all zeros ID. Make it random per device app install, and apps can't say "Want to see this awesome cat video? Enable ad tracking first".

<comment><USER14> Apps can't say that. Doing so would get them kicked off the developer program - quite possibly permanently.

<comment><USER15> If I recall correctly, Snapchat refuses to run unless you give it Camera permissions, even if you just want to view other's snaps.

<comment><USER16> They need the camera (roll) "read" permissions for their screenshot protection.

<comment><USER14> Not correct. iOS throws out an NSNotificationCenter call whenever a screenshot is taken. No need for photos permission - only camera

</comment></comment></comment></comment></comment></comment><comment><USER17> I am deeply disappointed, but ultimately not surprised, at the lengths advertising companies will go to to make a dollar more.

The "choices" the typical consumer has if they want to make themselves somewhat anonymous to advertisers are frankly awful. At the moment the only kind of official controls are very limited and not respected or even fully functional with all companies.

The self regulation of the industry is appalling and should be replaced with an international committee of advertising that finds a balance between people's privacy and the right of advertising companies and developers to make money. At the moment, this three way relationship is skewed very heavily towards the advertising companies, meaning the two people who are really the most important - the consumer and the developer - are getting a rotten deal.

Oh, capitalism, how I love you.

</comment><comment><USER18> It would be far more useful to have a feature akin to how FIDO authentication works where the app sees something like Hash(userID, appName). That way you can track a user within an app, so if you install the same app on your iPhone and iPad you don't have to make a separate username/password combination to get access to your saved data. But you can't track people across different apps.

</comment><comment><USER19> I was under the impression that thats what it always did...

A flag?! What kind of insanity is that?

<comment><USER20> It was a flag (before iOS10) which the developers were obliged to honour if they were doing more things than just frequency counting for example. Most of them probably didn't, and that's why Apple decided to take this step..</comment></comment>


The Key to Mercurial and Git (one page to grok it all) - <AUTHOR> http://mercurial.selenic.com/wiki/UnderstandingMercurial

<comment><USER2> I'm not seeing much about Git, but it's a nice overview of Mercurial.

<comment><AUTHOR> Behind the scenes, they work very much in the same way. It's the interface that's different.</comment></comment>


Creatures of the Deep Karst - <AUTHOR> https://www.americanscientist.org/article/creatures-of-the-deep-karst <comment><USER2> I love the Aldo Leopold quote -

> _The last word in ignorance is the man who says of an animal or plant, "What > good is it?" If the land mechanism as a whole is good, then every part is > good, whether we understand it or not. If the biota, in the course of aeons, > has built something we like but do not understand, then who but a fool would > discard seemingly useless parts? To keep every cog and wheel is the first > precaution of intelligent tinkering._</comment>


Startup Quote: Tim Westergren, founder, Pandora - <AUTHOR> http://startupquote.com/post/2746564464

<comment><AUTHOR> Just be prepared for a long and often uncertain journey. The good stuff doesn't come easy.

\- Tim Westergren (@timwestergren)

<http://startupquote.com/post/2746564464></comment>


Facebook set to finally launch auto-play video ads in news feeds - <AUTHOR> http://arstechnica.com/business/2013/12/report-facebook-set-to-finally-launch-auto-play-video-ads-in-news-feeds/ <comment><USER3> It's about time.

Facebook's ad inventory has historically been worthless. It doesn't matter how precisely you target the ads if you don't have the attention of the audience. Facebook had none of the "intent-harvesting" opportunities of search ads: they were just sticking text in the middle of the content you actually wanted to read.

Facebook ad inventory needed to be more like TV. Like Facebook, television advertising has no "intent-harvesting," but it has pretty good targeting. The nature of TV ads gives them a chance to engage the viewer.

Using full-motion video ads, with or without audio, gives advertisers a fighting chance for your attention. The ability to interrupt might be enough to make Facebook's valuation work.

<comment><USER4> I admire your decision to separate yourself from the user experience angle of this and focus on it from a business perspective.

Nevertheless, I hope that this little decision will be enough to put a lot of people off of Facebook because I'd rather see something like this fail than for an application I used to use as an example of pretty good UX and model of simplicity succeed with ad advertising technique normally lumped together with pop-up ads and fake buttons on download sites.

In short, to use a simple, easy to understand phrase: auto-play video ads are lame.

That said, I'm willing to be proven wrong. Maybe they'll come up with some way to make it unintrusive, but that isn't really the point, is it?

</comment></comment><comment><USER5> $2 million per day to really annoy a whole load of people...

Advertisers get ever more desperate to reach audiences but we've seen before that this arms race ends with ads so intrusive that people start to block them routinely. It might drive people away from FB, or it might make ad blocking more mainstream. It'll be interesting to watch.

<comment><USER6> OR, people won't care, and you and I are the small minority who bother to block them or boycott said websites,

<comment><USER5> I don't boycott facebook, and I don't think other people will either. But it will drive more to adblocking, I'm sure of it. Not everyone, sure, but more.

<comment><USER6> I do, I was just saying what you're saying. Changes like this are annoying, and a few people will reject the change.

That said, As long as theres no sound and the ad is to the side of the actual content/app, its not that big of a deal. I use adblocker for all sites except grooveshark, which uses a video ad with no audio. Dont mind it that much...

</comment></comment></comment></comment><comment><USER7> Adblock Plus takes care of the ads already, and I wouldn't be surprised if it also spares me the video ads.

<comment><USER8> Looks like you missed the part about everyone moving to 'mobile'

<comment><USER7> So what? There are numerous adblockers available for Android and jailbroken Crapple phones - and I'm sure that if the ads are to be loaded over cellular data, users will revolt.

Most people these days live on metered connections, and I surely would rather kill the FB app than have it drain my data coverage.

<comment><USER9> Can you suggest a good one for Android? I am missing ABP sorely.

<comment><USER10> AdAway is what I use.

[https://f-droid.org/repository/browse/?fdid=org.adaway](https://f-droid.org/repository/browse/?fdid=org.adaway)

</comment></comment></comment></comment></comment><comment><USER11> ...Facebook has ads?

Thank God for you, AdBlock.

<comment><USER12> If you need a rush of adrenaline one day, try turning it off and visiting some well-known news sites... I was pretty sure the machine I saw it on (parents' computer) was infected. Then realised my parents really need adblock.

</comment></comment><comment><USER13> The only place I actually find myself watching a video ad is in Hulu, where Hulu provides me an option of watching a video ad now in return of uninterrupted streaming of the content I wanted to watch, which I guess seems fair to me.

I guess that would work better, if you are provided the option of auto-playing video ads in your news feed, or watch one or two video ads for uninterrupted access to the news feed, say for every half hour of usage.

</comment><comment><USER14> The article mentions that the ads will only load over WiFi. How do you do that? Is it functionality specific to mobile apps?

<comment><USER15> The source of our WiFi is increasingly being capped as well so I'm not so sure this is even an acceptable approach. Just because I have WiFi single doesn't meet I have an unlimited amount of bandwidth to load your crappy video.

Detecting WiFi is a clever hack that works for right now, but for those using cell wifi routers, cell hot spots or with crappy ISPs that have a low cap it won't matter.

<comment><USER16> I know in Android you can mark a wifi AP as a hotspot to make apps throttle. I don't know about iOS or WP though.

</comment></comment></comment><comment><USER17> I can't blame them for doing it but I'm sure it will lead to me using facebook less. I probably won't close my account but just use the site less. My newsfeed is increasingly annoying as it is.

</comment><comment> k-mcgrady I've got the graph search but still (even after signing up to the 'waiting list' on day one) haven't got the 'new' design. I wonder if this means I won't get the video ads...

<comment><USER18> Is your language "English (US)"? I think that was necessary for Graph Search.

<comment> k-mcgrady I changed it to US which got me graph search. Still no new design though.

</comment></comment></comment><comment><USER19> Has there been any study on the effectives of video ads. Just wonder how many people close tabs because of video ads; At least I do.

</comment><comment><USER20> Auto plating videos and animated GIFs are the bane of my Internet browsing. Luckily, both are easy to stop with Firefox.

<comment><USER21> Back when animated ads were the thing - maybe they still are, I don't know - <USER2> quickly realized it was difficult for me to read an article with a monkey bouncing back and forth right next to it or there was an epilepsy-inducing banner telling me I was the 1000000000000000th visitor. It's not even a matter of being annoying, but of literally degrading the value of the content of the site. Back when I couldn't block the ad outright, I would simply resize the window and scroll it off-screen.

I used to use hostfile-based ad blocking and then started using AdBlock when it came along. The thing is, I'm not opposed to ads on principle or anything. I'm just opposed to ads that wreck the product being provided in exchange for the ad. It's like "Sure, I'll let you use my site, but I get to punch you in the head in exchange."

There are plenty of sites I've disabled AdBlock on, although I figure the odds of an ad on any random site being relevant or interesting to me is about 10000 to 1. I spent a while with AdBlock off on Facebook and thought the ads being shown me were really pathetic given how much Facebook should know about me and be able to target me.

But in general, I'm only opposed to ads when they ruin whatever they are being used to monetize. It's one reason I stopped watching broadcast TV now that ads consume 1/3 of the actual viewing time. Autoplaying videos definitely fall in that category, and I normally keep my computer muted anyway because the last thing I want is some stupid website blaring noise at me. I only unmute the computer if I'm specifically going to watch a video or listen to something. And let's face it, these ads will all be for banks or cars or some stupid political candidate using the movie-trailer-voice guy to tell me that so-and- so eats puppies and kittens, etc., etc. It's all just useless noise.

</comment></comment><comment><USER22> I think that when they do this, I will delete my Facebook account. Or at the very least, not log into it.

<comment><USER23> If anything things like this are a reason... [http://www.fastcompany.com/3023263/work-smart/the- surprising...](http://www.fastcompany.com/3023263/work-smart/the-surprising- ways-social-media-posts-bias-hiring-managers)

Facebook has gotta start looking out for it's user's interests.

<comment><USER22> The only reason people use Facebook is because other people use Facebook. It's not even because of the technology. This could be done by someone else (it would take time to get to the same scale). If more people remove themselves from it, then it will eventually fail.

</comment></comment></comment><comment><USER24> With any luck, this will be the last major step that will cause Facebook's fading into irrelevance.

</comment><comment><USER25> "finally"?

<comment><USER26> They were supposed to launch in october or something, and it got pushed back.

</comment></comment><comment><USER27> I HATE this.

</comment><comment><USER28> For all those thinking that you can't delete your facebook because you will lose connections: Delete it and watch how much you don't care.

Get their emails/phone numbers, call them once in awhile, grab a coffee.

<comment> k-mcgrady A simpler idea is to stop using your account but leave it active. Make it a glorified address book. Every now and then you can check in and accept friend requests if necessary. I know a few people who use it like this (not because they dislike Facebook but just because they spend very little time at a computer). It seems to work for them. They get the benefits without the constant ads and stream of info they don't care about. Of course if privacy is your concern this isn't a good suggestion but otherwise it's a happy medium.

<comment><USER29> Oddly enough, Facebook is finally starting to live up to its under-promising name: a digital yearbook that I occasionally thumb through when I'm curious about an old friend but otherwise let sit collecting dust.

Really exciting and controversial stuff doesn't happen much on Facebook anymore, at least not on my news feed. People are too concerned about maintaing their constructed image. My friends with babies use it as a family album. My friends trying to go into acting or modeling practically use it as an online professional portfolio. A lot of my coworkers are connected on Facebook, which naturally limits the extent of their expression; they might appear to be great friends, and to a large extent they are, but if one of them is mad about work they for sure can't post it to Facebook.

<comment><USER28> Thing with me is it's either I don't have it and never go on, or I have it and I'm brainlessly browsing random shit for hours on end simply because I can.

I guess that's more of a personal thing as I have pretty bad self restraint issues haha.

</comment></comment></comment></comment><comment><USER30> Auto-playing user videos are almost certainly worse than whatever targeted ads I'm going to see.</comment>


A Study of More Than 250 Platforms Reveals Why Most Fail - <AUTHOR> https://hbr.org/2019/05/a-study-of-more-than-250-platforms-reveals-why-most-fail <comment><AUTHOR> We grouped the most common mistakes into four categories: (1) mispricing on one side of the market, (2) failure to develop trust with users and partners, (3) prematurely dismissing the competition, and (4) entering too late. As always, the four categories aren't significant—how do you go broke? You run out of money by failing to keep enough of it, or by never getting enough users to have enough money in the first place. The individual tales are where juicy stories and interesting thoughts form.</comment>


The Nifty MiniDrive (Micro SD drive solution for MacBooks) - <AUTHOR> http://www.kickstarter.com/projects/1342319572/the-nifty-minidrive?ref=email <comment><USER2> Pretty neat idea. I wouldn't mind having one of these to back up my Documents folder with Time Machine if I'm on the go. However, I'm not sure how practical it would be for any other use considering how slow the write/read speeds are and how little (comparatively) a MicroSD card can store.</comment>


Do Smarter People Make More Money? - <AUTHOR> http://www.fastcodesign.com/1663036/infographic-of-the-day-do-smarter-people-make-more-money

<comment><USER2> Interesting visualization of the data, but I'd like to see more analysis. Further, this isn't exactly speaking to SMARTER people - it's speaking to more educated people. That's a very important distinction to make.</comment>


Show HN: Context Script – Share natural language commands for the web - <AUTHOR> https://contextscript.com/

<comment><USER2> This is neat, but it doesn't seem to work on cors enabled sites. :(

<comment><AUTHOR> Thanks for trying it out! I haven't noticed problems with cors enabled sites in general, so I'm curious what you tried to do. The bookmarklet doesn't with with websites that use headers to block scripts and css from unknown domains. Github is one example.

<comment><USER2> Yeah it was with github that it didn't work.</comment></comment></comment>


Making 3D printing filament at home for cheap - <AUTHOR> https://medium.com/endless-filament/make-your-filament-at-home-for-cheap-6c908bb09922 <comment><USER2> a few things about this article: you could always order 3d printer filament from amazon during the pandemic, it just took longer to get here (4 instead of 2 days for me). Some brands are sold out but I found a few that were in stock.

Also, this is completely discounting the time spent to set up and maintain the system, which is entirely nontrivial, and leaves out a lot of quality control steps that are important for making and storing high quality filament.

So basically, fun hobby, but it's not "$7.5 per hour at Home".

<comment><AUTHOR> Here you can see it working: [https://youtu.be/Xirli3qDJlU](https://youtu.be/Xirli3qDJlU)

It's mostly set and forget. You need to change rollers after few 50-60kg run.</comment></comment>


Show HN: Did you ever stuck between two dresses? - <AUTHOR> http://dressyes.co

<comment><USER2> Please feel free to give feedback!</comment>


Open sourcing Tickery - <AUTHOR> http://blogs.fluidinfo.com/fluidDB/2010/07/20/open-sourcing-tickery/

<comment><USER2> I'd be happy to answer questions about Tickery. The point of it is not what it appears to be from just looking at the web app. Read the Huh? dialog on the advanced tab, and also see the text on the About tab. It's not really about sets of Twitter friends, it's about FluidDB and what happens when an app (e.g., Tickery) stores its data into an openly writable database.

<comment><USER3> FluidDB is very exciting technology once one gets past the initial "WTF". I'm looking forward to more user-facing applications.

Not really a Tickery question, but I'm curious about how one could extract subsets of data for off-line use and then replicate this when back online. Understanding that the plan is to open-source FluidDB, what kind of resources would be required to run a "mini-FluidDB"?

<comment><USER2> Hi. I don't really know the best way to do this, though I have thought about it over the years. I think things like Google Gears will be a big help with this sort of thing. But it should also be possible to write smart client-side libraries that let you you modify objects locally and only sync when they can. That would certainly be fine for new objects you create, and for tags you have control over, but would be more involved if you (and others) were offline changing tags over which you all had control. Those kinds of things tend to run into difficult issues - which is mainly why I say I don't know how to solve this (fully). Running a mini client-side FluidDB shouldn't be too hard, especially with things like sqlite being built into some browsers. But again, lots and lots of details.....</comment></comment></comment>


Magnetic levitation can be used to separate the living from the dead - sahin-boydas https://www.newscientist.com/article/2251277-magnetic-levitation-can-be-used-to-separate-the-living-from-the-dead/ <comment><AUTHOR> Click bait title and paywall. I suppose it is about the following article:

"Levitating Cells to Sort the Fit and the Fat"

[https://pubmed.ncbi.nlm.nih.gov/32352239/](https://pubmed.ncbi.nlm.nih.gov/32352239/)

 _" Density is a core material property and varies between different cell types, mainly based on differences in their lipid content. Sorting based on density enables various biomedical applications such as multi-omics in precision medicine and regenerative repair in medicine. However, a significant challenge is sorting cells of the same type based on density differences. Here, a new method for real-time monitoring and sorting of single cells based on their inherent levitation profiles driven by their lipid content is reported."_</comment>


Show HN: Derek – your new project maintainer (bot) - <AUTHOR> https://blog.alexellis.io/derek/ <comment><USER2> Now I know all the buzzwords for how it's run, but still not what it actually _does_.

<comment><AUTHOR> Watch the video it's a 101-style how/what/why etc.

<comment><USER2> Not going to watch a 10 minute video for that, sorry (especially not on mobile), and I don't think I'm alone in that. It's just a bad medium for initial impressions unless done really well and compressed.

EDIT: on second read of the GitHub readme I understood that the text examples are commands you can give and not examples of what the bot does, that makes it clearer. Still, if you submit a blogpost that IMHO should be in the post.

<comment><AUTHOR> Example / walk-through - [https://github.com/Subsurface- divelog/subsurface/pull/1137](https://github.com/Subsurface- divelog/subsurface/pull/1137)</comment></comment></comment></comment>


Ask HN: Who is launching MVP? - <AUTHOR> We're super interested in knowing what you are launching in March 2018. Please include in your replies the short description of what you are launching, how you got the idea, and URL. <comment><USER2> just launched [http://startmydomain.com](http://startmydomain.com)

would love some feedback</comment>


The PewDiePie printer hack - <AUTHOR> https://threader.app/thread/1068714506770149376 <comment><USER2> Is this guys identity protected? Could the government / police demand twitter give the IP address of where he logged into his twitter account from. He probably use a VPN? Seems like a risky thing to post.</comment>


Don't read HN - <AUTHOR> http://serdardogruyol.com/?p=159

<comment><USER2> Don't read HN, instead, post in HN and promote your blog!

<comment><AUTHOR> Why the rage ? Guess you don't get the point of the post w/e.

<comment><USER3> Well, telling the truth isn't means rage.</comment></comment></comment>


Ask HN: Who is going to the 2019 YC Hackathon this Friday? - <AUTHOR> <comment><AUTHOR> First time going to the hackathon and thinking of organizing a small meetup before the event in SF. The venue is Southern Pacific Brewing (620 Treat Ave, San Francisco, CA 94110) and time is Thursday evening at 6pm. Reply if interested. Will reserve a table if we have 5+ people :)</comment>


Pied Piper (from HBO's Silicon Valley) Launches Landing Page.... and nails it - <AUTHOR>

<comment><USER2> [http://www.piedpiper.com/](http://www.piedpiper.com/)

</comment><comment><USER3> I'm going to have to add "bon vivant" to my Twitter profile now...

</comment><comment><USER4> Love it. Now I have to check out the show.

</comment><comment><USER5> Forget something?</comment>


Google + let's you chat with anyone in your circles, not just email contacts - <AUTHOR> http://support.google.com/plus/answer/1709883

<comment><USER2> What's the big deal? I knew about it since I joined Google+ :P</comment>


Collision Safety Differences US vs. Mexican Market - <AUTHOR> http://www.npr.org/sections/goatsandsoda/2016/11/20/502346360/crash-test-dummies-show-the-difference-between-cars-in-mexico-and-u-s?utm_source=facebook.com&utm_medium=social&utm_campaign=npr&utm_term=nprnews&utm_content=2047 <comment><USER2> Cost differences in the US vs. Mexican market

The 2017 Tsuru MSRP is 142,600 MXN ($6,910 USD).

The 2017 Versa MSRP is $11,990.

Ref:

* [https://www.nissan.com.mx/tsuru/](https://www.nissan.com.mx/tsuru/)

* [http://www.nissanusa.com/versa/](http://www.nissanusa.com/versa/)

</comment><comment><AUTHOR> Bookmark this for when some makes an impassioned argument about how the market can independently solve problems without regulatory intervention.</comment>


Ask HN: What is your greatest achievement(s)? - <AUTHOR> Excluding personal relationships, which are hopefully your greatest achievements, what are your greatest achievements? The things you are most proud of? <comment><USER2> In the 90s, I worked for an ecommerce network, Sterling Commerce, that processed data for Ford part suppliers. The suppliers would download purchase orders, and be required to respond quickly with advance ship notices, or be fined.

Through a testing SNAFU, our network failed to correctly implement an advertised change in Ford's network specs, finding out on the day that the final production cutover took place. One of the products I supported was a software package that could connect to many ecommerce networks, and I had successfully implemented a script that worked with the new Ford specs.

For about 3 days, while our engineers screwed around trying to get our network to interconnect with Ford correctly, I ran all of our customer traffic headed Ford's way through my work computer with the comm script I had previously patched, with a series of Windows scheduled tasks, batch files, FTP scripts, and a bisync modem.

Despite preventing dozens of companies from getting fined, my heroics went completely unnoticed by my company.</comment>


BlueRuby -- From SAP - <AUTHOR> https://www.sdn.sap.com/irj/scn/wiki?path=/display/Research/BlueRuby

<comment><USER2> Great stuff man... having worked on SAP back in 1857, and now working on Ruby/Rails, it feels good even SAP is waking up. So what if they have skipped a century, I will still get a kick to see a dinosaur walking San Francisco streets!

</comment><comment><USER3> (decf (cool-factor _ruby_ ))</comment>


ICO Ban? Canada's Regulators Are Giving One Token Sale a Big Break - <AUTHOR> https://www.coindesk.com/ico-ban-canadas-regulators-giving-one-token-sale-big-break/ <comment><USER2> I actually pulled this off with my team! Our project is impakcoin.com I can tell you that it was no piece of cake to have this approved

<comment><AUTHOR> Hi pevachon. I heard about this through the tech grapevine, also in Canada. Would you care to briefly discuss what you had to go through? I am skeptical towards most ICOs, but I think there is some room for innovation _if_ done properly. I would really love a chance to hear more about your experiences!

<comment><USER2> would love to talk more about the process. you can reach me a pierre- firstname.lastname@example.com</comment></comment></comment>


Introducing Dell Chromebook 11: 4GB RAM, USB3, Bluetooth 4, but only 16GB SSD - <AUTHOR> http://www.businesswire.com/news/home/20131211005460/en/Dell-Chromebook-11-Students-Teachers-Affordable-Easy

<comment><AUTHOR> How could one tell if Linux can be installed on this natively? (not using cruton)</comment>


How do you measure a startup accelerator's success? - <AUTHOR>

<comment><USER2> <http://www.coursebuffet.com> we put it up for indexing but it is not officially launched yet.

</comment><comment><USER2> I see you applied to Y combinator, what is your startup?

<comment><AUTHOR> Had been working with my first startup for past 3 years www.techbuddy.co.in. Now moving on to SeCheers.com,an online platform for collaboration of goals.

What about you?

</comment></comment><comment><AUTHOR> Anybody?</comment>


System automatically converts 2-D video to 3-D - <AUTHOR> http://www.csail.mit.edu/node/2627 <comment><USER2> "One of the main insights of the paper is that domain-specific methods are able to yield bigger improvements than more general approaches. This is an important lesson that will have ramifications for other domains."

Who would have thought...

<comment><USER3> So it's a general lesson about domain-specific methods, not a domain-specific lesson?

<comment><USER4> Did we really need this project to discover the value of heuristics?

</comment></comment></comment><comment><USER5> > of a soccer videogame

The rule of being specific also matches this title. This is for very very limited artificial video game footage and a database of known 3D scenes from the same. Hardly what I expected.

They are using recorded footage and depth maps from a FIFA game to 're-match' new footage with depth.

<comment><USER6> > This is for very very limited artificial video game footage and a database > of known 3D scenes from the same.

While they are using "artificial video game footage," as the basis for their process, they are applying it to real soccer game footage. Limited, yes, but quite clever in its simplicity. (Obviously, in general, the idea of using simulated data as a training set for supervised machine learning isn't new, but who would have thought that an off-the-shelf videogame would be realistic enough to be used to reconstruct 3d scenes from actual soccer footage.)

<comment><USER5> Thanks for the clarification, I somehow misread.

</comment></comment></comment><comment><USER7> I played with Samsung's 2D to 3D conversion in 2011 and found it to be surprisingly good at live action content.

While looking into their conversion technology I found a mention of TriDef. They have several OEM downloads indicating they provide the 2D to 3D conversion for some Samsung, HP, LG, and Phillips displays.

[https://www.tridef.com/](https://www.tridef.com/)

</comment><comment><USER8> Stergen[0] did this few years back(had a working system in 2010 IIRC). Their results are very good for soccer, and good for basketball and american football(all for live broadcast footage, in realtime). Unfortunately (for them) nobody watch 3D television anymore.

[0] [http://www.stergen.tv/](http://www.stergen.tv/)

</comment><comment><USER9> Just watched the youtube clip on my 3dtv and the results were terrible. The people are on the same plane as the grass. They aren't standing up out of the grass. I'm convinced it's junk like this that has made 3dtv so unpopular. I show people 3d gaming or proper 3d movies on my 3dtv and they had no idea the experience they were missing out on. More than one person has told me they were now going to go buy a 3dtv (good luck finding a passive 3d interlaced tv nowadays). I have the Vizio E3D320VX. Took me 2 months to find the one I ended up with. I paid about twice as much as a regular tv for it.

<comment><USER10> 3D has always been a gimmick back since the first stereo photographs were produced. I don't see any reason that will change.

<comment><USER11> Same with binaural sound. Mono was good enough for Miles Davis, it should be good enough for everyone.

No, seriously, your comment is useless. OP said he likes it for video games & you don't even address that.</comment></comment></comment>


Wikileaks publishes secret files on Gitmo prisoners - <AUTHOR> http://www.boingboing.net/2011/04/24/wikileaks-publishes-4.html?dlvrit=36761

<comment><USER2> Goddamnit. I saw this link and I was all careful to turn on Beethoven's Fifth before I clicked it, and then it was a dissappointing "We're _going_ to release these files" with only a few of the files posted.

Assange, you'd better know damn well what you're doing, because sooner or later you're going to be running around yelling about all the shit you have on _them_ and they'll kill you before you can release it.

<comment><USER3> Give it some time. Releasing them gradually also allows for more time for the media to pick up on it, which is good from their point of view - as opposed to a concentrated release, which would get much less attention.

</comment></comment><comment><USER4> I guess the bank papers were a bluff, or Wikileaks was bought out by their infinite wealth.

<comment><USER5> Are those the only two likely possibilities?</comment></comment>


Freedom and security issues on x86 platforms - <AUTHOR> http://mail.fsfeurope.org/pipermail/discussion/2016-April/010912.html <comment><USER3> Unbelievable. Yet again, we have a post on finding x86 alternative that's most FOSS friendly. Yet again, the author is unaware of or ignores the _only architecture_ that's open, has GPL cores, and an ecosystem. That's SPARC. Oracle's T1 and T2 cores are open-source to study. More appropriately, Cobham- Gaisler's Leon3 HW is dual-licensed under GPL and commercial. The Leon4 is 4-cores. SPARC ISA is open. Open Firmware exists.

So, why is SPARC left off in all these analyses? It's right there ready to pick up and deploy. More open, easy to acquire, and trustworthy (far as licensing) than than a POWER chip although slower for sure.

<comment><USER4> I'd imagine people don't bother looking at an oracle technology and just assume it is closed or unsupported due to the ways they generally operate.

That doesn't make it right to do this, but that'd be my guess.

I certainly didn't know SPARC was open until your comment.

<comment><USER5> As far as I know, Oracle has not made any SPARC intellectual property available since the acquisition of Sun. The T1 and T2 lines were emphatically Sun-era products.

<comment><USER6> So if API's are copyright-able.

And SPARC T1/T2 are GPL CopyLeft.

Shouldn't Oracle have to open source T3/T4/T5/M7 processors also?

(No I don't have the money required to sue Oracle and keep this suit open for the 2 decades settlement will take).

<comment><USER7> No, that's not how open-source licensing usually works.

Assuming Oracle own all the IP rights (having purchased them from Sun), they aren't bound by the terms of the GPL. The GPL grants certain permissions to others if they comply with its terms, but the person who offers the license doesn't lose any rights they already have. They have no obligation to keep successive generations of derivative products open source.

<comment><USER8> True, that's even spelled out in the GPL itself (that's from GPL 2, but GPL 3 has similar content in section 9):

> 5\. You are not required to accept this License, since you have not signed > it. However, nothing else grants you permission to modify or distribute the > Program or its derivative works. These actions are prohibited by law if you > do not accept this License. Therefore, by modifying or distributing the > Program (or any work based on the Program), you indicate your acceptance of > this License [...]

The copyright owner obviously doesn't need the license to have permission to modify the code, so they're not bound by it.

</comment></comment></comment></comment></comment></comment><comment><USER9> I've been looking into this recently.

Basically, the things mentioned on the text, made free software bios and firmwares impossible, some of the free software projects that exist now are mostly "binary blobs loaders", having more binary blob than free software code running.

There is some good analysis on why even Intel can't fix this if they wanted to, unless they stopped shipping some features entirely, their Intel ME system rely on a couple of proprietary third party code, that has on contract with Intel explicit prohibitions of Intel ever letting anyone seeing their source, or the keys needed to sign them.

Also, Intel ME can't be really trusted, the code is not really "reverse- engineeringable", and it works as a full second OS of sorts, it even has its own JVM running, if someone somehow decide to inject spy software into it, you will never know, also I assume that the first destructive virus to latch into that stuff, will take the world truly by surprise depending on when it triggers (for example if it spreads silently but triggers the destructive payload on a specific date).

Also, these features can be abused to abuse the market itself, for example by intentionally making the hardware underperform, and then sell "superior" hardware that has the only difference some software.

<comment><USER10> People have certainly done ME reverse engineering:

[http://me.bios.io/](http://me.bios.io/)

<comment><USER11> >there is a little man inside your pc... and his thing is bigger than yours. Your wife knows this.

I'm supposed to believe this technology is dangerous. But the advocates are children.

<comment><USER12> I think you're supposed to be able to distinguish the message from the medium. Certain styles can definitely make that harder, but ultimately if you can't examine an issue by the facts presented, the failure falls on you, as do the consequences.

To be clear, I also think the referenced bit is childish and detracts from the message. I just don't think that should affect your belief in whether it's important.

<comment><USER13> If a piece is written with a confusingly inappropriate tone for the subject matter, you can't solely blame the reader for being confused since it was the expressed intent of the author to instill that state.

<comment><USER12> Well, it's a wiki, so "author" is very loose (and when I checked at the time of my original comment, the change to add some of that verbiage was the most recent change, if still quite old). Ultimately, much of the information on the internet is presented without reference, so tone is the least of our problems. We need to be able to read what is being presented, and decide whether it's important enough to use that we should verify it. In this case, the tone shifts, but the message is along the same lines (the ME is your adversary), if very crudely done.

I do think you have a point though. It's not entirely up to the reader, there is a minimum threshold of clearly communicating facts that needs to be met by the author. But I don't think it's safe to say something that's unclear in tone means it was the expressed intent of the author to cause confusion. Humor can add quite a bit to an argument if done right, as humor often has the ability to cut through some of our preconceptions. Humor done wrong might be confusing, but that could very well be unintentional.

</comment></comment></comment></comment></comment></comment><comment><USER14> ARM architectures also suffer from this. You'll be hard pressed to find a board that doesn't require a propriety board support package somewhere in the stack.

Ironically, it is usually the bootloader that is/requires a blob or it is the DTB.

I remember being in middle school and reading Stallman's articles on the dangers of a TPM-oriented push by manufacturers. As cliche as it is, Stallman was right.

The push for platform security is also a push for platform ownership. Tinkering/hacking/your ability as a hardware owner is at ends with corporate security needs and that is a shame.

<comment><USER15> I'm using ASUS C201 which uses ARM. It was a Chromebook, now running libreboot and parabola linux.

<comment><USER16> How is it regarding GPU driver (or what Mali is)? Are you running binary mali driver or FOSS lima?

<comment><USER15> I don't really do GPU-intensive stuff on it. It renders webpages & youtube fine, which is probably the most graphical intensive stuff. I'm currently using it mostly for porting MuseScore to arm, mainly using qtcreator for development.

The external hdmi doesn't really work properly...I remember not being able to run external monitor in full screen, or at the same time as the lcd screen.

I just installed and ran glxgears. It gets 250 FPS and a default window size. But I do get an command line error libGL error: unable to load driver: rockchip_dri.so, so I don't think I'm getting GPU.

</comment></comment></comment></comment><comment><USER17> Intel ME checks to see if a certain portion of the BIOS flash memory is writable before it allows the main OS to boot.

What x86 Chromebooks do is they allow that region to be writeable but then zero that region on every boot. If your ME was backdoored, it was shipped that way from the factory.

It's so disappointing that Intel undermined the entire trusted computing stack for some unproven ideas of around ME revenue generating opportunities.

</comment><comment><USER17> Joanna has proposed a model where we minimize the trust we put in x86 with a peripheral. Seems like a plausible path forward to me.

[http://blog.invisiblethings.org/2015/12/23/state_harmful.htm...](http://blog.invisiblethings.org/2015/12/23/state_harmful.html)

<comment><USER18> There was an excellent talk related to this that Joanna Rutkowska gave at the 32c3 conference (she talked quite a bit about Intel's ME too, I was completely unaware of its existence up to that point): [https://media.ccc.de/v/32c3-7352-towards_reasonably_trustwor...](https://media.ccc.de/v/32c3-7352-towards_reasonably_trustworthy_x86_laptops)

</comment></comment><comment><USER19> Given that chip development has been hitting diminishing returns for a few years it might be time for Open Source to eat the world of processors as well.

It feels like the sort of opportune market that server operating systems, databases and web servers occupied: less of a visual aesthetic and more of a better-design-wins market.

It's not going to be easy - I'd guess that it would take at least 10 years for a project to get any sort of traction outside of a very small niche group.

<comment><USER20> People are working on that, and it might take less time than you think:

[http://riscv.org/](http://riscv.org/)

<comment><USER19> Yep. But I stick to my guess that it'll take a decade for real change to happen. Obviously the goalposts are a bit fuzzy, but I feel like you have to give the hardware a chance to make it through three generations (assuming three-year lifespan on devices) before someone launches something that is within the ballpark of devices shipping at the same time.

</comment></comment></comment><comment><USER21> Check libreboot.org

On their FAQ page: [https://libreboot.org/faq](https://libreboot.org/faq) , you can see the question "Why is the latest{Intel,AMD} hw unsupported?"

They go into more detail than the provided link. Also, dropped supports starts in 2008 for Intel, 2013 for amd.

The truth is: we need something like this to protect the whole boot process. But unless we can put our keys/sw in there, we will never be sure.

<comment><USER22> I was at FOSDEM this year (2016) and there was a talk from the leader of LibreBoot.

Honestly, his talk on the state of the project was very bitter. He literally said that there is absolutely no hope that LibreBoot will ever be able to cope with ME, and that the fight is over since 2008.

As much as I would absolutely love to be able to run a free firmware, unless there is a major change/outsider in the hardware manufacturer world, it seems very unlikely that it will be possible on current x86 architectures.

<comment><USER23> I've been using a Raspberry Pi 3 for the past week, and have been pleasantly surprised by the performance. It's no speed demon, to be sure, but it's good enough for all my basic tasks. I wish there were a general "open computing" branch of the Raspberry Pi Foundation that would produce a $50-$100 "pro" version with more RAM and faster bus+peripherals.

<comment><USER24> The Raspberry Pi still relies on a closed-source blob running on a CPU core whose instruction set isn't publicly documented to even boot, but I suppose at least it's possible to reverse-engineer that unlike Intel ME.

<comment><USER25> Broadcom released a considerable amount regarding the Videocore IV a couple years ago. Nobody's finished writing an RTOS for it quite yet, but the ISA is now documented.

[https://www.broadcom.com/docs/support/videocore/VideoCoreIV-...](https://www.broadcom.com/docs/support/videocore/VideoCoreIV- AG100-R.pdf)

</comment></comment></comment></comment></comment><comment><USER26> Hmm. OK, I have two questions - maybe somebody here has answers:

1) "...these proprietary blobs could easily contain code to exfiltrate encryption keys, remotely activate microphones and cameras..."

This seems basically impossible to actually achieve in reality though, because there will still associated network traffic that can be sniffed, and will have been by now, right? I mean, it is plausible that somehow we all just failed to notice that our computers are sending video traffic to the NSA without our noticing it?

I can imagine this happening on phones, where the baseband chip is much harder to actually sniff. But through my LAN? I doubt that.

2) Let's imagine that this post is entirely true. Why do Intel and AMD do this? If it's not part of a grand conspiracy, then why? Clearly there are far easier and cheaper ways to achieve what they view as security that don't require such a crippling approach. What's the upside to them?

<comment><USER27> It's called covert channels. It could be done by flipping some unused/ignored bits in ip4/tcp headers in a stream of traffic that goes past a collection point.

<comment><USER26> But this is still easily visible with wireshark, right? Don't you think we'd have discovered this by now?

<comment><USER28> How would Wireshark reveal this kind of attack? If the management chip has direct hardware access, it can hide data in innocuous-looking packets that the host machine never sees. You would have to monitor both the packets that the OS _thinks_ it's sending, and the packets actually received by the switch, and constantly compare them for mismatches. Given the performance cost, I find it hard to believe that anyone except the most paranoid organizations would actually do this.

And of course, if you block the obvious exfiltration methods, all you do is force the attacker to do something more creative. Like modulating inter-packet timings, or even sending data to a nearby radio receiver by using the system bus as an antenna.

<comment><USER29> > How would Wireshark reveal this kind of attack? If the management chip has > direct hardware access, it can hide data in innocuous-looking packets that > the host machine never sees.

Lots of organizations use various forms of intrusion detection. A network intrusion detection system (NIDS) would be an off-device system which monitors network traffic for suspicious or obviously malicious packets.

It's certainly no guarantee, but somewhere along the line someone probably would have noticed _something_ if these systems were exfiltrating data via the network using something like IPv4 headers. Specifically, a quick look makes it look like Snort (an open source NIDS) may actually be distributed with rules to alert on IPv4 reserved bits being set.

<comment><USER30> You keep saying that "someone should have noticed something" but as the old adage goes, _absence of evidence is not evidence of absence_

What you seem to keep missing is that we know from the Snowden leaks that the capability already exists, and NSA has successfully used implants to do data exfil in the past.

<comment><USER31> _" absence of evidence is not evidence of absence"_

This isn't true. Absence of evidence is _weak_ evidence of absence, and _suggests_ that it's not the case.

Not disagreeing with anything else in your comment, but that quote completely defies Bayes 101.

</comment></comment></comment></comment></comment></comment></comment><comment><USER32> And it's getting worse, SGX[1] allows 3rd party encrypted binary blobs to run on your CPU without being inspectable.

It's sold as way to protect your secrets from malware. But it more likely will be used to run DRM code on the user's computer while treating the user as a hostile entity.

[1] [https://software.intel.com/en-us/sgx](https://software.intel.com/en- us/sgx)

<comment><USER33> SGX has the potential to be amazing though. With it you can build "trusted" applications. For example, a Bitcoin mixer that's provably secure. (Well as secure as trusting Intel and users not to be able to break the chip.)

<comment><USER32> As it is right now you're giving up your liberty (debugging/inspecting/tinkering) in exchange for security.

That's generally a bad trade. Sadly one that many people are willing to make until it bites them.

It would be a lot better if secure mode had its own supervisor mode that worked through a master key that could be installed at boot time.

<comment><USER34> It's really a question of who you trust. There are lots of scenarios where you might trust the developer of a particular piece of software more than you trust the entire software stack running on your PC. This is especially true for a nontechnical / casual / grandma user, who has no hope of ever auditing _or even having more than a vague idea of what 's running_ on their computer at a given time, and probably is running (or at least needs to be assumed to be running) six different kinds of malware all the time. To someone like that, the PC itself is a hostile environment which they don't want to share certain information (e.g. their banking details, crypto keys, etc.) with. SGX allows you to ensure that.

If you take on premise that the PC is not safe and under your control, but is instead hostile and compromised, basically an outpost of the Internet in your house, then SGX and similar start to make sense. For many people, their computer is always going to be hostile; it was never "theirs" to begin with, so SGX doesn't really cost them anything, and the ability to let a single application basically force its way down to the hardware and elbow everything else in the stack out of the way is an improvement over having to trust the OS, browser, etc.

In a way it represents an abject failure on the part of the dominant OS developer (Microsoft) to produce a consumer computing platform that the average user can trust, as well as the failure of most other alternatives (e.g. DoD-style smartcards) to take off in the consumer market.

<comment><USER32> None of that justifies the absence of an ultimate user override.

There is no need to give up freedoms for that security.

Only when DRM comes into play you can really explain why the user is not in control here.

</comment></comment></comment></comment></comment><comment><USER35> The way to blow this wide open is to catch Intel's "management engine" doing something really bad and publicize it. It could do for Intel what John German did for Volkswagen AG.[1]

One approach would be to build some honeypots likely to attract attention. Give them a job that's not too traffic intensive but is suspicious, such as encrypted IRC. Record all traffic in and out of the box using external hardware. Get them fake encrypted traffic from suspicious sources (Tor, strange sites in suspicious countries, etc.) Wait for strange packets to show up that are not meaningful to the host software but cause something to happen on the target.

[1] [http://www.bbc.com/news/business-34519184](http://www.bbc.com/news/business-34519184)

</comment><comment><USER36> There is also an additional possibility: Recycle old computers. A Intel 2008 laptop performs OK with a modern GNU/Linux with an efficient Desktop (for example XFCE4). This also helps avoiding CO2 emissions, saves rare earths and energy. And it is a statement against a unsustainable throwaway society.

<comment><USER37> The problem with such old devices is that some of them can be impressively reliable, at an age of ~8 years, one has to worry about the device starting to fail. If you want to keep the device going once something breaks, getting replacement parts can become interesting. Not impossible per se, but depending on how popular a particular device was in its day, finding spare parts can be very time-consuming.

Still, I agree. I have a 2008 netbook at home I still use regularly, and I hardly throw away a computer that still basically works.

</comment></comment><comment><USER38> The fight is increasingly political, so advocate and donate where you can.

We lose when we give up, I suppose. I know what the Libreboot guy said before on his blog, alluded to here, but this is why, as crusty as some might find him, we most generally support Stallman's politics.

<comment><USER39> I wish the FSF was a bit more nuanced. For example, if DRM causes ordinary computers to come with proprietary code that is impossible to remove, then that is bad indeed. Then you no longer control your own computer. The same computer that you might use for political activities, for example.

On the other hand, if entertainment computers, such as blu-ray players or gaming consoles are locked-down and full of DRM, then I don't see a big problem. Sure, the government could potentially ban some movies in the future, and require the manufacturers to update the firmware on your machine so that it will no longer play those movies. But movies and games are expensive to produce, and without DRM most of them probably wouldn't get produced in the first place. In any case, movies and games aren't really that important, compared to say books and articles.

The FSF seems to be against DRM EVERYWHERE! They don't seem to realize that DRM might actually be a good thing for some things. Are there any organizations out there that I could donate to, that fight/work for open hardware for general purpose computers, without trying to prevent locked-down entertainment computers?

<comment><USER38> Disclosure: I became a member days ago, and did not want to mention it. Reading this article made me super proud to have chosen to fork the cash over before reading this crap as it gets worse all the time.

At the end of the day, I want a hardliner in this space pushing that line because I know, practically, he cannot win. But if consensus is drawn between him and the other extremes I find distasteful, I want him to pull the resolutions and positions as far left as possible, even if that is slightly left of center.

I worry, as current events show, anything less means that counter-forces to the free software movement will wear you down with abject greed by slowly going right of center and taking as much time as it takes to restore the balance back to their proprietary interests after the initial battle has gone to free software advocates. And that is how I see it. Very few of my friends understand the value of highly technical manuals, and that is what open source is about. My brother recently saw my side with automative hacking and experimentation countermeasures on the rise, as reported today on HN. But when I tell non-technical people these manufacturers hide secrets in their faulty designs and let you pay for their ineptitude, even if you want to fix it for yourself on your individual unit without harm or influence on them, they do not get the argument and ask why I think I know better than the compant. They only get the argument when they are locked out of a system they need for their very personal context.

Oh well. This is a very personal choice. I love GPL, I love MIT, and I smile when I think how all these hippies made a world for me in the 60s and 70s I could not live without today.

<comment><USER39> I totally agree with you that many corporations seem rather greedy. I wish those corporations were more nuanced, too. For example, I don't mind if Intel and AMD make locked down CPU and GPUs for entertainment computers, but it would have been nice if they also made some open CPUs and GPUs.

I wonder if this greed will be profitable for them in the long run? Obviously, most people don't care whether their hardware is open or not. However, a tiny minority of (very) computer literate users do care (a lot). Will it have any impact if this tiny minority abandons the x86 platform?

</comment></comment></comment></comment><comment><USER40> What about VIA x86 CPUs? [http://www.viatech.com/en/silicon/processors/](http://www.viatech.com/en/silicon/processors/) Do they implement some "secure boot"-like features?

<comment><USER41> To the best of my knowledge, VIA CPUs have no secure boot, management engine, or any other proprietary secondary hardware.

Coreboot supports many VIA CPUs and motherboards[1], though it's unclear if it uses any binary blobs the FSF seems alright with VIA Technologies and apparently they're cooperative with open-source BIOS[2].

1\. [https://www.coreboot.org/Supported_Motherboards](https://www.coreboot.org/Supported_Motherboards)

2\. [https://www.fsf.org/campaigns/supportlinuxbios.html](https://www.fsf.org/campaigns/supportlinuxbios.html)

<comment><USER42> VIA CPUs do have a crypto engine called Padlock (with all the usual goodies plus a randomness generator) which is not 'open' so be careful with that.

I recall that some independent company was contracted to audit the entropy generator in VIA C7 but I can't find it now.

</comment></comment></comment><comment><USER43> It's great that these guys pushing POWER8 at least have a workable situation, but at least for me, throwing $3,700 at a motherboard (Alone!) just isn't feasible. I would love to be free of proprietary firmware, but it would seem that's only for people better off than myself.

<comment><USER44> You have to start with a single step. Costs could go down over time.

<comment><USER45> While I agree with you, the average buyer of computer components is used to spending an order of magnitude less on a motherboard. A person can go to their usual source of computer parts and pick up a motherboard for a couple hundred USD at the high end. A few thousand USD for motherboard that does not offer an order of magnitude improvement in raw speed or expandability is going to be a very hard sell.

<comment><USER46> The question is rather: Is there a large overlap between the people who can afford to spend thousands of dollars for a free (as freedom) POWER8 workstation and the open source idealists who would love to buy such a free device?

</comment></comment></comment></comment><comment><USER47> I'd personally like to see the FOSS community try to embrace the POWER architecture: Ubuntu/Canonical are major members of the OpenPOWER foundation [1], so at least an entity sympathetic with our philosophy has an influence on the architecture.

[1] [http://openpowerfoundation.org](http://openpowerfoundation.org)

<comment><USER3> Red Hat has supported POWER for a long time. Debian does. Even Mint had a PPC release. The big BSD's do. Amiga's are still on PPC haha. I think it's not a question of FOSS support by OS developers. It's the users and app that don't commit to x86 alternatives.

<comment><USER24> One issue with PPC and POWER is that they're generally big-endian and everything assumes little-endian these days thanks to x86. Even JavaScript is little-endian now.

<comment><USER3> That's one of those sad realities of Worse is Better in action. Definitely a disadvantage. Far as why big-endian was The Right Thing, drfuchs had this to say:

"Because big-endian matches how most humans have done it for most of history ("five hundred twenty one" is written "521" or "DXXI", not "125" or "IXXD"). Because the left-most bit in a byte is the high-order bit, so the left-most byte in a word should be the high-order byte. Because ordering two 8-character ascii strings can be done with a single 8-byte integer compare instruction (with the obvious generalizations). Because looking for 0x12345678 in a hex dump (visually or with an automatic tool) isn't a maddening task. Because manipulating 1-bit-per-pixel image data and frame buffers (shifting left and right, particularly) doesn't lead to despair. Because that's how any right- thinking person's brain works."

<comment><USER46> It is not obvious whether big or little endian is better. For a nice overview read [https://fgiesen.wordpress.com/2014/10/25/little-endian-vs- bi...](https://fgiesen.wordpress.com/2014/10/25/little-endian-vs-big-endian/)

<comment><USER3> Thanks for the feedback. I'll add it to my collection for this subject and think on it in the future.

</comment></comment></comment></comment></comment></comment><comment><USER48> This sounds similar to basebands on cellular devices: Subsystems controlled by the vendor, not accessible from the 'user' system, remotely updatable and with access to everything.

<comment><USER49> Except modern baseband processors usually don't have direct access to main memory or peripherals - they are usually linked to the rest of the phone via a serial bus.

ME is very, very different - it transparently has access to everything.

<comment><USER48> > Except modern baseband processors usually don't have direct access to main > memory or peripherals - they are usually linked to the rest of the phone via > a serial bus.

Do you know where I can read more about that? A good, technical, authoritative resource? In my little bit of research, details are sparse and authoritative technical details even more sparse.

<comment><USER50> Paranoid android used to have a nice breakdown on which phones had isolated memory for the baseband and which used shared memory. I cannot find it now, and their site seems to have taken a very wrong turn in the design department.

<comment><USER48> fyi: As far as I know, Paranoid Android development stopped last summer, after OnePlus hired away key developers in February 2015. Here's an article with much more detail, including its prospects going forward:

[http://www.androidauthority.com/paranoid-android-calling- it-...](http://www.androidauthority.com/paranoid-android-calling-it- quits-648429/)

</comment></comment></comment></comment></comment><comment><USER10> Earlier posts around the same topic:

[http://blog.invisiblethings.org/2015/10/27/x86_harmful.html](http://blog.invisiblethings.org/2015/10/27/x86_harmful.html) [http://blog.invisiblethings.org/2015/12/23/state_harmful.htm...](http://blog.invisiblethings.org/2015/12/23/state_harmful.html)

</comment><comment><USER51> There's an related Youtube video from Igor Skochinsky's REcon 2014 talk that I watched this week & found interesting:

[https://www.youtube.com/watch?v=4kCICUPc9_8](https://www.youtube.com/watch?v=4kCICUPc9_8)

May be also be interesting to others wanting further information.

</comment><comment><USER52> I wonder if Apple might do something about this. They don't care so much for the FOSS side of things, obviously, but I wonder if they might demand chips from Intel without the management engine, because it's a potential attack vector they can't control.

<comment><USER53> I suspect at some point they will simply drop Intel for their own (ARM) platform. I think moving will be easy once all app store submissions are in bitcode.

<comment><USER54> I strongly believe you are correct. They have been mentioning that their ARM processors are desktop worthy. I also believe Apple are displeased with Intel's current inability to consistently get their new chips to market. All of this has to make one think Apple will take matters into their own hands soon. Likely within the next 2 years.

<comment><USER55> Important bit to note here: the two year timeline is probably only feasible for low end devices, like the MacBook and MBA.

Towards the higher end, ARM can't hope to field anything in that timeline to compete with even todays i5 or i7s (or corresponding Xeons). Some people do use this kind of CPU power.

<comment><USER56> I don't have a guess at what Apple is actually going to do, but the Retina rollout is a plausible model. Even 5+ years after the first Retina product, it's still not available across the lineup.

I don't think the switch would present a significant problem in marketing or for developers, so it would purely be a question of having the chips that fit the products. The Macbook, as you point out, is basically already there.

</comment></comment></comment></comment></comment><comment><USER57> This is the main reason that I'm reluctant to upgrade my 5-year-old AMD Phenom II processor.

 _> MIPS is often overlooked. However, China has revived this architecture for general purpose computing with the Loongson core..._

Baikal-T1 [0] is another interesting MIPS processor that I'd like to play with (or maybe even use).

[0] - [https://www.linux-mips.org/wiki/Baikal](https://www.linux- mips.org/wiki/Baikal)

</comment><comment><USER58> Even if the ME was opened, the chips themselves are complex enough that nearly anything could be hidden. State machines that enable backdoors from instruction sequences can be pretty small (triggering these from a preferred vector, such as a web browser, seems hard-ish though).

<comment><USER59> I dislike how libreboot skips microcode updates.

</comment></comment><comment><USER60> It seems superficial to concentrate on a few kilobytes of binary blobs as a security issue when millions of logic gates are also hidden from user scrutiny by design in most computers. That the number of people you have to trust now includes firmware developers in addition to hardware designers is a small movement in the scheme of things, though it may be a movement in an undesirable direction.

</comment><comment><USER61> Dependence on a few companies to design and make processors will not work in the long term. Open source processor design that can be manufactured by anyone is the way out of this problem. Even if this never happens the attempt to go there is enough to make the large companies involved with cpus beg and serve.

</comment><comment><USER62> Theoretically one way to correct it is to have an external device that blocks network activity going in or out.

Yes, I realize you could get around this. The superblob could be a) looking for patterns in JPGs for input, and b) stenographically encoding output into...anything the user is doing.

Sigh. Nevermind.

</comment><comment><USER63> I think that, given a large enough group of people willing to make a mass- purchase of CPUs, Intel would be likely to listen to requests for a batch with an open-sourced Management Engine component, or some shim akin to the one RHEL uses to boot UEFI in Secure-Boot mode. (mentioned it on /r/ReverseEngineering a few months back.)

I don't know who to reach out to at Intel on that suggestion though.

[https://www.reddit.com/r/ReverseEngineering/comments/3pwxjn/...](https://www.reddit.com/r/ReverseEngineering/comments/3pwxjn/rreverseengineerings_weekly_questions_thread/cwdpspb)

<comment><USER3> The possibility I see is their semi-custom business. A cloud provider or someone else with the money can have them make one that strips out all the spyware or DRM stuff. Leaves everything else. Optionally, strips out some other baggage from backward compatibility that FOSS OS's don't even need. Preferably, though, smallest possible changes to the chip like straight up removing the wires connecting ME.

</comment></comment><comment><USER64> They tested the waters with GPUs. after nobody complained at all, they just moved to CPUs.

</comment><comment><USER65> While I would love a contemporary performance computer that can be trusted, no such device is even remotely possible in the manufacturing and fabrication ecosystems of today. Consider for just a moment ALL the chips inside the box. All the microcode, all the ROM, all the places something could be intentionally hidden. The idea that you could buy some parts on the internet at retail price that could satisfy the truly paranoid (ie defense & espionage communities) is ridiculous.

On the other hand, it still is probably possible to prevent a computers unrestricted access to the internet. For now at least.

</comment><comment><USER66> When I saw RISCV mentioned as an alternative, I had to check the date twice to make sure it wasn't an April Fools'. I understand the concerns and all, but wish the alternatives were a little better picked out.

Most people already mentioned SPARC and ARM as alternatives, so I won't delve into those arguments other than point out that there will _always_ be commercial interests at stake here - hardware, unlike software, requires considerable material resources to create* and distribute (and is still harder - and therefore rarer - to create for its own sake), so there won't be a wide variety of viable options out there, and new CPU architectures don't grow on trees.

Better to lobby for open specs on the "offending" bits of hardware, really.

* - yes, software creation can also require material resources (and a whole lot of time, which can be expensive). Let's not belabor that point...

</comment><comment><USER67> > POWER is the only architecture currently competitive with Intel in terms of > raw performance, and boots using a fully FOSS firmware with no DRM > antifeatures embedded.

That's pretty cool. This combined with some benchmarks I saw for server workload on POWER8 will hopefully revive some interest in the platform.

</comment><comment><USER68> Opterons from 2011-2012 are still available and seem to be the best option to me for this purpose. They're reasonably performant (16 cores...), affordable and there are plenty of mainboard options. Software support is excellent of course. I'm just not sure how valid the "pre-2013 AMD is safe" claim is, since vendors have been known to include some remote management technology like Intel's ME in earlier versions before making it a standard feature.

</comment><comment><USER69> Wait until he finds out about microcode!

<comment><USER15> umm...he already knows about microcode obviously. Libreboot does not allow microcode updates.

</comment></comment><comment><USER48> 1) _requires FOSS users to purchase a license from Microsoft to boot FOSS on affected machines that lack an appropriate Secure Boot override._

What "appropriate" Secure Boot overrides are available?

2) _the end user is unable to modify the signed software without a license from Microsoft, even though they have the source code available to them under the GPL._

Other parts of the posting imply that we have no idea what the software does, but thhe statement above says we have the source code. What am I misunderstanding?

<comment><USER70> 1a) switch it off (iff the vendor lets you)

1b) nuke the platform signing key and replace it with your own (iff the vendor lets you)

2) You're mixing things up. "We have no idea what the software does" refers to the hardware management code, which can run a full OS stack. But that quote refers to the tivoization "feature" of Secure Boot: you can recompile your software, but not run it on the hardware, because you lack the signing keys to make the machine trust your code. But, see 1)

</comment></comment><comment><USER71> This is a one-sided view. It can, and also is, used to implement theft- protection, thanks to which the police tracked the guy, he got convicted and I got my expensive laptop back. Yes, the guy reinstalled the OS, but the tracking SW survived precisely thanks to these technologies.

<comment><USER72> Can you give more details on what OS and tracking SW you were using?

<comment><USER71> Absolute LoJack, with windows. It installs itself as a windows driver before/during the boot. It sends location once a day, or more often if you flag the device as stolen/missing. It can also remotely "brick" the device (yes, it can be undone by the owner) if the data is of concern.

I deliberately did not set BIOS password so that the laptop remained usable to whomever got their hands on it.

</comment></comment></comment><comment><USER73> Despite all my rage I am still just a rat in a cage.

</comment><comment><USER74> > Secure Boot [...] requires FOSS users to purchase a license from Microsoft

Nope.

<comment><USER10> Requires purchase of a cerficate from one of the authorities Microsoft recognises (Verisign/Digicert/...) and then the signature of Microsoft on compiled bootloader code. Either way, you have to pay and you have to get Microsoft's permission.

<comment><USER75> IFF you want to support the default set of keys installed on computers that ship with Windows. Secure Boot does not prevent you from installing your own keys, in fact most linux distributions do this already and just use a shim loader signed by Microsoft, the rest of the chain is signed by custom keys (the keys are silently and automatically installed for you).

<comment><USER76> > IFF you want to support the default set of keys installed on computers

Which happens to be a case if you want to use a extension card with its own BIOS. If it is signed, what key is used? Can you resign with your own?

<comment><USER77> IIRC, Secure Boot spec said there must be multiple trust anchors, i.e. it's not like "user's own or Microsoft", but there can be any combination of trusted CAs (and I bet there's NSAKEY somewhere, huh).

I'm not sure about the implementations and real-world situation, but as far as I get it, with X.509 with Secure Boot generally uses, one should be able put the exact card's vendor certificate (not MS CA root one) to trust the extension card. (Sadly, I think there's no way to trust one specific signature.) I guess that's probably very non-trivial in practice.

At worst, one should be able to put their own CA (to sign their own software) and be forced to add MS CA to trust the third-party software as well. But - <USER2> UEFI implementation allows user-defined CAs - it should be possible to run your own code without asking Microsoft's permission.

</comment></comment></comment></comment></comment><comment><USER78> SHA1

</comment><comment><USER79> Okay, so we get a pile of FUD (Secure Boot and Intel ME are DRM features now? 'kay), no acknowledgement of the actual security threats that compel Intel, AMD, Microsoft and the OEMs to adopt these measures, and an appeal to dump x86 for ARM (um), MIPS (uhhhhhhh), POWER8 (wat), and RISC-V (how?). What is the point of this, exactly?

<comment><USER50> If a secure boot chain makes you feel nice and fuzzy inside, then perhaps you might be interested in setting up your own. Without the ability to do so, you are boned if the trusted entity becomes untrustworthy (such as if the mfg was to be acquired).

If you alone are the trustworthy entity, things work better.

<comment><USER79> > If you alone are the trustworthy entity, things work better.

That really, really depends on how trustworthy you are, doesn't it? I would argue that most computer users don't and shouldn't trust themselves to secure against low-level threats, and some of the people who do trust themselves really shouldn't.

<comment><USER80> Yup. I run Debian instead of Gentoo because, for various reasons, I trust the Debian project to be better at things (like triaging, backporting, compiling, and testing security updates promptly and correctly) than I trust myself. I think this is a common decision.

I later extended this logic and bought a Chromebook—a decision I don't take lightly, as a free-software advocate, but I was not convinced that there was an alternative that effectively let me retain more control over my computing. One of the things the Chromebook does that basically nobody else does (systemd vaguely wants to do this, my previous employer wanted to do this for our customers, etc., but I don't think anyone actually does) is it enforces a secure-boot-style thing for the entire OS, and makes it hard for anyone who doesn't have the signing key to take control of my computing away with me. In an ideal world, someone other than Google would have the signing key. But per the logic above, I definitely _don 't_ want it to be me.</comment></comment></comment></comment>