Monotype launches the first redesign of Helvetica in 35 years - <AUTHOR> https://www.creativeboom.com/resources/monotype-launches-the-first-redesign-in-35-years-of-the-worlds-most-ubiquitous-font-helvetica/ <comment><USER2> Helvetica's relatively less popular but ubiquitous cousin, Univers also got a facelift in 2010 after 30 years before Adrian Frutiger passed away under the name "Univers Next" [1], the most prominent aspect of the redesign being the return of 16 degree italics blessed by Frutiger himself.

In my view, Univers evokes a deep feeling of sophistication unlike any other font. Helvetica has the "grunge" and New York aesthetic after it took over the graphic design scene in the 70's and 80's whereas Univers was silently used in engineering manuals, control panels, branding, keyboards(Apple), movie credits [2] and UI without much fuss. It never became cool and edgy as Helvetica, never tried to be something it is not and doesn't have a following. I was lucky enough to visit the archives [3] in a obscure drawer at the Museum fur Gestaltung in Zurich, seeing the original manuscripts of Univers was an extraordinary feeling. Created in 1950, it is truly timeless and sits along with other giants of contemporary typefaces such as Futura and Eurostile, perhaps in the back row towards the corner.

Univers was, is and always will be.

It's my favorite font.

[1] [https://www.myfonts.com/fonts/linotype/univers- next/](https://www.myfonts.com/fonts/linotype/univers-next/)

[2] [https://www.dafont.com/forum/read/5633/what-s-the-font- for-m...](https://www.dafont.com/forum/read/5633/what-s-the-font-for-movie- credits)

[3] [https://www.eguide.ch/en/designer/adrian- frutiger/](https://www.eguide.ch/en/designer/adrian-frutiger/)

<comment><USER3> +1 for Univers!

Honestly, it's right there in the names. Helvetica projects a very Swiss Modern feel to it. Sometimes that's what you want, sometimes it's not. Univers is the most neutral typeface around that's got any personality at all. (I've always felt Haas Unica and many of the modern sans faces, especially the "brand" ones, have so little character to them that they're just completely bland and uninteresting.) Univers just... is. It's Frutiger's best design, and that's saying something.

Other favorites of mine include Trade Gothic (& friends) and Futura. I'm a huge fan of the 1930s-1970s "industrial" look, like you might find stamped on motor nameplates for heavy machinery, or the Apollo cockpits, or the IBM 360 consoles. These designs just scream _solid_ in a way that modern stuff... doesn't. (Maybe because it isn't.)

(Tangent to a tangent: does anyone know what typeface HP used on their equipment in the '70s through '90s? It's a very close cousin to Univers, but not identical. Maybe something internal only? I don't think it's just an odd cut of any of the usual suspects either. This is another typeface that has always connoted reliability and stuff that Just Works to me.)

Still, though, like you, I'd say Univers is my favorite more days than not. If I had to pick only one typeface, it'd be the one (more days than not)... just don't make me do that :)

<comment><USER4> Univers makes me think of something like 2001: A Space Odyssey where computers are just running everything and they've long since figured out how to do it efficiently.

<comment><USER5> That's mostly Microgramma, although its successor Eurostile has become a default for spaceship signage.

Microgramma really hits the spot for a certain kind of 60s/70s retro-futurism.

</comment></comment></comment></comment><comment><USER6> I know it's a "design" website and all, but can't they just show an A-Z so I can look at it?

The official website has better representations, but is still full of a load of flashy animations and videos before you get to the actual font [https://www.monotype.com/fonts/helvetica- now](https://www.monotype.com/fonts/helvetica-now)

<comment><USER7> I was thinking the same thing and went through the whole article looking for a representation of the old font vs. the new font. It's my understanding that the only changes where kerning and slight shape changes but a picture of them side-by-side would be nice.

</comment></comment><comment><USER8> I did a little comparison between the bold weight of Helvetica, Helvetica Neue, and Helvetica Now, and the new typeface does look really, really nice. The letterforms aren't too noticeably different, but the kerning and relative positioning of the letters have been tweaked in such a way as to make the font appear more pleasing and readable (at least on my computer display). I'm also pleased this new font is available for use on websites via Fonts.com and in mockup work via SkyFonts. I'm definitely going to keep this in mind for future projects.

</comment><comment><USER4> Interesting. The new design makes it seem like they're trying to get away from the political stigma of Helvetica, while also kind of poking fun at it. Whereas the idea of Helvetica was to evoke things like openness, transparency, neutrality, naturalness, etc., the new typeface strikes me as being much more opinionated, but in a purposely understated sort of way.

In a lot of ways it really looks like someone took the core ideologies of modern third-places and distilled them into a visual type system, which maybe says something about the privatization of formerly public spaces and infrastructure over the past 50+ years.

<comment><USER9> I love that I have no idea whether that second paragraph is a real analysis or one making fun of font nerds.

<comment><USER4> I mean if you watch the documentary Helvetica they do a pretty good job of explaining both the political statement the typeface was trying to make, the backlash against it as it was adopted/hijacked by corporations, and then the post-backlash period where we are now.

If you look at the new typeface it's clearly designed primarily for the needs of consumer products and advertising. They could have instead created a typeface that was purposely designed to look bad on consumer products and in advertising, but that's not the direction they went in. That's not an accident, it was a deliberate design decision.

Whereas the goal of the original typeface was to create a better society, the goal of the new one is basically to make it onto a Starbucks cup. It's not even a subtle difference, even though it's supposedly just an updated typeface the two are really night and day.

<comment><USER10> > the political statement the typeface was trying to make

Hmm, I think that a typeface is possibly the least effective way to make a political statement. Approximately zero people looking at it will impute a political message.

<comment><USER11> Less true than you might be aware yourself, actually.

Think of written Russian. Did you think of beautiful cursive Cyrillic as Pushkin would've written or some blocky reverse-R all caps propaganda text?

Wonder why literally everybody associates anything written in "German Gothic" (blackletter, actually, but I digress) is instantly associated with a guy with a Chaplin moustache but who isn't Chaplin?

Why Simplified Chinese was designed to look good with printed serifs which interfered with the Traditional script's typography?

And I'm not even a graphic designer or a "font nerd"...

<comment><USER6> I associate German gothic text with beers

<comment><USER11> And the Metal Umlaut?

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> It looks OK from the specimens, Neue Haas Grotesk is still the best Helvetica IMO

...

Font licensing is immoral rent seeking that takes advantage of a legal loophole and goes against the spirit of the law in major countries (typefaces are ineligible for copyright in at least the US and Japan), and I'm always disheartened by how many individual designers and companies have fallen for it.

<comment><USER13> Can you say more about this?

<comment><USER12> [https://en.wikipedia.org/wiki/Intellectual_property_protecti...](https://en.wikipedia.org/wiki/Intellectual_property_protection_of_typefaces)

> Typefaces cannot be protected by copyright in the United States (Code of > Federal Regulations, Ch 37, Sec. 202.1(e); Eltra Corp. vs. Ringer). The idea > that typefaces (rather than fonts, which are computer software) cannot be > copyrighted in the United States is black letter law. 37 C.F.R. § 202.1(e). > Under U.S. law, typefaces and their letter forms or glyphs are considered > utilitarian objects whose public utility outweighs any private interest in > protecting their creative elements. However, there is a distinction between > a font and a typeface. The machine code used to display a stylized typeface > (called a font) is protectable as copyright. In 1992, the US Copyright > Office determined that digital outline fonts had elements that could be > protected as software. Since that time, the Office has accepted registration > of copyright for digital vector fonts, such as PostScript Type 1, TrueType, > and OpenType format files.

TL;DR

"On a computer, a typeface isn't a typeface so you have to pay us for it"

c.f. Apple and rounded corners, Mickey Mouse...

<comment><USER14> Then why isn't every high profile font from Hoefler etc. immediately cloned by a generic competitor?

<comment><USER15> A while ago there was a case when the guy behind Maven Pro produced a very nice font that felt vaguely like Whitney. Lo and behold, not two days after he delisted it. When pressed for reasons, he said he got a letter from Hoefler himself on how one cannot get insipired by other people's work, chided him for being unoriginal and implied dire legal consequences of not taking it down immediately. Mind you, the point of contention was a _feel_ of the font.

<comment><USER14> Do you have a link? Would love to read up more.

</comment></comment></comment></comment></comment></comment><comment><USER16> The name Helvetica Now seems like an April Fools' joke. The name will not age well, plus there is potential for confusion with Helvetica Neue.

<comment><USER17> Not disagreeing, but to be fair, Helvetica Neue (neue meaning new in German), did not age well either. I would assume the creators are aware of that, maybe even choosing that name to be in the tradition of Neue.

</comment></comment><comment><USER18> absolutely grotesque

<comment><USER19> Maybe so, but please don't post unsubstantive comments here. What would make a comment like this interesting is specific information about what is bad in the diff and why. (That, plus maybe a bit less name-calling.)

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

Edit: no, you guys are right, I totally didn't get the joke.

<comment><USER20> I think you got swooshed, a bit. The GP was almost certainly making a pun. [https://en.wikipedia.org/wiki/Sans- serif#Grotesque](https://en.wikipedia.org/wiki/Sans-serif#Grotesque)

<comment><USER16> I thought so too but dang's post history shows knowledge of type. Maybe dang is saying that calling this a grotesque font is name calling and poster should post more on why it is one.

<comment><USER21> He specifically says "what is bad" \-- he simply didn't get the joke. No need to prance to defense of the mods when they miss something.

<comment><USER22> Ok what do I need to know to get this joke?

<comment><USER23> _Grotesque_ in the context of typography is a category of sans serif typefaces, specifically the one from which typefaces like Helvetica descend (they are usually called neo-grotesque). So the GP joke is based on a double meaning: on a first read it may seem an insult, but typographically he is just stating a quite obvious thing: that Helvetica Now is a grotesque typeface.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Does this mean Apple will license this and include it in macOS the way it does (presumably) with Helvetica and Helvetica Neue? I really have no idea how something like this happens.

<comment><USER25> Apple no longer use this front. They have created their own font, San Francisco, and started using it 3 to 4 years ago.

Edit: oh, I misunderstood! Apple might start using it, but they are not compelled to. A lot of other fonts such as Palatino have also been updated, but Apple doesn't include them (yet).

<comment><USER26> Its not installed as an available font in MacOS, even though the its used for the UI. You can get it here if you want to use it within their licensing guidlines: [https://developer.apple.com/fonts/](https://developer.apple.com/fonts/)

</comment></comment></comment><comment><USER27> Side-by-side comparison?

</comment><comment><USER28> The Verge also did an interview with the designers [1]; I prefer The Verge interview to the Creative Boom announcement [2] that's the article link at the time of writing, because the interview adds detail behind the design process and reads much less like a marketing announcement.

Truly the most amusing thing about the new typefaces are the alternate forms of certain iconic letters. The alternate forms are more classically resemble the legendary Akzidenz-Grotesk, in the tradition of paring back the few flourishes that Helvetica did have.

Ironically some of the alternate forms also make it resemble Arial, Monotype's famous metric-identical Helvetica clone, despite Monotype's long insistence that Arial is less grotesk and more humanist. But I also found the not-sure- if-serious dissing of Arial to be mostly signalling and snobbery. Other alternate forms seem a bit odd, as if someone was playing 'design your own sans-serif typeface' and filled out the missing cells of a big row-column table for completion, like here's a geometric 't', and a humanist 'l'.

But all that aside, the new typefaces look nice and are redrawn with purpose. The micro variant actually makes Helvetica usable at small sizes for the first time. It's a well-crafted family in the honor of a classic.

[1] [https://www.theverge.com/2019/4/9/18302057/helvetica-now- new...](https://www.theverge.com/2019/4/9/18302057/helvetica-now-new-monotype- typeface-charles-nix-design-optical-sizes-alternate-characters) [2] [https://www.creativeboom.com/resources/monotype-launches- the...](https://www.creativeboom.com/resources/monotype-launches-the-first- redesign-in-35-years-of-the-worlds-most-ubiquitous-font-helvetica/)

</comment><comment><USER29> There's a relative to Helvetica, Unica, with quite an interesting story: [https://lineto.com/Lineto.com/Frontpage+Features/LL+Unica77/](https://lineto.com/Lineto.com/Frontpage+Features/LL+Unica77/)

</comment><comment><USER30> How do you "re-design" a font? Isn't that just making an entirely new font with a subtley different style? Or is this more backfilling tons of unpopulated UTF-8 characters that aren't covered by the original font?

</comment><comment><USER31> Where can I read more about the history of these "big hitter" fonts? It's interesting to hear about the context within which they were created.

</comment><comment><USER32> How is this $300 Helvetica compared to the free Noto font (which has sans- serif, serif and monospace from condensed extra light to bold)?

</comment><comment><USER33> The article mentions a single story lowercase 'a' and straight-legged capital 'R'... does anyone have a comparison for these? I'm unable to see it on [https://www.monotype.com/fonts/helvetica- now](https://www.monotype.com/fonts/helvetica-now)

<comment><USER34> [https://www.myfonts.com/fonts/mti/helvetica- now/](https://www.myfonts.com/fonts/mti/helvetica-now/) lets you choose stylistic alternates. Stylistic set 04 is straight-legged R.

</comment></comment><comment><USER35> Why is the T presented as though it is always aligned relative to its middle bar? Not only would this be an incredibly bad idea, it is (fortunately) not done on the official site [0]

[0] [https://www.monotype.com/fonts/helvetica- now](https://www.monotype.com/fonts/helvetica-now)

<comment><USER36> I'm not too knowledgeable about fonts (although I did learn how to spot Arial from Helvetica in that famous essay). Why does the uppercase R with its curvy "right leg" feel out of place with everything else that's straight?

</comment></comment><comment><USER37> So...

My dad was a typesetter and prepress technician for years. His favourite font was helvetica. I sent him this link. Here are his comments:

>They fucked with "R" the only way too tell them abart, and they gave it a streight leg.

>They messed with the dots wich was the othe way you could tell.

</comment><comment><USER38> Design comment: what's the deal with the googly eyes in the static header on mobile?

<comment><USER22> It's creative. bOOm.

<comment><USER39> I actually liked it. Often text logos can compete with the main text and headings in an article. Especially on mobile. Keeping the top nav all icons made the text of the article pop a bit more.

<comment><USER38> This may be different from my phone to yours, but the eyes bounced back and forth on Safari mobile. This definitely took attention away from the article.

</comment></comment></comment></comment><comment><USER40> Gotta say, the f and the t in the micro font are not good. At least while looking at it in my browser (firefox nightly on linux). They look like something out of comic sans.

<comment><USER41> I think it's quite legible at intended sizes, though. Around 6pt or less.

<comment><USER42> Here's a screengrab from a "2x retina" display of the sales page showing 8pt (so view this at 50%)

[https://i.imgur.com/9tpX2Vq.png](https://i.imgur.com/9tpX2Vq.png)

</comment></comment></comment><comment> black-tea Is it really "the most ubiquitous font"? I always notice when someone has used Helvetica itself rather than some generic sans serif clone and it's not that often.

</comment><comment><USER43> Too bad this font doesn't have a free license.

<comment><USER44> Fonts like this represent an insane amount of work though. I would love a free version, but I can understand why they aren't free.</comment></comment>


The Opa Language - <AUTHOR> http://opalang.org/ <comment><USER2> So.. what exactly are the goals here?</comment>


Will Windows Matter in 10 Years? - <AUTHOR> http://blog.travisbloom.me/post/7553419381 <comment><USER2> Yeah, that's pretty much correct, except for this, referring to corporate usage: "Because Windows infrastructure has been used and perfected for so long, I do believe they will still maintain a majority stake in 10 years."

That's rotting too. When those kids in college with 70% Macs go into the workforce, and are used to 1) everything in the cloud, 2) computers that actually work, 3) not being subject to the IT department for login problems, problems caused by malware, problems caused by anti-malware, Exchange problems, and so on, you think they're going to put up with Windows? In the last ten years of my working life, I've been at companies going from all Windows, to Windows + Mac + Linux, to a completely Windows-free environment. Even our marketing guys are on Macs and google mail/calendar. They still have Office on Macs, but google docs is displacing that quickly, because sharing Office docs _sucks_.

I think Microsoft experiences its first quarterly loss within 10 years.

</comment><comment><USER3> The cloud is going to eliminate the need for Windows IT infrastructure. Who needs group policies when you run everything in the cloud?

<comment><USER4> What do you think "the cloud" is running on?

<comment><USER5> LAMP, mostly.

<comment><USER4> LAMP is not the "cloud". It's a stack of an operative system (Linux), web server (Apache), database engine (MySQL) and scripting language (PHP). It's used for hosting web applications.

The vague "cloud" term, ultimately boils down to an internet connected server running Linux or Windows, with various layers of connectivity, applications, API's and storage access on top.

Meaning, if your company uses Microsoft software (which the majority does), a transition to the "cloud" will just mean that parts or all of your Microsoft systems, now are hosted by Microsoft themselves or a third-party, compared to being placed locally.

</comment></comment></comment></comment><comment><USER6> To ask this question and start out completely discounting the corporate market is ridiculous.</comment>


The true power of regular expressions (2012) - <AUTHOR> https://nikic.github.io/2012/06/15/The-true-power-of-regular-expressions.html <comment><USER2> I find this to be an interesting side effect of computer science as a branch of mathematics vs applied computer science in "programming" and "development".

I remember touring the computer science building at the university I would end up attending before I had enrolled there - some students in one room were discussing whether there was a regular expression for detecting prime numbers. I laughed to myself - because in my mind, that's not at all what a regular expression was.

Sure enough, there is in fact such a regular expression (or "regex pattern", if you prefer)[1]. Regular expressions in practice encompass BOTH the academic level-3 regular grammar stuff, and a bunch of other stuff that's been tacked on because it's useful in real-world applications.

[1] - This has been posted on HN before, probably a bunch of times: [https://iluxonchik.github.io/regular-expression-check-if- num...](https://iluxonchik.github.io/regular-expression-check-if-number-is- prime/)

<comment><USER3> This regex doesn't tell whether a number is prime, it tells whether the length of a specially crafted string is prime.

Kind of a big difference as you can make a regex that answers _any_ yes/no question if you preprocess the input enough.

<comment><USER2> Well, saying that a number presented as unary isn't a number, to me, is the same as saying that a number presented as decimal isn't a number. But you're right that it is "specially crafted" rather than a general solution.

</comment></comment></comment><comment><USER4> While true that PCRE is widely used, it is also true that there are several regexp libraries that do not veer very far from the formal regular language theory. Most notably Googles re2 which is based on finite automation engine.

<comment><USER5> Yes, there's a claim in TFA about modern implementations going well beyond regularity, and, well, if you consider PCRE modern, then sure, just as TS Eliot is Modern. Now _contemporary_ regexp engines, OTOH...

</comment></comment><comment><USER6> > So if somebody found a fast solution to a NP-complete problem, pretty much > all of the computationally hard problems of humanity would be solved all in > one strike.

There are plenty of interesting computationally hard problems that are (probably) harder than NP-complete problems, e.g. PSPACE-complete problems. For example solving chess, or more on topic, the problem of "does this regular expression generate all strings over this alphabet"?

<comment><USER7> Small but relevant nitpick:

 _Generalized_ chess is EXPEPACE-complete. Standard chess has an 8x8 grid with a finite number of states. In theory, chess is solvable in constant time (because you can provide a finite lookup table).

<comment><USER6> If I understand correctly it's only exptime-complete if you allow an exponential number of moves? If you only allow a polynomial number of moves then it's PSPACE-complete.

But yes good point about specific board sizes :)

</comment></comment></comment><comment><USER8> My takeaway from this, since the majority of it went over my head: I can continue to parse HTML with regular expressions.

<comment><USER9> I disagree with that takeaway.

Technically PCRE regexes are powerful and can match anything.

In reality, a complex PCRE regex will almost always be more difficult to maintain than a parser-combinator or hand-rolled parser in a more traditional language.

People saying "Regexes can't match HTML, use an html library" are wrong to say regexes are incapable of it, but they're right to say to use a library meant for the job.

Sure, you can use this regex to match emails ([http://www.ex- parrot.com/pdw/Mail-RFC822-Address.html](http://www.ex-parrot.com/pdw/Mail- RFC822-Address.html)), but using a more normal parsing language than PCRE regex will result in more readable code.

The same is true for almost any regular expression that takes advantage of PCRE features, especially backreferences.

In addition, a regexp will only match html correctly if you write a very complex one. With a naive regexp for an html tag's contents, you'll find that you still might match that text inside a <script> tag even though that is not html.. so you now need to figure out when you're in a script tag and exclude that, or if you're inside an html attribute string, and before you know it you have a 2000 character regexp that no one else will be able to read, all because you didn't want to use an html parsing library where getting a tag's value correctly would be a single xpath expression or css selector away.

<comment><USER10> There's no arguing the fact that regexes are a poor fit for HTML, but maybe this is the wrong time to use that ridiculous email regex as an example, since TFA features a highly readable, fully compliant email matching regex as its main example.

<comment><USER11> What the language contains as a main example is PCRE pattern that matches email addresses and in comparison to it's original EBNF incarnation is highly unreadable due all the syntax noise required to graft backtracing support onto traditional regex syntax (not to mention the fact that it's performance is certainly highly suboptimal).

<comment><USER9> The performance might be better in some cases actually.

In the case of perl, where regexps performance has been optimized for significantly, the regexp actually performs better than a more normal parser.

From [http://www.ex-parrot.com/pdw/Mail-RFC822-Address.html](http://www.ex- parrot.com/pdw/Mail-RFC822-Address.html):

> It provides the same functionality as RFC::RFC822::Address, but uses Perl > regular expressions rather that the Parse::RecDescent parser. This means > that the module is much faster to load as it does not need to compile the > grammar on startup.

Of course, if perl were a statically compiled language, the cost of compiling the grammar could be done at compile time.

<comment><USER11> Perl5 is not too meaningful for such performance comparisons, because on one hand it's regex implementation is very optimized while on other hand performance of Perl5 on "normal" procedural code is horrible (eg. Perl5 is about an order of magnitude slower on Gabriel's Takeuchi function benchmark than CPython).

<comment><USER12> This result generalises to most interpreted languages though. PHP, python, javascript, etc all have highly optimised regex engines, and regexs can consequently be a good optimisation technique when using those languages.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Wow! Fascinating! The portion displaying the regular expression for matching email addresses as per RFC 5322 was excellent. I've not once seen a regular expression written out this way.

</comment><comment><USER14> Related content on Stack Overflow: "Regex: How to find and extract acronyms and corresponding definition of acronym from a text?"[0] that gives the nearly the same RFC 5322 parser.

The reduction of 3CNF-SAT seems to be borrowed from "Reduction of 3-CNF-SAT to Perl Regular Expression Matching"[1], whose author is careful to note that the reduction shows that regex matching with backreferences is NP-hard. To show that it is NP-complete, you'd also have to show that regex matching with backreferences is also in NP, _i.e._ , that any match is checkable in polynomial time.

Readers may also be interested in "Oh Yes You Can Use Regexes to Parse HTML!"[2] on Stack Overflow by Tom Christiansen.

[0]: [https://stackoverflow.com/a/18339610/123109](https://stackoverflow.com/a/18339610/123109)

[1]: [https://perl.plover.com/NPC/NPC-3SAT.html](https://perl.plover.com/NPC/NPC-3SAT.html)

[2]: [https://stackoverflow.com/a/4234491/123109](https://stackoverflow.com/a/4234491/123109)

</comment><comment><USER15> Lots of previous discussions at [https://hn.algolia.com/?query=The%20true%20power%20of%20regu...](https://hn.algolia.com/?query=The%20true%20power%20of%20regular%20expressions&sort=byDate&dateRange=all&type=story&storyText=false&prefix&page=0)

</comment><comment><USER16> _Wrapping up As the article was quite long, here a summary of the main points:

\- The "regular expressions" used by programmers have very little in common with the original notion of regularity in the context of formal language theory.

\- Regular expressions (at least PCRE) can match all context-free languages. As such they can also match well-formed HTML and pretty much all other programming languages.

\- Regular expressions can match at least some context-sensitive languages.

\- Matching of regular expressions is NP-complete. As such you can solve any other NP problem using regular expressions._

I wish he wrote that in the beginning of the article. Would have saved me a lot of skimming (I already know grammar theory).

</comment><comment> another-cuppa It's only OK to parse something with regex if it was defined with regex. Far too often I see people wanting to match postcodes and things which are not defined by regex and your heuristic could break at any time.

<comment><USER17> What about postcodes makes heuristics break for regex but not a general parser? I'd assume if the format changed it'd break both all the same.

</comment></comment><comment><USER18> As a lead developer, I frown upon every instance of regex used. If it's shorter then, say, 20 characters, it may be allowed. Longer then that will result in a negative advice and binding advice to refactor. You implement a language lexer & parser, or use plain string functions.

<comment><USER19> I'd expect you, "as a lead developer," to know how the tokenizer in your lexer almost certainly works. Rather than frowning upon "every instance of regex used," I'd expect you to be familiar with cleaner and more maintainable ways of writing regexes, which are, after all, just declarative ways of specifying finite automata. An NFA is infinitely easier to characterize than some mess of a hand written recursive descent parser, precisely because they are so restricted.</comment></comment>


Subsidiary for startups - <AUTHOR> My cofounders want to establish a subsidiary company to spin off a new service.  The only reason for doing that is to satisfy existing investors because we used their money to build the new service.  I want more opinion about this issue... Personally, I don't think that is a good idea because the subsidiary will be controlled by the parent company (to let investors to have a cut of it) which might affect followings; 1. No investor is willing to invest that kinda subsidiary company especially the parent company is only Pre-A without a clear growth. 2. Early employees might have less motivation for this subsidiary startup. (because it loses part of the fun part of being a startup: doing the way you want)
We should either stay at the same startup or spin off an independent startup but not to make a subsidiary.  Existing investors can still have better term to invest in the new startup.  Anyway, I am trying to let members know this isn't a good idea but it seems the knowledge I have isn't enough for them...
Any suggestions?
Thanks! <comment><USER2> From the description I see two orthogonal issues.

1\. Is the new business model better from a business standpoint than the current idea?

If yes, forget about a subsidiary and pivot all resources to the new business model. How that is done depends on the second issue:

2\. Are the investors suitable for the new business model? [where "suitable" means willing to maintain their investment following a pivot.]

If no, then folding the existing company and starting a new company is an option worth considering. Such a case illustrates what YC means by "investing in people rather than ideas".

On the other hand, if the answer to the first question is no, then the idea of a subsidiary has a high probability of forming a distraction for a resource constrained company.

Finally;

A. Adding a subsidiary just complicates the legal structure of the company and therefore is likely to discourage investors.

B. A company can have two or more products without forming a new legal entity.

Good luck.</comment>


Rocket science – how hard can it be? [video] - <AUTHOR> http://media.ccc.de/browse/congress/2014/31c3_-_6180_-_en_-_saal_2_-_201412271830_-_rocket_science_how_hard_can_it_be_-_david_madlener.html

<comment><USER2> Not hard at all. Here are few key points to remember:

      - parachutes go at the top, engines goes at the bottom
      - engines point down
      - don't mess up your staging
      - if you didn't go high enough, put more boosters
      - if you fell apart in flight, put more struts

Sincerely, Jebediah Kerman.

<comment><USER3> Jebediah is an accomplished pilot, but does not know much about _building_ rockets. I am sure that Bill Kerman would have a few choice words to say on the subject.

<comment><USER4> Given amount of rockets of all types of quality that Jeb had been in, I think he developed quite a intuition for how a good rocket should be built. In particular this is not it: [https://www.youtube.com/watch?v=R0JUMFXlOsU](https://www.youtube.com/watch?v=R0JUMFXlOsU) (No wonder Jeb did not pilot this one).

</comment></comment></comment><comment><USER5> This guy is very entertaining in the video, and what they're doing is very practical.

Rocket engines sometimes get described as extreme plumbing. Big rockets that are more powerful than the simple solid rockets the video describes tend to use cryogenics like liquid oxygen (-185C/-300F) in one part of the rocket, and then at the other extreme have a combustion chamber over 1500C/2750F that will melt most metals.

Rocket science _is_ hard.

For some more good reading, there's a great usenet archive of sci.space at [http://yarchive.net/space/index.html](http://yarchive.net/space/index.html)</comment>


The Handshake Network wants to reinvent DNS - <AUTHOR> https://www.technologyreview.com/s/613446/the-ambitious-plan-to-make-the-internets-phone-book-more-trustworthy/ <comment><USER2> In practice, DNS is already sort of not-centralized (even if it would be incorrect to call it decentralized). One can decide to use specific name servers that do not follow ICANN's rules. See for instance the OpenNIC project. They even operate non-standard TLDs.

Using a blockchain has little benefits. And I believe it's energy cost is really not worth it in the current situation.

<comment><USER3> DNS is hierarchical, but that doesn't matter because it's effectively controlled by ICANN and big name registrars. "permissionless" is what we need, but you can only get there through decentralization.

This is a perfect usecase for blockchain, because we need permissionless writes to a distributed ledger. The energy costs of running the blockchain would likely be equivalent if not less than the current system (what's the energy cost associated with running Godaddy?).

An alternative would be to scrap the idea of memorable domain names all together, and move toward something like QRcodes + tor like public keys + petnames or similar.

</comment></comment><comment><USER4> > We use the DNS because most humans are bad at keeping track of long numbers.

I almost feel the need to challenge that these days. While it's absolutely true as far as the original intention went, and is true to a limited amount today, I think the days of most people typing domain names into the location field of their browser is largely over. Google search is the modern DNS when we're talking about that purpose. Today, I think DNS is much more about the _permanence_ of an address, not whether it's memorable.

<comment><USER5> Agreed that it's about changing what IP and address resolves to, 32 bit IPs don't have to be harder to memorize than a phone number. In fact most IP addresses can be represented as a 10 digit decimal notation and last I checked chrome will resolve this "phone number" representation into the traditional quad-octet

<comment><USER6> > most IP addresses can be represented as a 10 digit decimal notation

Can't all ipv4 addresses be represented this way, since it's equivalent to a 32 bit int?

<comment><USER5> You're right, I can't remember why I was thinking I ran into 11 digits...

</comment></comment></comment></comment><comment><USER7> I remember this was hot about 3 years ago.

Nothing will happen unless it's integrated into the major browsers. Afaik, no one is planning that.

<comment><USER8> You wouldn't integrate it in the browsers, but instead you'd probably want it on the OS level.

<comment><USER9> Exactly. With all of these proposed DNS replacements, support at the OS level is the first step to true adoption. Perhaps Linux-based OSes would be the places to start...

</comment></comment></comment><comment><USER10> DNS-blockchain was already done, 8 years ago: [https://en.wikipedia.org/wiki/Namecoin](https://en.wikipedia.org/wiki/Namecoin)

</comment><comment><USER11> This will catch on faster than IPv6...

</comment><comment><USER12> Didn't someone last year do an analysis where they thought Summit (250 PFLOPs) could do a 51% attack on Bitcoin?

My major concern would then be what about Aurora (1ExFLOPs)[1], Frontier (1.5ExFLOPs)[2], and similar computers? If the big draw is to avoid censorship this seems like a big concern. Potentially making us all more vulnerable because someone like China, Russia, or America could decide that they want to spend all those computing resources on an attack. It's not like these machines are a significant portion of the national budget and are really dwarfed by military budgets. We're only talking a few hundred million dollars to build and tens to operate.

I like the idea in principle, but is this worked out?

[0] [https://www.olcf.ornl.gov/olcf-resources/compute- systems/sum...](https://www.olcf.ornl.gov/olcf-resources/compute- systems/summit/)

[1] [https://aurora.alcf.anl.gov/](https://aurora.alcf.anl.gov/)

[2] [https://www.olcf.ornl.gov/frontier/](https://www.olcf.ornl.gov/frontier/)

</comment><comment><USER13> [https://github.com/Monadical-SAS/solana-dns](https://github.com/Monadical- SAS/solana-dns) Solana-based DNS would have performance benefits and also not wast the incredible amount of energy that traditional blockchains do.

</comment><comment><USER14> I stopped reading when the term "blockchain" arised. (Jokes aside, the paywall made me stopping reading)

> Old and busted: DNS over HTTPS. New hotness: DNS over blockchain > [https://twitter.com/dobes/status/1164412915648086016](https://twitter.com/dobes/status/1164412915648086016)

Original quote from [https://blog.fefe.de/?ts=a3a04f1b](https://blog.fefe.de/?ts=a3a04f1b)

<comment> m-p-3 So you stopped at Blockchain just above the title? ;)

Here's the IPFS [1][2] and Outline [3] copy after bypassing the paywall

1: [https://ipfs.io/ipfs/QmX6TTwqk4H6mKoKXHRGHYu22GZaCim9VBNtGdr...](https://ipfs.io/ipfs/QmX6TTwqk4H6mKoKXHRGHYu22GZaCim9VBNtGdrqWcS8Cm/)

2: [https://cloudflare- ipfs.com/ipfs/QmX6TTwqk4H6mKoKXHRGHYu22GZ...](https://cloudflare- ipfs.com/ipfs/QmX6TTwqk4H6mKoKXHRGHYu22GZaCim9VBNtGdrqWcS8Cm/)

3: [https://outline.com/96CLhZ](https://outline.com/96CLhZ)

</comment></comment><comment><USER15> How would blockchain make anything "unstoppable"? Malicious DNS records could still end up in the chain via other attacks. How does such a system handle establishing ownership of a namespace in the first place?

<comment> m-p-3 More like uncensorable, as unless you blocks all the nodes in the blockchain, the ledger will eventually makes its way to those who wants to download it.

</comment></comment><comment><USER16> Very similar to Ethereum Name System, down to Vickrey auction method.

</comment><comment><USER17> Discussed a month ago: [https://news.ycombinator.com/item?id=20625561](https://news.ycombinator.com/item?id=20625561)

</comment><comment><USER18> Mental note: Do some research later to see how this is different from namecoin.</comment>


Parallel Prefix Polymorphism Permits Parallelization, Presentation and Proof - <AUTHOR> http://arxiv.org/abs/1410.6449

<comment><USER2> I await with bated breath the story of the bar bet lost that generated that title. (Never mind that it actually seems like an interesting read!)

<comment><USER3> It was either 'go with the title or come up with another one', and I was too tired to argue.

By the way, the paper was really an excuse to document this IJulia notebook.

[http://nbviewer.ipython.org/urls/raw.github.com/jiahao/ijuli...](http://nbviewer.ipython.org/urls/raw.github.com/jiahao/ijulia- notebooks/master/2014-08-06-parallel-prefix.ipynb)

If you run it on your local machine, one of the cells has an interactive slider that lets you control the breadth of the parallel prefix tree you generate.

<comment><USER2> I didn't mean to imply the title was bad in any way - it just has that look (like the famed penguin diagram :) Personally, I think it's a triumph of alliteration, especially as it made sense.

And thanks for the direct link to the IJN. I really love that format, and will definitely run it on my machine!

</comment></comment></comment><comment><USER4> You left out "Presentation and Proof", say it right or don't say it at all.

<comment><USER5> Ah.. adding additional alphabetics annihilated an apex alliterative accomplishment. Also, acerbic and assholish annotations always abate awesomeness and aren't appreciated.

("Always avoid alliteration?" An arrogant and antiquated assessment.)

:)</comment></comment>


Learned helplessness and the languages of DAO - <AUTHOR> https://techcrunch.com/2016/10/01/learned-helplessness-and-the-languages-of-dao/?ncid=rss&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29 <comment><USER2> _And in the interim, let's do everything we can to finally start to fix traditional programming. It is not a quixotic dream; it actually is possible. Once we just accept that, everything can, and I believe will, be better._

This is literally magical thinking.

Formally verifying software, being disciplined about not adding unnecessary features, favoring simplicity over sophistication, using the tried and true instead of The New New Thing: all of these require a huge amount of willpower and fighting against the entire grain of the tech culture.

You will be branded a reactionary. You will be told you are stuck in the past. The person willing to promise marketing the moon will be promoted, you will be labeled "difficult to work with."

It's pretty black pill, but, as with our government: we are getting the software we deserve, good and hard.

<comment><USER3> Think of it as an opportunity. There is an insane amount of money to be made rescuing crashed projects built by people that were too focused on using the latest and the greatest tech rather than actually focusing on delivering what the customer asked, on time and within the alloted budget.

And by the time the project has crashed those promising marketing the moon will be fired, and you'll be labeled 'the guy/gal that saved the project'.

It's a pretty easy sell at that point, assuming the company survived the carnage.

<comment><USER4> You will still run into a lot of sunk cost thinking, and they will assume often that you will deliver everything the charlatans promised them.

Often it's the requirements that are the big part of the problem. Requests that defy physics aren't unheard of. Often the customer grasp how hard it is to change decisions in the structure after the fact. And what they have learned from this is to demand that everything in the system be "flexible". Which is how the giant white tower over engineered fiasco that preceded your arrival happened in the first place.

Infinitely flexible software requires infinite test infrastructure. Nobody teaches that, and many don't even recognize when it's happening to them. My observations suggest that most don't learn from the mistake. they blame the failure on the preventable mistakes in execution they imagine were under their control and they just try harder the next time.

</comment></comment></comment><comment><USER5> _> Everything is terrible because the fundamental tools we use are, still, so flawed that when used they inevitably craft terrible things. This applies to software [...] like the $150 million Ethereum DAO catastrophe._ [...] _> In principle, code can be proved correct with formal verification._

Formal verification is not applicable to the DAO hack that lead to some humans to decide on forking the blockchain.

Correctness in that example was in the eye of the beholder and from the perspective of the hacker that received the digital currency, it would have been formally verified as "correct".

<comment><USER6> Software correctness does not work like that. The DAO code as written allowed the theft, yes, and indeed was fully correct with regard to its specification - that is, itself.

Formal specification would involve writing safety properties in a higher-level language, and a machine-checked proof that the Solidity code enforced these properties. This ensures correctness of the Solidity code subject to correctness of the proof checker, execution model equivalence with reality, consistency of ZFC, etc. etc.

As you pointed out below, the safety properties validated could be irrelevant, poorly-formed, or (as a whole) incomplete. This is true, and also insurmountable - the chain of correctness has to start _somewhere_. Right now we have only an idea in someone's head, then Solidity code. The gap between the two is enormous and equivalence unverifiable. A higher-level spec greatly reduces the size of this gap and will catch the vast majority of bugs.

<comment><USER5> _> writing safety properties in a higher-level language,_

 _> This is true, and also insurmountable - the chain of correctness has to start somewhere. _

Exactly!

We can _shift_ the "correctness" test to correspond with the spec of the hypothetical higher language. But, we haven't actually _solved_ for universal correctness as it corresponds with how humans would ultimately decide what's correct.

In other words, the following function can be (trivially) formally verified:

      int increment_by_one(int x) { return x+1;}

If _int_ is signed 32-bits, one could brute force the tests for all 4,294,967,295 possible inputs. If x happens to be 2,147,483,647 and depending on the higher-level spec, one could define "correct" to abort with an error, or simply wrap around to a negative number.

However, the standard of "correctness" for Ethereum is much higher than that. Let's say there's an unwanted event called _Humans Will Decide To Fork Ethereum Because Of Unforseen Solidity Behavior_ which we'll abbreviate as HWDTFEBOUSB.

I contend the following static checker that correctly returns TRUE or FALSE is impossible to write:

      bool HWDTFEBOUSB(string Solidity_code)

In the context where you mentioned "insurmountable", I believe we are using the same frame of reference and are in agreement.

Is my insistence on universal correctness an unfair standard? I don't think so because Ethereum creators wanted the programming code in "smart contracts" to be the _ultimate and final arbiter_. No follies of human judgement or politics to "pollute" the transactions. If that's the goal, just using a higher level language as a specification language for formal verification engines _is not enough_.

<comment><USER6> Ah, I see what you mean. The fork would break the execution model/reality equivalence and thus (possibly) invalidate the verified properties. It could also modify the Solidity code itself, as in the DAO fork. Formal verification still provides benefit here: the proposed changes are easy to check for backwards-compatibility breakage prior to the fork, providing a valuable political tool to either oppose the change or require a rider contract code fix in the fork.

I do think your requirement of universal correctness is unfair. We can rightfully criticize the naivete or misleading marketing of Ethereum, but the system isn't valueless despite its limitations, and formal verification enables us to capture more of that value.</comment></comment></comment></comment>


Karma no longer 1-to-1 value-wise? - <AUTHOR> I haven't really paid attention to karma much in a long time, just something that fades into the background after you've been on HN a while. I'm noticing as a story I posted climbs the frontpage that I'm not getting 1 karma point per upvote. Note that it matters, but I'm just wondering when this changed, or has it always been this way?<p>Or is it based on some formula, or some other factor such as once you cross a certain karma threshold? <comment><USER2> For this kind of questions, it's better to email dang ( firstname.lastname@example.com ) directly to get a faster answer, sometimes the thread like this are unnoticed.

</comment><comment><USER3> I've noticed that too. Does someone flagging the story work against the story's points? Either 1-to-1 point reduction, or apply some sort of fractional multiplier to the point value of upvotes, perhaps?</comment>


Debugging mechanism in Intel CPUs allows seizing control via USB port - <AUTHOR> https://www.scmagazine.com/debugging-mechanism-in-intel-cpus-allows-seizing-control-via-usb-port/article/630480/? <comment><USER2> I posted this 71 days ago on HN.[1] I wrote this after reading the USB-C spec:

 _There 's a mode called "Debug Accessory Mode". This is totally different than normal operation and requires a special cable as a security measure. (In a regular cable, pins A5 and B5 are connected together and there's only one wire in the cable for them. Debug Test devices use a cable where pins A5 and B5 have their own wires and there's a voltage difference between them.) Debug Accessory Mode, once entered, is vendor-specific. It may include JTAG low- level hardware access. Look for exploits based on this. If you find an public charger with an attached USB-C cable, worry. Always use your own cable._

The "security" feature is that you need a nonstandard USB-C cable with an extra wire, and it needs to attach to something that sends JTAG signals.

The Google Pixel supports Debug Accessory Mode.[2]

[1] [https://news.ycombinator.com/item?id=12824366](https://news.ycombinator.com/item?id=12824366) [2] [https://plus.google.com/+BensonLeung/posts/XGLDnsF57PB](https://plus.google.com/+BensonLeung/posts/XGLDnsF57PB)

<comment><USER3> Alternatively all USB-C thumbdrives become a threat once they hit the market.

Given your commend it USB-C specific, and the linked article mentioned USB-3 (which has a USB-2 connector variant) what is the mechanism on those ports for detecting a debugger?

<comment> semi-extrinsic > Alternatively all USB-C thumbdrives become a threat once they hit the > market.

All USB thumbdrives are already a threat. Not just from autoplay/execute, but there are malicious/pentester thumbdrives out there (like the Rubber Ducky) that emulate a USB HID keyboard; computers have absolute trust in keyboards, so you just have a script that instantly types in "Win-R cmd enter <download and run your exploit>".

<comment><USER4> I don't think these threats are equivalent. You can detect a rubber ducky doing it's thing if you look at the screen, and the rubber ducky requires your pc to be unlocked, so you can easily defend against a rubber ducky by not leaving the PC unlocked.

With direct hardware access/DMA you can just plug a small device into, let's say a locked office cubicle computer and compromize/siphon data off it that way.

<comment><USER5> Considering the speed with which that attack can happen and that the macros can background the entire processing immediately (opens cmd, creates bat, executes bat, minimizes cmd), you only have to turn your back for a few seconds and an attacker can get into your system.

Imagine, you are sitting at your desk in the county clerk office and a citizen comes to see you about something. You turn your chair around for a few seconds to get a file and they insert the drive into the back of your computer and remove it before you turn back around. Do you honestly think that anyone beyond a security export or a spook would think they could be compromised that fast?

</comment></comment></comment></comment></comment><comment><USER6> As much as people have tried to make it otherwise, I've long been a believer in the "physical access = game over" line of thinking. Not letting anything untrusted into USB ports is one of the effective defenses against this.

 _In their concluding remarks, the researchers proposed a number of protective measures based on use of Intel 's BootGuard feature and forbidding activation of the debugging interface._

Let's not scare ourselves too much, lest we end up in Stallman's debuggers- are-controlled-munitions dystopia. ( [https://www.gnu.org/philosophy/right-to- read.en.html](https://www.gnu.org/philosophy/right-to-read.en.html) )

<comment><USER7> How vital are debuggers really though? Shouldn't proper design and testing mitigate the necessity of using a debugger? They're more akin to a crutch are they not?

EDIT: Adding this: ( [http://www.artima.com/weblogs/viewpost.jsp?thread=23476](http://www.artima.com/weblogs/viewpost.jsp?thread=23476) )

<comment><USER8> In the same way an MRI is a crutch for doctors who don't know the human body well enough.

<comment><USER9> That's a terrible comparison. The body already lies open before you in the form of code. A debugger should be the measure of last resort, when you can't explain why something fails or you have strange side effects. In my experience every programmer that relied on the debugger had difficulties understanding his or her code in the first place.

<comment><USER10> I don't know how your code can tell you the silicon is wrong (for example). Are you're suggesting the first step of debugging a problem is to understand your code, then every bit of code running under it, the all the code under that _ad infinitum_ , then hardware designs under all that... and not using an available debugger?

I can't help but feel this is an opinion only someone who has only ever worked on _extremely_ high level (and basic) systems _and_ has simultaneously disregarded all underlying abstractions could hold, _or_ someone who has only worked with very low level systems which were so shallow my aforementioned facetious approach to debugging is actually feasible. Limiting yourself to either extreme doesn't exactly give one the most balanced view of how problems can be solved in software

<comment><USER9> I don't think you understood what I've said. Debugging is perfectly fine when you can't explain what's going on even though you understand the code. "The silicon is wrong" so rarely, that it makes for nice, memorable trench stories. Either that or you work at a really low level, which is something that is not the default.

<comment><USER10> In addition to what the other comment says:

"you can't explain what's going on even though _you understand the code_ "

If someone's working on code what's wrong with using the debugger to understand the code better? There's all sorts of behavior defined underneath code that people write that can be much simpler to understand through analysis of the system in action than through code, especially when you don't have access to what's going on underneath your code due to abstractions.

There are a lot of 1+1=3 type situations that arise from abstractions people don't have access to the source to, or the resources to analyze at a given moment.

<comment><USER9> It's perfectly fine to use the debugger in such situations. Please see my other response on this topic:

[https://news.ycombinator.com/item?id=13367946](https://news.ycombinator.com/item?id=13367946)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> Here's the original CCC talk:

[https://media.ccc.de/v/33c3-8069-tapping_into_the_core](https://media.ccc.de/v/33c3-8069-tapping_into_the_core)

<comment><USER12> The YouTube link in the article is to an uploader _pretending to be_ the CCC. Some of these uploaders even participate in the YouTube advertisement programme, profiting off other people's work, when there is an official ad- free YouTube account as well (media.ccc.de, [https://www.youtube.com/watch?v=2JCUrG7ERIE](https://www.youtube.com/watch?v=2JCUrG7ERIE))

See [https://events.ccc.de/2015/01/03/the-youtube-and-stream- dump...](https://events.ccc.de/2015/01/03/the-youtube-and-stream-dump- problem/) for a detailed explanation of the problem.

</comment></comment><comment><USER13> Funfact: about a year ago some semiconductor manufacturers wanted to standardize something similar: put JTAG on CAN bus.

They explained it that way, that it would be a great benefit to debug ECUs via the on-board diagnostics port (ODBII) and may be later even over the internet.

They tried it behind the automotive scene. But we managed to get many major OEMs on board to prevent that standardization effort. This would have been the greatest easter egg for all cars, it that would have been happened.

</comment><comment><USER14> I am continually perplexed at how hardware designers end up with these kinds of "features" on external ports.

Remember direct DMA attacks on FireWire, etc.?

SMH.

<comment><USER2> I tried to get that disabled in Linux. There's a register in the FireWire interface which sets the range of addresses into which external memory access requests can be made. By default, it was at 4GB, even on 64 bit systems. Setting it to zero would break some external kernel debugger, though, so it was left open.

(Firewire isn't DMA. PCI-E is DMA. Firewire is a network cable, over which software sends packets. LAN over FireWire was sometimes done. But there's an optional feature which recognizes special packets for doing word-size loads and stores. This is usually used to talk to dumb slave devices, where you write "registers" to make things happen. It's not needed on a computer, and it's far too slow for bulk transfers. FireWire isn't inherently more vulnerable than a LAN port.)

<comment><USER15> IIRC Apple's "fix" was to just disable recognition of new FireWire devices when the computer was locked. So a nasty device could still compromise you, but it would be one that you plugged in yourself.

<comment><USER16> It looks like your recollection is indeed correct. See the entry for CVE-2011-3215 here: [https://support.apple.com/en- us/HT202348](https://support.apple.com/en-us/HT202348)

</comment></comment></comment></comment><comment><USER17> Why haven't they just created a small jumper on the Mobo to enable it when needed? That would solve the PC issues.

On the other hand; there is a reason for the age-old adagium that once an attacker has physical access; it's always game-over.

<comment><USER18> Physical access is reasonably easy to detect though in many ways.

USB is supposed to be an interface that is exposed to the world. Using USB is not quite the same as getting into the box and switching a microswitch.

</comment></comment><comment><USER19> So a security researcher using Intel-approved debugging tools has found he can take over CPUs... isn't that the purpose of debugging modes?

<comment><USER20> Yes, the story here is that new Intel platforms expose such debugging functionality over regular USB ports. This is not what most people expect, so it's newsworthy.

</comment></comment><comment><USER21> It sounds like this is more or less equal to android's "ADB"?

> "There are several ways someone could do this. An attacker could change the > BIOS configuration (for example, with a use of a Flash programmator) when > they have physical access to the equipment during manufacturing, storage or > usage.

It has to be specifically enabled (with physical access)

<comment><USER22> No, at least not on stock Android devices. ADB is pretty constrained (SELinux policy, the DAC, etc). It shouldn't be possible to go from there to something like root+unconfined on a normal user device, though of course with additional exploits anything is possible.

If the comments above are correct this is either more like JTAG or _is_ JTAG. That's commonly far more capable, usually providing the ability to do things like read and write arbitrary memory without any kernel hinderance at all (although ARM cpus can typically still protect trustzone memory).

<comment><USER23> JTAG is a protocol for testing electrical connectivity and package pins, all the debug capability is proprietary vendor extensions. Which is to say that for any retail product, the CPU will have had a fuse set to make it "protected" which typically includes disabling debug JTAG functionality.

<comment><USER22> It isn't always the case that there's a 'protected' fuse.

Manufacturers seem to have settled on a few different approaches to JTAG:

1/ Leave it open, hope nobody notices.

2/ Leave it to ARM, since modern ARM CPUs have the ability to disable normal and secure world invasive and noninvasive debugging.

3/ Require you to scan in a secret to unlock most debugging functionality.

4/ Fuse off JTAG on production devices.

I can only speak to my experience, but my guess is that for consumer electronics this is roughly in order of popularity with the top option being maybe half of devices and the bottom maybe 10%.

And each of these has problems, so it's no wonder people haven't figured out just one.

Leaving it open is terrible from a security perspective, but for some classes of devices it's also a legal and IP headache. So this is mostly the "couldn't be bothered" set.

Leaving it to ARM is fine as long as your trusted world is sane and the only interesting thing on the chain is your CPU. For many devices this isn't the case. And sometimes bootloaders etc can be made to be insane.

Scanning in secrets is just a bad idea. Provisioning per device secrets is hard, so the "secret" often isn't. Usually it's either something simple (1111... etc) or a serial number, or a serial number ^ a constant, or just the constant. Even where this isn't the case, the secret checking logic is often glitchable or has a viable timing attack. So these frequently fall into the "annoying but possible" bucket for me.

Fusing off JTAG is a mixed bag. It's a huge PITA for manufacturing and RMA so I understand why people don't do it. And you really have to have kind of a lot of logic running on most devices today to get fuses working, so it isn't always as effective as it looks in the presence of glitching attacks. But it is still by far the best option for security and it can be gotten right.

There are also usually various levels of 'disabled', with some parts letting you run eg mbists even in a secured configuration. Obviously, more special cases means more ways to go wrong.

Of course some segments of the market are better about these things than others, so YMMV on the frequency of various approaches.

<comment><USER23> That's interesting, I figured they would just disable/fuse it at the same time that the software is flashed, and updates need to use a bootloader anyway. What's the legal and IP issues?

2) sounds like a race condition.

<comment><USER22> On legal and IP issues--

Some industries are under various requirements not to be user-modifiable. Some of those requirements are uncommonly applied or are uncertain (wifi routers), but some have serious teeth (export controlled munitions). For devices in those classes they often can't be open without risking liability.

On the IP side, some people really care about keeping firmware proprietary. Leaving JTAG in a mode that is meaningful for debugging that firmware will pretty much completely destroy that. So if you super duper care, you sometimes put clauses in your contracts holding the integrator or OEM responsible if your firmware leaks.

Regarding a race condition, yeah. It's pretty common for devices to come up open, then harden up-- and not just for JTAG. It's also not unique to the register-setting approach.

</comment></comment></comment></comment></comment></comment><comment><USER24> I've said this many times before, and I'll say it many times more, but USB needs to go back to living by its name and being a Universal Serial Bus. That doesn't mean being a video bus, or a DMA bus, or a JTAG bus. It means being a serial bus. You can wrap whatever video or JTAG data you want in a serial connection without it being baked into the standard.

<comment><USER25> The wonderful thing about standards is that they're, well, _standard_.

USB Video Class devices can all use the same driver, instead of every new webcam needing it's own special software to work. USB HID devices all use the same driver, so I don't have to know I'd my specific keyboard and mouse are supported.

<comment><USER24> > The wonderful thing about standards is that they're, well, standard.

Nothing wrong with standards. What's wrong is trying to shove everything and the dog into a single standard instead of appropriately separating concerns.

Now we have multiple mutually incompatible USB-C connector based video protocols. This is the result of trying to overspecify the USB standard.

</comment></comment></comment><comment> gm-conspiracy Can this be enabled in the BIOS via vPro?

</comment><comment><USER26> "debugging" mechanism....

</comment><comment><USER27> Could there be anymore ads on that page?</comment>


Amazon has a way to catch package-stealing thieves - <AUTHOR> https://qz.com/1495241/amazon-has-a-clever-way-to-catch-package-stealing-thieves/ <comment><USER2> dupe: [https://news.ycombinator.com/item?id=18674892](https://news.ycombinator.com/item?id=18674892)

</comment><comment><USER3> Just learned tonight that UPS will no longer insure packages containing gift certificates. When I asked why the clerk said there were too just darned many porch pirates.

<comment><USER4> So then why leave the packages unsecured?

I think parcel lockers are a great invention, but if you don't have them, you can have Amazon packages show up in their own lockers.

Since this is HN I'll leave it to the technological solution rather than questioning why delivery protocol is no longer to hand off to another human being.

</comment></comment><comment><USER5> GPS units seem insufficient unless they're really well hidden. You'd want to get a bunch of xboxes or something and put the devices inside the enclosure then seal everything up so they can't just rip the boxes open as they depart and toss anything that looks suspicious. This also ignores the possibility of thieves using makeshift RF bags to hold everything. Maybe we should just go back to the days of dye packs?

<comment><USER6> I doubt that the kind of premeditated theft you're describing accounts for a large % of the losses.

Also, if a package with a dye pack were delivered to me, I'd be extremely pissed off. (Which I suspect is almost guaranteed to happen, if not by accident then by a thief that detects the trap and just ditches it at the next doorstep.)

<comment><USER7> I would say if a thief dropped one of your neighbor's packages on your doorstep and you got a face full of dye pack from opening it then you pretty much got what was coming to you.

My mailman drops packages for the building next door on my doorstep every once in a while and I just go walk it over to them fully avoiding the dye packs.

</comment></comment></comment><comment><USER8> Add explode-spilling permanent ink to packages to add more to fun</comment>


Nestle finds new way to use cocoa leftovers to sweeten chocolate - <AUTHOR> https://www.bloomberg.com/news/articles/2019-07-16/nestle-invents-new-way-to-make-chocolate-without-adding-sugar <comment><USER3> Cacao pulp is delicious. It is interesting that we use the bitter seeds from the fruit, and mostly throw out the tasty pulp. If you are in San Francisco you can get cacao fruit smoothies from Dandelion Chocolate. I hope the pulp starts showing up in more food products instead of going to waste.

<comment><USER4> Traditionally the pulp is left on the beans during fermentation to impart flavor, and is basically used up in the process. It's mostly American style chocolate that removes the pulp before fermentation and throws it away, in order to... reduce flavor, I guess?

</comment></comment><comment><USER5> Good side: nice, new ways to use that waste. Bad side: Nestlé.

<comment><AUTHOR> Serious question, why is it bad that it's Nestle?

<comment><USER6> I think the majority of the hatred for Nestlé comes from their aggressive approach to selling baby formula in poor countries where (for various reasons) it wasn't appropriate, which probably directly harmed children as a result.

However, according to this page, there are other reasons too: [https://www.zmescience.com/science/nestle-company- pollution-...](https://www.zmescience.com/science/nestle-company-pollution- children/)

<comment><USER7> "aggressive approach" \- their sales reps dressed as nurses and went into hospitals. It goes a bit beyond "aggressive".

"probably directly harmed children" \- report after report from (respected) NGOs and the WHO concluded babies died. No "probably", beyond "harmed".

<comment><USER6> Thanks for additional info. (I wasn't trying to downplay Nestle's crimes - more just hedge due to my own lack of certainty about the situation.)

<comment><AUTHOR> Wow, just read through the link and did some more research on it quickly, this is some crazy stuff. Thanks for sharing

</comment></comment></comment></comment></comment></comment><comment><USER8> Have they really been throwing it away? The white 'fruit' is delicious... If you ever see a cocoa tree, try it. It's like a fruit that tastes like chocolate.

</comment><comment><USER9> Nestle found a way to add sugar to chocolate without saying it added sugar to chocolate and even charge a premium for it.

<comment> toper-centage It's not sugar! It's cocoa pulp Syrup!

</comment></comment><comment><USER10> See also cascara, the dried fruit left over from producing coffee beans:

[https://en.wikipedia.org/wiki/Coffee_cherry_tea](https://en.wikipedia.org/wiki/Coffee_cherry_tea)

</comment><comment><USER11> Will this be required to be listed as "added sugars"?

(That it's a component of cocoa beans doesn't _necessarily_ mean it's permitted in chocolate as an unlisted component.)

</comment><comment><USER12> It would also be nice instead of just focusing on sugar, nestle focused on not using child labor in their cocoa sourcing process.

[https://www.washingtonpost.com/graphics/2019/business/hershe...](https://www.washingtonpost.com/graphics/2019/business/hershey- nestle-mars-chocolate-child-labor-west-africa/?utm_term=.78337193cd00)

<comment><USER13> Wow, what a poignant paywall.

</comment></comment><comment><USER14> As expected, this is pretty misleading.

"The food company is using a patented technique to turn the white pulp that covers cocoa beans into a powder that naturally contains sugar."

They're not adding any _processed_ sugar, so they can make the "no added sugar" claim. They're still adding sugar via another method.

<comment><USER15> Yeah, it's unclear from the article what the product is actually going to be composed of. 70% dark chocolate means basically 70% cocao and 30% sugar. Is it still going to be 30% sugar? It might not be cane sugar, but it'll still be sugar.

<comment><USER16> That's really not true. Or at least in europe, 70% chocolate contains 70% cocoa solids. The remaining 30% are mostly butter (cocoa butter or another type of fat) and can contain sugar and milk.

<comment><USER17> At least in the US to be called chocolate it has to be cocoa butter. Chocolate is an FDA regulated term. Hershey learned this lesson the hard way a few years back as they tried to change over to vegetable oil, IIRC. [1] Apparently in the UK it must be at least 20% cocoa solids.

[1] [https://www.nytimes.com/2007/08/09/business/worldbusiness/09...](https://www.nytimes.com/2007/08/09/business/worldbusiness/09iht- chocolate.1.7055816.html)

</comment></comment></comment></comment><comment><USER18> I remember in chemistry we learned the difference between ordinary, reagent grade sucrose and the fancy, organic, fair trade, whole wheat, gluten free sucrose. The fancy stuff was way better for you.

<comment><USER19> How can sucrose be "whole wheat"? And why would reagent grade sucrose have gluten in it? Sucrose usually comes from gluten-free sources, like sugar beets and cane, yes?

<comment><USER20> It was a joke...Sucrose is sucrose regardless of the source.

<comment><USER19> Looks like I'm being downvoted because I can't distinguish your humor from your being misinformed by your teacher.

I thought it was a lesson that that "reagent grade" is different from "food grade", Eq, [https://www.spectrumchemical.com/OA_HTML/chemical- products_S...](https://www.spectrumchemical.com/OA_HTML/chemical- products_Sucrose- Ultrapure_S1697.jsp?minisite=10020&respid=22372&phrase=Sucrose%20Food%20Grade) lists 99.9% purity, while commenting: "Sucrose, Ultrapure, also known as sugar, is derived from cane sugar and used as a food sweetener. Ungraded products supplied by Spectrum are indicative of a grade suitable for general industrial use or research purposes _and typically are not suitable for human consumption or therapeutic use._ "

(What is "reagent grade" for sucrose? Sigma-Aldrich's "ACS reagent grade" sucrose is only promising ≥99% purity (see [https://www.sigmaaldrich.com/catalog/substance/sucrose342305...](https://www.sigmaaldrich.com/catalog/substance/sucrose342305750111?lang=en&region=US) ).

So I figured there was some common lab impurity in sucrose that your teacher was referring to, which you mistook for, or mis-remembered as gluten.

As you almost certainly know, "organic" and "fair trade" refer to farming and labor practices, which is independent of the chemical content. The latter may be better for your mental well-being, for those sensitive to humans subjected to terrible employment practices.

<comment><USER20> I'm well aware of the differences between the different grades of sugar. You're still not getting the OP's joke. Purities aside, all sucrose is just as good or bad for you health-wise as any other sucrose.

As you almost certainly know, organic and fair trade refers to farming and labor practices, which is independent of chemical content. This is why fair trade sugar isn't any better for you than non-fair trade sugar. The substance you're eating is the same.

<comment><USER19> "Purities aside"? My objection - and confusion - is precisely because when you buy "reagent grade sucrose", you don't actually buy 100% pure sucrose - <USER2> buy "sucrose with a small amount of impurities." And the impurities that are okay in a lab might not be healthy.

Yes, in retrospect I can see where the humor is supposed to be. But I think it isn't a good joke, for reasons I've described.</comment></comment></comment></comment></comment></comment>


0day: Windows Kernel EPATHOBJ Vulnerability - <AUTHOR> http://seclists.org/fulldisclosure/2013/May/111

<comment><USER2> This is kind of hardcore, pity there was no discussion about it here.

r/netsec: [http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_...](http://www.reddit.com/r/netsec/comments/1eqh66/0day_windows_kernel_epathobj_vulnerability/)</comment>


What it's like to get hacked - <AUTHOR> http://www.bgr.com/2012/06/07/hacked-insider-account-atm-black-hat/

<comment><USER2> There is ZERO SIMILARITY between having security research done on a product you sell to the public and having your website hacked by a "hacktivist" group.

Security research is usually a public service, usually done for free, virtually always done with full attribution (that's part of the point) and almost invariably legal.

Website hacks are virtually never a public service, are done anonymously, often involve financial gain for the participants, and are invariably criminal.

Barnaby Jack isn't part of a "hacker group". At the time this post was written, he was a researcher for Juniper Networks. Drawing a parallel between his ATM research and "Hacktivism" is shamefully stupid linkbaiting. Since that bogus comparison is the only thing this article contributes beyond the actual blog post it linkjacks (which is excellent, but appeared on the site and was discussed yesterday), I flagged this post.

<comment><USER3> Actually, as someone who has had to respond to Website breaches in the past, my experiences and feelings are very similar to those described by the author. The main difference is I did not have the opportunity to discuss matters with my attackers — oh, how I would have loved that opportunity — but the experience and response protocols are very similar on a broad level, I'm sure.

And I didn't see this yesterday. I also thought the addition of Jack's video was very helpful to paint a more complete picture. But nice tirade.

<comment><USER2> Oh. Well, if it _feels_ similar, then there must really be a similarity between testing products for flaws and breaking into websites.

Sheesh.

<comment><USER2> I'm sorry for being so snippy about this. It's one of my snippy topics.</comment></comment></comment></comment>