Java Runtime updater now installs ask.com toolbar on Macs - <AUTHOR> https://jamfnation.jamfsoftware.com/discussion.html?id=13567 <comment><USER3> You aren't Oracle's customer. The Fortune 1000 are their customers. Oracle doesn't care about nerd outrage, the developer community, or end users.

Former Oracle employee, via acquisition. Horrible place to work.

This post is my own opinion and does not relflect insider or confidential information from Oracle.

<comment><USER4> I can't imagine that the Java installer asking to install the Ask.com toolbar on a Fortune 1000 CEO's home computer is terribly good marketing, though.

<comment><USER5> No Fortune 1000 CEO uses a Mac, so that's not an issue.

<comment><USER6> I think Tim Cook might.

<comment><USER7> He knows already.

Apple has stopped including Java in OS X and banned Java in the AppStore.

<comment><USER8> Oh, how the mighty have fallen. This is what developer.apple.com/java read back in 2009 [0]:

 _Mac OS X is the only major consumer operating system that comes complete with a fully configured and ready-to-use Java runtime and development environment. Professional Java developers are increasingly turning to the feature-rich Mac OS X as the operating system of choice for both Mac-based and cross-platform Java development projects. Mac OS X includes the full version of J2SE 1.5, pre-installed with the Java Development Kit (JDK) and the HotSpot virtual machine (VM), so you don 't have to download, install, or configure anything.

Deploying Java applications on Mac OS X takes advantage of many built-in features, including 64-bit support, resolution independence, automatic support of multiprocessor hardware, native support for the Java Accessibility API, and the native Aqua look and feel. As a result, Java applications on Mac OS X look and perform like native applications on Mac OS X._

[0] [http://wayback.archive.org/web/20091223033016/http://develop...](http://wayback.archive.org/web/20091223033016/http://developer.apple.com/java/)

</comment></comment></comment></comment></comment></comment><comment><USER9> And people are suddenly surprised there is strong anti-vaccine movement. _This_ kind of things is _the real_ reason for it.

From the producer who decides to reduce the amount of good in a box, while keeping the packaging and price tag the same, to the grocery store clerk that sells you meat that was already twice washed with dishwashing liquid to appear fresh (a very common practice), to the company that regularly sends you 4W LEDs when you order 5W hoping you won't notice, and if you challenge them they'll tell you it was a factory labeling mistake, to the smartphone vendor that tells you about amazing experience and then sells you equipment loaded with so much crapware that you cringe every time you turn it on - <USER2> around you is out there to get you. So many businesses try to fuck you over, all the time, and they totally get away with it.

And then everyone is surprised people have trust issues. It's hard enough to get people to install any kind of updates in the first place - and how we're expected to have a secure Internet if people have _a very good reason_ not to install new versions of things?

Seriously - companies like Oracle, like Ask.com, like Lenovo, SuperFish, like Uber and like so many, many others - start-ups, mom&pop's, medium companies, big corporations - they all found a very profitable business model: taking the common value of trust we have in society and burning it to earn money. And I guess it works well - if you're an executive who's going to get a pay raise and maybe a promotion for literally shitting on the faces of your customers, when why wouldn't you do it? Well, except of having _any decency at all_?

Whoever decided to bundle this crapware with Java Runtime, if you're reading this - you're actively contributing to one of the biggest problems our civilization is facing. You should feel responsible. The next time someone dies because he refused to follow established procedures out of lack of trust, this is - in a small but important part - _on you_.

It may feel like I'm exaggerating here, but just look around and think for a minute. The collapse of trust we see in contemporary society is raising to the level of becoming an existential threat for our civilization. And I wish I knew a way how to reverse it...

<comment><USER10> A bit of a slippery slope to associate the installation of adware with the anti-vaccine movement.

<comment><USER11> Not at all. OP is pointing to a common underlying social dysfunction. We live in a hierarchically exploitative society, which contributes to the global collapse of trust.

I'm sure if it were somehow possible and legal to bundle some kind of mind- control adware into a vaccine that forces you to buy the sponsor's brands, someone would be doing it.

<comment><USER9> > _We live in a hierarchically exploitative society, which contributes to the > global collapse of trust._

Indeed. And I think people sometimes don't realize that this trust on society- level is literally _the one_ thing that separates us from being savages. Not our technology, not our military, not the scientific advances, not the democracy, but bonds of trust are what keeps civilization from falling apart.

> _I 'm sure if it were somehow possible and legal to bundle some kind of > mind-control adware into a vaccine that forces you to buy the sponsor's > brands, someone would be doing it._

Then it would be detected, someone would get fired, company would pay some huge fines to FDA of WHO or whomever, at best maybe regulations would also be updated, and then everything would be business as usual. Everything, except the trust people just lost - because seeing the corruption everywhere, what possible reason would they have to believe that the new regulations will be effective at preventing such event from happening again?

<comment><USER12> > ...seeing the corruption everywhere, what possible reason would they have to > believe...

This is a fundamental truth that needs to be realized _now_ if there is to be any hope of preventing our slide from a democratic republic into a new form of feudalism. More specifically, a _financially stable_ democratic republic into a feudal society that dissembles, victim-blames, and makes shows of force to hide a useless economy and defaulted obligations.

The trust and respect that being destroyed by _both_ business _and_ government is also what the finance pundits refer to when they talk about "confidence in the market". When many people start observing that "rule of law" and "meeting of the minds" as used by everyday business interactions have become a double- standard that will be enforced in only one direction, the _rational conclusion_ [1] is to respond with the same lack of trust and respect.

I am of the opinion that we already reached this point. A lot of people already deeply mistrust large business, and w4 only have to look at the evening news to see the level of confidence most people have in the economy. We're simply waiting for a spark to ignite the situation. I actually thought the fast-food employee situation[2] was going to be that spark last year, but it seems that problem has been put on hold for the moment.

Meanwhile, we get to deal with the _collaborators_ that work to maintain the current situation by trying to explain away bad behavior like this Lenovo/Superfish stupidity. I hope they like the future they are creating...

[1] why? see the "tit-for-tat" solution to the iterated prisoner's dilemma

[2] [https://medium.com/@sarahkendzior/the-minimum-wage-worker- st...](https://medium.com/@sarahkendzior/the-minimum-wage-worker-strikes-back- fa4c36eb306b)

<comment><USER9> This text from [2] was one of the most heart-breaking pieces I read recently. I knew the situation was bad, having a friend who used to work in restaurants - but the article has really driven the point home for me.

> _When many people start observing that "rule of law" and "meeting of the > minds" as used by everyday business interactions have become a double- > standard that will be enforced in only one direction, the rational > conclusion[1] is to respond with the same lack of trust and respect._

I've been thinking about the names we use in law and economics and I realized many have become just misleading labels. It's like a variable named m_iNameCount that points to a global array of instances of Thread class. And this leads to the common trick of those "collaborators" you described, the "motte-and-bailey"[0]-like argument. They will defend bad practices by saying, e.g. "it's value-added; surely adding value is good?", where everyone knows that value-added doesn't actually _mean_ adding any real value for your customer.

[0] - [http://slatestarcodex.com/2014/07/07/social-justice-and- word...](http://slatestarcodex.com/2014/07/07/social-justice-and-words-words- words/)

</comment></comment></comment></comment></comment></comment><comment><USER13> Finally! I've been waiting for this for so long! It seemed so unfair that only Windows users could get the Ask.com toolbar for free...

<comment><USER14> /s?

</comment></comment><comment><USER15> My fear would be:

      brew install java-runtime
      ==> Downloading http://oracle.com/osx/java-osx-8-x86_64.tgz
      ######################################################################## 100.0%
      ==> Downloading http://ask.com/osx/asktoolbar-2.4.tgz

<comment><USER16> More like:

      $ real-pkg-manager install jre-openjdk
      ==> Downloading http://trustedmirror.somerealdistrib.org/openjdk.tgz
      ==> Checking openjdk.tgz signature
      ==> Installing
      ==> Done

You just need the right tools and community.

</comment></comment><comment><USER17> I hope Apple adds it to XProtect and revokes their code signing certificate.

</comment><comment><USER18> TL;DR

If the user keeps to the default installer settings and goes next, next, next... AND in Safari deliberately selects "Install" (not pre-selected) in the confirmation window, the ask.com toolbar will be installed.

<comment><USER19> So similar to Windows and avoidable but still annoying.

I can kind of understand some small software developers out there doing this stuff to make a few extra dollars but Oracle? It just seems so unnecessary. I guess they just can't get their head around giving something away for free.

<comment><USER20> Some more information...

 _" When you have a commercial relationship like this, not only are you dealing with your [own] corporate policies on communication, and revenue recognition and all that kind of stuff, but you also have a commercial partnership and agreement that you have to abide by and follow," said Smith during the call._

 _Smith also defended the practice by saying Oracle had inherited the deal when it acquired Sun Microsystems, the creator of Java, in 2010. "This is not a new business, this is not something that Oracle started," Smith said. "This is a business that Sun initiated a long time ago."

Sun had bundled third-party software with Java since at least 2005, when it offered a Google toolbar. In the following years, Sun made similar arrangements with Microsoft and Yahoo, before switching to Ask.com._

 _With Java, it 's true our installer waits 10 minutes before running the install process, but this to ensure the JRE [Java Runtime Environment] updates properly without additional strain on a user's computer," an Ask.com spokeswoman said in an email reply to questions Monday. "This is not intended to trick users."_

[http://www.computerworld.com/article/2494794/malware- vulnera...](http://www.computerworld.com/article/2494794/malware- vulnerabilities/oracle-will-continue-to-bundle--crapware--with-java.html)

<comment><USER21> The defense that "hurr durr Sun did it and we just haven't removed it yet" doesn't apply when you're actively adding it to installers on other platforms.

</comment></comment></comment></comment><comment><USER22> Oracle could have made a fantastic app ecosystem, with a great AppStore application, given how their vm is installed on very many PCs around the world. They could have done the 30/70 split and potentially gotten heaps of money out of it. Sun was even up to it at some point, but it was horrible, the way that only Sun could make UX horrible. But still, the potential is so enormous that I cannot fathom how they miss it.

And this Ask-crap is what they do instead, making pretty much every user in the world hate them. (Not to mention the insanity of how they handled the security problems they found themselves in right after acquiring Sun and Java)

</comment><comment><USER23> Desktop Java apps should just bundle a JRE.

Launch4j: [http://launch4j.sourceforge.net/](http://launch4j.sourceforge.net/)

Legality: [http://www.oracle.com/technetwork/java/javase/readme-142177....](http://www.oracle.com/technetwork/java/javase/readme-142177.html#redistribution)

<comment><USER24> At the rate Java has been fixing exploitable vulnerabilities lately, I would rather have just one copy to keep up-to-date. I know that's not a very Mac- like attitude though.

<comment><USER25> Almost all exploitable vulnerabilities are related to the browser plugin. There's no danger of keeping outdated JRE inside some application.

<comment><USER26> Unless you need Java Secure Sockets Extension to work - see smacktls.com.

</comment></comment></comment></comment><comment><USER27> The bigger context is this: jamf makes software to help manage fleets of Macs, by providing abilities such as deploying a package to a group of Macs. It's quite good and IIRC Apple uses it for configuration management. If a vendor gives you a normal package, as Java once was, it was fairly easy to deploy.

Contrast deploying the JRE with a simple package vs deploying it on Windows, which usually required an ever-evolving set of hacks to extract MSIs from the installer and install it in an automated fashion without installing bloatware, having it sit in the taskbar, auto-updating (which is a no-no in an enterprise environment), etc.

Now, thanks to this change, people on the Mac side will get to experience all the joys of deploying the JRE on Windows.

<comment><USER28> For what it's worth, the installer app contains a .pkg for the JRE that you can install by the normal methods. OTOH, the Flash installer used to contain a normal package, but no longer does.

</comment></comment><comment><USER29> Crapware in installations must end.I made a desktop PC for my sister with nothing but Windows 8.1. It only took my sister, an otherwise competent computer user, 48 hours for her computer to become infested with some web-ad hijacker and numerous IE toolbars.

<comment><USER30> "an otherwise competent computer user"

"numerous IE toolbars"

IE?

<comment><USER19> Internet Explorer...

<comment><USER31> Yeah, Frozenlock's snarkily trying to imply that "otherwise competent" computer users don't use IE.

<comment><USER32> Technically rjohnk didn't claim his sister used IE, only that IE toolbars were installed.

</comment></comment></comment></comment></comment><comment><USER33> How much $ does one make with this kind of crapware-bundling? Like how much would i get for 1000 toolbar installs?

<comment><USER34> I think the point is not for the user to make money, but the people bundling the toolbar.

I think ask.com pays whoever bundles their toolbar so it's basically advertising money, at least it seems like that for me.

<comment><USER35> Yes, I'm fairly certain that's what the parent meant. If he was running a company doing the bundling, how much would he get paid if his bundle installed the toolbar 1000 times, now how much would he as an end user get if he installed it 1000 times on his own machines.

<comment><USER34> Aha! that makes more sense. I read that as if the user would get money for using ask.com toolbar.

But yeah, thanks to both of you.

Now that I think about it, I'm not sure if ask.com is willing to bundle their toolbar with any product. Maybe they select only high-volume products?

</comment></comment></comment></comment><comment><USER36> This certainly poisons the Java well a little bit more in general, and desktop Java in particular. Android and a sea of line-of-business webapps will keep the Java platform healthy for a very long time, but this kind of thing makes me shake my head in sadness.

More positively, this is a an _excellent_ data point for both free software advocates ("look at the abuse closed source enables") and Apple ("do you really want to foist crapware on your users? just use our awesome native tools to write apps!")

I imagine that this move infuriates much of the Google Android team (because it weakens the developer story slightly) and makes them very glad that they have "Android plan B" with Go.

<comment><USER37> Developers don't install the consumer JRE anyway. They install the JDK which doesn't do this. I doubt it'd make any difference to Android.

Meanwhile, for apps like Minecraft that want to distribute consumer Java apps, just bundle the JRE. It's quite easy these days.

<comment><USER36> You really don't think stuff like this moves the dial _at all_ in a developers mind when deciding whether to focus on Android or iOS?

</comment></comment></comment><comment><USER38> There was a similar story relating to Java updates and Ask toolbars in 2013. There is some history to this.

[http://www.zdnet.com/article/a-close-look-at-how-oracle- inst...](http://www.zdnet.com/article/a-close-look-at-how-oracle-installs- deceptive-software-with-java-updates/)

</comment><comment><USER39> Even though I love Java and the ecosystem, this is one time I feel really embarrassed asking a non tech person to install Java.

Is Oracle really getting substantial money out of this deal?

</comment><comment><USER40> FYI, Oracle installs Baidu (Nasdaq BIDU) bloat wares in Java Updater here in China.

<comment><USER41> On Mac?

<comment><USER41> Why the downvote? I was just checking.

</comment></comment></comment><comment><USER42> So everyone who said "Windows just has all these problems. Just get a Mac instead! Nobody creates viruses or crapware for mac"... Guess what you just did?

Yup. You gave Mac enough market-share for it to be profitable to bundle crapware there as well. This is probably just the start and more will follow.

Whatever you do, please _don 't_ tell people to install Linux. I like it the way it is and I don't want any of this shit coming here.

</comment><comment> foreign-inc Ironic?

[https://www.techdirt.com/articles/20130115/17343321692/why-a...](https://www.techdirt.com/articles/20130115/17343321692/why- are-y-combinator-andreessen-horowitz-backing-drive-by-toolbaradware- installer.shtml)

</comment><comment><USER43> Search companies now have to pay third parties to get their product out. Google pays Apple to be on the iPhone. Yahoo pays Mozilla to be on Firefox. Bing is on Microsoft products because they're the same company. Now Ask is paying Oracle to push their search.

This is strange. Google, Bing, Ask, Yandex, and Baidu provide very useful services and put vast resources behind organizing the world's information. Two decades ago people would have paid serious money for any of those services. Yet now, search companies resort to expensive or, in this case rather pathetic, measures to get people to use their product.

Even the social companies (Facebook, Instagram, etc.) don't need to do that.

</comment><comment><USER44> Will it happen on Mac? [http://static.spiceworks.com/images/how_to_steps/0000/3886/t...](http://static.spiceworks.com/images/how_to_steps/0000/3886/too_many_toolbars.jpg)

</comment><comment><USER45> As far as I know if you install JDK and not JRE there should not be any additional adware. At least for now.

<comment><USER46> I installed the JRE and JDK (on diff machines) from the downloadable installers (not the updater) and neither installed the adware, nor had the option to.

<comment><USER47> This makes me wonder if they're doing a partial rollout to some small percentage of users to test the waters.

</comment></comment></comment><comment><USER48> Business as usual for Java, king of bloat.

</comment><comment><USER49> This is really f _&_ ed up. They are clearly against the common user that only wants to use their software. They advocate so much about security but embed a undesired software with their runtime. I really can't understand.

</comment><comment><USER41> As some commenters pointed out, the installer is now an APP instead of a PKG. The original PKG is inside the APP at Contents/Resources/JavaAppletPlugin.pkg (right click on APP -> Show package contents).

</comment><comment><USER50> Whoa... Stay classy, Oracle.

<comment><USER51> Stay classy? They've been doing this to Windows users for ages.

<comment><USER52> So they've done their users a favor by providing a consistent experience over all supported platforms?

I'd really like to listen in to one of the meetings where decisions to do such kind of blatant platform-abuse is being discussed. Possibly alternatives A/B/C (you always have to have 3 alternatives, right?) are the Ask-Toolbar, a bitcoin-miner or adding the end-user-PC to a botnet for DDOS-extortion, so we can be lucky that they agreed to do "A".

</comment></comment></comment><comment><USER53> Does this still work?

How to disable offers in the control panel.

[https://www.java.com/en/download/faq/disable_offers.xml](https://www.java.com/en/download/faq/disable_offers.xml)

</comment><comment><USER54> It's been awhile since I've used OS X, but I don't recall there being any bundled installers on anything.

Hopefully there will be some backlash; that was one of my favorite parts of the platform.

</comment><comment><USER55> If you are developing products that require Java you are a huge part of the problem. Learn a new language and start porting.

I am tired of 100% of the blame for these situations going to Oracle and Adobe, they are just doing what they were designed to do, make money by any means necessary. The developers who voluntarily learned a language and joined a community that is controlled by a for-profit company are the only thing keeping them alive. Every new product they make entices another end user to install crap on their computer.

</comment><comment><USER56> I worked on a couple of large Oracle projects, and they were probably the worst vendor I've dealt with in the last decade. They had the potential to solve really compelling problems, but it was overshadowed by how poor their products were and the eye-watering costs.

Once you're hooked of course on their financial stack you have little choice but to remain.

I'm watching with interest the adoption of Workday as a replacement for Peoplesoft, and wonder aloud if someone will unseat them in their related product groups.

<comment><USER57> I have seen this in so many cases. Somehow Oracle convinced people of their never-ending superiority. I know in 8i and 9i days, we were very happy with its performance and feature set. That's not to say that SQL Server (or hell, even DB2 or Sybase) couldn't have given it competition. But when I hear executive types pushing Oracle these days, I have to ask, "really? REALLY?? do you even know WHY you're pushing that monstrous heap of garbage?? Does it give you something you can't get with Postgres? Oh yes... a flatter wallet. Touche.

As far as Workday, I'm intrigued that someone would chosen Adobe Flex as a platform. (we just converted last year)

</comment></comment><comment><USER58> JRE is the new Flash

</comment><comment><USER59> Obligatory [http://bad.solutions](http://bad.solutions)

</comment><comment><USER60> I suppose this system could be crashed by automatically installing hundreds of millions of instances of the Ask toolbar to the point that it is economically infeasible for them to pay Oracle.

</comment><comment><USER61> It's mind boggling that they pay as much as $2 per install but can't afford decent design. I've never seen a good looking toolbar, it's as if they try to make them ugly.

</comment><comment><USER62> This is the number one thing that I uninstall from my computer and friends and families computers when they accidentally click too fast. These kinds of add- ons are incredibly annoying.

</comment><comment><USER63> I don't understand why OpenJDK hasn't been able to supplant Oracle as the standard Java distribution. That would eliminate reliance on the corporate whim of Oracle.

</comment><comment><USER64> I knew I clicked "remind me later" for a reason.. what the hell. Did Oracle run out of money in its lawsuit with Google?

</comment><comment><USER65> If you download from java.oracle.com as apposed to java.com these nasty toolbars aren't included.

</comment><comment><USER66> I installed this yesterday on my father in laws mac and don't remember seeing the ask thing...

</comment><comment><USER67> Maybe I should go work at ask.com if I could make it suck less this wouldn't be so bad...

</comment><comment><USER68> Smells a lot like Adobe... Stupid move killing credibility of their software.

</comment><comment><USER69> Why does Oracle want to kill Java so badly?

Buncha fuckin assholes if you ask me...

</comment><comment><USER70> Could someone please confirm that original JRE installer downloaded from www.oracle.com contains this? (I dont have a mac). On Windows you often get modified installers, if you download from 3td party website.

<comment><USER71> The official Java updater on Windows includes offers. It usually tries to install Chrome and will do so unless you unselect it during the upgrade process.

</comment></comment><comment><USER72> Just add "127.0.0.1 ask.com" to /etc/hosts?

While you're in it, add

127.0.0.1 doubleclick.com 127.0.0.1 doubleclick.net

also.

</comment><comment><USER73> I think everyone using the Java runtime should install and use the ask.com toolbar. Why not?

</comment><comment><USER74> Welcome to the club, Apple snobs. :)

</comment><comment><USER75> Steve jobs would build an uninstaller that ran right after to remove the shit.

<comment><USER76> Probably not, he couldn't code.</comment></comment>


BitTorrent Turns 10: Happy Birthday  - <AUTHOR> http://torrentfreak.com/bittorrent-turns-10-110702/ <comment><USER2> An obvious use of BitTorrent would be to build a supercomputer on top of it. The biggest barrier to ad hoc computation is getting at the data. (John Carmack: "It pains me to have hundreds of cpu cores across the office idle, but data transport precludes most computation of opportunity" - <http://twitter.com/#!/ID_AA_Carmack/status/61076521640665089>). That is what BitTorrent is good for.

Especially for problems where all you need to do is divide your data into slices, apply some function, and assemble the results, BitTorrent already solves the hard part of this. (Edit: because the hard part is getting at the data in the first place, not computing over it and assembling the results.) That's what you're doing when you download a movie, it's just that the function is "identity" and the assembly is "concat".

So HN, how would you build this? has it been worked on? what am I missing?

<comment><USER3> What you are describing is MapReduce, and it is the foundation on which google's empire is built.

I think I must be misunderstanding you. Are you talking about some p2p system for distributing the code/data to the nodes? Like a decentralised BOINC?

The bit about BT that makes it special is the tit-for-tat negotiation system, which prevents clients from "cheating" by downloading and not uploading. In an environment where there is no motive for an individual node to behave differently from the rest of the swarm for its own gain, then BT's unique benefits disappear.

<comment><USER2> I'm not talking about MapReduce but rather the back end presupposed by things like MapReduce. Let me try an example. Imagine some large dataset. All the stock trades ever, say. Or all the temperature readings ever. (Maybe these particular datasets don't exist, but some do.) Suppose some Saturday afternoon a question pops into your head. Wouldn't it be great to know, say, the average, max, and min temperatures in that dataset, maybe broken down across geographical buckets. How would you go about it? The hard part isn't computing averages - the difference between computing "average" and computing "identity" is practically negligible. The hard part is obtaining the data, arranging it in a suitable form, and then being able to get at it. You want the data to already exist in zillions of morsels on lots of different computers, have a fast way of discovering which morsels your computation needs, and a fast way of accessing those morsels. Ideally there would be many copies of each morsel, giving you a lot of choices about whom to talk to.

In other words, you want a decentralized, redundant morsel discoverer- replicator. To me this sounds like what BitTorrent already does with, say, movies. Any popular movie is already split into morsels and replicated a zillion times, so any particular download (computation, in our case) can immediately start running. Of course that's only true for files that are already well-seeded. But it's easy for anyone to come along with a new movie (dataset, in our case) and plug it in, making it easy for anyone else to download (compute with), and getting faster the more popular it becomes.

(MapReduce can do the computation easily... _if_ you've first arranged all the data appropriately. But that "if" is what, in Carmack's words, "precludes most computation of opportunity.")

The reason I wonder if BitTorrent would be suitable for solving the hard part of this problem (discovering and transferring big data) is that it already _has_ solved it, massively. What else would you need to get true ad hoc computation on arbitrary data? A query language, an evaluator for that language that knows how to compute with morsels and assemble the results (there's your MapReduce)... and what else?

<comment><USER3> Nice ideas. It sounds to me like you should be doing a Phd.

<comment><USER2> I work in a related area, which is why the idea occurred to me. To combine the two would be awesome, but is a long-term prospect.

One more point. You mentioned BOINC. I believe BOINC sends all input data to the client with each request. In other words, it's only good for computationally intensive tasks (lots of computation per unit of data). The same is true of GPGPU. That's why I brought up "average" as an example: it's a commonplace function that is not computionally intensive at all. The work is almost entirely in finding the data and accessing it.

What I really want to know, though, is who else has thought about using BitTorrent for this kind of thing, and what they think.

</comment></comment></comment></comment></comment><comment> matthew-wegner BitTorrent fascinates me because it was a thought problem. The technology to support BitTorrent had been in place for years--the requisite bandwidth, processing power, and storage space--but nobody had conceived of a clear- enough implementation to execute the high concept of piecemeal transmission before Bram.

Most unsolved problems today are probably thought problems, not technical problems (excepting battery life and blanketed super-fast wireless).

<comment><USER4> It's interesting to think about the sorts of technologies that are more about knowledge than supporting infrastructure. A perfect example would be the telegraph, which was only developed about a century ago but could have easily been built in cruder forms going back 2 or 3 thousand years. It makes one wonder what sort of fundamental innovations will be discovered in the future and what sorts of things we are missing out on today merely out of ignorance.

</comment></comment><comment><USER3> This makes me feel old. At 23, that isn't good.

</comment><comment><USER5> Thanks Bram, you made internet better place.

</comment><comment><USER6> Happy Birthday BitTorrent!!!</comment>


First battery-free cellphone makes calls by harvesting ambient power - <AUTHOR> http://www.washington.edu/news/2017/07/05/first-battery-free-cell-phone-makes-calls-by-harvesting-ambient-power/ <comment><USER2> Previous: [https://news.ycombinator.com/item?id=14659236](https://news.ycombinator.com/item?id=14659236)

It's not a cellphone. It's basically an backscatter analog audio bug which doesn't even operate on cellphone frequencies, and which has a range of only ~15 metres.

<comment><USER3> True. If they could make a Bluetooth earpiece powered this way, though, they'd have a product.

<comment><USER4> Would they? Those drop out often enough already, without being subject to the vagaries of the local microwave environment in order to power themselves at all.

Don't get me wrong - I love my Rowkin Mini, and a self-charging Bluetooth earbud would be an awesome thing to have! I'm just not sure how realistic a prospect that really is.

</comment></comment></comment><comment> TD-Linux It seems that this operates on the same principle as The Thing: [https://en.wikipedia.org/wiki/The_Thing_(listening_device)](https://en.wikipedia.org/wiki/The_Thing_\(listening_device\))

Several devices in the ANT catalog also rely on radio reflection, for example this video transmitter: [https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NS...](https://en.wikipedia.org/wiki/NSA_ANT_catalog#/media/File:NSA_RAGEMASTER.jpg)

</comment><comment><USER5> Hmm. Think this is a far stretch from being a cellphone prototype. What I'm seeing is a wireless microphone with a number pad prototype.

I get that the implied concept is to take power hungry components and offload them to a nearby transmitter device, but we have that already: a wireless phone.

</comment><comment><USER6> "The team designed a custom base station to transmit and receive the radio signals. But that technology conceivably could be integrated into standard cellular network infrastructure or Wi-Fi routers now commonly used to make calls."

This is not a cellphone. It is not groundbreaking or new technology. They've made a radio.

</comment><comment><USER7> > "power gathered from ambient radio signals transmitted by a base station up > to 31 feet away"

Seems pretty useless. Better would be to use capacitor and crank handle.

And first GSM phones were also battery free. It was van stuffed with equipment powered by a generator ;-)</comment>


A waterfront server farm cooled by the SF bay - <AUTHOR> https://www.eastbayexpress.com/oakland/borrowing-bay-water-in-alameda/Content?oid=26672190 <comment><USER2> Now this is seriously contributing to climate change.</comment>


Thirty-seven Reasons I Love Ruby - <AUTHOR> http://rubyhacker.com/ruby37.html

<comment><USER2> Noobs engaging in advocacy. Is there anything more annoying on the internet?</comment>


Ask HN: Anybody used Mathematica, for any reason? - <AUTHOR>

I was just digging around on WolframAlpha.com and there seem to be many different ways to use Mathematica:
http://www.wolfram.com/solutions/SoftwareEngineering/ http://www.wolfram.com/solutions/MedicalImaging/ http://www.wolfram.com/solutions/Chemistry/ http://www.wolfram.com/solutions/ElectricalEngineering/
I was just curious if anybody here has ever used Mathematica, and what your experience has been. I'm asking mostly because I like using Wolfram's search engine, so I  am curious if other products by the company are worth looking into. <comment><USER2> I worked in Mathematica quite a bit, still use it for some quick visualization hacks. But after some time, I wanted to do stuff that wasn`t available in Mathematica and the only choice would be to implement the algorithms by myself. At that point I realized that I`m locked to Wolfram and started to look for alternatives. I found <http://www.sagemath.org/> \- a python based framework. Now if I want to use something like evolutionary algorithms and some higher math, I can simply connect sagemath with e.g. pyevolve. And I heard they have an interface for R...

</comment><comment><USER3> Yep, I used it all through grad school, mostly around framing electronic structure problems and doing spectral deconvolution. For a certain set of problems it's really good especially for prototyping.</comment>


In Silicon Valley, rich getting richer and poor getting poorer - <AUTHOR> http://www.nbcnews.com/business/silicon-valley-rich-getting-richer-poor-getting-poorer-1C8813698

<comment><USER2> I wouldn't live in Silicon Valley I weren't tied to it because of my job and the industry in general. If I suddenly found myself in a situation where i'm nearly homeless, I would move out the the most expensive area in the west.

</comment><comment><USER3> The Rent is Too Damn High. <http://www.amazon.com/The-Rent-Damn-High- ebook/dp/B0078XGJXO>

If only the NIMBY bastards in the bay area would allow more construction to happen, this could all be alleviated. Construction would not only ease rents at all levels, but also create a lot of jobs that go to the working classes.</comment>


Google introduces self-riding bike in the Netherlands - <AUTHOR> https://www.youtube.com/watch?v=LSZPNwZex9s&feature=youtu.be <comment><USER2> It's April Fool's Day! Haha!</comment>


Stop Pretending you can Start a Company while Avoiding Sacrifice and Risk - <AUTHOR> http://www.gobignetwork.com/wil/2007/8/23/stop-pretending-you-can-start-a-company-while-avoiding-sacrifice-and-risk/10187/view.aspx <comment><USER2> This article does a wonderful job explaing why moonlighting is a poor path for people to start new companies.

But we don't have to reason this one through - we just look out into the world and check.

All in all, it does look grim. Most of the successful software companies do seem to have taken a big plunge at some point. Consulting companies don't count, but consulting companies that have morphed into product companies might.

Can anyone think of a few successful companies that have started this way? Or, if not successful companies, personal applications that someone managed to sell for a lot of dough?

Joelonsoftware's fogbugz might be a good candidate, as well as the 37signals apps. I think that delicious was started as a personal project by an employee with a full-time job. None of these are the giant, smash successes you read about in the business section of the mainstream press, but they can be still be remarkably profitable quiet successes.

</comment><comment><USER3> What spawned this post was a lot of the email I get from Go BIG members talking about wanting to pursue their idea, but they don't want to take any risk to do it.

I used the job example as the most common issue that people tried to circumvent, but I think you can moonlight in some cases just fine.

There is risk and sacrifice in moonlighting, too. I think people have unrealistic expectations as to what starting a company means though.

</comment><comment><USER4> This is probably the most controversial topic possible here. There's nothing that could offend people more than the idea that deep down they might not really have the determination they think they have.

It's so easy to fool yourself into thinking you can have your cake and eat it too. How many people get into the upper-middle class lifestyle of a programmer and then are willing to go back to living like a poor college student? Very few. So moonlighting becomes a way of trying without taking the plunge.

Someone might say about quitting to do a startup: "Yeah..maybe you can't diet without getting your stomach stapled, but I can."

Eating a healthy diet and exercising might be similar. It's something that tons of people want, but so few are able to actually sustain over the long- term. I think a lot more people would successfully exercise and eat healthy if they didn't have day jobs. If they had plenty of extra time to go to the gym and cook meals. I think the same thing is true for doing successful startups, but to a _much_ greater extent since they require so much more effort and time.

</comment><comment><USER5> True, lower the risk, lower the reward if it pays off. However, I think starting a business beside a job is a good way for people who want to start something small. Sure, they're not going to create the next Facebook part time in their garage. But they might build a nice lifestyle business that gives them quality of life.

<comment><USER6> There are also people in my position who have to start something big while moonlighting. I make 35k a year, so after car payments and living expenses (not credit card debt though, thankfully) there's simply no way to save up fast. I'm saving, sure, but at this rate it'd be a year before I could quit to spend 3-6 months on our startup. Godda start now.

<comment><USER7> sell your car, move with your girlfriend/boyfriend and code till you get a call from Yahoo.

<comment><USER6> That's.. certainly one way to do it. I'm debating that, but it's another thing when the chance of you failing affects someone else (for example, if you have a family). Technically you can't 'fail' at a startup, you just quit working on it, so how long do I invade their life? I couldn't bear to ask Emily's father to support me for a year or more.. It just feels morally wrong, especially when he's already 20 years in home debt and is supporting three children and a wife.

Does it make me a non-entrepreneur to worry about morally wrong things? I don't know.

<comment><USER7> Nope. Entrepreneurship and ethics go together. Chances are you can make more than 35k working as consultant or some odd jobs rather than working for someone else. That could be your first step. There are lots of people who would love to know what you know. Put a simple web page and offer consulting services and go to Odesk, Craiglist. Soon you will have a better income and more time for your startup.

</comment></comment></comment></comment></comment><comment><USER8> What a bunch of bullshit. This is at best stupid business-book pith, and at worst completely irresponsible advice. The parts about using your personal cash, spending kids college fund, blowing through your retirement account are particularly egregious. The founders of the most successful companies in Silicon Valley sure didn't risk their own money building their empires. If you're starting a (failed) nightclub in Cleveland, maybe it is a different story.

<comment><USER3> How do companies get funded then that:

1\. Aren't VC funded 2\. Aren't angel funded

Before you answer, keep in mind that 550,000 businesses are started EVERY MONTH in the U.S. alone. VC's fund less than 4,000 of those each YEAR.

You must have some kind of insight that 23 million small business owners don't.

<comment><USER9> I think his point is that companies that can't get funded usually won't be successful, because there has to be something wrong with them to not get funded. Only someone who lives in the Valley and sees how easy it is for someone reasonably connected to get funded could have this attitude.

This isn't always true but there's at least some truth there.

<comment><USER3> We all know Silicon Valley is the quintessential barometer for how all companies are funded and started.</comment></comment></comment></comment>


PostgreSQL Parallel Query v2 - <AUTHOR> http://rhaas.blogspot.com/2017/03/parallel-query-v2.html <comment><USER2> Besides parallel queries (specifically parallel index scans), the Postgres 10 feature I'm most looking forward to is the work Andres Freund has done on using LLVM to JIT compile expressions[0]. Based on the the layout of the database I work on[1], an insane amount of CPU goes to processing of partial index predicates. If the improvements are anywhere near what is being described in the mailing list, we're going to start saving a ton of money on CPU.

Parallel index scans will be an absolutely massive win for us. Currently Postgres does not perform any sort of prefetching. When performing an index scan, this results in serialized random I/O. In our case, queries wind up using ~1/10th the I/O they could be using if there were to do more I/O in parallel. We are expecting a dramatic speedup just from parallel index scans. This is in addition to the bugfix in 9.6 (we're currently on 9.5) which added proper support for index only scans over partial indexes. That bugfix should also result in a pretty large speedup for a lot of our queries.

As soon as Postgres 10 comes out, we are immediately going to upgrade. There are just so many huge wins for us.

[0] [https://www.postgresql.org/message- id/20161206034955.bh33pae...](https://www.postgresql.org/message- id/20161206034955.bh33paeralxbtluv%40alap3.anarazel.de)

[1] [https://blog.heapanalytics.com/running-10-million- postgresql...](https://blog.heapanalytics.com/running-10-million-postgresql- indexes-in-production/)

<comment><USER3> It should be interesting, but LLVM jit brings in a substantial up front cost. Maybe Andres found a way to mitigate it.

<comment><USER4> Is it significant when you are talking about analytical queries which are running for minutes or hours? Seems like it wouldn't be a huge amount of code to JIT compared to the payoff?

<comment><USER5> Presto, which is designed for analytics, does JIT to bytecode on every query and still works fine on sub-second queries. One potential difference with LLVM is that the JVM will profile and only generate machine code for hot code, so short queries might use JVM interpreted bytecode.

But you are absolutely correct that for long running analytic queries, the up front cost of generating optimized code pays off.

</comment></comment></comment></comment><comment><USER6> The relationship between EnterpriseDB and the at-large Postgres community has always intrigued me. Why do they turn over to the community what they could make part of their proprietary fork? Maybe they make a lot of money consulting and not just licenses and general at-large adoption is good for that side of business.

<comment><USER7> I have never used EnterpriseDB and I am only aware of it from a distance but it has always struck me as the ideal open source arrangement. Sure, EnterpriseDB is never going to have the revenue numbers of Oracle but their management and business teams should have a much easier time sleeping at night. I think it is great that EnterpriseDB has identified that it is better for their company to exist as part of a healthy ecosystem instead of trying to pave paradise so to speak.

<comment><USER8> A healthy relationship with open source projects is a great way to attract talent and gain goodwill.

</comment></comment></comment><comment><AUTHOR> That is really an amazing amount of work that has gone into this next release.

This is really getting Postgres up to par with the commercial offerings, and hopefully it keeps progressing for v11.

It's especially important now since servers with more and more cores are becoming the norm.

</comment><comment><USER9> Robert and his team are really doing an impressive amount of progress and work on this.

<comment><USER10> Definitely agreed.</comment></comment>


Run docker commands over your files - <AUTHOR> https://github.com/michaloo/drun <comment><USER2> A simple idea, but a good one.

Something else, you might want to add:

        alias drunu='drun -u `id -u`'

Then, with the drunu alias, the command is run as the current user, meaning you won't have unremovable files written to the current directory.

</comment><comment><USER3> If it meets the guidelines, this might make a good 'Show HN'. Show HN guidelines: [https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)</comment>


70 Days of Lying in Bed for Science - <AUTHOR> http://www.vice.com/read/nasa-patient-8179-200

<comment><USER2> I guess the site should have been indicative, but I'd love to have had more details about the study. Even little things: he posts a photo of his food tray. How does he eat something like spaghetti and meatballs(?) (or whatever that was) using silverware while inclined -6 degrees from horizontal? What was the result of muscular atrophy? How did he use a laptop at that angle to play SC2?</comment>


Yahoo re-org: A view from the ranks - <AUTHOR> http://gowest.blogs.fortune.cnn.com/2008/06/27/yahoo-re-org-a-view-from-the-ranks/ <comment><USER2> Great read. I feel what the yahoo search team feels from here.</comment>


Configure and render your own orbital launch vehicle(rocketbuilder.com) - <AUTHOR> http://www.rocketbuilder.com <comment><AUTHOR> Stumbled upon this website by United Launch Association(ULA) lets you configure an Orbital Launch vehicle(ALtlas Rockets with Centaur seconnd stage engines) to carry your payload to earth´s orbit LEO, MEO, GEO, GSO, Polar ....</comment>


Hiring Jr. Talent On Demand - <AUTHOR> https://lynxsy.com

<comment><USER2> Saw this team at Techstars Demo Day. Really excited to see what the future has in store for them.

<comment><AUTHOR> Thank you for the support nydrewreynolds!!! We loved our experience in Techstars and are sad it is over. We are now looking towards building our features our users want and becoming the easiest way to hire.</comment></comment>


5 EXTENSIONS FOR M2 TO SET Your STORE ON AUTO-PILOT - <AUTHOR> https://extait.com/blog/5-Extensions-for-M2-to-set-your-store-on-auto-pilot/ <comment><AUTHOR> Are you stuck into store hassles? Check these 5 extensions for Magento 2 that will help you to organize your store management effectively and spend significantly less amount of time in your administration panel.</comment>


Ask HN: What did you build or launch in April? - <AUTHOR>

We've had a lot of fun in the past showing off your current projects. Folks get some publicity, some feedback, and some ideas for their own projects. So, if you built or launched something in April, here's your chance to show it off with a description and maybe a link. I want to read about what you've done this last month! <comment><USER2> My co-founder and I launched our progress tracking tool for educators. It allows teachers to print out assignments that can be scanned via fax. We do the scanning and grading on our end automatically and spit the results out in analytics.

Check it out at <http://kiteedu.com> !

</comment><comment><USER3> We launched <http://dialog.gs/> into private beta a week ago.

Dialoggs is a social conversation network that can be used in a number of ways. See my explanation at <http://amirmalik.net/2012/04/27/introducing- dialoggs> if you're interested.

With ~100 users (~20 active/day), it's been great iterating on the product and seeing user feedback first-hand. Our app is incomplete with obvious bugs, yet we still launched. People love it and understand that we're human, and it's still a work-in-progress.

Don't wait for perfection that may never come, just launch.

</comment><comment><USER4> I opensourced a ruby-based bulk domain look up tool just like LeanDomainSearch but designed for home user. <http://github.com/joenorton/domainblob>

<comment><AUTHOR> super! I may make use of that tool to find a few names. Thanks!

</comment></comment><comment><USER5> The Personal MBA Guide to Small Business Infrastructure

<https://infrastructure.personalmba.com/>

I wrote the guide, produced the PDF using a nice third-party template with a few custom modifications, and wrote the entire sales app from scratch. This project is the first time I've used Stripe and Mailgun. The entire project took less than a week, and is on track to net five figures in the first month of sales.

</comment><comment><USER6> Lanched pgXplorer (<http://pgxplorer.com>). pgXplorer is an open source desktop GUI client for PostgreSQL database.

</comment><comment><USER7> Released <http://irepl.im> (Scheme REPL for iMessage), and then started to work on a more serious side project of mine <http://mathwake.com>

Quite like the idea of this thread - I've started to try and release something every two weeks until I find something that I really want to put all my time into.

</comment><comment><USER8> We launched our iPad travel magazine, Overnight Buses Travel Magazine. iTunes link: [http://itunes.apple.com/us/app/overnight-buses- magazine/id49...](http://itunes.apple.com/us/app/overnight-buses- magazine/id493329039?ls=1&mt=8)

Its a long-form travel magazine. Our second issue is coming out in July and next up is gaining some advertising. Should be fun.

</comment><comment><USER9> Added Siri support to my Reddit Notifier app for OS X:

[Mac App Store]: [http://itunes.apple.com/us/app/reddit- notifier/id468366517?m...](http://itunes.apple.com/us/app/reddit- notifier/id468366517?mt=12)

[video]: <http://www.youtube.com/watch?v=oDQfqpzQfLA>

</comment><comment><USER10> I moved a couple of thing that were tools on my own site onto their own domains. Both just fun projects, but still, they made it out of my brain and into the world :)

<http://www.mathaversaries.com/>

<http://www.readability-score.com/>

</comment><comment><USER9> Major redo of <http://www.onehandkeyboard.org/> ... Wordpress, blog posts for patio11-style content generation, etc.

Also shipped a much-improved version of the Mac app itself... but that's still waiting for review from Apple. So I suppose that doesn't count for April :0

</comment><comment><USER11> Started working on and launched Everyminder, a web app to handle infrequent maintenance tasks I always forget about: <https://everyminder.com/>

It's currently pretty basic, but I have lots of neat stuff on my todo list -- should be a fun ride.

</comment><comment><USER12> It was my first project! Nothing big really, just a little 1 MB windows form in VB that streamlines making an internal template. Still, it's exciting to make something my coworkers appreciate.

(I don't have it anywhere to share, and since it's VB I'd be a bit ashamed to, sorry)

</comment><comment><USER13> I played around with the OpenTok API (<http://www.tokbox.com/opentok/api>) and built Chat Envy: <http://chatenvy.com>

</comment><comment><USER14> I started a company that names new startups and products - <http://www.nomvilla.com>. It's going okay so far, but I'm working on a name- logo-business card package.

</comment><comment><USER15> I started learning D3 by recreating Tufte's epic "2004 MLB Baseball Season" graph.

<http://crismannoble.github.com/Tufte-in-D3>

</comment><comment><USER16> Just launched Briarpatch yesterday (a way to share and follow bookmarks): <http://briarpat.ch/hot>

</comment><comment><USER17> I've opened Hevibyte to new sign ups. It's secure sneakernet. <http://www.hevibyte.com>

</comment><comment><USER18> We have launched Wifi Protector - www.wifiprotector.com , super-easy to use VPN service to protect you on unsecured networks. Any feedback?

</comment><comment><USER19> Soft launched <http://traxmo.com> \- time tracking, task management & invoicing.

</comment><comment><USER20> Soft launched <http://mindcast.com> \-- spatial memory and bookmarking system.

</comment><comment><USER21> www.dabble.it - A location based journal. Leave digital postcards wherever you are. iPhone and Web app</comment>


Quantitative Finance Reading List - Programming - <AUTHOR> http://quantstart.com/articles/Quantitative_Finance_Reading_List_Part_2_-_Programming/

<comment><USER2> Note that the submitted link is to part 2 of a three part (at least so far) series of reading lists. That particular part seems pretty useless for the HN crowd, as it is just a list of resources for learning C++. That's something most HN readers could easily find themselves, on the off chance they don't already have such resources already in the libraries.

I'd have though part 1 (reading list for financial and math background) or part 3 (reading list for numerical methods) would have been much better submissions.

The site is organized a little sub-optimally for navigation, as the parts do not seem to link to each other. To find parts 1 and 2, click the "articles" link on the left. That takes you to a list of all articles, but it is a small list so the reading lists are easy to pick out.

<comment><AUTHOR> Actually, in regard to the navigation, this is something I'm working on. Another visitor had trouble with a finite difference method article I wrote and so it is high time to make an "Article Series" banner.

In regards to the HN crowd, perhaps an article on how to use C++ for quant models may be more appropriate? How many of us on HN are interested/practicing financial analysts?

If you have any more suggestions (particularly about navigation improvement!) I'd be keen to hear them. I want to make the site as useful as possible.

</comment></comment><comment><USER3> There's not anything there that is specific to quant work, it's just a reading list for C++.

As an ex-quant, I very much agree with the comment made by Karan (on the site). Our modelling was developed on statistical software such as SAS and SPS. The actual production code was simply Powerbuilder or C++.

<comment><AUTHOR> It is a similar situation to legacy Fortran code in the academic physics community. Fortran is used because some guy wrote the core algorithm 30 years ago in Fortran 77 and never wrote any docs about it. "If it ain't broke don't fix it."

I don't agree with this mentality at all. In fact, I make use of Python almost exclusively for the work I do (in a small fund). My NumPy/SciPy is not good enough though to choose it over C++ when I need to perform some hefty number crunching.

How did you find using SAS/SPS? Is R not a good candidate for what you're doing?

<comment><USER3> It was over ten years ago and I just don't remember. The development modelling was done by a couple of other guys.

I recall seeing R around, but I don't remember it being used for my markets, which were bonds and currencies. The data sets were very large and took hours to process (pre-Pentium 4); would that have anything to do with it?

<comment><AUTHOR> R has certainly gained some traction in recent years, as people have added more packages. It is interpreted so I'm not sure how this will affect speed. I haven't had a chance to use it personally so wouldn't be able to comment.

I know a guy who has a dual processor Xeon machine, each with 4 cores, running MatLab. Once the code was parallelised it zipped along.</comment></comment></comment></comment>


Kids' guide to the Internet from the 90s - <AUTHOR> https://www.youtube.com/watch?v=mfMrVKnGzwg

<comment><USER2> See the responses from (modern) teens here:

Teens react to '90s Internet [http://www.youtube.com/watch?v=d0mg9DxvfZE](http://www.youtube.com/watch?v=d0mg9DxvfZE)

It's a fun juxtaposition.

</comment><comment><USER3> That's so amazingly corny. I love it.</comment>


Statement from Chelsea Manning's Team on Assange Indictment - <AUTHOR> https://www.sparrowmedia.net/2019/04/statement-from-chelsea-mannings-support-team-regarding-todays-unsealed-indictment-and-the-purely-punitive-nature-of-chelseas-continued-detention/ <comment><USER2> It is one thing to advocate for transparency and try to implement better protections for whistleblowers, it is entirely different to willfully break the law, and carelessly, and then expect for the law to not apply to you. Assange is not innocent here and neither is Chelsea. They should accept some responsibility. We can't let people follow their lead without fixing the underlying problems with our government, otherwise their actions are equally as dangerous and put many other lives at risk.

<comment><USER3> Allegedly broke the law. I'm still waiting to see greater details of the evidence showing assange coordinated with Manning to get unauthorized access to a computer. It could be a bunch of bologne used as a pretense to extradite him.</comment></comment>


Ask HN: What's your consulting rate? - <AUTHOR>

I am looking to get a pulse on the going consulting rate for software engineers in the bay area.  Please post your rate and include languages of competency, years experience, etc. <comment><USER2> I currently charge 95/hr. Been doing a mix of Python/PHP/JavaScript and know my way around their associated frameworks and CMSes (Cake/Django/Flask/Drupal/CodeIgniter). I've done only freelance for 5 years and have worked in Austin and Portland. Rates are probably higher in SF.

</comment><comment><USER3> Friend (moved to palo alto,part of silicon valley, in Feb of 2011) makes $140 hr for five yrs experience in Ruby/PHP and 2 yr in Python/Ruby on Rails

He claims most engineers make $120-$150 with a couple years experience.

</comment><comment><USER4> Avg rates I see for everything/everyone is between 100 and 150/hr.</comment>


Urban Hopper robot can leap over 25-foot walls - <AUTHOR> http://news.cnet.com/8301-17938_105-10355669-1.html

<comment><USER2> For some reason cnet pages show without any style or graphics here, no idea what causes that, anyway, a video is here:

<http://www.youtube.com/watch?v=hDGP8IBs6fk>

not quite 25 ft but impressive nonetheless.

</comment><comment><AUTHOR> Wonder if they could scale this up a bit... =)</comment>


Avegant "Light Field" Display - <AUTHOR> http://www.kguttag.com/2017/03/09/avegant-light-field-display-magic-leap/ <comment><USER3> Fun. I hope they are successful. One of the things that my daughter pointed out about 3D movies is that because they are 3D your brain thinks it should be able to shift the focus but it can't and that 'fight' gets in the way of enjoying the content. My understanding is that light field optics don't have this issue.

<comment><USER4> 3D movies are a misnomer, they're actually forced perspective.

<comment><USER5> Forced perspective refers to optical illusions relying on a particular viewpoint. '3D movies' are stereo pairs.

</comment></comment></comment><comment><USER6> We're going to need a new word for resolution at depth. Cubic resolution?

"Cubic resolution of 1080p by 32p"

<comment><USER7> >We're going to need a new word for resolution at depth.

Well then I have good news for you - we already have a metric for resolution irrespective of the depth at which an object is rendered, and we've had it for years. That metric is Pixels Per Degree (PPD). PPD complements the way the eye resolves images (visual acuity) and is independent of depth. ~62 PPD is generally the maximum resolution of the human eye - <USER2> motion/shapes/contrast/color can alter (increase or decrease) this threshold.

PPD takes into account FOV, binocular overlap, and rederable pictures - all in one clean metric.

The truth of the matter is that when companies use this standard unit such that all AR/VR display resolutions can be compared on an level playing field, that tends to lift the veil that is obfuscating how poor the actual imaging resolutions truly are.

<comment><USER7> In case anyone is interested - NVIDIA on PPD: [http://phrogz.net/tmp/ScreenDens2In.html#find:density,pxW:19...](http://phrogz.net/tmp/ScreenDens2In.html#find:density,pxW:1920,pxH:720,size:12.3,sizeUnit:in,axis:diag,distance:31,distUnit:in)

They claify that while acuity limits for a person with 20/20 vision is 60PPD, the average acuity is more like 20/15, equating to 80PPD. It looks like NVIDIA put the PPD benchmark for an ideal display at ~92PPD, which would push the acuity limits for just about every human user. That seems reasonable to me.

As a point of reference, accounting for binocular overlap values (which I had to hunt for), I calculated PPD's for two of the highest pixel-count HMD's out there:

StarVR: 18.6 PPD Sensics dSight: 20.2 PPD

I don't have the details needed to calculate Avagent or Hololens PPD's, but I'd venture to say their at this point or lower. So, as you can see, we still have a long way to go.

One more note - Displays don't need a constant PPD accros the entire rendered image, thanks to steep visual acuity drop-off relative to FOV angle (1). So, to the OP's credit, perhaps there is still some work that is needed on the PPD metric to account for HMD's that use foveated imaging (2), such that all displays (foveated & non-foveated) can still be compared side-by-side.

1\. [https://upload.wikimedia.org/wikipedia/commons/thumb/2/27/Ac...](https://upload.wikimedia.org/wikipedia/commons/thumb/2/27/AcuityHumanEye.svg/500px- AcuityHumanEye.svg.png) 2\. [https://en.wikipedia.org/wiki/Foveated_imaging](https://en.wikipedia.org/wiki/Foveated_imaging)

</comment></comment></comment><comment><USER8> Hmmmm, just some brainstorming here:

You should be able to convert your smartphone's HD display into a low- resolution light field display by attaching a special lens array. It's like the lenticular 3D displays (they refract two rows of pixels in two different directions to create a stereo image), just omnidirectional.

I'm not sure how complex the manufacturing and calibration is but in theory we could create an attachable lens array for smartphones and use it to display a low-res light field, couldn't we?

<comment><USER9> yes. and people have. you're right that its very low res!

The newest idea is to use "programmable" difractive optics instead of lenticular lenses.

<comment><USER10> Do you have some links? Curious to try it out myself

<comment><USER11> [http://www.leia3d.com](http://www.leia3d.com) for instance. I have one of their early dev kit displays and it's quite impressive (but very small).

</comment></comment></comment></comment><comment><USER12> This is a horrible misuse of the term "light-field" for a display.

An actual light-field display would have, for every pixel, maybe 16 sub- pixels, each only visible from a certain vantage point. They represent the rays that travel through each point in space.

This is something that could bring true glass-less 3-D, and would be an ideal VR holographic display if they could make a 16K display that could fit in a headset. You wouldn't even need lenses to focus - just stick the display right up to your face.

<comment><USER13> Isn't that what they are offering though? How else would you be able to focus at different lengths?

<comment><USER14> This display is really an accommodating display, not a lightfield display. Although it's simulating a lightfield, it's not technically producing one.

</comment></comment></comment><comment><USER15> A publicity video can be found here:

[https://vimeo.com/207586226](https://vimeo.com/207586226)

</comment><comment><USER16> Isn't this how magic leap got started? Low valuation at first then bigger and bigger..

</comment><comment><USER17> Google cache: [http://webcache.googleusercontent.com/search?q=cache:k1NGo0q...](http://webcache.googleusercontent.com/search?q=cache:k1NGo0qpydYJ:www.kguttag.com/2017/03/09/avegant- light-field-display-magic-leap/+&cd=1&hl=en&ct=clnk&gl=au)

</comment><comment><USER18> go blue!

</comment><comment><USER19> I dunno, build one of those for $200, I'd consider buying it. Latency is far more important than resolution.</comment>


What are your favorite news websites beyond Hackernews? - <AUTHOR>

<comment><USER2> Google News. Add your own categories by keyword and it will keep you in the loop.

</comment><comment><USER3> Most of the time => Twitter with list.

</comment><comment><USER4> Venture Beat, Slashdot, New York Times

</comment><comment><USER5> InfoQ - Excellent presentations.

</comment><comment><USER6> techmeme. it's been my rss reader replacement for some time now.

</comment><comment><USER7> Google Reader.

<comment><AUTHOR> And when it will be terminated? :)

</comment></comment><comment><USER8> slashdot, arstechnica, echojs

<comment><AUTHOR> Thanks!

</comment></comment><comment><USER9> BBC News.

</comment><comment><USER10> qz.com

</comment><comment><USER11> Slashdot, big time.

<comment><USER12> Seriously? They seem to post the same stories a day or two later than everybody else.

When I remember how awesome it used to be, and then see the javascript-laden discussion pages I'm quietly sad.

I used to check it daily, commenting frequently, but I can't think of the last time I've visited the site.</comment></comment>


Ask HN: Please review my MVP - Instant Drop Box - <AUTHOR> http://instantdropbox.com

<comment><USER2> I like the idea, it's like uservoice, getsatisfaction etc only really really simple.

My only complaint is the fact you've called it 'dropbox' most people associate that word with a file storage/sharing device (such as getdropbox.com or the OSX dropbox).

Perhaps 'comment box' would be more appropriate?

Also, you may want to add some flood control - I was able to bombard my test account with all manner of crap ;)

<comment><USER3> I have the same issue with the naming - it needs to be related to suggestions, comments, feedback.

I had to chuckle when the 'create a premium dropbox now!' button took me to... a dropbox! You're taking the MVP approach pretty seriously, aren't you?

I can also see the benefit of providing some embed code to allow users to integrate it on their own site.

Good job on the design, BTW.

</comment></comment><comment><USER4> innovative.

i'd brush up the design usability. you're on the right track, but i'd avoid the float right/left on the form labels/inputs respectively on a flexible layout, because it makes it harder on the eyes.

also, perhaps set a cookie or something to allow someone to possibly go back to their last created dropbox from the main page. would be more convenient for the people who lose their urls. and/or an option to enter their email address and have the urls emailed to them, and maybe new comments.

<comment><USER5> I'd second all these suggestions, but especially the one about floating left/right. On a widescreen monitor they are so far apart as to be hard to line up.

</comment></comment><comment><USER6> I like the simplicity of the concept, however, it would be very helpful to provide a Javascript widget (a la UserVoice). As well, having the ability for the user to choose (or change) the given URL to be more readable would be a plus.

</comment><comment><USER7> I like it a lot, quick and simple. I've been looking for something like this for gathering quick feedback on small sites, instead of forcing users to go through the whole getsatisfaction & co process.

If you'd add some JS snippet for including it on a web page (popup etc), it would be very helpful. Also, email integration (both for mailing the admin URL so the user won't lose it and for sending user feedback) would be great.

</comment><comment><USER8> Decrease the size of everything. Or if you're set on the size, at least increase the contrast.

</comment><comment><USER9> I like the concept.. suggestions:

\- the URL of the dropbox and the admin page should be human-readable

\- some way to find my dropbox if I have lost the URL (see suggestions by noodle)

\- some way to integrate it as a widget in my own site

</comment><comment><USER10> I really like the design and the logo. Are you a designer? Did you find someone else to work on that? (I'm interested because I'm looking for a way to have a good looking design)

<comment><AUTHOR> Thanks! That encouragement means a lot. Some of my other designs (<http://mushpot.net/>) weren't so well-received by HN..

It was just dumb luck (plus aesthetic help from my wife) that the box graphic came out as well as it did. I made it in OmniGraffle (mac drawing program), and I just kept playing around with the splines until I liked the shape. I'm just a programmer, so I tend to go with the simplest, bare-bones designs I can get away with.

</comment></comment><comment><USER11> Could you replace your image buttons by text buttons (or at least better image buttons). The buttons I see on my 15-inch monitor running ff3/ubuntu are really ugly)

<comment><AUTHOR> I tried to make the image buttons as simple as possible..they're just text surrounded by a drop shadow. I'm surprised to hear objections. Could you describe what you don't like about them in more detail?

<comment><USER11> Sure,

On my screen the buttons look crenelated.

Here is what I see : <http://img260.imageshack.us/img260/3030/capture3.png>

</comment></comment></comment><comment><USER12> Good idea. It would be nice to have a JS widget ala Get Satisfaction that could be used to provide feedback without leaving a site.

</comment><comment><USER13> You did a good job communicating what this app does. Add to the front page, "Why do people need this?"

</comment><comment><USER14> How are you protecting against spam? How do any of these no-signup services protect against spam without resorting to captchas?

<comment><AUTHOR> Each dropbox url has a random code appended to the end, so spammers can't step step through all the drop boxes in order and pass in garbage. But otherwise nothing keeps spammers out. I'll cross that bridge when I get to it.

</comment></comment><comment><USER15> Show me the user agent and IP address of the user.

<comment><USER16> Um, isn't it supposed to be anonymous? I'm pretty sure it says, right on the front page, kind of big letters: "Collect anonymous comments".

<comment><USER17> UserAgent and IP don't tell you who the person is.

</comment></comment></comment><comment><USER18> What does MVP stand for?

<comment><USER19> Minimum Viable Product: The least you can do and let the user actually do something. Features can be added later.

Edit: I did this comment in the MVP way. I just put the term, then added the definition later.</comment></comment>


The Jury Is In: Monolithic OS Design Is Flawed [pdf] - <AUTHOR> http://ts.data61.csiro.au/publications/csiro_full_text/Biggs_LH_18.pdf <comment><USER2> I wonder if there exists a parallel dimension where linux is microkernel design and folks are pushing for monolothic citing the driver friendliness and performance

<comment><USER3> If parallel dimensions exist, then it's most certainly one of the closest dimensions to ours.

If I'm sure of one thing, it's that as soon as we decided to build everything as Microkernels, we'd have the same squeaky wheels touting the massive benefits of Monotlithic OS design. We're hilariously cyclical in our preferences.

"Think of all the runtime efficiencies of the shared memory, and how much easier it would be to develop on the shared codebase!"

<comment><USER4> The dirty secret is that we take a microkernel, rename the syscalls as "upcalls", throw in some hardware emulation code as a less efficient and uglier API for software that can't be bothered to be ported, and call it a hypervisor.

Also, your phone's baseband processor almost certainly runs a microkernel, and likely so does your car.

<comment><USER5> And what many seem to be unaware, is that project Treble made Android Linux into a microkernel where drivers use Android IPC to talk with the kernel.

[https://source.android.com/devices/architecture/kernel/modul...](https://source.android.com/devices/architecture/kernel/modular- kernels)

[https://source.android.com/devices/architecture/hidl/](https://source.android.com/devices/architecture/hidl/)

So everyone running Android Oreo or newer on their phones, not only has a microkernel on their basebase radio, they also have a Linux tamed into a microkernel on their main ARM SOC.

<comment><USER6> I don't see a microkernel architecture here. Requiring drivers to be loadable modules is just arriving in the 1990s of monolithic kernels. Also, only new devices with SoCs introduced for Android 9 are required to use kernel modules and kernels newer than 3.18. [1]

This means most (updated) Android 8 devices in the field are not Project Treble and are running old-style module-less kernels and don't have A/B system partitions.

HALs only seem to be there to abstract over the APIs of different hardware implementations and access to them. Not necessarily their drivers.

I would love to be wrong about this, so I would really appreciate evidence to the contrary here.

[1] [https://source.android.com/devices/architecture/kernel/modul...](https://source.android.com/devices/architecture/kernel/modular- kernels#kernel-version)

<comment><USER5> Because you just stopped at the kernel modules part and haven't spent time reading how HAL in Android actually works, starting at the HIDL link.

There are two HALs in Android.

The old HAL, previous to Treble, which was hardly used by OEMs.

And the new HAL, which is enforced by Treble.

On the new HAL, drivers are implemented as Android services using Android IPC via interfaces defined in HIDL, or by using the new shared memory APIs introduced in Oreo as well.

[https://source.android.com/devices/architecture/hidl/service...](https://source.android.com/devices/architecture/hidl/services)

[https://source.android.com/devices/architecture/hidl/binder-...](https://source.android.com/devices/architecture/hidl/binder- ipc)

[https://source.android.com/devices/architecture/hidl/memoryb...](https://source.android.com/devices/architecture/hidl/memoryblock)

[https://source.android.com/devices/architecture/configstore/](https://source.android.com/devices/architecture/configstore/)

<comment><USER7> I'll admit to not being steeped in the terminology, so feel free to educate me.. but some quick Googling suggests nobody else has called Treble a "microkernel." There are hits about Fuchsia (a totally separate OS), and some Android forks on microkernels.

I'm guessing that the Treble modules expose the traditional /dev and /sys interfaces like before, and these new HALs talk to devices through those, right? Is that not still a runtime-linked monolith, with fairly-thin userspace services between the kernel and the framework?

The bulk of driver code logic (e.g. interfacing with a touchscreen controller) is probably still running in the kernel - show me if I'm wrong. I would think this would be how you define a microkernel. One exception may be the GPU -- those drivers are often very thin in the kernel because of GPL, with a fat userspace library that they can legally keep closed-source.

<comment><USER5> They use Android IPC, which is a kind of RPC between processes.

[https://source.android.com/devices/architecture/hal- types](https://source.android.com/devices/architecture/hal-types)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> The jury was in in the mid 1990's, but Linus Torvalds doesn't know when he's wrong and to listen to his betters. Linux succeeded because of its community, _not_ because of its architecture. QnX has shown the strength of microkernels for decades, they are far more stable and much easier to work on than monoliths. The (small) speed penalty should be well worth the price of admission.

<comment><USER9> > QnX has shown the strength of microkernels for decades

Could you elaborate on this one please?

<comment><USER8> QnX is so common that if you removed it from the industrial world the world would _literally_ grind to a halt. Machinery and vehicles would stop moving, factories would stop producing, chemical plants would (hopefully!) shut down and airplanes would no longer take off (or would have a much harder time trying to land without the usual guidance systems), boats would drift and messages would stop being sent through many systems that you probably would never have heard of.

For one example of such a system: A computerized way to communicate the availability of cargo and space to brokers all over the world, on a good Monday morning several million such messages are sent with a guaranteed maximum time between the first and the last such message sent (to ensure a fair market).

QnX is extremely pervasive and it - and other OS's like it - are so reliable that people tend to forget the systems it powers.

Blackberry made a pretty smart move with their acquisition of QnX, pity that it did not end with QnX being open sourced, that would have been very nice.

<comment><USER10> Just as a casual reader of this comment, a few tips:

\- The rhetoric about the world grinding to a halt isn't really pertinent and makes you look unreliable. Also, no, not "literally." I think what you're getting at is that it's chosen for high-reliability systems, with the implication being that it's chosen for its superior reliability(?)

\- But I say this because it sounds like you have some knowledge as to how this obscure microkernal is used and sharing that is valuable to the community. It's just a shame if the message gets lost in the delivery.

<comment><USER8> The world really would literally grind to a halt, you are severely under- estimating how common this particular OS is. It has been the embedded system of choice for a very large variety of applications, it is anything but obscure it is just obscure to those who spend their time working on web stuff but in industry you would come across it (and RTOS: [https://rtos.com/](https://rtos.com/)) very often.

Neither of those names will ring a bell for people who spend their days with your usual web toolsets.

<comment><USER11> It really wouldnt. They'd keep using the OS and tools to sustain their systems until they got a replacement vendor supporting QNX or replaced the systems with non-QNX software. They might also sue original supplier.

So, rather grind to a halt, it would all continue running in legacy mode, users would spend more money, and it gets supported or replaced. Lots of precedents for that sort of thing.

Between acquisition price and QNX's revenues, it's unlikely support will be terminated any time soon. We wont get to see the hypothetical tested unless RIM bankrupts with nobody acquiring and supporting their assets. That a losing company acquired QNX did worry me a bit, though.

</comment></comment></comment></comment></comment></comment><comment><USER12> Reminds me of the famous Torvalds Tanenbaum debate. [https://groups.google.com/forum/m/#!topic/comp.os.minix/wlhw...](https://groups.google.com/forum/m/#!topic/comp.os.minix/wlhw16QWltI)

<comment><USER13> Thanks so much for the share, great gems in here, I still found myself surprised at this:

> True, linux is monolithic, and I agree that microkernels are nicer.

It's hard to believe that he was only 23 when he wrote this

<comment><USER14> I think thinking about operating systems is precisely the sort of thing 23 year old college students do. I know a few in my class did, I was hyped up by MS's Singularity OS back then.

Unfortunately they were not aware yet that Windows was going to lose the Server OS war and they never pulled Singularity out of research.

Operating Systems is a 2nd year course in most universities.

</comment></comment></comment><comment><USER15> There is a reason why kernel code run in privileged mode, speed! If you run more kernel code in privileged mode then you do not need to copy as much data between the kernel and user space. Vs a micro kernel you will have to copy more data up to user space. Copying data to user space causes context switches and gives less performance.

Larger mono kernels: Speed

Micro kernels have advantages such as: smaller privileged attack surface and thus more secure, more crash proof as you can restart user land processes for example device drivers

[https://en.wikipedia.org/wiki/Microkernel](https://en.wikipedia.org/wiki/Microkernel)

<comment><USER16> Do you really need to do a full copy? What if you had a shared page and notified the user process when the data in the page was available at a certain offset.

Take a look at this paper (FlexSC: Flexible System Call Scheduling with Exception-Less System Calls):

[https://www.usenix.org/legacy/event/osdi10/tech/full_papers/...](https://www.usenix.org/legacy/event/osdi10/tech/full_papers/Soares.pdf)

<comment><USER17> Sharing pages between user processes and kernel is extremely bug-prone, because threads in the user process can mutate the data while the kernel is reading it, leading to all kinds of race conditions. You can't depend on user processes respecting mutexes for security.

You can make this work by removing the page from the user process before making it available to the kernel, but the synchronization overhead of doing this (especially on a NUMA system) is probably worse than copying moderate amounts of data.

<comment><USER16> Hmm. Perhaps temporarily switching the TLB entry to read-only mode for that page during kernel accesses? There might be some interesting software-hardware co-design solutions here.

</comment></comment></comment></comment><comment><USER18> The title is missing "from a security standpoint". Of course, everything is a tradeoff. TLDR:

> We have presented what is, to the best of our knowledge, the first > quantitative empirical assessment of the security implications of operating > system structure, i.e. monolithic vs microkernel-based design.

> Our results provide very strong evidence that operating- system structure > has a strong effect on security. 96% of crit- ical Linux exploits would not > reach critical severity in a microkernel-based system, 57% would be reduced > to low severity, the majority of which would be eliminated alto- gether if > the system was based on a verified microkernel. Even without verification, a > microkernel-based design alone would completely prevent 29% of exploits.

> Given the limited number of documented exploits, we have to assume our > results to have a statistical uncertainty of about nine percentage points. > Taking this into account, the results remain strong. The conclusion is > inevitable:

> From the security point of view, the monolithic OS design is flawed and a > root cause of the majority of compromises. It is time for the world to move > to an OS structure appropriate for 21st century security requirements

<comment><USER19> So, they've looked at a sample of exploits that _were_ critical on Linux and established that most _wouldn 't_ have been critical on a hypothetical otherwise-similar microkernel system.

But they haven't looked at a sample of exploits that were critical on an actual microkernel OS and seen how many would have been less serious (or not arisen) on a hypothetical otherwise-similar monolithic-kernel system.

It reminds me of a nice observation in "Surely you're joking, Mr Feynman". Feynman developed some nonstandard ways of solving mathematical problems. Other people came to him and he repeatedly solved problems they'd been stuck on. "He must be much smarter than us!" But the problems they brought to him were selected as ones they couldn't do, so of course he'd look better than them on _those_. They never bothered asking him problems he couldn't do but they could, because they'd already done them.

Now, maybe the authors of the paper are confident that there's no way that a microkernel design could encourage or exacerbate vulnerabilities. But so far as I can see they don't offer any actual argument for that proposition.

<comment><USER11> "But they haven't looked at a sample of exploits that were critical on an actual microkernel OS and seen how many would have been less serious (or not arisen) on a hypothetical otherwise-similar monolithic-kernel system."

Cuz they don't exist so far. Microkernel-based systems will have same kinds of bugs as monoliths if coded in same language for same hardware. From there, the microkernel architecture leads less bugs in number (less code), less in severity (more isolation), and sometimes less difficulty in patching or recovery. If looking for microkernel-based bugs, I'd look for errors in concurrency and passing data over IPC. Monolithic system are using more concurrency and middleware than ever now, though. Even more than microkernels from what I see if talking about all the strategies and their implementations vs a few, standardized primitives. So, even those areas central to microkernel design seem like problems shared with modern monoliths.

So, the status quo is that the monoliths mostly add problems and increase their severity. Vice versa, the microkernels mostly subtract them in number and/or severity. The field evidence shows this with most of the data on bugs and vulnerability coming from monolith users. From there, someone might want to try to see if the opposite is true. Burden of proof is on them, though, with the status quo being quite reasonable. And that investigation, as I said, might find "microkernel" problems that hold in how modern monoliths are used (esp service and web architectures). Still worth attempting since they might surprise us with what they find. :)

To be clear, that's all about the architectural patterns. I think combining all the potential benefits of microkernels in a system vs a simple monolith could lead to more bugs in microkernel. Most of the problems in software will come from complexity and QA level regardless of architectural style. So, my post is written with assumption that we're talking about large, complex systems done with one style or the other.

</comment></comment></comment><comment><USER20> That chart with the growth of the Linux kernel discredits everything. The Linux kernel continues to grow because they are obsessed with keeping all drivers in mainline instead of having a stable API for them as any sane project would.

<comment><USER21> I believe one of the reasons Linux continues to be successful today is _because_ they keep the drivers in mainline _without_ a stable API.

It is a key motivator to ensure drivers remain available and supported well into the future of Linux.

<comment><USER5> Which given the way legacy AMD drivers story has been handled on Ubuntu, it is quite far from actually being so.

My Asus Netbook no longer gets all the acceleration options that it used to have pre 16.04.

Linux is successful because it is a free beer UNIX clone.

<comment><USER22> You still have the source to the old drivers. It's just not a priority for others to support anymore, but you have the means to go add that support yourself, or pay a third party to do it for you.

Contrast with when windows changed the video driver architecture in Vista, and the only option you had was to pound sand.

<comment><USER23> Seems like a pretty easy cost/benefit analysis to me:

I can either spend thousands of dollars worth of my time on updating the driver, or I can pay someone else thousands of dollars to do it. Or I can spend a fraction of that on a new video card.

Seems like the only solution for Vista users is the only solution I'd ever have gone with, anyway.

<comment><USER22> Sure the cost/benefit works out the same for you (which is why no one has done the work), but that's different from the full set of options available to you in both cases.

<comment><USER23> How expansive do we want to be about what the full set of options is, though?

I tend to fall on the side of the root poster - if having a stable driver API means Linux gets more commercial driver support, then that's the one that has the highest cost/benefit in my book.

In practical terms, being able to hack on open-source drivers isn't particularly useful to me, but having an easier user experience with Linux on the desktop (and, more generally, having Linux on the desktop be something more than an also-ran) would benefit me _immensely_.

</comment></comment></comment></comment></comment></comment></comment><comment><USER24> Contrary to what's written about microkernel speed: Systems I used in the '80s to great effect used at least the moral equivalent of a microkernel ("Nucleus"). They were fast (compared with VAXen etc.) for interactive use and supported real-time processes. (Some visitors thought context switching was a bit slow, assuming "microseconds" meant "milliseconds".) The filesystem was fast enough to dispel the assumption a "database" was always required for speedy experimental data access rather than a file per spectrum.

[https://en.wikipedia.org/wiki/OS4000](https://en.wikipedia.org/wiki/OS4000)

The performance wasn't just because Nucleus initially was in hard/firmware; two later software implementations were performant (on faster hardware). Also, as the article is about security: at least the original Nucleus also supported an A1/B3-level secure OS.

</comment><comment><USER25> Well, the obvious solution is to design our Kernel's on Kubernetes.

<comment><USER26> [https://www.qubes-os.org/](https://www.qubes-os.org/)

<comment><USER27> A reasonably secure os?

I think that's one thing I don't want just reasonable

<comment><USER26> It's kinda self-deprecating humor; the (now ex) Tor developers I know use it. Nothing is ever 100% secure.

<comment> yjftsjthsd-h It's like the lesswrong folks; step one was accepting that there are too many flaws to fix everything, and then step two was to do our best anyways.

<comment> qu4z-2 Also mutt, with "All mail clients suck. This one just sucks less."

</comment></comment></comment></comment></comment></comment><comment><USER28> IMO a microkernel isn't a design worth pursuing as there will always be overhead. Instead an exokernel with a simple monolithic 'multiplexing' kernel or a language that has 100% safety (not really possible).

</comment><comment><USER29> Still waiting for GNU hurd.

<comment><USER30> hurd isn't even interesting. seL4 is faster, has production applications, and is formally verified. you can even use seL4 as a base platform in genode[0].

[0]: [https://genode.org/documentation/platforms/index](https://genode.org/documentation/platforms/index)

</comment></comment><comment><USER31> In a perfect wrold microkernel OSes would be perfect but then it's all pointless.

In real life there are certain parts of the OS that _have_ to work or the whole device stops working. Furthermore: the isolation of dynamic and less tested application code from these parts is generally a good idea, that's why monolithic OSes are so popular; they're simply less demanding.

<comment><USER6> Nobody claims faults of core functions must be survivable in microkernel designs. The restarting of driver processes is a nice trick, but in the end the isolation and clean interfacing are particularly useful in an imperfect world.

The goal is to minimize the trusted computing base (TCB) so that it is, at least to some degree, verifiably correct. Then tack on features using isolated components.

</comment></comment><comment><USER32> Some super low quality commentary here. Straight to the Monolithic/Microkernal tribalism, talk of parallel dimensions, as long as we ignore the content of the paper - which remains far more empirical and convincing than any rebuttal seen here.

</comment><comment><USER33> I'd hazard to say that _every_ design is "flawed" in some regards: there's no way to achieve all desirable qualities and none of undesirable qualities. For one, some desirable qualities contradict each other.

So "${thing} is flawed" is not precise enough; an interesting statement would be "${thing} is not the best choice for ${conditions}". A monolithic OS is not the best choice for a high-reliability system on unreliable hardware. A microkernel OS that widely uses hardware memory protection is not the best choice for a controller with 4KB of RAM. A unikernel setup is not the best choice for a desktop system where the user is expected to constantly install new software. Etc, etc.

In other words, the ancient concept of "right tool for the job" still applies.

<comment><USER34> > In other words, the ancient concept of "right tool for the job" still > applies.

Or use a multi-tool ;)

<comment><USER35> The trade-off with a multi-tool is additional complexity, more difficult maintenance, it's heavier, takes up more space, etc.

</comment></comment></comment><comment><USER36> OK so seL4 is safer than Linux, that's not really news.. I have questions about seL4 though: is it able to manage several multicore CPU efficiently? What about power management, does it work?

<comment><USER5> Given that it is responsible for powering many embedded systems deployed into production, yes.

<comment><USER22> They only added multicore support in the past year, and it contains no power management code beyond sleeping in the idle loop.

<comment><USER5> So I wonder how do those devices manage themselves.

<comment><USER22> They dont. You don't need power management for a lot of embedded systems that are high assurance. Power is generally plentiful in high assurance situations for a lot of reasons.

</comment></comment></comment></comment></comment><comment><USER37> Of course it's about Gernot Heiser's verified ukernel...

</comment><comment><USER38> Now it's a good time to revive microkernel for prime as server less offers the abstraction for making transition transparent to users and application developers.

Anyone tried that?

<comment><USER39> Much of the cloud/virtualization industry is actually built on exokernels; a hypervisor is basically the commercially-viable version of an exokernel. The unikernel movement is an attempt to revive the LibOS and use exokernels as they were originally designed (i.e. move OS abstractions into user-space and not have a whole OS running on top of an OS), but there've been several pragmatic barriers that've kept them from gaining all that much adoption.

<comment><USER38> I think I am mostly want to say to the advocate of a certain on machine first- level software infrastructure above hardware to feel more free to try to prove their technology is the best.

I am not too much about particular alternatives.

</comment></comment></comment><comment><USER40> This is like saying Linux is more secure than Windows because not all of Window's critical vulnerabilities appear in Linux.

<comment><USER41> What classes of vulnerabilities are you referring to that are likely to show up in a microkernel-based design but not in a monolithic one? Do you think adding those classes of vulnerabilities to the picture will result in more, about the same, or fewer critical security issues between the systems overall, and why? Please be specific.

</comment></comment><comment><USER42> The Jury Is In: Microkernel OS Design Is Flawed.

See I can make clickbait titled papers also.

<comment><USER41> Great, now all you have to do is build a secure (preferably formally verified) monolithic kernel, exhaustively, thoroughly research all the vulnerabilities in popular micokernels, find evidence to support your thesis, write up the paper, and get it peer reviewed, and you're all set!

</comment></comment><comment><USER43> Linux is the most popular OS in the world (of course, counting Android), so I guess this means it doesn't really matter is monolithic is flawed, or it is not flawed enough.

<comment><USER5> Sure it matters, because Android Oreo has actually forked Linux into a microkernel like design, where drivers run as separate processes and use Android IPC to talk with the kernel.

<comment><USER44> And Fuchsia, if it ends up replacing Android, is a microkernel design from the bottom up.

</comment></comment></comment><comment><USER45> > We find that almost all exploits are at least mitigated to less than > critical severity, and 40% completely eliminated

This probably sounds trollish, but security isn't _that_ important. An OS architecture has to take into account other things too.

<comment><USER46> It's kind of pointless to have a faster server at the cost of seeing that server owned by someone else.</comment></comment>