It's time to publicly shame United Airlines' so-called online security - <AUTHOR> https://techcrunch.com/2016/08/13/its-time-to-publicly-shame-united-airlines-so-called-online-security/ <comment><USER2> It's entirely their prerogative as to whether or not they provide a decent level of security, and it's entirely up to consumers to choose whether or not to work with them.

The vast majority of people do not know what 2fa is, and sure as hell don't care to know, so the only people irked by their misleading messaging are IT professionals, who, again, can fly with someone else.

Essentially, there is clearly no incentive for them to improve their security unless it hurts their bottom line - and there's no point from their perspective in investing in something which makes no money.

Of course, if they have a major hack there will be some brief PR damage (none of the high profile hacks of major companies seem to have inflicted _any_ reputational damage - instead the public blame the "terrorist hackers" the media parade), and their insurers will cover any direct losses, including those as a result of a class action, which they're probably indemnified against anyway.

In short, they have no reason to change, so probably won't. If anything, they'll be upheld as the golden standard, because legislators will buy into their PR, not being in any way technical themselves. Perception is reality.

<comment><USER3> > It's entirely their prerogative as to whether or not they provide a decent > level of security, and it's entirely up to consumers to choose whether or > not to work with them.

Entirely? Does the security of their website rank anywhere in the top ten of reasons anyone chooses an airline?

> The vast majority of people do not know what 2fa is, and sure as hell don't > care to know, so the only people irked by their misleading messaging are IT > professionals, who, again, can fly with someone else.

And it is the IT professionals who might raise the bar, and protect those who do not 'care to know'.

> Of course, if they have a major hack there will be some brief PR damage > (none of the high profile hacks of major companies seem to have inflicted > any reputational damage - instead the public blame the "terrorist hackers" > the media parade), and their insurers will cover any direct losses, > including those as a result of a class action, which they're probably > indemnified against anyway.

So all that matters is PR damage, and anything that someone is willing to sue for?

<comment><USER2> _Entirely?_

Yes, entirely. It is up to them how they choose to operate their business, so long as it is within the bounds of law.

 _And it is the IT professionals who might raise the bar, and protect those who do not 'care to know'._

Correct, but how will you raise the bar or protect other passengers, if United do not care about your opinion, as you are a small minority? Unless you can hurt their bottom line by persuading people to not fly with them, they won't budge - and just you try persuading aunt Tilda not to fly with United because their website security is poor, even though their tickets are $200 cheaper than $competitor. I mean, that television ad said they had the best security in the business. Why would they lie about something like that, and what do you know about it anyway?

 _so all that matters is PR damage, and anything that someone is willing to sue for?_

To them, absolutely.

<comment><USER4> > Yes, entirely. It is up to them how they choose to operate their business, > so long as it is within the bounds of law.

I guess the law needs to change then. A shop cannot sell you an item of food that might seriously harm you, because it's unreasonable for the average consumer to carry out the required testing on every piece of food they purchase for consumption. Ultimately (I'm not saying this can necessarily happen overnight), the same should go for online security. Now, it's a difficult-enough thing that responsibilities need to be very carefully defined; every mom-and-pop site should do the reasonable minimum themselves, but a good centralised system should be available for them to use for the trickier aspects.

<comment><USER2> _I guess the law needs to change then._

I couldn't agree more - but then, what incentive is there for legislators who are technically illiterate, and have attended many cheque-laden seminars in which airline lobbyists have told them they don't need to do anything about that nasty regulation stuff. Imposing strict universal security requirements would be deemed anti-competitive, and could potentially result in businesses suing the federal government for loss of profits.

Personally, I think the future comprises a frothing sea of crapware, leaky everything everywhere, and nobody taking responsibility. The most probable ultimate response will be a "war on hackers", after someone pulls something spectacular off, which will generate trillions of dollars in profits for enforcement agencies, and give the public that warm fuzzy "somebody is being bombed and it isn't me" feeling.

</comment></comment></comment></comment></comment><comment><USER5> In all fairness to United, it's probably pretty difficult to implement real 2FA in COBOL.

(In passing jest to: [https://news.ycombinator.com/item?id=12246490](https://news.ycombinator.com/item?id=12246490) )

<comment><USER6> SECURITY DIVISION.

      Begin.

       PERFORM Login WITH TEST BEFORE

        UNTIL FactorCount GREATER THAN 2.

</comment></comment><comment><USER4> To be fair, all UA say is:

> Your security questions will also be used as part of upcoming two-factor > authentication to further protect your account

The stupid nature of the 'enum answers' aside, this doesn't necessarily mean they're not implementing 2FA properly. They _might_ have 2F set up as securely as the very best practitioners, then have this security question crap layered on top. We need to know for sure that they think the security question is one of the two factors before tearing them a new one.

<comment><USER7> They apparently think that those security questions, combined with the password, are the 2FA.

Unfortunately , this is not true. 2FA authentication means something that you know and something that you have. The advantage is the second one: if the attacker has compromised your PC/password wallet, they still can't get into your account because they are missing something (you have).

With UA's approach, an attacker can still successfully hijack the vicitims account if they have a key logger because UA's authentication only requires "something(s) that you know"

<comment><USER4> Sure, I understand what you're saying about 2FA but:

> They apparently think that those security questions, combined with the > password, are the 2FA.

What makes you say that? I see nothing that concretely backs this up.

<comment><USER8> It's as bad as it seems. Every time you log in from a new machine, it asks for you to answer security questions, and calls it two factor, which it's obviously not.

</comment></comment></comment></comment><comment><USER9> The dropdowns are hilarious for non-security reasons, you have to choose your favorite artist... from a list of about 12 artists. I suppose it could be an improvement on the misogynist, homophobic, and Facebook-able "mother's maiden name".

I'm almost disappointed that they're not having their phone staff ask for your actual password - I'd love to have the experience of reading my 1Password- generated password to them.

</comment><comment><USER10> The author seems to use authorization and authentication interchangeably multiple times in the text. They may be right about the point they are making, but it leaves a bad taste.

</comment><comment><USER11> security questions as a recovery mechanism are fucking terrible.

most people are going to fill in the same response for their security q/a over multiple sites so pretty much any bad actor in any organization could possibly look at the security q/a, guess that their question/answers are the same on other sites and exploit that avenue.

also fuck remembering all of that.

but i think hsbc was even worse than what united is asking for. for their online banking you had to enter in your password then enter in another password using a browser based keyboard (AVOIDS KEYLOGGING!) and then answer a security question or something like that. i must have asked for a new passcode to reset everything every couple of months (they mail these to you via snail- mail).

of course the problem with the system was (and i forgot exactly how) there was a way sometimes to reset all these systems so you didn't have to remember your answer for each security measure. i was pretty sure it was a bug with the system but fuck if i want to endure the hell in trying to explain to a website with terrible security that you've found a bug in their terrible system and please don't put me in jail and what do you mean, 'what is a hash function?'

</comment><comment><USER12> Providing account authentication as a service seems like a no-brainer.

Does no company in this space know how to sell to conservative IT organizations like air lines?

<comment><USER13> Well that was the promise of OAuth. But then that service company (in this case Google and Facebook) have full and perfect visibility on all the websites you use which raises some other problems. Which is why I never wanted to touch it and why I think they are not so popular.

What I really like is concepts like Steve Gibson's SQRL, which provides a pretty secure alternative to passwords, but in a fully decentralised way, i.e. SQRL only provides the protocol and the cryptography, but the authentication only involves you (and your devices) and the website, no reliance on a third party.

<comment><USER4> You think OAuth didn't take off because people are _too aware_ of security/privacy issues? I think it's the exact opposite reason.

<comment><USER13> I see a lot of people who find these privacy issues creepy. They might not necessary care enough to get off google, gmail or facebook, but care enough to install an ad blocker, and I presume declining to use facebook to login to some place.

</comment></comment></comment></comment><comment><USER14> Apple also uses security questions like this for Apple ID accounts. I don't like it, but where's the outrage? Is there is a way to do this correctly, other than the user asking their own question?

</comment><comment><USER15> I wonder at what point will companies finally realize that it would be cheaper and easier to just give each customer a security token.

<comment><USER16> Don't give them ideas. I have 1 security token for each bank over here in Singapore and a few others. I wish they use something like Google Authenticator rather than cook up their own.

</comment></comment><comment><USER17> Can we start by shaming Techcrunch.com's mobile layout?

[https://s4.postimg.org/5er0ol93h/Screenshot_2016_08_14_17_59...](https://s4.postimg.org/5er0ol93h/Screenshot_2016_08_14_17_59_56.png)</comment>


Matt Levine – Custody of Cryptocurrency - <AUTHOR> https://www.bloomberg.com/opinion/articles/2019-07-11/maybe-the-companies-will-fix-the-climate <comment><AUTHOR> From the article (ok the email):

Custody

If you buy a share of stock in a company, you don't get your own tiny fractional share of all of the company's assets delivered in a bag to your door. With rare exceptions, you don't even get a paper stock certificate. Instead you get an entry in the computer of your broker reflecting that some of the shares that the broker holds are actually held for your account. But the broker doesn't have a bag, or a paper certificate, either. The broker has an entry in the computer of some other intermediary—in the U.S., generally, the Depository Trust Company—saying that some of the shares that DTC holds are actually held for your broker's account. DTC may have a paper certificate, though often it just has an entry in the computer of the company's transfer agent reflecting that many of the company's shares are owned by DTC.

I guess if any of these computers crashed then that would be bad? For you? Presumably they keep backups. This system actually works really well; there are occasional weird glitches in which the technical details of stock ownership can get confused, but there are not really cases of people losing their shares because their broker or DTC or the transfer agent forgot where it put them.

This is not an accident: Reliably keeping track of security ownership is a really really really important feature of the financial system, and so the financial industry works together to maintain a functioning system, and it is all heavily regulated to make sure that it works. This system is conventionally called "custody," which is sort of a historical metaphor suggesting that you own paper stock certificates and your broker is keeping them safe in a box for you. But, in almost every case, that's not actually happening; that's just a metaphor. Really "custody"—the methods that your broker, and the financial system generally, use to keep your securities safe for you—occurs entirely on computers, and is basically an agreed and regulated set of legal and technological conventions for making sure that everyone knows who owns what stocks.

Cryptocurrency has different conventions. Basically there's a blockchain recording who owns what, and an enormous set of possible numbered accounts each with, in effect, a password (a private key) entitling its owner to use the cryptocurrency in the account. There is (generally) no centralized intermediary holding everything for everybody; distributed technology and cryptography are what keep your coins safe. There is a lot to like about this—it is not vulnerable to single points of failure, it is not captured by powerful incumbents, etc.—and crypto enthusiasts quite vocally like it. There is also, to be fair, a lot to dislike. You can lose your password, or someone else, absurdly, can guess it. Maintaining your password yourself might be a pain so you might rely on someone else to keep custody of your coins, and they might lose them. In fact there is a comically long history of people losing their cryptocurrency because they or their broker or their exchange forgot where they put them. The actual experience really is much worse than in the securities industry.

So far. You could imagine better conventions for just, like, how your broker should write down the password or whatever. Getting to institutional-grade custody of cryptocurrency is not an unsolvable problem; it is just a matter of finding some good legal and technical conventions, and getting the industry, and the regulators, to buy into them. It is a hard problem mostly in that the industry, and the regulators, are used to the conventions that work for regular securities, and it is hard at this late date to get them all to agree on a new set of conventions for a new sort of asset.

Anyway here is a joint statement from the SEC and the Financial Industry Regulatory Authority on "Broker-Dealer Custody of Digital Asset Securities":

In particular, a broker-dealer may face challenges in determining that it, or its third-party custodian, maintains custody of digital asset securities. If, for example, the broker-dealer holds a private key, it may be able to transfer such securities reflected on the blockchain or distributed ledger. However, the fact that a broker-dealer (or its third party custodian) maintains the private key may not be sufficient evidence by itself that the broker-dealer has exclusive control of the digital asset security (e.g., it may not be able to demonstrate that no other party has a copy of the private key and could transfer the digital asset security without the broker-dealer's consent). In addition, the fact that the broker-dealer (or custodian) holds the private key may not be sufficient to allow it to reverse or cancel mistaken or unauthorized transactions. These risks could cause securities customers to suffer losses, with corresponding liabilities for the broker-dealer, imperiling the firm, its customers, and other creditors.

These are not problems that are so different from the problems of keeping a list of securities at DTC; it's just that those problems are familiar and the crypto ones are new.</comment>


I just launched a new web analytics app, Inspectlet. Thoughts? - <AUTHOR> http://www.inspectlet.com

<comment><AUTHOR> I know there are a lot of options when it comes to analytics, but Inspectlet is designed to complement Google Analytics with everything it's missing.

We believe that we've built a suite of products that complements tradition analytics like Google Analytics very well. Google Analytics is your trusted old companion, but in order to really maintain relevance, a real-time service is necessary. Custom Metrics in real-time allow for an even stronger analysis of your site (in real-time). And of course, to test usability and how well a new interface design or feature is doing, screen capture is incredibly helpful.

We felt that with Google Analytics and Inspectlet, you have a very complete set of analytical tools.

BTW: Enter code "hackernews" during signup to get 15% off every month.</comment>


List of sites to promote your app - <AUTHOR>

I got these two links from a friend. You guys might find this useful. And of course if you know of any sites like these please post them :).
http://answers.onstartups.com/questions/31787/are-there-any-blogs-or-websites-introducing-new-website
http://productivewebapps.com/blog/list-of-places-to-submit-and-promote-your-startup-or-site/ <comment><USER2> Headlines on Tech Crunch is a good way of getting the word out about your app:

<http://techcrunch.com/contact/>

This article talks about all the various aspects to consider for app discovery:

[http://thenextweb.com/insider/2013/05/02/beyond-the-hype- app...](http://thenextweb.com/insider/2013/05/02/beyond-the-hype-app- discovery-and-app-promotion-need-better-quality-standards/)

</comment><comment><USER3> Thank you for sharing those great lists.</comment>


Overclocking the Raspberry Pi 4 - <AUTHOR> https://www.tomshardware.com/reviews/raspberry-pi-4-b-overclocking,6188.html <comment><USER2> I can't get over their decision to not include 0 on the scale. That makes the 47 -> 39 improvement look like 50% rather than 17.2%.

Otherwise it's interesting to see this is possible. I can imagine some tech entertainment channels soon picking it up with extreme overclocking and water cooling.

<comment><USER3> Came here to say the same thing. Annoys me when a (I thought) quite reputable site is so sloppy with their data presentation.

</comment></comment><comment><USER4> Is overclocking (at this level based on this form factor) really worth it? Sure, the speed increases are notable, but I can't see much benefit to overclocking (specifically a pi) unless you are trying to increase game emulator performance or something.

This is all probably moot if you're planning on using the pi for an actual third world type setting as a workstation for schools and such, I suppose.

<comment><USER5> Agreed. I came here to say overclocking a raspberry pi seems like it misses the point of the pi relative to other computers.

<comment><USER6> For some of the older pi's it was kinda a "free performance" that you may as well use for a lot of applications. The zero w still needs it for decent camera streaming.

The problem with the Pi 4 however is that it's on the verge of needing active cooling at stock speeds, so overclocking the pi 4 is kinda a deal breaker for me. (If I'm going through the trouble of setting up active cooling for the pi I'd rather use a different solution like an atomic pi or old laptop)

<comment><USER7> I have two pies in use at work 3B's.

Bought cheap little cases with active fans of Amazon and they are brilliant, nicely designed, quiet little fans and you dropped the pi in and closed the top.

Thermals where much improved.

</comment></comment></comment></comment><comment><USER8> What happened to Tom's Hardware? This webpage takes forever to load all the ads and things.

<comment><USER9> setup a pi-hole. page loads super quick then...

<comment><USER10> Plus now you can overclock it to do it even faster... A bit meta ;)</comment></comment></comment>


Idea for Windows Phone Team - Make switching easier and less costlier - <AUTHOR> http://anandnalya.com/2012/01/04/idea-for-windows-phone-team-make-switching-easier-and-less-costlier/ <comment><USER2> Interesting thought. The most customer friedly solution I could image would be a 'iTunes Match' like service for Apps. While seting up your Windows Phone, they could ask for your iTunes or Android Marketplace credentials and scan these accounts for past purchases of popular apps also available for Windows Phone and mark them as purchased in the Windows Phone App Marketplace.

</comment><comment><USER3> Interesting suggestion. I wonder, would app developers even be willing to go with this idea themselves?

Sure,importing data is great, and should be possible, but why on earth would they hand out free copies of their software? I'm sure many would consider this complete _madness_

<comment><AUTHOR> To retain users moving to a new platform?

<comment><USER3> I'm not saying they shouldn't do it. I just don't believe that the vast majority _would_ do it</comment></comment></comment>


Zynga Shuts Down OMGPOP One Year After Acquiring It For $200M - <AUTHOR> http://techcrunch.com/2013/06/04/zynga-shuts-down-omgpop-one-year-after-acquiring-it-for-200m/ <comment><USER2>
      | "but most of my team had new jobs lined up
      | by the time they left the building anyway."

I've never experienced this. Does this mean that they were already looking, or that they were able to immediately call someone up and get a job offer on- demand?

Edit: To be clear, having 'a job lined up' to me means that they already at least have an offer, rather than just a bunch of emails from recruiters and/or people looking to hire them. It seems really amazing to go from laid off to "have a job offer" in an afternoon. I could definitely see laid-off-to- interviews-lined-up in an afternoon though. Am I being too specific in my reading of this?

<comment><USER3> If it's anything like San Francisco, once word spreads that a gaming company is shuttering, there's pretty much a "land grab" from the other local companies for talent.

<comment><USER4> Especially at a company like Zynga, that at least as far as I know, had a fairly rigorous interview process. It's a chance to get a pre-screened engineer, possibly on the cheap.

<comment><USER5> understandably a company would want to pay less for higher quality work, but at the same time if the process was rigorous and assuming many tech recruiters are also trying to poach the employees - i would think 'on the cheap' wouldn't really apply given supply/demand here

<comment><USER6> It is on the cheap in the sense that they wouldn't expect to screen such people as much. It obviously isn't free, costs more than hiring from within, but cheaper versus trying to gauge recent graduates and the like.

<comment><USER5> ah yea, didn't think that all the way through

</comment></comment></comment></comment></comment></comment><comment><USER7> I was surprised to hear 3000 people were making those Zynga games. Doing what exactly? Pls I'm genuinely curious.

These social games seems so lame to me that I can't think of any reason why someone will even think of building a public company on top of it. You simply cannot meet investors' quarterly demand when your success is built on being "flavour of the month" business model.

I don't have anything wrong against Zynga or its founder and so I don't wish them failure but this should have come as a common sense that they should have stayed private and stayed lean (both in taking VC funding and the number of employees)

<comment><USER8> They have a few dozen games of varying popularity. The bigger ones need a non- stop flow of new content to be created. Zynga was very good at creating new tasks and items constantly, so there was always something to do and something new to collect. It requires new story lines, artwork, mechanics, localization, and support. Many of the games don't overlap, so each game needs much of its own team.

> You simply cannot meet investors' quarterly demand when your success is > built on being "flavour of the month" business model

Sure you can -- just look at any company that's in the entertainment business. All of their products, from pop songs to to supermodels to blockbuster movies, have a limited shelf life and require hit after hit after hit in order to sustain the business. They stay ahead of the curve by casting a wide net, having a team that is good at selecting the hits, effectively bringing the product to maturity (like producing an album or movie), and marketing the crap out of it.

Zynga may have made many mistakes along the way and probably got too large to quickly. But they not the first nor last company that got a couple of major hits and were backed to produce more based on that record. Do it well, and you have Pixar. Do it poorly, and you join the massive pile of overhyped one-hit wonders.

<comment><USER9> I just had a funny vision of what their task management system might look like. With managers planting work items, and having to harvest them when the developers are done :P

<comment><USER10> Yes! Please Atlassian, consider this a feature request for Jira.

</comment></comment></comment></comment><comment><USER11> I bet all the execs got well paid for their terrible efforts though and they will slide into new positions of power regardless of their merit. We need to take our industry back from the leeches. The near-sighted execs with nothing but paper accolades and networks of cronies.

<comment><USER12> Start your own company then and set an example instead of criticizing others.

Edit: Thanks for all the upvotes/support. To those who see this as legitimate criticism, really? The OP elaborated on nothing - no constructive criticisms were made. Instead, it just sounds like pure anger and naïveté on my end, alluding to all entrepreneurs trying to make it/who have made it as "leeches" and "near-sighted execs" that have "networks of cronies." Stay classy.

<comment><USER13> If failure of such magnitude cannot be criticized, then what should be?

<comment><USER14> Not even trying.

Edit: no, that's too mean. But I like people who take risks, and I get defensive when people snicker at failure from their armchairs of hindsight. We should learn from failures, but not rush to say, "he failed, what an idiot!"

<comment><USER11> I'm curious how you know so much about me. How do you know what I've done? I've already started my own companies bud and sold them, twice. I'm working on my third now after just building a startup with some others called Brabble. Here it is: <https://itunes.apple.com/us/app/brabble/id570281083?mt=8>

To the post below: BKRGB which was an signage platform and ShaiSoft, which sold networking library software. The rest of the details are none of your business sir. I like how you belittle me because my numbers aren't big enough on the Brabble app. I've heard all this type of BS before. Don't listen to me then. Just keep attacking other developers for trying.

BTW, we have a NASCAR running this on June 7th in the Party in the Poconos 400 with our logo on it. Keep an eye out for it. We're just starting.

<comment><USER15> Since you brought it up, which companies are those? Otherwise It just seems like you are making it up to make yourself look better.

By the way, I've also made iOs apps that barely get any ratings.

<comment><USER11> BKRGB which was a signage platform I built last year with a partner and sold and ShaiSoft, which sold networking library software that I sold in 2002. I'm not rich because of it but I _have_ tried and succeeded.

It's interesting how you belittle me because my numbers aren't big enough on the Brabble app. If I had bigger numbers could I criticize then?

<comment><USER15> >>It's interesting how you belittle me because my numbers aren't big enough on the Brabble app.

Sorry about that. It was uncalled for. Honestly I thought you were just making stuff up. You've certainly done more than most.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Could be good to hear from Dan Porter again.

[http://www.gamasutra.com/view/news/167244/Turning_down_Zynga...](http://www.gamasutra.com/view/news/167244/Turning_down_Zynga_Why_I_opted_out_of_the_210M_Omgpop_buy.php)

<comment><USER17> I didn't understand your reference. Is the story here that (1) Shay Pierce wrote a column for Gamasutra about why he decided not to work for Zynga after they acquired OMGPOP?

And then (I had to dig in the comments) (2) as that column was circulating, OMGPOP CEO Dan Porter supposedly sent the Twitter message "What's so interesting about success is the number of failures who try to ride on your back. Shay Pierce is just one of many..."?

(The message was supposedly at <https://twitter.com/#!/tfadp/status/185901564131688448> but this is a dead link.)

What would you want to hear from Porter now?

<comment><USER18> It would be interesting to see if Dan Porter still considers OMGPOP a success under Zynga?! That flippant tweet should have not happened, considering that the sale was pretty much a very successful exit for Dan Porter but not necessarily a great success for any of the OMGPOP people.

<comment><USER19> The sale was a success for all people at OMGPOP. Dan and all the board members made sure of that. (this is not private knowledge)

<comment><USER20> The business by contrast appears to have been a complete failure - but at least they got paid?

</comment></comment></comment></comment></comment><comment><USER21> I want to know what kind of thought process goes on company/individual's mind when they decide to do an acquisition like this, for $200M, which doesn't make enough money to justify it.

You would think when you are throwing around that kind of money, they would do some rudimentary research?

How much money was omgpop making at the time of the acquisition?

<comment><USER22> The thought process was something like this:

MP: "FUCK! OMGPOP's drawsomething is the number one game! COPY IT!"

varucasalt.jpg

Legal: "Mark, uh - I don't think we can copy that one"

MP: "WHY?! - We've done it with everything else!"

Legal: "Yeah - but this one's too big, too successful. If we copy the number one game, it would be too obvious."

MP: "How much to buy it? I WANT IT!"

/stamps foot

\---

I picture an internal battle around wanting to copy it and realizing that there was no way to copy them without a PR nightmare - so they opted to purchase them for an insane amount... even though that amount was not reflective of their ability to maintain or succeed with future releases.

<comment><USER4> Or the even simpler discussion:

"They have a huge hit, and no money in the bank. Let's acquire them now, before they raise money, for relatively cheap, so we don't have to sink time and resources into developing a clone ourselves."

Too bad it looks like this theory didn't pan out.

</comment></comment></comment><comment><USER23> There are too many people commenting on Techcrunch that are almost rooting for Zynga to fail and/or finding it amusing -- there are a still good number of people working at Zynga (with families and livelihoods at stake) and I hope they can right the ship and figure this out.

<comment><USER24> I'm pretty mixed. I have friends working there, but I think Zynga is a blight on humanity. I feel the same way about casinos and tobacco companies: they are essentially exploitative. So I hope that their ships all sink, but that the people working there get in lifeboats and land on some wholesome shore.

</comment></comment><comment><USER25> Is there anywhere a list of investors who called Zynga a "big deal" two-three years earlier?

<comment><USER26> We could just look at the investors who put significant sums in. Crunchbase has a list: <http://www.crunchbase.com/company/zynga>

To be fair to them all, it reads like a who's who of the VC world from Brad Feld and Reid Hoffman through to Andreessen Horowitz, Softbank, and Union Square Ventures. I'm not sure any blame could be laid at their doors though, it was an exciting and high growth company and that's exactly what they tend to invest in (and what gets celebrated the most around here on HN.. growth > profits, a "startup" isn't really a startup unless it's growing fast and all that, etc.)

<comment><USER27> Which is exactly why this is an appropriate place for introspection and even harsh criticism of what has happened. Two years ago people calling this event would have been "haters" - and because of the difficulties of forecasting, it was reasonable at least to say "we'll wait and see."

But now we've seen. The question is whether we will treat this as a freak accident purely unique to Zynga, or learn something from it. First, though, we need to allow that discussion rather than just saying "just make your own company if you think Zynga was bad." Really?

</comment></comment></comment><comment><USER22> I deleted DrawSomething from all my devices and we stopped playing it the day OMGPOP was purchased by Zynga...

I vote with my appstore.

<comment><USER4> More people stopped playing because they got bored. The fickleness of the public is the real danger in games like these, not the idealism of a few (which is a tragedy, as the latter would likely lead to much better games)

<comment><USER28> Is it really fickleness? Even hardcore games have a relatively short shelf- life. The only real exceptions are games like WoW which have been able to maintain some staying power.

For nearly everyone else all the money is made in the first few months after which it disappears into the bargain bin. It seems like social gaming is no different.

<comment><USER29> Longer-term successes do occur(Minecraft, the Sims, League of Legends are some of the biggest ones from the past decade or so) but the industry tends to quietly ignore them because they don't fit well into established models and formulas. The "blockbuster hit" model itself is a legacy of games being intertwined with the early-adopter consumer tech business, and has lately been challenged by an array of slower-growth stories that are essentially community-oriented service businesses.

<comment><USER30> You're talking about the wrong gaming space. You're talking PC. On the mobile side things are just as fickle (things go in and out of fashion,) but there are mainstream long-term successes: "Angry Birds" being the first among them.

</comment></comment></comment></comment></comment><comment><USER31> Wow. I thought Zynga just shut down its other studios to focus on mobile. Now they shut down one of their mobile studios?

<comment><USER8> OMGPOP was only about Draw Something, which faded as fast as it grew. Zynga's mobile focus needs to be around making its most popular games more mobile, or building new "mobile-first" games. Aside from Words with Friends, their most popular games like Farmville have failed to get popular on mobile. Why not? Mark Pincus would like to know, too.

</comment></comment><comment><USER20> That developer who opted out is looking like a genius right now.

<comment><USER32> not really. he lost out on severance.

<comment><USER33> ...but would've worked at Zynga for more than a year to get three months of severance.

<comment><USER34> Shrug, it's not like he wouldn't get paid for it.

I have no idea just _how_ miserable it would have been working at Zynga, but working for a year in order to get three month's of severance doesn't sound too awful to me.

<comment><USER32> I worked at Zynga for a year + some months. It's actually a good place to work. You learn a ton about social / viral games and monetization, make really good contacts, get paid at or above market salary, eat really good food, and get all the other startup perks. And, you're still doing game development so it's not like your skills don't transfer.

I don't regret working there at all. I just wish the stock hadn't of tanked and the game I was working on hadn't of been a failure =P

<comment><USER30> What successful game did you end up copying?

</comment></comment></comment></comment></comment></comment><comment><USER11> Zynga could possibly turn it all around if they achieve their goal of bringing real-world currency to their gambling games in the US and on facebook. That is a very tough road to navigate though given the current US climate regarding gambling. Globally though it might be an option to rebuild the company.

</comment><comment><USER35> I never understood this acquisition in the first place. I was surprised to learn that OMGPOP actually did produce more than one game[1], but I had previously only heard of Draw Something, which my wife and her facebook chums had already grown bored of by the time Zynga came knocking last year.

Forgive my naivety, but don't these things have to get past a board of shareholders with a public company like Zynga? This isn't just a hindsight- is-20/20 kind of thing; IIRC the general consensus at the time was that it was a risky, ill-advised acquisition for a potential one-hit-wonder company.

[1]<https://en.wikipedia.org/wiki/List_of_games_on_Omgpop>

<comment><USER19> Not really sure what your point is here... are you questioning the initial acquisition of OMGPOP by Zynga or what Zynga decided to do with OMGPOP after the acquisition? The former has already been discussed at length and is a dead horse. Now is the time to discuss the latter.

</comment></comment><comment><USER36> So that one who didn't want to move to the new employer was really the one holding the company together!

<comment><USER37> Are you referencing this: <https://news.ycombinator.com/item?id=3760583>

</comment></comment><comment><USER38> Did any OMGPOP employees have stock options vesting still from the acquisition, or was it all cash?

If they did have stock options, did they immediately vest upon termination or did they lose them?

</comment><comment><USER39> It seems like a lot of their employees had the wool pulled over their eyes.

An acquaintance of mine who worked for Zynga up until a few days ago spoke fondly of her position and the company's prospects. I issued her a warning months ago. I think it just goes to show just because you have kids/mortgage/bills, etc you should always evaluate who you are working for.

</comment><comment><USER40> Does anyone know the specific tax implications of a write-down of a bad acquisition? In this case and in HP's case it's truly hard to believe that the assets acquired are that severely depressed and I would like to know how this affects taxpayers via reduced taxed obligations of the acquirer.

</comment><comment><USER41> Makes Shay Pierce's decision look sane:

[http://www.gamasutra.com/view/news/167244/Turning_down_Zynga...](http://www.gamasutra.com/view/news/167244/Turning_down_Zynga_Why_I_opted_out_of_the_210M_Omgpop_buy.php)

</comment><comment><USER42> How big of $200M price tag for OMGPOP are bonuses and earn outs?

</comment><comment><USER43> The article just says OMGPOP is being shut down. Does that mean forward development is ending, or apps like Draw Something will also be shuttered?

Does anyone know?

</comment><comment><USER44> How does laying off workers equate to shutting down a business. Am I missing something?

</comment><comment><USER45> I guess I'll have to get to work on the Draw My Thing-type browser game I'd been working on a while ago now if OMGPop's going. Me and some friends liked that game a lot.

My implementation used javascript, php, and canvas, but I'm considering learning ASP.NET by making this with it. Any thoughts?

</comment><comment><USER46> Lots of drama about this! I guess that goes along with being high profile.

<comment><USER20> I lost respect for them when they began blatantly duplicating the hard work and ingenuity of indie developers just to make a few extra bucks. Why bother thinking when someone else has done it for them?

I uninstalled all Zynga games and blocked all FB entries as soon as I found out this was a common pattern for them. I also shared that knowledge with my largely non-techie social network so they could see the kind of company they were supporting.

</comment></comment><comment><USER47> Congratulations to OMGPOP for pulling this Hudini act off :)

Cha-chin!</comment>


Lax Bans Uber and Lyft - <AUTHOR> https://www.theverge.com/2019/10/4/20898596/lax-uber-lyft-ban-pickup-terminal <comment><USER2> > _Meanwhile, Uber and Lyft have tweaked their apps for drivers in the hopes > of making drop-offs and pickups more seamless. Both companies have added a > feature called rematch that allows drivers who have just dropped off a > passenger to pick up a new customer without leaving the airport and waiting > in an off-site area._

Interesting, didn't know.</comment>


AMD Zen Microarchitecture: Dual Schedulers, Micro-Op Cache and Memory Hierarchy - <AUTHOR> http://www.anandtech.com/show/10578/amd-zen-microarchitecture-dual-schedulers-micro-op-cache-memory-hierarchy-revealed <comment><USER2> SEV (Secure Encrypted Virtualization, [1]) is a hugely interesting feature that will be available with Zen. Once it's mature and perfected, it would allow you to securely run a VM in the cloud that is protected against someone who controls the hypervisor. And you'd also be able to attest that indeed you're running in such a protected VM.

How do you protect against someone controlling the hypervisor? Read the paper. But the high level is to encrypt memory using keys that cannot leave the processor and are only available to a specific VM ASID (Address Space Identifier), assisted by a secure firmware similar to the Secure Enclave. Attestation uses an on-chip certificate signed by an AMD master key during fabrication.

There were some discussions on this on the linux-kernel mailing list [2]. As I understand it, the current generation of SEV is still somewhat leaky, but there's no fundamental reason why those leaks cannot be closed.

[1] [http://amd-dev.wpengine.netdna- cdn.com/wordpress/media/2013/...](http://amd-dev.wpengine.netdna- cdn.com/wordpress/media/2013/12/AMD_Memory_Encryption_Whitepaper_v7-Public.pdf) [2] [http://www.mail-archive.com/linux- firstname.lastname@example.com/msg025...](http://www.mail-archive.com/linux- email@example.com/msg02578.html)

<comment><USER3> In addition to cloud VMs, I wonder what applications this might have on local systems. Systems that boot from encrypted partitions and can't have the keys recovered by cold boot attacks? Secure graphics acceleration of different guests in a Qubes system? etc.

<comment><USER4> DRM and keeping the user from rooting their PC. This is like MS/Intel Trusted Computing on steroids.

<comment><USER5> AMD has had a on-die management CPU (dubbed the PSP - Platform Security Processor) for years now, similar to the Intel ME, this is something completely different. Memory encryption doesn't prevent you from doing anything with your device, as far as userland is aware they still have access to the full address space with no knowledge encryption is happening - the only difference is memory _IS_ encrypted so even if you manage to freeze memory to preserve the charge it will be useless as soon as it is removed from the host machine or it is rebooted.

<comment><USER6> > Memory encryption doesn't prevent you from doing anything with your device, > as far as userland is aware they still have access to the full address space > with no knowledge encryption is happening

It depends what you mean by "userland". The purpose of SEV is to allow a guest VM (using hardware virtualization) to run without trusting the host, including remote attestation. Traditionally hardware virtualization is used to run a full operating system which was installed at the impetus of the user, but there is no rule that it can only be used for that. If this feature is enabled on desktop parts, it's equally possible for black box DRM software running, say, on a non-virtualized Windows system, to include a small unikernel and automatically set it up to run in SEV mode. The whitepaper proposes that people running VMs in the cloud use remote attestation to upload disk encryption keys such that the VM can only decrypt the disk if it hasn't been tampered with, but the 'cloudiness' could just as well go the other way: cloud DRM servers sending decryption keys, for both video and perhaps the code itself, to enclaves on desktop PCs.

Using SEV alone for DRM would have a significant limitation compared to using the PSP: since all interaction with the outside world is still through the host, it would be hard to prevent the host from grabbing the raw decrypted video data as it leaves. But this still prevents recovering the original bitstream; allows 'perfect' obfuscation of many facets of how exactly the code works; and could probably be used in combination with the PSP in some manner. And in some DRM applications, the ability to grab the output may not matter. Imagine a video game where the bulk of the game was inside an enclave, preventing piracy but also all reverse engineering and modding.

Of course, a video service or video game that only runs on AMD CPUs won't get very popular... but conveniently, Intel is coming out with their own feature, SGX, that provides similar capabilities, though with a different design (it's designed more directly for the DRM use case). One might imagine that eventually most systems will have CPUs that support one or the other.

<comment><USER4> > since all interaction with the outside world is still through the host, it > would be hard to prevent the host from grabbing the raw decrypted video data > as it leaves

Wasn't this part already paved earlier by Microsoft, when Hollywood wanted to guarantee no unencrypted HD video leaves the PC? It might have weaknesses but the principle is already estabilished.

A secure crypto path from black box VMs to smart TVs also leaves the door open for all kinds of nasty scenarios involving TV pwnage. You also will have no way of decrypting the data that the VM exfiltrates from your PC.

</comment></comment></comment></comment></comment></comment><comment><USER7> I've been recently reading reports from some of my banking friends (and actually chatted with some folks I know at AMD) because I'm curious about AMD's turnaround. Even just last year AMD looked to be in very dire straights, and are still operating at a loss.

However, they seem to have a strong technical pipeline and they have historically punched above their weight-class. Does it look like they are going to make it?

<comment><USER8> The issue is the long lag time between new ideas being implemented at a design level, and the many iterations of fabbing and tweaking that need to take place before it can actually be sold. The majority of people in tech are too used to something being written in the morning and deployed in the afternoon to understand what it is like having a 3-month lag in your testing cycle, and minimum twice that till release.

Just like Intel had the P4 hole that it had to drag its way out of, so now AMD has had Bulldozer. Notice how Intel has been quite conservative with each individual tick/tock, trying to keep their pipeline full. Doing crazy changes risks causing a pipeline stall which could last years. Each new architecture is risky, and AMD screwed up with Bulldozer. From early signs it looks like Zen is a winner, hopefully AMD can stick with it for a while.

<comment><USER9> I think bulldozer was just ahead of its time. I am fortunate to have one, and it has aged a lot better than the same-price alternatives from Intel due to the more multithreaded nature of e.g. games nowadays. That's not much comfort for AMD, since being ahead of your time is just another way to fail, but at least AMD had vision.

Mankind Divided's recommended specs are FX-8350 or i7 3770. The price difference between the two in their heyday was $100 in AMD's favor.

<comment><USER10> price was always in AMD's favor. problem is more and more the energy consumption. also the i-series of intel was really really solid and good, at least until broadwell (didn't seen too much skylake yet). that especially lost amd a lot of ground in the server space. and a lot of "high end" gamer favored the Intel i7 series aswell, even when they weren't as cheap as amd.

<comment><USER9> The i7 was a _lot_ better for gaming than the 8350 was at the time. Hell, an i3 was better at the time. The 8350 was priced accordingly. There was no price advantage. What I'm saying is that AMD's design has aged a lot better.

<comment><USER10> AMD was cheaper (always) not better. You can be cheaper and worse and people will still buy the worse since it's cheaper even if price / quality on intel would've been better.

<comment><USER9> You obviously haven't actually checked the prices.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> Not having a unified L3 cache is an interesting choice, I can see how it would significantly reduce the cost of the chip and considering many multi-threaded workloads are operating on separate chunks of data chances are it shouldn't incur a noticeable performance penalty (especially in virtualization workloads, I'm interested to see what their 32-core server chip ends up looking like).

<comment><USER11> On the other hand an unified (inclusive) L3 cache helps with maintaining cache coherency, which need to be explicitly handled in a non-unified design.

I guess a big benefit of the separate caches is that if only half cores are in use, you can power half of it down, saving power and TDP.

<comment><USER12> A unified L3 is expensive in a number of ways. It is large, which means it is geographically remote, as well as slow (for caches, big == slow). This costs lots of access latency.

It also has a bandwidth problem. If 64 threads are vying for access, you either build it with few access ports and it gets choked, or you build it with many access ports which is costly in area, power, & speed.

Two separate peer caches automatically have twice the bandwidth of one similar double-size cache, for the price of NUMA & cache coherency challenges.

There is no one right answer here. Bandwidth is far more important and coherency much easier in a small L1; as you go down the hierarchy, bandwidth needs shrink and coherency is more expensive.

<comment><USER13> I remember a rumour about a HPC-APU from AMD which would combine 16 Zen cores with a Vega GPU and HBM (High Bandwith Memory) as a L4 cache. I know a L4 cache would be much slower than a L3 cache, but I'm curious, could HBM as a L4 cache be one of the reasons why they didn't use a unified L3 cache?

Disclaimer: I don't know sh*t about hardware design as you can probably guess from my posting. ;o)

<comment><USER5> L4 cache is more used as embedded memory for the on-die GPU, last I checked Intel only included their eDRAM L4 cache on Iris Pro equipped model as any on- die GPU worth its salt is going to be bandwidth constrained even with a relatively low amount of GPU cores.

Same situation with Zen, if they're going to include even a Polaris it would be highly memory constrained if it had to hit system RAM all the time, so another fat chunk of memory on-die will be necessary to not starve it and keep latency down (as it stands the RX 480 can pump 256GB/s).

<comment><USER13> Yeah, the bandwith problem is already noticeable with AMD's current APU's even though they use small GPU cores compared to discrete grapics cards. Faster DDR3/4 memory brings noticeable FPS improvements. If they already had HBM they would run circles around Intel (which they probably already do unless the competitor is a Iris Pro with eDRAM).

Could the CPU also profit from the HBM memory? The bandwith is much better than with DDR4 main memory (even if it is 2 or 4 channels), and I would guess the latency as well because it would be on the same die?

<comment><USER5> HBM won't be on-die, but it will be on-package - HBM relies on chip stacking to get the desired throughput in a small surface area, regardless the latency and throughput would stomp system DRAM something awful, and if it's a proper L4 cache then the CPU would benefit as well.

IBM does something similar (though not for graphics) in recent POWER CPU's with the Centaur memory controller(s), they are off-chip memory controllers with a bunch of eDRAM to act as a L4 cache (though the difference here is each system has multiple centaur controllers to handle different DIMM slots). They're able to burst to ~96GB/sec to _system_ memory using this, having a good amount of on-package HBM would probably yield similar gains :)

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> The timeframe is slightly disappointing since I think a lot of people were expecting Q3/Q4 2016.

The architecture itself sounds pretty much like what everyone was expecting, a traditional fat and wide core. Their power management and foundry process will probably make the difference as to whether final performance is impressive or not, may also be the cause of the delay.

<comment><USER13> AMD stated for a while (march or so) that they maybe have small shipments in december, but the bulk of shipments will realy only start in Q1 2017.

Anyway, the first benchmark is promising, and I hope Zen can also keep up with Broadwell performance in other benchmarks/workloads, as well as in power efficency.

</comment></comment><comment><USER15> As someone who is fascinated by articles like this one, but doesn't have a background in CE/EE, any recommendations for literature/classes I could take so that I can better understand the topics being discussed?

<comment><USER14> A computer architecture class. For books, [1] is what you will probably use in any decent computer architecture class, and [2] is a good read from a more general audience perspective, if a bit dated.

1\. [https://www.amazon.com/Computer-Architecture-Fifth- Quantitat...](https://www.amazon.com/Computer-Architecture-Fifth-Quantitative- Approach/dp/012383872X/ref=sr_1_1?ie=UTF8&qid=1471536721&sr=8-1&keywords=hennessy+and+patterson)

2\. [https://www.amazon.com/Inside-Machine-Introduction- Microproc...](https://www.amazon.com/Inside-Machine-Introduction- Microprocessors- Architecture/dp/1593276680/ref=sr_1_1?ie=UTF8&qid=1471536789&sr=8-1&keywords=inside+the+machine)

<comment><USER16> I would argue that this is the best: [https://www.amazon.com/dp/B00HCLUL5O/ref=dp-kindle- redirect?...](https://www.amazon.com/dp/B00HCLUL5O/ref=dp-kindle- redirect?_encoding=UTF8&btkr=1)

Albeit, slightly older and _very_ technical.

</comment></comment></comment><comment> mark-r I've been a big booster of AMD for a long time, but recently the performance/power is so much in Intel's favor that I've been forced to use Intel for my last couple of PCs. I hope Zen makes them competitive again.

</comment><comment><USER17> The most important thing for me. Zen cores have the AMD equivalent of Intel AMT ? (I don't remember the name).

If it haves it, I would avoid it like a pest, and get an FX-8370 or 8350 to replace my now aging FX-4100. The last thing that I like to have on my computer is a hidden uncontrollable CPU doing things that could affect to my privacy.

<comment><USER18> Unfortunately, it seems impossible to acquire a modern x86/x64 chip without such hidden firmware. The last Intel CPUs without it are from 2008, and the last AMD CPUs without it are from 2013.

If you can tolerate using a different CPU architecture, Raptor Engineering's Talos Secure Workstation looks very intriguing. [https://www.raptorengineering.com/TALOS/prerelease.php](https://www.raptorengineering.com/TALOS/prerelease.php)

<comment><USER19> >last Intel CPUs without it are from 2008

and those have cpu wide ring0 escalation bug [https://www.blackhat.com/docs/us-15/materials/us-15-Domas- Th...](https://www.blackhat.com/docs/us-15/materials/us-15-Domas-The-Memory- Sinkhole-Unleashing-An-x86-Design-Flaw-Allowing-Universal-Privilege- Escalation.pdf)

</comment></comment></comment><comment><USER20> I just wish AMD made drivers for Win 7 as well - then I could switch from 4-core 4790k/32GB to 8-core ZEN/64GB ECC and keep using all the Adobe video editing stuff.

<comment><USER21> Citation needed. There would have been a huge stink if AMD had stopped supporting Windows 7 already.

<comment><USER20> [http://techreport.com/news/29611/win10-will-be-the-only- wind...](http://techreport.com/news/29611/win10-will-be-the-only-windows- supported-on-next-gen-hardware)

<comment><USER22> The article states that it only applies to new CPUs/APUs. I also vaguely remember that Intel's doing the same as well

<comment><USER20> > only applies to new CPUs/APUs

i.e. Zen

</comment></comment></comment></comment></comment><comment><USER23> Should I wait for Zen or buy i7 now?

<comment><USER24> Depends on what you have and how urgently you need the greater speed.

My main system is still running a i7-2600 from over 5 years ago. That GTX 680 I have in there is still plenty fast. The upgrade question is: how pretty do I want Star Citizen to be?

<comment><USER23> I would like to build a PC that would compile stuff quickly... Android, Java, Spring/Hibernate, some Rust and JS recently. Currently takes a few minutes to build any of my projects on a laptop I have. I think more physical cores will boost it more?

<comment><USER25> First question, does that laptop have a SSD? Most developer machines do these days, that's the single biggest improvement to build times you can make. Then look at CPU, IO, memory utilization during builds to see where improvements can be had.

<comment><USER23> Yes, it comes with top fastest SSD and fast RAM.

<comment><USER24> Is that an NVME SSD or SATA SSD? NVME is about 4 times faster than SATA in terms of pure transfer bandwidth, though I'm not sure about random access speeds.

<comment><USER20> NVMe makes sense only if you are either pushing bandwidth limits (e.g. processing large RAW 14-bit 4K/8K video on a scratch drive) or have hundreds of threads with concurrent I/O operations. In real world, you are barely going to notice any difference between SATA2 and SATA3 SSDs, not to mention M.2 PCIe ones.

<comment><USER26> With SATA2 you might as well just use a HDD. Of course I'm assuming you actually optimized how your data is layout on the storage medium to take advantage of the sequential read speed of your HDD, SSD or even RAM. Even my HDD usually reaches 160MB/s so a SATA2 connected SSD is only twice as fast at four to six times the cost. Yes SSDs are better at IOPS but an application that heavily depends on IOPS is often a result of poor design.

[http://media.bestofmicro.com/Q/0/378072/original/AS- SSD_Sequ...](http://media.bestofmicro.com/Q/0/378072/original/AS- SSD_Sequential.png)

<comment><USER20> For real-world reaching speeds of 250MB/s while having significantly reduced latency comparing to HDD as well as read/write IOPS >60k is what gives you the snappy feel of SSDs. If you are unlucky and have e.g. Sandisk G25 SSDs with write IOPS in 10k range, you'd barely notice any difference to a fast HDD. But if you even get an SSD in a USB stick like Sandisk Extreme 64GB with reasonable IOPS, you can install OS X/Linux/Windows there and it would give you that snappy feel. Bandwidth beyond certain threshold is not what is giving you the snappiness. If you take NVMe that reaches 3000MB/s comparing to SATA3 with 550MB/s, booting time reduces by like 1s - would you really want to pay 2x price when that is the only benefit you'd notice? Or starting your app would take 0.63s instead of 0.67s?

Seriously, invest into NVMe if you are video producer (I can't imagine processing my 4K movies on SATA SSD or HDD, even 24fps playback on SATA SSD can't happen in RAW format as it needs >1MB/s) or you do some heavy I/O server stuff. If you don't do any of the above, invest your $ into capacity instead, i.e. given 512GB NVMe vs 1TB M.2 SATA I'd go with 1TB one.

<comment><USER27> > [4K movie] 24fps playback [...] in RAW format [...] needs > 1 MB/s

Actually, much more than that. 3840 * 2160 * 3 bytes * 24 Hz = 569.53125 mebibytes / second

<comment><USER20> 4K CINE 14-bit 24fps RAW - 4096 * 2160 * 5.25 bytes * 24Hz = 1063.125MiB ;-) I should have written >1GB/s in the previous comment :-D

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Am I the only person whom the Zen logo makes cringe? They shouldn't copycat Intel Inside logo there. Really bad taste...

<comment><USER28> It's not copying the Intel Inside log, although I'll agree they look _similar_ its most likely based off of the Ensō[0], which is part of _Zen_ Buddhism.

[0] [https://en.wikipedia.org/wiki/Ens%C5%8D](https://en.wikipedia.org/wiki/Ens%C5%8D)</comment></comment>


Here are the Massachusetts police department using license plate scanners - <AUTHOR> https://www.muckrock.com/news/archives/2013/apr/10/license-plate-scanners-use-across-massachusetts/

<comment><USER2> Very interesting article, but the title of this submission is highly misleading. Of the 53 departments queried, about 1/2 do not use scanners.

<comment><AUTHOR> Yikes, sorry I definitely did not mean every department is using ALPR, meant this is a list of every department using. Fixed headline, thanks.</comment></comment>


Electronics-recycling innovator going to prison for trying extend computer lives - <AUTHOR> http://www.latimes.com/business/technology/la-fi-tn-microsoft-copyright-20180426-story.html <comment><USER2> Several recent discussions about this:

[https://news.ycombinator.com/item?id=16924587](https://news.ycombinator.com/item?id=16924587) \- 87 points/6 days ago/11 comments

[https://news.ycombinator.com/item?id=16921634](https://news.ycombinator.com/item?id=16921634) \- 390 points/6 days ago/262 comments

[https://news.ycombinator.com/item?id=16940722](https://news.ycombinator.com/item?id=16940722) \- 72 points/4 days ago/22 comments

</comment><comment><USER3> Its quite clear to anyone with even an passing understanding of copyright and to anyone with even a basic moral compass that what this fraudster did was not illegal or right and he paid the price. A few techcrunch articles will not change this understanding.

</comment><comment><USER4> This should be in the news and front page of every tech site.

Whenever I bring up the abusive legal behaviour of these big companies or how inherently flawed IP laws are, people either shrug it off or treat me as if I was wearing a tinfoil-hat.

<comment><USER5> I'm wondering if this is government overzealousness, not something Microsoft particularly cared about (aside from their lawyer perhaps carelessly chiming in). Government has a lot invested in this prosecution: they set up a sting, some prosecutor's reputation is probably on the line.

It very much reminds me of the Aarton Swartz case (whose life was destroyed by Carmen Ortiz).

Anyway, the article is light on details.

<comment><USER6> Microsoft could have disavowed any claims. Said that the CDs were worth nothing. But they didn't, so they're just as much at fault as the prosecutors are.

<comment><USER7> Why did he spend tens of thousands of dollars creating discs that had no value?

The courts found that MS sell these discs for $25. They mulitplied that by the number of discs he sold. They did it that way, rather than using the price he sold them at, because he had done such a good job of forging them and the law then uses the value or the infringed, not infringing, item.

(I don't think he should be in prison for this).

<comment><USER6> > Why did he spend tens of thousands of dollars creating discs that had no > value?

I guess because he cares about encouraging reuse?

> The courts found that MS sell these discs for $25.

But according to the article, those $25 CDs come with licenses. And his didn't.

<comment><USER7> The court documents explain this.

[https://blogs.microsoft.com/uploads/prod/sites/5/2018/04/FIN...](https://blogs.microsoft.com/uploads/prod/sites/5/2018/04/FINAL- FILED-BRIEF-11.17.17-004.pdf)

> McGloin also testified about "certificate[s] of authenticity" (DE:145:45). A > certificate of authenticity, or a "COA," is a paper-based label that > "contains security features, much like a bank note or [a] passport that is > adhered to [stuck to] a device" (DE:145:45). During the conspiracy period, > COAs typically contained a "product key" that could be used to activate the > Microsoft OS software and verify the authenticity of the software license > (DE:145:47). Importantly, however, an end user who purchased a computer with > pre-loaded Microsoft OS software would not need the product key to activate > the software (DE:145:47-48). This is because Microsoft allows devices sold > by large OEMs like Dell to "bypass activation,"which means that an end user > can start operating the computer without having to enter a product key > (DE:145:48 ("COURT: So, if somebody bought a Dell laptop, and got it home, > they plug it in and operate it? McGLOIN: Yes. COURT: And the end user does > nothing else?McGLOIN: Correct. It gives the end user a nice experience, it > works. THE COURT: It works.")).

> What this creates, McGloin noted, is something called an "unconsumed" > product key—i.e., a product key that goes unused, so to speak, because an > end user never has had to enter it into the system, and hence Microsoft has > not registered the use of that key as an "activation event" (DE:145:50-54). > This "unconsumed" product key exists in "around 98 percent" of cases, > McGloin testified, where the software was pre-installed by the OEM; there > has not been a hardware failure; the end-user has not had to enter the > product key; and Microsoft has not registered the use of that product key as > an activation event (DE:145:50-54). In light of the vast number of > unconsumed product keys,it is "very common,"McGloin explained, for computer > refurbishers unlawfully to remove COAs with unconsumed product keys from one > device and stick them on another device as away to grant a Microsoft > software license impermissibly to an otherwise unlicensed device > (DE:145:51). Indeed, there "is quite a large market for obtaining product > keys from other devices and reselling them through a particular market, on > Ebay or other means," because they "[can] be used . . . in the refurbished > market as a genuine license" (DE:145:81-82). And, as relevant here, these > unconsumed product keys canbe used unlawfully to activate and use pirated > versions of Microsoft OS Software like the Microsoft OS software contained > on Lundgren's counterfeit Reinstallation Disc

<comment><USER6> How does that relate to Lundgren's case? Did he somehow use unconsumed product keys? Or encourage computer refurbishers to switch COAs from one device to another?

I don't trust the court documents, in any case. Because it's based on opinions of biased experts.

<comment><USER7> The court documents explain Lundgren's points (these discs are free, they still require a licence) and the prosecution's points, and why the courts agreed with the prosecution.

<comment><USER6> Are you claiming that the court actually understood what he'd done? That's not what I get from the article.

Edit: See the top comments at [https://news.ycombinator.com/item?id=16921634](https://news.ycombinator.com/item?id=16921634) The court clearly didn't understand that he was providing restore disks, which would not work unless the user already had a license key.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Appalling. Anyone planning on buying Microsoft products or stick will hopefully pause and consider this case beforehand. Gsuite works nicely as an office replacement.

</comment><comment><USER9> Since when do we send snake-oil salesmen to prison? There must be more to this story.

<comment><USER10> Selling a DVD for 0.25USD is hardly snake oil.

Perhaps you are confusing him with the official from Microsoft who testified that the discs were equivalent to the 25USD discs sold by Microsoft.

<comment><USER7> He wasn't selling the discs for $0.25. He was selling most of them for $3 or $4, and a small number of them for $30 and $40.

</comment></comment></comment><comment><USER11> _> I got in the way of their agenda," Lundgren said, "this profit model that's way more profitable than I could ever be._

Yeah, Microsoft "changed so much for the better".</comment>


An Open Letter to ECMA - <AUTHOR> https://medium.com/@richardeng/an-open-letter-to-ecma-cb60ee917da9 <comment><AUTHOR> Before everybody jumps the gun, this article is a piece of _satire_. It's meant to be funny. It's meant to _entertain you_ , as well as inform you. Please take it in the spirit in which it was written. Enjoy.</comment>


Why aren't Cubans, Quebecois, Saudis, Syrians allowed in Google Code Jam - <AUTHOR> http://code.google.com/codejam/faq.html#registration

<comment><USER2> Quebec has weird laws about competitions.

(<http://www.advertisinglawyer.ca/advertising.htm>)

([http://business.financialpost.com/2011/09/08/why-many- contes...](http://business.financialpost.com/2011/09/08/why-many-contests- exclude-quebec-residents/))

<comment><USER3> I was humorously assuming it was because almost all programming languages have key words in English.

The Imp of the Recursive in my head was imagining an alternate programming culture like a Quebec version of steam-punk.

<comment><USER4> You're not too far off. Companies have to, with growing size, do more and more stuff in french. At large companies that aren't exempt you must have a french keyboard for example and code comments have to be in french.

<comment><USER5> I live in Quebec and worked in big organizations, even public ones like the Governement and a city, and never ever heard that. Source please?

<comment><USER6> [http://en.wikipedia.org/wiki/Francization#Francization_in_Qu...](http://en.wikipedia.org/wiki/Francization#Francization_in_Quebec)

Any large company should have a policy document which states the absurd rules including installation of French software versions and use of French keyboards, hiring and e-mail policies. I believe the policies only apply to businesses with over 50 employees so you would not have encountered them in the public sector.

</comment></comment></comment></comment></comment><comment><USER7> OK I'm a Cuban programmer and can tell you this measure sucks big time, if the blocked government wants anything from Google Code, Sourceforge or any other "restricted" place they have mirrors, nice people on other unblocked countries willing to help and as last resource a tor proxy will do. So this measure only asserts read-only access, nothing else. Actually US goverment looks stupid when do things like this, you can't stop software to spread all over the world it's nonsense.

Anyway I prefer Github, Google is not the cool company they used to be, now most of their products look like stripped-down copies of others.

#ifndef HUMOR

#def HUMOR

I think we on the "Evil Axis" should have our own code hosting platform.

Possible URL: <http://evilhub.com>

I'm thinking in projects like:

ak47-assembler

missile-launcher

dropbomb

spy-detector

nuclear-cad

whitehouse-boom-boom

familyguy-downloader (we love stewie too)

#endif

<comment><USER8> Dude, you made my day. I'm pretty fascinated by my Gringo stereotypes of Cuba colliding with a programmer on HN.

I'm picturing a guy with a laptop, palm trees in the background, lots of antique cars driving on the street behind him, a brass band somewhere nearby, a pork sandwich on a plate. Please, please be wearing a Che/Fidel hat.

In all seriousness, I'm curious about the internet situation there. How's the bandwidth these days?

<comment><USER7> You missed the "Havana Club" rum bottle and a mulatta. ;)

Well, the internet access is a delicate topic, lots of schools have it, government offices, but not much civilians yet, they say is coming soon, but the problem is they fear technology (old people mostly), they see it as a possible way of US Gov. and Miami oppositors to take control of our minds or whatever.

Old people have fears, they have their reasons, young people have ideas, we want to push forward. And is like that, some get tired of waiting for a change and go away to a more tech-savvy place, but is not an option for everyone.

The bandwith is better than 5 years ago and improving, it's not wideband but we can live with that.

Anyway, it sucks to have studied IT Engineering (so far, thousands of us [http://en.wikipedia.org/wiki/University_of_Information_Scien...](http://en.wikipedia.org/wiki/University_of_Information_Science)) to end up setting up printers and not creating awesome stuff, people in charge have no faith in knowledge products.

I realized a big truth reading Peopleware: The "Spanish Theory of Value" is killing us.

</comment></comment></comment><comment><USER9> As a fellow french speaking Quebecer, this is because of the "Régie des alcools, des courses et des jeux", the main office regulating alcool, races and gambling.

In our legislation, if you are making a contest with the intent of giving away more than CAD$2000, you must get a licence from them[1]. Many companies just don't want to get their head in this.

The main reasoning behind this is to keep track of the contests and make sure that no one is trying to scam you.

[1] [http://www.canlii.org/en/qc/laws/regu/rrq- c-l-6-r-6/latest/r...](http://www.canlii.org/en/qc/laws/regu/rrq- c-l-6-r-6/latest/rrq-c-l-6-r-6.html)

<comment><USER5> Exactly! As simple as that! This is why we are always (almost) excluded from any contests :)

<comment><USER10> But we smoke Cuban cigars - legally ;)

</comment></comment></comment><comment><USER11> USA corporations, including Google, have restrictions on paying money to residents of certain countries such as Cuba and Syria. Tough luck.

</comment><comment><USER12> _or anywhere that the contest is prohibited by law._

That's probably why.

</comment><comment><USER13> > The Contest is void in Cuba, Quebec, Saudi Arabia and Syria > and where > prohibited by law. Individuals and entities > restricted by applicable > export controls and sanctions > programs are ineligible to participate in > the Contest

Some could perhaps be explained by export restrictions on crypto code, although I would expect to see some other countries (Iran) banned if that were the case.

Quebec has rather stringent data privacy laws - perhaps these are not compatible with Google's personal data storage policy.

<comment><USER14> Quebec's case is rather their laws regarding contests, lotteries etc.

Basically any contest from outside Canada won't give a damn about working all of those rules in (if it's even possible at all), so they are simply banned from essentially all international competitions of this kind :)

<comment><USER15> Since the competition is being held by a company outside of Quebec, do they need to abide to these laws at all?

<comment><USER16> Probably, because Google has a Canadian subsidiary with offices in Montreal; they're subject to local law. If this wasn't the case they'd gladly not exclude Quebecois.

<comment><USER17> Why are we just making stuff up?

This is not true. Contests must abide by any local laws or regulations in any jurisdiction they're run in. If you don't run the contest in Quebec (e.g. if you disallow Quebecois entrants) then and only then are you exempt from their laws.

<comment><USER16> We're not making stuff up. If I run a competition and someone from Belgium enters (and wins) but I have no presence in Belgium, I'm in no way subject to Belgian laws. How can I possibly be? Google doesn't have offices in Venezuela, Colombia, Bolivia, Chile, or South Africa. I highly doubt they're complying with local laws regarding competitions in these jurisdictions!

Google are subject to Quebec's laws because they have offices there and a Canadian subsidiary. If these things weren't, they wouldn't have to abide by such laws. Even if Quebec said they had to, they wouldn't have jurisdiction.

<comment><USER18> I understand that this is something people don't get, but: yes, if you are doing something that can be construed as "doing business" in a country, then you get to be subject to that country's laws regardless of whether you have offices there or have ever set foot on that country's territory.

This is not particularly new. What is new is the general belief I've seen in many people that "but I did it on the internet!" is a magical answer.

<comment><USER16> Such laws would be really, really difficult, if not impossible to enforce.

I seem to remember there are certain laws the British government thinks applies to foreign companies that have no ties to the UK but otherwise do business with British residents, but in the same breath says they have no way to enforce them.

<comment><USER18> Enforcement's not so terribly hard. Look at the US campaign against online gambling; when they want to crack down, they can cut off the flow of money to customers in the US.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER19> Those crazy Quebecois are going to use the knowledge learned to nuke Toronto!

<comment><USER20> Ubisoft Montreal already has ;) [http://ca.ign.com/articles/2013/04/11/the- nostalgic-insanity...](http://ca.ign.com/articles/2013/04/11/the-nostalgic- insanity-of-far-cry-3-blood-dragon)

</comment></comment><comment><USER21> Another example of Quebec being a totalitarian regime. A bit different from some others in this world though. A place where one can increase funding for a language Gestapo, who fines restaurant owners who don't properly translate pasta in their menu, while cutting social spending. All for the benefit of the residents. Go Quebec!

<comment><USER22> Better post the French translation of this rant soon, or suffer the consequences :)

<comment><USER23> I'll do it for him:

"Viva Quebec!"

<comment><USER5> This is not french ;)</comment></comment></comment></comment>