Disney criticised for filming Mulan in China's Xinjiang province - abc-xyz https://www.bbc.com/news/world-54064654 <comment><AUTHOR> > Disney is under fire for shooting its new film Mulan in parts of China where > the government is accused of serious human rights abuses.

Because as we all know, if they'd shot it in any other province, the crimes against humanity basically aren't even happening!

<comment><USER2> There's a difference between not stopping genocide and giving money and recognition to the people conducting it. The actual point of the criticism is more nuanced than what you quoted:

> social media users noticed that in the credits Disney thanked a number of > government entities in Xinjiang, including the public security bureau in the > city of Turpan and the "publicity department of CPC Xinjiang Uyghur Autonomy > Region Committee".

<comment><USER3> > giving money and recognition to the people conducting it.

Isn't this basically all products that we buy at walmart though. What is the difference. I don't understand the nuance here.

<comment><USER2> I agree that western companies' decision to ignore human rights in favor of cheaper prices is a problem but it seems like an escalation to go from ignoring the issue to publicly supporting the organizations involved with the full knowledge that they use things like that both as part of their public defense and to gauge how much more they can get away with.

</comment></comment></comment></comment><comment><USER4> Did we need a live-action version of Mulan? What was wrong with the animated version (that is better in the live version)?

Edit: I might even have been excited about a new version of Mulan if not for the controversies surrounding it. It is a shame because it was one of my favourites as a child.

<comment><USER5> Did we need a live version of Lord of The Rings? What was wrong with the print version?

The original Mulan legend is good material as is the original movie. If the new movie had been any good we'd likely all be happy for it.

A Star Was Born has been re-made 4 times. The most recent is the highest rated. Pride and Prejudice has been made several times. I personally really enjoyed the mid 90s version. Mutiny on Bounty has been re-made more than once. I liked the 60s version over the 40s version. I liked the 2005 King Kong (and the 1933 King Kong)

There's nothing wrong with remaking. It's just disappointing when it's a bad remake.

<comment><USER6> I'll tag along: I liked the live action version of Aladdin a lot more than the animated.

<comment><USER4> I enjoyed the Aladdin stage play, though TBH it's not my favourite play I've been to in recent years. Would settle for any play right now.

</comment></comment></comment></comment><comment><USER7> On the one hand I'm glad they're deciding to give work to Chinese locals, they could have picked a better place though.

</comment><comment><USER8> This is manufactured outrage, once again.

Nothing wrong with filming in any part of China, but when people want to find something to pick on they find something to pick on.

<comment><USER9> I'll stick to my outrage of the casts' attitudes towards Hong Kong and the outrageous $30 _rental_ rate. I think that's more than enough, though this particular story certainly doesn't change my mind.

<comment><USER8> The $30 rental rate is not 'outrageous'. It's a commercial decision, perhaps an experiment, taking into account the current special circumstances: How much is a family willing to pay to see this in a cinema? It's more than $30 in total, so as they cannot do or decide not to go, let's then watch this movie for actually less than that but more than for a movie that is passed in release date. The 'market' will decide.

As for the cast, well they are Chinese and may not have the same opinion as the 'correct' opinion broadcast on Western media. I think this is not outrageous. This just shows that people in different countries see things differently. In this case I think that taking note and understanding Chinese people views on Chinese issues is more productive than being outraged.

<comment> john-shaffer In 1861, would "taking note and understanding Confederate people views on Confederate issues" have been more productive?

You can justify absolutely anything if you try hard enough. It's harder to justify the policies of a racist, genocidal government like the CCP, but calling them "Chinese issues" seems to work for some.

<comment><USER8> If you think you example is equivalent, or just even sensible, then you really need to pause and understand Chinese history before passing judgement.

In fact these attacks and insults by foreigners who know nothing about the subject matter is one the thing that makes Chinese public opinion very firm when it comes to issues like HK (a symbol of foreign aggression) and the riots there, which is what the cast of the movie commented on.

The riots were not defensible, but indeed you can justify anything if you try hard enough.</comment></comment></comment></comment></comment>


"One Hundred Years Hence": Victorians predicting future technological wonders - <AUTHOR> http://www.ephemerasociety.org/blog/?p=6228 <comment><USER2> I'd be interested in seeing a list of how each of these was achieved, not achieved, kinda achieved, or other (based on a major misconception?).

For example, for the first series:

Aerial navigation: achieved, but not as convenient and ubiquitous as suggested

City Improvements up to date: not achieved, although it's possible to move individual homes and buildings at great expense, and you can buy deliberately- portable ones for certain uses

Shopping made easy — moving sidewalks: achieved, but not as convenient and ubiquitous as suggested

Summer excursions to the North Pole: marginally achieved, but not regularly commercially available; also, the image's notion of "North Pole" seems to be "inhabited Arctic regions" which are not, in fact, the North Pole

Concert and Opera at Home: achieved (and how!)

No more Droughts. Rainmaking machines at work: not achieved (unreliable and expensive rainmaking technology doesn't prevent droughts)

Dispensing with Bridge and ferry: marginally achieved, but not convenient or popular for most purposes; [http://hydrobikes.com/](http://hydrobikes.com/) is really awesome but still expensive and most people don't have somewhere to store one, and other waterwalking apparatus is generally in the same boat (if you'll pardon the pun)

New uses for Roentgen rays: achieved (!!), though not all forms are routinely available for civilian law enforcement use

Roofed cities, fine weather insured: not achieved

Submarine Excursions: achieved, but much less convenient and ubiquitous than suggested

Cruisers evading an enemy: not achieved, but see [https://en.wikipedia.org/wiki/DUKW](https://en.wikipedia.org/wiki/DUKW) (on a much smaller scale)

It would be neat to see this kind of analysis for all of the other sets they've collected.

<comment><USER3> If I think of the scale of our buildings, combined with the protection of automobiles, I feel like we've sort of achieved roofed cities.

You can drive your car from your garage to underground parking at your enormous Apple spaceship campus where you work, eat, and exercise under one roof. Then you can drive to the mall where you work, shop, and watch movies under one roof. Then you drive home. You're never exposed to the rain.

Obviously this doesn't apply to most people but shopping malls is what got me thinking.

<comment><USER4> With the aid of a guidebook ("Cities without Ground", ISBN 1935935321) I have crossed central Hong Kong on foot, above street level, from rail station to mall to office and hotel and residential building and been under cover the whole distance. Similarly I've walked underground in Taipei and Tokyo for kilometers, surfacing entirely out of choice for a glimpse of sky, to remind myself this isn't Trantor after all.

These are cities where it is a common experience to arrive at the airport, take the train into town, and never leave cover for the whole duration of a stay.

It may not all the be same roof, but the permanently covered urban life is a reality today.

<comment><USER5> +1 for comparing to Trantor rather than Coruscant

</comment></comment></comment></comment><comment><USER6> Aside from the main theme of what has / hasn't been realised technologically, I also find it a fascinating lesson in how society has changed, that these drawings almost exclusively feature families and extended groups of people engaging with modern inventions together.

In contrast, a huge proportion of modern advertising, especially for consumer technology products, depicts an individual interacting alone. It's not just the funny tech predictions, nor just the quaint clothing, that provide for anachronism and sober reflection in this collection.

</comment><comment><USER7> Very interestig.

Though, let's not forget, these things probably weren't drawn by the smartest people in the world. Many of them might look silly not because they were drawn long ago, or because it's so impossible to predict the future, but because they were created by an artist at an ad agency, not a scientist or an engineer.

Right now, the future predicted by Eliezer Yudkowsky, Sam Altman, or Elon Musk would probably be very different, and much more accurate, than the future drawn for a magazine by an artist.

</comment><comment><USER8> They missed it by 50 years, but sure, people will be summering in the North Pole in no time.

</comment><comment><USER9> I enjoyed this but found the word "Victorian" in the title (it appears once in the article too) odd since I have only used that term to refer to mid-end 19th century UK & Empire. This article had a wider and more interesting scope.

<comment><USER10> Queen Victoria died in 1901 and most of the empire was still part of the empire by then.

<comment><USER9> That's true but Belgium, Germany, USA etc which are most of the presentation were not "victorian".

</comment></comment></comment><comment><USER11> Typically, when people think about the future, they think about what they're doing today and how technology could transform that.

But when predicting the future, you need to figure out what we won't do anymore because of technology.

</comment><comment><USER12> Nice. I hadn't seen the US ones before. The French series, "En L'An 2000", is well-known, and Wikimedia Commons has most of those cards at high resolution.

</comment><comment><USER13> We've achieved a lot of things they couldn't possibly imagine. Here's hoping we achieve things in 100 yrs we can't even dream of today.

<comment><USER14> [http://europe.newsweek.com/command-control-donald-trump- nucl...](http://europe.newsweek.com/command-control-donald-trump-nuclear- weapons-492743)

"Why any one of these incidents hasn't ended in a mass disaster is "pure luck," Schlosser says in the film. "And the problem with luck is it eventually runs out." Think about your laptop or car, he suggests. "Nuclear weapons are machines," he says. "And every machine ever invented eventually goes wrong.""

[http://thebulletin.org/press-release/doomsday-clock-hands- re...](http://thebulletin.org/press-release/doomsday-clock-hands-remain- unchanged-despite-iran-deal-and-paris-talks9122)

"Three minutes (to midnight) is too close. Far too close. We, the members of the Science and Security Board of the Bulletin of the Atomic Scientists,want to be clear about our decision not to move the hands of the Doomsday Clock in 2016: That decision is not good news, but an expression of dismay that world leaders continue to fail to focus their efforts and the world's attention on reducing the extreme danger posed by nuclear weapons and climate change. When we call these dangers existential, that is exactly what we mean: They threaten the very existence of civilization and therefore should be the first order of business for leaders who care about their constituents and their countries."

I have personally started to worry always more about the catastrophic software failures. At least here on HN there are people who react to my comments who typically haven't even heard about the concept of developing with the goal of the fault tolerance [https://en.wikipedia.org/wiki/Fault_tolerance](https://en.wikipedia.org/wiki/Fault_tolerance) advocating instead the beloved "fail early fail often" as the best default even when the topic is actually controlling the rockets(!)

[http://thebulletin.org/who-would-destroy- world10253](http://thebulletin.org/who-would-destroy-world10253)

" _An existential catastrophe could only happen once in our history._ This raises the stakes immensely, and it means that reacting to existential risks won't work. Humanity must anticipate such risks to avoid them."

<comment><USER15> Does "fail early fail often" necessarily lead to fault intolerance and non- robustness?

<comment><USER14> Had you read my link you'd know that "fault tolerant" means the system which continues to do its job even when some components of it already failed. The system designed to "fail early" simply fails by default. There's simply no attitude of "do as much of the work no matter how many components already failed" or "making my part failing as seldom as possible." Not the mention actually designing the active recovery process, the complete opposite of "fail early":

[https://www.youtube.com/watch?v=KgTs8ywKQsI](https://www.youtube.com/watch?v=KgTs8ywKQsI)

Compare that approach with the handling of the water in the Fukushima electrical generators, situated on the edge of the ocean.

But even with all the possible care, accidents do happen. Some possibility will remain unaccounted.

So the only good approach is to have so little nuclear weapons that the accidents, when they happen, and they surely will happen, still don't destroy the humanity. The goal must be "fault tolerance" on the civilization level.

Or there won't be any civilization left.

The same stands for handling the global warming.

</comment></comment></comment></comment><comment><USER16> Dispensing with Bridge and ferry seems like a step (no pun intended) backwards.

<comment><USER17> This was during the buildout of US city transportation infrastructure, including bridges, but still with compact commutes. So "I want to go just over there. I can see it. If the river was frozen I could easily walk it. Instead, time/expense/unpleasantness/hazard."

Modern equivalents might be "the door is right there... but I need to find parking", "I'm going half a mile to shop on the other side of this Appalachian hill... it's a half hour fast drive", "I'm going just across this bay... it's a two hour commute", "I'm taking public transit from point A to nearby B... but because of route topology and schedules, I'll travel 10 times as far, and take longer than if I could go direct, crawling". Fast automotive transportation has duck taped a lot of infrastructure gaps.

</comment></comment><comment><USER18> for all the foresight of technology, it strikes me most that the clothing would remain the same.</comment>


Rust Discovery, Or: How I Figure Things Out - <AUTHOR> http://carol-nichols.com/2015/05/10/rustc-discovery/

<comment><USER2> Nice find with the grammar mismatch! Thanks for showing your methods in depth. I also liked the intro bit about knowing how to delve into a system. Seems like hoisting the entire Rust compiler distribution into one brain would be uncomfortable; there's so much going on in there.

Tangentially, digital archaeology is fascinating. I want to see some kind of VR "Git Simulator 201X" for exploring history in 3D. Maybe render commits projected spatially by date and be able to zoom into the diffs? If it could pull down all the PR comments from GitHub and then annotate the graph/blames... well, it might be useful, or might be more distracting than productive. Maybe a project for some rainy winter...

<comment><USER3> Thanks! There's more grammar and reference work to be done, hint hint to anyone reading this and looking for something to do on Rust ;)

I'd love to be able to follow a chunk of code around visually, wherever it gets moved, play back the commits touching it... not sure how it'd work exactly, but I think you're onto something there :)

</comment></comment><comment><USER4> Dead comment by user bombless. Reposting so Carol gets to see the comment (since she asked specifically for additional ways to find information) in case she doesn't have show dead on.

>About the ‵mod′ keyword in ‵use′, if you ask it on IRC I'm sure many people including me would point you the relevant PR that was made around October. Nice article by the way.

<comment><USER3> Thank you, both of you! :)

</comment></comment><comment><USER5> This post is really great. Often when trying out a new ecosystem the longest part of the learning process isn't learning the language or tools themselves, but learning a process that works best for the language. This gives a lot of insight about how you approach Rust and the other tools in your toolbox.

<comment><USER3> Thank you! <3

</comment></comment><comment><USER6> Thanks so much for working on the grammar docs! This is much needed and very helpful, considering how quickly Rust's grammar has been evolving.

<comment><USER3> You're welcome! <3

</comment></comment><comment><USER7> Great write-up! (And great work).

A little surprised there's no mention of looking at the implementation (src/grammar/parswr-larl.y, eg line 308) -- perhaps in the next installment?

<comment><USER3> Yeah, I was going to get into the implementation when I was going to figure out what `path` should be, which was also when I decided the post was getting too long ;)

Note that src/grammar/parser-lalr.y is a reference grammar for testing [1] and the actual implementation is in src/libsyntax, afaik.

[1] - [https://github.com/rust-lang/rust/pull/21452](https://github.com/rust- lang/rust/pull/21452)

<comment><USER7> So, there's three "official" grammars for Rust? The one in the documentation, the reference grammar (that serves as documentation and testing) - and the actual grammar, used in the reference implementation? No wonder there are inconsistencies...

Sounds like paring it down to two: a reference/testing grammar that is well documented; perhaps written/maintained with a literate programming tool and the actual implementation is a good idea. Kill off the "only documentation" grammar and/or merge it with the larl-one.

<comment><USER8> I was also wondering why not autogenerating a "documentation" grammar out of the working code.

</comment></comment></comment></comment><comment><USER9> What is this stream of consciousness?

<comment><USER3> Welcome to my brain. Please use a coaster.</comment></comment>


Debian + dwm = Blazing fast experience - <AUTHOR> http://dwmx.ninja/blog/ninja-deliberation-release

<comment><USER2> This is a repost. Just because you took it down ~6 hours ago when nobody voted it doesn't change the fact that its a repost.

<comment><AUTHOR> True, it is. Keen eye you have there.</comment></comment>


IE11 breaks Google and own Outlook Web Access - <AUTHOR> http://www.theregister.co.uk/2013/10/21/internet_explorer_11_breaks_google_outlook_web_access/

<comment><USER2> I'm actually having quite a few problem with Google websites (specifically with Gmail) from Windows 8 Mobile as well...

How can a company be so "unlucky" with a browser?</comment>


To Flip or Build, that is The Question - <AUTHOR> http://foundread.com/2007/10/16/to-flip-or-build-that-is-the-question/ <comment><USER2> We dealt with this same question and one of the guys we called to talk about this said:

"When you're young, hitting a double is better than striking out, because you can then get drafted into the majors."

Nevertheless, you need to really just focus on product because if it's all just hype, you're likely going to not provide any value to the buyer later on anyway and that hurts your reputation too.

</comment><comment><USER3> the question is more like: do you sell your business as a startup? or do you sell a mature business? If you want quick cash then sell the startup; Or, build a buisness and sell for a lot of money.</comment>


Show HN: Minio – S3 Compatible Object Storage - <AUTHOR> https://github.com/minio/minio <comment><USER2> Hello HN,

Here is a bit more explanation about erasure code and bit-rot protection.

Minio along with being S3 compatible also protects data against hardware failures and silent data corruption using erasure code and checksums. You may lose roughly half the number ((N/2)-1) of drives and still be able to recover the data.

Minio uses Reed-Solomon code to stripe objects into N/2 data and N/2 parity blocks. This means that in a 12 drive setup, an object is striped across as 6 data and 6 parity blocks. You can lose as many as 5 drives (be it parity or data) and still reconstruct the data reliably from the remaining drives.

Minio also supports bit-rot detection transparently which works along with erasure code using high speed BLAKE2 - [https://github.com/minio/blake2b-simd](https://github.com/minio/blake2b-simd) hash based checksums.

</comment><comment><USER3> While I commend the developers of Minio for building what appears to be a functional S3-API-compatible system in Go Lang it seems to me to be missing the key thing that makes S3 a compelling object/data storage solution -- the _distributed_ part. Meaning, while I see that a Minio developer (y4m4b4) talks about erasure coding, something when talking about AWS/S3 normally refers to the way data is encoded and replicated across nodes to mitigate outright data loss as well as bit rot, their description states "You may lose roughly half the number of drives..." \-- "drives" not "systems" or "nodes". This appears to be a single node solution, or have I overlooked the documentation describing how to join nodes together into a cluster? The description given is much more akin to RAID, which is fine and useful for distributing data across disks connected to a single system.

I hope that this is just an early announcement of a thing that is going to mature into a fully distributed solution, or that it is made clear that this is like SQLite (Minio is to AWS/S3 as SQLite is to RDBMS systems [PostgreSQL, Oracle, etc.]) -- something intended to be smaller in scope and single node only. Leaving this fuzzy will lead to many people being confused and potentially someone depending on this system and later dealing with massive data loss when their drive or drives fail.

Could the developers of Minio please make a statement as to which direction they intending on going? Is this a single node S3-API compatible solution (which is valuable for a specific class of problems) or something that will eventually be designed to store data across 10s/100s/1000s of nodes geographically distributed all working together to maintain some degree of availability and data integrity?

What's Minio going to be when it grows up? a) S3Lite b) S3

</comment><comment><USER4> I tried minio and was really impressed with how easy it is to get started.

But I couldn't figure out how to scale it or make it reliable. Having my entire system depend on a single server not going down is a non-starter for me. Do you consider this use case in-scope?

I've been looking at Skylable instead. While setting it up is a little clunky, it's the only open source package I've found that explicitly supports replication across multiple datacenters - which is even more interesting to me than simply across servers within a data center.

<comment><USER5> For reliability, you could start another minio server process on a different machine and use "mc mirror" subcommand ([https://docs.minio.io/docs/minio- client-complete-guide#mirro...](https://docs.minio.io/docs/minio-client- complete-guide#mirror)) to asynchronously copy out data. In this release, one needs to run "mc mirror" periodically using cron(8) or an equivalent tool in their platform. We are looking at providing "-c" option to "mc mirror" subcommand, which performs continuous replication. i.e, there would be no need run it periodically.

Minio encourages micro-storage architecture and scalability is achieved by deploying many minio server instances.

Hope that helps.

Disclaimer: I work at Minio.

<comment><USER5> To clarify my previous reply, in a cloud environment, scalability and multi- tenancy is achieved by spawning many instances of minio server, one per tenant. We are also working on a distributed minio server at the moment.

<comment><USER4> Cool!

The continuous async replication feature you mention would be ideal, especially if it's setup so that I can use consul/etcd/... to automatically elect a "master". If you also added (1) a feature so that writes can be redirected to another instance, and (2) a feature so that I can direct SOME of my reads to a master (reads where I care about consistency), then you'd have a not too difficulty to implement - but also very powerful - distributed version of minio. Maybe something along those lines is what you are planning.

Many instances of minio makes a lot of sense to me, and it seems light weight enough (i.e. resources like memory) that it would work. The only deal-breaker feature which looked like it was missing was the ability to set a disk quota. In multi-tenant environments it's important to have resource limits for reliability reasons. I considered putting each minio instance in it's own ZFS volume to handle disk quotas, but I would have had to write a lot of glue code to make that work from a deployment perspective.

Great work on minio - it's the least painful to use S3 server implementation I've run across so far.

<comment><USER6> Good point @devplusops. Disk quota should be built into Minio. Will add it to the roadmap.

</comment></comment></comment></comment></comment><comment><USER7> Wow this looks interesting. Nice job team minio

<comment><USER2> Thanks @unknownhad</comment></comment>


How Taxes Distort Business - <AUTHOR> https://mises.org/blog/how-taxes-distort-business <comment><AUTHOR> tl;dr:

      1. Bizarre and byzantine legal entity structures.
      2. Capital structures that overwhelmingly favor debt over equity.
      3. Keeping cash overseas.
      4. Trafficking in tax losses, sort of.
      5. Creative transfer pricing.

</comment><comment><USER2> Simply tax corporations by taking a percentage of their total stock value. Done.</comment>


Elon Musk Promises a Truly Self-Driving Tesla in 2020 - <AUTHOR> https://www.wired.com/story/elon-musk-tesla-full-self-driving-2019-2020-promise/ <comment><USER2> Be interesting to see how government regulation keeps pace with these new technologies to make them common place in the future.</comment>


Ask HN: Is Google App Engine a good option for new startups with limited funds? - <AUTHOR> <comment><USER3> I've used App Engine a decent amount the past 8 years and I would say it's great for prototyping and quickly creating CRUD tools or simple services. But stop there, don't build a whole API that powers your app / service on top of App Engine. Having done exactly that, I feel that App Engine is being treated more and more like the unwanted step-child.

The more "adult" Cloud services are taking priority which is noticeable in the monitoring solutions and deploy tooling. I've seen bugs that you wouldn't expect in a production class service linger for months, requiring you to spend time working around them. And the CPU cost overhead of their heavily abstracted runtime is not dismissible if you compare running Docker instances in Kubernetes (Google Container Engine).

I really enjoy using GCP, the APIs and tools are much nicer than say AWS, and Google's offering has quickly caught up with competitors. I've just moved over to Docker instances which is ultimately cheaper, faster to deploy, more predictable, and more configurable.

</comment><comment><USER4> I've used GAE (Google App Engine) a fair bit myself too.

I think that new startups are well served by GAE for a couple reasons, with some caveats.

Easy deploys - you just upload a war file and you're done. Also, the versioning works pretty well, so you can have multiple versions of your app live at the same time and switch on the fly.

Access to message queues - those are actually very useful. You can send stuff off to queues fairly trivially and it'll get processed as needed with retry and timeout options.

The scaling advantages are overstated for startups - if you need unlimited horizontal scaling, either your app is horribly inefficient or you're already making enough money to write a simple scaling infrastructure.

The caveats are that the datastore is really nice (pretty much megastore), but if you use it, you'll have a hard time migrating to another service provider.

As for limited funds, GAE is actually fairly expensive as it's PaaS versus IaaS, but if you're a startup and speed is of the essence, it'll let you get something out there in front of consumers very quickly for very low up-front and fixed costs.

</comment><comment><USER5> There's a lot to like with AppEngine, but the support is showstopper for anything you can't afford to be down.

Outbound emails, for example, mysteriously quit working for a month straight until someone there admitted that the anti-spam dial was tuned incorrectly. There was no error back to the users indicating the emails were being trashed. [https://code.google.com/p/googleappengine/issues/detail?id=1...](https://code.google.com/p/googleappengine/issues/detail?id=12786)

You might check out the various lower cost plans that many providers offer to startups. Here's a few:

[https://www.digitalocean.com/hatch/](https://www.digitalocean.com/hatch/)

[https://cloud.google.com/developers/startups/](https://cloud.google.com/developers/startups/)

[https://azure.microsoft.com/en-us/pricing/member- offers/bizs...](https://azure.microsoft.com/en-us/pricing/member- offers/bizspark-startups/)

[https://aws.amazon.com/startups/](https://aws.amazon.com/startups/)

</comment><comment><USER6> I have used GAE a lot. They have improved tremendously over the last couple of years and have also extended their services. However, as noted on in the previous comments - support sucks.

Advantages:

\- Easy to set up.

\- Cheap to start (somewhat like Heroku). Especially the moment you start optimizing for performance it's easy to cut down on the funds needed each month.

\- Scalable. Google takes care of it.

\- As someone mentioned versioning. It works as easy as changing the YAML file.

\- Deployments are fast and painless.

\- Amazing cloud administration with beautiful and easy UI. Unified logs.

\- Ease of integration with other Google products and APIs.

Disadvantages:

\- Lack of proper support.

\- Documentation is sometimes lacking.

\- Lock-in. Oh man does it hurt if you want to move away from GAE.

\- For python for example, you can only used C based python modules.

\- HTTP request 30 seconds. 10mb limit. Datastore is I believe 1mb. Blobstore 50mb.

\- Gets expensive the moment apps become bigger (somewhat like Heroku).

I'd definitely wager where your app will be in a month, 3 months, six months and a year and see if GAE is a viable option. Think of API integrations as well.

<comment><USER7> Can you please elaborate on your support experiences? There's varying levels of support, all the way up to employing essentially dedicated SREs that have a shared application uptime responsibility with customers (CREs).

(Work on Google Cloud)

<comment><USER6> Hey, first of thank you for your hard work! Let me redefine my argument - <USER2> level of support is somewhat lacking.

To be fair - this was like year and a half ago. Two separate issues. The previous company I worked at was where the issues occurred. First issue was something related to the NDB. I do not exactly recall what happened, as it was right when I got there. I do recall people being whining about delayed replies and ended up re-deploying to another instance.

Second issue was a fee for a service we have not used (big data/query I believe)- it took a while for the support to reply(something along the lines of couple of business days - billing support btw) and after we got ahold of them we have spent a lot of time on the phone trying to figure things out and we were still charged for that month. It was not much, but we could have purchased the current silver package for that money.

After the company started selling more products we upgraded to Gold package which was excellent. That's about the time I left.

Another separate instance was when I was not allowed to create more apps (even though I deleted more than 6-7) and I had to make a request for my account to create more. That took couple of days as well.

I think I started using GAE around 2011 and since then I have only seen improvements :)

</comment></comment></comment><comment><USER8> It also depends on how comfortable your team is with managing your own infrastructure. If you're not strong on the DevOps side of things, then stick with a PaaS solution to get started (even if it's a bit more $$$), and look at cost efficiency later.

If you're comfy with running your own stack, then nothing really beats D/O, Vultr, Packet.Net (if you want bare-metal) to get started. With the number of self-hosted PaaS tools out there, you can easily replicate GAE on your own for a fraction of the cost, but you need to handle the Ops on your own.

It's ultimately about how fast you can get to market, and how well you deploy resources getting there. Frankly, there are times when paying a few hundred dollars per month to have the entire stack hosted and managed for you, is WAY cheaper and a better ROI than hiring people or adding to your dev workload.

In my experience, free credit programs are great, but only if you keep your tech portable enough to move over easily to someone else after they expire. A lot of these platforms offer APIs and services that are convenient, but they also create lock-ins that will force you to stick with a vendor who's cost- benefit drops after a certain point in time. At that stage, the decision you make will be between is it cheaper to refactor or to stick it out.

Hope this helps.

</comment><comment><USER9> At least not its datastore. It's extremely weird, hard to use correctly and nonstandard. You have to rewrite all of your data layer if you're going to move from it (or if Google will deprecate it, I think it will be quite soon).

I have very simple app there for personal use and I had lots of pain debugging it, and it still works on black magic. It's easy to rewrite that app from scratch because it's so small, but downloading data from datastore is extremely painful process involving browsing forums for third-party hacks. If you have more than few megabytes of data, I think you can't get it out at all.

Development tooling is also weird and glitchy.

</comment><comment><USER10> I have used AppEngine, off and on, for many years. The advantage is getting auto-scaling and robust data stores automatically. The disadvantage is some degree of technology lock-in and that you can host less expensively using a provider like OVH or DigitalOcean.

EDIT: another good thing about AppEngine is that the 'free tier' will let you run a low traffic site for free, or very inexpensively. IBM's Bluemix is another service with a generous free tier.

</comment><comment><USER11> MS bizspark may be worth looking into if you're short on funds.

<comment><USER12> I really appreciate the MS bizspark program.

</comment></comment><comment><USER13> On reducing cost on GAE while prototyping: [https://goo.gl/BLutaI](https://goo.gl/BLutaI)

GAE has flexible environment which has meant you can use stack of your choice which is unlike its previous versions.</comment>


World failing to meet all biodiversity goals, says UN - <AUTHOR> https://www.france24.com/en/20200916-un-biodiversity-report-countries-failing-to-meet-all-aichi-targets <comment><USER2> Isn't it astounding how much humanity has fucked the planet in like two centuries of industrialization?

Such a great outlook to have on life and I'm not even out of my 20s yet. Thanks, previous generations.</comment>


Performance recommendation: Do not use jQuery's hide() method. Ever - <AUTHOR> https://twitter.com/paul_irish/status/564443848613847040 <comment><USER2> _" What's interesting to me is that it doesn't seem to be taking up time in defaultDisplay – which is our internal method for handling the first edge case you've described – but rather the native getPropertyValue called in curCSS to retrieve the current display value. However, that is even more disconcerting because removing defaultDisplay won't solve this issue. It seems that retrieving computed CSS for all of those elements is the bottleneck, which is very unfortunate because that isn't unique to .show()/.hide(). Maybe someone else could confirm what I'm seeing?"_

May not be .show() or .hide() that you should avoid, but instead a slow native call that the jQuery team might be able to point out to browser vendors... Or am I reading this incorrectly?</comment>


Show HN: A chat server with no client side scripts - <AUTHOR> http://wiby.me/chat <comment><USER2> I wanted to try this out, but it looks like it's no longer working. How do you know when others are talking if you don't have client side scripts to load data from the server?

<comment><AUTHOR> Hi, I opened it up again. Someone has to be available to moderate it when its opened to the public :)

There is only one way to do this and that is through the meta tag <meta http- equiv="refresh" content="2"> where 2 is the number of seconds to wait before refreshing.</comment></comment>


Show HN: Ritzy – Google Docs-like rich text editor - <AUTHOR> http://ritzyed.github.io/ritzy/ <comment><AUTHOR> I would like to introduce the open source Ritzy web-based rich text editor: [http://ritzyed.github.io/ritzy/](http://ritzyed.github.io/ritzy/). It is based on React [1] and SwarmJS [2] and primarily intended for embedding into applications to support rich text entry with real-time collaboration. Technically, it works similarly to Google Docs and eschews ContentEditable in favor of a custom javascript-based editor surface and layout engine [3]. As far as I know, this is the first open source implementation of this technique. Please see the project README and source code [4] for more details. Note that this is pretty new and hasn't seen any real-world testing/usage, so there are some known bugs [5] and likely lots of unknown ones as well.

Depending on interest, I am considering offering the editor as a software-as- a-service solution. Because it is intended for real-time collaboration, a server-side component is (currently) required. While a simple implementation is part of the open source project, a more complete commercial service could handle storage, communications, security, availability, and provide a simple but powerful API for developers. The API would allow interaction with client- side editors and the data they contain, including real-time server-side push updates as editor contents change. Please let me know if your company or startup may be interested in such a service.

      [1] https://facebook.github.io/react/
      [2] http://swarmjs.github.io/
      [3] http://googledrive.blogspot.ca/2010/05/whats-different-about-new-google-docs.html
      [4] https://github.com/ritzyed/ritzy
      [5] https://github.com/ritzyed/ritzy/issues

<comment> odeke-em Congrats on the release! Looks good!

</comment></comment><comment><AUTHOR> FYI: GitHub master updated to version 0.1.4, demo ([http://demo- ritzy.rhcloud.com/](http://demo-ritzy.rhcloud.com/)) updated to the same version. New DESIGN ([https://github.com/ritzyed/ritzy/blob/master/docs/DESIGN.ado...](https://github.com/ritzyed/ritzy/blob/master/docs/DESIGN.adoc)), INSTALLATION ([https://github.com/ritzyed/ritzy/blob/master/docs/INSTALLATI...](https://github.com/ritzyed/ritzy/blob/master/docs/INSTALLATION.adoc)), and API ([https://github.com/ritzyed/ritzy/blob/master/docs/API.adoc](https://github.com/ritzyed/ritzy/blob/master/docs/API.adoc)) docs. Demo has new controls that use the API. A bunch of bug fixes and improvements esp. around some more complex collaboration stuff e.g. operations that overlap with remote selections and cursors as one example.

</comment><comment><AUTHOR> A blog post introducing the project: [https://medium.com/@ramangupta/a-new- rich-text-editor-for-th...](https://medium.com/@ramangupta/a-new-rich-text- editor-for-the-web-with-real-time-collaboration-710ffdf6ee2c)</comment>


GOG offers 27 games for free to help pass the time - <AUTHOR> https://www.gog.com/partner/stay_at_home <comment><USER2> Lord of Midnight was a piece of art. A game of epic scale that managed to combine army-rallying and war strategy with adventuring and sneaking behind enemy lines.

It was also a product of a time when everything was possible and single-person would do everything from graphics to programming to writing (in this case a substantial novella). It seeps nostalgia from every pore.

Unfortunately it won't sit well with today's gamers. Not just because the low resolution graphics, but because it requires much patience and learning from own mistakes. The culture has long shifted to hand-guiding and "succeed on first try" mentality.

</comment><comment><USER3> FYI almost all of these games are usually free.

<comment><USER4> Making a couple games free to showcase a collection of 20 something already free games is nothing to complain about. GOG is reaching out to those in need during hard self isolating times.

It is a win for everyone, and in my books, GOG deserves our money.

</comment></comment><comment><USER5> Stargunner was a very nice R Type clone.</comment>


Show HN: Easily see and choose Adobe's Webfonts - <AUTHOR> http://peterchondesign.com/adobe-webfonts.html I got tired of looking at Adobe's Webfonts one by one, so I complied it to a list. <comment><USER2> This is pretty darn useful — thank you! Although it's sad that Adobe can't do anything this clean and simple: Every page they put up with jammed with marketing gibberish.

<comment><AUTHOR> I don't blame them - they are "for-profit" after all.

<comment><USER2> That's not it — good marketing communicates what you want to say — adobe is terrible at this. When I first read their web page I had no clue what it was about, I then had to come across an article on a blog that clearly explained it in one simple headline.

<comment><AUTHOR> I agree, I'm just saying that marketing department usually wants to throw as much tactical words at the users as possible.</comment></comment></comment></comment>


Democratic Party symbol has been changed to a rat within the Google search - <AUTHOR> https://www.bleepingcomputer.com/news/security/us-democratic-party-symbol-changed-to-a-rat-in-google-search/ <comment><USER2> The story doesn't mention that the logo came from a forum on a site called Armchair General. The logo was the start of a joke thread that announced the image as the new Democrat Party logo. Chances are that Google saw this site as being somewhat reputable/popular, found the image, used the phrasing as a signal, and noticed the post time. Those could have been enough points to automatically get the logo updated. At least that's my assumption so far, anyways.

</comment><comment><USER3> Likely the image was changed on Wikipedia and by pure chance Google was spidering the page during the time the altered image was active. If so, going through the image and page history on Wikipedia should point to when it happened.

<comment><AUTHOR> Interesting! It still hasn't been fixed.

<comment><USER4> Fixed now.

</comment></comment></comment><comment><USER5> Now if we could only manage the same thing with the GOP, but with a wooly mammoth...

</comment><comment><USER6> knowledge panel has been so consistently bad that it's a wonder people don't complain more. Half the time all I get is a random irrelevant excerpt from some website with all the formatting screwed up. If you're multilingual it'll show up as a random mix of two or three languages too.

</comment><comment><USER7> > since the image is not representative to the entity.

Arguably it is.

</comment><comment><USER8> I think Google AI is choosing a more appropriate animal, after reviewing the Democratic primary debates so far?</comment>


Intel platforms from 2008 onwards have a remotely exploitable security hole - <AUTHOR> https://semiaccurate.com/2017/05/01/remote-security-exploit-2008-intel-platforms/ <comment><USER3> _The short version is that every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME (Management Engine) not CPU firmware._

We knew this would happen. We knew that the Management Engine was a backdoor, and we knew it was only a matter of time before someone would figure out how to exploit it. This is exactly the reason why Libreboot exists ([https://libreboot.org/faq.html#intel](https://libreboot.org/faq.html#intel)). And now, far from being the tinfoil hat distro that is often portrayed, it will become a bare necessity.

<comment><USER4> Let's hope one of the other CPU manufacturers (e.g. AMD) starts supporting LibreBoot and allows to officially disable the ME-equivalent hardware feature, so that Intel get's forced by market-pressur to follow.

Intel needs more competition - thanks to AMD latest new 8-core CPU Intel got forced to release a new CPU the had in their basement for years - <USER2> it's possible for them to release i7 notebook CPUs with more then two cores!! Even back in 2010 it would have been viable to produce 4 core notebook CPUs - but the went away because the had no competition.

<comment><USER5> That was the top request in their March AMA:

[https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea...](https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_creators_of_athlon_radeon_and_other/?s)

I wouldn't hold my breath, though.

<comment><USER6> The sad thing with that is that

\- releasing the source doesn't tell you what's on the chip.

\- PSP is kind of "Ring ∞", so there would be no good outcome from providing general-purpose access to it. So, the keys will never be released.

\- it's thusly not possible to map the signed (encrypted) firmware to the source.

\- even if the source had a clearly documented "master off" in it, you can never know if the firmware's copy reads "master-except-if-A-and-B-say-C off" :(

</comment></comment></comment></comment><comment><USER7> > For obvious reasons we couldn't publish what we found

It's not obvious to me why anyone not under an NSL or NDA would sit on this vulnerability for 5 years and wait until it's actively being exploited in the wild before public disclosure.

It's extremely negligent to global security for SemiAccurate to not immediately publicly disclose the vulnerability 5 years ago after Intel refused to fix it. Of course this is ignoring the root of the problem, which is that the US government has deeply compromised Intel since the very first security management interfaces were added to Intel chips in the early 90s.

The real solution to the root issue is legislation that forces security disclose timelines of 90 days or less for government-found vulnerabilities, and prevents the stockpiling of vulnerability exploit kits.

<comment><USER8> It gets more confusing because Intel is crediting Maksim Malyutin from Embedi: [https://security- center.intel.com/advisory.aspx?intelid=INTE...](https://security- center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr)

 _Intel would like to thank Maksim Malyutin from Embedi for reporting this issue and working with us on coordinated disclosure._

<comment><USER9> I interpret that as SA got wind something like this was going down, guessed some of the details and possibly forced Intel to disclose but they didn't actually find anything themselves nor do they have the details. Which explains why Intel credits someone else and they overplayed their hand by claiming that either ME or VPro are breached when it really is AMT. (Bad enough...)

</comment></comment></comment><comment><USER10> Is there a better source for this than SemiAccurate? The article doesn't really have much beyond self-aggrandizement and "we can't tell you any details, but you're screwed". For something that could be anything from "Charlie Demerjian heard a rumor about a ME patch and wanted some pageviews" to the actual security apocalypse, I'd like credible sources.

<comment><USER11> Credibility issues of the author/website aside, I actually hope this is true, and I hope it's catastrophic for Intel.

Maybe then we'll finally see hardware companies taking security seriously.

<comment><USER12> IME is likely not a case of Intel "not taking security seriously". It's almost certainly a case of doing what FiveEyes demanded of them.

<comment><USER11> You're probably right.

I still hope it's true, and that it's catastrophic for Intel. No change can happen otherwise.

If Intel aren't fighting against 5eyes then they aren't taking security seriously.

</comment></comment></comment></comment><comment><USER13> >>every Intel platform with AMT, ISM, and SBT from Nehalem in 2008 to Kaby Lake in 2017 has a remotely exploitable security hole in the ME (Management Engine) not CPU firmware.

>>there is literally no Intel box made in the last 9+ years that isn't at risk

>>SemiAccurate has been begging Intel to fix this issue for literally years

Am I the only one who is so cynical to think it must have been deliberate? Intel dragging their feet for YEARS -- what could justify such a delay? The paranoid side of me asks "Were they waiting to patch this hole, until they found a different one that could be utilized?" Which begs the next quesion: Where is the NSA in all of this? It's the sort of thing that would be mighty handy to a group wishing to snoop on everyone and everything?

Last question: Why would anyone trust the encrypted management engine after this? (Why would anyone trust it before?)

>> What about embedded devices that are increasingly PC based? Digital signage perhaps? Industrial controls. HVAC. Security systems. Flight controls. Air traffic controls. Medical devices.

What, indeed? Is this the method used to interfere with Iran's nuclear program centrifuges?

<comment><USER14> Believe incompetence before malice, and I'd stick economic incentives somewhere in the middle.

The discussion probably went something like:

Person 1: "Should we issue a recall and disable a feature which bought us a several billion dollar customer?"

Person 2: ...

<comment><USER15> In this day and age the choice between malice and incompetence seems to fall more on the malice side.

</comment></comment></comment><comment><USER16> As a sysadmin at a Windows shop, I don't know what to make of this. Has Intel commented on this, yet? Any OEM?

Joanna Rutkowska, who _is_ a renowned security researcher, warned of something like this happening sooner or later[1], so I don't think I can afford to just ignore this.

But without something more specific to act on, there is nothing I _can_ do, except wait firmware updates to be released by various vendors. _If_ that happens.

And what if Intel does make a statement that essentially says, "This is all total BS"? I wouldn't know whether to believe them or not.

The only scenario where I could have any degree of certainty would be if Intel came out and said, "Yeah there's an exploitable security hole in ME, here's a patch to disable it".

[1] [http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf](http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf)

<comment><USER17> As pointed out by another commenter, Intel has released the advisary:

[https://security- center.intel.com/advisory.aspx?intelid=INTE...](https://security- center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr)

It confirms much of the SemiAccurate report, but also includes this:

"This vulnerability does not exist on Intel-based consumer PCs."

Which seems to differ from what SemiAccurate was saying. I'm not sure if it's SemiAccurate being... er... not completely accurate :D, or if it's Intel trying to downplay things.

I guess we'll find out more over the next few days/weeks.

<comment><USER18> Looking at the Intel link, they take you down a path to see if you have vPro. That's on some i5s and i7s. So they are defining "consumer" roughly as "purchased at best buy or similar". There are certainly desktops in people's homes that have vPro. Even some of the higher end NUCs have it.

<comment><USER19> Easier path: [https://ark.intel.com/#@Processors](https://ark.intel.com/#@Processors)

When I've purchased VirtualBox hosts, I've deliberately avoided stuff with vPro.

</comment></comment></comment></comment><comment><USER20> Zero details and zero cross references, zero mentions on Google and zero mentions in any security list I'm on. Charlie blowing nonsensical steam yet again?

<comment><USER21> The article implies that they have been privately trying to get Intel to fix it, so there is no reason it would have been mentioned publicly anywhere.

Now a patch is coming out but Intel is still trying to keep it quiet, so he's trying to warn people disable AMT and be ready to apply patches ASAP.

Presumably he didn't even want to disclose the existence of the vulnerability publicly until there was some sort of fix, and he still won't want to disclose details before the fix is released.

Of course, you can doubt the veracity of this story, but I'm just pointing out that there would be no reason to expect details, cross references, or mentions on Google or security lists yet if it is true.

<comment><USER10> If Charlie was a security researcher and SemiAccurate was a well-regarded security firm, I would not expect details or cross-references or mentions on security lists. Charlie is not a security researcher, he's a journalist, and SemiAccurate is the tech equivalent of a supermarket tabloid. He is not a credible primary source for anything security-related, particularly given SemiAccurate's reputation for publishing rumors as facts.

None of that means he's necessarily wrong, just that you should be very careful about believing his claims without supporting evidence. A lot of people here on HN have thought that a remote ME exploit was only a matter of time, so an article claiming to validate that belief will not get as much skepticism as it should.

<comment><USER6> FWIW, Intel published this: [https://security- center.intel.com/advisory.aspx?intelid=INTE...](https://security- center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr)

</comment></comment></comment></comment><comment><USER22> FTA, Intel confirms? [https://security- center.intel.com/advisory.aspx?intelid=INTE...](https://security- center.intel.com/advisory.aspx?intelid=INTEL-SA-00075&languageid=en-fr)

</comment><comment><USER23> I think it is high time for companies who make hardware be financially fined for lapses like this. In this particular case, the manufacturer was warned and did nothing for years.

This is negligence especially considering these chips control critical devices that can cause damage or even loss of life if they are successfully exploited.

Can you imagine if car maker didn't fix a hardware defect they knew for years. Oh wait...

</comment><comment><USER24> What is the motivation behind Management Engine?

From the perspective of an everyday user these things came out of nowhere to evolve into this para-computer running along side me that I cannot see and have no control of. It is on literally _ALL_ hardware

Why is it that any attempts to disable it knock your whole computer out?

And this is the world of technology that we want? I'm so sick of technology companies appearing to work for their customers but secretly working against them.

<comment><USER25> The functionality ME attempts to provide is lights out a.k.a. out-of-band management (like IPMI) to the desktop.

If, for example, an admin needed to add a dual-boot-to-Ubuntu option to every PC on a floor, he could, through ME, remotely reboot (force power reset if necessary) or power on every machine, have the machines boot to a (remote) OS install disk, run the install, and reboot.

ME allows one to do almost anything remotely to a PC, regardless of what the main processor is doing. That is both useful and frightening.

<comment><USER24> Fine, but putting it on _all_ hardware?

How many corporate IT environments buy off-the-shelf motherboards and CPUs from the same channels as consumers? OEMs get an entirely different set of parts and enterprise sales works in completely different channels. If there is such a clean separation between corporate and consumer markets then why is this hardware on _everything_ , and why does it need to pull power on the machine if it's disabled?

<comment><USER26> It isn't on all hardware. Intel has two ME firmwares, a small one for consumer systems, and a big one for corporate/enterprise systems. The small one does not (or at least, should not; is not supposed to) include the remote management features.

In other words, the separation that you describe exists.

Systems with the full firmware sport things such as the vPro branding, and only certain combinations of CPU and chipset support it.

<comment><USER18> I'd be careful with assumptions on what "consumer hardware" means. There are desktops, NUC units, etc, that shipped with i5 and i7 chips that had vPro.

<comment><USER26> Even with the CPU, you also need the right chipset and the right firmware to actually light this stuff up. While especially in the laptop sector there are consumer devices that include this, it's far from universal.

</comment></comment></comment></comment></comment></comment><comment> joatmon-snoo /r/netsec link: [https://www.reddit.com/r/netsec/comments/68lqzq/remote_secur...](https://www.reddit.com/r/netsec/comments/68lqzq/remote_security_exploit_in_all_2008_intel/?submit_url=https%3A%2F%2Fsemiaccurate.com%2F2017%2F05%2F01%2Fremote- security-exploit-2008-intel- platforms%2F&already_submitted=true&submit_title=Alleged+remotely+exploitable+vulnerability+in+Intel+AMT%2C+ISM%2C+and+SBT+since+2008)

</comment><comment><USER27>
       Security is a cost center and most OEMs run on margins too thin
       to bother with security patches even if they cared. Most simply don't care.

I think that sums up pretty well why downstream vendors are treating security casually. So the billion dollar question is, how do we fix this, as a tech community?

<comment><USER28> OEMs are not involved at all with ME afaik, it's exculusively controlled by Intel.

<comment><USER29> OEMs have to ship ME firmware updates; Intel has no way to get them to you directly.

<comment><USER30> Can't they install an update remotely via this vulnerability? :p

<comment><USER31> No joke, this would be the best thing for everyone. Especially if we find a way to do it ourselves rather than wait for a vendor to.

I've been thinking for years about writing a virus that patches the vulnerability it used to spread as it goes.

</comment></comment></comment></comment></comment><comment><USER32> Great news that this finally came to light.

After learning about remote management capabilities I've always suspected it had holes. Large attack surface, any exploit would have a high value, and closed source.

Perhaps one day we'll be able to buy CPU's without this "feature". I'm betting AMD and ARM are in the same boat.

<comment><USER33> > After learning about remote management capabilities I've always suspected it > had holes. Large attack surface, any exploit would have a high value, and > closed source.

Even after reading this, I'm still not convinced it does have holes. It's so high value (pervasive, incredibly powerful, and old) that if it were possible a bad actor _would have used it_. The spectrum of possibilities is small:

        1. The hole does not exist, but SemiAccurate thinks it does.
        2. It exists, but only SA has discovered it.
        3. SA discovered it along with a few bad actors, who are using it surreptitiously and haven't been caught.
        4. It's being used all over the place, it's a widely acknowledged security disaster.

We're not in state 4. The article suggests we're in 2 or 3. 2 seems unlikely - SA does not have special abilities that transcend those of other security research firms. 3 seems especially unlikely: with this much power available, and with the hole being patchable, could they resist using it? Which leaves option 1.

<comment><USER10> SemiAccurate isn't a security research firm, it's a tech news blog. There's basically no chance that they've discovered anything. If there's an exploit, they would've had to have heard about it from either a source inside Intel or an actual security researcher of some kind.

</comment></comment></comment><comment><USER34> "It is this last point that has been causing some political unrest in the US, and the rest of the Western world. As you undoubtedly know, China is very nearly the sole producer of all electronic goods. It would be very, very easy for the Chinese government to slip a hardware backdoor into the firmware of every iPad, smartphone, PC, and wireless router." 2012 [https://www.extremetech.com/computing/133773-rakshasa-the- ha...](https://www.extremetech.com/computing/133773-rakshasa-the-hardware- backdoor-that-china-could-embed-in-every-computer)

Made in China, designed in the USA. Everyone wants their own backdoor.

</comment><comment><USER35> Patching is going to be a nightmare considering that many OEMs drop support for a motherboard after 3 years. There will be unpatched systems floating around for a very, very long time.

</comment><comment><USER36> I've got a Lenovo T530 and a Lenovo T450s. I wonder if they've released a firmware update yet...?

I can't say I'm surprised, but I am surprised at the fact that finally, after all these years, someone finally got down to patching some vulnerabilities in this area.

props to whomever forced Intel's hand.

<comment><USER37> One nice feature of (some) Thinkpads is that the AMT and ME can be "permanently disabled" through the BIOS, presumably by blowing a fuse or similar. Check if yours has this capability.

Otherwise check for updates at [http://pcsupport.lenovo.com](http://pcsupport.lenovo.com).

<comment><USER38> Hopefully, someone can speak further to whether this is a real mitigation and what "permanently" and "disabled" really mean, in this specific context.

I'm don't mean to sound oppositional. I appreciate this being mentioned.

I'm just not willing to trust it without knowing in detail that and how it works.

</comment></comment></comment><comment><USER39> Can anyone add any details? The article is very very vague. Doesn't this work thru the Ethernet port in the chipset silicon?

So if you're running a desktop that has a physical Ethernet card in it, and the Intel Ethernet isn't connected, are you OK?

And if you're running on a laptop that uses Intel's Ethernet, (and most of them do?) then are you vulnerable?

</comment><comment><USER40> Worrying about the ME and my dislike of secure boot is what has kept me from upgrading beyond the Core 2 Duo with BIOS. It's starting to feel slow now, but I still don't feel I can upgrade unless there is at least a way to disable the ME. So far, there don't seem to be any reliable methods of doing so.

</comment><comment><USER41> Even without any newly discovered backdoor. The Intel ME was always a fu __ing security issue. A BACKDOOR. It is completely naive to think the NSA can 't use the ME to get access to anything, but hey it needs another Snowden for people to listen again.

</comment><comment><USER42> Intel ME always reminding me of the saying, "Absolute power corrupts absolutely."

</comment><comment><USER43> Relevant discussion:

[https://news.ycombinator.com/item?id=11913379](https://news.ycombinator.com/item?id=11913379)

<comment><USER44> "The Intel ME subsystem can take over your machine, can't be audited" \- OP's discussion's title

> _do the first three steps of thinking for them. Make it really easy for the > other person to say yes or no_

source: [http://firstround.com/review/how-to-become-insanely-well- con...](http://firstround.com/review/how-to-become-insanely-well-connected/) | [https://news.ycombinator.com/item?id=14195664](https://news.ycombinator.com/item?id=14195664)

I've agreed to include a bit of detail when spamming all my friends links via e-mail going forward.

</comment></comment><comment><USER45> For those who cannot switch to Libreboot, [https://github.com/corna/me_cleaner](https://github.com/corna/me_cleaner) may be a solution to this issue.

</comment><comment><USER46> What is the management engine, and how does one access it remotely?

<comment><USER47> it's a closed-source binary blob on intel chipsets with unfettered access to the CPU. it is also (often) directly connected to the RJ45 port.

here's a good overview of the risk: [http://hackaday.com/2016/11/28/neutralizing-intels- managemen...](http://hackaday.com/2016/11/28/neutralizing-intels-management- engine/)

<comment><USER46> So if you don't use the RJ45 port on the motherboard but instead use an RJ45 port on an expansion card instead you're safe?

<comment><USER48> Partially. Expansion cards use PCI-E which has DMA capability, so a bug/backdoor in their firmware can very well be used to attack a system.

But I believe newer systems with MMUs acting as "firewalls" for DMA are safe from this vector.

<comment><USER47> there's also the concern of physical attacks, via the motherboard's RJ45 or USB.

<comment><USER48> At least USB doesn't have device-initiated DMA, but USB descriptor parsing bugs have in the past led to exploits (I remember the PlayStation jailbreak).

</comment></comment></comment></comment></comment></comment><comment><USER49> Does this affect an Apple MacBook?

<comment><USER50> Assuming that what the author says is true and there is a local exploit for non-enterprise versions of the Intel ME, then yes.

</comment></comment><comment><USER51> It'll be interesting to see how Intel deals with it.

Looking at the recent Atom failures (with vendors told in no uncertain terms to present publicly as generic "timing component" failure), will they even admit it's an ME thing?

</comment><comment><USER52> The way this article is written leads me to believe that it is not entirely accurate.

</comment><comment><USER53> Now this less-mainstream theory about the precarious state of our communication systems has confirmed to a greater degree, would anyone here know of similar risks that few seem to be aware of right now?

I'm not sure if this would be considered OT, but considering the nature and scope of these vulnerabilities I don't consider it reasonable to exclude the possibility of intent and malice.

For this reason I'd like to ask: what do you consider to be "the next, most likely to surface, conspiracy of this flavor"?

The flavor being: "the struggle for control of any and all data and computational resources".

</comment><comment><USER54> I have a Sun workstation that seems to be no longer supported by Oracle (Sun Ultra 24 with a Q9300). I guess I'll just be vulnerable forever.

I don't really know what AMT does, but this has me thinking, if AMT is provisioned while a machine is used inside a company and then that machine shows up on eBay still provisioned, is it going to be phoning home and still be remotely manageable? How many of these machines have what are essentially persistent rootkits managed by large corporations that have had large fleets of laptops/desktops deployed that are then sold on?

</comment><comment><USER55> I'm a total n00b to how this stuff works, but I can't seem to find any information for this sort of stuff online. I have an Intel CPU with a Gigabyte Motherboard and BIOS. If I'm running Linux without a GUI (headless) is this something that I have to worry about? If so, how do I turn it off? I don't see any options for the Intel AMT or ME in my BIOS settings.

EDIT: I have a Core i3-4130T. Looks like it doesn't have vPro so I'm hoping I'm safe?

</comment><comment><USER56> My ignorance is showing, but what product lines are impacted?

Obviously things like Xeons and Core iXs, but what about things like Atom processors in tablets?

<comment> yjftsjthsd-h The post appears to claim that literally everything is affected, albeit probably only locally exploitable. I think that's what it means at least.

<comment><USER56> It claims that things with IME are (which I'm not sure if Atom has), and lists a series of architectures of which Atom isn't part. (Its architectures have different names.)

It's ambiguous if the Atom line (and which portions) might be impacted, and I would prefer someone comment directly on if Atom has ME and if so, if it was using the dangerous version (and when).

</comment></comment></comment><comment><USER57> Vulnerable as in how vulnerable? Do you need to be physically connected to local Ethernet for this? WiFi?

If it's WiFi that's damn scary.

</comment><comment><USER44> _Warning: Baseless, Idle Speculation_

With the lead time on the silent patch before Shadow Brokers published all the Microsoft exploits, I wonder if Shadow Brokers will be publishing this one soon. No chance of an Intel ME patch going out without being noticed though!

A Shadow Brokers release would be a real mess.

</comment><comment><USER58> Are remote management functions of portable consumer electronics (i.e.: remotely wiping your iPad) also supported by similar hardware chips from other vendors?

<comment><USER59> There is a laptop theft recovery/tracking software called LoJack for Laptops (AKA CompuTrace). Some laptop manufactures have added BIOS support for this service (Dell, HP, Lenovo, etc). According to the Wikipedia article [1] this BIOS service copies a downloader into the System32 folder on Windows, which then downloads the full service. It doesn't appear that the BIOS service itself is remotely exploitable, however it can be used for persistent root- kits [2].

[1] [https://en.wikipedia.org/wiki/LoJack_for_Laptops](https://en.wikipedia.org/wiki/LoJack_for_Laptops) [2] [https://en.wikipedia.org/wiki/LoJack_for_Laptops#Vulnerabili...](https://en.wikipedia.org/wiki/LoJack_for_Laptops#Vulnerabilities)

</comment></comment><comment><USER60> I've disabled ME on my PC because at some point LMS (Local Management Service) started consuming too much resources for no apparent reason.

<comment><USER61> How do you disable it? In the BIOS? Is it enabled by default?

<comment><USER60> I'm running Windows and I just disabled the service. There are a couple of them, one is Local Management Service and the other is User Notification Service.

<comment><USER62> ME is a separate chip running alongside main CPU. You can't disable it via Windows services :)

I recommend Platform Embedded Security Technology Revealed book [0] from designers and creators of ME for further information.

[0]: [https://link.springer.com/book/10.1007/978-1-4302-6572-6](https://link.springer.com/book/10.1007/978-1-4302-6572-6)

<comment><USER60> I stand corrected :)

</comment></comment></comment></comment></comment><comment><USER63> Site is throwing NET::ERR_CERT_AUTHORITY_INVALID on latest Chrome Canary, is anyone else seeing that?

<comment><USER64> StartCom is untrusted by Chrome these days.

</comment></comment><comment><USER65> So they (SemiAccurate) knew about this for years, and STILL haven't bothered with disclosure to force Intel's hand earlier?

Thank you, SemiAccurate, for sitting on a vulnerability for years when you could've reported on it long ago and not had us left with this garbage of a security hole to deal with.

</comment><comment><USER43> A back door is a back door is a back door.

Let's hope Intel and all the other chipmakers will learn this lesson (unless it's done on purpose, in which case they won't care about any lessons learned - they'll do it anyway).

</comment><comment><USER66> Is there an analog of this issue on AMD chips?

</comment><comment><USER67> I've always wondering why nobody seems to notice the fact that this site is literally called "Semi Accurate". I mean sure, everyone makes mistake and even the most credible news sources are not entirely accurate all the time. But what am I to think when your organization is literally named after being only half truthful?

<comment><USER68> It's a semiconductor news site.

<comment><USER67> Semiconductor Accurate? Doesn't really sound right grammatically, also the arrows missing the target in their logo lead me to believe half accurate was how they intended the name to be interpreted.

<comment><USER29> The name is a joke. The whole purpose of SemiAccurate is to report leaks and rumors and one can never expect such reporting to be fully accurate.</comment></comment></comment></comment>


Coping with discouragement - <AUTHOR> http://www.theliteraryplatform.com/2012/08/coping-with-discouragement/ <comment><USER2> This doesn't mention the distinction between criticism and discouragement. Damning, but valid criticism can sound a lot like the dismissive reactions in the article, if not phrased constructively. Sometimes crap is just crap and you're best off accepting it, figuring out why, and starting over.

I also try to avoid telling people about stuff I'm working on or have made if I don't expect them to be in a position where they can realistically give me a useful, actionable opinion. The stoic "I'll show them!" thing (for me) works in small quantities. But it can really wear you down over time, particularly from people you care about. Some people just don't seem to understand why you'd even bother to try with creative endeavours, let alone pour your life into them.</comment>


Entrepreneurs Are The New Labor - <AUTHOR> http://www.forbes.com/sites/venkateshrao/2012/09/03/entrepreneurs-are-the-new-labor-part-i

<comment><AUTHOR> Quote: As software eats the world, every sort of engineering (and indeed, every sort of profession organized along lines suggested by the physical sciences, including fields like medicine) is becoming effectively a branch of computer science.

This is sort of what I've been thinking for a long while that in essence (being able to write) software truly is the new literacy. In a sense scribes ("pure programmers" with no additional domain skills) are being also deprecated day by day.

</comment><comment><USER2> This is a very interesting read and the parallels here are indeed fascinating. I think one potential difference this time is the emergence of digital, decentralized currencies. If that trend continues, it will be more difficult for bankers to exert the same type of control they did in the gilded age without control over all of the capital.

</comment><comment><USER3> Previous discussion: [https://news.ycombinator.com/item?id=5648839](https://news.ycombinator.com/item?id=5648839)</comment>


This Call Is Being Recorded - <AUTHOR> http://shkspr.mobi/blog/2013/07/this-call-is-being-recorded/ <comment><USER2> From the link:

> _In the UK, it is perfectly legal for an individual to record their calls - > and there is no need to inform the other party nor obtain consent._

This is missing an important qualifier. In the UK it is legal to record a call without telling the other party _for your own use_. However, if you intend to make the call available to a third party, you _must_ have consent. You couldn't record a call without telling someone and then put it up on your blog, for example.

Other countries will and do vary!

<comment><USER3> "own use" \- does that include a business's own use?

For example, could my employees record some calls for each other's use within the business, or would that count as a third party, if those call recordings remained private to the company?

<comment><USER4> It seems to be standard practice to have a "calls may be recorded for training purposes" disclaimer these days. Some even say "please tell the operator straight away if you do not wish to be recorded".

This doesn't really tell you what's legal or not, but I would assume that the only reason they put that stuff in is because they have to.

<comment><USER5> They may just add the disclaimer because they find it makes customers behave better. I suspect that knowing you're being recorded may reduce the chance of you screaming abuse etc.

</comment></comment></comment></comment><comment><USER6> I've been wondering why this isn't standard already. I would love to have my phone record every call I make. It could store the raw audio, tag it with metadata about who was on the call, what time it occurred, and where I was. It could do speech to text asynchronously (if you store the raw audio forever, you could potentially get better transcripts as technology improves).

I would love it if Siri was paying attention to things said during the call. It could suggest calendar entries, notes, and reminders based on things said.

Then of course, all of the transcripts would be searchable via Spotlight or whatever indexing system one uses.

This reminds me that it annoys me that there are no useful actions available on iOS for working with voicemail. I often would love to forward a voicemail to email in order to delegate a task.

<comment><USER7> Yeah, having Siri or your equivalent voice assistant listen in during calls could be interesting. Reminds me of Jane from Children of the Mind.

There could potentially be major privacy issues, though.

<comment><USER6> I agree about the privacy issues. Siri as currently implemented requires sending data off to the Internet, which is one reason why I don't personally use it very much. One of the technical reasons that Siri itself can't do this currently is that on some providers it can't do data and voice concurrently on the GSM radio. I don't know how much of Siri could be done locally on the phone, but that can't be far off.

</comment></comment></comment><comment><USER8> This is a great app, but FYI there are a very limited number of phones that record the line audio. Most require it to record through the mic while on speakerphone mode.

Not Supported:

[http://www.grinzone-apps.com/1/post/2013/04/not-supported- de...](http://www.grinzone-apps.com/1/post/2013/04/not-supported-devices.html)

Tested (doesn't mean supported necessarily):

[http://www.grinzone-apps.com/1/post/2013/04/welcome-to- our-b...](http://www.grinzone-apps.com/1/post/2013/04/welcome-to-our-blog- support.html)

</comment><comment><USER9> I don't see why me recording calls for use in a criminal trial would be illegal, when the NSA or GCHQ doing it against me is perfectly fine.

</comment><comment><USER10> In the United States, rules about call recording vary a lot from state to state. Definitely check your local laws...

</comment><comment><USER11> I've been using InCall with the Nexus 4 for a while and it works well, except when using my car's bluetooth phone integration.

I wonder what the magic is though. How did they work around the problems with MediaRecorder.AudioSource.VOICE_CALL on most devices?

</comment><comment><USER12> And there I was, thinking this was going to be about the NSA. Isn't this fact implicit now?

<comment><USER13> Same here. I was expecting the whole "a call may only be recorded if two parties are aware, the recorder and the NSA"

<comment><USER14> It is. The grassroot NSA-YOUTH movement thrives on all these new snoop apps.

</comment></comment></comment><comment><USER15> Off topic, but does anyone else make all their calls through Google Voice and get the 'This call is now being recorded' message randomly during conversations?

It has spooked everyone who has been on the other end of the line when it occurs.

<comment><USER16> If you accidentally press 4 during a call, you'll get that

</comment></comment><comment><USER17> "More than that, for some people [that the call is being recorded] really improves their attitude and their service."

I'm interested in hearing in what ways a caller's attitude changes when they know a call is being recorded.

</comment><comment><USER18> With Google Voice, calls are routed through Google before they get to you IIRC.

With this in mind, would it be possible to route voice calls to a server in a jurisdiction where recording without consent is legal, have that server then connect to your phone and record both sides of the conversation.

i.e.: US phone line -> Recording Server Abroad -> US phone line

Also, does broadcasting count as recording? What if all calls are broadcast live (possibly encrypted) and then there is a server that is listening to all broadcasts on that frequency and records them?

</comment><comment><USER19> As someone mentioned below, Google Voice can do this natively if you press a button during a call. It alerts the person on the other end of the line and makes a recording available in your account following the call. Quite useful and works on any phone provided you're using GV.

</comment><comment><USER20> A lot of call centers will hang up if you tell them that the call is being recorded on your side.

</comment><comment><USER21> Given the storage size of the Black Star, _all_ calls worldwide are being recorded. Forever. "Just in case".

But ironically you can go to prison in many states in the USA if you record calls without the other party agreeing.

<comment><USER22> Only 12 states:

      * California
      * Connecticut
      * Florida
      * Hawaii (in general a one-party state, but requires two-party consent if the recording device is installed in a private place)
      * Illinois (debated, see next section)
      * Maryland
      * Massachusetts
      * Montana (requires notification only)
      * Nevada
      * New Hampshire
      * Pennsylvania
      * Washington

[https://en.wikipedia.org/wiki/Telephone_recording_laws#Unite...](https://en.wikipedia.org/wiki/Telephone_recording_laws#United_States)

</comment></comment><comment><USER23> I get a "This item is not available in your country' error when I try to install from the Play store, which is strange for a free app. Anyone else?

</comment><comment><USER24> I had this on my Treo. It was incredibly helpful, especially if you hate writing stuff down.

</comment><comment><USER25> Nice, but why that program asks for network access permission? Deal breaker for me.

<comment><USER7> In order to upload recordings to Dropbox.

</comment></comment><comment><USER26> i mean really? my ancient palm treo 600 could do this (and so much more newly rediscovered functionality of modern 'smart'phones.)

</comment><comment><USER27> Anyone know what the law is in Canada?</comment>