On CPU backdoors - Trusting hardware - <AUTHOR> http://theinvisiblethings.blogspot.com/2009/03/trusting-hardware.html <comment><USER2> This touches on what I think is one of the more interesting technological problems that we have to worry about right now. As a disclosure, most of the reason I think that is because I'm a PhD student doing research on hardware security. Anyways, there has been a lot of interesting discussion on the topic. DARPA has had at least two programs dedicated to trying to solve this problem, IRIS and TRUST [1]. Both of them seemed to be more interested in tampering by third-parties, perhaps because it's not in their best interest to accuse the people designing their ICs of attacking them.

In the long run, verifying the functionality and intentions of software and hardware are probably roughly the same problem, with no clear solution to either in the foreseeable future.

[1] <http://www.wired.com/dangerroom/2011/08/problem-from-hell/>

<comment><USER3> > In the long run, verifying the functionality and intentions of software and > hardware are probably roughly the same problem

Both require trusting the source code (a languages problem), as well as trusting the translator. In the case of software, the translator is an end- user accessible compiler/interpreter which is itself more software, thus recursively auditable.

In the case of hardware, the translator is an entire _institution_ , which can only be trusted if you have recourse against said institution. As an individual end-user (uber alles) can then never fully trust their hardware, it makes sense to draw a line in the sand and proceed from that assumption.

(and suuure, put a picture of a pic16f84, the chip that started the revolution of microcontroller DIY, at the top of an article on dodgy hardware..)

</comment></comment><comment><USER4> Indeed, a russian security specialist has proofs that there is a backdoor in Intel's virtualization technology: <http://www.xakep.ru/post/58104/> And here is the Google translated version of the article: [http://translate.google.com/translate?hl=en&ie=UTF8&...](http://translate.google.com/translate?hl=en&ie=UTF8&prev=_t&sl=ru&tl=en&u=http://www.xakep.ru/post/58104/)

<comment><USER5> That's pretty interesting - I wonder if there are any other people/companies who've delved into this matter?

</comment></comment><comment><USER6> DARPA and others are concernced about this exact scenario and are funding research into reverse-engineering chips to detect these types of backdoors. There are two parts this problem. One part is using electron microscopes and lasers and whatnot to go from silicon to a netlist of gates. The second part, which I'm a little more familiar with, is "decompiling" these gates into higher-level structures like ALUs and multipliers. The hope is that we can identify maybe 80% of the circuit to be good/recognized using purely algorithmic techniques and then a human can dig in and look through the remaining 20% for anything suspicious.

They do seem to be more concerned about chips the US buys from certain other countries than about the likes Intel/AMD building in backdoors.

EDIT: I should also mention that this is not just a concern of the american defence. I'm aware of the indian govt also funding this sort of research with similar motivation. However, in this instance, the professor was trying to attack the problem through the lens of formal techniques. I think the idea was to prove that if the chip interacts with the outside world through these limited set of channels then you can't sneak data out through some sort of covert channel hiding in the "regular" communication. The specific concern here was about routers/switches and the like equipment sneaking sensitive data out of a secure network.

<comment><USER7> Doesn't the government already make use of IBM's manufacturing capabilities for Top Secret+ chips to try and mitigate the risk of this scenario?

<comment><USER6> I'm not sure but I think you may be right because the researchers have been granted access to some IBM cell libraries. (I was wondering why IBM agreed to this, but this probably explains it.)

My understanding is that the main concern here are chips in COTS equipment bought from countries that are considered by some to be untrustworthy.

<comment><USER7> _I was wondering why IBM agreed to this_

Allegedly the government requiring a domestic fab for some chips is one of the biggest reasons IBM's fab remains funded.

All hearsay though.

</comment></comment></comment></comment><comment><USER8> 2009\. I'm surprised this hasn't been on HN before.

Related - <http://cm.bell-labs.com/who/ken/trust.html>

<comment><USER4> I just remembered another related case, the "Induc" virus which was infecting a library file from the Delphi distribution, and then every compiled program was infected. There were several pretty popular programs compiled on infected computers of the developers and spreaded by the world.

[http://delphi.about.com/od/humorandfun/f/w32-induc-a- delphi-...](http://delphi.about.com/od/humorandfun/f/w32-induc-a-delphi- virus.htm)

<https://www.f-secure.com/weblog/archives/00001752.html>

</comment></comment><comment><USER9> > So, if we buy a laptop from vendor X, that might be based in some not-fully- > democratic country

Like, say, the US...

<comment><USER10> I have no idea why this is getting downvoted. The current political climate in the US is fucking abysmal, and bears little resemblance to a representative democracy.

<comment><USER11> Probably because the comment didn't contribute to the discussion at hand and had a high troll potential. It's unfortunate that the author decided to throw that comment into the article because it is naive sounding and seems quite out of place there as well.

<comment><USER9> I suppose it doesn't open up much possibility for discussion afterward, but I wasn't intending to troll. I just think we need to remember that we don't have to imagine some undemocratic international threat to understand why these issues are important.

</comment></comment></comment></comment><comment><USER12> Never mind us. Why should Intel trust Intel? Like any good computing company, I would imagine they are mostly self-hosting. The chips they built last year are the chips they use to run simulations and design the chips they put out next year. Backdoors can be exploited by any employee who knows about them, and it would be extraordinarily damaging for Intel to allow backdoors into hardware they depend on.

Even if they built in some sort of a kill-switch, how could anyone confidently say that a rogue engineer involved in the design couldn't bypass it and use the chip against Intel. Ultimately, I think there's so much danger that I have to assume Intel is competent enough not to do something so foolish as introduce deliberate backdoors.

<comment><USER13> But there are SO many chipsets they put out. e.g. I have a Core 2 Duo system, but the exact chipset is T9400.

Intel could keep track of which chipsets are vulnerable and which are not, and carefully pick which kind gets released to who.

Obviously, Intel employees aware of the strategy would only use the invulnerable chipsets themselves.

</comment></comment><comment><USER14> I'm expecting someone to produce a fully open hardware stack sooner or later - there's already a freely available sparc processor design, and I recall some open-source people working on a fully open graphics card. (Of course you still have to trust your fab, but that's not very different from trusting your compiler).

<comment><USER15> how is trusting your fab any different than trusting Intel?

> that's not very different from trusting your compiler

if you were paranoid enough to be worrying about CPU backdoors, why would you trust your compiler?

<comment><USER14> >how is trusting your fab any different than trusting Intel?

You increase the cost of an attack - it's harder to change a processor's behavior by editing the mask than the VHDL. If you were super-paranoid you could source to multiple different fabs and run the chips you get back in parallel, with some sort of trap that goes off whenever you get different results from one or other processor.

>if you were paranoid enough to be worrying about CPU backdoors, why would you trust your compiler?

If you don't trust your compiler, why are you even bothering worrying about CPU backdoors when you've got a much easier attack vector open?

<comment><USER13> _run the chips you get back in parallel_

Who's to say you're going to trigger the condition that causes the backdoor? Seems very unlikely. If you have ideas on this, though, I'd be interested.

 _If you don't trust your compiler, why are you even bothering worrying about CPU backdoors when you've got a much easier attack vector open?_

You may not trust your compiler, and therefore do certain things in a VM where e.g. access to network is limited. See [1].

[1] <http://qubes-os.org/Home.html>

</comment></comment></comment></comment><comment><USER16> The irony is that electron microscopes run on computers, too. And they are probably even networked.

So really you can only trust an analog, optical microscope. Which, also ironically, is not quite good enough to resolve individual transistors (being limited to about 200nm or so, in green light.)

Last but not least, our CPUs are always designed by other computers, so it's theoretically possible that a backdoor could propagate itself forever.

</comment><comment><USER17> One thing to note is that having good perimeter security makes exploiting hardware backdoors much harder. I mean if you are monitoring all of your internet traffic then even if somebody with an access to a hardware backdoor tried to steal data or log your activities the traffic caused by those attempts would be caught at the perimeter.

</comment><comment><USER18> Problem is real, solution not so much. By hardware memory protection drivers will be isolated, but you cannot protect yourself from backdoor logic built into the hardware.

<comment><USER19> An IOMMU does protect against rogue peripheral devices, just not a rogue processor.

<comment><USER20> Yes a driver written that uses IOMMU/VT-d for firewire devices will prevent attacks over it from dumping memory and recovering keys, assuming that the memory isn't reused and contains it already etc. Having this combined with a quick way to zero out whatever DMA region is being used would be about as foolproof as you could expect anything to be for protecting you from this kind of attack.

</comment></comment></comment><comment><USER21> Note that you also have to trust the /tools/ that generate the circuits. Nobody's doing to check every single gate on the chip against the source code; it would be easy for a VHDL compiler to lay down extra stuff.

Shades of "Reflections on Trusting Trust," but in hardware. Doesn't have a complete replication loop, though, which would have the compromised hardware re-infecting the very VHDL compilers that generated the chip backdoor :-)

</comment><comment><USER22> I bet this is where Stallman does another 180 (like with cloud computing) and will claim that open hardware is paramount.

<comment><USER23> What was his 180 with cloud computing?

<comment><USER22> At one point I remember he said it doesn't matter that we can't see the source code running on remote computers because they're not rightfully in your control. It's just something you're connecting to with something you do control. You have the potential to check on your safety because you can see everything going in and out of your computer.

</comment></comment></comment><comment><USER24> Regarding open source, I think the point about security is not so much that you will read the entire source yourself, but that the reading of the source is, like its writing, a collective enterprise. If there's a backdoor, somebody at some point will see it.

</comment><comment><USER25> Aren't there laws against companies making Backdoor like this? Not that I'm naive enough to think that means it won't happen.

</comment><comment><USER26> typo in headline

<comment><AUTHOR> Fixed - thank you !</comment></comment>


In-toto: providing farm-to-table guarantees for bits and bytes - <AUTHOR> https://blog.acolyer.org/2019/10/02/in-toto/ <comment><AUTHOR> The Datadog TUF + in-toto implementation is discussed in more detail here[1]. Let me know if you have questions!

[1] [https://www.datadoghq.com/blog/engineering/secure- publicatio...](https://www.datadoghq.com/blog/engineering/secure-publication- of-datadog-agent-integrations-with-tuf-and-in-toto/)

<comment><USER2> Thank you; seeing that someone in industry was using it for real is a much nicer read than "alice and bob can sign hello world", especially with my concerns around trying to use any of this stuff in a CI/CD setup, where "developers attest ..." becomes very hard to discuss

Does your setup, or in-toto in general, get all the way into the weeds of clang, libc, the python VM, or whatever supporting tooling goes into building and running the Agent?

\---

Assuming it does not drill _all_ the way down, is there something about in- toto that adds value above and beyond GPG signing git commits? AIUI, a git commit protects every byte within the DAG and doesn't require a monster JSON blob or external tooling beyond the gpg binary to do so

<comment><AUTHOR> "Does your setup, or in-toto in general, get all the way into the weeds of clang, libc, the python VM, or whatever supporting tooling goes into building and running the Agent?"

Not yet. This chicken-and-egg problem will take time to solve. We will need to spread TUF + in-toto piece by piece...

"Assuming it does not drill _all_ the way down, is there something about in- toto that adds value above and beyond GPG signing git commits?"

Yes. While signing git commits are a good idea, how would the client know whether the built package corresponds to a signed git commit? With developers signing in-toto link metadata about source code, this become easier to check in the background by the client.

</comment></comment></comment><comment><USER3> Great writeup! The supply chain is one of the weakest links in the software development process today due to the implicit trust developers have in the open source ecosystem, so I'm glad to see more interest in projects like in- toto.</comment>


Hello Real World — You don't know what a computer scientist is - <AUTHOR> https://medium.com/p/b3592150339

<comment><USER2> True, C.S. is not what most people think it is. But, in practice, a C.S. undergraduate _degree_ is what lots of people think it is.

I'm a C.S. professor. Our program leads to a Bachelor of Science degree in "Computer Science". But like just about every other such program, it would probably be better called a B.S. in "Software Development". Computer Science -- in the strict sense -- is an important component of that, but it is not everything.

So, yes, our students should (and do) get experience successfully building working final products before we consider them to be qualified to receive a degree.

OTOH, our program is not about the latest, greatest, coolest tech. Nor, I think, should it be. My vision for a C.S. degree is that you should be able to get one, go sit on a mountaintop for 5 years, come down, find that your degree is still relevant, pick up the latest stuff pretty quickly, and be a big success.

BTW, as long as we're talking about the meaning of words, if you think that every qualified Rails or iOS developer is a _hacker_ , then I don't think you know what "hacker" means.

</comment><comment><USER3> [http://en.wikipedia.org/wiki/Hacker_(programmer_subculture)](http://en.wikipedia.org/wiki/Hacker_\(programmer_subculture\))

"A hacker is someone who loves to program or who enjoys playful cleverness, or a combination of the two. The act of engaging in activities (such as programming or other media) in a spirit of playfulness and exploration is termed hacking. However the defining characteristic of a hacker is not the activities performed themselves (e.g. programming), but the manner in which it is done: Hacking entails some form of excellence, for example exploring the limits of what is possible, thereby doing something exciting and meaningful."

[http://www.catb.org/jargon/html/meaning-of- hack.html](http://www.catb.org/jargon/html/meaning-of-hack.html)

"Hacking might be characterized as 'an appropriate application of ingenuity'. Whether the result is a quick-and-dirty patchwork job or a carefully crafted work of art, you have to admire the cleverness that went into it."

Although it is popular to call just about anyone creating products in IT a hacker nowadays, the term did have a meaning once and more people should know about it.</comment>


AWS IAM Manager – Users, Groups, Policies as a Code with one simple Lambda - <AUTHOR> https://github.com/RafalWilinski/aws-iam-manager <comment><AUTHOR> Hi Everyone,

At netguru.co we have to provide access for over 100 developers to different AWS accounts. Doing it from console or CLI was kind of a pain so I came up with this solution.

Basically, it "mirrors" structure from selected Github repository into AWS IAM Users, Groups and Policies. Everyone can request access to AWS account by creating pull request which must be Approved by a devops/cloud architect. Once merged, message will be send to SNS and then to Lambda which will take care of keeping everything synchronized.

Right now it does not support Cross-Account Access & Roles but I'm planning to implement it.

Let me know what do you think.

<comment><USER2> As Serverless already allows managing of IAM resources through the generic CloudFormwation resource support, where do you see the advantage of your approach instead of monitoring a Git repo and executing _serverless deploy_ for each change in there?

<comment><AUTHOR> That's pretty good idea, I haven't thought about it.

I think that my format is easier to understand. You don't have to use `Ref`s and weird `Fn::Join`s which may be not obvious for developers which are not experienced with CF.

</comment></comment></comment><comment><USER3> How are users and/or programs affected by the dropping and recreating of policies?

Does that interrupt access at all?</comment>


Hong Kong Has Weaponized the City's Subway Against Protesters - <AUTHOR> https://www.buzzfeednews.com/article/rosalindadams/hong-kong-mtr-protests <comment><USER2> The company that is running the HK subway, MTR Corporation (a public company, but 75% owned owned by the "HK government", i.e. China), is also handling operations for some none-HK/China locales:

* London: TfL Rail: Paddington to Heathrow Airport and Liverpool Street to Shenfield (100%)

* Stockholm: the subway (100%)

* Melbourne: the metro (60%)

* Sydney North West Rail Link (60%)

More details:

[https://en.wikipedia.org/wiki/MTR_Corporation](https://en.wikipedia.org/wiki/MTR_Corporation)

<comment><USER2> Please wear Free Hong Kong or Taiwan flags or similar while traveling on these routes

<comment><USER2> Ah, this was downvoted, so that's probably a good signal. Also try to get your photo taken!</comment></comment></comment>


Show HN: Macro – Customize your Zoom meeting interface - <AUTHOR> https://macro.io <comment><AUTHOR> Hey folks! My name is John and I'm one of the creators of Macro ([https://macro.io](https://macro.io)). We allow Zoom users to customize their meeting interface with different UI modes, real-time airtime visualization, and dynamically synced note-taking.

My co-founder Ankith and I both realized how unproductive most meetings were while working everywhere from startups to Fortune 500 companies. As engineers, we thought we could use technology to fix that. We started gathering data around meeting effectiveness last year using a Slack integration at over 250 companies and found that people were having the most problems in virtual meetings (and this was before COVID and before the entire world was WFH!). Specifically, people felt like their voice wasn't heard and they were missing next steps (or the entire point of the meeting). They felt that video meetings were frankly getting in the way of work instead of augmenting it.

We decided in December 2019 that we should use these customer learnings to build a new video interface that would fix the biggest issues. Instead of reinventing the wheel, we chose to build on top of the new Zoom SDK so we could piggyback on the best audio / video infrastructure around. Our initial launch focuses on showing airtime distribution in real time, giving users the ability to take GDoc-synced notes directly from the Zoom UI, and allowing users to pick different video modes for different meetings (like a mode with small bubbles at the top to pair program or design on Figma together).

It's our first day live to the public and we're excited to share the product with HN without any recently popularized 'exclusive waitlist'. You can check us out and download (macOS only at the moment) at [https://macro.io](https://macro.io) or just see more on Product Hunt and TechCrunch. We're a small company of 5 and we're rapidly iterating on the product every week so we'd love any and all feedback from the HN community!

<comment><USER2> Just downloaded! Can't wait to try it out.

</comment></comment><comment><USER3> Little Snitch reported that Macro wanted to send a request to hooks.slack.com—I'd imagine that you're posting a notice in your team's Slack when the tool is used?

Your on-boarding mentions your affinity for transparency, but this feels pretty shady to me. I've uninstalled the app.

<comment><AUTHOR> We don't use any traditional third-party user tracking software so we do indeed use Slack webhooks to allow the leadership team to be notified about certain events (onboardings, uninstalls, etc.). No meeting data (name, attendees, or otherwise) are included in these requests.

If you've got any suggestions on how to debug client-side issues with more transparency in mind, I'd love to hear them!</comment></comment>


More on free work - <AUTHOR> http://www.scottberkun.com/blog/2010/more-on-free-work/

<comment><USER2> I find it hilarious that this guy who claims to be "author of three bestselling books" tried to get his next book designed for free; and then changed that to a "small" flat fee.

If you're a champ, pay like a champ.</comment>


Users to USTR: Don't Sign Away Our Ability to Fix the Orphan Works Problem - <AUTHOR> https://www.eff.org/deeplinks/2015/08/users-ustr-dont-sign-away-our-ability-fix-orphan-works-problem <comment><AUTHOR> David Post has a legal analysis of this topic, [https://www.washingtonpost.com/news/volokh- conspiracy/wp/201...](https://www.washingtonpost.com/news/volokh- conspiracy/wp/2015/09/03/in-a-dark-corner-of-the-trans-pacific-partnership- lurks-some-pretty-nasty-copyright-law/)

" _The solution is pretty obvious — a true legislative no-brainer: Amend the Copyright Act to eliminate statutory damages for these orphan works. Surely even Congress can see how idiotic it is that this class of invisible rights holders can keep this treasure trove of information out of the public's hands, and there has indeed been significant movement recently (including a Copyright Office proposal to this effect) toward just such a change.

.. A [US] court would (as I read the new statute) NOT be permitted to award punitive, or exemplary, damages in orphan works cases – but the TPP seems to require that._"

<comment><USER2> I wish you had to register to obtain the copyright for you work. It shouldn't be automatic. If you intend to make money from something, surely registration + a small fee every 5 years wouldn't be a huge burden. Fail to do that, and the work becomes public domain within two years.

<comment><USER3> Under such a system, a photographer would presumably have to register each photograph before hosting the image on her website, or risk losing copyright protection.

This seems extremely onerous for a wide range of creative professions.

<comment><USER4> This future photographer will use some specialized computer software that automatically registers every photograph that ends up on their own personal website.

BTW, we're working on the underlying technology for this kind of stuff here:

[https://github.com/blockai/openpublish](https://github.com/blockai/openpublish)

<comment><USER5> Is the idea here that an artist would first register their work on the blockchain, then publish it publicly?

I've had a very similar idea to use something like that registy with a browser extension that catalogs every resource visited by a user (by the SHA-2 of it's content), what site referred / linked them to it. This will create a big list of consumed content. At the end of the year, the user can view their audit log (and metadata on it, e.g. how many minutes of a video they watched, how they rated it etc) and it will let them donate a certain amount of numbers from an atomically incrementing counter signed with keypair identity to the artists registered for those works and those that referrer them to the content.

The donater could back keypair with a variety of identities (maybe something like a twitter account that takes into account how famous the donater is based on their followers etc or maybe through something like keybase that aggreates together several social media identities into a unique key). The donater could also back this counter with a certain amount of money or BTC or whatever (essentially acting as their own bank).

This allows an referrers/artist to be compensated in both _fame_ (the Sum of the amounts of count assign to them * the follower-strength of the person assigning the count at the time of assignment / the total count that person has assigned) which is useful for parlaying into advertisement backing and _fortune_ (the total value of the count they were given). The artist/referrers can hold their count (speculating a rise in the value of that contributors count), can trade some portion to other's via the blockchain or back to the original donater in exchange for the backing amount.

Obviously people can parasitically clone works and republish them, with minor content variations. Hopefully some sort of auditor could set what constitutes a new vs derived work and how the splits are calculated and to find duplication and attribute it back to the correct authors, it would be up to each donater to choose the auditor they want to use when making their donations. The expectation here is that artists would band together and choose to promote the auditors that do the best job of being 'fair'. Ultimately though, the choice on how to give money to the creators of content would be to the public and so auditors that favor regimes unlimited copyright and very restricted derivation would be less weighted than ones that pushed for creative derivative works.

</comment></comment></comment></comment></comment><comment><USER6> What I don't understand is why copyright applies for so long (life + 70y so typically 120y+) and why intellectual property (patents) applies for such a short period (20y). Fundamentally it is the same thing. And one could argue that code could be treated either way.

<comment><USER7> Because the Disney corporation doesn't want Mickey Mouse to fall in the public domain. I've said before that it may behoove us to simply amend copyright in a way that gives Disney infinite copyright, while everything else gets ten years. Call them an "irreplaceable cultural giant" or whatever else euphemism you want for "lots of money". Require a yearly tax that's just below what they pay in lobby money currently. To make it "fair", you could say "first ten years copyright is free, then it's X per year per work, then it ramps up until it reaches what Disney can pay.. I mean Z, which was determined after market analysis"

<comment><USER8> Only the original Steamboat Willy cartoon would even _rise_ to the public domain. The character as we know him today is thoroughly trademarked, which does not expire.

All anyone would be able to do, is distribute free or paid copies of a historical cartoon film.

<comment><USER9> > All anyone would be able to do, is distribute free or paid copies of a > historical cartoon film.

But perhaps you could also legitimately create derivative works? If you didn't offer them for sale, perhaps trademark would not apply (not used in commerce)? It would be interesting for them to demonstrate injury.

<comment><USER8> You would only be able to create new derivative works of the character as he was in Steamboat Willy. Anything that we now recognize as being characteristic of Mickey Mouse would still be under copyright, because it was developed in later films.

</comment></comment></comment></comment></comment><comment><USER10> Has the EFF ever won a copyright battle? Since they lost the big one (copyright term extension), I can't think of a big win.

<comment><USER11> If you're referring to Eldred v. Ashcroft, that wasn't an EFF case.

You can see some of EFF's legal victories here: [https://www.eff.org/victories](https://www.eff.org/victories) , although to be honest we really need to update that list. For example, in the IP space I don't think it includes the two busted patents from earlier this year, which were being used to target podcasters and online competitions. See [https://www.eff.org/press/releases/eff-busts-podcasting- pate...](https://www.eff.org/press/releases/eff-busts-podcasting-patent- invalidating-key-claims-patent-office) and [https://www.eff.org/press/releases/victory-photo-hobbyist- pr...](https://www.eff.org/press/releases/victory-photo-hobbyist-prevails- over-junk-patent-bully)

<comment><USER10> Steve Jackson Games wasn't an EFF case, either. I was at the Steve Jackson trial as a technical expert. The EFF didn't have anybody there.

<comment><USER11> Sorry I'm late to this; at that point, EFF didn't even have lawyers on staff whold could be there. Instead it was formed to financially fund the Steve Jackson suit against the Secret Service -- that's the reason why it's has "foundation" in the name.

[http://www.sjgames.com/SS/](http://www.sjgames.com/SS/)

"The EFF provided the financial backing that made it possible for SJ Games and four Illuminati users to file suit against the Secret Service."</comment></comment></comment></comment>


What Will Happen When the Sex Robots Arrive? - <AUTHOR> http://www.blackdragonblog.com/2018/04/12/what-will-happen-when-sex-robots/ <comment><USER2> I don't think sex robots are going to be as prevelant as the blogger thinks. I couldn't even consider a sex-robot. That just seems gross and pathetic to me and I'm like a 1 or 2 out of 10 on looks scale.

I think us ugly guys just adapt to being single most of the time and sex just becomes something you don't ever really think about. I don't care how realistic these robots are, I think they always be a niche product for a small handful of weird guys.

<comment><USER3> It's easy to think of them as gross, pathetic, absurd if you consider their current state. If the robots ever get to the point where they are indistinguishable from humans, I imagine these things would become much more acceptable. Maybe some day you'd be viewed as some kind of old-fashioned bigot for not accepting such modern "relationships".

</comment></comment><comment><USER4> But who wants to be the loser that's so unattractive and socially inept that he can't get an actual woman to be interested in him?</comment>


Does the Internet Make You Dumber?  - <AUTHOR> http://online.wsj.com/article/SB10001424052748704025304575284981644790098.html?mod=WSJ_LifeStyle_LeadStoryNA

<comment><USER2> >In one experiment conducted at Cornell University, for example, half a class of students was allowed to use Internet-connected laptops during a lecture, while the other had to keep their computers shut. Those who browsed the Web performed much worse on a subsequent test of how well they retained the lecture's content.

What if half the class was allowed to read a book during a lecture and the other half was not? Would you expect the results to be any different?

</comment><comment><USER3> Bad Title. It should be does the internet make you...oh look something shiny.

The idea that multitasking is bad for you is not new.

<comment><AUTHOR> I just went with the title of the article.

<comment><USER3> No worries, it's just a joke.</comment></comment></comment>


Ask HN: How do you avoid RSI injuries - <AUTHOR> I'm finding using the modifier keys a challenge. Using my pinky to CTRL + C, CTRL + V etc, is causing discomfort ranging from mild to a chronic daily strain which is sometimes bad and at best can be ignored. I'm starting to get twitches in it also.
I'm curious what strategies you have used to avoid similar.
Looking at any solutions ranging from:
- Finger Exercises.
- Hardware solutions
- Software solutions ( ie rebinding keys )
- Foods <comment><USER2> related: "Ask HN: What do you wish you knew before you got RSI?" [https://news.ycombinator.com/item?id=23561926](https://news.ycombinator.com/item?id=23561926), "Ask HN: How do you take care of your hands?" [https://news.ycombinator.com/item?id=21046033](https://news.ycombinator.com/item?id=21046033), "Ask HN: Best Mouse for Avoiding RSI" [https://news.ycombinator.com/item?id=20689309](https://news.ycombinator.com/item?id=20689309)

</comment><comment><USER3> Switch Caps Lock to CTRL. Also, learn to touch type so you can place your fingers on the keyboard properly.

</comment><comment><USER4> 1\. Laptop in lap and ass in comfy chair...the kind of chair that you would sit in to binge watch Netflix in your living room. It's just another screen. The ergonomics allow shifting my weight and adjusting my relationship to the screen and the angle of my hands to the keyboard. My favorite is an Ikea Poang chair with footstool.

2\. Keyboard with Ctl and Alt on both sides of the space bar. Then I can use one hand for Ctl and/or Alt and the other hand to press a key.

3\. Item 2 is an optimization for Emacs picked up from Xah Lee's _ErgoEmacs_...which means I try to use Emacs key bindings whenever practical.

4\. Laptop has a touchpad. I don't use mice because that screws up two handed Ctl and Alt shortcuts. Pointing sticks are also good if you have a Thinkpad (and Thinkpads are the best because not only are their Ctl and Alt keys on both sides of the space bar, they are symmetrical (my Dell has an Fn key between Ctl and Alt on the left side of the space bar)).

5\. Barring a laptop, I like the Microsoft Natural Ergonomic 4000 keyboard...again in my lap. But my Unicomp EnduraPro has symetrical keys, buckling springs, and a built in pointing stick which means I don't need a mouse and so it's even better.

6\. One of the big things about putting a keyboard in my lap is it avoids pressure points where my wrist rests on the edge of the desk. This is the biggest source of discomfort for me going back more than twenty years. The first solution was a plastic folding table as a desk with a ~1" radiused edge back in the early 00's. But keyboard in lap is simply better and laptop in lap and ass in comfy chair is even better.

7\. One of the big things for me is recognizing when I'm having discomfort early -- it's amazing what I am able to ignore if I try -- and adjusting my position slightly for the next few days. That took a long time to learn because I was trying to sit at a desk with a keyboard and mouse on the desk and that's fundamentally broken...which reminds me that standing desks have most of the same issues _for me_ as sitting desks in terms of keyboard position and the display position is worse...again, for me.

8\. When I notice pain I stretch my arms and wrist tendons. The arms by doing whatever feels like it's stretching, the wrist tendons by extending my arm palm down and pulling back and upward on the fingers with the other hand.

Being mostly self-employed for the past thirty years, I don't have the privilege of claiming RSI. Sometimes it just hurts and so I do what it takes to reduce the hurt and keep working. But that also means I can work in a comfy chair with a keyboard in my lap without a manager managing me for the sake of conformity.

Good luck.</comment>


GDB 8.1 Released - <AUTHOR> https://sourceware.org/ml/gdb/2018-01/msg00026.html <comment><USER2> > New shortcuts for TUI Single-Key mode: 'i' for stepi, and 'o' for nexti;

TUI really is one of the best features to really get into gdb. visually stepping through the disassembly really makes debugging more appealing, I really wish they dont abandon this aspect of gdb

<comment><USER3> Why not use a real GUI frontend like Visual Studio Code instead?

<comment><USER4> Can you use VSCode as just a debugger? IDE's typically require sacrifices like letting the IDE take over your build process.

<comment><USER5> Yep! This is all of the configuration needed to use VSCode as a debugger for Ocaml:

[https://i.imgur.com/kY6NuXC.jpg](https://i.imgur.com/kY6NuXC.jpg)

</comment></comment></comment></comment><comment><USER6> _starti, rbreak_ and _ptype_ sound good even if they've been available as idioms before.

<comment><USER7> _starti_ did not exist before, and specifically addresses a StackOverflow question of mine from ~3 years ago: [https://reverseengineering.stackexchange.com/questions/8724](https://reverseengineering.stackexchange.com/questions/8724)

 _ptype_ already existed, but did not print out offsets. This is incredibly useful, and something Windbg does with _dt_. Pwndbg does this in GDB by adding new commands.

<comment><USER8> Does this mean p does not work anymore, because there are now 2 commands starting with p? This would be a shame.

<comment><USER8> I checked it out. p still works as before.

But I needed a C++ patch on osx with cc/clang. Apparently they added cxx files with the .c extension: gdb/probe.c:63

        - const any_static_probe_ops any_static_probe_ops;
        + any_static_probe_ops any_static_probe_ops;

</comment></comment></comment></comment><comment><USER9> I'd really like a way for a program to have an API for interacting with GDB: with that it could tell "I'm running under a debugger". There would be a file descriptor which talks to the debugger, if the debugger is present. Output sent to it goes to the debugger and perhaps it could obtain input from the debugger also. Maybe the API could provide some introspection: the program could ask what breakpoints have been set and things like that.

<comment><USER10> Having the program behave differently under a debugger is a great way to introduce bugs that disappear when the debugger is present. Any features of this type would have to be completely optional.

<comment><USER11> Yes, and introducing bugs is not the only issue at stake.

Imagine malware that could react differently when a debugger is attached.

<comment><USER11> Well, to be fair malware already exists that can detect when a system debugger is attached so maybe my concern is invalid. I guess the greater concern is the introduction of bugs after all.

Edit - Other commenters beet me to this point :-P

<comment><USER9> The program is what it is and it has bugs. There is a risk that bugs are irreproducible under a debugger (no matter how transparent the debugger). Oh well; you have to debug those in some other way. That risk shouldn't paralyze us from innovating debuggers.

There are bugs that won't reproduce when you debug via JTAG; so what.

Simply pausing on a breakpoint can make a bug irreproducible.

Programs can infer that they are being debugged via timings, and various side channels.

<comment><USER12> The issue is that by introducing this feature, you're increasing the number of programs that behave differently when a debugger is attached. Just because this can be an issue today doesn't mean that we should make it even more of an issue tomorrow.

</comment></comment></comment></comment></comment></comment><comment><USER13> heh. Has anyone ever used gdb to debug Pascal? :)

<comment><USER14> I have to, on a regular basis actually and I'm glad gdb and FPC work well together.

<comment><USER15> Nice to hear, I have a pascal lisp project I need to revive, having gdb on my side would help

</comment></comment></comment><comment><USER16> Cool, but why are the release checksums in MD5?

<comment><USER17> Ah yes, the standard nitpicky dismissive HN comment makes its appearance.

<comment><USER18> I'm quite amazed we've made it to 33 comments without somebody complaining it the project hasn't been retooled with Rust/Clojure/Node.js yet.

<comment><USER19> There is no point on reimplementing GDB yet, you need first a legacy debugger with proper Rust support until the new one can debug itself.</comment></comment></comment></comment>


Ruby 'compiler' in Common Lisp - <AUTHOR> http://jng.imagine27.com/articles/2010-10-07-084756_ruby_subset_implementation.html <comment><USER2> Another interesting example of a program like this is CLPython:

<http://github.com/franzinc/cl-python>

It is too bad that more language implementors do not go this route, as it is a really easy way to get decent efficiency.

I suppose it isn't surprising, however. It is a lot easier to find people willing to contribute to open source C/C++/Java code than Common Lisp.

I will note this implementation and does not have a lot of the important functionality involved in classes/modules and their scoping (so pretty much any of the language semantics, which is understandable as it is a toy).

Implementing the semantics of the language, would be trickier and probably lead to less efficient code.

</comment><comment><USER3> Neat trick. Still, it's like Charles Nutter said - it's easy to make a fast subset of ruby by chopping off inconvenient corner cases. It's really, really hard to make a fast ruby.</comment>


College Is Much More Than a Means to a Higher Salary - <AUTHOR> http://sam-koblenski.blogspot.com/2015/06/college-is-much-more-than-means-to.html <comment><USER2> 1\. List (very real) benefits of going to college. 2\. Repeatedly refuse to engage in any sort of analysis of whether those benefits were justified by their cost by using phrases like "I can't even put a price on those experiences." 3\. Claim that college is worth every penny.

"College is just a means to a higher salary" is a strawman. The real question is whether the other things it brings are worth tying yourself down in heavy debt for most of your working life.

Also, if a big reason to go to college is motivation you can't find anywhere else, how completely f __*ed will you be when you enter the real world heavily in debt and unable to learn new things without paying an institution thousands of dollars per month to motivate you?

<comment><USER3> > "College is just a means to a higher salary" is a straw man.

I've always wondered about this. Does having a degree lead to higher salary? Or is it that the types of people who go to collage and get degrees are more naturally inclined (for whatever reasons) to get paid more?

It seems like a pretty 'basic' and fundamental question, so I'm sure there's been studies/research on it before.

<comment><USER4> Despite the Silicon Valley's somewhat undeserved reputation for breaking with tradition, at least having attended a top university is so close to being a requirement in SV that it might as well be. Try getting a job at a top-flight SV company without a degree, or even with a degree that wasn't from an Ivy League school...you'll find it nearly impossible. There are exceptions to every rule, but if you don't plan to work for yourself, you'd better either have a decade or more of solid, demonstrable experience that yielded exceptional results, or have a degree from a top school.

<comment><USER3> Yeah so I think that's where I see things differently over here in Australia. While 'degree leads to higher income' is still a common belief here, I don't think that there's that requirement to have a degree, let alone from a top uni (like you mentioned in SV).

Although I'm still relatively early in my career (23 years old) - Lacking a degree has never been a problem for me and I've still ended up in a pretty well paid job.

<comment><USER5> New Zealand seems to be similar, with the added bonus that we only have a handful of universities so there is no distinction between 'good universities' and 'the rest'.

<comment><USER6> You'll find HR consultants for pretty much all big companies and govt (incl Fonterra, TradeMe, GCSB, IRD, Frucor, to name a few) will throw your CV in the trash if you don't have a degree. Luckily in this country it's much easier to get your foot in the door through meet-and-greet.

Want to meet a developer from Xero? Tweet 'em. No luck? Ask somebody you know if they know someone who works there, likely they or someone they know does.

</comment></comment></comment></comment></comment></comment><comment><USER7> Nonsense.

The best knowledge that I have retained over my educational "career" has been self taught.

College partially helped dictate the direction but why should I be paying 100,000 grands for just directions ?

The best learning also happens when you are not stressed out due to "shame, external pressure". Or in my case financial and parental pressure.

I remember reading studies done recently that found out that students are more stressed out than people locked up in prison.

How is this fair ?

Khan Academy's lectures on cryptography, physics and chemistry helped me through high school and college more than any other source.

To the author of the blogpost : Stop whining about having to listen to young people's doubt about college when you have no clue what society is putting them through.

<comment><USER8> >but why should I be paying 100,000 grands for just directions

You don't have to spend anywhere near 100k for college, and the vast majority of people don't.

The average in state tuition and fees at a public university is $9,139. Some kind of assistance is available to most people--the Pell Grant is income based and many states have Scholarships. Georgia (where I went to school) has the hope scholarship that covers around 90% of tuition and fees for high school students with a B average and close to 100% for students with a 3.7.

In addition almost everyone qualifies for student loans. And if you take out more than $30k or so (I forget the exact amount) you can qualify for income based repayment where you pay back only 10% of your discretionary income (Income - 1.5 * Federal poverty level) for 20 years.

<comment><USER9> That's almost exactly what I was thinking.

Anybody with decent grades can get into the local branch of their state school, live with their parents/friends, and graduate with minimal debt. It's not as sexy as going to a big name school and living in the dorms, but it's a lot smarter in the long run. It's especially true in a field like Computer Science, where it's so easy to impress people with results. To most people a degree from MIT means a lot less than a profile of impressive projects, and the projects don't cost an arm and a leg.

</comment></comment></comment><comment><USER8> I've seen this debate from both sides. I worked as a self taught programmer for about 7 years before I went back to college.

College forced me to learn the all the (seemingly) boring parts of Computer Science that I'd skipped over while teaching myself. Some people have the discipline and drive to spend time proving that an algorithm is O(n^2) or that a grammar isn't regular--most do not.

My CS degree filled in so many holes in my background that I didn't even know I had, and most of the other self taught programmers I've worked with weren't too different from me. Many times this is the difference between spending a week banging your head against a wall, and taking 10 minutes to realize your particular problem was solved 50 years ago.

</comment><comment><USER10> > If someone doesn't have the motivation to get through college classes, it's > unlikely that they'll have the motivation to learn on their own with online > videos and exercises.

If you don't have the motivation to learn something, then I posit that you haven't framed the topic in the right way. I like this quote from Feynman:

> "I don't know anything, but I do know that everything is interesting if you > go into it deeply enough."

The only way I'm going to put in the effort to learn something (really learn it, not just pass the class) is if I find it interesting in some way. I'm sure that awesome professors are great at framing topics in the right way, but I can also see myself doing that.

For example, 3D graphics. There can be a lot of tedious math and programming involved, but if you can master it, you have the ultimate ability to visualize anything you can think of.

</comment><comment><USER11> Author doesn't get into it, but the quote at the top from a HN comment briefly touches on why I went back to college.

I just graduated at 41 years old. There's not a clean, easy single reason why. But it involves some bits of pride and shame. I'm the oldest of all the grandkids in the extended family and had been the only one who hadn't earned a degree. Lost one of my grandmas a few years ago and I wanted to make sure my other one could see me get there. Also I wanted to do it just to prove to myself I could finish something I started over 20 years ago.

Money ain't everything.

<comment><USER12> That's like my story. I dropped out of CS degree and spent 20 years working on some great self motivated projects, I've had CGI videos on Mtv including one for a #1 charted band (not the song I did), taken a company from $250k turnover paper based business to $1m+ by computerising, started an ISP.

But when I reflect: "no degree" always rankled, especially when I was hanging out with MIT grads at conferences. It definitely opened doors to them that were closed to me. I have heard "I could get you a semester of research in my lab if you had a degree".

So here I am at 46 doing a BSc and am lining up my doctorate. Dr SixSigma has a good ring to it.

</comment></comment><comment><USER13> While what he says is true, if you're taking on a lot of debt you _have_ to consider whether you're going to be able to pay it off and how long that will take.

"How much can I expect to make after graduation" was something people always considered, but the recent steep rise in tuition has made it more of an overriding question.

<comment><USER8> They have an income based repayment plan where if you borrow over a certain amount you only have to pay 10% of your discretionary income (Income - 1.5 * Federal poverty level) for 20 years.

<comment><USER14> That's quite a burden, right up there with a mortgage. Back in the day I paid off my student loan debt in 3 years, then my wife's in one more year. And we went to Stanford. Things have gotten way out of whack.

<comment><USER8> >That's quite a burden, right up there with a mortgage.

That's nowhere near a mortgage at the income levels where it makes sense. If you're stuck in a crappy job making $30k a year and you're single, it's about $100 a month.

If you're making $60k and you're single, you could definitely pay off the average $30k loan in 3 or 4 years (assuming you live somewhere where 60k is a decent income).

And If you're making $60k and you have a family of 3, you're payments are going to be about $250 per month.

Obviously the cost of college has gone up a good bit. Mainly due to an increase in the number and cost of administrators and a decrease in state funding.

However, it hasn't gone up nearly as much as it seems when you realize that most people aren't paying the sticker price after you factor in federal grants, state scholarships, and university scholarships.

>And we went to Stanford

Right now if you go to Stanford and your parents make less than $65k a year, you get a waiver for tuition and room and board. They also waive tuition for students whose parents make less than $125k a year.

<comment><USER14> If you're making 30K you don't have a mortgage. 100$ a month for life is a significant fraction of your disposable income, and it never ends. ITs very much like a mortgage.

Anyway, folks aren't bellyaching about $100 a month. Student loans are costing millions of Americans many times that for 20 years.

<comment><USER8> >If you're making 30K you don't have a mortgage.

True, but that's probably the case regardless of whether you have a $100 a month student loan payment.

> 100$ a month for life is a significant fraction of your disposable income, > and it never ends.

It's not for life. If you haven't paid it off in 20 years, the rest is forgiven.

>Anyway, folks aren't bellyaching about $100 a month. Student loans are costing millions of Americans many times that for 20 years.

The income plan is for people on the lower side of the income scale. The standard plan is only 10 years. If you can afford that, you'll be done in 10 years.

If you can't afford that, it's unlikely that you'll pay "many" times $100 a month for 20 years because what you pay is directly proportional to your income. And anyway, $100 a month for someone making $30k a year is basically an equivalent burden to $350 for someone making $60k.

Sure there are exceptions--people who took out enormous sums of money to live on campus at an out of state school. The solution is to got to either go to a state school and don't live on campus, get scholarships, or go to a school with a large enough endowment to waive most of the cost.

</comment></comment></comment></comment></comment></comment><comment><USER15> Frankly, I think 15 years out from school the most important thing I got was the 1 line on my resume that says `BS Computer Engineering`. Everything else I either have forgotten because it wasn't applicable to my daily life, or was basic enough that a few months in the "real world" would have either taught it to me, or I have since moved far beyond.

But, that one line keeps the door open when I need to look for jobs. I have an ex-coworker with similar skills, experience, etc. And when looking for positions I get about 2x-3x as many callbacks as he does. HR departments seem to throw his resume away, and the only thing we can think is that it must be the lack of degree.

<comment><USER16> You have the raw end of the deal, not him. If an HR person can't make a judgement on whether a candidate is good or not other than by their qualifications (or they're actively marking the individual down when they have the experience but not the piece of paper), then the chances of the other employees at the company being chosen poorly is high.

If he got no interviews whatsoever, then it'd be a cause for concern. But it seems to me he's got a more optimal list of possible future employers.

<comment><USER14> Not quite fair. HR people have a huge number of applicants. They need something to winnow down the field. They could choose white males, or blue- eyed females, or athletes, or anything really. And still have a pretty good cross-section of candidates, some with skills.

So they choose college degree, for (somewhat) defensible reasons. And they interview those that pass the filter, and choose 'good fits'. Which is what they'd have done if they had used any filter at all.

</comment></comment></comment><comment><USER17> I personally never had the motivation to work hard in college. I always assumed this was a personal flaw. Years later, after I'd completed a large number of Coursera courses, I realized it was because college was _boring_.

(edited to add) I should also note that the Coursera lectures themselves were pretty boring -- the innovation is that they provided slides and lecture notes so that I didn't have to sit through the lectures.

<comment><USER18> No, college isn't boring. Lectures are boring. And they're boring because they can't rely on students to read the textbook so they have to tell you what's in the textbook.

The best teachers don't lecture. They facilitate discussion or present a problem and give you feedback while you work through it. You watch some videos outside of class and you come to class to be assessed.

But that's hard work. Lecturing for an hour 3 times a week and giving a bubble-sheet test is easy for the teacher, and easy for the student.

<comment><USER19> Well, the other problem is similar to all schools. Students are at varying levels of competence. I finished many labs in 10 minutes which took the other students a full hour and a half simply because I already knew Java/C inside and out. Same with lectures where I was already familiar with the material.

<comment><USER18> The question is why were you in the class if you already knew the material? People like you should be able to get credit for what you already know if you can demonstrate it.

Unless of course you're just looking for a GPA and need the easy grade.

If the school just made you sit there because reasons, well, yes, that's a huge problem. A problem which is being rectified all over the US.

<comment><USER19> I actually did skip several math classes (calc 1/2) by taking exams. There was a limit to how much you could skip though as they wanted you to earn the degree.

</comment></comment></comment></comment></comment><comment><USER20> Author is making biased observations, probably based on his experience. Parental pressure, peer pressure, shame are all wrong reasons for going to college to get a degree. The lectures I watched on Khan Academy, Coursera or EdX beat almost all lectures I attended at college. For me there isn't a "big difference between watching a video online and actually being there". Many times I learned more from watching Youtube videos than attending lectures at universities/colleges. Hands-on learning courses on codecademy or codeschool are much better than in-person corporate trainings I attended, that companies I worked with spent thousands of dollars on.

<comment><USER21> Most of the Coursera and EdX lectures are actually college lectures, just put online.

I know as a TA, it can be hard to answer some questions via e-mail, so I'm assuming it would be difficult to do in a web forum as well. I once spent several e-mails trying to explain something to a student and after failing, asked them to come to my office and explained it in five minutes in a way they understood. So, while there might not be the difference for a lecture, it's the things around the course that can make the experience better.

I know Khan Academy has some problems (at least in the past) with some of its material. One example is discussed in,

[http://www.leancrew.com/all-this/2012/12/khan/](http://www.leancrew.com/all- this/2012/12/khan/)

I can verify what he's saying is correct as I used to be involved in teaching the same material.

I first learnt C++ in an in-person corporate training session and it was excellent. I think it all depends.

</comment></comment><comment><USER22> As someone who dropped out of college and had to cope with the consequences, I often think if college is worth it for the typical use-case in HN discussions: an ambitious & hard-working American citizen < 24.

While there's plenty of edge-cases in that definition (esp. the orders of magnitude over-represented college dropout billionaire), indubitably I think it is worth it for the vast majority of people for these two reasons:

1) The majority of society (aka the people who work in HR) still thinks it's important. Being the guinea pig (or crusader) isn't fun. While people like Peter Thiel, who graduated from Stanford 2x, pontificate about the outdatedness of education, note that before becoming a billionaire he leveraged his education to earn serious money and experience in respected careers that unanimously goto college graduates: finance & law. This gave him the financial foundation & creditability to invest in Max Levchin and ultimately run PayPal.

The same opportunities are not offered in our society to people who graduate from top 10 universities vs drop out from the average American university. The latter will have to prove themselves 5x more to compete for the same opportunities - whether it is jobs, capital, co-founders, or even dating. Theres nearly no statistically likely argument where dropping out leads to better outcomes for the typical HN user over the long run across almost any metric.

2) Wait till you want to change careers or move into senior management to earn more money. Want an MBA so you can double your salary for the next 25 years? Want to become a teacher or a professor? How about a lawyer. Great, now take a bunch of classes with 18 y.o. know-it-alls and earn zero money for 4 extra years of undergrad tacked onto grad school when your opportunity cost is literally $500k (just for undergrad).

I fought the good fight, and the lesson is it's generals and politicians who win wars, not soldiers.

</comment><comment><USER23> And in many cases, it isn't even a means to a higher salary. Often it's a means to a lifetime of debt.

</comment><comment><USER18> This article focuses a lot on lectures.

And lectures are dying. Modern teaching methods are trying to phase them out, as the Internet is really good at giving you information. The educator's role is now a facilitator.

"Guide on the side, not sage on the stage", or so it's been said.

And that's how it has to be - that's the only way a college can compete. Because the online lectures you see are just captures of regular lectures. You don't need to go somewhere and pay money to watch someone talk.

The value the professor adds is in assessing your work. And if classtime can be used to do that, or classtime can be used to let you practice, then there's the advantage.

</comment><comment><USER24> Diamonds maintain their value thru strict control of the supply enabling them to serve as a symbol of status. Processes that threaten the control of artificial scarcity represent an existential threat to the value of the diamond industry and diamond holders. Draw parallels at your own will.

</comment><comment><USER25> It's not a binary decision of college or "no-college"... It's a matter of considering the "space" of portfolios of other experiences you could assemble for potentially greater value (including non-financial value) at lower expense.

</comment><comment><USER26> How much are you willing to push yourself? Will you try multiple ways of solving something till you really understand it? Motivation is key. Some find it years after college, some find it while in college. Some find it without any college!</comment>


What if the Web never happened - <AUTHOR> http://esr.ibiblio.org/?p=3335

<comment><USER2> Without the Web:

<http://en.wikipedia.org/wiki/Bildschirmtext>

<http://en.wikipedia.org/wiki/Minitel>

"The Minitel is a Videotex online service accessible through the telephone lines, and is considered one of the world's most successful pre-World Wide Web online services. It was launched in France in 1982 by the PTT (Poste, Téléphone et Télécommunications; divided since 1991 between France Télécom and La Poste). From its early days, users could make online purchases, make train reservations, check stock prices, search the telephone directory, have a mail box, and chat in a similar way to that now made possible by the Internet. In February 2009, France Telecom indicates the Minitel network still has 10 million monthly connections, among which 1 million on the 3611 (directory). France Telecom is mulling an end of the service in September 2011[1]."

<comment><USER3> There was also Prestel and Teletext in England. Time, Inc. invested a _ton_ of money here in a teletext startup. I don't know why they abandoned it but "who owned the VBI" (vertical blanking interval, which would carry teletext) was an issue back then too. AT&T also had NAPLPS in the works. Times Mirror and at least one other company I can't recall (in Florida) had NAPLPS systems up and going. Time Warner had Qube on cable in Ohio (Columbus?). None of them had the life or vibrancy or innovation of the BBS subculture.

</comment></comment><comment><USER4> As someone who played with both HyperCard and too many a BBS back in the day I can tell you that the web was inevitable (see FidoNet). It might have evolved in half a dozen ways and looked slightly different, but it would have happened. Also having somewhat survived the dot.com era of the 90s I'd have to say what really gave the web its power was broadband getting to the masses, and several industries gave that push.

<http://en.wikipedia.org/wiki/FidoNet>

<comment><USER5> I was going to say that Gopher would have probably morphed and evolved into something not too dissimilar to the web we have today -- it had the hyperlink idea down.

<http://en.wikipedia.org/wiki/Gopher_(protocol)>

I remember a few graphical BBS systems that also had some of the conceptual underpinnings of the web today in terms of graphical interfaces.

But I agree, We would have probably ended up with something pretty much like we have today.

</comment></comment><comment><USER6> It's amusing to see a die-hard libertarian like ESR describe a dystopia where online services are being developed by private entrepreneurs rather than the US Government.

<comment><USER7> I think some libertarians support small governments and small corporations.

Large corporations always use their influence on governments. This happens for a lot of time around the world. Those corporations influence governments to stipulate laws that protect their own interests rather than interest of proletariat.

The most disturbing aspect is that those large corporations propaganda as they are in fact protecting proletariat's property right. In a country such as U.S. where 1% in populations control 33% of the wealth and 10% in population control 66% of the wealth, the law is not for protecting 90% population's property right, but the 10%.

You doubts this? Look at RIAA, MPAA's effort in U.S. Congress.

P.S. I am a closet libertarian.

<comment><USER8> Why "closet"?

<comment><USER9> Because he hasn't come out of it yet; just look how impetuously he's attacking property owners.

<comment><USER10> The right to intellectual property isn't a natural right like the right to physical property. The Constitution states that intellectual property (i.e. copyrights and patents) exist to serve the purpose of encouraging innovation. The RIAA, MPAA and software patent trolls' abuse of these rules serves to hinder innovation, and therefore these rules should be revised.

I don't think there's anything especially revolutionary in what I just stated.

<comment><USER9> Nothing really is a natural right. Nature is not a lawmaker. All rights, rules, and laws are simply what we define them to be. The laws of physics are about the only absolute laws out there. Watch out for people using the word "natural". Whenever they mention this word, they use it to mean whatever suits them best. It's from the 101 guide to critical reading: the use of the word "natural" is a huge red flag for someone trying to sell you their politics.

It may seem natural that it is hard to make copies of physical objects, but just wait 10-40 years (depending on who you ask) until 3D printers become commonplace, and then reevaluate what you consider to be natural.

I'm not a huge fan of corporations like Disney; however, I have a feeling that we are not using the proper ammunition when we attack them based on what our idea of "natural" rights is. As a programmer, I feel that following logical rules should not be encumbered by patents. As an artist, I get pissed when someone tries to imitate me without proper credit, and I feel fully justified in using legal means to stop them. I guess this means that I believe (so far) that abstract algorithms should not be patentable while software implementations (which carry not just algorithms but also a cultural component) as applied to specific problems should be. I know some people try to make them both patentable -- I am against that.

<comment><USER10> >I guess this means that I believe (so far) that abstract algorithms should not be patentable while software implementations (which carry not just algorithms but also a cultural component) as applied to specific problems should be.

How do you distinguish between the two? If you come up with a revolutionary new cryptography algorithm and implement it in C, you would only be able to patent that implementation. If I came along later and merely re-implemented your innovation in Python, I could free-ride off your innovation without paying you a cent. Is that right or fair? I don't honestly know. What I do know is that its dreadfully hard to separate concept from implementation in a field as abstract as programming.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> Technology aside, I am having a hard time wrapping my head around the social implications of no web, even on a personal level. My husband, my boss, my two very closest friends, the nonprofit I volunteer with that means so much to me - those all started first as internet acquaintances that grew into real, offline relationships that span thousands of miles and have had a profound impact on my life and have shaped who I am - and I'm just one person.

</comment><comment><USER12> Not sure if the author of this piece actually witnessed what the Internet was like without the WWW. Or, more specifically, without NCSA Mosaic, which really jumpstarted the WWW.

My experience back then was that the Internet did grow exponentially even when the WWW was not yet popular. Much faster than Compuserve and others.

Also, the allegation that Linux wouldn't have happened is bogus since development of Linux actually started way before 1993/94 (when NCSA Mosaic made the Web popular).

<comment><USER13> I think Eric S. Raymond witnessed the pre-WWW Internet.

<comment><USER3> So did I. And I Commented and I think his essay is a parlor game. Amusing, annoying, but not to be taken seriously.

<comment><USER14> why not to be taken seriously?

There was a movement by AT&T to block research and implementation of internet or have you forgotten. In fact they wanted the infrastructure done their way not decentralized, etc. Than there was FIdonet, etc.

<comment><USER15> Because time does not go backwards?

The problem with counterfactual history is that history is nonlinear: The things which do happen affect the things that don't. In particular, it is very hard to write the future history of things that were squelched by larger forces before they could grow big. Squelched things are obscure. They are hard to research.

It's hard enough to write an _actual_ early history of, say, Apple -- much of it was witnessed only by a handful of people, and memory is fallible, and lots of traditions have obscure beginnings -- but how do you write the future history of the company that Steve Jobs would have started if Woz had decided to remain at H-P? It's like trying to predict hurricanes by tracking all the butterflies.

</comment></comment></comment></comment></comment><comment><USER16> >>Technological change has a tendency to look inevitable in retrospect – "It steam-engines when it's steam-engine time."

You would think so. But basically all parts of the steam engine where invented in Roman times (<http://en.wikipedia.org/wiki/Roman_technology>). Unfortunately, the empire collapsed before anybody found the time to put the parts together. If they had, we would... well, something.

<comment><USER17> Even earlier than that actually - the Greeks had both the differential gear and the steam engine.

There is pretty much nothing technological that would have prevented Athens from destroying its opponents with steam powered tanks several centuries B.C.

Plus at the time the standard tactic would be a deep phalanx, which would have been absolutely smashed by a tank driving over it.

<comment><USER18> Has anyone written an alternate history novel along these lines?

<comment><USER19> I happen to host the blog (among others) of an author who has written just such a novel: _Bring Laws and Gods_. It should be released some time this year.

<http://skepticlawyer.com.au/tag/bring-laws-and-gods/>

The historical point of departure is that Archimedes of Syracuse was captured, not killed, and brought back to Rome.

<comment><USER18> Can you gently suggest to him that his blog is really hard to navigate? I can't even figure out where to find information about the book.

<comment><USER19> It's a 'her'. Helen Dale.

I linked you to a blog category page; there's no "brochureware" as yet.

</comment></comment></comment></comment></comment></comment><comment><USER20> From the article:

 _The pretense being maintained was that only direct affiliates of government- sponsored, authorized research programs were being allowed on_

and

 _One such serendipity was the invention of the World Wide Web_

But that's contradictory - Tim Berners-Lee was a full member of an official research project when he invented the WWW!

</comment><comment><USER21> We'd have some damn fine Gopher browsers with 20 years under their belts.

</comment><comment><USER22> Tim Wu argues persuasively in The Master Switch and elsewhere that these things come in cycles, and that we're well on our way out of the cycle that led to an open internet, and into a cycle of consolidation and control (see: Facebook, locked down cell phone networks, net neutrality, etc).

<comment><USER23> At least in the quickly-expanding Android world, cell phone networks seem to be getting _less_ locked down, and this trend shows no sign of slowing.

</comment></comment><comment><USER24> Something like FIDOnet would have taken it's place as the hacker-aether. Linux would be alive and well.

</comment><comment><USER25> We have a pretty good idea of what would have happened without the us government developing the Internet: 1) compuserve, genie, aol, prodigy, et al. and 2) SMS messaging.

</comment><comment><USER26> The scenario presented here seems to mistake the Web for the Internet.

Before the Web was invented, Usenet (and to a lesser extent, WAIS and Gopher) was a thriving protocol, with relatively large numbers of people participating daily. Usenet was my first introduction to the Internet, and for years, it was to me what Facebook is to many people now.

There were MUDs where we spent many late hours engaged with other Internet users around the world, and yes, our email systems were on the Internet.

Thousands of independent ISPs were thriving before the Web came along, most having gotten their start as dial-up BBSes. Each provided access to a wealth of Internet services.

For that matter, hyperlinking was already commonplace in Gopher, and fairly mature in Hypercard.

CD-ROMs were introducing rich multimedia experiences before the Web came along, and it doesn't take much of an imagination to move from CD-ROMs and Gopher to something very similar to the Web we know today.

It's fun to imagine alternate dystopian histories, but the one described here is far-fetched, to say the very least.

</comment><comment><USER27> I don't understand how he got through this entire post without mentioning AIM, Facebook, Live.com, and Gmail, which are doing their damnedest to make his vision come true.

</comment><comment><USER28> hey i remember my 300 baud atari modem good times! - the web would have happened one way or another!

</comment><comment><USER29> Maybe what we know as the internet is a woefully inadequate imitation of what it COULD HAVE been. If only some influential people at DARPA could have done a few things differently, then technological advancment would have happened an order of magnitude faster, and we would already be a space faring civilization.

<comment><USER18> Why does an advanced internet automatically imply space travel?

</comment></comment><comment><USER30> The article is a little silly in that it pretends walled gardens don't already exist. To many people, the web is just Facebook and Yahoo Mail.

<comment><USER31> I don't think the web is Yahoo Mail to many people.

I think this might be a prelude to an attack on Facebook.</comment></comment>


Esoteric Topics in Computer Programming (2002) - <AUTHOR> http://web.archive.org/web/20020609152409/www.catseye.mb.ca/esoteric/index.html <comment><USER2> I've said it before and I'll say it again: go and learn Brainfuck. Just write a program that outputs your name or does FizzBuzz or something trivial, that's enough to get a grasp of it.

Brainfuck is to Turing machines what Lisp is to Lambda calculus. Minimum viable amount of syntactic sugar (and a bit of "semantic sugar" as well, it's nicer to work in bytes than bits) to make it usable as a programming language.

Lambda calculus is just a bit more practical formalism than Turing machines, that's why Lisp is genuinely useful as a programming language, unlike Brainfuck. That doesn't make learning about Turing machines any less useful as a brain teaser exercise.

<comment><USER3> >> Brainfuck is to Turing machines what Lisp is to Lambda calculus.

Indeed, the lambda calculus was never meant as a real programming language.

<comment><USER4> > Indeed, the lambda calculus was never meant as a real programming language.

In fact, not even Lisp itself was originally meant as a real programming language! McCarthy invented it as a notation for mathematical proofs, and one of his grad students thought it might make a good language.

<comment><USER5> Never knew that. That's a trip. Great accident to have in one's career given all that came of it.

<comment><USER6> [http://www.paulgraham.com/icad.html](http://www.paulgraham.com/icad.html)

Look for the section heading "Catching Up with Math".

<comment><USER5> That was a good read. Appreciate the link.

</comment></comment></comment></comment></comment></comment><comment><USER7> Chris' site didn't go anywhere, it just changed URLs: [http://catseye.tc/](http://catseye.tc/)

<comment><USER8> Thanks for the link!

However, it seems like the page linked in the post is not available anymore.

<comment><USER7> Well, you are talking about a gap of 14 years: the site's been reorganised since then, but all the content is still there.

</comment></comment></comment><comment><USER9> One of my favourite examples is the blank C program that won the "Worst Abuse of the Rules" award in the 1994 Obfuscated C Code contest (last entry here):

[http://web.archive.org/web/20020615054101/http://www.nyx.net...](http://web.archive.org/web/20020615054101/http://www.nyx.net/~gthompso/self_c.txt)

It's a Quine, a Palindrome and a Null Program all in one!

</comment><comment><USER10> I'm surprised no APL or its successors: K and J

[https://en.wikipedia.org/wiki/K_%28programming_language%29](https://en.wikipedia.org/wiki/K_%28programming_language%29)

[https://en.wikipedia.org/wiki/J_%28programming_language%29](https://en.wikipedia.org/wiki/J_%28programming_language%29)

</comment><comment><USER11> I'm disappointed LOLCODE [1][2] is not on the list. [1] [http://lolcode.org/](http://lolcode.org/) [2] [https://en.wikipedia.org/wiki/LOLCODE](https://en.wikipedia.org/wiki/LOLCODE)

</comment><comment><USER12> Can someone provide examples of programming forms, practices, or languages intentionally born esoteric that eventually turned mainstream? Nothing from this page popped out to me. It seems like sometimes an idea is so odd that it gets widespread attention just due to its oddness.

<comment><USER13> There's at least one on that list that's (at least in my experience) gone from relatively mainstream to esoteric - self-modification.

Back in the day when both memory and clock cycles were very precious, it wasn't unknown to use self-modifying code as a performance optimisation trick. I did it at least once in the late 80s, when I was working on comms software that had to be as fast as possible in order to avoid missing incoming data.

There was a check that needed to be done on every byte - I think it was whether I was now processing graphics characters or not - but the check was taking valuable time, and the value didn't change very often.

So the most efficient way I found to do it was to wait until I got a "switch to/from graphics" byte in the input stream and then update the instruction at a given location to either be "unconditional jump to graphics routine" or a "no operation (NOP)", which passed straight through to the routine for normal characters.

It was a horrible hack, but it worked.

Thankfully, I've not felt the need to even consider this approach for the past 20 years.

<comment><USER14> That eventually turned into JITs, and it's still a very powerful technique for tight loops on modern processors, although the pipeline means the benefit happens with more iterations than on the old non-pipelined/cacheless CPUs. It can even be done across multiple cores, as I coincidentally explained here a short while ago:

[https://news.ycombinator.com/item?id=12485205](https://news.ycombinator.com/item?id=12485205)

I don't think SMC has ever been "relatively mainstream", at least after HLLs gained popularity over Asm. But in Asm, it still has its uses where a full JIT would be far too much overhead.

</comment></comment></comment><comment><USER15> Missing from this list: FRACTRAN, a turing-complete language based on fractions, invented by John Conway.

[https://en.wikipedia.org/wiki/FRACTRAN](https://en.wikipedia.org/wiki/FRACTRAN)

</comment><comment><USER16> On the palindrome section:

> I'd like to see one where the entire code is executed, or one done in > Brainf*ck, as well.

I might be wrong, but this seems a really bad example for palindromes. Aren't all palindrome strings made of `+-.,<>` valid brainfuck programs? I know that this subset is not turing-complete, but I also think that any valid brainfuck program with `[]` can't be a palindrome, which again would make this language a bad example.

</comment><comment><USER17> No love for ternary computers?

<comment><USER7> You're looking for Malbolge: [https://esolangs.org/wiki/malbolge](https://esolangs.org/wiki/malbolge)

<comment><USER17> I was actually thinking in the Setun: [https://en.wikipedia.org/wiki/Setun](https://en.wikipedia.org/wiki/Setun) and DSSP. But thanks for the reference, I did not know Malbolge (though it looks like it uses the set 0, 1, 2 instead of the IMO more useful -1, 0, 1).

<comment><USER7> Malbolge (and Dis) are the classic ternary esolangs. I fiddled around with that in a long lost esolang back in the day.

Keep in mind that Malbolge is _meant_ to be awkward, so while (-1, 0, 1) might be more useful, (0, 1, 2) suit Malbolge's perverseness much better, though I doubt that was a conscious decision.

</comment></comment></comment></comment><comment><USER18> templeOS should be mentioned here :) (written by a genuine bigot)

<comment><USER2> Not to give excuses to his occasional behavior but he has his good moments. Some of his writings and interviews are pretty genious. Not to mention his projects, I sometimes enjoy studying them.

You gotta give him some benefit of doubt. He has a genuine, diagnosed mental illness. And even if he did say racist, misogynist and other derogatory things, some of it was years ago and he might have changed as a person (and hopefully for the better). The memory of the Internet is sometimes too long.

I gotta agree with him about one thing: computers are best when they have 16 colors (I spend most of my time in xterm with my favorite sixteen colors).

<comment><USER19> > And even if he did say racist, misogynist and other derogatory things, some > of it was years ago and he might have changed as a person (and hopefully for > the better). The memory of the Internet is sometimes too long.

While this charitable impulse is to be admired, I'm not sure "that was a long time ago and he _might_ have changed" is inherently exculpatory.

<comment><USER20> > exculpatory

........

<comment><USER7> It means 'tending to clear of charges'. Google (or a dictionary) is your friend.

</comment></comment></comment></comment></comment><comment><USER21> Funny how non-imperative programming languages, so for example FP, are in the "esoteric" group. Looking at the industry today it no longer seems to be true.

</comment><comment><USER22> Beautiful and lots of fun. Thanks for sharing.</comment>