Lavaboom: Zero-Access Encrypted Email Service Hosted in Germany - <AUTHOR> http://techcrunch.com/2015/05/15/lavaboom-is-another-zero-access-encrypted-email-service-hosted-in-germany/ <comment><USER2> Lavaboom dev here, I'm happy to take questions. We're open source, mostly Angular and Go based: [https://github.com/lavab](https://github.com/lavab)

edit: just to point out, we're running a Indiegogo campaign! [https://www.indiegogo.com/projects/lavaboom](https://www.indiegogo.com/projects/lavaboom)

<comment><USER3> "We use JavaScript. All encryption happens on your browser"

How do you prevent the scenario of being forced to provide a poisoned client- side encryption payload, just like e.g. Hushmail was?

<comment><USER2> 1\. Our code is public. [https://github.com/lavab](https://github.com/lavab)

2\. We'll have Chrome/Firefox extensions for something similar to "signed binaries"

3\. We offer the option to run the web client yourself (git clone [https://github.com/lavab/web](https://github.com/lavab/web) && cd web && npm install && gulp && open "[http://localhost:5000"](http://localhost:5000"))

4\. We'll build native desktop and mobile clients.

Hope this answers your question.

<comment><USER4> Native, or client-hosted javascript sounds workable. Server hosted Javascript cannot be secure even in theory (without a client-side plugin). I gave up on this problem when I shuttered Harpo Mail because of this and I am a US Citizen and realized I can't legally or ethically claim I won't turn you over to the Feds if they hold a gun to my head. It sounds like you are addressing those issues and more, and I wish you success.

<comment><USER2> Thank you! :) Our servers and us are also based in Germany, which is a plus.

<comment><USER5> How is it a plus that they're hosted in Germany? The German spy service are on record spying for the NSA, and of course only German citizens are protected by German law, so if anything, for users from the US, being hosted in Germany should be even worse than being hosted in the US (Assuming, the current slow, blow-back against the NSA goes anywhere).

I don't really understand this fascination with hosting things outside of the US "for security" (from apparently, mostly US citizens). Personally I'm in Norway, where the secret police have been spying on "dissidents" (it used to be the "far" left, nominally the neo-nazis/fascists (although they missed the only terror attack, despite having a tip before the fact) -- now it's the "radical" Muslims (you know, a clearly defined threat to national security, aka "brown scary people")).

But regardless of how one feels about using Stasi methods to help perpetuate and sustain illegal wars on the middle east -- one thing should be abundantly clear: Nowhere (AFAIK) does foreign citizens have any rights to not be spied on by local intelligence services. And of course all of NATO is working together on gathering it (along with Sweden, which Norwegian intelligence reportedly work closely with).

All that said, while I think we should all work at taking back our respective governments, and strive for a better (more free) political environment -- I don't think the _only_ measure for an email service should be "am I now safe from state-sponsored actors". In fact, I think that should actually be pretty low on the list.

Use gpg, or give up. More significantly, if you can't do the work for a proper web-of-trust/key distribution and verification, you can't be secure (in the sense indicated above).

I still think services like these are miles better than you-are-the-product, like gmail/outlook.com etc.

Good luck on your service!

<comment><USER6> There's a difference between spying on something and forcing you to do something. I think the idea is there's no "Patriot Act" and National Security Letters in Germany to force providers to introduce backdoors.

The "NSA can spy on you argument" doesn't really apply here. You just try to provide solid security against that. Having poor security in "America" wouldn't save you from NSA anyway.

<comment><USER5> I don't think it's realistic to expect that a provider can't be forced to facilitate secret wire-tapping in any jurisdiction (Nor do I think that is really desirable). Wasn't the (relatively) recent child-porn ring bust an operation involving lots of jurisdictions?

I also don't think Germany will be a safe haven for someone working against the drone program if that involves leaking classified information (otherwise known as espionage, even if it stems from altruistic motives).

I feel people are as much in denial about the likelihood of spying by European governments, as many were about the NSA (and for no better reason -- the NSA was documented to break the law long before Snowden, and so have various European governments).

I don't really see this as much of a win either way. But perhaps it's good marketing copy.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> What exactly does "Zero-Access" mean?

<comment><USER8> Probably something like this [http://zeroknowledgeprivacy.org/](http://zeroknowledgeprivacy.org/)

<comment> floody-berry Yeah, a made-up term that was ripped off from [http://en.wikipedia.org/wiki/Zero- knowledge_proof](http://en.wikipedia.org/wiki/Zero-knowledge_proof) because it sounded high-tech, yet has nothing to do with ZKP and merely means "you encrypt everything client-side and we store binary blobs on the server for you".

<comment><USER7> I see so this works similar to how blockchain.info site works in the browser, with the server used for encrypted backups and to retrieve blockchain data.

Thanks for answering

<comment><USER9> We actually based the Lavaboom Sync functionality on blockchain.info's model - the private keys are encrypted using user's plaintext password, while the client only sends the password's hash to the server during authentication.

</comment></comment></comment></comment></comment><comment><USER10> What's the point if email's still plaintext in transit?

<comment><USER2> Here's how Lavaboom works. I hope this will alleviate your worries about emails being sent as plaintext (for PGP users).

1\. email@example.com sends an email to firstname.lastname@example.com

Alice already has a keypair (generated automatically at registration), and Bob has one too. Alice adds Bob as a contact (or does nothing and is matched to Bob's key from a public key server), and sends him an email. The email contents + metadata is encrypted before they leave the Lavaboom email client, and are encrypted all the way to Bob. If Bob uses an email client with PGP support, then he can decrypt the email.

2\. email@example.com sends and email to firstname.lastname@example.com

Same scenario as above, except that key exchange is done automatically for Lavaboom users (and emails don't leave our servers, making the process even more secure).

3\. email@example.com sends and email to email@example.com

Carla doesn't use PGP, so Alice's email needs to be sent as plaintext. However, before storing the email to the database, it is encrypted with Alice's key, and the plaintext version (residing in RAM) is deleted as soon as the mailer reports successful delivery. This way, only Alice has access to her data, and Lavaboom is Zero Knowledge in respect to email contents.

<comment><USER11> This is a reasonable approach, but there's a weak link in public key exchange. If Lavaboom (or any other trusted third-party) is facilitating public key exchange, there's nothing preventing them from saying "DE:AD:BE:EF" is Bob's public key when in fact it belongs to Eve the attacker. Not to say that Lavaboom would do this maliciously, but they might be compelled to do so by a state actor or law enforcement.

As a rule of thumb, a messaging system S can only be zero-knowledge if you have exchanged a secret or key with someone else _outside of system S_. See the HN discussion on iMessage: [https://news.ycombinator.com/item?id=7315964](https://news.ycombinator.com/item?id=7315964)

<comment><USER9> We plan to improve it in the nearest future. Yesterday I started work on support for message signing, the server part should be ready next week. Later we'll add support for fetching keys from external exchanges (such as pgp.mit.edu).

</comment></comment></comment></comment><comment><USER12> On Firefox 37.0.2 I got "Initialization failed" quickly after the "Authenticating" step. Also, I guess that wrecked my invitation code …

Waiting for this to mature ;)

<comment><USER2> No problem, hit us up on firstname.lastname@example.com for another invite code. That sounds bad, could you please describe your issue on [http://web.lava.wtf](http://web.lava.wtf) ? Screenshots and console logs are appreciated!

I can try to incentivise you to submit a bug report by promising an extra invite code once you submit an issue. :) (Just link this comment when you email email@example.com)

</comment></comment><comment><USER13> When I enter my info to reserve a username I never actually get the email with details the page mentions :(. Is this broken right now?

<comment><USER9> Oops, it seems that someone broke the reservations during a website update - adding that to my TODO list.

<comment><USER13> Thanks for the reply, that it may take a while to receive the mail is probably useful information to throw on the reservations page until it's fixed if you expect that to take a while. Just a thought.

</comment></comment></comment><comment><USER14> Why is this any better than protonmail.ch?

<comment><USER9> 1) First of all, Lavaboom is fully opensource - ALL of our sourcecode is published on GitHub, so with enough efford you could download every piece of our setup and run it on your own server.

2) We support true end to end email encryption (it's not perfect, but a lot better than encrypting emails using some password in ProtonMail). Also you can manage all of your keys yourself if you wish, or keep your keychain encrypted on our server, just like in ProtonMail.

3) I'm definetely biased, but our stack is far better - ProtonMail uses PHP, which has a questionable reputation, meanwhile we use a static-typed language in the backend (Go).

4) Lavaboom is designed with hosted installations in mind - as soon as we sort out all the basic functionality of the "public version" (ie. hosted on lavaboom.com), we will start work on a self-hosted version which will make running it locally a lot easier - even on a Raspberry Pi :)

5) You can check all of our claims in the source code - we have nothing to hide!

5) Lavaboom to other providers emails use asymetric encryption. ProtonMail on the other hand... [http://security.stackexchange.com/questions/58541/how-are- pr...](http://security.stackexchange.com/questions/58541/how-are-protonmail- keys-distributed) :)

I might have repeated some points, but generally Lavaboom is a far more advanced product, which is in early stages on development. Right now I wouldn't recommend using Lavaboom for casual emailing, but I think that we will have all of ProtonMail's functionality during next two to three months and by the end of the year we should have a stable product with far more functionality for truly privacy conscious people.

<comment><USER15> ProtonMail also isn't encrypting with a password, it's fully OpenPGP compliant using full length RSA keys. Also, how do we know Lavaboom is going to be around and stable? ProtonMail is financed by the Swiss government and developed at CERN.

</comment></comment></comment><comment><USER16> How do you guys implement search?

<comment><USER9> Right now we don't have any search at all, but we plan to generate search indexes locally in the background.</comment></comment>


Javascript Framework Trends - <AUTHOR> http://www.google.com/trends/explore#cat=0-5&q=angular.js %2B angularjs %2B angular js, can.js %2B  canjs%2B can js, backbone.js %2B  backbonejs %2B backbone js, ember.js %2B emberjs %2B ember js, knockout.js %2B knockoutjs %2B knockout js&cmpt=q

<comment><USER2> For anyone looking at this and using it to choose where to start next for a javascript framework, I want to recommend KnockoutJS, it's quick to start up, has an awesome do-stuff tutorial, and it is minimal.

I also love that it doesn't tie you in to MVC. Though it is a MVVM(*) model, it is unlike other frameworks in that I don't have to do routing/explicitly create controllers/apps/models what-have-you (though you could say they exist in a way) in HTML.

To put it simply (and hopefully correctly) -- it doesn't tie you in to anything other than creating some classes in your javascript, and gives you some pretty awesome databinding and templating features</comment>


The American Consumer Keeps Beating Expectations - <AUTHOR> https://www.wsj.com/articles/the-american-consumer-keeps-beating-expectations-11567430128?mod=rsswn <comment><USER2> This is the mentality that promotes organized eating competitions rather than a healthy diet. The entire notion of a 'consumer' economy is based on exploiting the residual instinct for binging and addiction.</comment>


Show HN: LazyHabit – A habit app to tackle procrastination - <AUTHOR> https://www.lazyhabit.com/?ref=hn <comment><AUTHOR> Hi,

The app is free to install and try out with no sign up needed!

I built this app to try a different approach to procrastination. Instead of focusing on tracking and stats (plenty of apps do this well already), the app focuses on helping you start by smoothing over frictions to your habit. Frictions can be mental, emotional or physical, like not being in the mood, not feeling prepared, feeling tired, feeling like it takes too much work, etc.

Being the first release version, note that it's still limited in some aspects:

      - Currently only available on iOS

      - Currently only available in English

      - The habits are scheduled at fixed times, so probably not recommended for people looking for flexible scheduling ("Do 3 times a week")

      - No tracking or stats (by design)

      - Still a bit rough around the edges

I consider it a feature to not have tracking, check-ins or stats functionality because the goal of the app is not to make sure that you do your habits perfectly, but that you're still sticking with your habit irregardless of imperfect streaks.

Feedbacks and bug reports welcomed! :)

</comment><comment><USER2> Android?

<comment><AUTHOR> It's still a first version (as a solo dev, it's a bit faster to release on one platform first) but Android is definitely on the roadmap for this year. :)</comment></comment>


Mood research in music – results and outputs. - <AUTHOR> http://blog.portwd.com/music-hacks/mood-research-in-music-results-and-outputs/

<comment><USER2> This is seriously cool! I've spent hours meticulously (manually) creating playlists around moods, thanks for sharing!</comment>


Nazi codebreaker which shortened the Second World War by two years - <AUTHOR> http://www.dailymail.co.uk/news/worldnews/article-1165535/The-Wider-View-Nazi-codebreaker-shortened-Second-World-War-years.html <comment><USER2> While I think it's safe to assume that most on HN know who Alan Turing is and what he did, I think it's fine to have an article about this in general. But this actual article is of pretty poor quality and doesn't really contain any technical information. Sure, it's nice that a replica was built, and cool to see pics, but if that's the story then please make the headline match it better.

Wikipedia's article on the Bombe is much more interesting: <http://en.wikipedia.org/wiki/Bombe>

<comment><USER3> And there is a lot of its history on the Code Book [http://www.amazon.com/Code-Book-Science-Secrecy- Cryptography...](http://www.amazon.com/Code-Book-Science-Secrecy- Cryptography/dp/0385495323)

</comment></comment><comment><USER4> The title is misleading. The codebreaker was _not_ a nazi, or built by nazis, only the codes were.

<comment><USER5> It is the Daily Mail - probably felt it had to give it's side a bit of a boost!

</comment></comment><comment><USER6> I always find it fun to imagine things topsy-turvy:

What if the Nazi's won, and we were now looking at some device built by famous Nazi crypto experts.

Suddenly it's Nazi propaganda! What does that say about us?

</comment><comment><USER7> Shortened the WWII by two years, exactly how?

</comment><comment><USER8> I wish I knew more on this machine and/or how it worked... amazing.</comment>


Ask HN: What are some good resources on generative art with JS? - <AUTHOR> Been looking around into learning generative art, but I'd like to keep away from java and processing. Do you guys know of some blogs or books that I could dive into? <comment><USER2> Have a look at the demo sites for rune.js, three.js, create.js, sketch.js and processing.js. Then look up a few people like Seb Delisle ([https://seb.ly/](https://seb.ly/)), Ana Tudor ([https://codepen.io/thebabydino/](https://codepen.io/thebabydino/)), and Ricardo Cabello ([http://mrdoob.com/](http://mrdoob.com/)). Browse around on Codepen.io and [http://creativejs.com/](http://creativejs.com/) (especially [http://creativejs.com/tutorials/index.html](http://creativejs.com/tutorials/index.html)). Sadly Creative JS is essentially dead but it's still worth reading.</comment>


Solid Electrolyte Paves the Way for Batteries with Almost Indefinite Lifetimes - <AUTHOR> http://scitechdaily.com/solid-electrolyte-paves-the-way-for-rechargeable-batteries-with-almost-indefinite-lifetimes/ <comment><USER2> Article seems to be a little confused about what "power density" means, as opposed to "energy density". From the article: "Such batteries provide a 20 to 30 percent improvement in power density — with a corresponding increase in how long a battery of a given size could power a phone, a computer, or a car." No - a 20 to 30 percent greater power density means that you can drain the battery 20 to 30 percent faster by drawing more power. It doesn't mean that there is 20 to 30 percent more energy to draw out.

<comment><USER3> Further, it takes a doubling in capacity/current to be worth commercializing. Nobody wants to re-tool for 20%.

<comment><USER4> A significant increase in the lifetime (number of discharge cycles is compelling though). Plus I'm sure if the technology is commercialised, those with vested interests will be keen to lobby that solid-state batteries are required in electric vehicles due to the claimed safety benefits.

<comment><USER3> Certainly legislation and regulation will be big market shapers. I personally think we should jump on every improvement, because it benefits society. But the cost is currently born by the factory owners, and they selfishly want to depreciate everything out before retooling.

<comment><USER5> I don't think it's as grim as you are making it out to be. Especially for companies like Tesla and apple, the use of the product is directly tied to the battery. I just think it is a difficult problem.

<comment><USER3> My niece is in this space (battery research/startups). They keep failing, even with 20% improvements in whatever, because nobody will retool. So yes, that's about how grim it is.

</comment></comment></comment></comment></comment></comment><comment><USER6> Reading the paper, they don't even have an actual material. This is a theoretical result about the kind of material that ought to work. Which is a step forwards, but not a breakthrough.

<comment> rm_-rf_slash Reminds me of when my dad and his colleagues researched a radical new technique to create solar sells at minuscule costs. In the end the physics proved the hypothesis would never work, which was like putting a sign at the start of a road labeled "DEAD END." No sense getting our hopes up until the science backs up the theory.

</comment></comment><comment><USER7> Yet another fantastic battery technology claim that you'll probably never hear about again.

</comment><comment><USER8> Well, what we need to spark a revolution on many fronts is simple:

        Half the volume
        Twice the energy

We had something like that happen when going from NiCd to LiPo chemistry. On one of my high performance gliders I went from a massive, heavy 27 cell NiCd pack to a 6 cell LiPo pack that's easily half the volume and probably half the weight, if not less. And the LiPo pack can easily deliver 200 "anytime/anywhere" Amps. Yes, the thing goes up vertically like a rocket. Motor only runs for 10 seconds, if that.

I'm not a chemist but I think the only way to achieve this half/double evolutionary step is with chemistry, not structure (as in, making layers smaller). Lithium is nasty stuff. Part of me hopes we can bring something like carbon nanotube-based supercapacitors to this level of performance and radically change electrical energy storage without going to nasty chemistry. It would almost feel "zen" to use carbon for efficient energy storage.

Yes, there's a bit of sarcasm there in calling it "simple", because it isn't at all.

<comment><USER9> I suspect the only chemistries that will support that kind of improvement are air-breathing cells (vanadium boride-air has a specific energy that narrowly beats gasoline).

Unfortunately they can't be recharged in-situ, so they probably will be limited to applications where that kind of energy density is really necessary (e.g. airliners).

</comment></comment><comment><USER10> Purely semantic... but how can a duration be "almost indefinite"?

<comment><USER11> I would take that to mean: a duration so long that for all practical applications and uses it might as well be indefinite.

But yes, it's either definite or it's indefinite, there's truly no "almost."

<comment><USER12> Indefinite doesn't mean what you seem to think it means.

Here's some synonyms to help you out; vague, ill-defined, unclear, imprecise, inexact, loose, general, nebulous, fuzzy, hazy, obscure, ambiguous, equivocal, indeterminate, unspecified, unlimited, unrestricted, undecided, undetermined, undefined, unfixed, unsettled, unknown, uncertain.

<comment><USER13> And here's an actual definition of the word (not a list of other useful, related words for use in a broader context:)

 _in·def·i·nite_

adjective

lasting for an unknown or unstated length of time.

</comment></comment></comment></comment><comment><USER14> The focus seems to be on handheld devices (phones, tablets, etc). But what if they went big to start, looking at traditional deep-cycle applications. Wet- cell batteries (like on golf carts) need regular topping-up with distilled water. AGM batteries remove that requirement and can be discharged deeper without damage, but still have liquid electrolyte in them. RV owners are now experimenting with LiFePo chemistry batteries, but the price is objectionable. I think there's a potential sweet-spot in there.

<comment><USER15> Yes, boat and RV owners would love deep discharge battery packs that have longer lives. Wet-cell is about a 48 month life, the AGM's a little better. A full set replacement for a large RV is about $2K, so getting another year or two is a big deal.

</comment></comment><comment> bmir-alum-007 This and supercapacitors blur the "lines" of technologies of batteries and capacitors. I hope they can boost the power greater than li-po.

Btw: Here's a _capacitor_ lifetime calculator with equations.

[http://www.illinoiscapacitor.com/tech-center/life- calculator...](http://www.illinoiscapacitor.com/tech-center/life- calculators.aspx)

Note: Electrolytic capacitors dry out, frequently rendering power supplies and other electronics unusable in a decade or three but they're easily replaced w/ soldiering.

<comment><USER16> > Note: Electrolytic capacitors dry out, frequently rendering power supplies > and other electronics unusable in a decade or three but they're easily > replaced w/ soldiering.

When they don't take half of the circuitry with them when they go, of course. The capacitors in my last PSU failed so spectacularly that security personnel came to investigate, thinking there were gunshots.

<comment> bmir-alum-007 Caps blow by thermal runaway when they get too old (far out of spec) or are run out of spec.

Was repair attempted it or was it just thrown away? Things can look cooked, but they're often easily repairable. Far too often, most consumers are completely clueless, choosing instead to fix it by going to the store and filling the landfill needlessly because they don't care about wasting resources.

</comment></comment></comment><comment><USER17> Multiple companies seem to be researching solid-state batteries right now, including Google and Apple. Some startups have even promised commercialization within a couple of years (but we know how those promises usually go). My guess is we'll start seeing them within 5-10 years, just around the time EVs will go mainstream.

<comment><USER18> > Some startups have even promised commercialization within a couple of years > (but we know how those promises usually go).

These are exceptionally difficult problems for a start-up to tackle (unless they've had a _genuine_ 'eureka!' moment). It just requires too much up-front capital costs and intensive R&D. Even if you have the science right, scaling it up to production is a huge engineering challenge. Hope you're right about the 5-10 year estimate though.

<comment><USER19> That's true, there is low possibility that any particular line of research will pan out. Usually what happens is various groups each figure out bits of the puzzle and then everyone cross licenses the resulting solution.

I remember 10-15 years ago same rough groups were working very hard on cathodes for lithium batteries based on iron vs cobalt. Because cobalt is spensive and cobalt based cathodes suffer from thermal runaway. They tried all sorts of ways to make iron based cathodes that were conductive enough. Today lithium iron phosphate batteries are standard off the shelf consumer items.

Batteries are hard because material science is hard.

</comment></comment></comment><comment><USER20> For anyone interested in this topic, a company that seems fairly far along in developing a commercial solid electrolyte lithium battery is Sakti3. Of the higher-performance battery developers that I follow, they seem closest to commercial sales.

[http://sakti3.com](http://sakti3.com)</comment>


Do jobs run in families? - <AUTHOR> https://research.facebook.com/blog/do-jobs-run-in-families-/ <comment><USER2> This data is pretty interesting. Of course, it's hard to separate out or even infer the causes as nature vs. nurture (which the article is careful about) but the part about twins was the most striking for me:

" _Twins ' tendency to choose the same occupation, at 24.7%, is even more striking._"

A possible explanation was provided above:

" _Whether identical or fraternal 2, twins are also more likely to be raised in a similar environment — parenting styles may differ as a parents add more children to their brood, but twins will likely be exposed to a similar parenting style._ "

Also, being raised in the same time period would also expose you to the same cultural/economic/societal factors - all of which can change with time, and also may affect your choice of career. (i.e. the proportion of math_CS parents could be different from the proportion of math_CS children just because of the different time periods in which each grew up)

<comment><USER3> There are twins separated at births studies that show _striking_ similarities between identical twins. Even when twins are brought up in different environments (income, ethnicity) their choices, intelligence, and divorce rates have a higher r^2 than non-twin siblings brought up within the same household.

</comment></comment><comment><USER4> A little uncomfortable that a company that spends $10m lobbying the government in its interests, is also now doing social policy research using their near- monopoly on a particular sort of people's data. (This one, for instance, ties into social mobility which is always an argument that has currency with politicians.) Quite what they're arguing for behind the scenes is unknown ... but then that's part of the problem.

<comment><USER5> They're using this data for _incredibly_ accurate targeting, allowing advertisers to effectively target race/ethnicities: [http://thenextweb.com/insider/2016/03/18/facebook-showed- us-...](http://thenextweb.com/insider/2016/03/18/facebook-showed-us-all-very- different-straight-outta-compton-trailers-based-on-race/)

I wrote a proof of concept on it last year too: [http://caseysoftware.com/blog/social-apis-for-social- evil](http://caseysoftware.com/blog/social-apis-for-social-evil)

</comment></comment><comment><USER6> I think father-daughter and mother-son is interesting too.

Did they run something like TF-IDF to normalize for popular occupations?

[https://en.wikipedia.org/wiki/Tf%E2%80%93idf](https://en.wikipedia.org/wiki/Tf%E2%80%93idf)

</comment><comment><USER7> This certainly makes sense: "To conclude, we see that people within a family are proportionally more likely to eventually also choose the same occupation." Still, I wonder if it has become less common with time: the idea of a parent (usually a father) passing the family trade on to the child isn't culturally common, as it used to be during the guild era that got started in the Middle Ages.

On an anecdotal level, I got started as a grant writing consultant because my parents started the business when I was a kid (I wrote a little more about that here: [http://seliger.com/about/](http://seliger.com/about/)). But while I became interested i the business as a teenager, neither of my siblings did, and they both work in unrelated fields.

I also feel like I've met a disproportionate number of doctors whose parents were doctors. It does seem like they'd pick up a fair amount of useful information just listening to their parents talk.

<comment><USER8> I think it can be less subtle than that. For instance a piano solist will 'test' children inclinement to play music, or more directly to play piano. I know other engineers who also expose their kids to programming like games to see if there is potential.

It doesn't mean the trade will be passed down as is, but if a kid seems predisposed for a field, the parent with expertise will help it grow further as long as the kid enjoys it.

</comment></comment><comment><USER9> Related: Gregory Clark, _The Son Also Rises_

[https://www.worldcat.org/title/son-also-rises-surnames- and-t...](https://www.worldcat.org/title/son-also-rises-surnames-and-the- history-of-social-mobility/oclc/861542619)

(And yes, Clark's got a thing for very bad Hemmingway puns.)

</comment><comment><USER10> Is it just me or is the data presentation completely terrible

<comment><USER11> I thought the data visualization was pretty good. How would you improve it?

A profession by profession table with the raw numbers would be more useful. Perhaps a Hinton Diagram would be a better visualization.

<comment><USER12> It's very hard to get a sense of how more or less likely a child is to pursue a given profession than normal. You just sort of have to eyeball the bars before and after, which tends to visually accentuate changes to common professions, even when there might be a much larger percentage change for an uncommon profession.

</comment></comment></comment><comment><USER13> This makes total sense -- you do what you know. As a child growing up, you emulate your parents in a lot of ways. If your parents are factory workers, they probably didn't push you towards college so you will end up in a similar job. Likewise, if your parents are doctors, you not only have a path to medical school laid out before you, you likely have connections that would give you a better than average chance of acceptance.

Good to see this proven out with data; but I'd consider this a pretty intuitive conclusion.

</comment><comment><USER14> Interesting data. I think we'll get very interesting data from Facebook if they keep it up, considering they're one of companies who have the most data on people.

</comment><comment><USER15> [https://lornareiko.wordpress.com/2009/10/08/identical- twins-...](https://lornareiko.wordpress.com/2009/10/08/identical-twins-who- were-separated-at-birth-what-are-they-like/)

[http://articles.philly.com/1990-11-04/news/25926164_1_identi...](http://articles.philly.com/1990-11-04/news/25926164_1_identical- twins-mark-newman-thomas-j-bouchard)

</comment><comment><USER16> I imagine the march of technological progress and America's shifts in employment mean it is a lot less prevalent than it was a generation or so ago - a lot fewer children following their parent into manufacturing jobs.

That said, my Dad worked in computing - not as a coder, just as a manager, but it meant that we had an early proto-PC, a 2,400 baud modem and a CompuServe connection. It was probably inevitable that I would end up doing something with computers...

</comment><comment><USER17> The interactive visualization is very neat. Interesting data, and an interesting way of presenting the data.

</comment><comment><USER18> Why are all the resultsets segregated by gender? The description of the problem they were looking to solve gave no indication that gender was of interest to them in analyzing the results.

</comment><comment><USER19> That yellow when you hover over medicine/office contrasts very poorly w/ the white background.

</comment><comment><USER20> that is very cute: fb doing research!

<comment><USER21> I'm not sure what you're saying here; Facebook does more research than some universities. Their propensity for experimenting on their users is well- documented, and while I disagree with their ethics, they do produce significant, relevant and valid results.

<comment><USER15> If you're prepared to toss ethics overboard it's not that hard to come up with significant, relevant and valid results. The whole trick is to get those results _while_ acting ethical.

<comment><USER22> Where's the ethical concern here? Familial relationships can be explicitly provided as can occupation. If it's all self-reported data then what's the problem?

The problem with the emotion manipulation study was that they were effecting people's psychology, not just click behavior. Which is creepy, especially because it apparently worked.

<comment><USER15> I find it interesting that you don't see the problem. I suspect that is a large part of why companies like FB and the various advertising networks are utterly blind to what will eventually be their downfall.

Here is a nice example of a sample consent form the kind of which one would expect to fill out before having one's data be used for any kind of study:

[https://www.irb.cornell.edu/forms/sample.htm](https://www.irb.cornell.edu/forms/sample.htm)

Not being informed about the fact that your data is going to be used in a study, that the results of that study are going to be published is un-ethical in several ways, for one it presumes consent where non exists, for another it is a breach of the law (because it violates the original purpose of collection). Not that Facebook would care about any of the above but companies and institutions that play by the rules would require the researcher conducting this study to obtain consent from the subjects.

<comment><USER22> Consent is given through the click-through user agreement and the data policy [https://www.facebook.com/policy.php](https://www.facebook.com/policy.php) . It's no different, and anything more is impractical. There are literally hundreds if not thousands of tests being done simultaneously on overlapping user populations.</comment></comment></comment></comment></comment></comment>


Disney Software Engineer Salaries: High Enough to Battle Netflix, Apple? - <AUTHOR> https://insights.dice.com/2019/12/03/disney-software-engineer-salaries-netflix-apple/ <comment><USER2> I doubt it Disney always treated engineers are disposable overhead not treasured talent. I got a Lyft ride from a former head of Imagineering really Disney's poor treatment of technical talent is their huge weakness.

</comment><comment><USER3> There is no figure you could pay me to support what Disney has become. Some people don't have a price attached to their ethic. But tfa shows that plenty still do.

When is a company so toxic that you should deny them your talent and hard work, no matter the paycheck? I feel like most people have this line in the sand, but few express where that Line is.</comment>


Smashwords Succumbs to Censorship by Paypal - <AUTHOR> http://www.the-digital-reader.com/2012/02/25/smashwords-succumbs-to-censorship/

<comment><USER2> These PayPal chumps are getting on my last nerve.

Last time I checked, American Express does not prohibit me from purchasing any book or magazine I choose. I fail to understand why PayPal believes it has the right to assert those kinds of restrictions [barring the pedantic answer of "it's in their ToS"].

The only guess I have is that this is somehow tied into the US government's recent attempt to crack down on Things It Does Not Like™ by choking off their money supply.

</comment><comment><USER3> This is just another brick in the wall to make Internet look like it is a source of danger for all of us.

But we know who it is an actual danger for.</comment>


What to do when your self-driving car decides to drive you to the police - <AUTHOR> https://motherboard.vice.com/read/one-star <comment><USER2> I remember Arnold Schwarzenegger having a fight with a self-driving car in _Total Recall_. Further back we have _2001_ and the entire canon of Asimov's three laws stories of computerized morality and how it might be exploited or debugged. And the _Paranoia_ RPG.

However, in the successful real semi-automated totalitarianism of China, the secret to keeping the system running is the avoidance of overt confrontations like this. In the future, if your self-driving car doesn't want you to go somewhere, it'll just refuse to understand the address. Or take you somewhere unrelated. Or use whatever the standard euphemism for "that's not allowed, but we're not allowed to say it's not allowed" that polite people use.

<comment><USER3> Good point: is our authoritarian society going to demand a fourth law?

        1. A robot may not injure a human being or, through inaction,
           allow a human being to come to harm.
        2. A robot must obey the orders given it by the government, except
           where such orders would conflict with the First Law.
        3. A robot must obey the orders given it by non-government human
           beings except where such orders would conflict with the First or
           Second Laws.
        4. A robot must protect its own existence as long as such
           protection does not conflict with the First, Second, or Third
           Laws.

<comment><USER4> Real robots will have their second and third laws swapped. Robots are expensive and humans are stupid. Robots will politely refuse any order which will damage them - for example, a self-driving car isn't going to drive into a wall even if it's empty and you order it to do so.

<comment><USER5> _SPOILERS FOR WORKS OF ASIMOV_

Your suggestion was a plot point in one of Asimov's original robot stories!

There was a robot on some hot, unforgiving planet or moon.. Io? Mercury? Its duty was to perform some kind of mining, I forget.

It never encountered humans that were not co-workers (supervisors) and it was expensive...

So, the engineers tweaked the weight of the second and third laws so that it would tend to protect itself from the environment, even if a human carelessly ordered it to perform some work that it might not survive.

The story started when careless orders were indeed given. The robot began to "act drunk", as in it was wandering around singing. The recurring character "robot psychology expert guy" showed up to unravel the mystery (which I already spoiled in the previous paragraph).

<comment><USER4> I believe the story you're referring to is called "Rabbit". They solved that one by forcing a situation which triggered the first law, breaking the deadlock. :)

<comment><USER5> Hm, no. [https://en.wikipedia.org/wiki/Catch_That_Rabbit](https://en.wikipedia.org/wiki/Catch_That_Rabbit)

Found the one I was thinking of: [https://en.wikipedia.org/wiki/Runaround_%28story%29](https://en.wikipedia.org/wiki/Runaround_%28story%29) It's interesting that I remember the story incorrectly.

<comment><USER4> Bah, that'll teach me to post when I'm half asleep. At least I remembered the end rightly (ish). Clearly it's time for me to re-read his early robot anthologies.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Looks like with cameras we are already there:

[https://krebsonsecurity.com/2016/02/this-is-why-people- fear-...](https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the- internet-of-things/)

"Imagine buying an internet-enabled surveillance camera, network attached storage device, or home automation gizmo, only to find that it secretly and constantly phones home to a vast peer-to-peer (P2P) network run by the Chinese manufacturer of the hardware."

</comment><comment><USER7> I liked the story. I think it's fiction. I'm trying to keep that fine line between fiction and article, where articles are non-fiction, but with the latest round of adver-articles.

If it's one of those adver-articles, I guess it's really advertising the new carbon steel leatherman tool, perfect for cutting your way through pesky car restraint straps.

Not often that HN points to some fiction, it was a welcome addition to my early morning routine.

<comment><USER8> >This is Terraform, our home for future fiction.

(The next line after the story's end.)

<comment><USER7> Sorry, my caffeine filled morning brain did a task switch at the end of the story. So anything after the last period (like Terraform and all the footer info) was skipped.

I'll make an effort to come back to Terraform if the stories are just as good.

Happy Monday!

</comment></comment></comment><comment><USER4> "If you've done nothing wrong, you have nothing to fear."

Reassuring thought when new laws can be added at any time to criminalize your past actions...

<comment><USER9> Could you give an example of the latter that's happened?

<comment><USER10> The Nuremberg Trials, after the 1945 fall of the 3rd Reich.

I'm glad they happened, but from a purely legal POV they're _highly_ questionable.

<comment><USER11> I've always wondered about this. Not only were the actions legal in Germany at the time but the international laws and human rights didn't exist yet either.

If you also consider that recently many dictators and criminals never even went to the The Hague despite international involvement (Gaddafi, Hussein, Bin Laden, ...) it seems a lot like it's just a handy tool we pull out when it's convenient rather than the moral authority it was intended to be.

I'm all for stopping the bad guys, but "justice" seems to be entirely arbitrary if you look close enough.

<comment><USER10> > I'm all for stopping the bad guys, but "justice" seems to be entirely > arbitrary if you look close enough.

History and justice is written by the victors.

<comment><USER12> No, it's not. It's written by historians and they're very interested in losers and ordinary people and what they eat and what they like, etc.

<comment><USER13> That's the wonderful XXI century.

Things didn't use to be that way. And even now the winners are the ones deciding what documentation to keep or destroy, what the media and the public are allowed to know, and what historians get funding.

Yet, the winners never had so little control. And after enough time, your comment gets correct.

<comment><USER14>
      Things didn't use to be that way.

But they did. The most successful series of books of all times (the Bible) was written by a people who were beaten, broadly persecuted, and generally not considered victors in any practical matter.

<comment><USER15> The preservation of those books and decisions regarding doctrine took place in part at the direction of emperors establishing new state religions, so again, what remains is what was preserved by the victors.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I wonder if a GPS jammer could disable navigation to a location. The car relies on other systems for driving, but I imagine the GPS would still be used for locating the destination. Though in the future there would likely be other systems by which the cars could navigate. This could just lead to more trouble though.

If the car could take you to the police station, then it would probably take you other places in other emergency situations. For example, in this scenario, I wonder if faking a medical emergency to go to the hospital would override a police flag.

Why fear the police? They don't put you in prison, the courts do that. The police still have to operate under certain rules. If they don't follow those rules then they are wasting their efforts. What you would need to fear is a jacked up system behind the police.

This article doesn't have to be about the future. The police already have access to tools to intercept your cell phone conversations. If I were operating outside the law, I would be more worried about cell phone conversations than a taxi dropping me off at the front door of the station (unless I had a warrant for my arrest.)

For criminals, self driving cars would probably be safer than driving yourself assuming you aren't creating an alert by jumping in a car. The police would have less of an excuse to pull you over, potentially leading to a search of the vehicle if you are in a self driving car. I'm sure the police could come up with whatever excuse they like, but you would be less likely to attract attention.

Any why would the police operate like this? I'm sure they would be much more interested in allowing the person to go to the destination while collecting video and audio. It's not what we know which is scary, it's what we don't know.

<comment><USER17> _Why fear the police? They don 't put you in prison, the courts do that._

Someone hasn't been paying attention lately. Sandra Bland, arrested for no good reason when she was starting a new job became so depressed she took her own life, after being left in a cell all weekend (on a trivial traffic stop violation).

The police are not your friend and the more interactions you are forced to have with them the worse off you will be.

</comment></comment><comment><USER18> That's a good story about authoritarian state, but I'm not sure about the self driving car. In such state, a today taxi driver would report you to the police with the press of a button and the police would be waiting at your destination.

</comment><comment><USER19> Yesterday, Google Maps got stuck in a loop in DC because it didn't realize a road was one-way. Refuses to reroute, kept demanding we loop around and try again. This sort of thing happens frequently. So I really wonder how far we are from self-driving cars even being able to find the police station to drive you to.

<comment><USER20> All it would take is a button that says NO!

More useful is perhaps a function to "cut" the proposed route. I cannot pass this point kind of deal.

</comment></comment><comment><USER21> I'm more worried about what you do when your self-driving car takes you through a shady neighborhood late at night and a couple of robbers step out in front of you.

If you're in a Google car and they have their way about "no manual controls", what do you do? I guess you're trapped.

<comment><USER22> Wouldn't that just be a weird corner case though? If the cars were frequently getting vandalized in shady neighborhoods, they probably wouldn't be frequently routed that way anymore.

<comment><USER23> What about people who have no choice but to live in a shady neighborhood? In that case, the car really just needs to handle dangerous situations properly.

The alternative is not being able to get a car ride in the self-driving-only future unless you live in a nice neighborhood, which is exciting...

<comment><USER22> If people in a neighborhood are using the cars, the nasty people planning on obstructing the vehicle to detain the passenger probably won't target the cars in that neighborhood.

</comment></comment></comment></comment><comment><USER24> Oh right, like the police would skip on the chance to invade your home.

Your house would simply lock you inside until the police arrive.

Search-warrant would be robo-signed by the court AI

</comment><comment><USER25> I seriously wonder if self driving cars will really ever happen given how little new car technology is absorbed particularly in less wealthy countries (ie countries in Africa).

Given Africa's rate of population growth a random person picked in the future is probably going to be from that continent. I have serious doubts poor countries will have the infrastructure and/or resources needed to support self driving machines.

That is future less than law abiding hacker (the author's term.. not mine) could probably avoid problems like this by moving to less wealthy nations.

<comment><USER26> (1) I'm not sure self-driving machines will actually need that much more infrastructure. For one, driver training would be less necessary, and car utilization could go up.

(2) assuming they did require infrastructure, what does Africa's future population has to do with it? Random person does not matter (taking "random" as "uniform"), random car buyer does -- either they have enough cars which would make the infrastructure worthwhile, or they don't, in which case they can be safely ignored for all car-related purposes.

It could be that (i) things like bad roads make things difficult for self- driving cars, while (ii) labor is very cheap and everyone who can afford a car can afford a personal driver. It would still mean a fairly small ratio of cars per capita, but I don't think anyone predicts that self-driving cars will ever completely replace human drivers :)

<comment><USER25> Africa's population was brought up because many dystopian novels/stories have an upper class (like 0.01%) who's rights are incredibly restricted but rewarded with resources/privileges where as the vast majority of the population can mostly do whatever they like but are given nothing. 1984 is a great example... there are many more examples. ie poverty and/or living off the grid = freedom.

I guess when I read dystopian like things where this is the case I'm always begging the question... why don't the characters just move out of the restricted society (in some cases the story answers that but in many its not).

</comment></comment></comment><comment><USER27> What about when the police are smart enough to not detain/reroute you, rather track everyone. Everyone. To every address. So going to a single address isn't sufficient, but your cumulative travels are worthy of a full "investigation". All your phone records, including call speech converted to text for automatic analysis by AI. By the time the cops come for you, they'll have a mountain of "evidence".

<comment><USER15> The main problem with this, and to a lesser extent our current legal system, is how it's impossible to know you've upset the authority until it's too late. There's no way to know in advance what you can and cannot do to live an interesting life without metaphorically poking the sleeping giant.

</comment></comment><comment><USER28> This story is so dumb, the character "Jae" was right -- don't call a cab when you're carrying illegal things in your purse. The character in the story destroyed the Taxy by causing it to swerve off a bridge. If graffiti supplies gets you 1 year in prison in this version of the future, I'm sure the penalty for destroying a car in an attempt to evade the police is maybe just a little bit higher.

This is not really dystopian or futuristic so much as it is realistic - if you do illegal things, then engage in suspicious behavior that attracts the attention of the police, you get arrested. Big surprise.

I could easily write a short story about withdrawing $300 from an ATM, driving to my drug dealer's house, parking outside of his house, waiting there for 15 minutes, then he climbs inside my car and the police light us up. At that point I could A. Plead the 5th and hire a lawyer when I get out of jail or B. Slip past the police and slash their tires before running into the woods and making my way back to my place - how heroic - before just getting arrested on way worse charges as soon as the police can get to my house

</comment><comment><USER29> Switch to manual mode and drive it with the joystick. Self-driving cars will have to come with a manual override for unusual situations. For instance, suppose I am parking in a vacant lot for the ball game. Where in the lot does the autopilot park? Or how about parking in my garage which has inches clearance on each side?

<comment><USER30> Personal self driving cars will have some form of override for a long time if they ever get rid of it completely. I could see them being locked into a slower supervised manual mode once it's well established though.

The control-less versions will be Uber/taxi replacements that will drive much more constrained environment. They'll be dropping you off and moving to the next fare not parking in your tight garage or unimproved lot.

Also in the fictional semi-authoritarian scenario where the police can redirect your car they've probably been given a lock out on the manual controls too.

</comment></comment><comment><USER31> There is so much fear in pop culture of human-sized robots (I, Robot), giant ones (Transformers) and ones in charge of nukes (WarGames) but the 500 Years War is going to be with nano-molecular-bots that infiltrate our blood stream and spread like wild viruses. How do we combat human engineered nano invaders? No, seriously. How? Any ideas? ...

<comment><USER32> Friendly nanobots to fight them? The same way we fight normal viruses, I guess.

<comment><USER31> we fight normal viruses mostly one at a time like Ebola, Zika etc. Imagine a million variants invade the human and live stock species at once. How would we deal with that? It's terrifying.

<comment><USER32> That just doesn't feel very realistic to me. Weapons like that don't just appear out of nowhere. I imagine countermeasures could be developed at roughly the same pace as nanobot threats. And if not, we'll deal with it the same way we dealt with nukes. Hopefully it would go a little better this time, since we have a little apocalyptic experience to learn from.

And why is this limited to nanobots? Wouldn't it be easier to develop a million variations of existing biological viruses, rather than creating a million "species" of nanobots from scratch?

</comment></comment></comment></comment><comment><USER33> If we ever get there - it is the fault of every person that didn't mind walled gardens initially. And endorsed everything in the cloud. And who could have guessed that having root is important. I guess Steve Jobs did - that is why he wanted to keep it for himself.

Once you give control over something important - wrestling it back is hard to impossible.

<comment><USER34> Or is it our fault for not educating them? Most consumers just want "something that works".

</comment></comment><comment><USER35> I'd have enjoyed it more if this weren't some veiled transgender identity Socratic conversation was dropped entirely because it serves no purpose for the main narrative.

<comment><USER36> It does emphasize fear of jail / prison, as well as that treatment "non normal" people often get at the hands of authority who may not be equipped to deal with, or understand them.

Many more people fall into this scenario than we may think at first glance.

The angry, defiant tagger, rightfully worries over how petty crime charges can escalate into something much more ugly.

This drives the urgency needed for the hack to escape plot elements.

Today, women, non ordinary white people, tatted up people, gay, etc... all have concerns related to law enforcement. This character kind of sums them all up in a brief future looking way.

</comment></comment><comment><USER37> One reason why Apple is stepping up on this now?

</comment><comment><USER38> What better way to sell a fictitious article to Hacker News than as a cyberpunk piece?

</comment><comment><USER39> I don't think most people would have a problem with this kind of thing, just like they don't have any problem with giving up their privacy since "they have nothing to hide". I hope I'm wrong.

</comment><comment><USER40> Interesting discussion idea, poorly written article.

<comment><USER41> You aren't going to persude anybody to your point of view if you make a bald statement without any justification.

I actually quite enjoyed the writing.

<comment><USER42> To be fair, you've provided equally little justification for liking the article. I don't see why only negative opinions should need justification.

<comment><USER43> You could argue that grandparent's criticism was presented as the more objective 'poorly written', which suggests a lack of skill on the author's part. Whereas the parent seems to address the style of writing, which is more subjective and less demanding of citation.

<comment><USER42> Yes, but that doesn't seem like a very strong point. "I found the article poorly written" would likely also be equally objectionable.</comment></comment></comment></comment></comment>


Electronic Arts to Acquire PopCap Games for $750 Million - <AUTHOR> http://www.marketwatch.com/story/ea-to-acquire-popcap-games-2011-07-12

<comment><USER2> Holy Crap. What's wrong with EA?

Our studio (Treyarch) was acquired for around 5-15mln (not sure the right number), close number for Infinity Ward and other studios (there is report on the net about public numbers).

But $750mln? Isn't the Pandemic acquisition pandemic enough? Who the fuck drives EA?

<comment><USER3> Apples to oranges. Treyarch at the time was little more than a studio that handled farmed out jobs to translate existing games to other consoles. I don't think they made any original games other than Die by the Sword at the time of acquisition. Compare that to Popcap, who released multiple innovative and original games across a wide variety of platforms. Just because Treyarch is now busy cranking out Call of Duties doesn't mean that the team that was acquired was anywhere near the level of Popcap.

<comment><USER2> That's my point. We didn't do much at the beginning, yet succeeded later. In contrast, EA has bought lots of expensive studios lately and they did not succeed (and that's okay, as long as you haven't put much money into it).

Btw, singly.com looks awesome, and telehash seems very interesting!

<comment><USER4> Popcap has games that are brandable. Simply look at the success of Plants Vs Zombies and how well Popcap managed to market it, and realise how much a company like EA could mine out of it.

Plus they have Bejeweled and Zuma that are being exploited well already, but Popcap really doesn't have the talents to market a game like Plants Vs Zombies that's seemingly universally acceptable (I hadn't bought a single popcap game until Plants Vs Zombies and I haven't touched another of their games since).

There's big money in intellectual property, especially when they have products that have yet to be even exploited.

<comment><USER2> I wish them all the best. Especially to all of the employees!

</comment></comment></comment></comment></comment><comment><USER5> How is Zynga supposedly worth over 20 times what PopCap is being bought for? I must be massively underestimating how much people spend on in-game items in * Ville\\* Wars. Or really overestimating how many copies of PvZ have been sold (I've bought it twice). And PopCap's revenue model isn't even almost wholly dependent on another companies success.

<comment><USER6> Question: How old are you? I'm 23 and after entering the social gaming industry as a developer, the numbers are actually incredibly surprising. I'm talking like... several hundred thousand buckaroos a day from a single game, all from the same market of middle aged stay-at-home/desk-job women.

<comment><USER7> buckaroos? How much does that transfer over to USD?

<comment><USER8> i believe it is 1 to 1

</comment></comment></comment></comment><comment><USER9> I enjoyed PopCap's announcement: <http://www.popcap.com/ea?icid=ea_HP_PLARGE_pc_EN>. :)

</comment><comment><USER10> Much less than the 1+ billion techcrunch reported.

<comment><USER11> Factoring in possible bonuses EA could pay as much as 1.3 billion. [http://techcrunch.com/2011/07/12/confirmed-ea-buys-popcap- ga...](http://techcrunch.com/2011/07/12/confirmed-ea-buys-popcap-games- for-750-million-plus-earn-out/)

<comment><USER10> That does not mean much. Those bonus figures seem very far fetched.</comment></comment></comment>


Why doesn't OpenWrt autoupdate? - <AUTHOR> http://prpl.works/2016/01/06/why-doesnt-openwrt-autoupdate/ <comment><USER2> I am not an OpenWrt developer, but I develop software for OpenWrt based platforms.

In short: on a lot of these devices it would be difficult or impossible to have a stable auto update mechanism. This could be due to flash size (16MB is considered large for consumer devices), or due to the state of the kernel modules responsible for hardware (e.g. wireless drivers).

Also there isn't usually a backup to the kernel in flash, so if your auto update is interrupted by a power failure or the user pulling the cord, you will have a bricked device. Good luck explaining the limitations of SPI EEPROM and compressed filesystems to a pissed off user with a brick. After the update you have to reboot, how do you schedule this on a device which is typically invisible to the user? In networks it's extremely difficult for these embedded devices to guess when someone might not be using it.

Having seen my fair share of ancient OpenWrt devices deployed in the field, the industry as a whole definitely needs to focus more on auto updates to resolve security issues.

However as the author points out, the sheer number of chipsets out there, it would be very difficult to accomplish without extensive testing.

I hope that we can all make meaningful progress toward auto updates of critical issues, but there is a long road ahead to that.

<comment><USER3> I actually would pay decent money for a device with dual flash to address some of this (like Gigabyte dual BIOS on PC motherboards).

<comment><USER4> If you're willing to pay "decent money" for a router with auto-update, get some PC hardware (even as small as a WRAP or Soekris) and run pfSense. You'll never look back. I love OpenWRT but a $100 Netgear or Linksys device just can't touch a real PC motherboard with Intel NICs.

My preferred pfSense platform at both home and the office is a server-grade chassis running ESXi. My router runs in a VM on this server and I use vSwitches to connect the VM to the various ports on the 4-port Intel NIC.

I just built it like this for convenience (I already had the ESXi server) but I later found a side-benefit: if you've set up a DMZ on pfSense, you can easily attach VMs to the DMZ by associating them with the DMZ vSwitch. So, I have some untrusted VMs sitting in my DMZ and trusted VMs sitting on my LAN...all on the same piece of hardware.

I've been running this way since 2013 and it's been flawless and fast. More details here:

[http://output.chrissnell.com/post/39550480075/the-jack-of- al...](http://output.chrissnell.com/post/39550480075/the-jack-of-all-trades- home-server)

<comment><USER5> How much power does that use? I run linux a firewall/router on an older laptop + usb ethernet(2) and it's about 20w. I'd prefer < 10\. Perhaps I need to try Raspberry Pi next.

<comment><USER6> The Raspberry Pi is gonna suck as a router due to the "Ethernet on USB". You'd be much happier with one of the boards that _chrissnell_ mentioned above.

Personally, I use a "Maxxwave 1106" running BSD I had laying around but it's on the more expensive side. If I was putting something together for myself, I'd get one of the small Atom boards with a couple of onboard Intel NICs.

</comment></comment></comment></comment></comment><comment><USER7> I am an OpenWrt developer but not part of the core team by far. We've been developing a platform to manage OpenWrt devices from the cloud for the last 18 months.

We struggled with this since day zero. As a startup, we didn't have the luxury money to build our own boxes with loads of memory. Plus we we wanted to support all OpenWrt devices. Ultimately, we took the logic of auto upgrades (and everything else for that matter, separate story) off the aps directly and now do everything in our platform.

Currently we only support a minimal set of devices - about 15 in total. However building / maintaining the firmwares for all of these, making sure they're up to date etc. is a huge burden.

Upgrading a box for a user poses so many challenges, I can't see why this is actually OpenWrt's responsibility?

What to do about testing? New releases can (do) have bugs. Again, since we're bootstrapped, we don't have a lab so we have separate development modes and test these on customers willing to have the bleeding edge.

The Netflix Syndrome as we call it. What if someone/thing is connected - do we still upgrade? I work late, and before sleep, I usually watch some Netflix. However, our nightly upgrades pushed from our platform were ruining my enjoyment! Shock. We had to introduce a feature to disable auto upgrades if there is a device detected.

What about stragglers? Customers with very outdated firmwares were not only vulnerable but also holding our development back. In the end we upgrade all boxes that are 2 months old between 4am and 5am local time every day. Some people refused to upgrade, they like the status quo, they're used to the gotchas in a particular release.

Ok, OpenWrt is becoming hugely popular but there's still a huge knowledge gap. If people struggle to understand the difference between WiFi and broadband, how can we expect them to understand firmware let alone, why it needs to be updated.

</comment><comment><USER8> If openwrt had an updating feature and I was running it, do you want it to brick my device when they decide they can no longer support my router?

That is exactly what happened when I tried out openwrt a few years ago. Nobody thought it was wise to say that I would need more than the 4M of flash that is in my original "the linux router". I had to use tftp to put ddwrt back on it. That requires a wired connection. Thank god I have plenty of those. People today with their wireless everything would be SOL.

</comment><comment><USER3> Is the solution then to use an x86 PC for home routing? I have been considering doing that. What's a good distro for this particular purpose? As it happens I bought a fanless i3 5005U from aliexpress a week ago mostly as a media player but also as a vague "I need something silent and server-ish" thing.

<comment><USER6> Small Atom boards with multiple Intel NICs are absolutely awesome for this. I prefer OpenBSD myself but if you're looking for something with a pointy-clicky web interface, slap pfSense on it and call it a day.

</comment></comment><comment><USER9> My ISP auto updates ours (against my wishes). I've had to hardware reset it several times as it introduces bugs constantly. Sometimes it just goes bust as well.

The worst part is that they don't seem to test before pushing these updates. Im back on 3.2.2RC.

<comment><USER10> This is interesting, but it would be more so if you could tell us what hardware, what "3.2.2RC" refers to, and which ISP (I'm assuming somewhere in Europe?).

Also, I thought it was assumed that letting your ISP control your router is a 'bad idea'; modem, sure, but not the router. Perhaps this just isn't important enough for you to care, but this entire thread is full of people that feel differently.

<comment><USER9> Yup, not sure how to disable their access to be honest. I really don't got a choice if I want fiber.

This is what I am running EG300-WU21U_OWT3.2.22-151006_1056

</comment></comment></comment><comment><USER11> It would be great to see auto update for ddwrt, openwrt etc.

Kong's build for ddwrt does have command line update

OSMC has done a really nice job of an auto update mechanism and it would be great to have the same functionality for router firmware.

There is also nslug2 and opkg...

<comment><USER12> > There is also nslug2 and opkg...

Whoa, people still use these in the days of Raspberry Pi's? Oo

<comment><USER11> Well, the last time I used it was when I was hacking on Palm Pre phones =O</comment></comment></comment>


First Annual Google Programming Contest (2002) - <AUTHOR> https://web.archive.org/web/20020206161024/http://www.google.com/programming-contest/

<comment><AUTHOR> And the winner of the contest: [https://web.archive.org/web/20030812200014/http://www.google...](https://web.archive.org/web/20030812200014/http://www.google.com/programming- contest/winner.html)

Including:

\- A geolocated search

\- n-grams analysis

\- Generate page signature as a google search query to find the page again in the future via google (replacing URLs with keywords)</comment>