curl | sh - <AUTHOR> http://curlpipesh.tumblr.com/ <comment><USER2> Note that dowloading an app (.exe for windows, or an apple app) and running it, is just as bad. Downloading an installer, and running it, is also insecure. So the question is... What is the proper alternative?

I think the best alternatives are appstores such as found on ios and android, right?

However that doesnt really fit for open source. Is the way to install open source software, to download the source and compile it from scratch? Well, thats also risky, you should check the source code first...? But thats undoable.

All in all, it comes down to "trust". Do you trust the website? You dont care about security too much, well, imho then it makes sense to curl | sh.

<comment><USER3> No it's not because MSI packages and EXEs are signed so there is at least a chain of trust. SmartScreen kicks you in the face if it's not "known" by various metrics and it's hard to get around that these days (as someone who just had to get EV certs for their MSI). If you click through that, and you don't know what the source was then you're a muppet.

curl + bash is suck and blam the machine. Hope you didn't do a sudo in the last few seconds...

[http://www.nastybastard.com/funky-super- installer.sh](http://www.nastybastard.com/funky-super-installer.sh):

       #!/bin/bash
       echo "mwuhahahaha"
       sudo rm -rf /boot

<comment><USER4> > No it's not because MSI packages and EXEs are signed

Sure, some are. But most software packages that a user is going to download aren't signed.

<comment><USER5> Right. And really, who checks signatures?

I'm a developer and I don't think I've every checked an md5 signature of a jarfile/gem/package I've downloaded. Nor have I ever been in an environment where that was ever mentioned. (Have mostly worked in small to medium businesses--I imagine that bigger orgs or the defense department might do this.)

</comment></comment></comment></comment><comment><USER6> I sense that the reason these kinds of things are growing in popularity is that there is a command-line renaissance occurring among certains kinds of developers. I'm guessing that about half of these pages are used principally by Ruby/Rails crowds, for example.

This is a natural outgrowth of Rails itself which expects even the novice dev to do everything from the CLI. I also notice a certain amount of machismo surrounding this sort of thing, which means that the novices are that much more likely to blindly install things, in spite of the more senior devs blandly insisting that they should "read and understand the script before running it." This is ironic because of course they are novices and learning how to do a security audit on a random bash script is a non-trivial affair, to put it most charitably. It's also ironic because Rails is supposed to be all about easy and convention, not auditing everything for oneself.

The designers of OSs did not have in mind non-experts using the CLI with su turned on (or even off) all the time. In fact, user-friendly OSs are designed to prevent non-experts from doing any damage, anywhere. In all, it seems like this sort of thing is circumventing basic protections provided by experts for non-experts, and that is probably not something to encourage.

<comment><USER7> 1\. These script-based solutions generally work across a variety of platforms where compiled executables would need to be customized.

2\. They give an easy way to automatically download and install a tool in one pasteable command without having to manage downloads and deal with the inevitable extra UI of installer executables.

3\. Why does one need to understand what a script is doing any more than one needs to understand what a downloaded installer executable is doing? At least with the shell scripts it seems like more of an option.

</comment></comment><comment><USER8> I don't see how this is less secure than downloading a program and running it. Or downloading some package that asks you to run an install script.

People will see no problem with curl | sh as long as they feel they can trust the source/site asking them to do so. They will be running the same risk as with downloading binaries or install packages.

<comment><USER9> Exactly. This is little more than cargo culting.

<comment><USER10> I'd at least save the script somewhere so i can audit it if something goes wrong after i run it.

</comment></comment></comment><comment><USER11> Yeah. Of course nobody bothers with providing an installation guide that could be used to build RPM/DEB packages. Because everybody runs `curl | sh` on production machines to install random software.

</comment><comment><USER12> Previously:

[https://news.ycombinator.com/item?id=2420509](https://news.ycombinator.com/item?id=2420509)

Nate Lawson's comment in particular.

<comment><USER13> [https://news.ycombinator.com/item?id=2421012](https://news.ycombinator.com/item?id=2421012)

Sadly, it had become more popular since you posted that comment.

</comment></comment><comment><USER14> My thing with piping curl to a shell was always that a severed connection will run a partial script, which can have weird consequences. I wrote about it awhile back:

[http://blog.seancassidy.me/dont-pipe-to-your- shell.html](http://blog.seancassidy.me/dont-pipe-to-your-shell.html)

<comment><USER15> Would something like

        curl http://google.com/keylogger.sh > temp.sh && sh temp.sh

work?

<comment><USER13> More like:

curl [http://google.com/keylogger.sh](http://google.com/keylogger.sh) > temp.sh

less temp.sh # actually read the fucking thing

sh temp.sh

rm temp.sh

<comment><USER15> Somewhat inexperienced with linux/unix. What's the purpose of "less temp.sh" here?

<comment><USER16> less is to view the file. It is interactive and safer than cat - the latter because less (by default) strips out terminal control characters.

</comment></comment></comment></comment></comment><comment><USER17> Here is another curlpipesh: [https://fixubuntu.com/](https://fixubuntu.com/)

<comment><USER13> Except, that one shows the full source so you can copy, paste, review, and save it instead.

<comment><USER18> You can do that for all of these, just request the file directly and copy it out of the browser.

</comment></comment></comment><comment><USER19> It's obviously somewhat prone to failure, as the script can't possibly work in every environment. But other than that as long as it's over https is there a security issue?

Obviously, a better alternative is a package manager, pulling from a repository for which you have gpg keys installed (such as Debian provides). But that's not always an option.

Even checking out a git repository and building from source seems as bad a curl | sh to me.

<comment><USER20> Both curl|sh and git checkouts tend to end up in production deploys so it's interesting to compare them.

Both introduce a point of failure if the remote host becomes unavailable and you need to deploy new machines.

The curl|sh method is vulnerable to change from the maintainer or any attacker who gets access to the storage layer. git is also vulnerable but requires a collision attack on SHA-1.

<comment><USER19> If you're running it in production then that's a problem. But I'd dare say that relying on an external "apt-get install xxx" is pretty bad practice in production (to deploy new machines).

<comment><USER20> I agree but most companies I know don't have the infrastructure or best- practices in place to avoid it. Copy-pasting the curl|sh is very low effort and will predictably end up in deploy code (if you have any).

</comment></comment></comment></comment><comment><USER21> `curl ... | sh` installations don't really bother me. The scripts tend to be short and commented, or at least readable. Sure beats running an opaque .pkg installer, which invariably asks for your password (presumably for no reason) and installs god-knows-what all over your hard drive.

<comment><USER22> Generally, yes, but some package managers have code-signing support, which means if you trust the authors, you can avoid potential hijacks.

At the end of the day, though, you're always going to trust someone with something.

</comment></comment><comment><USER23> At least most of the examples are using https.

<comment><USER13> Mojolicio.us is a good counter-example. Unfortunately, they're not on the Tumblr yet.

<comment><USER24> Unfortunately the default way of installing Perl modules (cpan command line tool). is just as insecure as curl | sh - Note that we have added an example of securely installing Mojo on the homepage as well, if you have configured Perl for signature verification - [http://mojolicio.us/](http://mojolicio.us/)

</comment></comment></comment><comment><USER25> What I do is simply copy the `curl foo | sh` oneliner into a text editor which does not run in a shell, and then copy the line from there into the console. This does not save you from downloading the script and actually auditing that it does what it should.

</comment><comment><USER10> I think not saving the script somewhere first makes it worse, You can't go back and inspect what it has actually done in the worst case scenario. To install rust the other day and had to read the whole script to be sure.

</comment><comment><USER26> Most of these are downloading stuff over https, and sometimes from GitHub, so it really offers superior security to most AppStores and (signed) installers (as you can even look at the source, if you want to).

<comment><USER13> "superior security"?

If I can hack the endpoint (or the server that handles the 301 redirect to github), game over.

<comment><USER27> That goes for every software you install. The only solution is to not install any software. And then hope that the preinstalled software on your device is OK:

<comment><USER13> OR

I could verify an asymmetric cryptographic signature based on a public key I already possess. As long as the private key is not stolen, an attacker who can breach the server cannot backdoor the software I'm downloading.

<comment><USER26> Which is exactly the same as you verifying the public HTTPS key of the server you're downloading the software from; in reality, the only thing that differs is the server you're targeting (the compilation server, v.s. the downloading server).

<comment><USER16> The downloading server is necessarily public facing, and the key is necessarily unlocked during operation. In a sense that's a difference in "the server you're targeting", but both are points in favor of pushing that to the compilation server.

</comment></comment></comment></comment></comment></comment><comment><USER28> I normally do a curl | less before doing a curl | sh and take a quick peek. Not perfect, but at least it's a step in the right way. Like someone says, it's a matter of trust (but verify).

<comment><USER29> As already mentioned, save to disk first to avoid network connection failures messing you up. To avoid an extra command use "tee" to output to file while viewing it (i.e. it's "less" and ">" functionality combined).

<comment><USER16> _' To avoid an extra command use "tee" to output to file while viewing it (i.e. it's "less" and ">" functionality combined).'_

That's undesirable. First, because you should be making the decision about whether to run the script after you look at it, and if it's already running while you read it then it's probably too late. Second, because you should not be echoing possibly-malicious characters to the terminal - view with less or an editor, tee works like cat here.

<comment><USER29> "First, because you should be making the decision about whether to run the script after you look at it" \- exactly, which is what my suggestion is. All I'm suggesting with tee is that it allows you to read in terminal what you are writing to file in the same command. The OP was downloading the script to view in less, and then _downloading it again_ to execute. This method at least ensures that what you view is what you are going to execute but ...

"Second, because you should not be echoing possibly-malicious characters to the terminal" \- this is something I know nothing about, so I would be (and maybe others) highly appreciative of any links about this class of attacks that you could post. Is it possible to execute malicious code while writing to STDOUT, or is it because you can hide malicious code with escape characters? Also, I don't quite understand the "cat" comment as we're not doing any file concatenation here?

<comment><USER16> _" All I'm suggesting with tee is that it allows you to read in terminal what you are writing to file in the same command."_

Gotcha. That makes more sense.

Regarding the second, I don't know whether there are presently any attacks in the wild for any commonly deployed setups (if anyone else does, I'd love to hear about them) but terminals are incredibly messy beasts once you start to throw nonprintable characters at them. Better not to expose that surface area.

</comment></comment></comment></comment></comment><comment><USER13> [https://github.com/composer/getcomposer.org/issues/76](https://github.com/composer/getcomposer.org/issues/76)

</comment><comment><USER30> What's the worst that could happen? It's only PHP. [https://apigility.org/](https://apigility.org/)</comment>


Small retailers who sold through Amazon are facing a tax time bomb - <AUTHOR> https://www.latimes.com/opinion/editorials/la-ed-amazon-marketplace-taxes-20190501-story.html#nws=mcnewsletter <comment><USER2> "As unfair as it may have been for out-of-state retailers to avoid the sales tax burden"

This article blames the retailers, but they are just going to be a pass through. The consumer will be paying more.

Taxes imply I'm getting services from the government. If I'm a retailer with a warehouse in Ohio, what service is the government of California paying for? This sounds like a money grab to me.

It also requires small retailers to know the tax code of any state that requires this, which is ridiculous.</comment>


France's contact-tracing app uninstalled by nearly half a million people - <AUTHOR> https://www.telegraph.co.uk/technology/2020/06/23/frances-contact-tracing-app-uninstalled-nearly-half-million/ <comment><USER2> Assuming 1 million users of the app, between 3 and 9 users catch the virus per day. There won't be many warnings issued since so few people have the app the number of recorded contacts is going to be low for the same reason.

This highlights is what had already been said about tracing apps: They must be used by a significant majority of the population, and individuals should not have to take action to trigger warnings beyond being tested.

If anything this strengthen my belief that these apps will end up being most useless because of they are deployed too late, they are not installed on enough devices, and users have to take active actions/data are not immediately available to authorities.

</comment><comment><AUTHOR> > Even with more than a million people still running the app, just 68 people > who had become infected with coronavirus reported their symptoms to the app, > resulting in 205 warnings being sent to other users....

205 warned users out of more than million users doesn't strike me as very efficient.

<comment><USER3> Well, that's 205 warninga that would have otherwise not being sent

Sure far from efficient, but overall good

I'd like to know how has the south Korean app faired and if south Korea has forced certain features of the app into the user such as constant location tracking

<comment><USER2> In Korea I believe that people who have tested positive have their smartphones directly tracked by the cellular network with alerts automatically issued if the device leaves the person's home.</comment></comment></comment>


Onboarding is Broken – Some Amazingly-Painful Statistics... - <AUTHOR> https://medium.com/try-tomo/onboarding-is-broken-d509875eed26#.3b8a7d1o8 <comment><AUTHOR> Love to hear "war stories" or any suggestions on how to make employee onboarding better...!</comment>


Top 10 facts about domes - <AUTHOR> http://www.biodomes.eu/Why-domes.php <comment><AUTHOR> Top 10 facts about domes

1\. Domes are the strongest human shelter ever conceived. The even distribution of weight is how domes efficiently distribute stress along the entire structure.

2\. They are the world's highest earthquake resistant structures. And they dont require any interior load bearing walls.

3\. Domes are aerodynamic. They can withstand hurricane winds of even 320 km/h.

4\. Domes are the most efficient structures known to man, covering the most living area with the least amount of surface area.

5\. Because of the high volume-to-surface-area ratio domes have at least 30% less surface area than other shaped buildings. That means it takes at least 30% less energy to heat or cool them.

6\. The spherical design results in highly efficient and effective air circulation. The ambient airflow inside the dome is continuous, with no stagnant corners, requiring less energy to circulate air and maintain even temperatures.

7\. They mirror the suns path thus maximizing solar gain all day, all year.

8\. Some of the largest buildings in the world are domes; London's millennium dome and the Eden domes were record breakers when they were built. The Miyazaki Ocean Dome in Japan is known as the world's largest indoor water park (300m-100m-38m).

9\. Domes use much less materials than conventional buildings and still outperform them in structural tests.

10\. The larger the dome, the more efficient it becomes. This is demonstrated by doubling the diameter, which encloses eight times the volume.

And the most important fact: 11\. They are beautifull !</comment>


Life at Google - <AUTHOR> http://www.tbray.org/ongoing/When/201x/2010/03/20/Google-Vignettes <comment><USER2> I was looking forward to, well, you know - some content.

It's basically a short "list" of things that are cool at Google each followed by a comment along the lines of "but I can't really go into detail".

<comment><USER3> To be frank, Tim is pretty good at doing this - writing posts with very little content but vaguely cheering on the corporation. I unsubscribed from his RSS feed over a year ago, and at no time when I come across his blog since do I feel like I missed anything, or feel compelled to resubscribe.

<comment><USER4> In his defense, his posts are known for brevity. That's why he calls them "fragments". Some are just a couple sentences long. That doesn't negate that there may be very little content in the post, but it's consistent with what he has stated he would do all along.

</comment></comment></comment><comment><USER5> I am working at a second largest IT company in India, in terms of revenue and I get zero-internet access from 9am to 5pm. During the rest of the hours, I get the so called 'restricted' internet access, where I cannot check web- mails, nor can I download any executables, and I don't have admin access to install anything. Even to install the network printer I need to raise a request to the computer division. I feel sad.

<comment><USER6> While the situation is sad, would you say this increases or lowers productivity? (your own / of your company)

</comment></comment><comment><USER7> "We're at a weird time in the history of the growth of the Internet. At this (perhaps anomalous) point, the business leverage resulting from the focused application of human intelligence is so high that all these benefits and all this freedom, considered through a pure cold profit-and-loss lens, are cheap at the price..."

In other words, Google has created an army of superbly intelligent people who are deeply committed to their mission of covering the surfaces of every neocortex in the world's brains with little text advertisements.

If this were a classical legend it would be a tragedy of Olympian proportions.

<comment><USER8> I don't know, man. I hear people ragging on advertisement all the time. But the history of western media is the history of text advertisements. Subsidy from advertisement made the newspaper something the everyman could buy with the change in his pocket. In modern times, advertisement still supports most of the media that people choose to consume.

I know ya'll have read your "no logo" and everything, but you got to acknowledge that advertisement has done some good. It's hard for me to imagine what the last two hundred years of history would have been like without it.

How big would the internet be if people couldn't use google ads to pay for their bandwidth costs? How many small net businesses would never be able to reach their customers? I know Patrick uses ads to get customers for his bingo card creator. Thousands of other businesses do.

I just can't hop on the "ads are evil eye pollution" bandwagon.

<comment><USER7> I'm not hopping on the text ads are evil bandwagon, I'm hopping on the "Optimizing text advertisements is a rather surprising way to employ the talent of a generation of smart people" bandwagon.

</comment></comment></comment><comment><USER9> That had way less content that I imagined.

I still hope it does turn into a series and he can give us some more information.

</comment><comment><USER10> There is nothing here that you couldn't figure out even if you aren't an employee of Google. An example of the insightfulness: _Look at Google's age in years and current size and do some arithmetic; insane growth is an everyday constant._ Groundbreaking.

<comment> brown9-2 Is he trying to break ground, or just share some thoughts on his first day? I don't understand why there is an expectation that this blog post would be an in-depth investigative journalism expose.

<comment><USER11> Not an expose but maybe some information beyond "they have sensible security".

Unless you have some reason to care about tbray personally, the post is basically useless.

</comment></comment></comment><comment><USER6> This feels like spam.

</comment><comment><USER12> This topic is soooo 2003.

</comment><comment><USER13> _That's what Google is. I mean, why can't everyone lavish these sort of perks, and this sort of environment, on their employees?_

Not all businesses scale well. Software is one of them. Once you develop them the cost of adding more users - or selling more ads is virtually zero. Music _was_ another. High speed trading maybe is also in this category.

The real world is outside Google:) Does anyone know how many employees are at Googleplex or take a guess?

</comment><comment><USER14> Interesting. I've read many horror stories about people wanting to get a job at Google and going through the interview shredder.

Apparently, once you're in, it's a paradise. Well, at least compared to what you had to go through.

<comment><USER15> _going through the interview shredder_

My experience was that the interviews were easy and fun once my interviewers got over the embarrassed "this is really stupid, but I'm supposed to ask you this really trivial question...".

The recruiter I dealt with, on the other hand, was collossally incompetent, and ranks among the top reasons why I declined Google's job offer.

<comment><USER16> That's sad.

After you join Google you never have to deal with the recruiter again and the interviewers become fun people to work with.

OTOH an incompetent recruiter can result in a bad job offer and I can understand why that could be a big negative.

<comment><USER15> I think I got the right offer despite the recruiter's screwups; but you're missing my point. Even if I never had to encounter that recruiter again, it started me thinking "do I want to work for a company where people can continually screw up and not get fired?"

<comment><USER16> Did you, in addition to not taking the offer, make sure that someone above that recruiter knew about the issues described?

It is hard to fix problems if nobody reports them.

<comment><USER15> Yes. I asked to complete a survey about my interviewing experience, and I wrote about my recruiter at great length. (I presume that someone read the comments on those surveys...)

<comment><USER17> Someone surely did read the comments: the recruiter and/or one or more members of the HR department.

In all of the companies I have worked in as an employee or with as a consultant, the HR department always has by far the weakest staff. I have also observed that the number and degree of problematic staff in non-HR departments is largely correlated with just how weak the HR department is. This makes complete sense, of course, since it is the HR department that is supposed to address such problems and it is the HR department which usually plays the largest role in disciplinary decisions and firing decisions. The department holding onto firing decisions will always have the weakest staff, and for the simple reason that they aren't exactly going to fire themselves, now are they? :) The rest of the company's staff problems simply fall out from that. Not that I am suggesting that Google has notable staffing problems, rather simply that no matter where you go, even Google, the HR department (or whichever department in reality owns hire/fire, usually HR) will necessarily be the weakest in the organization.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> What I really want to know is what "tbray" sees as the next google. Now that he is inside he surely must have a different perspective on what could be dislodging/game changing for the mammoth company.

<comment><USER19> No, unfortunately that's not going to happen. Instead, he's going to become incapable of seeing any future of the internet other than "more Google".

This seems to happen to all their employees, with the exception of Brad Fitzpatrick.

<comment><USER20> There's a good contingent internally that haven't drunk the kool-aid, Brad's just the most visible externally. It's a reasonably huge effort just to keep the hubris in check internally, and it doesn't always work out.

<comment><USER21> "Brad's just the most visible externally"

Which is the other problem... People enter Google and disappear from external sight. I don't think Google has a "don't blog" policy, maybe it is that they just see "google = internet" and decide there is no value in having a public facing side.

I wonder whether this will happen to Tim

<comment><USER20> Many OSS contributors disappear because they're encountering satisfyingly challenging engineering problems as their day job for the first time. It takes a special discipline to actually _use_ 20% time at all (not because of team pressure, just from the ease with which one can focus on the large problems at Google). I've had that problem myself, and am considering putting said discipline in my own written goals.</comment></comment></comment></comment></comment>


New attack bypasses virtually all AV protection - <AUTHOR> http://www.theregister.co.uk/2010/05/07/argument_switch_av_bypass/

<comment><USER2> This project <http://sysjail.bsd.lv/> was dropped because of exactly the same problem with systrace on BSD systems, found in 2007.

Details: [http://www.lightbluetouchpaper.org/2007/08/06/usenix- woot07-...](http://www.lightbluetouchpaper.org/2007/08/06/usenix- woot07-exploiting-concurrency-vulnerabilities-in-system-call-wrappers-and-the- evil-genius/) (Exploiting Concurrency Vulnerabilities in System Call Wrappers)

It's not really possible to write wrappers which can inspect system calls, allow them to be blocked or modified, AND be efficient. Therefore they're not useful for security purposes because of the inherent race conditions.

</comment><comment><USER3> A new attack on Windows machines. In the immortal words of the Slayer, "Dawn is in danger. It must be Tuesday."

</comment><comment><USER4> This article is an abomination of journalism, go to the original site (<http://www.matousec.com/>) for something that makes sense.

<comment><USER5> Thanks for the link. I found the article confusing.

Was the article specifically about the list of results in this posting: [http://www.matousec.com/projects/proactive-security- challeng...](http://www.matousec.com/projects/proactive-security- challenge/results.php) I am sure that other systems can be compromised, but I gather this is concerning Windows only?

I ask because when reinstalling a Windows/PC last week, and I needed to copy some missing drivers (network/video) onto a USB flash drive from a working computer. I happened to notice there was a Ubuntu installer on the USB stick, and was very tempted to install Ubuntu!

</comment></comment><comment><USER6> Summary of the article: AV software hook into Windows system calls. When user- mode calls a kernel function, the AV hook handler first checks that the arguments comply with the security policy. If they do, it passes the arguments to Windows in order to execute the call. However, another user-mode thread can change the data between the time of the check and the execution. The AV will see valid data, but Windows itself will act upon the malicious data.

This is a vulnerability in AV software, not in Windows. If the attack succeeds the system remains just as secure as other operating systems which don't have AV.

How can the attack be prevented? I guess in the same way that the kernel itself prevents such attacks (after all, the kernel has its own checks, which presumably can't be bypassed). There's probably a way to make memory pages read-only for the duration of the system call, so the data can't be changed.

</comment><comment><USER7> Since hardware virtualization was introduced, the whole system can be wrapped by an attacker. Therefore, well coded malware could use the SSDT vulnerability to virtualize the currently running OS and not even have to remove AV protection afterwards. Tech keeps getting more and more flakey :-/

<comment><USER8> Not really. Read "Reflections on Trusting Trust":

[http://en.wikipedia.org/wiki/Backdoor_(computing)#Reflection...](http://en.wikipedia.org/wiki/Backdoor_\(computing\)#Reflections_on_Trusting_Trust)

</comment></comment><comment><USER9> What did the researchers propose as a solution? The article doesn't mention any way around this.

<comment><USER10> The first thing I would try is a bit hacky but might work. I'd take a copy of the data structures you are analysing when looking for malware and then copy it back to the original place just before you call the normal windows function.

It would minimise the amount of time the malware had to get the data in.

What you really need is to move the data into kernel space somehow. That would need a tweak to windows though.

The difficulty for the attacker comes in creating the initial attacker and faker threads. Possibly AV can hook the creation of threads and examine new threads for this potential behaviour (this might kill heavily threaded apps though). Then the virus make would have to attack two separate threads.

<comment><USER2> Two problems:

1) Efficiency

2) When an argument refers to a large amount of data which is necessarily in the user's memory space - eg memory mapped files.

</comment></comment></comment><comment><USER11> I love the arms race between AV and attacks. Always an interesting read.

</comment><comment><USER12> Would this timing attack affect Google's NativeClient as well? <http://code.google.com/p/nativeclient/>

</comment><comment><USER13> The last paragraph is interesting. How did bypassing AV become privilege escalation?

note: i have yet to read what matousec.com really says.

</comment><comment><USER14> In short, a race condition in Windows.

<comment><USER15> Not really. Actually Windows is a sophisticated form of distributed race condition.</comment></comment>


Ask HN: Berkeley or Urbana Champaign? - <AUTHOR> I want to do web entrepreneurship. I want to be a hacker. Unfortunately, I applied and got into the Honors business track for U. Illinois at Urbana-Champaign. I also applied and got L&S for UC Berkeley. I'll be switching into computer science tracks ASAP, regardless of what school I go to, but a friend tells me it's easy to do at Berkeley and I'd lose 12k worth of scholarship if I switch at UIUC.
UIUC costs 17k because of my scholarships. Berkeley costs 50k and 40k are in loans.
My parents earn less than 100k annually (and a sister in college). Should I take the loans and go to Berkeley or stick with UIUC?
Complication: I met a girl named Jessica Mah and am interested in working with her, and this dilemma was actually caused by her talking me into thinking Berkeley would be more conducive for toward my efforts than I originally guessed. Originally, I was going to say, oh heck, I'll go to the cheaper school. But now I'm seriously weighing the pros and cons.
Anyone have some insight? I know most of you here are from the valley, anyway. Jess says many valley people either went to Berkeley, Stanford, or both. Not to mention she says she'll hook me up with people I'll want to meet...? ;) <comment><USER2> Go to Berkeley. The weather is better. The town is cooler. It's close to the ocean. And the mountains. There are cuter asian girls (and better looking men.) The school itself is ranked higher... in every subject. It's the best public university in the country.

No matter what your major, it's a university everyone in the WORLD has heard of before. You are therefore considered smart for going there even if you major in Psychology. UIUC is only known in Illinois and some engineering circles.

Nobody goes to Berkeley and thinks "I should have gone to UIUC." But they do wonder the other way around.

(I went to university in the midwest and moved to Berkeley after I graduated, and then kicked myself for not even trying to go to Berkeley or Stanford.)

<comment><USER3> UIUC is very famous in Computer Science. I don't think that people will give you a job because you are graduating from a FAMOUS university. It is more on what major you take than what university you are graduating from.

Think of this:

EE from Yale or EE from UIUC? I am sure that a EE company will definitely choose the latter.

<comment><USER2> Having a degree from a famous university may not automatically get you a job, but it will definitely get you more job interviews.

If you know for sure you're doing engineering and you got into the EECS program at UIUC, then it probably doesn't matter as much. However, it didn't sound like that was the case for the original poster.

<comment><USER3> It is not really hard to get a minor in CS in UIUC as long as you are good in Math and Science subjects.

But, one thing is sure: 17K vs 40k

</comment></comment></comment></comment><comment><USER4> Dude, I'm guessing you're only 18, so please take my advice: do not choose your college 'cos you're chasing some girl. By the time you graduate both you and she will be different people. And you're going to meet a ton of interesting people over the next 4 years (and I know you don't want to hear this right now, but so is she).

There is nothing wrong with UIUC, that's where NCSA is. Stick to your original plan. Heck, stay with the business program too and learn to hack on the side and maybe take some CS electives if you can get credit for them. Graduating with a ton of debt in what it looks like the economy's going to be ain't going to be pretty.

<comment><AUTHOR> HAHA it's not like that, she's like one of the most well-connected 18 year olds on the west coast and I could be a part of a startup with her...

but thanks for the insight, exactly what my dad told me. ;_;

<comment><USER3> I am studying in UIUC now majoring in CS. It is a very good chance for you to transfer to CS major as long as you are doing good in all the science and math subjects when you are in college. Here, you will have the chance to study in the best building in the campus across NCSA - <http://www.cs.uiuc.edu/about/siebelcenter.php> ( I have 5 classes here every week even I am freshmen now)

Pros:

Startups? We have entrepreneurs like Jawed Karim(Youtube), Steve Chen(Youtube), Marc Andreessen(Netscape), Thomas Siebel, Max Levchin(Paypal), etc. (Geni, Yammer, Yelp, etc)

I am doing a startup right now with few of my friends. I am going to California this summer and I am putting my school on hold for next few semesters. One of my partner got into MIT before he came here. He decided to come to UIUC because the tuition fees in MIT was really too high (50K vs 13K). He thought that he made the correct decision after he worked on one of the project from MIT.

Cons:

The weather here sucks. It is really cold during the winter.

And, I am sure that Berkerley will have better "startup" environment. But, you will still see some startups around you in UIUC (My startup :X ).

(Anyway, I know Jessica Mah too. And, I can hook you up with people you want to meet too if you are coming to California this summer. But, do you think that networking really helps you to start your next big idea? Your skills are actually more important.)

<comment><USER5> > We have entrepreneurs like Jawed Karim(Youtube), Steve Chen(Youtube), Marc > Andreessen(Netscape), Thomas Siebel, Max Levchin(Paypal), etc. (Geni, > Yammer, Yelp, etc)

You _had_ them. All of them came out to the bay area to actually do their startups. That might tell you something :)

<comment><USER3> You are right. Bay Area is a good place to start a startup. But, he is going to study. Not starting a startup. What I wanted to say is: you don't necessarily have to graduate from a bay area university to start your startup.

<comment><AUTHOR> Hmm can I do both?

<comment><USER3> It is really hard to start a startup if you are studying at the same time. That is why I have to put my school on hold for the next few semesters.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> My overwhelming bias when I give advice on this subject of choosing colleges is to go as far away from home as possible, because that causes personal growth. (I didn't get that personal growth until AFTER college, when I lived overseas.) BUT, money does matter, and you are talking about a substantial money difference.

Now let's be clear: are you sure that you must take a financial hit to major in computer science at UIUC? Or can you major in business and still take quite a few CS courses anyway?

What is the assurance you can get into CS at Berkeley at all? I thought that was an "impacted" major there.

Good luck deciding. If the money were closer, it would be a no-brainer to go to Berkeley, but the money is not close, so there is much to be said for staying with Illinois.

<comment><USER7> Good point. My son majored in EE&CS at Berkeley. IIRC you cant transfer into CS from L&S. You might find yourself in the position that you go to Berkeley and cant get into CS. My info is 10 years old, so check it out.

Also Berkeley was very heavy into the Computer Engineering side of things. Be sure you like EE and hardware.

<comment><USER2> There's an alternative track at Berkeley for a CS major within L&S, if you're not admitted into the engineering school.

[http://sis.berkeley.edu/catalog/gcc_view_req?p_dept_cd=COMSC...](http://sis.berkeley.edu/catalog/gcc_view_req?p_dept_cd=COMSCLS)

</comment></comment></comment><comment><USER8> Do the math on how much it's going to cost you -- I would not want to get near 160k worth of debt, which is what it sounds like you're proposing. Also, you can take your summers, or even semesters to work in the bay area if you want. Hell for a few thousand dollars a year you can probably fly out there every weekend and work with your friends if you really wanted to.

Personally, I think anyone going over 50k of debt for an undergrad should really think it through, there may be cases where it makes sense but that is a lot of money. Also, having a significant debt load will limit your choices when you graduate from college -- the minimum salary that you'll need to live and pay your loans will be quite high.

Best of luck.

</comment><comment><USER9> Most high school seniors think that college is about education. It is, just not the kind of education you think. College is about learning to be an adult, I got infinitely more experience and knowledge participating in campus groups and events than I ever did from class. You'll learn almost everything you need to know for your career on the job. So, I just can't see how Berkeley is worth the extra money.

Regardless of which school you go to, I highly highly recommend that you consider joining a fraternity. It is honestly one of the best decisions I've ever made in my life. There are certainly going to be houses that are full of douche bags, but if you find the right house (and there is one for everyone) you'll have an amazing experience. You'll learn so much about yourself and so much about dealing and interacting with people. And good interaction skills are a force multiplier, they'll make you a much more effective (and pay worthy) businessman/engineer/hacker.

At least go through Fall Rush, there is never an obligation to join and worst case scenario you've wasted a few hours, best case scenario you have 100 new friends for life.

</comment><comment><USER10> I've never been to Illinois, but the Bay Area is pretty much guaranteed to have better weather and nicer outdoor type stuff, if that matters (it does to me, a lot).</comment>


Retina display Macs, iPads, and HiDPI: Doing the Math - <AUTHOR> http://www.tuaw.com/2012/03/01/retina-display-macs-ipads-and-hidpi-doing-the-math/ <comment><USER2> Mostly a good article and I agree with his main points, but I have two big disagreements.

\- Viewing distances. I only sit about 16-18" away from my 13" MBP screen and only about 24" from my 24" display. This varies obviously as I don't sit in a locked position all day, but I think he's erring a bit too high on estimated view distance, which means his necessary resolution to reach "retina" level is too low.

\- Screen size. Right now the 13" MBP I'm staring at has a very significant bezel that I would like to see mostly go away in an upcoming model refresh. The iPad's bezel makes sense since it's meant to be held in the hand. The MBP only needs enough bezel to fit the camera up top and needs none on the sides or bottom of the screen.

But yes, his overall point that Apple does not need to go so far as screen doubling on laptops and desktops to achieve pixels that are indistinguishable to the human eye is correct. I just think the resolution at which that point is reached on laptops and desktops is a bit higher than what he's calculated.

<comment><USER3> Hi ebbv, I'm the author of the post.

I've had a quite a bit of feedback that I've moved the viewing distances too far out. I measured from my own experiences, but I guess I must be atypical. It might be because I use dual monitors on the desktop (I have a 27" and a 26", so I sit back to reduce head turning) and slump when I have a laptop in my lap.

Anyway, I've expanded the spreadsheet that goes with the post to include some extra settings for closer distances and for your specific distances and devices.

Hope this helps!

Here's the spreadsheet: [https://docs.google.com/spreadsheet/pub?key=0Aq8W2-V7OXqfdGV...](https://docs.google.com/spreadsheet/pub?key=0Aq8W2-V7OXqfdGV3OFJ5R1RxOHJjMFRfYW5VbThORXc&output=html)

</comment></comment><comment><USER4> The landscape is getting a little messy for app developers. Not saying this is bad. It's just a fact.

Today you have to deliver _.png,_ @2X.png and *~ipad.png image sets with your app. And, there is no off-the-shelf way to reuse @2X images with the iPad when in most cases they'll work just fine. You can, but it requires creative coding.

Still, this results in app packages that are bloated with image assets in triplicate and now soon to add a fourth version.

If you build a universal app it seems that even someone downloading your app onto an iPod Touch is going to end-up with @2X, ~ipad and ~ipad2X (or whatever) images that the app will never use.

Maybe this is the beginning of the end of the universal app?

<comment><USER5> Maybe it marks a new rise in using vector image formats? (note: I am not an iOS developer and do not know the level of support iOS provides natively for vector formats)

<comment><USER6> You can render PDFs as UIImages[1], there are categories around that make this easy[2].

However, this is never ever going to be as cheap as loading a converted PNG (which Apple's modified pngcrush converts for you). I think a lot of devs have the draw/vector vs. precomposed bitmap tradeoff the wrong way round.

Drawing all of your gradated UIButtons with CoreGraphics methods is a false economy compared to just loading a stretchable PNG. Almost all of Apple's UI system imagery is bitmap based, and for a good reason.

[1] [http://mattgemmell.com/2012/02/10/using-pdf-images-in-ios- ap...](http://mattgemmell.com/2012/02/10/using-pdf-images-in-ios-apps/)

[2]<https://github.com/mindbrix/UIImage-PDF>

</comment></comment></comment><comment><USER7> "Retina Display" should have a very clear definition. It should refer to resolution at which anti-aliasing becomes unnecessary. Anti-aliasing is rightly classified as a hack placed on top of modern drawing systems, and one of the reasons that many games don't support it out of the box. With a high enough resolution, anti-aliasing technology will become irrelevant.

This is going to be different for each resolution depending on the distance that you view it at, I built a quick image that you can test this on. <http://dl.dropbox.com/u/1437645/alias.html> Put that on your phone or desktop and see how far you have to step back before the aliasing affect disappears

</comment><comment> alok-g From OP: "makes a solid argument for why an iPad retina display must be pixel- doubled -- i.e. 2048×1536 -- and not some intermediate resolution (just as was the case for the iPhone 4 before it). Anything else means every single existing app either has to re-scale art assets -- resulting in a fuzzy display -- or let them appear at a different size on-screen -- resulting in usability problems as the tap targets are resized. This is because every single existing iPad app is hard-coded to run full screen in 1024×768."

Doesn't this suggest that Apple is getting bitten by backward compatibility to the mass of pre-existing apps, just like Microsoft got stuck with the mass of existing software running on Windows (and also actually users who get too used to existing UIs/UX)?

<comment><USER8> Not exactly. This theoretically only pertains to bitmap UI elements (mostly icons). Sadly bitmaps are everywhere, notably because they're so cheap to create and render compared to vector, and more computation implies more energy. I suppose one could generate a cache of rasterized vector UI elements to cut on subsequent rendering.

Apple tried to bring resolution independence to Mac OS X since quite some time, and in all honesty it worked well... for vector stuff. It broke in varying ways across iterations of it every time there was a bitmap involved, in which case they were at best either blurry or unscaled. There's no miracle, unless you generate bitmaps for numerous multiple sizes (like in icns files, where they range from 16x16 to 512x512, downsampled if scaling is needed, like on the Dock), initially small bitmaps will just look bad unless you use a 2x factor, in which case you will at best have no improvement (but no loss either) over a non 2x screen, or you have an uncanny effect when a 'fat pixel' bitmap stands near a 'thin pixel' vector curve. Anyway as noted by robomartin, things are sufficiently bloated already not to include full-scale 16->512 bitmaps.

What's more 2x is computationally way simpler and much less costly for everyone. The only non-hackish, seriously viable alternative is to go all the way vectorized. A typical case of 'less is more'/'worse is better' if you ask me.

[0] <http://news.ycombinator.com/item?id=3658369>

</comment></comment><comment><USER9> This is a very good post. One I've thought about in a different context before: How much bandwidth/resolution do we really need.

The human senses have an upper limit of resolution, once we reach that limit further progress is irrelevant. So once everyone is streaming netflix at limitx2, Where does further bandwidth/storage demand come from? Growing populations? There's a limit to that growth. "big data"? Hardly.

We're rapidly approaching the point where individuals' need for further storage is exhausted. I think it'll be somewhere in the 10-100PB range. Which is pretty damn close.

<comment><USER10> How much data does a 2 hour immersive holographic "film" consume?

<comment> a-priori Assuming the holographic system uses voxels, it would need to be capable of displaying 108,900 (330x330) voxels per cubic inch to allow the same level of resolution as an iPhone 4 if it produces a flat surface. This would allow Retina-quality images when viewed from at least 11 inches away.

Assuming also that one voxel is 32 bits and not compressed, then the hologram would be 435,600 bytes per frame per cubic inch. At 24fps (you did say "film") that's 10,454,400 bytes per second per cubic inch.

Let's say it projects a hologram to fill a room the dimensions of a Star Trek- style holodeck, a cube of maybe 10 metres on a side. That's about 400 inches on a side, or 64,000,000 cubic inches. That means that a holographic film would be 669,081,600,000,000 bytes (608.5 terabytes) per second.

So, to answer your question, a 2 hour holographic film would be 4,817,387,520,000,000,000 bytes (4.178 exabytes) in size.

<comment><USER11> Fortunately, i'd be willing to bet you could use some kind of Occlusion culling to compress that stream quite a bit.

<comment> a-priori Yup, there's surely a ton of ways to compress that. Occlusion culling would be one, since you'd never see the insides of objects. For another, modulo atmospheric effects like fog and smoke, there'd be a lot of empty space between objects that even run-length encoding could compact quite a bit. I'm sure that even with lossless compression you could get it down to the petabyte range.

</comment></comment></comment></comment></comment><comment><USER12> This is a great post. If an iPad 3 has the "retina" display with resolution 2048×1536, I still think that a similarly high-resolution display will follow soon after for the soon-to-be-unified MacBook Pro/MacBook Air lines. If these high-resolutions screens are available at 9.7" for the iPad, it's hardly a stretch to manufacture them at 13" with a slightly reduced DPI.

</comment><comment><USER13> There's an elephant hiding behind "UI elements would look proportionally larger": such a non-doubled Retina display _would show less information_ than the old non-Retina one. This makes perfect sense in the Lion (and Metro and Unity) single-window world, but not for people who do work.

</comment><comment><USER14> Is anyone else wondering about speed/performance issues when scaling up iPad graphics like this? Apple must have a hot new (A6?) chip up its sleeve that will enable performance on par with what you get from an iPad 2 now while also smoothly handling the larger images necessary for an iPad retina display. If not, what's the point outside of HD movies? Who cares about retina display if graphically intensive apps all chug? Or if devs have to use non high res images in order to preserve performance... Will be interesting to see how it shakes out.

Here's hoping for an awesome chip that will make all of the graphics production rework worth it..

<comment><USER15> Well static images need hi res more than dynamic video, so animations could run at lower resolution and get blurred up with no user experience degradation.

</comment></comment><comment><USER16> This can't be correct when it comes to the larger screens. I found the text on the iPhone 3G to be fuzzy but not on the iPhone 4. I don't like Apple's antialiasing but on the iPhone 4 it doesn't matter anymore. Antialiasing becomes irrelevant. However, my 17 inch Macbook still has text that looks fuzzy to me and the antialiasing is still bothersome. I'm really hoping that there is some increase in resolution for the larger displays coming.</comment>


How to Build a Popularity Algorithm You can be Proud of - <AUTHOR> http://blog.linkibol.com/post/How-to-Build-a-Popularity-Algorithm-You-can-be-Proud-of.aspx <comment><USER2> Interesting overview, however he fails to address scalability issues properly. Some of the algorithms presented need to periodically recompute each item's score - this is a drawback if scalability is what you are looking for. A scalable algorithm will compute each score on write and will not require batch updates of previous items.

See: <http://code.google.com/appengine/articles/overheard.html>

<comment><USER3> After looking at a number of these algorithms, it seems like you really need to take each situation into consideration. I like that Google example as it is easy and scalable as you said. But for more complicated situations, you can do batch updates using Hadoop/MapReduce, assuming you don't have popular items that need to be calculated real-time.

</comment></comment><comment><USER4> I really liked this article. I've been playing around with some social-news- rating algorithms of my own, which are quite different from any of the ones listed here. One of these days I'll find the time to sit down and code a site around it them...

Also...I'm pretty sure that his argument for the "Dampening The Weighted Votes By Record Age" section is wrong. If you assume that each vote has the same weight (like HN, Digg, etc.), then you can rearrange the terms so that it's possible to use an algorithm that updates the 'rating' of the story on-the- fly.

<comment><USER5> > I've been playing around with some social-news-rating algorithms of my own

Where do you get the data for this? Its something I'd like to toy around with a bit but I have no idea how to get data.

</comment></comment><comment><USER6> Some discussion on a similar, but less comprehensive post: <http://news.ycombinator.com/item?id=478632>

</comment><comment><USER7> What you are likely to have is something like this: 1000 users and each voted between 0 and 100 times with 10 votes average. Yet with this approach all you have is a bag of 10,000 votes. It does not matter what you do with this bag - all the information on how the individual users voted is lost.

<comment><USER8> None of these algorithms take into account the number of views for each item. Wouldn't you define the popularity by starting with the number of people who viewed the item, divided by the number of votes?

This would solve the issues reported about late night news being ignored because no one is around.

Anyway, great article.

<comment><USER9> I think that would be a helpful factor in theory, but in practice would be too inconsistent to rely on. Using Reddit as an example (because I have no familiarity with HN's source) there is client-side javascript that intercepts clicks on links and appends story IDs to one of the Reddit cookies. Next time a request goes to Reddit, they get a list of recent clicks.

This can fail in a lot of ways, most obviously if Javascript or cookies are turned off. Also, the cookie isn't sent to Reddit until I load another page, so if I read an entire page of links and then close the browser without refreshing the page, the cookie doesn't get sent. Plus, the script clips the list around 20 elements, so even if I did refresh Reddit, it wouldn't know I'd clicked on more than 20.

My point is not the numerous weaknesses of Reddit's approach. Instead, it's self-reported information that must necessarily be suspect and incomplete. If an article on an obscure programming language pops up here, and every single person who reads it uses Lynx with cookies turned off for security, there might be no opportunity to record any views.</comment></comment></comment>


Riot Files Motions to Block Current Employees from Taking Legal Action - <AUTHOR> https://kotaku.com/riot-files-motions-to-block-former-employees-from-takin-1834335897 <comment><USER2> It remains insane that a company can require arbitration for violations of the actual law, rather than general contractual problems.

</comment><comment><USER3> > Throughout Kotaku's interviews, one name kept cropping up: Scott Gelb, Riot > Games' COO, whom current and former employees allege participated in "ball- > tapping" (flicking or slapping testicles), farting on employees or humping > them for comedic effect. "It just became so normal," said one employee who > witnessed Gelb's behaviour.</comment>


How to view only the posts that are interesting to you on StackOverflow - <AUTHOR> http://debugarea.com/2013/03/31/how-to-view-only-interesting-posts-on-stackoverflow/

<comment><USER2> Or make a userscript out of it which will let you do that automatically.</comment>


LogMeIn Acquired by Private Equity - <AUTHOR> https://techcrunch.com/2019/12/17/logmein-agrees-to-be-acquired-by-francisco-partners-and-evergreen-for-4-3b/ <comment><USER2> My old company used Logmein professionally to remotely manage 100s of computers for many years before switching to ConnectWise.

They had a great product for a long time but some of the worse licensing decisions I've ever seen. It went from being completely free to several thousand dollars overnight without any additional features, support, etc being offered. And meanwhile development was stagnant with only weird changes to the UI and punitive changes to free users being rolled out.

We would have been more than willing to pay for licensing. Even in the end it was the one product we found that could do some really cool stuff remotely (like recover a frozen Windows system and reboot it into safe mode). But they just handled the business side of things like complete idiots.

<comment><USER3> Great product, hundreds of computers for professional purposes, and "several thousand dollars" is a sticking point? Why?

<comment><USER4> Windows itself costs $200 or so. LogMeIn isn't worth 5 times as much as the operating system. At that price, it very quickly becomes cheaper to investigate alternatives like just using a Linux machine where remote management is a breeze, and there are tons of high-quality, free tools (with optional paid support contracts that are very inexpensive by comparison.)

<comment><USER5> Take a look at the pricing for Jetbrains products. 500€ for the first year only. I'm sure it has some features above "vim with syntax highlighting" but I can't tell which one costs 500.

<comment><USER6> The nice thing about their pricing is that it gets cheaper in the the second year and then again the third year. So from the third year on it's only 389 euro/year for the toolbox bundle that includes _all products_ , so you'll be set for tools tools for any mainstream language.

<comment><USER5> Yeah, 900€ just for two years is nothing. And this is just for the IntelliJ IDEA, not the whole pack. The standalone Office suite is 650€ for life. Photoshop from Adobe is quite a lot cheaper (some variant goes for $120/yr).

</comment></comment></comment></comment></comment></comment><comment><USER7> Bitwarden is a nice alternative. And you can self-host the server part if you want.

edit: LastPass is owned by LogMeIn, that's why I mention this alternative.

<comment><USER8> LogMeIn is remote access software. The LogMeIn refers to a local machine,not a website.

<comment><USER7> Sorry, I should have been more clear and mention the LastPass relation.

</comment></comment></comment><comment><USER9> This thread seems to be dominated by bitwarden recommendations, So I thought I would list some of the other reliable options that I'm considering.

\- Keepass [https://www.keepassx.org/](https://www.keepassx.org/) | [https://keepassxc.org/](https://keepassxc.org/)

\- Pass [https://www.passwordstore.org/](https://www.passwordstore.org/)

\- Dashlane [https://www.dashlane.com/](https://www.dashlane.com/)

\- 1Password [https://1password.com/](https://1password.com/)

\- Bitwardnen [https://bitwarden.com/](https://bitwarden.com/)

\- Lockwise [https://www.mozilla.org/en- US/firefox/lockwise/](https://www.mozilla.org/en-US/firefox/lockwise/)

If you think there are other legit options out there please reply with links to the project / product.

<comment><USER10> Lesspass [https://lesspass.com/#/](https://lesspass.com/#/)

</comment></comment><comment><USER11> Off-topic, but can anyone tell me of an instance whereby a software entity was acquired by a VC firm and things turned out great?

<comment><USER12> Others have pointed out the difference between VC and PE, but I think there's a _crucial_ thing missing from your question: turned out great _for whom_?

<comment><USER13> SOP for PE's is to come in, cut costs, and improve the bottom line without affecting revenue or service.

Customers typically aren't affected but employees are.

<comment><USER14> > SOP for PE's is to come in, cut costs, and improve the bottom line without > affecting revenue or service.

This is fundamentally untrue. Large CAP ($1B+ valuations) is notorious for this, but there's about 5k PE deals per year and those deals are the exception, not the norm, in terms of shear volume. They're great for headlines though! (hello Toys 'R Us)

Most of them are about adding value through various means, one of those might be cutting unnecessary costs.

</comment></comment></comment></comment><comment><AUTHOR> These guys must really be pessimistic about their future if they are accepting a deal of $86/share. Their 52 week high was $96/share, and as high as $120/share last year.

<comment><USER15> From 2017 to 2018 they nearly tripled revenue, probably a reflection of the price changes that many in this thread have complained about.

The problem is that since then their growth has completely stalled out and is projected to be under 5% for both this year and next year.

While their revenue tops out over $1B their net profit is pretty slim.

Post acquisition expect to see a lot of cuts to improve cash flow as operations are slashed across the board, and depending on how the acquisition is funded it won't be a surprise to see the company burdened with a bunch of debt.

Then PE will either try to return cash through net income, or more likely than not relist the company after two - five years when the restructuring is complete and the company has a more financially interesting profile, akin to what happened with Ping Identity.

In an ideal world they will also try to increase revenue growth as well, so I wouldn't be surprised to see some more price increases coming down the line as well.

<comment><USER16> They blindsided us with a 300% increase. I'm very much looking forward to getting off the service. They may have done very well in the short term, but they destroyed to long term business.

</comment></comment></comment><comment><USER17> They own GotoMeeting, Rescue Assist, LastPass and of course LogMeIn to name a few. I use their GotoWebinar product. Zoom.us has been eating their lunch lately ...

<comment><USER18> Ah, shoot, I didn't connect this to LastPass. Thanks for pointing that out.

</comment></comment><comment><USER19> I cancelled LogMeIn because every year they raised prices. Started at like $100 a year and over 5 years went up to over $1000 a year just to get into around 10 PCs.

</comment><comment><USER20> We changed the URL from [https://investor.logmeininc.com/about- us/investors/news/pres...](https://investor.logmeininc.com/about- us/investors/news/press-release-details/2019/LogMeIn-Enters-into-Definitive- Agreement-to-be-Acquired-by-Affiliates-of-Francisco-Partners-and-Evergreen- Coast-Capital-for-8605-per-Share-in-Cash/default.aspx) to a third-party article with a bit more background.

</comment><comment><USER21> LogMeIn Hamachi was a pretty great way of setting up a LAN over the internet for gaming. We used to play Minecraft on it all the time in college.

<comment><USER22> Hamachi was created by Alex Pankratov. Once LogMeIn purchased Hamachi, they ruined it with the following update ( _either purposefully or accidentally_ ) by making it no longer work with a large handful of older games. That sanfu in combination with a more bloated UI, forced LogMeIn account, and a splattering of useless features made it obsolete within a few months. It was the fastest rise and fall of a piece of software I have ever personally witnessed. You can read about the original Hamachi on the author's website here: [https://swapped.cc/#!/hamachi](https://swapped.cc/#!/hamachi)

<comment><USER23> Your recollection is off.

LMI bought Hamachi in 2006 and I was involved in the development until 2009. Through that time there were no known issues with older games. Nothing was broken. What was tunneled before was still tunneled the exact same way, including IPX, IP4 broadcasts and multicasts. We did rewrite the client, cleaning up all the cruft, separating the engine from the UI, adding compression support and what not. It still wasn't fully integrated with the LMI core and no LMI account was required. The UI was redesigned in-house, without my participation, and while I didn't like the result, the original look wasn't a pinnacle of design either :)

What happened after 2009 I have no idea. The devs I worked with were _really_ good, so if things broke, most likely it wasn't accidental.

<comment><USER22> I remember the UI change being around the time most things broke for me, and there were other users in the product forum with their various games also having issues. Maybe those type of posts were always numerous, and I never visited the forums before. For me the games that broke were Starcraft, Red Alert, and a handful of non-internet games. Perhaps the forum/customer-support tickets didn't make it down to you, but something had definitely broke around the time the UI changed.

It's likely the issues were quickly fixed and I am remembering the gradual post-2009 decline more vividly and blaming it on the time when the UI changed, which was emotionally upsetting ;)

But thanks for posting your remembrance of the events, and creating Hamachi in the first place!

</comment></comment></comment></comment><comment><USER24> Software Engineer here working on GotoMeeting (throwaway account). Not having gone through a private equity buyout in my career before, any ideas of what to expect/any recommendations of what to do now?

<comment><USER25> Has any private equity buyout ever helped anybody other than the PE stakeholders?

<comment><USER26> Dell was saved that way. But this here is different of course.

</comment></comment></comment><comment><USER27> Serious question: how much will this impact LastPass? I get that a buy-out creates some risk for the company's future, but is migration really required in the next 6-12 months?

<comment><USER28> Private equity (PE) has a bad reputation for a good reason. I wouldn't jump to migration immediately, but you should keep an up to date export in a secure place. PE can take years to drive a company into the ground with debt.

<comment><USER29> I migrated to Bitwarden immediately and removed all content in LastPass and deleted my LastPass account. My experience seeing companies sell out to private equity firms leads me to believe I haven't made that rash of a decision. For me, trust is usually immediately lost once a company changes hands. And when it comes to password management like this, trust is everything.

Honestly, I would have supported Bitwarden before had I known about it prior to this HN post. I appreciate the content you and everyone else has provided in this thread.

</comment></comment></comment><comment><USER30> LastPass recently started deleting a secure note of mine after I'd edit it. It's been almost two weeks and their support team has done nothing but kick the can down the road. I wonder if the acquisition has anything to do with their very poor support quality.

</comment><comment><USER31> A lot of discussion surrounding LastPass and alternatives, but what are some actual LogMeIn alternatives that people like?

<comment><USER32> I use AnyDesk now as TeamViewer became annoying with their need to install and things like disconnects every x-minutes. Didn't look back since.

<comment><USER33> I switched from TeamViewer to AnyDesk too. Sensible licensing, protocol compatibility between versions, Linux versions _and_ repositories... Fantastic product!

</comment></comment></comment><comment><USER34> I used to play cs 1.6 using hamachi, and it was unmatched at that time. Sad to see the gradual downfall of project.

</comment><comment><USER35> Keepass; open source, can store the file wherever you wish, isn't liable to be acquired by a private entity since you can just build your own copy.

Use open source software wherever possible, it's just better that way.

<comment><USER36> Does it work to sync between Linux dev machine and iOS phone?

<comment><USER37> I use KeePass kdbx file synced in my Linux computer and Android smartphone through Google Drive. For that I use Keepass2Android in my phone.

I just searched and there are also iOS applications that also provide easy cloud sync, one of such is KeePassium[1].

[1] [https://keepassium.com/](https://keepassium.com/)

<comment><USER38> I'd like to add that if you end up syncing the password database through a service like Google Drive then you should use a password _and_ keyfile on the password database. Share the keyfile in a (more) secure way with your device and don't put it anywhere like Google Drive etc. This way even if somebody captures your password database and somehow gets your password they still can't open the password database because it requires the keyfile.

</comment></comment></comment></comment><comment><USER39> In my experience, a private equity take over is the kiss of death.

<comment><USER40> It's easily the bottom of the barrel type recovery.

Although historically private equity has been a net gain for struggling businesses that would otherwise go out of business.

There was tons of anti PE stuff after the financial crisis and they received some of the earlier and harshest attacks from congress and other groups, but the data didn't support the idea they were some corporate raiding vultures and far more often turned around ventures in precarious positions.

But ultimately its not something you go to when they are going well. Unless there is some obvious value add consolidation scheme.

<comment><USER39> >Unless there is some obvious value add consolidation scheme.

The kiss of death works in mysterious ways, the synergy is palpable.

<comment><USER40> I would read this book

</comment></comment></comment></comment><comment><USER41> I don't understand how HN can complain about Google sucking up data and rarely if ever mention LassPass's terms of service which basically flat out state they share your info to marketers. Effectively they appear to be making money by looking at all the sites you log into via LassPass. If you're using their browser plugin I can only guess, given their Terms of Service, that they're spying on all pages, not just pages you're getting a password via their service for. Though even selling the info of which services you're using is bad enough.

Sure, they have a free plan and so you are not the customer. Why do they get a pass?

Note: I have no proof they are spying. I only have the fact that their TOS points to their privacy policy and their privacy policy says they can collect pretty much anything you'd expect software to be able to collect and that they can share that info with whoever they decide to partner with.

Contrast to some other password managers that stay flat out, they don't collect your data and don't want to know it.

From their Privacy Policy

> 1\. Information We Collect and Receive

> Service Data (including Session and Usage data):

> When you use our Services, we receive information generated through the use > of the Service, either entered by you or others who use the Services with > you (for example, schedules, attendee info, etc.), or from the Service > infrastructure itself, (for example, duration of session, use of webcams, > connection information, etc.) We may also collect usage and log data about > how the services are accessed and used, including information about the > device you are using the Services on, IP addresses, location information, > language settings, what operating system you are using, unique device > identifiers and other diagnostic data ...

> Third Party Data: We may receive information about you from other sources, > including publicly available databases or third parties from whom we have > purchased data, and combine this data with information we already have about > you. We may also receive information from other affiliated companies that > are a part of our corporate group. This helps us to update, expand and > analyze our records, identify new prospects for marketing, and provide > products and services that may be of interest to you.

> Location Information: We collect your location-based information for the > purpose of providing and supporting the service and for fraud prevention and > security monitoring. If you wish to opt-out of the collection and use of > your collection information, you may do so by turning it off on your device > settings.

> Device Information: When you use our Services, we automatically collect > information on the type of device you use, operating system version, and the > device identifier (or "UDID").

That's pretty much everything given they put an extension in your browser and can collect all of that info for every page you visit

> 4\. Information Sharing

> ... We may share your personal information with (a) third party service > providers; (b) business partners; (c) affiliated companies within our > corporate structure

Why would anyone want a password manager with this privacy policy?

<comment><USER42> > Why would anyone want a password manager with this privacy policy?

Why would anyone want a cloud based, proprietary, non-free, non-oss password manager is what I really want to know.

<comment><USER43> Because there's not a replacement that syncs well and is easy to teach your non-techie parents/spouse how to use to log into their shared accounts.

<comment><USER6> What's the problem with the built-in one in Firefox? It has optional syncing if you want it.

<comment><USER43> Firefox Lockwise is very new and quite frankly doesn't have very many features that people require such as import, export, etc. At this point I don't even know how to get all my password manager passwords into Lockwise even from a simple comma delimited file.

Right now, it's still impossible to switch to it for a lot of people.

</comment></comment></comment></comment></comment><comment><USER44> LastPass... :-(

<comment><USER45> 1Password is better and unlikely to be acquired. They are quite profitable on their own.

<comment><USER36> And doesn't work on Linux.

<comment><USER46> It does: [https://support.1password.com/explore/linux/](https://support.1password.com/explore/linux/)

There is even a cli: [https://1password.com/downloads/command- line/](https://1password.com/downloads/command-line/)

Not having a native gui is not the same as "not working".

<comment><USER36> Sweet! I used 1Password for years and then went LastPass for Linux support. At the time only the recovery mode worked to the best of my knowledge. This was in the 1Password 4 days.

</comment></comment></comment></comment></comment><comment><USER47> The pricing for LogMeIn and Hamechi and TeamViewer is ridicolous. Paying tens of dollars for a TightVNC with a middle server is more luxurious than having WinRar licence

<comment><USER48> I don't know why anyone would pay for Hamachi when you could self-host ZeroTier for free or pay $30/mo for unlimited user of their hosted service.

<comment><USER47> Oh man 30 dollars... So the problem with SaaS is that if you dont earn money directly from using SaaS most of the time you are outside of the scope of the business. Because SaaS needs to remove the lowest pricing so that the direct earning users choose the higher one. I can not pay 10 dollars for occasional service because its bad for the SaaS business aimed to more heavy users. I dont like it in SaaS model and i cant see any solution for this. Its like pizzahut stopped selling margherita and capricosa. SaaS dont sell margherita and capricosa!

<comment><USER49> It's free up to 30 devices, or free forever if you host your own.

</comment></comment></comment></comment><comment><USER50> Yep, we also used to have thousands of machines under management (across different clients), I always loved logmein, but moved to teamviewer for pricing reasons.

For example, in $:

0 > 1,500 > 3,000 > 5,000 > 8,000 > 12,000 > ...

(For the same service, over the years)

We left around 6-8k. The issue was always around a lack of transparency and arbitrary price increases, never about the actual price.

</comment><comment><USER51> Makes sense that LastPass was "slow" to adding new features (such as u2f) lately.

</comment><comment><USER52> Aw shit, I use LastPass.

</comment><comment><USER53> So, any recommendations for alternatives to LogMeIn Rescue for remote support, that supports mobile remote support (SDK, not another mobile app)?

</comment><comment><USER54> I used LastPass then 1Password before.

today, I've finally switched to KeepassXC today and am wondering why I haven't done this any sooner. Really happy especially with the cli. If you don't trust your AES stack (shitty implementations on certain SSD's) you have options such as chacha20. The whole project seems well maintained too.

there was a rework-podcast today with DHH and Dave Tear discussing venture capital and what this funding means for 1Password. [https://rework.fm/venture- capital-and-control-with-david-tea...](https://rework.fm/venture-capital-and- control-with-david-teare/)

</comment><comment><USER55> Didn't Citrix own LogMeIn?

<comment><USER56> Citrix owned Citrix Systems Online (owned GoTo* IP)which was rebranded to GetGo which was then spun out using a reverse-Morris trust to LogMeIn after receiving threats of a hostile takeover from Elliot Management.

</comment></comment><comment><USER57> LastPass has taken a huge dip in quality since the Logmein acquisition and I expect this will only make it worse.</comment>


List of educational tools for our teachers out there - <AUTHOR> https://blog.phuaxueyong.com/post/2020-07-25-top-10-educational-tools/ <comment><AUTHOR> What other interesting educational tools do you think is good!</comment>


Solar Updraft Tower - <AUTHOR> http://en.wikipedia.org/wiki/Solar_updraft_tower

<comment><AUTHOR> There's also an article about a research facility in Argentina developing a new version of this tower:

[spanish] [http://www.pagina12.com.ar/diario/sociedad/3-164105-2011-03-...](http://www.pagina12.com.ar/diario/sociedad/3-164105-2011-03-14.html)</comment>