Consensus on Cassandra - <AUTHOR> http://www.datastax.com/dev/blog/consensus-on-cassandra

<comment><USER3> So, the leader must renew their lease every (period * ι), where ι < 1\. The problem is that this assumes a synchronous network, or reliable clocks - <USER2> the Paxos implementation isn't tied to the master -- this results in the problem that you've given up safety, example:

1) The process p1 on the machine holding the lock stalls (VM stall, let's say). 2) τ seconds have gone by on the Cassandra cluster, and the lock is removed 3) Another process, p2 takes the lease 4) The process comes back, only to resume processing, and not realize its lease has expired...

Without the leasing system, and the leaser being tied together, it's very difficult to guarantee safety, and liveness.

<comment><AUTHOR> Agreed. They discuss this in the chubby paper as well.

There is a grace period where the master is in jeopardy of failing over vs failing over straight away. I left this out for simplicity of the state machine but I pointed to the chubby paper as a true reference.

They also mention the fact that client and master clocks must advance no faster than a known constant factor.

</comment></comment><comment><USER4> I love the simplicity of this, especially if you're already using Cassandra.

Is anybody out there using a lease mechanism like this (i.e., atop Cassandra) in production? Are there any pitfalls or edge cases in taking this approach?

<comment><USER5> There are numerous users of the paxos/lwt feature of Cassandra to selectively guarantee immediate/strong consistency for operations that need it (some at very large scale). But I'm not aware of anybody using this type of lease mechanism on top of Cassandra in production yet. I'm guessing this will be changing soon, as it has a lot of potential for infrastructure and application simplification. If you are interested, I'm happy to discuss further. Feel free to ping me on twitter, or email me at DataStax.

</comment></comment><comment><USER4> I was digging on this a little deeper and found this discussion from 2011 [1] that has some interesting points.

[1]: [https://groups.google.com/forum/#!topic/nosql- databases/4Aco...](https://groups.google.com/forum/#!topic/nosql- databases/4Aco3P_ZICk)</comment>


To Maren and the rest of the Zirtual team - <AUTHOR> https://medium.com/@vegalightsmyway/to-maren-and-the-rest-of-the-zirtual-management-team-14878f0649bf

<comment><USER2> _"...and don't even begin to mention the things like repeatedly switching insurance companies so that we wouldn't have the ability to use what was purchased then retroactively cancelling coverage that was already "paid" for and so many more others."_

It's amazing that after pulling stunts like that the company had any employees left at all. And it makes it pretty clear that firing everyone with no notice via e-mail was just the culmination of a long history of employee abuse.</comment>


Show HN: ChatMap – A shared map canvas and communicator for teams in the field - <AUTHOR> https://www.chatmap.io <comment><USER2> Please email firstname.lastname@example.com so we can send you a repost invite. We send those when we notice a story that seems good but fell through the cracks.</comment>


Show HN: A beautiful Reddit/producthunt clone - <AUTHOR> http://www.produktfang.de/room/gadgets

<comment><AUTHOR> any thoughts what kind of features are missing ?</comment>


What You Need to Know About Thunderbolt - <AUTHOR> http://www.macworld.com/article/158145/2011/02/thunderbolt_what_you_need_to_know.html

<comment><USER2> Okay, maybe I'm missing something crucial here, but "devices have direct access to the PCI bus" sounds kind of terrible. Forget keyloggers: I can log your proc talking to the drives and monitor now. Am I wrong?

</comment><comment><USER3> Is there a reason that Apple needs to keep creating its own proprietary connections/protocols?

Worse, they keep changing.</comment>


Suggest a cool starup that we should profile on our Incubation Radar? - <AUTHOR>

Could you suggest a cool tech company that we should profile on our Incubation Radar http://bit.ly/aXtj9B ?<p>See my profile for more on this... <comment><USER2> Clickable: <http://bit.ly/aXtj9B>

</comment><comment><USER3> Shoply.com</comment>


New Google TechTalks explaining Chrome's architecture - <AUTHOR> http://www.youtube.com/my_playlists?p=AE7BD00A2CED9EA5

<comment><USER2> The above link just linked to my playlists, but here's a Chrome video I found: <http://www.youtube.com/watch?v=A0Z0ybTCHKs></comment>


Which common mistakes do less experienced programmers make time after time? - <AUTHOR> http://www.reddit.com/r/programming/comments/awotv/experienced_programmers_which_common_mistakes_do/

<comment><AUTHOR> Saw this discussion over at reddit, and wanted to know thoughts of readers here.</comment>


Mythbusting The WSJ's Stats About Pro Bloggers - <AUTHOR> http://www.businessinsider.com/wsj-pro-blogger-stats-2009-4

<comment><USER2> The number of professional bloggers is based upon that technorati survey (based upon 1300 technorati users) where 2% of users said that blogging was a primary source of income for them. So basically 26 technorati users have been scaled up to half-a-million pro-bloggers.

</comment><comment><USER3> _the $75K average is skewed by a handful of outlier successes, but the great majority of bloggers who get 100,000 uniques/month earn more like $22,000. Here, the median is far more relevant than the average_

Absolutely true</comment>


Ask HN: Am I correct about FOSS licenses and open source software? - <AUTHOR>

Earlier today, I tried to answer frederickcook's question about which software licenses are compatible with proprietary software. I posted my answer several hours late on a small thread, so I am reposting it here for your convenience and/or corrections. (The original is at http://news.ycombinator.com/item?id=2210218)
* If you are building a website and you do NOT redistribute the website's software (e.g. allow people to run the website on their own server), you can incorporate code from most open source licenses. Specifically:
* The MIT, BSD, PSF, and Apache licenses are fantastic for proprietary websites, even if you do redistribute the website's software. (In which case you will need to include a disclaimer, copyright notice, and/or copy of the license, depending on the details of that specific license.)
* Libraries licensed under the AGPL may NOT be used for proprietary websites. The regular GPL's language is unclear about proprietary websites, so you may want to avoid GPL libraries altogether. (I have been told that the FSF claims that the GPL covers websites. Note that the AGPL was written to firmly and explicitly address this issue.)
* You may use LGPL libraries, but if you modify them then you may have to release the code that you modified. (Due to the aforementioned uncertainty.) Again, I am not certain about this, but I have seen that claimed before.
Disclaimer: I am not a lawyer and nothing I say is legal advice. Use the information I provide at your own risk. It may be wrong. I have no legal liability if you use it.
Feel free to correct me. I would be happy to hear that I am incorrect regarding the GPL. <comment><USER2> In general, I wouldn't give advice based on what _I have been told_.

About the GPL, see [http://radar.oreilly.com/archives/2007/07/the-gpl-and- softwa...](http://radar.oreilly.com/archives/2007/07/the-gpl-and-software-as- a-serv.html)

<comment><AUTHOR> Thank you. I found mixed answers on the internet and I will correct my other post.</comment></comment>


Doctor GPT-3 will see you now - <AUTHOR> https://arshamg.com/blog/posts/dr-gpt3/ <comment><USER2> Interesting - I wonder what's the ratio of true vs. false knowledge in the corpus that GPT-3 is trained on. Perhaps someone has performed a study on this for a specific domain?</comment>


Open source needs designers - <AUTHOR> http://benwerd.com/2011/06/open-source-needs-designers/ <comment><USER2> I think from the designers I know and from my distant former life as a designer before I ended up as a CS guy, it only really comes down to one thing:

What's in it for a designer?

* It's not scratching an itch that they have.

* It's not great promotion (design has worked on a portfolio system for generations, so they have them already - showing someone what you've built is new and revolutionary for development in relative terms, but for design that's just how it is).

* It's probably not much fun (it's a skill to work with designers and to manage a project such that it comes out well - one that most OS projects do not possess if I had to guess).

* It's probably quite thankless (by no means a universal attitude, but plenty of developers think of design as an add-on, or a nice to have - not much of a situation to be in with your work).

So why would designers volunteer for this when they could do work for themselves and their portfolio that they may actually enjoy? How many projects will provide enough exposure to make this a good use of time?

<comment><USER3> I do design for open source projects, I've started helping out on the Gnome Project doing interface design.

• It's great for scratching an itch of 'I want to help other people'.

• It can be good promotion. The same way a good github account can help developers, stating and showing how you have participated on a open source project that is _real_ is good for showing you can pull through on projects and deliver.

• It can be great fun to see something you designed being implemented and working. Even more fun if people praise you for your great solution to a problem. The thing with doing FOSS as a designer, you have to take alot of control - and push for developers to code your design. It's not just delivering a PSD, you have to _work_ with the developers.

• If you solve a real problem, people will thank you.

<comment><USER4> Everything in your post is the absolute best case.

It can easily go the other way and your contributions can be ignored and never used, you will be reacted to with hostility by developers who think that design is an "extra" feature, and that even if you do succeed and something you do does hit a release, the overwhelming majority (nearly all) of people who use the software won't know you exist.

There are two sides to open-source development (at least, when it's not with people you know personally IRL) and one is, sad to say, generally not very pretty. Institutional hostility toward non-programmers still lives in a lot of open-source projects--usually the ones who need them the most!

(EDIT: Mind you, this isn't a reason to not at least try to contribute if you feel it's important to you, but the results are often not as rosy as your post suggests.)

<comment><USER5> You are aware _absolutely_ everything you wrote is the same for developers too, even the programmer part;I've seen hostility towards people offering patches who are more users than programmers.

That's contributing to other people's projects period.

OSS is about scratching an itch, releasing code your business does but does not need to protect, or about self-gratification. While it can be a showpiece, you never get much in the way of fame out of it, no matter what you do.

<comment><USER4> Of course. Incidentally, Mono aside (and that was a special case), it's why my own open-source projects are the ones I choose to contribute to.

</comment></comment></comment></comment></comment><comment><USER6> Open source really doesn't want designers.

They want people to make things pretty, and there's a big difference.

Bringing a competent designer on board means bringing a strong opinion on board.

Someone who'll probably decide to cut 90% of the features.

The problem with most open source projects is everyone involved has an opinion that they'll fight for, so you end up with 1000 features, designed by a committee of developers (see the Linux desktop)

<comment><USER7> You make it sounds like if Autocad had involved a designer in the process, they would have wound up with google sketch. Sometimes things need to have features, even features that 90% of users won't need 90% of the time. A good designer shouldn't be the person who decides to cut features, he should be the person who figures out how to keep the features, but in a manner that allows new users to start with a minimum of pain, and expert users to keep growing into the product. That's hard work, and it takes a lot of cleverness and creativity, but I think anybody willing to do that work would be welcome in any sane open source project.

EDIT: on re-reading my post, it looks like I'm saying Autocad didn't have designers, which is completely the opposite of how I feel. What I was trying to get it is that (IMO) Autocad is an amazingly approachable product with tons of features, just presented in a way that isn't terribly daunting to a new user.

<comment><USER6> The people who use AutoCad most likely use it for a living, and the time investment in learning the UI is probably worth it.

I feel the same way about Photoshop. People spend time learning its quirks because it's worth it.

However, realistically 90% of the features could be cut and it'd be for the good of the product.

The problem in the software industry (and this is not limited to Open Source) is that people like long feature lists.

This is especially important if you're a Photoshop or an AutoCad. You need new things for the new version.

</comment></comment></comment><comment><USER8> I've been thinking of helping open source project as a designer but I don't 1) which 2) how.

1) Most of the software I use is commercial or already well designed(OSX/iOS), so I don't really have a personal itch to fix something I use.

2) I'm familiar with web technologies, git and development environments but I think the problem is politics or communication. I imagine it's lot easier to pull a repo, refactor a bunch of code and get it patched, than it is to submit a remake of the UI and get it on the product. Somebody probably likes the old one more and feels the 128 menu options where there for a reason.

I already have enough politics on my day job, so arguing on with developers on open source projects doesn't sound that inviting. I might be wrong, but it just doesn't seem like that designer friendly environments and maybe lacks the process/tools to be that.

<comment><USER9> How about you start your own open source project as a designer and try to recruit developers to do the coding? Never seen this approach before but it might be worth trying.

<comment><USER10> A common myth-let is that you start an open source project and people just come streaming out of the woodwork to work on it. The reality is that you are in stiff competition with thousands of projects for relatively rare resources. The global outcome is good, the local outcome is generally developer starvation. A developer with little more than mockups and no code to speak of is not going to win this competition, even with a truly stellar mockup.

</comment></comment></comment><comment><USER11> Unfortunately design is best when it is totalitarian. Good design comes from a core visionary entity, not a committee. This way of working seems incompatible with open source, because developers volunteering their time don't want to be told what to do.

<comment><USER12> +1

</comment></comment><comment><USER12> I tried helping the Wordpress comunity with this Google Summer of Code entry for Android blogging app redesign: [http://tomaskafka.wordpress.com/2011/04/08/wordpress-for- and...](http://tomaskafka.wordpress.com/2011/04/08/wordpress-for-android- concept-for-gsoc-2011/) . I based the design on taking the most common requests and complaints from Android Market reviews, mixed with so successfull 'post anything fast' model of Posterous.

The mentors chose this joke of a buzzwords and a brainless copy of Facebook (Facebook has dashboard with 9 buttons therefore my app will have 9 functions and it is a good UX) instead: [https://anirudhspider.wordpress.com/2011/04/01/version-2-wor...](https://anirudhspider.wordpress.com/2011/04/01/version-2-wordpress- android-app-ui/)

The code of app was terrible - mashup of business and diplay logic organized as 1 screen = 1 class. I recognized that to decouple business logic from view and enable different screen flow, splitting into proper MVP layers would be needed - and offered to do the refactoring as well.

I tried - never will again. Open source my ass.

</comment><comment><USER13> Open source doesn't (just) need visual or interaction designers. It needs product designers. I.E. people who say no. Needless to say, given the reality of FOSS, that's not going to happen.

<comment><USER14> You must have missed out on last weeks posts about PHP internals devs saying no to practically every enhancement. Including enhancements with patches ready.

</comment></comment><comment><USER15> Designers like to come up with one piece of design, not working on different little design changes wanted by an entire community of open source developers.

Designers like to design one product and expect developers to follow suit, not the other way around. This doesn't happen in the open source world.

<comment><USER3> It's a great challenge to better the user experience on a small problem. Alot of designers would love doing small 'papercuts'. I don't think your statment that designers _just_ love redesigns or complete products holds true.

<comment><USER5> I think many designers do not know how to be really collaborative. They don't know how to bend their design to development realities and do cost-insensitive things all the time.

I do professional iOS development all the time, and have had the pleasure of working with some really good design teams while working, who are there the entire process, but I've also had the occasion when a design is handed down by "god" and they won't do a damn thing to adjust to what's actually possible or doable.

The communication style of designers also irks the hell out of developers. There is argument by emotion, argument by reputation and argument by logical reasoning. Most devs do the latter as a default thing. Many (I'd probably not say most) designers shoot at repuational argument overly quickly, relying on inchoate notions of things they can't really verbalize well.

The fact one side is saying "Trust me, look at all the stuff I've done" and the other is saying "But this is that way and that is this way" leads to a horrid clash of communication style. This is only exacerbated via email, which is how much OSS gets done, as email is exceedingly logic based.

<comment><USER3> You can't be a good designer without knowing your format. And working with those would seem like hell, I guess.

<comment><USER5> That's the issue though, you can't really learn the format without doing work in it.

There needs to be a "Oh, pushback, let me listen then change things" that many people lack when they're not experts in the area.

That said, there are people who listen exceedingly well when they're not experts and are a pleasure to work with.

</comment></comment></comment></comment></comment><comment><USER16> _[W]hile NetBeans and Eclipse feel engineered, Coda feels designed._

The comparison between Eclipse/NetBeans to Coda is problematic. The OP downplays the importance of who those apps were created for, when that is a fundamental part of the design process. Both Eclipse and NetBeans are just as designed as Coda, but not for web developers. Take the "Refactor" menu in Eclipse, for example: it feels like someone is saying "We know how miserable you feel that the code sucks right now and how hard it is to improve it. Here, have these amazing tools and fix it." For a Java developer, having a refactor do in seconds what would take a whole day _definitely_ has emotional implications in the visceral, behavioral and reflective levels. If that does not resonate with the OP, well, that's because he doesn't have the same sensibilities and issues a Java developer has, not a inherent fault of Eclipse.

 _[O]ver 80% of Linux kernel contributions are made by corporations, so it's reasonable to infer that most open source software is built to feel an internal corporate need. Consequently, interaction design is underrepresented in open source._

While it's certainly the case that open source has a lot of interaction design issues, the who-what-why-how of the kernel are not the cause. The Linux kernel is the least user-facing component of the typical OSS stack. As Linus points out in an excellent chat with Greg Kroah-Hartman¹, there is very little left the Kernel developers can do to help the typical user. The problem is in the "userland".

 _Part of the problem is market. To be blunt, commercial software needs to sell, and usable interfaces are an integral part of that._

OSS needs to "sell," too: it must be adopted by a community and, in some cases, it must find a corporate sponsor. One may argue that OSS _projects_ are started to solve the problems of a single person, but the ones that become _products_ must have seen wide adoption. Good interaction design is, just as for commercial software, another selling point. At the same time, terrible user experience is democratic. There are loads of unusable commercial and open source software available.

What open source really needs is not (just) designers, but _design_. Good design can only happen when people with a strong hand, a vision and any kind of design sensibility are in charge. And that's true for any kind of software product, not just OSS.

¹. <http://www.youtube.com/watch?v=__fALdvvcM0>

<comment><USER17> I totally disagree with you on Eclipse. I've used both Eclipse and IntelliJ IDEA extensively for Java work, and the user experience on IntelliJ IDEA is way better and has been for years.

A couple times I've talked to Eclipse committers in detail about UI problems and what I get is either denial that there's a problem or an answer like "Oh, yeah, I guess we should do a UI sweep sometime." I'm sure Eclipse seems fine to the people who make it, but that's true of almost any terrible UI. Most people stop at "looks good to me," rather than going for, "tested to work well with the target audience".

<comment><USER16> My point was that Eclipse and Netbeans (and IntelliJ IDEA) cater to a specific public with specific needs and that public is not the same as Coda's. To compare the experience of using Eclipse and Coda is questionable and to argue that Eclipse does not "feel designed" is absurd.

I never said Eclipse had better or worse UX than IntelliJ IDEA. This is not what the OP is about.

</comment></comment></comment><comment><USER17> Wow, I totally disagree with the thesis of this article. Open source doesn't need designers, not in the sense of a job role.

At most companies, a "designer" is a person who by definition doesn't make anything directly useful. They produce documents describing how they think other people should make things. Much of the time their designs only get executed because somebody with power over paychecks tells developers to obey. But most open source doesn't work like that. Nobody can order a volunteer to do things differently.

What open source needs is for developers to understand designing for people. For user-facing apps, the point isn't to write code, it's to make something that people use and love.

To aid in that, we could certainly use help from user researchers, so we get feedback on what's working and what isn't, and get enough data help us think about solutions. And maybe we can use help from consulting designers when we need help with a problem. But I don't think we need designers as such, any more than we need managers.

<comment><USER18> I feel like this is the attitude that drives good designers away from open source projects - the attitude that they are swooping in after the fact to destroy the hard work of intelligent programmers. If you instead see designers as intelligent people who chose to specialize in understanding and translating raw "feedback on what's working and what isn't, and [...] data" and time- tested design concepts into a final product that ties the chops of programmers with the actual human-centered goals of projects, it may result in better software.

Are we really trying to, for random example, create a protocol for individually and consistently addressing nodes securely within an ad-hoc mesh network of inconsistent size which needs to route requests to one or more gateways to the larger internet, OR are we trying to help average people create their own neighborhood networks where they can share services?

I submit that we're doing the latter, and the hard problem in order for programmers to facilitate it is the former. As a programmer, I stumble across magnificent libraries bitrotting on various parts of the internet that sometimes do things that I wouldn't even have imagined possible, yet no one but hobbyist techs will ever use them until they are integrated onto the backend of something that designers somewhere created to scratch a person's itch, not a programmer's. The big problem: when will a designer ever be meandering around the depths of CPAN or an aside on some obsessed functional programmer's blog?

To be even more extreme, I'd like to see more projects primarily headed by designers or end user types, ones with little to no technical knowledge and a healthy respect for people who do. As a programmer, I pride myself on telling people the best way that things can be done with a computer, not what people should want a computer to do and how they would like the computer to do it.

Seriously, the less I have to think about ui, especially in the context of projecting myself into the mind of somebody who isn't clear on the difference between a directory and a file, the better. Background shit that automagically runs with no interaction? Love it. Something that helps grammar school kids collaboratively research their school projects in a transparently sourced way? Somebody please draw me a picture, tell me where to put the buttons, and tell me what they should do. And even though I've written an awesome algorithm to realtime index and classify the contributions of the individual students and make suggestions about who should be assigned to clarify a portion of the outline based on keywords and library proximity - tell me where to put it, or whether I've been wasting my time and that no one needs it. I don't have to have a big red button on the toolbar. I'm smart, I can certainly use the algorithm for something else.

Sorry for ranting:)

</comment></comment><comment><USER19> I've always wondered about this, and the conclusion I've reached is that we don't have more designers contributing to open source because

a. we developers don't make it easy for them to do so.

b. designers don't care about our projects.

For example, look at wordpress ... you can go in and create a theme ... today, if you'd like to, as a result there are tons of free themes out there, but how would a developer go about creating a Netbeans theme?

Also, most open source projects are created because a developer wanted to build something cool for themselves ... and it isn't often that designers find those sorts of things cool as well so of course they're not going to be designing cool ui for those things

The first is solvable ... devs need to make a concerted effort to reach out to designers, outline a design process (send us a psd of your design, we'll go over the details in basecamp/unfuddle/whatever and you can provide direction as we go) ... I can't see much being done about the second.

<comment><USER20> I actually tried to contribute interaction design to to Elgg (referenced in the post). I spent some hours on concepts and got almost no response on the forums. Hindsight is 20/20 but I've found that some open source devs aren't that excited about people who add scope but can't make huge contributions code wise.

</comment></comment><comment><USER21> i agree, I'm a designer and have been offering to fork open source projects here and there for a bit, but i think its a thing that the community has to adopt. its getting there though. developers also need to come to terms with the fact that just as a project needs great coding (by a dev) many projects need great design (by a designer)

<comment><USER22> My experience from starting WeekendHacker is that developers do know they need it.

In fact I have a lot of developers asking for design help (and luckily vice versa)

The format I use is a little more free form and it's curated which I hear a lot of people say help a lot.

Plus projects are fresh.

I have also tried to involve myself in OSP over the years.

The problem at least from my experience was that while developers have a clear process on how to work together amongst themselves. While they have created their own lingo. It doesn't really include the design process (unless they like me want to learn how to use GitHub) and how that ties into development.

There is clearly a disconnect between the two disciplines and I have yet to find a tool to allow for easy transcendence. You can't in my experience use the github principles for versioning of design, since iteration works completely different for most designers.

I have a couple of ideas of how that could be done, maybe I should start a WH project :)

<comment><USER5> Thom, I work with designers and git all the time (iOS dev)

Git does work for the design files (however less well than with the text the programmers work with).

I'd say generally speaking, it works better if you do design and cutups for a programmer who then implements a fork. He then submits the fork to the project to be merged in to the main project if the rest of the implementors agree.

Gotta find a front end programmer who likes you and thinks you're doing the right thing for that to pan out well.

<comment><USER22> It works when I have cut out the files and do the CSS/jQuery etc.

But my point is more about about design iterations within photoshop, fireworks etc.

Obvious problem is file size. It's going to be interesting to see whether LionOS will allow for some sort of integration with GitHub that allow for this.

<comment><USER5> The files are large, for sure, but not _that_ huge. Is there some file size limit killing you or something at github in particular?

Or are you just referring to transit time (aka upload/download time)?

<comment><USER22> Not just that, although that is a problem IMO especially with PS where the files can get very big.

But also just a problem of state.

A lot of designers who use PS use layers and groups to show different scenarios within the same file.

But as I originally stated.

The reason why many designers don't joing these projects is because it doesn't take their way to work into account.

Yes you can learn to use Github or other versioning tools but that's not good enough if you ask me. Especially if you want to have more designers to participate.

<comment><USER5> Yeah, the everything in one giant file thing is a big problem for collaboration in general (even among designers).

I thought the reason many designers don't join the projects is because many technical people are surly when you try to tell them to put things here and here and here... etc.

It's not like you can't share a dropbox folder then occasionally check into the code base, or never check in the PSDs at all.

</comment></comment></comment></comment></comment></comment></comment><comment><USER23> It might be helpful for developers to have a better idea of the type of design they need for their project. In my experience, when most people talk about designers, they are talking about visual designers. Open source needs help with visual style, layout, graphic elements and branding, but I feel that UX/interaction design is needed much more. Designers are rarely masters of both disciplines.

</comment><comment><USER14> The author states in the opening paragraph that he has slowly been migrating off Eclipse, to Netbeans, now to Coda!!?

Seriously, what was he using Eclipse and Netbeans for if Coda is a migration path. Stating the obvious: He clearly wasn't doing any heavy duty coding. Talk about using a sledgehammer instead of a fly swatter.

</comment><comment><USER24> There are designers that make pretty interfaces (last I saw Xfce needed some of them, and there are designers who make images (like OpenTTD replacement of the original game files). Yes, both are needed, but most designers go towards making websites or something else over-subscribed.

</comment><comment><USER25> This is a great topic, but who are the designers that developers really need?

I don't see any portfolio links in the comments yet...</comment>


Ask HN: Do a coworking space make you more productive? - <AUTHOR> I'm having doubts on buying a coworking space versus working from home. Not sure if coworking will really boost my productivity (since in home I have a few distractions, but not many). <comment><USER2> Not at all. I'm not a people person and it distracts and drains me like an illness.

</comment><comment><USER3> Try it for a month, it works for some people it doesn't work for others.

<comment><USER4> Yes, A/B testing is the best means to answer this question. What works for other people says little or nothing about whether it will work for this person, though some comments might contain nuggets of insight as to _why_ it works for some people and not others and that might be useful. But, ultimately, trying it is the way you find out.

</comment></comment><comment><USER5> It's more distracting than sitting next to a jackhammer. This isn't hyperbole either: I actually had to program once in an industrial setting next to a jackhammer. It was less distracting.

</comment><comment><USER6> As others have said, do some trials at a few and see how they work out. Though from past experience it's difficult to judge the long-term experience of a space by a 1 or 2 day trial. Ask if you can get a week at a reduced rate.

Coworking spaces are not for everyone and it depends on many factors, specifically your personality type and your ultimate goal for a space. ie: if you ultimately want a space that helps you extend your network and you're willing to sacrifice the fact that the environment will be more distracting than working at home, you'll more likely forgive the latter to gain the former.

</comment><comment><USER7> If you are worried about distractions, get some noise cancelling headphones (I have Bose QC35s and they make the world of difference). There's no reason you shouldn't be able to be productive in a coworking space. If you are in a good one you will also benefit from networking. Most people working there will understand to leave you alone when needs be.

</comment><comment><USER8> I tested out a co-working space last year about 15 minutes away.

I have a pretty nice setup at home, quiet, a few different setups to work from so I still get more work completed at home vs. co-working or coffee shop.

It is nice to get out every once in a while but it's not something I would do every day or even a few times per week. So If I want to get out I go out to a coffee shop.

Now if I didn't have a private area to work from at home I would definitely consider using a co-working space.

</comment><comment><USER9> Yes. I find working next to people that are working on completely different things is hugely beneficial. If i need help, then I am required to explain my problem in a way that ramps up and keeps the interest of volunteers around me. This means that i'm required to connect with people in a very particular way.

Whenever I need privacy, I can put in my headphones. The only down side is when I need to make a phone/video call.

</comment><comment><USER10> For me yes, I find really really difficult to focus at home, even if I live alone there.

I prefer much much more coworking spaces, the more crowded the better for my focus. Ironically is deep silence the thing that disturb me the most.

</comment><comment><USER11> I need some separation between my bedroom and my working area.

I get lazy at home easily, I turn to lay down and just pass out sleeping.

</comment><comment><USER12> No, I found it distracting, personally.

However - it's great for networking if you participate in a well-organized one!

</comment><comment><USER13> Pretty sure coworking spaces make for pretty shitty programming environments.</comment>


A Doctor Trying to Stop Heart Attacks - <AUTHOR> http://www.npr.org/sections/health-shots/2016/09/23/495027377/this-doctor-is-trying-to-stop-heart-attacks-in-their-tracks <comment><USER2> This is another example of a recurring theme where the profit motive is failing to incentivize pharma companies to create products that can have an immediate impact on saving lives or improving health outcomes. I'm no socialist, but this seems to be a real (albeit very specific) failure of capitalism. Does anyone know of a government agency that is chartered to solve these kinds of problems?

<comment><USER3> The United States Department of Health and Human Services, whose motto is "Improving the health, safety, and well-being of America", which has a budget of just over 1.1 trillion dollars, and about eighty thousand employees.[1][2]

For comparison, the largest pharmaceutical company in the world is Novartis, with annual revenues of approximately forty-seven billion dollars.[3]

The pharmaceutical industry is one of the most, if not the most heavily regulated industry in the United States. This industry is also affected by various government interventions into research and development, both in funding and restricting options. If you believe there is a problem (and I think there is), it seems difficult to believe that it is due to a lack of government involvement.

[1] [https://en.wikipedia.org/wiki/United_States_Department_of_He...](https://en.wikipedia.org/wiki/United_States_Department_of_Health_and_Human_Services)

[2] [http://www.hhs.gov/sites/default/files/fy2017-budget-in- brie...](http://www.hhs.gov/sites/default/files/fy2017-budget-in-brief.pdf)

[3] [http://www.pmlive.com/top_pharma_list/global_revenues](http://www.pmlive.com/top_pharma_list/global_revenues)

<comment><USER4> About 90% of this budget is providing Medicare and Medicaid.

<comment><USER3> Yes, and a large portion of that is spent on prescription drugs; the US Government is one of (if not the) largest customers for most drugs.

<comment><USER5> We need to stop thinking of the government and corporations as distinctly separate.

Officials from government own stocks in corporations, serve on their boards, and often get cushy jobs in the very corporations they "regulated" or acquired government contracts for when they retire from "public service".

Corporate executives also demonstrate their selfless commitment to the public good by going to work for the government and regulate their former employers.

Corporations are taxed and that tax money flows from the government back to corporations. Corporations spend millions lobbying, bribing, and electing government officials to enact laws and contracts favorable to them. Often it's the same people who govern both corporations and the government, and profit from both.

They have their hands in each other's pockets and scratch each other's backs.

</comment></comment></comment></comment></comment><comment><USER6> Heart attacks are a downstream consequence of the molecular damage of aging.

Everything that isn't repairing the root cause damage of aging is going to be a much less effective way of going about things if the goal is to avoid cardiovascular events of that nature. Keeping a machine from a specific failure mode without actually repairing the damage that raises the odds of that failure mode is a much harder thing to do than to enact repair.

This is largely why medicine for age-related conditions has been an incremental process over recent decades: advanced enough to do sensible things with downstream consequences of damage, and so produce marginal effects at sizable investment of time and resources but for various reasons unwilling or unable to address the damage itself. The reduction in heart disease over the past 30 years has been an enormous achievement when considered within these bounds: really going above and beyond, finding ways to keep the accumulation of damage from having the same level of consequences and juggling biochemistry to keep running at a lower failure rate for longer.

But still incremental, and to really solve the problem you have to repair the damage. Nothing else is going to do the job.

<comment><USER7> > _Everything that isn 't repairing the root cause damage of aging is going to > be a much less effective way of going about things if the goal is to avoid > cardiovascular events of that nature._

Tons of heart attacks before the age of 60 can be avoided simply by better diet and more exercise.

Given that, it doesn't matter if not ALL are.

Especially if the alternative is hoping for some unicorn anti-aging discovery.

> _But still incremental, and to really solve the problem you have to repair > the damage. Nothing else is going to do the job._

Yeah, we're still are going to age and die in the end. But the job here is not immortality, is not going down from a heart attack before that...

</comment></comment><comment><USER8> If big pharma's not interested, would the costs of getting this kind of therapy into paramedics' hands be within the reach of private philanthropy (e.g. Gates foundation or YC's recent non-profit efforts)?

<comment><USER9> Glucose, insulin and potassium are already readily available on every ambulance, so all you'd need is a clinical trial proving that the mixture is effective and safe to use for heart attack patients. The costs of a clinical trial seem well within the reach of private philanthropy, especially since this isn't an experimental drug where you'd have to start from scratch--all three of those meds have been extensively studied both separately and in combination. (Glucose and insulin is a combination commonly used to treat high potassium levels, for example.)

</comment></comment><comment><USER10> Here's a slide deck with data about the results of the trial (of Glucose Insulin Potassium) mentioned in the article.

[http://clinicaltrialresults.org/Slides/ACC2012/Selker_IMMEDI...](http://clinicaltrialresults.org/Slides/ACC2012/Selker_IMMEDIATEtrial.pdf)

From the conclusions slide:

"Composite endpoint of cardiac arrest or acute mortality was significantly reduced, and FFA levels were lower, consistent with the proposed FFA link to arrhythmias"

</comment><comment><USER11> > And so I started talking to the pharmaceutical companies saying, 'You know, > would you make this stuff?' And they basically weren't interested.

How many?

Which ones?

All of them or some or most of them?

So maybe a big name isn't interested.

There are tons of companies who make generics who would probably welcome the opportunity to market a concoction like this or at least entertain the idea.

<comment><USER12> You seem very ready to assume that the author didn't do his homework, while seeming equally willing to assume that there are some companies who would be game.

<comment><USER13> Given their track record, _any_ "advocacy" type article that appears in the news media should be considered written by someone who didn't do his or her homework until proven otherwise.

<comment><USER12> That's certainly possible, but then I still prefer something tangible in response, "Here is the homework you failed to do." You know?

It's too easy just to imply that someone didn't do it, and then sneak a claim in on the side.

</comment></comment></comment></comment><comment><USER14> A different [edit: diet based] approach to reduce heart disease (also advocated by a physician): [https://youtu.be/LXigmGZk5FU](https://youtu.be/LXigmGZk5FU)

This same approach also appears to address other leading causes of death.

</comment><comment><USER15> Yeah, let's get a pill to fix it and keep chugging processed industrial foods and sugar water while sitting browsing social networks.</comment>


Unpatchable Malware That Infects USBs - <AUTHOR> http://www.wired.com/2014/10/code-published-for-unfixable-usb-attack/ <comment><USER2> My dad collected some usb memory sticks from a trade show and he tried to empty them for his own use. One of the sticks he could't use: when plugged in, it sent keystrokes <windows key> \+ r + [http://whatevermarketingsite.com](http://whatevermarketingsite.com) \+ enter.

So it was just a dummy usb hid device that emulates a keyboard. No exploit or anything but a simple marketing gimmick that people take because of 'hey, a free usb stick!'.

Here's some more info: [http://blog.opensecurityresearch.com/2012/10/hacking- usb-web...](http://blog.opensecurityresearch.com/2012/10/hacking-usb- webkeys.html)

<comment><USER3> A common social engineering trick is to drop some USB sticks that have keyloggers, etc. loaded on them in the employee parking area of the target firm. Sooner rather than later, someone will plug one into a corporate machine...

<comment><USER4> Sure, but my recollection is that depended on either Windows Autorun (which hasn't been the default for quite a while) or people being curious/foolish enough to execute a file they find on the drive. This is a lot more insidious.

<comment><USER5> IIRC a talk by Travis Goodspeed mentioned that it was only internally disabled for USB and writeable media. If a USB device presents itself as a CDROM, it can still autorun things unless globally disabled by the user.

Or it could emulate a disk + HID keyboard, and enter the win+r filename.exe <RET> keystrokes necessary to launch it, or one of several other tricks.

It could also intercept mass storage requests, wait til you're copying an exe onto there (even if you've reformatted the drive since), and inject a payload into it.

<comment><USER6> This is how U3 drives, when they existed, were able to work. They emulated a tiny CD drive with an autorun bootstrap.

</comment></comment></comment></comment></comment><comment><USER7> I have been thinking about creating an active "USB Condom" for a while, and this might be the right time to work on it. It would be pretty straight forward to make a device that sits between a PC and a USB device and monitors the traffic. It could allow only certain device classes, or it could ask you to press a button for each file moved. My original thought was to stop the spread of viruses that are designed to move between computers over USB drives (my last job had a lot of trouble with these), but preventing it from showing up as a HID would also be useful in this case.

One option would be to build this into the chassis of a PC so that you know anything plugged into the green USB port will only work as a drive.

<comment><USER8> You mean like this?

[http://syncstop.com/](http://syncstop.com/)

<comment><USER7> I knew someone would mention that, and I almost put a note about it in my post. I think all that does is disconnect the data pins, so it wouldn't be too useful when you are attaching a flash drive to your computer.

<comment><USER8> Good point.

However, if the exploit is in the bios of the usb device, you can't trust _anything_ coming off of it. All you've got left is recharging it.

</comment></comment></comment></comment><comment><USER9> This might protect against malware infecting your device unexpectedly, but I think there's a need for OS manufacturers to consider this as part of the holistic security. Why not pop up a dialog when a new USB device with HID profiles shows up that the OS hasn't seen?

<comment><USER10> I hate to point out the blindly obvious, but what if you need the HID device to click on the box? So now you are stuck in a chicken/egg conundrum. You need the HID to click the box but the HID isn't installed until you click the box, great!

Unfortunately without going back to Windows 95-esk "please restart to install this keyboard" world, I cannot see how you fix this. Even blackholing some input from the HID is only at best a temp' solution (as they'd just add longer and longer sleeps before fake HID input was generated).

I guess you could redirect all HID input to a certain context (like a Virtual Desktop e.g. UAC prompt) until the user accepts it. However realistically most users would ignore this warning and just click "install" without reading it or understanding the implications.

<comment><USER11> I have an idea: Making and breaking the USB connection _itself_ is a form of input!

1\. Supposing all the more-convenient ways have broken down (no keyboard, no mouse, etc.)

2\. The OS displays a random 15-60 second countdown telling the user _when_ to unplug the device if they trust it

3\. The OS displays a second (random) countdown telling the user when to _re_ connect the device if they trust it.

4\. If both steps succeed to a reasonable level of accuracy (some fudge-factor for humans and for slow-powering-up devices) the OS will begin trusting the HID device and installing drivers etc.

This requires no additional hardware except for a monitor, and evil devices cannot reliably brute-force it without taking a lot of time and being very obvious and obnoxious about it.

<comment><USER12> So I hand you a malicious USB stick, you plug it in, the computer asks you to unplug it and plug it back in. You do so, because you trust the USB stick (why wouldn't you, free USB stick!).

<comment><USER13> Maybe it would be better to make you type some characters on the keyboard. Similar tricks with outher human interface devices. That way the user physically can't do it with fake USB sticks.

It would require that all these devices have at least some basic functionality with only some standard drivers. I don't know how true that is right now.

</comment></comment></comment></comment></comment><comment><USER14> The only way to mitigate against these attacks is to treat the USB bus the same way we treat the network: \- Communication with devices should only occur once they have been identified & authenticated \- Authenticated devices can only send type specific messages and can't change type without re- authentication. \- Data should be written as encrypted volumes to storage devices. (You should be doing this anyway.)

This is more like how bluetooth works. However that still leaves significant problems for HIDs. The only solution I see is remote attestation and securing the comms channel with encryption.

Even if USB is patched like this it doesn't solve the problem of having un- trusted peripherals or appliances. For example, would you trust that the signed firmware for a USB scanner is actually secure? It is quite easy for a scanner driver to be subject to a buffer overflow caused by data from the scanner. Scanner embedded malware could be triggered by scanning a specific form, or anywhere it sees interesting text, like 'SECRET' headers on a page. Networked scanner/photocopier/printers are even worse because they return PDF documents and are serviced by outsiders, and anything on the network can often send them a PDF to execute. I've managed to crash my printer many times by sending large/complex PDF/postscript/PCL5.

</comment><comment><USER15> Here's the talk from DerbyCon that the article is talking about: [http://www.youtube.com/watch?v=xcsxeJz3blI](http://www.youtube.com/watch?v=xcsxeJz3blI)

</comment><comment><USER16> It's been nearly 2 decades since USB was invented and I'm still of the opinion that USB keyboards provide no significant benefits over PS/2 in the majority of applications today - a keyboard that is always plugged into the same port. All the extra driver complexity and security holes like this could be avoided if people realised this simple fact.

USB tries to make peripherals "universal" \- and I don't think one of the primary input devices of the computer should be mixed in with the others in this way. (Trying to troubleshoot problems with USB controller drivers when the keyboard itself is USB can be... frustrating. The BIOS has its own USB keyboard driver but hands control to the OS after booting, meaning that any flaw in the rather complex USB stack can cause a loss of an important input device. On the other hand, I've never had any problems with PS/2 keyboard or mouse drivers.)

<comment><USER17> > significant benefits over PS/2

Being able to unplug a keyboard and plug it back in again while the PC/server is on without the PC/server freezing is a pretty significant benefit.

Also... though not a tech limitation... the only access point for a PS/2 plug being at the far back of the PC case can be really annoying (though I wonder what would happen if you had 2 PS/2 ports on a board and you actually plugged in 2 keyboards... probably a small explosion).

<comment><USER16> > Being able to unplug a keyboard and plug it back in again while the > PC/server is on without the PC/server freezing is a pretty significant > benefit.

What are you doing where being able to hotplug keyboards frequently is a "pretty significant benefit"? If you are working with multiple servers a KVM switch is a better solution.

(The problem with hotplugging PS/2 was that it originally wasn't designed for that so the interface lacked the necessary protection components, but more recently manufacturers have been realising that it's far cheaper to add the protection components than deal with returns from those who either accidentally or purposefully hotplug PS/2\. There's still considerable variance between when manufacturers did this, so it's still officially "not supported" but recent motherboards and keyboards/mouses should be robust enough to handle the occasional hotplug.)

The PC spec also only allows for 2 PS/2 ports and no more: one for a keyboard and one for a mouse. They use the same physical protocol so no catastrophic effects from putting in two keyboards/mouses or switching them around, but they just won't work since the commands are slightly different; some newer motherboards with a single PS/2 port can detect whether a mouse or keyboard has been plugged into it, and configure accordingly.

<comment><USER17> I had 5 or 6 1u servers in a rack. I would roll up a monitor and keyboard (provided by the data center folks). Twice just plugging in a ps2 keyboard froze the server. The fix was a usb keyboard (kept in the cabinet).

A kvm would be a solution... but for the rare visit to the colo it just wasn't worth it. One of those 1u rack mount with integrated monitor would have been nice (though the 1/4 cabinet was the top one so I don't think it would have worked very well).

Also with KVMs... wires and wires and wires. Blah!

</comment></comment></comment></comment><comment><USER18> Not to understate the severity of this issue, but how is this any different than if I built a custom device that contained a USB hub + emulated HID keyboard to fire off a malicious macro + flash storage housed inside a plastic shell that looked like a normal flash drive? I guess that would require developing and manufacturing custom hardware.

So maybe it's not different. And this just significantly lowers the barriers to entry to an extremely easy process using only off the shelf hardware. And now the malicious device can be anything from flash drives to keyboards to USB Missile Launchers.

That seems like a problem the manufacturers need to resolve, however inconvenient it is to have read-only firmware.

<comment><USER19> It's very different because your device is just one device. "BadUSB" type malware can spread like a virus/worm by infecting other devices. In your scenario the specially crafted device is the only infection point. With BadUSB an infected device is just patient zero. It infects computers, which in turn infect other devices plugged into it, which infect other computers, and so on and so forth.

<comment><USER18> Ah! Got it now. Thanks.

Ok. Now I'm concerned.

</comment></comment></comment><comment><USER20> > _To prevent USB devices' firmware from being rewritten, their security > architecture would need to be fundamentally redesigned, he argued, so that > no code could be changed on the device without the unforgeable signature of > the manufacturer._

Complete rubbish. No thrusted computing is required to protect a device from surreptitious programming by malware.

All you need is a write protect switch ("fuse") that is burned when the device is programmed for the first time, so that for subsequent in-field updates, it requires a physical override to enter into a programming state (the user has to flip some switch, or hold some pin-operated button or whatever).

<comment><USER14> But how do you know the write protect switch actually works? Maybe the manufacturer implemented it as a flag to the microcontroller. Maybe your 'trusted' USB stick was replaced by one that looks exactly the same but that has a different chip inside that mimics the vendor/device ID.

So you are back to requiring trusted hardware and trusted handling, which is impractical except for strictly controlled systems.

<comment><USER20> The trusted USB stick being replaced by a lookalike is a breach of physical security somewhere in the delivery chain between manufacturer and you. In that case, the programmability issue is moot; neither the original USB stick nor the rogue one have to have field-programmable firmware. The rogue one is hard- coded at manufacture time to do harm.

This is a different issue from white hat USB devices that turn black due to a remote exploit, and it is addressable by some form of trusted computing, like authenticating that USB devices are genuine. With this authentication in place, it's possible that there could be remote exploits that somehow retain the device's ability to authenticate while changing its behavior.

As far as trusting the manufacturer to implement the switch: it is hard to get away from trusting the manufacturer. You're plugging in their hardware into your device. Under the assumption that the manufacturer is working in good faith to prevent rogue reprogramming, it is in their interest to implement the switch properly, so it cannot be overridden in software.

Basically, the situation is that if someone wants to sell you, say, a rogue keyboard that steals your keystrokes, they can do that without even involving the USB protocol. A keyboard can have its own storage for keystrokes and its own channel for transmitting the information, not involving the USB interface. For instance, it could have on-board Wi-Fi, and a rogue firmware that finds a free hot-spot, makes a connection and sends its logged data to its "mother ship".

</comment></comment></comment><comment><USER21> So from my possibly naive understanding of this article the new researchers want to publish the exploit on GitHub to ensure it gets fixed. But even they hold off on some of the worst exploit vectors because of an ethical dilemma. It would seem to me that any of this being published is probably as good as all of it for bad actors to reverse engineer the exploit and then study the usb spec and create new attacks. Just the mention of this sort of exploit is probably enough to make someone try and find it. So they seem to be contradicting themselves here. If it needs to be fixed and releasing will spur the industry into fixing it, it should be published.

Is there something I am missing here? Serious question.

</comment><comment><USER22> There needs to be a built-in pairing button on the computer that you have to press to allow a new device to be activated. Sadly, it probably won't stop this attack because when they plug it in they will just press the button.

</comment><comment><USER23> Do we really need to repost this every 2 months? The first proof of concept for this kind of attack has been demonstrated 7+ years ago at the CCC. It pops up every year and every time people act like this is news.

<comment><USER24> Source?

</comment></comment><comment><USER25> The rule in the '80s and early '90s was never ever exchange floppy disks with anybody and never insert other people's floppy disks in your PC. Enter the LAN and the USB sticks, problem solved. Not.

I'm afraid we have to go back to exchanging files over the LAN. Or turn on our WiFi cards in hotspot mode and create a LAN ourselves. There are going to be good opportunities for desktop and mobile apps. Obviously Evernote and Dropbox are already here but they are not exactly the same thing.

<comment><USER26> > I'm afraid we have to go back to exchanging files over the LAN.

1 horribly infected computer on a LAN can be a nightmare for everyone else connected.

<comment><USER12> That's the definition of a worm.

</comment></comment></comment><comment> mark-r Is there something in the USB spec that requires the internal processor to be updatable? Couldn't they just lock the firmware down at the factory?

<comment><USER27> No, there's nothing in the USB spec that requires the internal processor to be updatable. The headline is clickbait.

To get this to work, you need to solder wires onto the USB flash drive's PCB, and then program a "burner" firmware image into the microcontroller. Only then you can remove the wires, and further program its firmware over USB. The stock firmware for nearly any USB device would never allow itself to be upgraded over USB.

This strategy allows you to give someone a malicious flash drive that enters keyboard commands into the computer (this has been done before), or infects the computer by pretending to be a device whose driver has a security flaw. It would not allow you to infect the other USB devices connected to that computer, because they don't have burner firmware.

<comment><AUTHOR> I think you're wrong: as I understand it, many of the consumer USB sticks can be flashed over USB. No soldering required.

<comment><USER27> Yes, you're right - I've done some more research on the github site, and figured out how they do it. The burner image can be sent to RAM over USB, to cause the microcontroller to boot from it. Then, that burner is used to flash the malicous firmware image.

</comment></comment></comment></comment><comment><USER28> This attack vector could also be used by USB charging devices. That's been done before using Windows vulnerabilities, but this is more general.

</comment><comment><USER29> Since this is like the old floppy disk days, where any disk could be infected, would a version of the same solution apply? I'm thinking of the old boot- sector protectors that would announce your disk is clean, thereby occupying the space a virus would otherwise claim. Of course there would have to be something in place to verify this wasn't just malware calling itself a protector.

<comment><USER14> What this requires is called remote attestation. People have been working on this for smart cards and embedded systems, though PCs and VMs/cloud get more attention. It is very complex though.

[http://web.cs.wpi.edu/~guttman/pubs/remote_attest.pdf](http://web.cs.wpi.edu/~guttman/pubs/remote_attest.pdf)

</comment></comment><comment><USER30> When I bought my last car, they sent what appeared to be a USB flash drive. It had some warranty documents on it, and also emulated a keyboard. I think it popped up a browser went to a webpage and prefilled my VIN and some other details so I could register my car. This was several years ago. How is this different?

<comment><USER8> That was probably done as an application that ran from the USB stick, similar to the way AUTOEXEC.BAT works on Windows (it sees it on mount, it runs it).

I think the exploit version occurs at a lower level down in the bios of the stick, where it's far more insidious.

<comment><USER30> I thought I remembered windows saying it detected a new keyboard device, or my brain may have invented that part. I'll see if I can't find it laying around and see how it actually worked.

</comment></comment></comment><comment><USER31> Have usb device supply some kind of a checksum/key of its firmware when connecting to the computer.. the driver would then compare that checksum/key to the list of trusted checksums. But of course, hackers could extract the checksum from the driver, and hack the firmware to always return it :/

</comment><comment><USER32> > showing that it's possible to corrupt any USB device with insidious, > undetectable malware

That is surely false. It depends on the type of microcontroller used and its configuration. And indeed the github link in the article is only for certain types of USB flash drives (Phison 2251).

</comment><comment><USER33> USB is just so vulnerable... Kali Nethunter is now exploiting some of its idiocy.

[http://www.kali.org/kali-linux-nethunter/](http://www.kali.org/kali-linux- nethunter/)

<comment><USER34> Is USB vulnerable or are many USB implementations vulnerable?

</comment></comment><comment><USER35> Can't some of this be patched at the USB driver level in the OS? A storage device shouldn't be acting like a keyboard, etc.

<comment><USER10> That's not how this works.

The device acts like a USB hub which happens to mount both a keyboard and a USB drive.

So unless you ban all USB hubs then this isn't workable.

<comment><USER36> Banning USB hubs isn't really workable either. Any keyboard which has USB slots would be blocked, for instance.

</comment></comment></comment><comment><USER37> USB devices need to be regulated to ensure this kind of thing can't happen. Perhaps the FCC's arm reaches far enough that they could tackle this issue, otherwise maybe a separate task force should be created for this.

</comment><comment><USER38> Am I the only one cringing at the use of the lone term "USB" to describe "USB flash drives" in this article? I would have expected more from Wired.

<comment><USER39> Because it's not just USB flash drives. Any device, a cell phone, a mouse, a webcam, anything that connects via usb, could essentially connect as a USB HID (human input device) and start issuing commands on the computer as if it were a human. But that's not the only thing it could do. You should read the article.

<comment><USER38> > Because it's not just USB flash drives

As for the actual flaw, yes that's true. But that's not what this article is talking about.

> You should read the article.

I did. It says:

> "People look at these things and see them as nothing more than storage > devices," says Caudill. "They don't realize there's a reprogrammable > computer in their hands."

It's clearly talking about the storage devices. If they were talking about the bus protocol they'd say "USB is nearly impossible to secure in its current form" instead of "USBs are nearly impossible to secure in their current form"

<comment><USER4> I think you're being kinda pedantic. It's like people who write "ATM Machine." It's wrong, but it's not a big deal and the reader understands what they're saying.

<comment><USER38> > I think you're being kinda pedantic

Possibly. I wouldn't care if it was speech. I wouldn't comment if it was a regular newspaper. But WIRED writing like this?

<comment><USER4> I used to really enjoy Wired in the pre Conde Nast days....

</comment></comment></comment></comment></comment></comment><comment><USER40> Why so many Wired Magazine articles lately?

<comment><USER41> Somebody catching up on their reading, maybe?</comment></comment>


Tomorrow Market offering infinite private beta spots for HN users - <AUTHOR> http://www.tomorrowmarket.com/user/register?special=hackernews

<comment><USER2> Well, once in on the site, it is really very bland looking. It isn't difficult to read, but there isn't an effective call to action either. This could be because i have no idea what I would use it for.

If i were you, i'd make it more like a news game. Not sure how you would accomplish this, but that could give it a more realistic spin and attract a diverse group.

Most of the stuff I'm seeing on the site falls strongly into the 'who cares' column. Maybe you should take a few current news topics and have those as headlines and get users involved with something everybody is familiar with.

As it currently stands, i'd spend a lot more time on design and marketing (figuring out how you are going to get people to use it/spread it).

I don't find it usable/workable as it is, and I feel your opportunity for success with the current version is very limited.

I wouldn't go into any sort of public beta with this. I actually feel it is too early for you to be doing private beta, but I know it can be difficult to get honest feedback from aquiaintences.

Don't read what I'm saying as 'this can't be successful'. Your idea has merit, you could make something of this, but you have to have a better product than you currently have, even in closed beta.

</comment><comment><USER3> What is Tomorrow Market? I couldn't find info on the site, I admittedly only looked for a minute.

<comment><USER4> WARNING:

Don't give your real username and password! I've tried with a fake password and works!

<comment><AUTHOR> If you're serious, email me details at email@example.com. Passwords are encrypted, by the way.

Update: people are confused because the sign up page looks like a log in page because it is so short. You can not log in to Tomorrow Market with any password.

<comment><USER4> > people are confused because the sign up page looks like a log in page > because it is so short. You can not log in to Tomorrow Market with any > password.

That was the case. The title suggested if I login with my HN credentials I'll benefit "inifinite private beta spots". I login with my HN username and fake password which worked.

Then I was alerting HN users do not use their real credentials. And got my karma downvoted :D

</comment></comment></comment></comment><comment><AUTHOR> Tomorrow Market is a social prediction market. Hacker News members get to skip the email verification. Let me know what you think.

<comment><USER5> >> We strongly believe that predicting should be a social activity.

Can you explain more about what the purpose is? I can see why predicting certain things can be important, but after reviewing the "tour" and the issues being discussed, it seems like a game of chance to me. What are the benefits to being involved in a community like this?

<comment><USER6> Prediction markets* aren't games of chance; they're an economist's tool, an alternative to polls, or an embarassment to prognosticators. Not that they're perfect+.

Even less perfect when I can't find a list or search-box to select among the "symbols" to sell and purchase. Also, the "social" part is difficult when I can't find a place to "discuss" on each contract.

*<http://en.wikipedia.org/wiki/Prediction_Market> +<http://www.slate.com/id/2189135/pagenum/all>

<comment><AUTHOR> All of the symbols are listed on the sidebar. Good idea about contract discussions. That's in the pipeline.

</comment></comment></comment></comment><comment><USER7> It is a good idea, although I wouldn't use real money for something like this. I agree with radu_floricica that it is difficult to understand how the bidding works on first glance. I'd try to add more information on the pages, not only in the faq and tour.

<comment><AUTHOR> Thanks for the comment. I will definitely be adding more information and making the bidding process more "instantly intuitive."

</comment></comment><comment><USER8> It's interesting both in concept and execution, but isn't it a bit empty? It's usually a good idea to populate something like this beforehand, even if it's with fake/random accounts.

Also the bidding interface might use some contextual help. Everything is probably explained if I read the docs, but if I just want to jump in it's a bit difficult. For example the difference between Market and Local.

</comment><comment><USER9> Isn't this the same thing as Inkling: <http://home.inklingmarkets.com/>

...or am I missing something?

<comment><AUTHOR> It's similar, but not the exact same thing. It's supposed to be more social than products like Inkling and InTrade.

<comment><USER9> Fair enough. This may be something you want to put on your "About" page.

</comment></comment></comment><comment><USER10> Can I ask what it is?

</comment><comment><USER10> Can two members make the same prediction?

<comment><AUTHOR> Two members can make the same trade, so yes.

<comment><USER10> a trade is the same as a contract? If it is, won't more than one of the same contract devalue the shares in those contracts?

BTW, there is a typo on the FAQ page 'How much _many_ do I start with?'</comment></comment></comment>


Disorderly environments stimulate  creativity [pdf] - <AUTHOR> http://www.carlsonschool.umn.edu/marketinginstitute/documents/VohsRedden_PhysicalOrderliness_2013.pdf

<comment><AUTHOR> It's a paper worth reading. For others, here's the conclusion:

 _> There exists a large and growing industry around instilling environmental orderliness. Proponents claim that people see measurable life improvements from becoming neat and tidy, and they can point to multiple billions of dollars in annual revenue as evidence of success. In contrast, many creative individuals with Nobel prizes and other ultra-prestigious awards prefer — and in fact cultivate — messy environments as an aid to their work (Abrahamson & Freedman, 2007). One such person was Einstein, who famously quipped, "If a cluttered desk is a sign of a cluttered mind, of what, then, is an empty desk a sign?"

> As with many vociferous debates, it seems that both sides have a point. > Orderly environments promote convention and healthy choices, which could > improve life by helping people follow social norms and boosting well-being. > Disorderly environments stimulate creativity, which has widespread > importance for culture, business, and the arts. The use of systematic > experiments to reveal the causal role of each setting means that people can > harness the power of each environment to achieve their goals._</comment>


Handling numerical input in mobile web apps or "A sad tale of two keyboards" - <AUTHOR> http://mir.aculo.us/2013/08/30/handling-numerical-input-in-mobile-web-apps-or-a-sad-tale-of-two-keyboards/ <comment><USER2> And even though you think you can type "15m" using the iPhone, as per the HTML5 spec, it will validate the field and prevent you from submitting the field if the result isn't a floating point number(!).</comment>


Why Desktop Linux Still Matters - <AUTHOR> https://www.howtogeek.com/676963/why-desktop-linux-still-matters/ <comment><USER3> It's staggering the amount of things I can do on Linux. One basic feature that I can't believe isn't on macOS or Windows is in Xfce, where I can right-click a window titlebar and put it always on top. I'm sure Windows has the _capacity_ to do this - WinAmp iirc lets the user toggle this in the app - <USER2> I can't do it for programs like Firefox.

It's the little things that make me like Linux, things like that. It's endlessly customizable, and if nobody's made something I want yet, I can just make it myself. Nobody's stopping me. Plus, it doesn't have Candy Crush preinstalled in the year 2020.

<comment><USER4> Funny thing is it was that little things that made me switch to windows as well. The last time I tried to usimg ubuntu, I wasn't able to drag drop a subtitle file from an archieve directly to vlc. I had to drag it to a temp folder to decompress it. And then I was able to drag that subtitle file to vlc

</comment></comment><comment><USER5> > About two percent of desktop PCs and laptops use Linux, and there were over > 2 billion in use in 2015. That's about 4 million computers running Linux

Yawn...I'm not sure what to expect from someone who cannot even do basic math...

<comment><USER6> They dropped a zero. The correction is useful, the snark is not.

<comment><USER5> They didn't _just_ drop a zero. They based their reasoning on that number, the next sentence suggests it's like the population of Kuwait (~4.5M). No, it's more like California:

[https://worldpopulationreview.com/states/california- populati...](https://worldpopulationreview.com/states/california-population/)

Or Canada. Or Iraq, to stay in the Middle East.

<comment><USER7> I agree that the assertion was at the beginning of the article, but I don't think the remainder of the article is predicated on this claim. In other words: I don't think the order of magnitude invalidates the rest of their argument.

</comment></comment></comment></comment><comment><USER8> > Linux would penetrate the PC desktop market and displace Windows

Linux would penetrate the PC desktop market and will be called Windows... and I believe it'll be good for users and good for Microsoft

</comment><comment><USER9> Linux on desktop is one of those things where reputation precedes reality. It runs fine most of the time, but many remember or have read the nightmare stories about non-functioning hardware, the need to compile drivers and so on. While Linux has been sorting out those issues, a lot of things moved ahead to SaaS and Web applications and for majority the device is just a terminal. Which runs Windows or MacOS because people are complacent and don't care.

</comment><comment><USER10> > I've met Mac owners who thought their computer was running Windows "the > Apple way,"

I also have met those people, eventually they will figure out that you can install Windows on Mac just fine.</comment>


Show HN: GitHub front page for open source ESB - Warewolf-ESB

We've recently taken our software open source and are hosting it on GitHub.
We're looking for feedback on the GitHub front page - as a software developer does it give you the information you are looking for? Is there anything missing? What else do you want to see there to make a decision to get involved or not?
https://github.com/Warewolf-ESB/Warewolf-ESB
Any feedback much appreciate.
Thanks <comment><AUTHOR> Hey there, a few points:

1\. If you're going to claim it's easier than others, give examples. I've had to work with a few, mule, spring integration, and it's a pain to wade through tons of docs.

2\. Getting started page: this is teeny [http://community.warewolf.io/uploaded/image/9453/35540/10280...](http://community.warewolf.io/uploaded/image/9453/35540/1028013/cd528aefc2f9b4d0cfe40fa0b255f5c7.png) i can't read that at all.

I'd like to see examples, how can i implement aggregation, filter, resequence, blah blah. This is where i'd like to see comparisons with other esbs. Give you a chance to explain "easiest service bus .."

HTH

<comment> Warewolf-ESB Thanks for the feedback - We're working on extending our examples at the moment. Is this the kind of thing you would be looking for? [http://community.warewolf.io/topic/544566-backup- solution/](http://community.warewolf.io/topic/544566-backup-solution/)

Thanks again!</comment></comment>


HN Needs More Transparency - <AUTHOR>

HN seems sometimes to be falling into a trap of being heavily over-moderated.
Posts just disappear, titles change, posts drop off front page suddenly, etc.
There should be more transparency regarding admin/mod actions that affect posts. There should also be transparency showing the various weights/auto-moderation that is applied to posts.
Perhaps show mod/admin edits on posts, and have a page where users can view current system-applied auto-moderation rules. <comment><USER2> Like Stackoverflow?

How about an (edited) tag when they are changed and a quick why?

</comment><comment><USER3> Why?

EDIT:

There is openly aggressive moderation going on, which is well-documented.

If you want these changes, you need to better articulate _why_ they are a good idea, and _what_ they'd improve. Democracy for its own sake is bullshit.</comment>


The Web Fundamentals Gap - <AUTHOR> https://zendev.com/2017/10/24/the-web-fundamentals-gap.html <comment><USER2> People have been building websites for more than 20 years. There are _a lot_ of developers who are capable of building straight forward CSS and vanilla JS websites. The only 'problem' is that they're experienced and cost more than a bootcamp graduate.</comment>


Ask HN: How many startups fail because their MVP is too minimal? - <AUTHOR> In my own product development I get so caught up in figuring out the least amount of stuff to build to test my value proposition that I often forget, building an MVP is just one strategy. Does anyone know how common it is to fail because of building too little? Any examples? <comment><USER2> > How many startups fail because their MVP is too minimal?

None.

They fail because they didn't talk to customers, didn't do sales, didn't do marketing, or failed to find a viable service model after all that.

MVP is shorthand for "do the least work customers will pay you for." Customers are shorthand for "people you can find who will pay you."

MVP is quite often abused to mean "here's a thing I made." If you don't have customers, and you can't find customers ... then it's not viable yet, is it?

Here's a thing you can do:

You have a hypothesis that [service you can provide] will be valuable to [people you can find]. Okay, so go check that you can actually find those people. Then talk to them about what they do.

You are not allowed to sell, or ask "would you buy this." Facebook surveys are also right out. You need targeted customers, not a bunch of random people with few common characteristics besides being bored enough to respond to Facebook surveys.

Your objective is to learn about these people. How do you find them? How do they talk about the problem? How do you tell them apart from people who really don't give a shit about the problem?

Once you've got a target customer validated at the talking-to-people level, then you can try building stuff. Start with the least work that you think will get people to pay you. It's probably much smaller than you think, and may involve no code.

You don't need to solve everything that anyone told you about the problem, you just need to do enough to make their corner of the world a little better.

Then, go back and try to do sales. Face-to-face sales is the highest conversion rate condition you're ever going to have access to. It doesn't have to scale to infinity million dollars of revenue. It's validation. (Although it's also quite possible to get to stability on boot sales alone, if you charge enough. Which is the only time I _ever_ want to hear that "with no marketing" meme.)

If you can't sell when the deck is stacked in your favor, you don't understand your customers, or you're working on something they don't actually care about.

Treat stuff as a hypothesis. Then test it. Don't just throw code at the wall either. Code without a customer is not a product, it's just some thing you made. Figure out who the customers are and aren't. Then try to find them & talk to them. Learn about them. Then build.

Nobody failed because their MVP was too minimal. They failed because they didn't have customers & didn't do the work to fix their understanding of the world.

<comment><USER3> This is a great post, but I think what the op is asking is how many business fail because what they thought was a mvp was not actually a mvp.

I should add you can still fail even if you have customers. In someways having customers can be worse than having none. If you have no customers you know what they problem is, but if you have customers and no growth then it can be hard to work out what to do.

<comment><USER4> I think the parent's point is:

Yes, you can be short of desirable features for your customers and fail; but the real failure is that you didn't talk to your (potential) customers to identify this gap. In other words, you shouldn't be adding more features if you think your MVP is too minimum - you should be talking to customers to really find out.

<comment><USER3> Talking to customers is critical, but you need to do it in an intelligent way. Just asking customers what features to add will have you end up with a monstrosity with each customer asking for something different.

<comment><USER2> "What features should I add" is another trap question. Avoid this.

You want to study the people & problems you're targeting to the point that you become the expert they're trusting for advice about the problem. This is hard, but not that hard - minimum viable expertise is a thing as well.

For example, not everyone who uses email as part of their hiring process has spent an enormous amount of time studying how to improve contact-to-interview conversion rates. Specializing on this & studying across N people who are a close match for your target customer can quickly give you working expertise on the problem, because everyone else is worrying about 10 other things at the same time when working with it, while you can go deep on that one thing.

Then based on your understanding of their workflow & what ought to generate value (as obtained by talking to those people in a learner mode vs. a sales mode), you generate a hypothesis and test it. If it actually helps deliver value, and the problem actually matters, and you actually understand these people well enough to get them to trust you...congratulations, you might have yourself a viable product.

For the above example, you need exactly zero unique software to pull this off. You can start as a completely manual service with direct sales only against the people who you think will be most likely to buy. Give yourself the easiest win conditions you possibly can, requiring the least time and investment. Then, build on that, add automation as appropriate and test that the value is still delivered, try to scale, etc. - but start with the scaleless version, it ships easily and then you have actual customers who are paying you.

<comment><USER3> I agree that knowing what to build is a real skill and one that is not easy to get right. Sometime you have to make a judgement call on what the market really wants and build it.

Unfortunately not all problems are amenable to "stubbing out" with human labor. With my product every new feature has to be built first and then introduced to the market - sometime they stick and other times they fail to get used despite being really great (customers aren't always rational).

</comment></comment></comment></comment></comment></comment><comment><USER5> If it's too minimal, you just build out more until you have something that's viable.

A bigger risk is failing because you've built _the wrong features_. It's harder to change or remove features than it is to build them, and you also don't get the time back for misplaced features. Hence the bias toward starting small.

</comment><comment><USER6> By definition, if it's too M it's not V.

<comment><AUTHOR> Solid rubric.

</comment></comment><comment><USER7> also curious +1</comment>


Ask HN: if not SQL then what? - <AUTHOR>

There are plenty of public complaints about SQL lately, and there were some hot discussions here on HN about SQL/NOSQL.
I have a toy project in Haskell, an in-memory DB implementing some limited subset of SQL and transaction support. I started doing this to first learn more about STM, then lightweight threading (forkIO). I implemented JDBC binding too, and can use it from Java.
Every time stumbling upon the SQL/NOSQL debate I feel myself a dinosaur: I work on SQL DB and there are some folks in the Valley who have a periodical meetup against SQL. The question is: if not SQL then what? What are the problems with SQL (I'm not addressing particular SQL implementation problems and standards compliance here, just the language implementing relational algebra per se)?
For example, document-oriented DBs look nice, but what's the fundamental advantage? Key-value stores look oversimplified to me. Any other approaches I missed? <comment><USER2> Anyone who is meeting up _against_ SQL is a moron. SQL is a great solution 90% of the time and only a fool says otherwise. You should use SQL until you have a good reason not to.

10% of the time it doesn't work. It will fail due either to performance (compare memcached to any SQL server) or expressiveness (e.g., no SQL query will give you the path in a graph). You'll need a different NoSQL solution for either case. Key value stores are great when you need performance without features. Object databases are great when you need to map OO into the DB. Tree/graph databases are great when you need to store graphs.

I think the main reason we have a NoSQL movement is that before the social web, SQL was a great solution 98% of the time.

<comment><USER3> _no SQL query will give you the path in a graph_

Could you explain what you mean there? Do you mean the path of how a graph was traversed?

<comment><USER2> Consider a graph, e.g. the facebook friend graph. You can't write a SQL query which will determine if I'm connected to Kevin Bacon and via which friend.

SQL expresses first order set theory, but graph connectivity is not a first order property.

<comment><USER3> Perfect. Thanks.</comment></comment></comment></comment>


Google talent search: error 502? - <AUTHOR> http://www.sfgate.com/cgi-bin/blogs/techchron/detail?entry_id=50641&tsp=1 <comment><USER2> There is one problem with the correlation citet by Peter Norvig: since the persons that got a 1 on one of the interviews and are hired are not a representative sample of all candidates that got a 1 on one of the interviews, the real predictor for success is probably not the interview score, but the fact that one person in the hiring process was passionate enough about them to pound on the table and insist that they were hired.

<comment><AUTHOR> Also, do they tell the people they hire what score they received on the interview?

Perhaps the "1" people feel that they have something to prove and consequently work harder.

<comment><USER3> No. Scores remain secret, even if you are hired.</comment></comment></comment>


Google Will Collapse - <AUTHOR> https://hackernoon.com/how-google-collapsed-b6ffa82198ee <comment><USER2> Should be tagged (2017)</comment>


Malware leads Minnesota school district to close for 1 day - <AUTHOR> http://www.startribune.com/malware-leads-minnesota-school-district-to-close-for-1-day/372623011/ <comment><USER2> This is really disappointing and feels like a regression. We've managed to teach and learn for _centuries_ without any computers, and now problems with them can cause schools to _close_? I've taught _programming_ courses without needing to refer to a computer.

 _So to give tech support staff a chance to start rebuilding the system, they closed all five schools in the district on Thursday._

"Tech support staff", so presumably the teachers didn't need to be involved at all.

I'll refrain from further ranting on how {black,white}boards, dead-tree books, and writing instruments were all we needed when I was still in school.

<comment><USER3> If I had to guess it wasn't really necessary from a teaching standpoint but they decided it was easier since nowadays they manage the entire school on their school information system. Attendance, lunch room balances, etc. are all routed through the systems nowadays and trying to do it all by paper and then re-entering it the next day would have been a huge PITA.

This is yet another reason for schools to switch to mostly Chromebooks. Pretty much impossible to get malware spreading on those things.

<comment><USER4> Chromebooks protect you against some categories of malware, but they also add a dependency on the internet and giving Google tracking data. While it is hard to quantify these costs, they do exist and should be considered. In particular, requiring the internet is a huge risk which may require even more shutdowns in the future if the internet ever goes down.

<comment><USER3> The SIS systems are almost all hosted these days so it's the same risk from an Internet requirement. Google doesn't track usage on students use of Chromebooks.

</comment></comment></comment></comment><comment><USER5> Not exactly the circumstances I'd like to see my state hit HN with... My guess: school districts up north have some extra days built into the semester (usually for closings due to snow storms) and they figured it would be less stressful for everyone to close for a day while they sort things out.

</comment><comment><USER6> I hate articles with no details. It would instructive to know what type of malware, what OS versions, what server infrastructure, etc so that others might be forewarned. Of course I realize it's probably Windows XP without patches but it would still be nice to know.

</comment><comment><USER7> This happened last week to my girlfriends brothers schoo, we are in the UK. Ransomware attack that encrypted their NFS shares. They did not close however. I _think_ they may have had to pay the ransom.

</comment><comment><USER8> Medical organizations have downtime procedures when centralized technology isn't functioning in production. In general, things move to more of a peer to peer set of procedures, manual intermediary record keeping, and procedures to synchronize the system to the actions during downtime.

Education interruptions, especially in public schools, don't have the same magnitude for needing documented resilience, but surely some people should be able to just wing it in the class rooms.

Or do social time / pre adult day care like how half my public school hours seemed to be.

<comment> nommm-nommm It's extremely unlikely computer use is actually required to teach in the classroom. The malware attacked the district's servers. The ability to administrator was likely what was effected since servers can control things like door locks, bells, alarms, heating, and access to student databases.

</comment></comment><comment><USER9> _The bright spot, Scarbrough says, is no personal student or staff data or financial information is at risk._

They have lax enough security to allow malware to shut them down for a day, they have unknown programs running amok in their network, yet, somehow, they are confident that no personal or financial information is at risk?

Next week's headline: Hackers demand ransom, threaten to post Minnesota School district's student and financial info online.</comment>


Running containers from Mac OS X - <AUTHOR> https://hyper.sh/blog/post/2015/07/30/running-containers-from-mac-os-x.html

<comment><USER2> Wait... If they're using VirtualBox isn't this just a Hyper version of boot2docker?

In other words, the container is actually not running on OS X but on a Linux VM in OS X.

Or am I missing something?

<comment><USER3> Disclaimer: I'm the author of this article

You are correct. As explained in the article, containers are running on a Linux VM, from Mac OS X, not natively on Mac OS X.

A few differences between Hyper for Mac and boot2docker though:

1- Docker commands are run inside the boot2docker VM and not directly on the host . Hyper daemon directly runs on your Mac.

2- When using boot2docker, each time you restart the VM, you have to manually mount the drives (and reinstall Fig if you're using it)

3- While boot2docker is a "wrapper" around Docker and VirtualBox, Hyper for Mac is part of the whole Hyper ecosystem, providing a similar environment on Linux, or Mac OS X.

</comment></comment><comment><USER4> That is correct, but isn't the difference that the hosted docker images are 'fully' isolated from one another including the kernel.

I thought docker came about because this mechanism is inefficient, but if they have, as they claim, resolved that particular problem, it might be interesting</comment>