NSA Starts Contributing Low-Level Code to UEFI BIOS Alternative - <AUTHOR> https://www.tomshardware.com/news/nsa-contributes-low-level-stm-coreboot,39704.html <comment><USER2> I applaud moving away from UEFI, to something simpler and more transparent, and something not hostile from the start to open source.

I like how relatively simple my Coreboot systems are. The sooner that Coreboot can minimally initialize hardware and invoke an open source bootloader or Linux kernel payload directly, the better. (Bonus, if the kernel doesn't need legacy PC BIOS services.)

Regarding concerns raised in the article, I'd be more suspicious of closed microcode and firmware blob parts, than of open source parts. Many knowledgeable eyes on the open parts can help. Though, of course, open parts could, in theory, be crafted to provide affordances for naughtiness involving closed parts. I have mixed feelings about recent initiatives to push closed updates more widely and reliably, and look forward to more-open hardware.

<comment><USER3> I still think it's problematic, since it is in the vital interest of the NSA, and one of its core missions, to be able to penetrate endpoint security at that level. If they contribute to Coreboot, then that means either that they want to compromise the project or that their "tailored access" group already has enough other ways of comfortably breaking the security of any PC at a level that is low enough (to evade all user-level software, anti-virus vendors, etc.). Both possibilities are bad for international users, even if the second one is obviously more preferable.

It makes no sense for the NSA to assist making PCs secure for non-military use and for use by non-US citizens against their own attacks, because it contradicts their mission statements. The only other (not totally implausible) explanation is that different departments within the NSA are so disconnected from each other that they have started to work against each other.

<comment><USER4> _vital interest of the NSA, and one of its core missions, to be able to penetrate endpoint security_

It's also a core mission of the NSA to protect US networks from attack. If they're inserting backdoors in products used by US businesses, they're directly undermining their core mission.

<comment><USER5> What about PRISM? Protecting US networks is clearly not a part of their mission.

<comment><USER6> Do you even understand what PRISM was?

<comment><USER6> More info to better conform to the guidelines.

OP, your insinuation is that PRISM weakened US networks, but that is a misunderstanding of what the program actually did. Wikipedia:

>The actual collection process is done by the Data Intercept Technology Unit (DITU) of the FBI, which on behalf of the NSA sends the selectors to the US Internet service providers, which were previously served with a Section 702 Directive. Under this directive, the provider is legally obliged to hand over (to DITU) all communications to or from the selectors provided by the government.[38] DITU then sends these communications to NSA, where they are stored in various databases, depending on their type.

I personally think it's important to understand what types of surveillance our government is doing and not listen to FUD on what people think they are doing. In this case, there's no weakening of a network. The FBI provides a selector (email) to the service provider, and the provider uses their own systems to retrieve the data and send it back. The "direct line" that many people reference is to the database of selectors, so that FBI can push it directly to the provider.

</comment></comment></comment></comment></comment></comment><comment><USER7> People in this thread are talking about how they wouldn't trust the NSA at all. I went to a presentation and talked with people from the NSA before and at face value they seemed like a silicon valley tech company. In their presentation they talked about how they were interested in open source, diversity, big data, artificial intelligence, and all the other buzzwords. They all seemed like they genuinely thought what they were doing was helping people. I know what they've done (and continue to do) but it's strange being able to attach a face to an action. You're more likely to believe them and buy what they are saying. I suppose the best thing to do is check over their code and accept it if everything looks good. They probably are being genuine.

As a an extra piece of information that I found interesting, they were pushing the diversity stuff hard. Everyone that gave the presentation were women (and they weren't low level people), they had an African-American person that worked there talk about how inclusive it was, they talked about how they're super accepting of LGBTQ+ people, and on and on. The tech stuff was for like 5 minutes, then the rest was on diversity (at a tech presentation, looking for recruits). I'm not exaggerating.

<comment><USER8> So all of this makes what they actually do as a living okay? You know, dragnet surveillance, physically wiretapping Google's internal network, backdooring encryption, etc.? Since when are we trusting the face value of anything somebody at the NSA says? Where's the skepticism gone from the Snowden days? Like, these people aren't our friends. Any code contributions from organisations like this, which do not have our best interests at heart and at worst actively attempt to subvert efforts at hardening encryption and other security efforts, need to be combed over with a fine-tooth comb.

Hell, as a European, the NSA is very clearly the enemy. Their goal is to protect US citizens, maybe, with very unconstitutional methods. They have little to no interest in the privacy or legal rights of people outside of the US, and yet have an unimaginable global reach.

<comment><USER9> The fact that they're not committing their changes under a pseudonym or front company suggests that they're okay with the world knowing about what they're up to. Same with their reverse-engineering toolkit.

What Snowden publicized was, for the most part, completely hidden from the view of society. The NSA wasn't coming to tech conferences announcing their new surveillance tools.

Don't think that the new parts of Coreboot won't attract scrutiny from security-conscious companies and individuals.

<comment><USER10> > The fact that they're not committing their changes under a pseudonym or > front company suggests that they're okay with the world knowing about what > they're up to.

They are not committing their most secretive and effective tools on GitHub for Christ's sake.

</comment></comment></comment></comment><comment><USER11> Oh, cool. I really enjoy coreboot in principle, but I wish more systems supported it. None of my daily drivers are running Coreboot, as of today. I'm pretty inept when it comes to low level stuff, but I've been playing around trying to port Coreboot to an unsupported laptop board. It's probably futile, but it was pretty exciting seeing some serial output for the first time.

From lurking around, one of the more surprising things I've found is that DDR RAM initialization seems to be the single most difficult aspect of the whole boot process, or at least on typical PC platforms. Not to say everything else isn't also difficult; the debugging tools available to the general public for firmware are fairy rudimentary.

<comment><USER12> There was a story a few years ago about "Intel Boot Guard" making it impossible to install things like Coreboot. I don't know if that was ever resolved.

<comment><USER13> That's not strictly true. In my view, Boot Guard is sort of like a locked bootloader. In Boot Guard, the CPU verifies a signature on system firmware before loading it. The signature is verified using a public key from the platform manufacturer. So under the Boot Guard regime, the platform manufacturer essentially gets a vote in whether your platform can run modified firmware level code. Or you find a jailbreak.

<comment><USER12> OK, in that case I'd be very interested to know which motherboard manufacturers are friendly to installation of replacement firmware and which not.

coreboot.org links to libreboot.org, but the list of supported hardware is pretty short: [https://libreboot.org/docs/hardware/](https://libreboot.org/docs/hardware/)

<comment><USER13> I think purism might be amenable. Worth double checking with them.

<comment><USER12> They don't even use Intel CPUs, it seems. Boutique vendors would be out of my price range, and the few boards supported by Libreboot seem to be circa 2009 models, presumably preceding Boot Guard. I doubt that it's something I'll be using any time soon.

</comment></comment></comment></comment></comment></comment><comment><USER14> It is the job of journalists to ask these controversial questions about NSA's role as a saboteur vs contributing in good faith to really improve the security of systems. So, nothing wrong with that. Healthy skepticism and all that.

In my experience, when closed source research teams start to contribute to well-run open-source projects there can be valuable contributions.

But it highly depends on having independent and technically competent maintainers with strong personalities who are not easily manipulated into accepting patches that they don't understand or violate their technical principles.

</comment><comment><USER15> I hope the Coreboot people are extremely careful about this. Accepting code from a giant agency with the goal of making everyone less safe is very dangerous.

<comment><USER16> It could also be the NSA does not trust proprietary firmware for similar reasons people are working on open source firmware to begin with.

The problem is NSA really only knows their motives.

The other problem with the NSA is that they have two goals. One is to protect the US and US entities security and the other is subvert foreign entities. If they start publicy recommending coreboot for what they deem senstive installations then their intentions are obviously not malicous. Problem is the NSA may never publicy specify that its for senstive installtions and may only ever be an internal guideline.

<comment><USER17> Their MO seems to be to improve the overall IT security of the nation such that it's less vulnerable to less sophisticated actors but still vulnerable to them.

This is likely tacit recognition that UEFI is such a dumpster fire that it's not only vulnerable to them.

<comment><USER18> "Their MO seems to be to improve the overall IT security of the nation such that it's less vulnerable to less sophisticated actors but still vulnerable to them."

That's exactly what they do. How they rate and evaluate their high-security products (Type 1 or EAL6+) vs majority of market (EAL4 or less) under Common Criteria corroborates your claim. EAL4, which Linux and others top out at, says it's only trusted to stop "casual or inadvertant attempts to breach security." Anything prolonged or well-funded will breach it.

</comment></comment></comment></comment><comment><USER19> I hate it when news outlets assume readers don't know what they are talking about and use analogies like "UEFI BIOS Alternative" without mentioning the actual thing on the title ("Coreboot").

<comment><USER20> Especially when it's flat out _wrong_. Coreboot is low level init code that launches a payload. Which can be TianoCore EDK2 or SeaBIOS.

</comment></comment><comment><USER21> I wouldn't trust NSA with a "hello world" program. The way they might phrase it could trigger hidden feature in linker which in turn could trigger hidden instructions in CPU making the 3 lines program a backdoor into your system.

<comment><USER22> You better avoid the Linux kernel then as the NSA have contributed a lot more than 3 lines.

</comment></comment><comment><USER23> Could you imagine the shitstorm if Coreboot was accepting code from a Chinese intelligence agency? I'm American myself and am glad NSA is on my side. But they've proven themselves time and time again to be completely untrustworthy when it comes to securing our computer systems.

<comment><USER24> "glad NSA is on my side", you are 100% sure about this?

<comment><USER25> maybe they also have nothing to hide /s

</comment></comment></comment><comment><USER26> I applaud this and I think the coreboot team is good enough to be critical and diligent about patches they will receive.

</comment><comment><USER27> This is great news - not only will competent NSA hackers improve Coreboot, but their participation will usher in even more scrutiny and review of the code. This is a win for everyone.

</comment><comment><USER28> In reading the discussion here, I'd like to bring up an error that the News Media typically makes when discussing large groups of people... That is, they implicitly or explicitly judge large groups of people -- most notably other countries / other nationalities -- by the actions of the few.

Applied to a group, in this case the NSA, I don't believe that they should be judged by the actions of a few of their members... I am sure there are both socially positive and socially negative actors in the group (and everybody in between), thus it is disingenuous to judge the group in either direction...

Me, I'm completely neutral about the NSA, with one exception, and that is that I feel that companies should _NEVER_ be exposed to secret NSL's... either make those communications a part of the public record for congressional and other legal/legislative oversight, or don't send them in the first place!

But that's not the _people_ of the NSA, whom I hold harmless... That's part of the _mission_ of the NSA, and well, mere mortal citizens are probably not going to change that anytime soon...

If anyone really wants a secure computer, build yourself a VAX-11/780 out of transistors, and write the operating system too... (If I ever did, I'd put on a few of my super-secret cooking recipes ("Mmm, however did you get those BBQ ribs to taste so good? It's a secret!") along with a note "If you got this message, you are definitely elite, and please don't delete my BBQ sauce recipe!").

Try and get that with no RF link in the electronics... I double dare you...<g>

In the meantime, back up your files, and audit your communications regularly for anything you wouldn't want on the news 24/7... <g>

But the NSA? Not evil...

<comment><USER29> >Try and get that with no RF link in the electronics... I double dare you...<g>

Build my GPL3'd Signals Intelligence device, and you can _audit_ it :)

[https://www.rtl-sdr.com/the-radioinstigator-a-150-signals- in...](https://www.rtl-sdr.com/the-radioinstigator-a-150-signals-intelligence- platform-consisting-of-a-raspberry-pi-rpitx-2-4-ghz-crazyradio-and-an-rtl- sdr/)

<comment><USER28> Didn't know that that existed... Looks really nice!!!

(Although, technically, to be really secure, you'd have to audit the entire RF spectrum AND lower frequency wavelengths, i.e., ultrasonic AND have to figure out what to do with signals that are intermittent and/or frequency hop!!! Then of course you have the power supply lines and the ability to send super-low frequency signals via all of that... In other words, you'd have to audit all wave frequencies from all connected devices, simultaneously, and keep in mind such possibilities as frequency hopping, and intermittent periods of silence... like if someone really wanted to be stealthy, they could send something like 1 byte per hour... and that hour is randomized, so it's actually a random interval between 50 and 70 minutes... and/or hide that in random radio noise... the possibilities are endless... <g> (This is why I leave security to the security people and just assume that no information is private anymore...))

But, all of that being said, your link looks really nice, and I didn't know that existed before! It looks cool and worthy of experimentation!

</comment></comment></comment><comment><USER30> A public STM implementation has long been needed.

In 2009, ITL/Qubes wrote about DRTM (Intel TXT, AMD SKINIT) and STM, [https://invisiblethingslab.com/resources/bh09dc/Attacking%20...](https://invisiblethingslab.com/resources/bh09dc/Attacking%20Intel%20TXT%20-%20paper.pdf) & [https://www.blackhat.com/presentations/bh- dc-09/Wojtczuk_Rut...](https://www.blackhat.com/presentations/bh- dc-09/Wojtczuk_Rutkowska/BlackHat-DC-09-Rutkowska-Attacking-Intel-TXT- slides.pdf)

 _> The late launch ... promises to effectively provide all the benefits of a computer restart without actually restarting it. It is hard to overemphasize the potential impact that a technology such as TXT could have on computer security ... We describe a practical attack that is capable of bypassing the TXT's trusted boot process ... As part of the attack we also discuss practical attacks on SMM memory ... Intel's remedy to malicious SMM handler is called STM, which stands for SMM Transfer Monitor. The purpose of STM is to sandbox the existing SMM handler by virtualizing it using VT-x and VT-d technologies. STM should be thought of as of a peer hypervisor to the VMM that is being loaded using late launch. STM is supposed to be measured during the late launch process ... no STM, as of today, is unfortunately available on the market, which yields our attack applicable to all current systems. One aim of our research ... is to stimulate developers to create an STM._

The May 2019 version of Windows 10 added support ("SystemGuard") for DRTM- enabled hardware that could benefit from an STM, [https://www.microsoft.com/security/blog/2018/04/19/introduci...](https://www.microsoft.com/security/blog/2018/04/19/introducing- windows-defender-system-guard-runtime-attestation/) & [https://www.platformsecuritysummit.com/2018/references/#syst...](https://www.platformsecuritysummit.com/2018/references/#systemguard)

In 2018, NSA gave a presentation on their STM work, [https://www.platformsecuritysummit.com/2018/speaker/myers/](https://www.platformsecuritysummit.com/2018/speaker/myers/)

 _> We describe our work to demonstrate an enhanced SMI transfer monitor (STM) to provide protected execution services on the x86 platform ... Our STM enhancements create a protected execution capability by extending the STM to support additional VMs (PE/VM)_

From a coreboot developer, [https://twitter.com/_zaolin_/status/1055474061428572162?s=21](https://twitter.com/_zaolin_/status/1055474061428572162?s=21)

 _> We are currently implementing @intel #TXT and #SRTM measured boot support as part of Google's verified boot which can be used on all supported platforms in @coreboot_org_

</comment><comment><USER31> When I read the headline, my brain first parsed it as a scandal breaking, then I read the article and found that it was not that. I just hope the open source community will be very serious about auditing that code and not accept any blobs coming from people affiliated with the NSA.

<comment><USER21> Your brain was correct...something like 5 years before correct. I bet in 5 years this will be a scandal breaking because whatever NSA code gets adopted, it will be unveiled later as a backdoor.

<comment><USER32> If the NSA wanted to add a backdoor, they would likely not do it in a patch openly contributed by them.

<comment><USER31> It's probably more subtle than that: coreboot is a hodgepodge of open source aspects and oblique blobs that contain god knows what. That's why libreboot exists (shares a lot of coreboot code but doesn't allow blobs). If the NSA wants to do some dirt, then the dirt will probably go into the blobs and/or happen as a result of how the open source code interacts with the blobs in ways that are not obvious to anyone who doesn't know what's in the blobs. So I can see how getting some influence in the coreboot community would be of strategic value to them to implement schemes to weaken IT security for whoever they want to weaken it for.

</comment></comment></comment></comment><comment><USER33> I was setting up Windows servers 15 years ago, the company was chuffed to be using special secure NSA tweaked versions of the OS, which was nice of them...

</comment><comment><USER34> Terrific! About time we had some people with proper technical expertise contributing to our everyday systems. #Taxpayer dollars put to use

</comment><comment><USER35> If Govt's around the world want to really secure their IT systems, then just remove the laws that get hackers into trouble for hacking Govt systems. Still keep the law for non-Govt systems or for changing anything on a govt system and then the Govt can sit back and enjoy free pen testing.

</comment><comment><USER36> Keep proven bad actors and miscreants, be it government or large tech, out of establishing standards.

</comment><comment><USER37> What could possibly go wrong.

</comment><comment><USER38> timeo danaos et dona ferentes

</comment><comment><USER39> LOL! Trusting NSA for UEFI code is like.... I hope cryptographers and hackers better than what NSA has go through that code with a fine toothed comb.

<comment><USER40> The title is pretty shitty but you should at least click through before making a comment.

This is a contribution to Coreboot, which is an alternative to UEFI/BIOS.

As much as I dislike US government agencies in general, I think this time they have good motive to provide good code. Undermining this code would also undermine the systems of other government agencies.

In this case, I trust the NSA more than random contributors on the internet that have less known motives and may in many cases be agents of foreign spy agencies.

<comment><USER41> For non-americans, NSA is a "foreign spy agency"...

<comment><USER42> And "illegal combatant"</comment></comment></comment></comment>


Here's Why You Should Convert Your Music To 432 hz - <AUTHOR> http://www.riseearth.com/2013/12/heres-why-you-should-convert-your-music.html

<comment><USER2> New age bullshit, you can skip reading this.

<comment><USER3> >Knowledge: How Hemp Oil Cures Cancer And Why No One Knows

>Knowledge: Why Baby Carrots Are Killing You</comment></comment>


Government, Not Business, Has Been the Source of Breakthrough Innovation - <AUTHOR> http://www.epi.org/blog/government-business-source-breakthrough/

<comment><USER2> It's not just technology.

My favorite example is the Eire canal. It wasn't a technology breakthrough but it was a massively successful use of public money.

I wish we had the political will do something of real scale with solar before we cook the planent.</comment>


Gregory Mankiw reflects on three decades as a textbook author - <AUTHOR> https://www.aeaweb.org/research/greg-mankiw-reflections-textbook-author <comment><USER2> i worked on Wolfers' new book. Lots of improvements have been made to modern day econ textbooks</comment>


How Likely Is It That Birth Control Could Let You Down? - <AUTHOR> http://www.nytimes.com/interactive/2014/09/14/sunday-review/unplanned-pregnancies.html <comment><USER2> It amazes me that IUDs aren't more popular in the US, despite being widespread in Europe. There is generally some pain during the the procedure, and some heavier cramps during menstruation for a few months, but other than that it is a method with virtually zero side effects, zero ability to screw it up, and as good as it gets in terms of prevention. I know about 10 women in the US with IUDs (including my wife) and all of them recommend them with an evangelical fervor.

<comment><USER3> I think it's the upfront cost, which is still a problem.

The only reason I ever got my Mirena IUD was that it was the first month Obamacare kicked in for mandatory birth control coverage and my insurance covered it. Before then, I wasn't willing to entertain the idea of an $800+ option when I was doing okay with other things (mostly nuvaring). Mirena was by far one of the best forms of birth control I had ever used though :)

There are definitely problems with the procedure and the IUDs themselves for plenty of women, too, let's not ignore that. But it is hard to screw up and it is a pretty easy method. I hope that better coverage leads to more IUDs and less unwanted pregnancies :)

<comment><USER4> I thought there was a lawsuit on Mirena ? Due to side effects and perforations. [http://www.drugwatch.com/mirena/](http://www.drugwatch.com/mirena/)

<comment><USER3> Honestly, that looks like some ambulance chaser site.

All IUDs can perforate a uterus. Any form of birth control can cause side effects. Any medication can cause problems in general. Hell, pregnancy has side effects and can potentially cause death :P

You just learn to know what to look for and you get it looked at, that's all. And your doctor can tell you if you're not a good candidate for a particular medication (i.e. smokers shouldn't use hormonal contraceptives), like you should be doing already.

</comment></comment></comment></comment><comment><USER5> >How the numbers were calculated: The probability that a woman doesn't get pregnant at all over a given period of time is equal to the success rate of her contraceptive method, raised to the power of the number of years she uses that method.

This does assume that the chance of getting pregnant after a year is independent of the person/people using it, though... presumably there are reasons other than a random roll of the dice why various birth control methods fail, which could well affect the distribution.

(It also seems absolutely crazy to give these statistics "per year" when I'd feel pretty confident in saying that it depends on how often you have sex!)

<comment><USER6> Well, there are separate numbers for "perfect use" versus "typical use". Presumably, perfect use is independent of the person using it.

<comment><USER7> Perfect use means "the user did not make any mistakes".

A woman who gets pregnant after forgetting to take the pill one day is a "typical use" birth control failure; a woman who becomes pregnant because her natural hormone levels are such that the birth control pill (consistently taken at the same time every day) doesn't render her infertile is a "perfect use" birth control failure.

Similarly, couples who intend to use condoms but occasionally forget (or get carried away etc.) would be "typical use", but a man with a cat-like barbed penis which makes holes in condoms could still qualify as "perfect use".

<comment><USER8> There's a comment worth reading all the way to the end.

<comment><USER7> I like to think that all of my comments are worth reading to the end!

<comment><USER8> I'll skip right to the end from now on, to know what I'll be getting myself into.

</comment></comment></comment></comment></comment></comment><comment><USER9> Unexpected pregnancy is only a fraction of the problems that birth control brings. I've had way too many friends struggle for years to find the "right birth control for them" at a high personal cost.

Unsurprisingly, trying to make your body think it's already pregnant via external hormones can have some significant side effects. I mean, I suppose decreased libido probably contributes to the effectiveness of a birth control method, but why bother? Or how about some frustrating weight gain from your body trying to nurture and protect a non-existent baby? Or maybe you prefer that sex become uncomfortable or painful? Even IUDs are only recommended if you're not thinking about ever having kids; the danger of infertility is still too high.

"I don't want to wear condoms" is all-too-often the only reason that hormonal birth control is ever considered. It's my personal opinion that men are the ones that need to suck it up. Every time.

Chances sex is less pleasurable for men? Probably 100%. But the chances that hormonal birth control will significantly diminish some woman's quality of life are statistically significant. The only way to avoid it is to go with condoms.

Don't want kids? Don't want to take chances? Don't have sex. You think it's a coincidence that one of the most pleasurable experiences possible also happens to lead to the continuation of our species? Ha.

<comment><USER10> >Don't want kids? Don't want to take chances? Don't have sex

This attitude has served our young people terribly [0]. Whether or not you support abstinence-only education, your absolute refusal to acknowledge the reality of human relationships and the sexual involvement that comes with it makes your advice worthless, akin to saying "Don't want to die in a car-wreck? Don't want to take chances? Don't leave your house."

[http://www.ncbi.nlm.nih.gov/pubmed/17885460](http://www.ncbi.nlm.nih.gov/pubmed/17885460)

<comment><USER9> Your linked article is not at all talking about what I'm saying.

All I'm saying by that is that there is one and only one guaranteed way to avoid pregnancy. I'm all for proper education on the alternatives but abstinence is the only contraceptive that's 100% effective at preventing pregnancy.

That's why the "don't want to take chances" portion of my conclusion is so critical. Education that contraceptives are imperfect is also critical IMO.

<comment><USER10> Yes, you are correct that this is the only way guaranteed way to prevent pregnancy. That information is not only obvious and well-known (I'm not sure there is a group of people who thinks you can get pregnant without having intercourse), but the attitude behind it perpetuates a culture of misinformation, lack of information, and sex-negativity. You say you're pro- education, but your attitude doesn't reflect that, as it matches precisely the group of people that preach otherwise.

</comment></comment></comment></comment><comment><USER11> The male birth-control pill is the need of the hour, yesterday. These stats give me the chills.

<comment><USER11> [can't edit original comment for some reason, so follow up:] ...A safe, low side-effect, potentially reversible male birth-control pill would be a godsend for men who want to control their reproductive potential.

I have heard that RISUG )([http://en.wikipedia.org/wiki/Reversible_inhibition_of_sperm_...](http://en.wikipedia.org/wiki/Reversible_inhibition_of_sperm_under_guidance)) has shown promise, so may be something to watch out for.

</comment></comment><comment><USER12> Really the ideal solution is to somehow make humans sterile by default with a pill that allows you to become fertile on demand.

<comment><USER13> We can even push stage 1 of the product out (100% sterilization of everyone, everywhere) before we build stage 2 (the pill that reverses stage 1). At that point, even non-profits will be throwing investment money into the business.

<comment><USER12> You could open source and crowdfund stage one and your close relationship to the project would give you the insight to develop stage two and patent it first. Overpopulation in a future with limitless labor isn't a non-issue. Charge maybe 20 grand a child?

[http://masseffect.wikia.com/wiki/Genophage](http://masseffect.wikia.com/wiki/Genophage)

</comment></comment></comment><comment><USER14> I'm happy to read that a Hormonal implant is the most effective (even better than sterilization.... I didn't expect that). [http://www.implanon- usa.com/en/consumer/index.xhtml](http://www.implanon- usa.com/en/consumer/index.xhtml)

<comment><USER15> Happy for what reason?

I've dated two women over a long period of time, part of the time with, and part of the time without, a hormonal implant.

They both had drastic changes in mood, in my opinion for the worse, with the implant in. Depressed, unambitious. For one of them that was nearly the opposite of normal.

<comment><USER16> I'm not surprised. The pill tends to have such effects, though sometimes very subtle, as well. For my wife it seriously reduced sex drive. Which we only figured out after she stopped taking it. Which in turn and in the spirit of the moment made us seriously question the whole anticonception-using-drugs thing: what is this scam? How did society let this ever happen? Millions of women paying huge amounts for something which basically makes them feel worse. Erm, what? Of course we also realized it's not as black and white like that, and it does prevent pregnancy. But still, something to think about.

<comment><USER17> Depends, for women with strong problems during period the pill can improve those a lot. Which might mean that instead of having to stay in bed with a hot water bottle and terrible pain for a day+ each month one only feels slightly uncomfortable.

</comment></comment></comment></comment><comment><USER18> Interesting "article", nice visualizations - where did that data come from though ?

<comment><USER19> Sources are listed after the article:

> Sources: James Trussell, Office of Population Research, Princeton > University; Brookings Institution

<comment><USER20> That's not saying much. The guy wrote hundreds of articles on this topic since 1972: [http://www.princeton.edu/~trussell/publications.htm](http://www.princeton.edu/~trussell/publications.htm)

The charts also ignore the fact that risk is more correlated with number of usages rather than number of years of usage, so the numbers themselves are quite useless.

Overall, I am disappointed by this... um... style of journalism.

<comment><USER19> > The charts also ignore the fact that risk is more correlated with number of > usages rather than number of years of usage, so the numbers themselves are > quite useless.

I don't know how you're expecting that to be measured/reported. They're just building on top of how effectiveness of contraceptive methods is already reported, which comes from polling actual people and extrapolating from that, not some theoretical calculation of the chance of failure per individual sexual relation.

<comment><USER20> I'd say it's not unreasonable to expect a question of "how many times did you use said contraception last year" in the poll/questionnaire. If the "perfect" scenario can be self-reported, this is fair game as well I think.

</comment></comment></comment></comment></comment><comment><USER21> 5% of female sterilizations fail? That certainly doesn't sound right.

<comment><USER3> The 'tied tubes' type can fail because the tubes can grow back together. The implant type (causes scar tissue to form and block the tubes) can fail if the tubes are not fully blocked or something else happens to them.

</comment></comment><comment><USER22> If spermicides are useless why are they allowed to market them?

<comment><USER23> They aren't useless, for instance you can use them in addition to condoms to increase the effectiveness.

</comment></comment><comment><USER24> For couples looking for a non-surgical, non-pharmaceutical approach to family planning, the _Billings_ and _Sympto-Thermal_ methods of NFP are are good options:

[http://www.thebillingsovulationmethod.org/](http://www.thebillingsovulationmethod.org/)

[http://ccli.org/nfp/stm-method/ccl-stm-method.php](http://ccli.org/nfp/stm- method/ccl-stm-method.php)

Both are well-researched (backed by solid science), easy to learn and use, and have effectiveness rates as good or better than many methods of artificial contraception. Also, they naturally help the couples become increasingly aware of their fertility, and can aid them in achieving pregnancy if/when that is desirable.

<comment><USER22> The charts in this article disagree with your "easy to learn" statement about fertility awareness methods. It is one of the least effective in typical use although theoretically it's not bad. As you say these methods are more useful for getting pregnant than for not.

<comment><USER24> Here is the paper presented by Prof. S. Z. Qian in September 2000 regarding a large trial of the Billings Method conducted in China:

[http://www.lifeissues.net/writers/qia/qia_01nfpchina.html](http://www.lifeissues.net/writers/qia/qia_01nfpchina.html)

"Due to its high efficacy, low expenditure and extreme safety incomparable by any other contraceptive methods, the BOM is well accepted by the Chinese couple of different cultural and economical backgrounds."

So, while I do not have enough background information on the chart provided by NYT, it doesn't seem to square with other known data.

<comment><USER3> I don't think it necessarily contradicts the NYT chart. Fertility awareness ~can~ be fairly effective.

I think the problem is that the linked paper only studied women for 12 months (try doing NFP for 10 years and saying it's effective) and they cherrypicked them too... normal cycles (!), partnered, specific age range, para 1 (!!!). That is definitely not going to match up with what NYT used and I wouldn't be surprised if any one of those points ends up making a difference.

I'm trying to get pregnant for the first time right now with still irregular cycles, and NFP for the purpose of pregnancy (educated, and I spend a LOT of time on a lot of communities about this) is a huge headache. There's no way I'd try this as birth control.

<comment><USER24> I'm in my late 30s and have met and know couples who use/d NFP for a decade+. No one I've spoken with has said it's a huge headache, though some have candidly admitted that the self-control factor is sometimes challenging (that aspect is going to vary by couple, of course).

I can't speak to your experience, and as you say you have irregular cycles. BOM can actually be quite simple for many couples, STM a little less so since it tracks more fertility signs.

Here's a more recent report on a German study:

[http://humrep.oxfordjournals.org/content/22/5/1310.short](http://humrep.oxfordjournals.org/content/22/5/1310.short)

"The STM is a highly effective family planning method, provided the appropriate guidelines are consistently adhered to."</comment></comment></comment></comment></comment>


Nanomsg – MIT-licensed ZeroMQ alternative - <AUTHOR> http://www.freelists.org/post/nanomsg/nanomsg-01alpha-released <comment><USER2> I personally like the fact that the codebase (up until a few months ago at least, when I last looked) is very clean and very understandable.

This probably has to do with both the transition from C++ to C, and the fact that Martin (the author) has a better idea of what he wants to make. In other words, he is (painfully) aware of the errors he made in his ZeroMQ and is doing it right from the first time in nanomsg. This leads to clearer and more consise code. The reduction of strange bugs and perhaps better performance adds a lot of icing on the cake as well. I look forward to using nanomsg in my future projects!

EDIT: github link, [https://github.com/250bpm/nanomsg](https://github.com/250bpm/nanomsg)

<comment><USER3> I've been totally conversed back to "C" from "C++" after working on a port of Metal Gear Solid to PC in 2000. I've had no problems understanding and reading through the code the Konami developers have written, it was using some kind of generic OO system in "C" with TCL-like passing of arguments (object* obj, int argc, const char*argv[]) - and passing text messages. Yes that was okay even on Playstation1 I guess.

Now I still prefer C++ at work for certain things as I'm simply too lazy to do it correctly in "C" \- give me STL, Qt, any UI framework written in there, and it's easier to use. But for core/system libraries (zlib, png, jpeg, tiff, zmq, libpq, etc.) I'd rather have it in "C", at least on the interface part, but I've seen what hiding of C++ or .NET can do with a crazy debugger :)

</comment></comment><comment><USER4> It's important that the author of nanomsg is also the author of ZMQ. One can see nanomsg as something built on the lessons he learned from ZMQ, assuming he can avoid second-system syndrome.

<comment><AUTHOR> I've worked on OpenAMQ before ZeroMQ. And lots of proprietary stuff before that. So it would be more like dozenth-system syndrome :)

<comment><USER5> ZeroMQ isn't really a message queue though...

<comment><AUTHOR> Traditional message queues are actually composed of two rather different subsystem: the queue itself (basically a database) and the networking.

I would say we are on the path of separating the two. ZeroMQ does away with the centralised server holding all the queues. It still has local queues though.

nanomsg goes even further and gets rid of queues entirely. What's left it networking buffers, typically implemented at L4 of the network stack.

<comment><USER6> So, then, what do you get by using nanomsg? Is the value proposition "BSD sockets but less lousy"?

<comment><AUTHOR> Nope. It's a platform for delivering packaged and reusable distributed algorithms, such as request/reply or publish/subscribe. The algorithms handle the issues like message routing, scaling up, handling partial failure etc.

<comment><USER6> Well, that's what I meant--technically, BSD sockets are themselves supposed to be "a platform for delivering packaged and reusable distributed algorithms".

In a friendly, ideal environment (like the Internet of the 1980s), req/rep is "just" TCP/SCTP unicast, pub/sub is "just" UDP multicast, and so on. Issues like "message routing [and] scaling up" are supposed to be handled on the link layer (i.e. using ARP, BGP, etc.); issues like handling partial failure, on the transport layer (if IP stacks weren't stuck in the 70s, we'd have such a thing as multicast TCP, and "send TCP packet to host set, wait for ACK from all hosts, and retransmit to failed hosts" would simply be its obvious send() system-call semantic.)

We've just screwed the "friendly, ideal environment' pooch by putting not- very-intelligent NATs and firewalls everywhere. So we have to, sadly, reimplement all these nice things on top of the few things we've kept working: TCP and UDP unicast from clients to "business-leased" IPs with open+addressable ports. The necessity of things like this, UPnP, and TURN/STUN/ICE sadden me sometimes, they really do; they're 100% examples of an inner-platform[1] created because software developers have gone on for so long only touching OSI layer 7, and thinking about the rest of the infrastructure as a black box, that now the application layer is the only place you _can_ solve problems, because the infrastructure will no longer transport your packets if they do anything special below it.

So I say, please, look past your abstractions, programmers, and learn what makes the Internet tick! It's worth it to understand what your packets are doing--you might want a property that you can already get by asking something different of a lower layer. Or, even if not, you might just become--as Bret Victor says--very unsatisfied with the state of things. :)

Oh, and start here, if anywhere: [http://beej.us/guide/bgnet/output/html/singlepage/bgnet.html](http://beej.us/guide/bgnet/output/html/singlepage/bgnet.html)

\---

[1] [http://en.wikipedia.org/wiki/Inner- platform_effect](http://en.wikipedia.org/wiki/Inner-platform_effect)

<comment><AUTHOR> You are oversimplifying it. REQ/REP is not the same as TCP, unlike TCP it works with multiple requesters and multiple repliers. Same with other patterns.

The main distinction between L4 and scalability layer is that L4 works between 2 nodes, scalability between arbitrary number of nodes.

There's the special case of UDP multicast, but the multicast itself feels more like a hack rather than a real L4 protocol.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> I don't buy the `it's better because it's C rather than C++`. For example, "Number of memory allocations is drastically reduced as intrusive containers are used instead of C++ STL containers." can be solved in 3 ways:

1\. use an intrusive container in C++.

2\. Just use a `vector`, faster in most cases, regardless of complexity.

3\. Read about and use allocators properly.

<comment><USER7> Or, the other valid solution:

1\. Write the whole thing in valid C89

2\. Prevent users from having to use Boost or the rest of the C++ nonsense

3\. Users can now write trivial language bindings and link at runtime easily.

4\. Profit.

~

C++ is a cool bro and all, but honestly the solutions you've listed make it annoying to work with this code outside of C++ on a platform with subgood template support.

Moving a simple utility library like ZMQ to C makes a great deal of sense.

<comment><USER8> Who said anything about boost? afair zmq compiles with no boost dependencies

<comment><USER7> Read the thread--as per usual, the stock response to criticisms of C++ (here, the difficulty with intrusive lists) is "USE MOAR BOOST!1111one".

Now, it's a very useful library, but it's also an amazingly tired refrain.

</comment></comment></comment></comment><comment><USER9> The author appears to care about performance. That is why I'm surprised to see the choice of switching to level-triggered interrupts instead of edge- triggered. This really defeats one of the most important performance improvements of epoll().

See `man epoll' for an excellent explanation of the difference.

<comment> X-Istence The problem is that embedding an edge triggered file descriptor into an event loop that expects level triggered is a HUGE pain in the ass. I wrote two articles on the matter:

[http://funcptr.net/2012/09/10/zeromq---edge-triggered- notifi...](http://funcptr.net/2012/09/10/zeromq---edge-triggered- notification/) [http://funcptr.net/2013/04/20/embedding-zeromq-in-the- libev-...](http://funcptr.net/2013/04/20/embedding-zeromq-in-the-libev-event- loop/)

</comment></comment><comment><USER10> Background, from wikipedia:

 _" iMatix CEO Pieter Hintjens registered the zeromq.org domain in May 2007 and started the ØMQ project together with Martin Sustrik, who was its architect and lead developer through March 2012.

[..]

In March 2012, due to disagreements over control of the project, some of the original developers forked ØMQ as Crossroads I/O. Martin Sustrik has started nanomsg, a reboot of the ØMQ core library."_

</comment><comment><USER11> Since the title mentions it.

The ØMQ library is licensed under the GNU Lesser General Public License. All add-ons and examples are published under the GNU General Public License.

[http://zeromq.org/area:licensing](http://zeromq.org/area:licensing)

</comment><comment><USER3> Things that are normally valid C++ code that would get you into trouble if you are library (some of them you are static one):

\- Globally constructed objects, called before main(). Yes you might say, don't use them, but once you are in C++ land you can't be safe that everything else you've decided to use does not use them.

\- Throwing exceptions. This is mostly debugger pain. If you've used (again) without knowledge underlying code/library that uses exceptions (and note, you don't) then you might be inadvertently throwing them to the user.

\- RAII does not work with longjmp/setjmp. If you have callback mechanisms, and your client does longjmp on you, this won't work with any RAII done objects.

\- C++ runtime. You would be requiring this to be loaded, which might become nuisance in situations where your main application never used C++, you wrote a plugin/shared lib using C++ code, and now there is the requirement. Not a big deal after all.

\- C++ runtime again but for MSVC (although it's for the C runtime too to a point). Now while you can make code that is more independent from the "C" runtime for MSVC, it's harder to maintain this for C++ - you might run into issue where mixing dynamically (shared) libraries would have to use different (and even more different through WinSxS) MSVCPxxx.DLL libs (C++ runtime). In all fairness, this is more of a Microsoft mishap, and not caring about backward binary compatibility, but hey it's there.

\- Most of all, no matter what you do - you can't expose the really useful C++ things - like stl or qt5 or something else's objects/vectors/strings/maps/etc. Well that's obvious - off course you can, but then you are basically forcing the person using your library to go that route. If your interface is in "C" not only he longer has this pressure, he can use it easier through FFI in plethora of other language/runtimes without writing wrappers, and minimizing the number of precompiled binaries that he has to provide (no linking statically to C++ runtime would turn out bad at the end).

\- Case in point - STL's ITERATOR_DEBUG_LEVEL in MSVC. By default it's set to 2, which means make extensive checks of every map<>, vector<>, etc. once they are released. This severely slows down the debug. It's useful, but it's not feature that can be turned on or off. Most of 3rd party libraries, are playing safe and don't do anything special, e.g. they expect ITERATOR_DEBUG_LEVEL=2. But in your production code you might want even your Debug versions to be somewhat faster. Most of your day won't be spent tracking down map<>, vector<>, but other things. As such you go ahead and compile ITERATOR_DEBUG_LEVEL=0, and then .... well you can not link anymore directly to the said 3rd party libs. You either have to precompile them, which might be fine, until you are given Middleware that is not compiled this way. And in all cases it's very important that all these libs use at the end just one runtime, not several (as it happens when you have tons of MSVCRxxx.dll/MSVCPxxx.dll in your running image).

\- And there is more. For example for statically build libraries, global constructors might be lost, if there is no symbol referring to them used by the main application. So you might lose some important initialization step.

\- etc., etc., etc.

<comment><USER12> I just saw someone use a globally constructed object to instantiate some global variables and it seemed like a neat solution, but I don't really know C++. What causes it to go wrong?

<comment><USER3> It depends on compiler / librarian / linker. I'm talking from experience here, not from deep knowledge or understanding the problem.

So basically what happens, is that if you have a lone variable globally instantiated, but no one refers to it, it might be stripped from the final linking, and as such any constructors/destructors associated with it would not be called.

Now if you are linking directly to the .obj file where the variable is declared it most likely would be put into account, but if the .obj is in a .lib (.a) then it might not.

Again, do some experiments, try it out.

There is another nastiness with globally initialized variables, that one should not expet some kind of order when the things are initialized. We've had code in the past (Dreamcast) where globally initialized variables, which were assigned the values of other globally initialized variables and then some operation on them would not always work: e.g. this at the top level:

float x = 10;

float y = x + 20;

It worked most of the time, and then if someone started moving variables to other object files, it stopped.

Check the [http://yosefk.com/c++fqa/](http://yosefk.com/c++fqa/) for more gotchas.

</comment></comment></comment><comment><USER13> I am hoping for some kind of solution for the DoS problems present in ZeroMQ (and probably in nanomsg as well) when used in an Internet facing application. For example the possibility to subscribe to an unlimited number of prefixes in the PUBSUB model leads to memory explosion on the server side.

<comment><AUTHOR> Good point. Would you mind bringing it up on nanomsg mailing list?

</comment></comment><comment><USER14> I'm curious about the differences mentioned in the threading section, "In nanomsg the objects are not tightly bound to particular threads and thus these problems don't exist."

Does this mean that threading is still used/required, or could nanomsg use non-blocking techniques?

<comment><AUTHOR> Threading is required as there's processing going in the background. Not sure what you mean by non-blocking techniques. Lock-free algorithms maybe? These are used in ZeroMQ as well.

<comment><USER15> They probably mean async/evented techniques. For example, provide a function to get a FD that select()s as readable when stuff needs background processing, and a do_background_step() method to call, so it can be hooked into a single threaded event loop.

<comment><AUTHOR> Yuck. Why would anyone want that kind of stuff. nanomsg does all its processing in the background threads, same way as TCP does. I doubt anyone would ask to have to call do_background_processing_step() to make TCP work.

Also, that kind of thing compromises internal working of the library, if the user doesn't call do_background_step() fast enough. Timers may be delayed that way etc.

</comment></comment></comment></comment><comment><USER16> How does this project relate to crossroads IO, if at all?

<comment><USER17> I'd say crossroads IO is dead, and would start porting my stuff to nanomsg (or ZMQ).

</comment></comment><comment><USER18> In one of the linked blogs, he implies that Windows OS uses MIT licensed software.

Is this true? Do windows 7/8 have any lists of open source software projects that they incorporated into the operative system? It sound as a really interesting read if such was the case.

<comment><USER19> Windows included (and may still include) parts of BSD. The IPV4 networking code, and some utilities like ftp.exe and rcp.exe, came from BSD.

<comment><USER20> This is no longer true, as the IP stack was rewritten in Vista.

[http://technet.microsoft.com/en- us/network/bb545475.aspx](http://technet.microsoft.com/en- us/network/bb545475.aspx)

<comment><USER18> Did the old IP stack have any MIT licensed software, or was it all BSD?

<comment><USER20> I think it was only partially BSD, but I don't have any documentation at hand.

There might be a reference to it on Windows Internals series.

</comment></comment></comment></comment></comment><comment><USER21> Out of curiosity, was libuv ever considered as the underlying i/o library? Looks like some problems at a quick glance (named pipes for instance) are already solved there.

<comment><AUTHOR> There are no 'scalability protocols' such as req/rep or pub/sub in libuv.

<comment><USER21> libuv would just be the transports, can't those be built on top of the TCP and Pipe handles exposed by it?

</comment></comment></comment><comment><USER22> This is kind of exciting. I know that mongrel2, for instance, hit the REQ/XREQ nonsense he fixed.

</comment><comment><USER23> I saw a while ago that zmq could handle disconnections better: [http://lucumr.pocoo.org/2012/6/26/disconnects-are-good- for-y...](http://lucumr.pocoo.org/2012/6/26/disconnects-are-good-for-you/)

Does Nanomsg has the same problem?

<comment><AUTHOR> The blog post was wirtten by Armin Ronacher. Here's today's tweet from Armin: "Oh wow. Looks like nanomsg fixes all my problems I have with ZeroMQ."

<comment><USER23> Nice, thanks!

</comment></comment></comment><comment><USER24> I'm interested to see how the Nanomsg filesystem state model compares to the ZMQ context state model. I'm a little bit worried about using Nanomsg in a multithreaded environment.

<comment><AUTHOR> The two are equivalent. The only difference is that in ZMQ the global state is created upon zmq_init() call. In nanomsg it's created upon first nn_socket() call.

<comment><USER24> Is there a resource talking about thread safety in Nanomsg? I was writing a Haskell client library a little while ago and couldn't quite figure out how to treat threading, though I haven't had a chance to get back to it in a bit.

</comment></comment></comment><comment><USER25> The inproc fixes in nanonmsg are enough for me to start looking at it -- his post explicitly hit on (and claims is fixed) the two most annoying parts of inproc://</comment>


Coronavirus will end the golden age for college towns - <AUTHOR> https://www.chicagobusiness.com/opinion/coronavirus-will-end-golden-age-college-towns <comment><USER2> I think both Austin and Raleigh have grown large enough that the "college town" effect is in the noise. In both cases the underlying economy is doing more to drive itself than the college is at this point. In those cases 40 years ago it would have made a big difference, but today better examples would have been places like College Station TX, or Gainsville FL, where the college remains the primary employer. UT Austin is the 10th largest employer in a town with a pretty self reinforcing tech economy, and a very long tail of national brand SMBs.

[https://www.austinchamber.com/economic-development/austin- pr...](https://www.austinchamber.com/economic-development/austin- profile/major-employers)

<comment><USER3> In both of those cities the colleges have become feeder schools to the tech industry. And they're both desirable places to live on their own.

Austin is gorgeous. Semi-arid but the big river gorge running through it means downtown is lush. Big hills/mountains a mile west. Tons of nature, water. Colorful history. Great downtown thats a regional vacation destination. Within 3 hours of Houston, Dallas, the ocean, and only 45 mins from San Antonio. That means 50 million people within a few hours, densest area you can find besides east and west coast. And of course the capital, which means a lot more in Texas than elsewhere due to secessional tendencies (ex the TX state capitol is taller than US capitol)

Tech triangle is again in a gorgeous area. A few hours from NC coast and Blue Ridge mountains. Weather is an interesting hybrid between cold-winter northeast and humid deep south. It doesn't get very hot or cold. Probably the closest you can get to west coast weather in the east, and the nearby coast and mountains heighten the illusion. Nicely positioned for business, Miami and NYC are less than 2 hours by plane.

They're both safe with great weather and a low cost of living (for tech hotspots). I have deeply considered living in both.

<comment><USER4> Austin is not semi arid. Salt Lake City and maybe Denver are semi arid, but Austin is humid in the summer and almost swampy in overall climate. You aren't going to see a hint of beige until you get way into west Texas.

<comment><USER3> It's definitely not swampy, its quite dry. I looked up rainfall levels and its also not an arid climate like I thought. Much of the rainfall is concentrated in large storms, it doesn't rain very often. Much of the local vegetation is drought tolerant, succulent and cactus.

Houston is swampy because of the coast. Austin is dry and not very humid, like Dallas. The wind often comes from the deserts out west.

<comment><USER4> Austin isn't dry...from wiki ([https://en.wikipedia.org/wiki/Austin,_Texas#Climate](https://en.wikipedia.org/wiki/Austin,_Texas#Climate)):

> Austin is located within the middle of a unique, narrow transitional zone > between the dry deserts of the American Southwest and the lush, green, more > humid regions of the American Southeast. Its climate, topography, and > vegetation share characteristics of both. Officially, Austin has a humid > subtropical climate under the Köppen climate classification. This climate is > typified by very long and hot summers; short, mild winters; and pleasantly > warm spring and fall seasons in-between.

> An uncommon characteristic of Austin's climate is its highly variable > humidity, which fluctuates frequently depending on the shifting patterns of > air flow and wind direction. It is common for a lengthy series of warm, dry, > low-humidity days to be occasionally interrupted by very warm and humid > days, and vice versa. Humidity rises with winds from the east or southeast, > when the air drifts inland from the Gulf of Mexico, but decreases > significantly with winds from the west or southwest, bringing air flowing > from Chihuahuan Desert areas of West Texas or northern Mexico.[76]

I never saw a cactus in Austin before...at least one that wasn't being cultivated in someone's yard. I do remember my time there for one hot and very humid summer...it made Mississippi feel nice in comparison, it definitely wasn't like Salt Lake City in climate.

<comment><USER2> Prickly pear [https://en.wikipedia.org/wiki/Opuntia](https://en.wikipedia.org/wiki/Opuntia) is a very common sight in the few remaining wild/unkept parts of Austin and surrounding country given that Austin is part of its native range. As cactus goes, it is definitely one of the friendlier ones.

</comment></comment></comment></comment></comment></comment><comment><USER5> The graduate student analysis doesn't seem right. I don't think the article understands the incentives of graduate students. Yes, there are lots of foreign graduate students, especially masters students. One big motivator for them studying in the US is that they want to work for a US company and / or immigrate. Moreover, the ones that want to pursue a PhD often choose institutions based on potential advisors. It seems very unlikely that these things are going to change in the next year or so. Schools might miss out on prospective students with a time table, but I'd be surprised if the situation in 2025 is significantly different from today.

I do see academic towns really hurting from the lack of undergrads. That's a big decrease in population, and even if most businesses are allowed to open in the fall, lots of universities will take conservative measures and not let undergrads back on campus --- dorms etc. being an ideal transmission environment.

<comment><USER6> Those things have already changed though.

Students graduating this year will not be able to remain and work in the US because the US has stopped processing work visas and are explicitly preventing immigrants from getting new jobs.

This is in addition to the fact that international student numbers had already dropped over the past couple of years thanks to US hostility towards immigrants.

<comment><USER7> > Students graduating this year will not be able to remain and work in the US > because the US has stopped processing work visas and are explicitly > preventing immigrants from getting new jobs.

What story are you referring to? I've seen stories around the edges of this kind of thing for H1B's, but nothing so definite.

A student graduating now wouldn't need one yet anyone because they get two years of OPT if they were in STEM.

<comment><USER8> > A student graduating now wouldn't need one yet anyone because they get two > years of OPT if they were in STEM.

Yes, but it's also possible to use some (or all) of that OPT time on internships in industry. I have colleagues who were in that situation, and had to spend a few months back in their native country after graduation, while their visa was being processed because they had no OPT left.

<comment><USER7> They also get something like 6 months of CPT for internships.

</comment></comment></comment></comment></comment><comment> tech-historian According to the chart in the article, >75% of grad students in EE and computer science at American colleges are international students.

That is a shocking number to me. Entire grad programs are in serious jeopardy if the worst case scenario plays out.

<comment><USER9> It's funny to me how wrong all of the answers of this thread are: These programs are too broad. / The talent is abroad. / This is a ticket for a Visa.

Those may all be more or less true, but the broader issue of why these programs are mostly populated by foreigners is that they're too expensive (for master degrees) and vastly underpaid compared to market rates for PhD degrees. (Consider the strike at UC Santa Cruz by PhD students for a wage that would allow them to cover their living expenses without having to commute hours to campus.)

US students, which most likely have already contracted debt to finance their undergraduate degree will simply go get a job that both pays better and may boost their carreers more, and may come with more social status, given the current wave of anti-academic sentiment.

<comment><USER10> Having gone through a PhD program myself, this smacks of truth.

In the PhD program I went through, it was predominantly populated by foreign students and Americans whose parents paid for their undergrad (like me). Unlike in the United States, foreign college graduates typically don't have a massive amount of debt to pay off. When you graduate college and owe $35-120k in student loans, deciding between "lets get a job with actual pay" versus "lets make essentially no money for another 4-8 years" is a very easy question to answer, and it doesn't favor going to grad school.

If you're American, your options are (1) very cheap undergrad, which makes it more difficult to go to grad school, (2) large amounts of debt, which makes it infeasible to go to grad school, or (3) have had your undergrad paid for, which is inaccessible to most.

</comment></comment></comment><comment><USER11> It always bugged me that both universities I graduated from took in large numbers of high paying international students, in order to prop up huge salaries for administrators.

<comment><USER12> There's like five comments with this "huge salaries for administrators" theme. Is that some political party's talking point? Did it feature in some Netflix hit?

Because I can't quite see how it's an actual factor? If we're talking deans and university presidents, the numbers are just too low to make a difference for universities with tens of thousands of students. Plus, obviously, some Dean of Harvard Law might be earning millions but would still be underpaid relative to what they could command in the private sector.

If it's "administrators" as in "lowly" bureaucrats, how do they have the power to be given salaries beyond what's needed to attract them in the marketplace? If we compare their relative level of education with your average San Francisco Javascript coder, are their salaries still too high?

Speaking of COBOL: University IT staff, which would seem to be among the categories of "administration", is almost stereotypically underpaid compared to the private sector. Staying within the PhD comics universe, graduate students, postdocs, and other non-tenured faculty often have to fudge the numbers to delude themselves into believing they make more than minimum wage. This would also seem to disprove any theory that universities are particularly generous or incompetent when it comes to labor exploitation.

Beyond that, it seems strange how you are linking these two issues, of administrative salaries and foreign students. There is absolutely no reason to believe that money coming in via these students is different in any way to, say, grants or patent royalties or donations from alumni or really any source of income.

Foreign students pay more than their relative share of costs. Thus, they lower costs for everyone else. They take nobody's spot, but allow for more (subsidised) US students to attend.

This holds as long as an additional $1,000 made from foreign students does not, on average, result in admin salaries rising >$1,000. That would seem to be a pretty safe assumption, and I doubt anyone can come up with a plausible mechanism for why it should not be the case.

It really seems to me like you have two rather specific grievances, the choice of which I can't really explain except that I have a tingling sense they might have distant roots within the same corner of the ideological spectrum. And because these are your associations when the topic of universities comes up, or because you believe it helps to validate each, you've drawn some connection between the two.

But since neither is particularly well-tethered in reality, they really don't have much support to offer each other.

<comment><USER13> Both are well-grounded in reality.

Admin salaries aren't enough to raise tuition much for everyone. If a university president makes a megabuck, and the school has 5000 students, that's $200/student. If it's a dozen admins making a megabuck, and the president making a few megabucks, that's a couple thousand dollars per student.

But that's not the point. Megabuck salaries draw in the wrong people for the wrong reasons. That dean of HLS you talk about: Should it be someone who retired from a high-profile law firm or government job and took a pay cut to help make sure a new generation of lawyers get mentored RIGHT? Plenty of people would do that. Or should it be someone looking to maximize quarterly KPIs and find ways to leverage that position for personal political/career/financial growth? That's the change which happened in elite academia in the past 25 years, with megabuck salaries.

And yes, universities do try to attract foreign students, especially into Master's programs, as cash cows. I'm not sure what's wrong with that -- people need educations, immigrants of this type grow economies, and universities need money. It seems like a win-win-win all around.

But there does get to be a problem when that money is managed by admins of the type described in the previous paragraph. More money doesn't make for better schools if it goes into spending hundreds of millions on fancy buildings, faculty clubs, and similar. General funds don't come with even the minimal financial controls of grants and donations.

<comment><USER14> >If it's a dozen admins making a megabuck, and the president making a few megabucks, that's a couple thousand dollars per student.

Without having studied any university financial reports in detail lately, anecdotally one of the issues isn't so much megabuck salaries at the individual level but general administrative sprawl--which there have been complaints about for decades.

Some of this is just Parkinson's Law stuff. (As he originally wrote about the British Admiralty.) Bureaucracies tend to grow.

It's perhaps also the case the today universities need more administration to handle increased compliance and other requirements.

</comment></comment></comment></comment><comment><USER15> Side Note: Can we all appreciated that this website requires 112 of its 349 requests to load javascript from 47 different domains.

<comment><USER16> I'm not familiar with website development to know whether you're being sarcastic or not. Is it actually a good thing?

<comment><USER17> Not at all. You can design a beautiful "modern" site with orders of magnitude less resource requirements with ease.

</comment></comment></comment><comment><USER18> The STEM grad student numbers are both astonishing and not when you remember how little they are paid.

</comment><comment><USER19> Even if remote learning MAY (it may not) become the norm for higher education, parents who can afford it will still send their children someplace where children who engage in higher educationing congegrate. Probably college towns.

</comment><comment><USER20> This is a very hard situation for the affected, but I cannot look at it any other way than a positive change. My own opinion is that modern universities are a mix of ponzi scheme with stockholm syndrom. It's a bubble that should have burst a long time ago. From institutions of education and widening of perspecitve they morphed into thought-culling money making machines. I think we underestiumate just how many things changed for the better thanks to the virus.

<comment><USER21> > From institutions of education and widening of perspecitve (sic) they > morphed into thought-culling money making machines.

How did you come to that conclusion? I would agree on the money-making machine part, but I had rather a different and mostly positive college experience on the education side, both in undergrad and graduate school.

</comment></comment><comment><USER18> > It will be impossible for engineering departments to replace many of these > lost researchers. That in turn will force many labs to shutter or scale > back, making college towns a less attractive investment destination for > private companies.

This part made me curious. Is grad school not all that competitive to get into?

<comment> d-sc Well, it's hard to find capable people for grad school. It's not just a selection to pick some form of the best. To succeed as a grad school you need people that can make discoveries and play the academic game.

</comment></comment><comment><USER22> These articles claiming new normal ignore the fact that having a pandemic per century is normal. America of four months ago is an America after many pandemics, and that includes college towns.

Journalists just want things to say they think people might read.

</comment><comment><USER23> > The highly successful model of using tax and tuition dollars to subsidize > and plant the seeds for thriving local economies is getting hit from all > directions at once.

Maybe schools can pay competitive wages to their researchers while state schools focus admissions on state students?

<comment><USER18> That would mean a decline in revenues and an increase in costs. Where does the money come from?

<comment><USER24> Football coaches have a rather large salary.

<comment><USER25> For many schools, football subsidizes all sports, even after paying the coaches and staff. And for a lot of schools, football pays for scholastics. You'd be hard pressed to find a school that pays a coach out of line financially.

<comment><USER26> I keep reading these same talking points without any data to support it. Can you provide any details on "many schools" or "a lot of schools"?

My alma mater, Miami University in Oxford, Ohio, pays their coach $533k/year. That is half-a-million dollars for a mid-tier team in a mid-tier conference. They also built a $13 million indoor sports practice facility a few years ago. [https://miamiredhawks.com/sports/2018/6/7/facilities- indoor-...](https://miamiredhawks.com/sports/2018/6/7/facilities-indoor- sports-center-15-html.aspx)

<comment><USER25> Miami of Ohio isn't a football school as you know, although it seems they want to try and capture more of the football pie. The school has 36M in annual sports revenue [1], a good chunk of that football. From a source that had 28M in total sports revenue, it stated over 6M in football [2]

As the coach of a multi-million dollar business, 533k is justified. Especially since the talent is currently not compensated. If you want to compete you have to spend a decent amount. You're right that Miami of Ohio is mid-tier but the 533k is a mid-tier salary these days (#112 in rankings). There are 6 other MAC schools with higher coach salaries than your school. [2]

Also, from your own article "The 91,000-square-foot facility was built completely with donor contributions and is used by student-athletes, intramural and club sports participants and youth athletic tournaments."

Donor contributions.... And used by everyone for various sports including youth... So I'm not sure why you are so upset.

Aside from that - there are 108 schools with athletic revenue of 30+M. [1]

And, "The average college football team makes more money than the next 35 college sports combined" [3].

[1] [https://sports.usatoday.com/ncaa/finances/](https://sports.usatoday.com/ncaa/finances/)

[2] [https://sports.usatoday.com/ncaa/salaries/](https://sports.usatoday.com/ncaa/salaries/)

[3] [https://www.businessinsider.com/college-sports-football- reve...](https://www.businessinsider.com/college-sports-football- revenue-2017-10)

[4] [https://www.collegefactual.com/colleges/miami-university- oxf...](https://www.collegefactual.com/colleges/miami-university- oxford/student-life/sports/)

</comment></comment></comment></comment></comment></comment><comment><USER27> People are thinking about this the wrong way.

Masks reduce R0 so much that in Austria the infection rate plummeted after Apr 6 when masks were required.

The lockdowns are a last resort, the result of a public policy failure to contain the virus.

The entire US establishment including the CDC, Fauci even Mike Pence said until mid March not to wear or buy masks. Mind you, not even the cheap surgical ones that are 50 in a box.

I have pamphlets in NYC written by the city's health agency Feb 26th that insist there are no confirmed cases in NYC and the risk to new yorkers remains low.

NO ONE was willing to get ahead of this thing and look silly requiring masks when there was no emergency.

So the outbreaks were swift and led to exactly the lockdowns we were in now.

We will face this situation again as we emerge from the lockdowns.

We can't rely on government to create a clear framework for businesses to follow. We need businesses to step up and sell a standardized solution.

At Qbix we are doing our part. Contact me if you want to help in your community.

Even the most staunch libertarian can't say no when a private building enforces a mask policy in their lobby and in public areas like elevators. No amount of social distancing will help in elevators - only masks can.

But the stupid attitude is "a mask can't protect me, so why bother?" No!! The masks are to prevent everyone from spewing virus particulates into the air.

Seriously this is the 21st century and several months after China got the epidemic, the richest countries in the world are still complaining about not enough masks.

Meanwhile in Taiwan the buildings are handing them out and you can drop them off. That's how it should be.

<comment><USER28> >NO ONE was willing to get ahead of this thing and look silly requiring masks when there was no emergency.

AFAIK it was because there was a mask shortage and giving masks to healthcare workers provided greater utility than giving them to everyone else.

</comment></comment><comment><USER29> > Even before coronavirus, President Donald Trump's administration had been > working to decrease the inflow of students from overseas

Sometimes I wonder if the U.S. is purposefully trying to move down in world rankings... I'm not sure why anyone would think it's a good idea to intentionally limit the opportunities to the best and hardest working people in the world; those opportunities will just spring up elsewhere instead. I have a theory that a society cannot maintain leading world standings without also leading in science and technology, and it's not long before the U.S. loses this (if it hasn't already). Most of the greatest recent technological advances are already driven by people born outside the U.S. that work within the country; it wouldn't surprise me if they decide that coming to the U.S. is just no longer worth the hassle.

<comment><USER30> > the best and hardest working people in the world

That's not the majority of international students in the US. It's those whose parents can afford to pay for them to study abroad.

<comment><USER31> But a good proportion of the best and hardest working people in the world are international students in the US.

</comment></comment></comment><comment><USER32> The generation from the swine flu pandemic of 2009 would like to have a word with this author.

<comment><USER33> Zoom and YouTube weren't as big, mate.

</comment></comment><comment><USER34> It's really just accelerating what was going to happen in a decade or so anyway when the demographic bulge passed. Colleges are to some extent wildly overprovisioned, as well as overextended, and many were starting to fail before SHTF.

</comment><comment><USER35> Risk of coronavirus spreading in schools is 'extremely low' study finds: [https://www.yahoo.com/news/risk-coronavirus-spreading- school...](https://www.yahoo.com/news/risk-coronavirus-spreading-schools- extremely-194143983.html)

<comment><USER36> That makes no sense. All the kids are in very close proximity.

<comment><USER37> Close proximity does not have to the the only factor, although all the world ist currently fixed on social distancing. How about children being less contagious? After all they are developing no symptoms at all in most cases.

<comment><USER38> You can still be contagious without obvious symptoms. And allergy season could help spread the particles even if the virus isn't triggering coughs/sneezes itself.</comment></comment></comment></comment>


This site crashes Mac completely if you open it with Chrome - <AUTHOR>

I don't know who else to ask to try this, but I've noticed that more and more people are reporting that when they visit my portfolio with Chrome (www.turshija.com) their computer crashes completely ... I have the same problem with my MacBook Pro with newest stable Chrome, If I open the page, my screen freezes and sometimes I hear weird beeps (same as RAM failure), but that thing happens to almost all Macbooks and iMacs I've tried (to be precise exactly 2 macbooks and 1 iMac) .. And recently more and more Windows and Ubuntu users started reporting the same problem, but most of them say that they can kill Chrome without reseting PC ... I've reported this issue here: http://code.google.com/p/chromium/issues/detail?id=121089 But they don't look so interested, even though I think this can be exploited badly, like making invisible iframe on some page or masking it with some url shorteners and make people click on it ... The main problem is that sometimes after crash, my Chrome profile gets corrupted, so I have to reinstall it or delete some files to be able to access bookmarks or password storage ... Can anyone else confirm this by visiting www.turshija.com with Chrome (be prepared for crash, so save all your work before visiting the link) ? <comment><USER2> I'm running Snow Leopard 10.6.8 on a Core 2 Duo with the newest version of Chrome (19.0.1084.46) - no crash!

I haven't had the time yet to check the code properly but why do you have a 5090x6640 pixel canvas element?

<comment><AUTHOR> Well, its created by scrollPath plugin: <http://joelb.me/scrollpath/> Do you know anyone with MacOS Lion 10.7.4 who can try opening the page ? I've also tried to narrow down the problem and came to this: www.turshija.com/chromecrash One page crashes my mac, other one doesn't, and difference is only in one line ...

<comment><USER3> Opened with the newest version of Chrome on MacOS Lion 10.7.4 and it loaded without crashing.</comment></comment></comment>


The Old Design Argument, Now Politicized - <AUTHOR> http://www.charlespetzold.com/blog/2008/04/Old-Design-Argument-Now-Politicized.html

<comment><USER2> The full title of the book in question is this,

 _On the Origin of Species by Means of Natural Selection, or the Preservation of Favoured Races in the Struggle for Life_

...and Ben Stein's political concerns are quite appropriate. It is astonishing to listen to ordinary people discuss evolution, and to observe the context in which the subject is raised. The one context is...

 _Christianity_.

You see? There has arisen an odd dichotomy [1] between Christianity and Evolution. And people understand religion to the extent that it is _false_ , and understand evolution to the extent that it is the _proof of that falsehood_. Lesson over. Ordinary people can only understand things in an oversimplified way. Part of the job of the elite is to determine how things are simplified.

In fact, the implications of evolution, and especially its offshoots like sociobiology are in extreme contradistinction with an entire class of laws and shibboleths and received wisdom----shortly, anything that champions egalitarianism or sings "We shall overcome" when that overcoming means a quashing of the superior by the inferior through unnatural means. I posit that "unnatural" means are inherently temporary, and so require constant maintenance--which is what Stein is doing.

[1] <http://www.northernsun.com/images/thumb/2214.jpg>

<comment><USER3> _In fact, the implications of evolution, and especially its offshoots like sociobiology are in extreme contradistinction with an entire class of laws and shibboleths and received wisdom_

This, then, is the basis for societal construction? The apeish mandate of kill or be killed is the last word, simply by virtue of it being the _only_ word for most of history?</comment></comment>