Cash vs Equity compensations - <AUTHOR> http://swombat.com/2011/2/21/cash-vs-equity-compensations

<comment><USER2> Google is "just a market job" yet it's interesting and will pay it's SRE engineers a compensation package which roughly equates to $200k if you're married (with children). Most start-ups in SF try to con you into filling the same role for $100k and subpar health insurance, plus at best 0.5% of the company, which will be diluted down to about 0.05% after 3 rounds of VC.

At my last full-time job I fought hard for 2% of the YC2010 company and exchanged a disgracefully low salary for it. At some point I got tired of slaving away so that the "founders" of this start-up would become millionaires. That time was when I did the math and realized nothing anybody could do would make this company see more than a $20m exit meant I had a one in ten-thousand chance of seeing $400k after 4 years. So I quit and I expect to gross $200k over the next year while working roughly 1,200 hours.

To work for a start-up is to be a sucker.

<comment><USER3> goodweeds' HN profile:

      An old sysadmin going through a career change, spending
      most of my time learning Ruby, Rails and developing small
      niche websites as a way to fund my lifestyle of friends,
      family, outdoor exploration, and ganja.

      Disclosure: I suffer from Ultra-Radian Cycling Bi-Polar
      Disorder, and have a tendency to post stupid comments
      during swings that I later regret. I'm not quite sure how
      to fix this with software, yet.

No comment on the second paragraph.

But in all seriousness, a lifestyle of "friends, family, outdoor exploration, and ganja" may not be wholly compatible with the intensity required to build a successful startup.

Given the gaudy valuations and acquisition prices of many YC startups, it might be useful for someone to estimate what the average, median, and max ROIs are for engineers joining YC startups before 10, 20, and 50 employees. Would not be surprised to see mean north of $200k, and median slightly lower. That's the risk profile people are looking for when they join a startup.

Only pg could really do this calculation of course.

<comment><USER2> You're half right. I'm more than happy to work myself for the bone, but I'm not willing to do it when I hold all the risk and others hold all of the upside. The thing about today's startups is that the founders hold zero risk, they get paid good salaries and they keep the lion's share of the company for themselves while asking their engineers to bleed for them in exchange for their table scraps. All in the name of "interesting projects" and "fun, exciting environments".

I've sold one company, failed another, and am working on a third. Between consulting and full-time employment I've worked directly wit about 50 start- ups over the past 12 years. I know dozens of founders who are now millionaires, even two who are now hundred millionaires.

Except for the fluke of associates I know who went through Google's IPO, and through Youtube's acquisitions, I only know about a handful of engineers who have become millionaires working for a startup.

<comment><USER3> > the founders hold zero risk

There is zero evidence for this claim.

</comment></comment></comment></comment><comment><USER4> _one small hole in this is that startups are not just "a market job". They're significantly more interesting, you learn more, you get more introductions to interesting people, etc. Startup jobs are inherently more valuable than "market jobs" working at a mindless corporation._

About that, I'll just say that, like much everything, it depends.

Sure, you might do more interesting stuff, meet more interesting people, etc. but you also might work on a project that nobody will remember or even hear about, that will go offline in a few short months so that you can't even point at what you did, etc. While another "regular" job will possibly bring you a scale and reach that you would likely never get working at a startup.

Considering the other sacrifices of extra hours worked (typically), more pressure, less job safety and benefits, and so on, I don't think the discount you're talking about is necessary.

</comment><comment><USER5> What most people forget is that equity is awarded over time for value provided over that period.

For simplicity's sake, imagine a startup with two people: a founding CEO and their first development hire. At the beginning, their contribution to the company may be equal, or even tilted towards the developer providing more value.

As the company grows, there is still just a single CEO, but now there are multiple developers. Several years on, the CEO is still responsible for all their own duties, but engineering might encompass dozens or even hundreds of people.

Over time, the relative value of the first program is diluted, while the CEO's remains fairly constant. This is why there is great inequity between founder and early hire option grants.

<comment><USER6> And who built that team? Who hired and managed those dozens of devs? Often times its engineer #1. Also, who picked the stack?

You're selling technology short on HN of all places.

<comment><USER5> No offense, but you appear to be acting deliberately obtuse. I am not denigrating the role of developers.

In most cases engineer #1 is the founding CTO and has commensurate equity. The first _hired_ developer, like the first hired sales guy, marketing guy or customer service guy, is the first person in an eventual team of people, all performing similar duties in parallel.

<comment><USER6> Your post only mentions two people a CEO and a developer. No CTO or technical founder is mentioned.

</comment></comment></comment></comment><comment><USER7> Are you thinking of working for a start up? (2005):

[http://weblog.raganwald.com/2005/03/are-you-thinking-of- work...](http://weblog.raganwald.com/2005/03/are-you-thinking-of-working-for- start.html)

</comment><comment><USER8> Job security can push it back in the other direction though, if I'm at a start up with say 6 months cash in the bank I can't be to certain that I'll still have a job there for me after that. If anything the salary should be market rate on the equity for the extra responsibility/ effort of being in a small team.

As much as some startups advertise a good work/ life balance I'm sure it's not going to fly working your normal hours if overnight or over the weekend the service has a major problem.

</comment><comment><USER9> Isn't this a moot point? Any type of employment whether corporate or startup will start with a yes or no and move on to negotiations. During negotiations is when the startup and the potential hire figure out compensation. So the real question is: how well can you negotiate? (applies to both sides)

</comment><comment><USER10> Problem is most early investment is convertible debt hence the angels don't know what they're getting either.

</comment><comment><USER11> You could also argue in the other direction: the substantial risk that stock in a startup may pay nothing at all should require paying a premium in stock options to make the expected value line up.

<comment><USER12> The point the author is trying to make is to price that risk according to how Angel investors and VCs price that risk.

One reason you _may_ want to take a discount is that you are in partial control of its success. I also think that if you are going to join a start up you should believe that the VCs and Angels priced it incorrectly and that the chance of success is far greater.

<comment><USER11> But investors get to spread their risk around. _You_ are forced to keep all your eggs in one basket. The marginal utility of their cash investment is likely lower than that of your time investment.

You have some control of its success, yes, but does it _really_ compensate for the previous paragraph?</comment></comment></comment>


A Survey Of JavaScript Lisp Implementations - <AUTHOR> http://ceaude.twoticketsplease.de/articles/a-survey-of-javascript-lisp-implementations.html

<comment><USER2> If you want to skip right to the results: <http://ceaude.twoticketsplease.de/js-lisps.html>

<comment><USER3> The number of JS lisps out there is pretty awesome.

Although, the results would be much nicer to read if the column headings didn't require a mouse-over.

<comment><USER2> For fun:

javscript:$('th').css('-webkit-transform', 'rotate(-45deg)').css('padding- bottom','30px').children().css('visibility', 'visible')

substitute mozilla for webkit if necessary</comment></comment></comment>


Show HN: Raccoon – Getting into Play without letting Google get into your phone - <AUTHOR> http://raccoon.onyxbits.de <comment><USER2> Does it allow you to download APKs and update them without a Google account?

Can you use it to avoid installing anything Google-related on a phone?

<comment><AUTHOR> > Does it allow you to download APKs and update them without a Google account?

No, Google Play can't be accessed anonymously (the whole point of all Google services is to coerce you into signing up for an account, so you can be tracked). You can (and should), however, create a throw away account exclusively for Raccoon.

> Can you use it to avoid installing anything Google-related on a phone?

Yes, Raccoon gives you the APK, which you can then sideload on your phone. Unless the app in question depends on something Google related, you are good to go.

<comment><USER2> The last time I tried to make a throwaway account for an android VM, Google blocked it in minutes (for "suspicious activity") and demanded a phone number to unlock it.</comment></comment></comment>


Ask HN: IBM will kill Google with Watson? - <AUTHOR>

Now that IBM has a computer that can answer complex human language questions, beating the world's best Jeopardy contestants, what's stopping IBM from feeding Watson the entire Internet as his knowledge base, and giving him a front end website for user's to ask him questions?
Forget searching pages of Google search results. Watson could answer nearly anything you ask it in real natural language.
Sure it'll take a year or two more to refine Watson to scale, but all the hard work is done. Additional using his machine learning, Watson would get better and better as user's asked him questions. What say you Hacker News? Will IBM kill Google? <comment><USER3> I swear, all this box worship makes me think of The Prisoner, Episode Six, "The General". Patrick McGoohan had the right take on this forty years ago.

At the risk of repeating myself, trivia questions are a game, not a source of wisdom. They are a highly constrained genre: a good trivia question requires no special expertise, can be answered in seconds by a human, and - <USER2> important of all - has a single, unambiguous, indisputably correct, short answer. In other words, it is the least important form of knowledge. They call it _trivia_ for a reason.

It is doubtful that Watson will be particularly better at answering such questions than Google plus a half-educsted human would be. It might be _faster_ than that combo, but how often are fractions of a second of the essence when Googling? It might not require the human to do as much, but humans are a dime a dozen on Mechanical Turk.

Moreover, taking humans out of the search loop is self-defeating: Google makes money _because_ a human must filter the results. Humans are susceptible to advertising. Watson won't click on ads that he glimpses out of the corner of his eye, and even if he did advertisers wouldn't pay for those clicks. So what is WatsonGoogle's business model?

<comment><AUTHOR> Ok, so Watson couldn't yet answer "How do you change the oil on an 77 Corvette?" any better than Google could, but it could conceivably answer the question "What size sockets do I need to remove the oil pan of a 77 Corvette?" Is that trivia? I guess. But it's also practical knowledge that's time consuming to find in Google search.

Also, I could be wrong, but I imagine a large percentage of searches are for trivia. It wouldn't have to be all or nothing. Perhaps Watson answers trivia like questions in clear english. For everything else he returns all the resources he has that he thinks are related to the question, like Google does. Heck, maybe Google partners with IBM to license the tech. Google's already trying to answer some trivial questions outright in search, such as when you ask for a definition, unit conversion, or simple math. Watson could take that to a whole new level.

As far as a business model, I don't see why slapping an ad on where to purchase the correct size sockets you need online beside your answer wouldn't work.

<comment><USER4> > _"What size sockets do I need to remove the oil pan of a 77 Corvette?" Is > that trivia? I guess. But it's also practical knowledge that's time > consuming to find in Google search._

Using Google or Watson is an inherently inefficient approach because it's trivial to find the most practical answer with a socket set and a mechanics creeper (and '77 Corvette). A shop manual doesn't hurt either.

</comment></comment></comment><comment><USER5> No.

IBM has little to no interest in or tolerance for consumer facing web sites. It tried developing a consumer web search in 1996 called "InfoMarket" and killed it weeks before launch (and killed off IBM's own web site search in the process as collateral damage).

While IBM does support a few sporting event web sites (which IBM has down to a routine), I don't see IBM doing anything with Watson facing the general public. Perhaps as a gimmick for a short period of time, but not a general service.

<comment><USER6> That was 15 years ago. I would really enjoy the show if IBM tried to backstab Google and Facebook, while everybody thinks the race is between the latter two only.

<comment><USER5> IBM has spent the past 15 years getting only farther away from consumer facing businesses. This one is a non-starter.

</comment></comment></comment><comment><USER7> I remember people asking the same kinds of questions when Wolfram Alpha was released. Alpha and Watson work in very constrained spaces and transferring their success to general search is very much non-trivial. So, no Watson will not make a dent in Google.. It'll be a very helpful tool in specialized areas but scaling it out is not a matter of a year or two..

</comment><comment><USER8> Natural language query is the holy grail of search engine perfection. I am sure, whichever company leads in this technology will have a prominent role in future. Imagine, having this functionality in the cell phone? People don't mind even paying monthly subscription to have this functionality.

</comment><comment><USER9> Police detectives might be interested in using Watson to assist them in solving murder mysteries.

</comment><comment><USER10> They could brand him as a butler. Maybe rename him to Jeeves! What could go wrong!!</comment>


America's Elites Lost Their Grip in 2019 - <AUTHOR> https://time.com/5735384/capitalism-reckoning-elitism-in-america-2019/ <comment><USER2> I'm not underestimating America's elites grip on anything.</comment>


The 10 acquisitions Yahoo should make right now - <AUTHOR> http://www.launch.is/blog/the-10-acquisitions-yahoos-new-ceo-should-make-on-day-one.html

<comment><USER2> The problem I have with analysis like this is it doesn't take into account what Yahoo actually needs to do to grow. For the most part, the companies on the list are innovative companies, led by talented CEOs/entrepreneurs and are leaders in there sphere.

But Yahoo's revenue is about $1.2 billion a quarter, and I would say that they would need to grow that by 5-10% to even approach any sort of potential turnaround territory. That means they need roughly $50 to $150 million in new revenue a quarter, I bet you all those companies together don't make that amount of money in a year.

I think it would be awesome for Yahoo to buy innovative companies and give creative people free reign, but the reality is Yahoo buying these companies is like putting a band aid on a bullet wound. Yahoo's just too big and those companies are just too small to turn Yahoo around.

</comment><comment><USER3> Leo needs more than creative control with TWiT, which is ultimately why I don't see him selling until he's ready to finally release the reigns to tightly. That said, the options posed in this content dream team would make any company successful, if managed and handled correctly. If it's not managed correctly, it's just another AOL story.

<comment><USER4> He already handed over CEO control to someone else I believe, so I imagine given total editorial control he would sell for $50 million or so.

Off topic, I would like to see he and Calacanis make up (as mentioned in the article). TWiT is a far better show with him.

<comment><USER5> Agree.

I'm not a big fan of Calacanis but he did provide the most interesting arguments (and color) when he was a regular (even when he was far off the mark). Especially when Dvorak was around too.

Much better than the current ensemble of "me toos".

PS. I also thought it was cool of him to write:

"I'd throw in my little ThisWeekIn.com copy-cat network to make up with Leo to get the job done. I've been looking to repair that burned bridge for a while."

</comment></comment></comment><comment><USER6> Interesting suggestions. I don't think Leo would sell to Yahoo. After what happened to TechTV, Yahoo is the last place he'd turn. Yahoo already has omg! which dwarfs Sugar Inc. I don't think Jim Lanzone would be afraid of Yahoo "Zucking" anything at this point.

I do think Gawker, Curbed, The Atlantic, Business Insider, Scoble, and Flipboard make sense, though.

</comment><comment><USER7> Sounds like a better plan than they've had for a while!</comment>


Notes on the Celebrity Data Theft - <AUTHOR> https://www.nikcub.com/posts/notes-on-the-celebrity-data-theft/ <comment><USER2> I wrote this in the other thread on the leak before it died:

> Even if the leaks result from one at a time social engineering, it still > really calls into question the practical security of the cloud. I doubt it's > much harder to steal, e.g. confidential business documents from executives' > cloud accounts than it is to steal pictures from celebrities' cloud > accounts.

> If I were a big organization with confidential information, I'd really be > thinking hard about my cloud policies and my BYOD policies right now. The > policy at my previous employer (we handled a lot of extremely sensitive > information), was pretty draconian: data never leaves a company desktop, > laptop, or blackberry.

The fact that the users may be the biggest security leak is more alarming than it is relieving. Software bugs can be fixed. Getting users to follow proper security practices is much harder. And frankly, it doesn't help that the industry is actively user hostile. I gmail my passwords to myself because every site has different password rules and force me to change my passwords too often.

<comment><USER3> Dude. 1Password. Switching to using it for everything was one of the single smartest things I did this year.

I agree with you about the wider industry problem, but for your own personal use just start using a password manager. Just do it.

<comment> vhost- 1Password and last pass are pretty awesome. Some people don't want to use a 3rd party and for those, I suggest KeePass databases at the very least.

I have all my two-factor reset keys in KeePassX at home and all normal passwords in last pass.

I actually lost a two factor code for Linode when I lost my phone with the Google authenticator app on it and having those reset codes in KeePassX was a life saver.

<comment><USER4> I've seen this argument come up before and I don't understand it. Why do you trust KeePass more than 1Password? In both cases you are sharing the datafile however you'd like (Dropbox, thumbdrive, etc...). The primary difference is if you have access to the source code or not.

If KeePass purposefully injected a vulnerability, it would just be that dev/project that would fail. If 1Password were to do the same, that company and all the people that work for it would go down. I'd personally see this as more of a reason to trust 1Password over KeePass.

The primary argument is that the code is open and you can audit it, but in reality that doesn't really happen unless there is a real drive to do it (like we saw recently with TrueCrypt).

I trust/distrust both about the same amount. But 1Password has more resources behind it so they are doing more to try and secure the data within the encrypted store.

<comment><USER5> Well, Keepass is free as in beer too, so from a licensing perspective, that's a factor (mainly for adoption) though, 1Password is a totally affordable and solid investment for 99%+ of folks on this board).

Free allows much more organic adoption - I can recommend a friend to use KeePass without worrying a bit that he doesn't think 1Password is a good investment. I can mandate it for my team at work without having to get it expensed.

<comment><USER6> Free as in beer is a reason to be more distrustful of the software. Sure it's more convenient, but this seems to be an area where it's really worth investing money in getting the more reliable solution.

<comment><USER7> Are you by chance a purchasing manager for a large corporation? Do you feel that signing a $100K-$1M Oracle contract is worth it because "if MySQL or PostgreSQL were worth something, then they would charge you for it?"

<comment><USER6> Thanks for the straw man and entirely manufactured quote. We're talking about paying $50 for software that manages your passwords for everything, not paying hundreds of thousands to millions of dollars.

<comment><USER7> > Free as in beer is a reason to be more distrustful of the software.

> this seems to be an area where it's really worth investing money in getting > the more reliable solution.

You're stating that "Free as in Beer" == "Less Reliable" and the fact that something costs money _implies with 100% accuracy_ that it is reliable. Neither of these are true. Arguing that I'm bringing up a strawman because I said "Free vs. Millions of Dollars" instead of "Free vs. $50" is beside the point.

<comment><USER6> I am not saying either. I'm saying "Free as in beer" is not a reason to trust software in _this particular field_ , i.e. the field of security software where one error can undermine the whole point of the software and expose your secret data to the world.

And I never even came close to saying that "something costs money implies with 100% accuracy that it is reliable". You are once again making up words to put in my mouth.

The fact is, a lot of people still believe the "open source == more eyeballs" myth, even though that _is_ a myth. Open source does not equate to reliability. And when it comes to software that requires this much trust, a company built around a product is more inherently trustworthy than open source, as the entire company is on the line with their product (and the livelihood of all their employees), whereas with the open source product only the reputation of the author(s) is at stake.

Please note that, once again, I am _not_ saying this is a "100% accurate" indicator of reliability. There are many factors at play. One important factor would be whether the software in question has ever undergone a security audit. Another would be whether there's proper documentation on the encryption (i.e. 1Password's file format is completely documented, both so third party software can use it if need be, and so the security of the file format can be vetted). A third would be the involvement of anyone who is already previously known to be an expert in the field. Etc.

Edit: Come on guys, please stop drive-by downvoting. If you disagree, _comment_!

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> While I am complete appalled by the data breach and hope that similar things never happens to anyone again

I would like to propose a purely thought experiment:

The hacker reported sold the nude photos of Jennifer lawrence for a mere sum of $130 using bitcoin.

If we apply game theory here, these kind of data is very difficult to monetize. If you sell one copy of the data, it is then immediately distributed online for free. Although, nude photos of celebs are arguably very valuable.

The question is: What is the ideal path for these people to maximize profits?

I think the better alternative would have been a kick starter type model where the attacker will only release photos if reaches a funding goal (let's say $50k). The attacker might release less revealing photos to build interests in the goal funding.

I often hear about decentralized kickstarter models with bitcoin (mutlsig; or ANYONE_CAN_PAY hash type). But I always thought of them as gimmicky. This is actually a use case for it.

So going beyond, celeb photo breach, this similar model should be applied to many more scenarios. ie.

1\. you have a valuable asset,

2\. but it loses value immediately after the first distribution

3\. so you must capture all of the value at distribution

Note:

Anyone can pay: [https://bitcoin.org/en/developer-guide#term-sighash- anyoneca...](https://bitcoin.org/en/developer-guide#term-sighash-anyonecanpay)

<comment><USER9> While I don't actually have any solid grasp of the code that would be required, I imagine it would be possible to release 1 image to show that one does indeed have a collection of "valuable" photos. Once trust has been established that the person probably does indeed have additional photos, people will be more willing to submit bitcoin.

You overwrite each pixel of each photo with black. You assign every photo a bitcoin address and perhaps give a name describing its content (something kinky, obviously). Each photo has a set amount the person is asking for its release. As bitcoin is sent to each photo's address, more and more pixels are revealed, as a percentage of the remaining bitcoin price.

You can go further by making the first few photos far cheaper the next (potentially more sultry) photos, creating an exponential pricing system that will likely benefit the hacker. Trust is increased as a low cost photos are revealed, demand for more revealing photos increases as trust increases.

Thoughts?

<comment><USER9> As noted by ______1, the hacker did something similar by censoring the photos and offering to uncensor for bitcoin. The difference here is that people sending bitcoin have no guarantee that the photos will actually be released once the bitcoin is sent. They don't have any guarantee that the posted bitcoin address is not an imposter, and the real address is elsewhere. They don't even have a guarantee that the hacker was already caught, thereby wasting their bitcoin. That system is lacking in trust. A dynamic system described above would help mitigate that problem (even though the hacker could reblack-out each photo and tell them to start again, but that would completely demolish any future trust, although it would hardly be considered "stealing" since the percentage paid of each photo was already released).

</comment></comment></comment><comment><USER10> I use strong passwords generated by 1Password for everything.. except for iCloud. There I have an idiot password.

Why? Because freaking iPhone asks for that when I want to download something from App Store. How do you guys handle that?

<comment><USER11> Don't use an "idiot" password, use a long password.. Good passwords aren't complex, they're LONG..

"this is a really dumb password" is probably actually a really good password. ;-)

And also, your "problem" is simply your decision to trade security for convenience.

You need to weigh the risks vs. reward and make the choice for yourself. If something goes wrong, at least you'll know why.

<comment><USER12> Long passwords (aka the xkcd scheme) aren't secure anymore - [https://www.schneier.com/blog/archives/2014/03/choosing_secu...](https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html)

The only good passwords are ones that stay well away from dictionary words..

<comment><USER13> The Schneier article is puzzling; the security of the diceware/XKCD scheme doesn't rely on the word list being secret, just on the words from the list being chosen randomly. 4 words randomly chosen from a list of 5000 provide about 49 bits of entropy _when the list of words is fully known_.

Against an attacker who knows exactly how you chose your password, it's (roughly) the same level of security as a 14-digit numeric code, or an 8 letter case-sensitive alphanumeric code. It's just supposed to be easier to remember.

<comment><USER14> His point is that using actual, grammatically correct, sentences is not the same as using several random words. As your mobile keyboard autocomplete well knows, after a certain word there are words more probable than others.

How many people use this kind of approach, I don't know. Schneier seems to focus on "three random letters" kind of attacker.

</comment></comment></comment></comment></comment><comment><USER15> The thing that bugs me is that you could have good password practices. But if you're having a party, having a fun time (and lets face it, people are going to do shit...), and _one of your friends_ is snapping photos of you, and they have bad password practices, then you are kind of screwed. People don't typically make friends on the basis of: do you have good password practices.

<comment><USER16> Yup. And that very reason is why many people don't have social networking accounts. You can control what you share, but you can't control what your friends share.

<comment><USER17> How not having a social networking account helps with that? Not only you still can't control what your friends (that is, the real-life ones) share, now you're the last to know if they share something about you.

<comment><USER18> Perfect example is Facebook. You don't have to be on it for them to know your phone number. If 2 of your friends have the "Share your Contacts with Facebook" option turned on, chances are Facebook has your phone number/whatever else your friends store on their friend about you.

</comment></comment></comment></comment><comment><USER19> > Password reset is answering the date of birth and security question > challenges (often easy to break using publicly available data – birthdays > and favorite sports teams, etc. are often not secrets)

I really dislike this trend of "personal questions" to reset your password. The first car I owned or where I'd like to retire is easily obtained information. When are websites going to stop doing this?

I answer these questions using passwords generated from 1Password. So basically I have 4+ passwords per sites that use these questions. Very annoying.

<comment><USER20> What about just using a basic cipher for your questions? It is what I do. So if the question is "What was your first car?"

Answer could be: Ford

Instead it is Enqc or droF or Gpse

<comment><USER17> Well like many such website "security" practices, if you know why they're bad, they are no longer a problem for you. But normal people don't know why security questions are a stupid idea, so when an otherwise reputable website (like an e-mail provider) asks you for your first car or favourite toy, they assume it's how things are supposed to be on the Internet.

</comment></comment></comment><comment><USER21> So if I'm understanding this from a technical perspective, the real story is that this is/has been going on for quite some time, and there's an entire ecosystem devoted to it. The general public rarely ever sees behind the curtain, but somebody got greedy in this case and we ended up in a race to the bottom.

If true, interesting that such a layered economic structure can exist without much press or public comment -- until something like this happens.

Fascinating. Makes you wonder what percent of the total activity these 100+ celebrity invasions represent.

<comment><USER17> Well the fact that JenLaw's photos went for the extremely huge amount of $130 suggests that either there's _a lot_ more of it out there, or that the guy who stole them couldn't fence them (per [0] thread).

Anyway, you summed up the take-away from the article perfectly. Since this seems to be going on for some time, I wonder how the whole ecosystem kept coordinating this well so far, that it's the first time we hear about such big (but still lousy one) defection.

[0] - [https://news.ycombinator.com/item?id=8260233](https://news.ycombinator.com/item?id=8260233)

<comment><USER21> Yeah, there's some hard-to-accept math in that story.

If JenLaw's photos were worth $130 or so, that means that any photos that any of us have are associated with a market value. And it ain't that much.

<comment><USER17> Well, that our photos have a price tag is kind of obvious. Everything has one. But I'm very surprised by the amounts we're talking about. I'd expect JenLaw to be extorted for hundreds of thousands of dollars, or at least those photos going for many $k (and THB, some other celebs have much worse photos/videos in this leak). So them going for $130 implies that either celeb sex tapes are really common/cheap in the darknet, or _we have no frikkin ' clue what's going on out there_.

<comment><USER22> Anonymous extortion threatening to release something that is trivial to copy is not going to work, because there is nothing to guarantee more money will be requested next week, or that the material will not be released later.

As far as selling it, the price cannot be very high, because nobody has that much to gain from being the first with the pictures. It's illegal material after all, so magazines can get in trouble for buying it. Put it in a shady, for-pay site, and with it being illegal material and all, it'd be in a torrent in minutes, so how many times will you really sell it?

If it was, say, a presidential candidate doing hard drugs and cheating on his wife with a man, then maybe you could say that the opposition would be willing to pay for the pictures to be released, regardless of how they were obtained: There'd be millions at stake. A naked actress? not so much.

</comment></comment></comment></comment></comment><comment><USER23> Why is nobody talking about password reset questions?

<comment><USER24> I'm not sure if it's completely fair, but everytime I see "security questions" I can't help think: "Oh, it's an American site".

Silly "security" questions about mothers, dogs and favorite teachers seems to be cultural to the US (and maybe Canada), why is that?

<comment><USER25> The whole "mother's maiden name" thing is pretty popular in US banks. I'd wager this is where it came from.

Then again, you are talking about a country where the only thing people need to steal your identity is your ... social security number. Brilliant.

<comment><USER24> Stealing the social security number in Denmark is just as bad and possible easier than in the US. If you know a persons birthday and gender you have at least a 1 in 500 chance of simply guessing the last four digits.

<comment><USER26> That's exactly not the point. The point is that _it shouldn 't matter_ that other people know your SSN. What effect does it have in Denmark when other people know your SSN?

</comment></comment></comment></comment></comment><comment><USER27> Choice quote:

 _To reiterate what the main bugs are that are being exploited here, roughly in order of popularity / effectiveness:_

 _Password reset (secret questions / answers)_

 _Phishing email_

 _Password recovery (email account hacked)_

 _Social engineering / RAT install / authentication keys_

Note: Not weak passwords.

<comment><USER28> Here's a question: How did the attacker get the usernames of the celebrities? Those aren't exactly public info (unless they used the same name as their Instagram account or something).

<comment><USER27> The article discusses this very point in some detail (see especially point 7 about iCloud email testing).

</comment></comment></comment><comment><USER29> I use a Yubikey with a generated key.

This is only half of my password; the first part is a password I can remember easily with numbers and letters, the second is the generated key.

This means that even I don't _really_ know my password and if someone found my Yubikey then it's useless to them without the other half that only I know.

(I do have a printout in a safe place of the key and also a backup Yubikey)

I use this password for my computer as well as my 1password vault which is generally filled with randomly generated keys for each website.

Might sound a bit overkill but if you can; why not?

<comment><USER30> That sounds secure, but help me understand: Is it the same password everywhere? How do you manage the different passwords for different services? How do you enter your password to login on an ipad, or on your phone?

My biggest problem with the Apple's password policy is that I'm required to enter it periodically on an ipad or iphone - meaning I can't keep it lastpass and that complex alphanumeric passwords are even harder to enter.

<comment><USER29> My iOS accounts are, unfortunately limited to a password that I can remember but I use one with numbers and letters and a mixture of uppercase and lowercase characters.

Most of my website passwords are generated keys; each different - all stored within 1password, should there be an issue at any point (doubtful) I can always go through the "forgot password" features on any given website to reset it to something temporarily that I can use easily.

</comment></comment></comment><comment><USER31> Just to give OP a heads up: the article's font is rendering terribly in Windows Chrome.

<comment><USER32> I've noticed this with my own websites. Fonts consistently look great in FF and IE but terrible in Chrome. What can be done to fix this?

<comment><USER33> Turn of the DPI scaling in Windows.

[http://support.microsoft.com/kb/2900023](http://support.microsoft.com/kb/2900023)

Google around for the actual steps.

<comment><USER31> I'd rather not do a fix like that; I want to notice if sites I code have the issue.

<comment><USER33> I agree, but until Google gets the fix in you can have no way of knowing what it will look like because it all depends on the hardware and how it has been scaled.

I only came across this because my daughter's new laptop with an HD screen made Chrome look awful and I didn't understand why since it looked good everywhere else.

</comment></comment></comment></comment></comment><comment><USER34> Isn't showing partially blacked out private photos still a violation of privacy? If the author of this post really wants to be white hat, he should modify the image (above 14) to obscure the non-blacked out part of the photo with a different color. I'm unfamiliar with that celebrity in the picture but if I was familiar with her work, it would feel creepy to look at it.

<comment><AUTHOR> thanks - fixed. didn't notice I picked the wrong image out when uploading.

</comment></comment><comment><USER35> The average user does not know much about security. They trust Apple's brand more than they trust their friends (with secrets and health apps) and they will now likely stop using many services rather than step up security.

What is interesting is that the perception among normal people I heard speak about this is that all of iCloud has been breached, i.e. everyone's photos are in the hands of hackers and they only released the pics of celebs.

The reality is of course likely that an attacker was able to hack one phone which among photos hosted contacts and mail addresses of other celebs and from there on they got their hand on more accounts to directly target.

Anyway, my point is that to average consumers it does not mean that they need to use stronger security or that they would understand about targeted attacks. They will believe Apple has been breached and they will think more before creating private selfies or putting health data onto their until now so trusted companions.

</comment><comment><USER36>
      > 6. iCloud is the most popular target because Picture Roll backups are enabled
      > by default and iPhone is a popular platform. Windows Phone backups are
      > available on all devices but are disabled by default (it is frequently enabled,
      > although I couldn't find a statistic) while Android backup is provided by
      > third party applications (some of which are targets).

Fragmentation, for the (security) win! </sarcasm>

Not really, of course. The big win (shared by Windows Phone) is simply _not turning on the security-sensitive cloud service by default_. That being said, it is worth noting that enabling/encouraging third-party service competition can create an extra hurdle by discouraging cloud-service monocultures.

<comment><USER37> Does Android really not provide an auto upload of snapped pictures to the cloud? I was under the impression that they did this way before iCloud even came up. First it was to Picasa or some place, then to the google+ place somewhere.

Either way, I don't even remember if the iCloud upload was default or not. When it was introduced I took an interest to find out how to deactivate that in case it was enabled by default. Don't remember if it was. All I know is, it is disabled on my device and it'll stay that way because I really didn't want to use this.

<comment><USER38> > Does Android really not provide an auto upload of snapped pictures to the > cloud? I was under the impression that they did this way before iCloud even > came up. First it was to Picasa or some place, then to the google+ place > somewhere.

When you sign into Google+ or Dropbox (among others), you are presented with a screen where you can enable photo uploads to those cloud accounts.

</comment></comment></comment><comment><USER39> I think the cloud has proven to be untrustable. One must assume that any data on any public cloud service (including email, photo libraries, documents, mobile device backups, etc.) will become public, and use the cloud with that mentality.

</comment><comment><USER40> Reddit should not be listed among the sites hosting the stolen images, as reddit does not support image uploads. Imgur is the primary site hosting the stolen images in that case.

<comment><USER41> Are we still unable to move past this pedantic hosting-vs-linking nitpicking? It's like you willfully ignore how content discovery works on the Internet.

<comment><USER42> Just to be pedantic: By the same logic, Google is also grossly hosting tonnes of illegal material.

<comment><USER43> Google doesn't have moderators posting messages like "uh-oh your illegal content is being taken down. Here's a list of other places to post it." Meanwhile, Reddit has precisely that. Warning: link to NSFW board, though this post isn't itself NSFW.

[http://www.reddit.com/r/TheFappening/comments/2fa2a1/meta_ef...](http://www.reddit.com/r/TheFappening/comments/2fa2a1/meta_effective_immediately_any/)

In which the mods write: "On another note: please use other hosting sites besides imgur.com. We have a large list of whitelisted domains listed here that you should be uploading to besides imgur. Do not put all of your eggs in one basket."

</comment></comment></comment></comment><comment><USER44> I'm wondering if simple GeoIP check can prevent lots of intrusion attempts - if the user consistently logs in from one location and then suddenly tries to log in with the wrong password from the distant one, that's the red flag that warrants temporary account lockout at least.

<comment><USER45> problem #1: GeoIP isn't accurate enough

<comment><USER46> problem #2: Travel becomes more of a pain because your apps/phone stop working.

</comment></comment></comment><comment><USER47> Read the comments to this blog post. The misogynistic mouth breathers are out in full force as usual.

<comment><USER17> Just wait for the misandristic crowd to show up, as they always do. I'm just starting to see first articles in my Facebook feed trying to spin this celebrity leak into women oppression problem.

<comment><USER47> Both groups certainly exist, but one is larger than the other by a few orders of magnitude.

<comment><USER17> (disclaimer: not meaning to start any kind of flame-war)

To be honest, the one I perceive (as a straight, white, middle-class, educated male) larger is the misandristic one. As a person who strives to be good and helpful to every human being equally, regardless of race, gender, orientation or whatever, I get everyday on the Internet and I get flooded by articles and comments saying that everything I do or think is misogynistic, wrong and overprivileged.

Honestly, I think that (and I never thought I'll say something like that ever) UrbanDictionary's definition of "social justice" sums it up perfectly:

 _Promoting tolerance, freedom, and equality for all people regardless of race, sex, orientation, national origin, handicap, etc... except for white, straight, cisgendered males. Fuck those guys, they 're overprivileged no matter what. "In the name of social justice, check your privilege."_

( [http://www.urbandictionary.com/define.php?term=social+justic...](http://www.urbandictionary.com/define.php?term=social+justice) )

I'm not saying the world is fair to women or minorities, it's sure as hell not. But SJWs are overplaying it by _many orders of magnitude_.

In my opinion, the reason this leak contains only women celebrities has nothing to do with misogyny, and everything to do with the reason why celebrity magazines are focused on women-celebrities, why most porn is targeting males, why most women dress in various cuts and colours while for a man just a suit will do, etc. Not saying it's good or bad, it's just how the culture evolved - but the point is, _there 's nothing new/important to see here_.

Also, to risk being accused of victim blaiming, et al., when you become a celebrity - be it an actor, a model or a politician, you implicitly accept that all your life becomes a public matter and is subject to scrutiny by random actors. And to be honest, I think that those celebrities actually would agree with me on that. See, it's not the victims that are making a big scandal out of this leak, it's the media and the general public, who are doing it "in their defense".

<comment><USER48> Regardless of the truth or falsehood of what you're saying, no good (for you or anyone else) will come of making this one of your personal crusades, which it sounds like it is. There are far nobler causes than standing up to SJWs you feel have crossed some line of hypocrisy, and you are much more likely to be a force for harm than good in the world as a result.

<comment><USER49> SJWs are not beyond criticism, nor should they be:

[http://studentaffairsfeature.com/ten-counterproductive- behav...](http://studentaffairsfeature.com/ten-counterproductive-behaviors-of- social-justice-educators/)

</comment></comment></comment></comment></comment></comment><comment><USER50> Icloud hacking was mentioned and everyone has jumped on it. Many cell transmissions are unencrypted. MITM attacks should not be thrown out as a possibility. Malware is also a vector, including apps.

<comment><USER51> One of the victims stated the pictures were from several years ago. Unless the hacker was extraordinarily patient and persistent, I have to think a MITM attack on a cell tower is unlikely. More likely a cloud service (email, social media, storage) of some sort was compromised.

<comment><USER50> Another possibility is purchasing an old phone from Ebay and extracting deleted files. Or a local mac/pc/phone repair shop pulling the data during a repair. Then theres the nsa/border sec vector too.

Photos uploaded to a mac or pc could also be malwared or malicious apps. Theres the ex/friends/family as possible weak points too.

Plus we have no idea how long these photos have been traded within that private group.

What i'm saying is there are lots of ways this could be done and we shouldn't get so hung up on the icloud idea.

</comment></comment></comment><comment><USER52> Why doesn't platform maker like Google, Microsoft and Apple have their Password manager and forces the usage of it?</comment>


How Id built Wolfenstein 3D using Commander Keen tech - <AUTHOR> https://www.gamasutra.com/view/news/344672/How_id_built_Wolfenstein_3D_using_Commander_Keen_tech.php <comment><USER3> Hovertank and Catacomb, the games between Keen and Wolfenstein, are both open- sourced:

[https://github.com/FlatRockSoft/Hovertank3D](https://github.com/FlatRockSoft/Hovertank3D)

[https://github.com/CatacombGames/Catacomb3D](https://github.com/CatacombGames/Catacomb3D)

I'm the current owner of the Catacomb games, and have been working on improving and porting them in my spare time (not publicly available yet, but will be When It's Done). Fabien's Game Engine Black Book has been an invaluable resource for me. I highly recommend it!

<comment><USER4> How did you become the current owner? I'm very curious about how you went about obtaining the rights.

<comment><USER3> The original publisher, Softdisk sold many of its assets to Flat Rock Software in the 2000s. Flat Rock sold off bits and pieces over the years, and the Catacomb games were one of the last things it held [1]. In 2017, I wrote a toy implementation of Catacomb 3D in WebGL [2]. Since the project used art that was under copyright, I contacted Richard at Flat Rock to ask permission to use it. That conversation eventually led to me deciding to buy the overall game ownership from him [3].

[1]: [https://web.archive.org/web/20150101022225/http://www.flatro...](https://web.archive.org/web/20150101022225/http://www.flatrocksoft.com/)

[2]: [https://github.com/jayschwa/CatacombWebGL](https://github.com/jayschwa/CatacombWebGL)

[3]: [https://web.archive.org/web/20170623155041/http://www.flatro...](https://web.archive.org/web/20170623155041/http://www.flatrocksoft.com/)

<comment><USER5> Wow! Mind if I ask what the price is to the rights of an old game like Catacomb?

<comment><USER6> I was looking into buying that IP a few years ago, and the asking price was affordable (I just didn't have the $ at the time so I went onto other projects). Glad to see someone doing something with it, I think it's perfect for a remake.

<comment><USER7> Would you be willing to share an order of magnitude?

<comment><USER6> It was high four figures

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> It can't be understated how much impact Wolfenstein 3D and Doom had. Commander Keen was already quite the tech demo, with scrolling on a PC without dedicated hardware; the most advanced platforming you'd see at the time would be Price of Persia.

Wolf 3D felt like a next gen tech demo out of time. It was great fun, it was violent, it looked unlike anything else (besides Ultima Underworld). Of course, that monumental achievement looks insignificant when compared with Doom, which single-handedly added stairs, different floors, multiplayer (!) and modding.

Most of us here work in software. To see software so casually come in, introduce never seen before concepts, it's so impressive to me. I don't think That I know of something having quite this impact in other aspects of software.

<comment><USER9> I've played much "better" games than Doom in many ways, but never one so revolutionary for its time, and I've never been so genuinely _afraid_ when playing.

But seriously: Overstated! You mean overstated!

<comment><USER10> _> so genuinely afraid_

As a little tyke I used to actually duck left of my monitor when an imp threw a fireball with my heart thumping. Replaying as an adult I'm like wtf that's just a lumpy mass of pixels, how could I have been so scared?

<comment><USER11> I remember watching my father play Descent and that was pretty much the first real 3D game I've seen (Germany, so there was a bit of trouble with Doom and Wolfenstein). And I was constantly trying to peek around corners by moving my head.

<comment><USER12> You should all check out overload by the original descent developers.

[https://store.steampowered.com/app/448850/Overload/](https://store.steampowered.com/app/448850/Overload/)

</comment></comment></comment></comment></comment><comment><USER13> Impressive id went through development of Quake 3 with no version control.

When I was interning at Apple back in the day I had a side project of porting wolf3d to OS X, and it was the first occasion I had where I came to admire John Carmack's code directly. His game source code is something I recommend checking out to coders interested in gamedev.

Also, I have fond memories of poking around making DOS experiments in Borland C++ as a teen.

But speaking of version control — I guess that's just how things were done in the 90s. I read recently that not only was Final Fantasy 7 developed and shipped without it, but Squaresoft contemporaneously lost the final PlayStation source code and art assets. The studio contracted to port it to PC was supplied with a mishmash of non-final code and assets.

<comment><USER14> Version control software was a lot more primitive and less fun to use in the 90s. On Unix you had CVS, on Windows just VSS. SVN, Mercurial and Git all came post 2000.

<comment><USER15> And it took SVN a couple extra years to be performant on Windows, which at the time was still the dominant development environment in many places.

Maybe my second SVN project, we had a monorepo, Windows, and a virus scanner (multiply pull time by five). I'd come in in the morning, log in, do an svn up, go get coffee and say hi to the people I was collaborating with, and be back to my desk all before it finished.

Many days I only synced to head twice because it was a pain in the ass, and the SVN maintainers were not at all sympathetic. A new contributor consolidated the config files and cut the number of file open operations by a couple orders of magnitude. I don't think we ever properly thanked that guy.

<comment><USER16> > _A new contributor consolidated the config files and cut the number of file > open operations by a couple orders of magnitude. I don 't think we ever > properly thanked that guy._

Unspoken benefit of "new person" — eventually someone not desensitized to the crap will throw up their hands and fix it.

<comment><USER17> Sometimes it's so tiny too, but requires you to look at code that nobody else has a reason to look at any more.

I once increased performance of a CMS by 30 percent my first day in the job because I happened to spot a handful of lines of unnecessary string copying while trying to figure out how the thing worked.

Everyone else could have, but none of them had any reason to look at that part of the code because it worked.

</comment></comment></comment></comment></comment><comment><USER18> "We didn't have a version control system. Surprisingly, we went all the way to Quake 3 without one, then we started using Visual Source Safe."

That is both impressive and terrifying. I'm old enough to remember when I first started using VSS, and being amazed at how awesome source control was :D

These days, it's hard to look back at SourceSafe with anything other than horror....

<comment><USER19> There was a transition from the 80s to late 90s: until you had some kind of network, the important thing was to backup your machine. Daily if you can. Even if you had been running a local revision control on your local machine, you wouldn't be protected enough, so backups were more important.

Once networking and servers became more prevalent, it slowly made sense that backups turned into revision control. If your machine crashes, there is a remote repo you can connect to and get back to where you were.

</comment></comment><comment><USER20> >> Everybody was working witht he best PC money could buy, a high end 386DX/33MHz with 4MB of RAM

According to a May 15, 1990 issue of PC Magazine, that was a $3,500-4,000 USD machine back then.

Used to develop Wolf3D, but only good for about 8fps when Doom (ID's next hit) came out.

<comment><USER21> Interestingly that's the exact PC my dad bought us when we were kids. I loved how computers back then had a turbo button, but I could never figure out why anyone would turn off turbo! :P

<comment><USER22> I believe it was due to programs (mainly games) that relied on clock speed to work. If you ran some of them with turbo, they were so fast they were unplayable.

</comment></comment></comment><comment><USER23> "Masters of Doom: How Two Guys Created an Empire and Transformed Pop Culture" has an excellent account of how Romero and Carmack built these games.

<comment><USER24> I've tried using that book to explain to people how "real" software development works. How the inception of the real cool shit, the stuff that spawns a company, is almost always 2, 3 or a small handful of people working late, night after night, living on pizzas and cola, churning code. And how that apparent anarchy is a more productive environment that ten pointy headed bosses plugging away at their gantt charts and a hundred 9 to 5 developers carrying out their orders.

<comment><USER25> Not that I want to be seen defending pointy headed bosses, but I think there's a fair amount of survivorship bias in your statement. How many groups of 2-3 people have worked late, lived on pizza and coke and produced absolute garbage? Quite a few, but you never hear about them because they aren't notable.

You don't have to get into pointy headed boss territory to be a successful programmer _and_ leave the office at a respectable time every day.

<comment><USER26> Are many successful game programmers in corporate environments leaving the office at a respectable time every day? I definitely don't get that impression at all.

At least in a 2/3 man team surviving on pizza and Coke you're not lining someone else's pockets with millions of dollars only to be thrown out onto the street at the end of the process.

</comment></comment></comment></comment><comment><USER27> A version of Keen's tile editor was used to create maps for games as recent as _Rise of the Triad_ , which was itself built on a modified Wolfenstein engine.

<comment><USER28> > as recent as Rise of the Triad

Released December 21, 1994

<comment><USER29> That game got a remake a couple of years ago. I don't know if they were referring to that.

<comment><USER30> If they were still using the Keen Tile Editor that'd be amazing.

<comment><USER27> I was referring to the original -- which was still released after _Doom_ came out.

</comment></comment></comment></comment></comment><comment><USER31> John Romero mentions this in his talk - "The Early Days of Id Software"

[https://www.youtube.com/watch?v=KFziBfvAFnM](https://www.youtube.com/watch?v=KFziBfvAFnM)

<comment><USER31> John talks about Id's Software Principles, one of the YouTube commenters (Sean Ramey) summarized them below:

1\. No prototypes. Just make the game. Polish as you go. Don't depend on polish happening later. Always maintain constantly shippable code. (Large teams require more planning though.)

2\. It's incredibly important that your game can always be run by your team. Bulletproof your engine by providing defaults (for input data) upon load failure.

3\. Keep your code absolutely simple. Keep looking at your functions and figure out how you can simplify further.

4\. Great tools help make great games. Spend as much time on tools as possible.

5\. We are our own best testing team and should never allow anyone else to experience bugs or see the game crash. Don't waste others' time. Test thoroughly before checking in your code.

6\. As soon as you see a bug, you fix it. Do not continue on. If you don't fix your bugs your new code will be built on a buggy codebase and ensure an unstable foundation.

7\. Use a development system that is superior to your target.

8\. Write your code for this game only - not for a future game. You're going to be writing new code later because you'll be smarter.

9\. Encapsulate functionality to ensure design consistency. This minimizes mistakes and saves design time.

10\. Try to code transparently. Tell your lead and peers exactly how you are going to solve your current task and get feedback and advice. Do not treat game programming like each coder is a black box. The project could go off the rails and cause delays.

11\. Programming is a creative art form based in logic. Every programmer is different and will code differently. It's the output that matters.

Extra advice:

1\. Only program for a few minutes and test code immediately. Try not to code for even as long as 30 minutes. This is will help to avoid debugging because you will catch bugs sooner, and won't have as wide an area of code to look through for the bug.

</comment></comment><comment><USER32> Interesting how they make sure to mention the use of 320x200 during graphic editing to maintain proper aspect ratio, then display screenshots from the game in improper aspect ratio

</comment><comment><USER33> Wow, those screenshots bring back memories. Used that same exact IDE to make games when I was a kid. It was an amazing time to be programming.

</comment><comment><USER34> And notice that they used an IDE. So that kind of gives credence to the idea and the HN meme that "10x developers don't use IDE's" is BS....

<comment><USER35> You are not making an equal comparison. DOS at the time didn't have multiple windows or multitasking. People that don't use IDEs these days still use multiple terminals or windows.

Using the Borland C++ IDE in 1991 is way more similar to using Emacs these days, than Visual Studio Code.

<comment><USER34> The source code for Doom 3 (circa 2004) was released on Github - it was a Visual Studio solution.

[http://fabiensanglard.net/doom3/](http://fabiensanglard.net/doom3/)

</comment></comment></comment><comment><USER36> Great article - cool to get an inside look at tools, IDE environments, art sketches etc.

Such an exciting time for PC games, with ID way out at the forefront - <USER2> recommend the Masters of Doom book mentioned in the article too, it's a deep dive into the making and eventual impact of Doom. Great snapshot of the ID guys and of that time period.

</comment><comment><USER37> For anyone curious about the technical details, there's a decent description of how Adaptive Tile Refresh works in the wikipedia article: [https://en.wikipedia.org/wiki/Adaptive_tile_refresh](https://en.wikipedia.org/wiki/Adaptive_tile_refresh)

</comment><comment><USER38> I remember playing Wolfenstein 3D for many hours back in grad school.

Then Doom came out, and I found out the hard way that I get motion sickness from playing immersive games with good graphics. :-(

I've not been able to play first person shooters since. But I sure loved Wolfenstein 3D.

<comment><USER39> Used to get severe motion sickness too until I figured out it went away at high FPS. At least for well made games with low input latency.

With a good 1000Hz wired mouse and games I where I get _at least_ 100fps, preferably >144fps, I don't feel anything at all when I play. Still can't watch others play though.

<comment><USER38> My curiosity is not sufficient to test whether the same is true for me. Particularly not since if I get immersed in the game, by the time I realize it is happening it is too late. The potential upside just isn't there to make it worthwhile.

However I've also found that 3-D systems that everyone else oohs over whose operators promise don't cause motion sickness any more, always do. Really fast. So I'm apparently on the sensitive end of motion sickness from computer systems.

</comment></comment></comment><comment><USER40> These two titles in one sentence, make me wonder how a 3d shooter version of Commander Keen would be with current day graphics.....

</comment><comment><USER41> My dad brought copies of both of these games home on floppy disk, which is what got me into computers.

</comment><comment><USER42> Shameless plug: this reminds me of how I once spent an afternoon compiling the open sourced version of Keen Dreams using Borland C++ 3.1 :D

[http://x3ro.de/2014/09/18/keen-dreams- dosbox.html](http://x3ro.de/2014/09/18/keen-dreams-dosbox.html)

</comment><comment><USER43> What is the blue-yellow IDE/editor called?

<comment><USER44> It is quite clear on the figure captions, Borland C++ 3.1.

<comment><USER29> You could even license the UI library from Borland for use in your own programs. And Turbo Pascal had the exact same look.

Later, there was a near clone of the Borland IDE called RHIDE which wrapped DJGPP, a GCC port for DOS/DPMS. I had some fun times with that.

<comment><USER45> _> You could even license the UI library from Borland for use in your own programs. And Turbo Pascal had the exact same look._

Turbo Vision?

<comment><USER46> They even released the C++ version as public domain. Free Pascal uses it's own Free Vision which is back port of the TUI support into Graphics Vision[1] (which in turn is LGPL's reimplementation of Turbo Vision API in graphical mode)

[1] [https://www.math.ucdavis.edu/~mkoeppe/mkm/mkmeng.html](https://www.math.ucdavis.edu/~mkoeppe/mkm/mkmeng.html)

</comment></comment></comment></comment></comment><comment><USER47> I miss Keen.

</comment><comment><USER48> Now that's a flex!</comment>


Experiments with prepledge - <AUTHOR> http://www.tedunangst.com/flak/post/experiments-with-prepledge <comment><USER2> The author explains well that pledge(2) is all-or-nothing and that this design is intentional. Indeed, as more cap-safe APIs are designed, this sort of edge will only become sharper. Cap-safe languages can do even better fine-grained restriction of capabilities, but require a total rewrite instead of just an extra syscall.

</comment><comment><USER3> This is about OpenBSD pledge(2), which was designed to allow developers to write software that can be sandboxed, not as a mechanism to sandbox arbitrary software with requirements for which you don't fully understand.

[http://man.openbsd.org/pledge](http://man.openbsd.org/pledge)

<comment><USER4> Well, the article actually attempts to use pledge to do just that. This results in a nice article that teaches a bit about pledge, sandboxing, and ktrace.

The conclusion does explain why pledge would be a poor generic sandbox.

 _This point has been made from the early days, but I think this exercise reinforces it, that pledge works best with programs where you understand what the program is doing. A generic pledge wrapper isn't of much use because the program is going to do something unexpected and you're going to have a hard time wrangling it into submission._

<comment><USER3> Sorry, this was more for HN readers benefit. I know he's writing this from a developers perspective.</comment></comment></comment>


Camping is not for the faint of heart - <AUTHOR> http://lifebyblackhole.blogspot.pt/2012/08/camping-is-not-for-faint-of-heart.html

<comment><USER2> A quote: "We arrive at the park and have to mount everything. This involves removing all the gear from the car ..."

Wait -- based on the article title, I thought this was about camping. In camping, you put on a backpack, walk away from civilization, choose a spot suitable to put up a tent or throw a sleeping bag on the ground, and stay a while.

No park, no car, no bathroom. The author is misusing the word "camping" to refer to going to a car park.

Another quote: " ... all the usually long trips to the bathroom (if you're lucky it's just 50 meters from your tent) ..."

This is depressing. I'll bet this guy has never camped in his life. Where I camp, I have to think of a way to keep the bears out of my tent.

One of my camps in Alaska: [http://arachnoid.com/alaska2008/graphics/pws_naked_island_20...](http://arachnoid.com/alaska2008/graphics/pws_naked_island_2008_07_03_003_small.jpg)</comment>


Show HN: Chrome Extension I wrote that shows image properties on hover - <AUTHOR>

https://chrome.google.com/webstore/detail/ngadjednajjomdjagknebelhmcjggklk There it is. It shows width, height and file size(which you can turn off) in a corner. It looks neat from the box, but you still can configure it for yourself. I would appreciate any feedback.<p>Also, there's source available at https://github.com/KiDoki/Image-Resolution If there's any interest, I will continue working on it. <comment><USER2> Cool extension, but normally i just right-click and i have the information there :)

What will you build more on it? Maybe i can help?

<comment><AUTHOR> You can surely fork it on github. I wrote this extension for myself and I don't need any more functionality. But if someone wants a thing or two, I will try to implement it. But at the moment there's no interest from the user base, so I'm not willing to code new features. It would be good to be able to configure it more. For example, to show that properties box only if user is holding Ctrl or something like that. Or to show the box near the cursor, and not in the corner.

</comment></comment><comment><USER3> Looks good</comment>


Comparisons among Java-based CSV parsers - <AUTHOR> https://github.com/uniVocity/csv-parsers-comparison

<comment><USER2> Taken with a grain of salt, of course, because the winner is the one running the competition.

Worth noting:

\- All but the last-place finisher here are actually placed quite closely in performance, given that they're working on a 3 million record file.

\- Other performance stats that could be more relevant (depending on what you're doing with CSV...): startup time, memory footprint, any differences in handling based on very long or very short rows

\- Given similar performance on the above, what's actually more important (for most uses): elegance & consistency of API, support for various CSV formats (e.g., Excel vs. RFC-4180 etc. vs. flexibility for rolling your own format), and sensible error handling options (like: don't blow up if there's one row with a different number of columns).

I've hardly reviewed any of these, so I can't really ompare them usefully, but I've been using the Apache Commons CSV parser 1.0 version recently (finally released after who knows how many years in semi-hibernation!), and it's been pleasant to work with thus far.

<comment><USER3> I agree with much of this, especially api simplicity. I usually reach for openCSV for the same reason.

Definitely applaud the effort, and it would be good to extend the test corpus in terms of record length and escape complexity. I do think 3M records is on the low side. Good to see scale tests for 1OM, 100M, 1BN records too.

<comment><USER2> They're mostly operating on streams, so at some point (based mostly on how GC is managing, I imagine) the speed will be constant per-row regardless of the record count.

</comment></comment></comment><comment><USER4> Jackson has a CSV parser that is not in the list: [https://github.com/FasterXML/jackson-dataformat- csv](https://github.com/FasterXML/jackson-dataformat-csv)

</comment><comment><USER2> Side note: CSV is boring and unsexy as formats go; but it's also dead easy for companies to provide and even automate even with minimal technical staff on hand; this is one of the reasons I'm working with it at the moment ("CSV uploaded via SFTP" is on the list of inaterfaces we support for data integrations).

Think of the character escapes involved in something like XML or even JSON, for example; for CSV you escape _only_ the double-quote, and you escape that by adding a second double quote -- so you don't need to mess with escaping your escape character. The main problem with CSV is more that there are several possible specs for it...

<comment><USER5> There's only one RFC though.

<comment><USER6> RFC 4180: [http://tools.ietf.org/html/rfc4180](http://tools.ietf.org/html/rfc4180)

... which is compatible with the data I used to get out of Lotus-123 (and some other things) back in the 80s.

</comment></comment></comment><comment><USER6> I think they missed this parser: [http://ostermiller.org/utils/CSV.html](http://ostermiller.org/utils/CSV.html)</comment>


The Risk of Weak Online Banking Passwords - <AUTHOR> https://krebsonsecurity.com/2019/08/the-risk-of-weak-online-banking-passwords/ <comment><USER2> I often wonder why not all websites (especially delicate ones like ebanking) do not show the number of failed login attempts since last successful login.

That would raise awareness with users (ok, maybe scare some people) and give me some hints that my account may be under attack...

<comment><USER3> Unless you have a very unique login, you are going to often seen login attempts. Common names such as john, john123, john234, johnq, qjohn will happen more often especially for a big site.

This will probably give rise to support calls to the bank...

<comment><USER4> Then you'll learn that your username is one that's under attack and that it's even more important to have a strong password. Put some useful documentation on the login page that explains it. What's wrong with that?

<comment><USER3> 2FA and be done with it.

<comment><USER5> 2fa is not magical. It makes an attack require more complexity, but it's not an "and be done with it," solution.

<comment><USER6> Have you seen how severely 2FA drops the rate of unauthorized accesses? It's incredible. What have you seen that moves you to hedge on the value of 2FA?

<comment><USER7> For one thing, the SIM swap attack [1]

[1] [https://krebsonsecurity.com/tag/sim- swap/](https://krebsonsecurity.com/tag/sim-swap/)

In general, relying on a second factor whose security practices aren't the best, could actually compromise security compared to having a strong and unique password.

I personally wish that more banks would support 2FA authentication using a username/password in combination witH TLS client side certificates.

<comment><USER8> Requires forcing every PC case and laptop sold to have a slot for smart cards. Otherwise it is too inconvenient.

<comment><USER7> You could just put it in the certificate store on the machine rather than relying on external storage.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> So my understanding is that ultimately the bank is responsible for any loss on my end as a result of someone breaking into my bank account, therefore I don't really care if my banks don't follow best security practices.

I guess it's probably more complicated than that, so perhaps someone more knowledgeable can expand on what I can expect to happen if someone steals money from my bank accounts because of one of the vulnerabilities in the article?

<comment><USER10> > _So my understanding is that ultimately the bank is responsible for any loss > on my end as a result of someone breaking into my bank account, therefore I > don 't really care if my banks don't follow best security practices._

Remember that when you need to take a week off of work to deal with your bank after a breach zeroed your account. Remember that when you can't pay your bills during that time and miss a car/house payment.

<comment><USER11> Seems like another checking account with a month's worth of expenses in it could be a prudent idea.

<comment><USER12> Multiple accounts are a must. If you're smart about it, you also won't set up any kind of electronic transfer between them. Otherwise if one is hijacked the crook could initiate an ACH from the other accounts.

</comment></comment></comment></comment><comment><USER13> > _even if your bank offers multi-factor authentication as part of its login > process_

All of my banks have security questions. This protects me by combining a password with some other passwords that are public information and that I can't change.

<comment><USER14> You by no means have to give your real information.

I recommend using something like Bitwarden's passphrase generator so all your answers are things like `concise myth bird`.

This way they are A: actually secure, and B: easily pronounceable, so that just saying "a bunch of letters and numbers" to a phone tech shouldn't work as I've heard people complain can happen when using normal passwords (e.g., c9b21s1qzs) for these fields.

<comment><USER15> Inaccurate but plausible is the advice I've been given for these. My bank insists on a "memorable name" (was formerly "mother's maiden name" \- I confirmed it didn't have to be accurate), so I use one that was basically picked out of a hat, which has no connection to me or my family.

<comment><USER13> How legal is it to give false information to a bank?

<comment><USER16> > How legal is it to give false information to a bank?

Irrelevant. These are only security questions. They can be anything, and in fact, for most of them they are not supposed to know.

If you are applying for one of their products and you get a form, and THEN you provide false information, it's a different matter.

</comment></comment></comment></comment></comment><comment><USER17> Banks unfortunately often have deplorably backward as well as arbitrary password rules such as: "Your password must not be longer than 8 characters and must not contain any of these characters '@', '&', '/', '('." ...

<comment><USER18> Up until recently, a big Canadian bank only allowed 6 character passwords, and mapped whatever you typed into 6 numbers (e.g. Aa-Dd = 0).

</comment></comment><comment><USER19> I was trying to remember wtf the name of the new MFA standard that Chrome supports was, and it took me 10 minutes of Googling to find it (U2F[1]). If a security nerd can't even remember the name of the thing that's supposed to replace passwords, regular users will never figure it out.

You want to get rid of passwords? Stop allowing users to manage them. Make a browser plug-in support U2F, make it auto-generate passwords for sites, make it manage them internally. When you go to login to Chase, the browser will fill in the login details, after it has verified this is the Actual Real Site and not a phishing site. All access to this auth data will be based on a master password entered into the user's browser at start-up.

To reset an individual site's auth creds, the site can send a re-auth e-mail to the user. When the user clicks through, they can use the site's preferred verification process to show they are the real user. The browser can then generate and save new auth details for the site.

At no time did the user ever enter a password, but strong authentication data is still being managed independently per-site, the user can still reset any given site's auth details, and the user only has to manage one strong password on their client machine at start-up time. They can also use U2F with a second device for MFA.

[1] [https://en.wikipedia.org/wiki/Universal_2nd_Factor](https://en.wikipedia.org/wiki/Universal_2nd_Factor)

<comment><USER20> Or countries could solve the issue for their citizens instead of making everyone invent their own, like Estonia and quite a few other european countries have. By providing a physical card (or SIM) that allows people to log in where they want.

<comment><USER21> Many people will not want "help" from a government to authenticate and logging in to a non-government site.

<comment><USER20> Many people don't like passwords either. The point being that sometimes we have to go with things we don't find perfect, just tremendously better than what we have now.

</comment></comment></comment></comment><comment><USER22> Good thing my bank artificially imposes length restrictions so that my password is exactly between 8-12 characters

<comment><USER4> My favorite is when they truncate it without telling you. It's a better UX though!

<comment><USER23> Mine silently truncates to 8 characters _and_ does a case insensitive comparison. Good thing they have all the liability....

</comment></comment></comment><comment><USER24> Why doesn't Google or Apple have 'explain like I'm 5' explanations of how their password managers work? I don't use either service but this is a MAJOR opportunity to encourage their users to use a password manager and subsequently make their users more secure online.

I'm a big proponent of using a password manager and if I even remotely mention using iCloud Keychain or Google's password manager, people have zero idea what I'm talking about.

<comment> matt-attack I agree. It's odd that an article this technical goes on to recommend (or at least enumerate popular) password managers, but doesn't mention Apple's own KeyChain. It's built into all iPhones and MacOS computers for god's sake.

I personally don't use any 3rd party password managers. I find KeyChain to work amazingly. There's even a FireFox plugin that supports it.

<comment><USER25> A problem is that most users are likely in a mixed computing household, such as using an iPhone and a Windows Desktop. It would be a lot easier to suggest to some of my family, for instance, to use KeyChain if they had a good Windows client. (With the recent modern iCloud update in the Microsoft Store, I could even see this possibly happening, as opposed to the many years where iTunes for Windows was an afterthought.)

</comment></comment></comment><comment><USER26> Honestly I'm more worried about remembering my username...13 digit numeric sequence.

Nice one Mr Bank.

Trying to fight my way back in after emigrating put a lot of worries at ease. Voice printing, secret code words, security questions, 2FA, passwords...omg just let me in.

Nobody's getting in there...I just hope I don't lose access.

</comment><comment><USER27> I have a bank account whose username is a number and password is also a number. Good thing is you need to click on a randomly distributed keypad to input your password. /s

<comment><USER28> Mine too. Which is also my employer (you can find out who that is easily). ¯\\_(ツ)_/¯

Since both number are sent (separately) via physical mail, all you'd have to do to get them would be to wait around in front on the mailbox when the postman come, ask him he's got mail for Mr X, repeat for a few days until you get the monthly report sheet, on this document will be the first number. Now go online, ask for a new password. Wait around the mail box for the new password to arrive. The mailman will just think "oooh Mr X is such a good person, always saying good morning". Chances are the victim doesn't have any alarms set up on their phone. I have alarms set up.

</comment></comment><comment><USER18> I had a colleague who always knew, to the quarter, how long he had been working there. During the quarterly password changes, he'd increment the numbers ;)

</comment><comment><USER29> My bank (BNP) opted to force me to click on big clear text buttons instead of typing my login code. And yes, it's a six digit numeric code. So the username is a clear text field, and you could read my code from 5m away without zooming while I login.

Should I ever get scammed on this account, I'll claim that their security BS must have been the entry and let them try and disprove that.

</comment><comment><USER30> My bank has a "helpful" mobile app secured by a 6 digit code. The worst part is that some sensitive operations like adding an external wire transfer target and changing transfer ceilings can be done from the app and only from the app.

</comment><comment><USER31> I'm still annoyed that one of my banks, only offers 2 factor though email & sms and doesn't offer TOTP. Does anyone know if this is a PCI thing or is it just bureaucracy?

<comment><USER32> I've spent a good bit of time reading PCI requirements and I can't think of anything that'd prevent using TOTP or Yubikey type devices. My guess is that they don't implement it because they don't think anyone would use it. Honestly I can't say they're wrong either—I'd love to use a Yubikey on my bank accounts, but I can't imagine anyone else in my circle of non-programmer friends/family doing so.

<comment><USER33> With WebAuthn it doesn't have to be a USB fob - it can be built into your device too.

</comment></comment></comment><comment><USER34> Chase doesn't allow special chars. Lmao.

</comment><comment><USER35> Not just weak passwords, but reusued ones (which to me is an equal sin)

</comment><comment><USER36> Thank you for the PSA -- I just changed my old insecure password!

</comment><comment><USER37> Then why there is no law for 2FA in the banks? In Turkey all banks must provide 2FA for logins. It is required by law.

<comment><USER38> Krebs has covered this previously; oligopoly service providers.

See his excellent, if depressing, 2018 exploration of banking security, "What Is Your Bank's Security Banking On?".[1] Sadly, the industry is dominated by a small handful of banking platform providers. Four, Fiserv, Jack Henry, FIS, and CSI, serv over 80% of the market. Bank regulators, responding to Krebs, said that "small to mid-sized banks are massively beholden to their platform providers, and many banks simply accept the defaults instead of pushing for stronger alternatives."

This is not a good situation.

Digging further into the matter, I turned up a set of publications by Experian -- the credit rating agency which hasn't been breached ... yet -- on risk and fraud, including credential compromise.[2] One of these mentions in. passing that the typical person has "about 100" service-based accounts.[3] That's not all that far off the count of 700 accounts HN users have reported having.[4]

________________________________

Notes:

1\. [https://krebsonsecurity.com/2018/03/what-is-your-banks- secur...](https://krebsonsecurity.com/2018/03/what-is-your-banks-security- banking-on/) (HN: [https://news.ycombinator.com/item?id=20203482](https://news.ycombinator.com/item?id=20203482))

2\. Stealthily hidden around Experian's website, though this search presently lists several of the beter ones: [https://www.experian.com/innovation/thought- leadership/fraud...](https://www.experian.com/innovation/thought- leadership/fraud..). ([https://web.archive.org/web/*/https://www.experian.com/innov...](https://web.archive.org/web/*/https://www.experian.com/innov...))

3\. "Upcoming fraud trends and how to combat them: Ebook" [https://www.experian.com/innovation/thought- leadership/upcom...](https://www.experian.com/innovation/thought- leadership/upcom..).

4\. packet_nerd reports that here, though I recall an earlier mention as well: [https://news.ycombinator.com/item?id=19488899](https://news.ycombinator.com/item?id=19488899)</comment></comment>


TechCrunch stores user passwords in plain text - <AUTHOR> I tried to signup for TechCrunch Disrupt to pitch our VC funded predictive analytics platform that uses heuristics and ML to find what is driving users to convert and identifies potential changes you can make to your website to drive conversion growth and got a very silly SQL error that showed them inserting my password in plain text!<p>(error code 22001) SQLSTATE[22001]: [Microsoft][ODBC Driver 13 for SQL Server][SQL Server]String or binary data would be truncated. (SQL: insert into [battle_users] ([userEmail], [userPassword], [activationCode], [isFastTrack], [event_id]) values (email@example.com, aQojvBPZK9ZXcJw49dK{oeF6GRDm4E)(T4XMQrCN]c,$Vj86470V242wu&mbsCf*;L2Q, 0, 138, ?))<p>Simply enter a long password on https://battlefieldaustralia.techcrunch.com/auth/register to receive the error yourself <comment><USER2> Damn, that seems pretty bad. That said, could this be a problem with the Startup Battlefield mini site or do you think it's common practice across TechCrunch as a whole?

Part of me cynically thinks the latter, but another part of me thinks a lazy developer could have taken shortcuts with what they saw as a less important part of the site. Either way, it's bad news and I hope they address it soon.

<comment><AUTHOR> I'm a big subscriber to broken windows theory; leaking raw errors and plain text passwords makes me think it's likely common practice...

I've reached out to them so hopefully they can get this sorted!

<comment><USER3> I tried it. It's still not fixed. This is incredibly dangerous.

I think that for all 'non-essential' sites it might be prudent to use a throwaway password each time. I think it might be an all too common practice on many a site.

<comment><USER2> I try and use separate passwords on every site, essential or not. That way if something like this happens it isn't really much of a big deal.

After all, who can ever know that even a large site like Facebook or Twitter or Google or Hacker News is storing your password securely? You usually can't, so you may as well be cautious and not reuse passwords for any service.

</comment></comment></comment></comment><comment><USER4> More accurate / precise headline: _TechCrunch Startup Battlefield Australia site stores user passwords in plaintext_

At the bottom it says "Powered by Trackiva" which looks to be a splash page service.

> Trackiva is the platform that powers the famous TechCrunch Battlefield > application selection process.

So really it sounds like this splash page service, which looks to be relatively unknown in Google is insecure, making (at least) some of the OWASP Top 10 vulnerabilities.

Apparently the app is made by this company Fardini Media ([https://www.fardinimedia.com/](https://www.fardinimedia.com/)). Hopefully they'll find this thread from a Google Alert or something and fix it.

</comment><comment><USER5> This website hasn't been updated in a while. [http://plaintextoffenders.com/](http://plaintextoffenders.com/) Scary how many websites still do that.

A website I would've never expected it was [https://www.pm.org/](https://www.pm.org/), a community website for Perl developers run by ... well Perl developers. [https://what.thedailywtf.com/topic/1874/perl- mongers/5](https://what.thedailywtf.com/topic/1874/perl-mongers/5)</comment>


Microsoft Patents GPU-Accelerated Video Encoding - <AUTHOR> http://www.conceivablytech.com/3421/business/microsoft-patents-gpu-accelerated-video-encoding/

<comment><USER2> How can this be worthy of a patent? This has been _the_ example of GPGPU from day one. It is not even a technological invention, it is an application of existing technology. It is like IBM patenting "using a computer for business administration" or a kid patenting "swinging sideways on a child's swing" (that last one is actually not made up: see [http://www.newscientist.com/article/dn2178-boy-takes- swing-a...](http://www.newscientist.com/article/dn2178-boy-takes-swing-at-us- patents.html))

update: I just noticed that the New Scientist article actually refers to a patent for "a system that issues reservations for using the toilet on an aeroplane", issued to four IBM developers. How ironic :P

<comment><USER3> _It is not even a technological invention, it is an application of existing technology._

Can you cite an example of an invention which was not an application of existing technology?

<comment><USER2> Do you want to get into a philosophical discussion on what constitutes technology? :P

I believe patents should be used to protect inventions of new technology (e.g. things like light bulbs, telephones (ouch) or cars), not "methods for illuminating the workplace", "methods for notifying people of cancelled appointments" or "ways to transport oneself from home to work".

<comment><USER3> _Do you want to get into a philosophical discussion on what constitutes technology?_

No. My question was unambiguous.

</comment></comment></comment></comment><comment><USER4> Just as a side comment, x264 using one of its faster speed presets is both faster and a better compressor (sometimes at the same time!) than any GPU- accelerated encoder I know of. Attempts to port part of it to GPGPU are welcome, if they're faster and not worse, but so far 5+ attempts at it seem to have failed.

Luckily, the concept of CPU-accelerated video encoding is not patented.

<comment><USER5> It will be interesting to compare x264 against Sandy Bridge's GPU encoder; they added a scoreboard to accelerate wavefront-parallel motion estimation (AFAIK this has been problematic for previous GPU encoders).

</comment></comment><comment><USER6> I'm not sure this patent is very strong. Anybody who did motion estimation on video frames prior to the 2004 filing and did it with a co-processor could probably claim to be prior art on the idea of GPU accelerated motion estimation. The independent claims are quite wordy. This makes me think they were probably made to put in specific claim details that weaken the patent by making it narrower.

</comment><comment><USER7> I am not an expert at reading patents so correct me if I am wrong. From what I understood it only appears to cover encoding accelerated using graphics APIs. If you are not using the texture unit for performing loads and your data is not stored as textures on the GPU (and you dont really need it for CUDA programs), then the patent does not seem to apply.

As a sidenote, the article linked here gets some basic details wrong ("CUDA was launched in 2008", it was launched earlier than that).

</comment><comment><USER8> Also they have a patent on 2 pass LZ compression. Insane.

</comment><comment><USER9> I think at a bare minimum any patent that feels like it's just been a race to file a patent shouldn't be granted.

<comment><USER10> That's why you have a team of patent lawyers spend a week taking the engineer's specs and extending it into a 50+ page document.</comment></comment>


The Man Who Had HIV And Now Does Not - <AUTHOR> http://nymag.com/print/?/health/features/aids-cure-2011-6/

<comment><USER2> Remember the 911 logs released by Wikileaks and all the AIDS medication alerts; time to take your medicine? Hope one day there is a cure, but until then, I am glad we live in a society that fights to see these thing gone.</comment>