German Army buys 31% fewer helicopters to save 2.2% - <AUTHOR> http://translate.google.com/translate?sl=de&tl=en&js=n&prev=_t&hl=de&ie=UTF-8&u=http%3A%2F%2Fwww.tagesschau.de%2Finland%2Fhelikopter110.html

<comment><USER2> This is reversed causality according to a friend of mine who is involved in this. The helicopters got 13 million € more expensive, thus the order was reduced.

<comment><USER3> If confirmed, this would change everything about the sense of the deal...

</comment></comment><comment><USER4> Economies of scale work both ways. If the infrastructure that you need for 100 widgets will get you to 200 widgets with only a little additional work, then don't be surprised when downsizing from 200 to 100 only saves you a little on infrastructure.

</comment><comment><USER5> It's a common problem in defense, especially in the last 20 years. As budgets continue to shrink, countries are under pressure to cut the number of units purchased, which increases the per-unit price (design and development, being fixed costs, have to be spread amongst a smaller number of units.)

For new designs coming about after '91, it's even harder as the design work is being done at the same time. With systems like the F-35, LCS, AAAV, NH90, and others, the money is shrinking even as development is taking place, and the spiraling costs of systems that "can do everything" in an environment where no one can assume was the nature of the next generation of threats will be has made procurement something of a disaster.

The last element is national. European nations are reluctant, no matter how much money it may save, to completely forgo their national defense industries in favor of larger conglomerates or the U.S. There are many areas of overlap where there is already a better, proven alternative in the market (Airbus A400M could be served by the C-17, NH90 can be handled by the SH60 series, Nimrod MRA4 by the P-8. I note all of the alternatives in favor of U.S. kit, but there are older examples of this happening in the other direction)

<comment><USER6> there's one great read that discribes the fundamental flaws of defense procurement pretty well ([http://pogoarchives.org/labyrinth/full-labyrinth- text-w-cove...](http://pogoarchives.org/labyrinth/full-labyrinth-text-w- covers.pdf)).

Mainly geared towards the US, but the basics works for Germany, too. As far as the procurment of the NH90 and Tiger is concerned, there are more flaws in the specification, design and program that fit in a book. Everybody aims at a silver bullet solution only to end up with a one made of lead for the price of a golden one.

One point that dtruck me most when I was still part of the "system" was the shere amount of spec and design changes that happened AFTER development was finished. the solution is called Retrofit. That and the important difference of a design to be able to perform a certain task and a design being allowed to perform it by the german army.

One example is the NH90 not able to transport troops with combat gear (German army view pint) and the NH90 being suvvessfully used to airlift troop over half of Finland. Another one would be the Eurofighter being unable to perform ground support operations in the german air force and the very same plane doing just that for the british.

And the A400M would be apretty good plane hadn't politians insisted on a new prop engine built by a paneuropean consortium that did that for the very first time. That other planes would be just as good, agree. Even i would have rather opted for the Antonov An70 :-)

What really sad about the NH90 is the wasted potential. Considering the age of the Blackhawks, the potential market is HUGE. The situation being what it is, this ain't gone happen. But that's a point the NH90 has in common with the F-35, doesn't it?

<comment><USER5> Thanks for the document. I've only started reading it, but it looks rather good. (I'm astonished and thrilled that in the essays, the authors cite their sources.) Good find. =)

</comment></comment></comment><comment><USER7> What about maintenance and personnel? Are those included in the price? If not, maybe there are 2nd order savings we don't see...

</comment><comment><USER8> How much does helicopter upkeep cost? What are the intangible benefits to having "buy what you expect to need" instilled as a value throughout a massive organization?

<comment><USER9> Helicopter maintenance is expensive, and training mechanics and repair technicians is also expensive.

Not having a spare machine when you really need it is expensive, too.

And on the gripping hand, how many wars is Germany planning to fight with helicopters in significant roles?

<comment><USER10> Transport helicopters are a _sine qua non_ of a modern military, and combat ones are really, really handy.

Turn the question around: can you imagine _any_ deployment of the _Bundeswehr_ where they wouldn't need transport helicopters (the NH90 mentioned in the article)?

This most particularly includes humanitarian missions, e.g. the usual suspects ridiculed the US for sending a carrier battle group to help survivors of the 2004 Indian Ocean earthquake and tsunami, not realizing they have both "nuclear powered" fresh water distillers and lots of helicopters that can transport water, food etc. (ADDED: [http://en.wikipedia.org/wiki/Humanitarian_response_to_the_20...](http://en.wikipedia.org/wiki/Humanitarian_response_to_the_2004_Indian_Ocean_earthquake#Americas) says a total of 48 helicopters were involved in our military relief effort, of course from many ships.)

</comment></comment></comment><comment><USER11> wow, google translate really worked pretty well on this article. If this continues improving, it will be an awesome technology soon.

<comment><USER12> Google translate works well when the text is grammatically correct, when running it across comments where people use slang it doesn't work all that well (obviously).

It's the future where I can translate an article written by someone in another language on another continent into (semi)-readable text in my own language.

<comment><USER13> Your sentence is perfectly correct, but its translation in french (by google translate) is far from perfect. The translation toward english is generally not so bad, but for me, google translate is still very poor.

<comment><USER14> I think it depends largely on the source and target languages and how similar they are (in what ways I couldn't say with real certainty). Japanese -> English translations are pretty much always hilariously bad, but then we get at least some very good German -> English instances like this. Without unprecedented advancements I doubt automated translation between two highly disparate language families will be consistently usable any time soon.

<comment><USER15> Google Translations gets most of it's source data from the regulatory documents of the European Union which are required to be translated into the language of every member.

Perhaps if we were to get a similar source for Japanase -> English translations the accuracy would improve drastically.

</comment></comment></comment></comment></comment><comment><USER16> Okay is it just me or does the Defence Minister look like a bobblehead doll in that pic?</comment>


Patreon suspended my account. They have not notified me - <AUTHOR> https://twitter.com/Scott_Helme/status/1077254028453654529 <comment><USER2> Patreon has been on a spree to ban people that think the wrong way.

Matt Christiansen had a call [1] with Patreon to discuss their banning of Sargon of Akkad. Sargon was notified of the banning by his patrons, not Patreon, and had no recourse to challenge the decision. In the call Patreon made it clear that their platform is;

1) explicitly anti free-speech

2) is not a free market (they can ban you for arbitrary reasons, for things posted anywhere including leaked private messages)

3) their rules are enforced in a subjective manner by design

Considering that they have banned many people that disagree with progressive PC ideology, which seems to be a moving target of increasing religious [2] fervor, I can't see why anyone would trust their platform at this point and rely on it to build their income.

Even progressives might like the so-called TERFs fall on the wrong side of the party-line at some point, so I can't see how anyone can trust their platform as a source of income. Unless you of cause love staking your income on the arbitrary whims of the ideologues at Patreon.

[1] [https://www.youtube.com/watch?v=Hv7hvZee- PQ&feature=youtu.be](https://www.youtube.com/watch?v=Hv7hvZee- PQ&feature=youtu.be)

[2] [https://areomagazine.com/2018/12/18/postmodern-religion- and-...](https://areomagazine.com/2018/12/18/postmodern-religion-and-the- faith-of-social-justice/)

<comment><USER3> Although Patreon is an excessively scummy company, there is some evidence that some of these bans were forced by Mastercard and Visa.

<comment><USER4> There is speculation that Mastercard may have put some pressure on them

I have seen zero actual evidence for MasterCard, and no speculation for Visa, so I would love to see citation for your evidence?

There was Speculation for MC in the JihadWatch banning, but MC has publicly said they were not behind it I believe.

PayPal on the other hand probably is, PayPal has been on a moral Authoritarian left war for over a decade now

<comment><USER2> See the transcript of Matts conversation with Patreon [1]. They said this was entirely their decision, and they did it because they didn't like Sargons brand whatever that means.

[1] [https://docs.google.com/document/d/1U0mQjUA0T5INc_GDkwPJ2mfh...](https://docs.google.com/document/d/1U0mQjUA0T5INc_GDkwPJ2mfhO7tbaIogisSqqxHw0hc/edit)

</comment></comment></comment></comment><comment><USER5> The whole backlash against Patreon didn't start now as they've done stuff like what that person on Twitter complains about but it culminated in the strange circumstances involving the banning of one Carl Benjamin, aka. Sargon of Akkad. People are upset about this, even outside of politics not because they support or even agree with Carl Benjamin but because of what Patreon did, and still does.

They banned the guy over a 10 month old livestream on an obscure channel where he criticised the alt-right using their own vernacular. If you ignore context, then sure, it is "hate-speech". The issue here is, however, that Patreon explicitly said that they only enforce their policies on their own platform in their terms. (Jack Conte said the same thing, explicitly on a podcast.) And yet, they suspended a creator, without warning and shoddily still allowed new people to pledge money to him. For other creators this does shows that their livelihoods can be shut down any time, any moment, for any reason, on a whim of someone on that "Trust & Safety Council".

Let us not mention the blatant hate-speech they allow _ON THEIR OWN PLATFORM_, even among their top 20 creators.

If you entrust your livelihood to a platform, you want someone neutral and someone who takes the time to notify you about changes related to your income, even if it's via automated messages.

</comment><comment><USER6> It's possible this is an account suspension (i.e. "We don't want you to have an account anymore because you do XYZ"), but it looks more like a fraud / financial flag (i.e. "We think someone has broken into your account and we're holding your funds temporarily.") As evidence, they still contact him about new subscribers and his page is still online, which it isn't in other cases when Patreon suspends an account.

Still an indictment of their communications process, and still a financial risk to the person, but it's a little odd that literally all the replies in that Twitter thread are people talking about Milo Yiannopoulous. Even if Patreon decided it wanted to go all in on hosting controversial political figures, they'd presumably still have some kind of fraud checks, so the points really do seem to be unrelated.

<comment><USER7> If that flag can suspend his account, it can send him a message.

</comment></comment><comment><USER8> This same story played out 10 or so years ago with Wikileaks, PayPal, and major card processors and banks.

The sad realization was that private companies can control who gets to speak very effectively.

Lots of people hoped cryptocurrency would fix this, but so far it hasn't.

<comment><USER9> In technological terms, cryptocurrencies really have fixede this. However, the adoption is lacking behind somewhat. However, the few creators that do use cryptocurrency (even just in a rudimentary way of putting a bitcoin address in a video) - have gained from this.

<comment><USER10> It really didn't.

Bitcoins ledger is public, marking every transaction from who to whom the money went. Yes, it's originally only the wallet id that is public, but this id only needs to be matched once to a person...

And don't even start with exchanges. They have exactly the same problem as any private entity such as PayPal or patreon has

<comment><USER9> Couldn't one simply use the other currencies where ledger is not public, if the privacy is needed? Like Zcash, Dash or Monero (no affiliation, I'm just listing options to clearly show that public ledger is in technological sense not a problem).

I think that many of these problems stem from censorship, not need of privacy.

<comment><USER11> You can't for a simple reason: to use them you need a combination of hw, sw and connectivity that's largely proprietary and can't be considered safe...

You may trust your FOSS-only OS, your FOSS "wallet", but how you can trust your hw? How easy a country can look out citizens from internet services?

Mesh network and open hardware exists but mostly at a marginal and embryonic stage...

</comment></comment></comment></comment></comment><comment><USER12> Patreon sounds like something relatively easy to replicate. Effectively every utility implements what patron provides. It's essentially just scheduling recurring payments, with a discussion forum attached. More behavior like what we've been seeing Patreon do lately, and I can see larger creators shifting to hosing their own patronage services. Essentially the same reason why EA, Blizzard, and even more niche game publishers like Matrix Games, Slithrine, and X Plane host their own game purchasing and delivery services: greater control and no cut taken away.

Perhaps a more feasible and maybe probable approach is for another service like WordPress or SquareSpace to offer patronage functionality (as in, offering recurring payments and exclusive contents for patrons).

<comment><USER13> The most bizarre part, to me, is that it feels like this should just be a part of modern banking.

"Hey if you like my stuff consider adding my <public bank account key> to your monthly payments.

I guess Patreon provides a walled garden of premium content for patrons, but I'm skeptical that's universally desired by creators. The few I know don't do any of that.

<comment><USER12> I think the core of Patreon's value is tying the payment to exclusive contents and access to patrons-only forums. That's why I think WordPress or SquareSpace would be suited to capturing Patreon's market. Creators can already create web stores in SquareSpace, it shouldn't be too much work on top of it to create recurring payments. It'd be more work, though, to wall off certain portions of the site to different payment schedules. And that's the real value.

One thing that Patreon does have that would be harder to recreate is the gamification of patronage. Like comparing subscriber counts on YouTube, Patreon makes it easy to compare different creators' Patreon income which I think serves as a rough estimate of clout.

<comment><USER13> Do they? I thought income went private some time in 2018. I did use to enjoy looking at my favourite creators to see that indeed they were getting paid enough.

<comment><USER12> It's configurable by the user: [https://support.patreon.com/hc/en- us/articles/115000392243-H...](https://support.patreon.com/hc/en- us/articles/115000392243-How-do-I-change-my-earnings-visibility-)

</comment></comment></comment></comment></comment><comment><USER14> Being someone who pays ~zero attention to Twitter, and very little to "politics", I had no clue that there was a shitstorm happening over "censorship" by Patreon. (Although I think that it probably _is_ censorship, I'm not sure, so scare quotes.)

Anyway, so searx.me shows me a NY Times article from today.[0] And it contains these ironic bits:

> Patreon takes a highly personal approach to policing speech. While Google > and Facebook use algorithms as a first line of defense for questionable > content, Patreon has human moderators. _They give warnings and reach out to > talk to offenders, presenting options for "education" and "reform."_ Some > activists hope this will become a model for a better and kinder internet. > [emphasis added]

> _"There are no automated takedowns," Mr. Conte said._ "As a creator myself > dealing with these big tech platforms and getting an automated takedown > notice, there's no appeals process. You can't talk to a human. And I never > want to do that." [emphasis added]

Funny, that.

Edit: And if this is truly a " fraud / financial flag", wouldn't one expect to see the same level of outreach?

0) [https://www.nytimes.com/2018/12/24/technology/patreon- hate-s...](https://www.nytimes.com/2018/12/24/technology/patreon-hate-speech- bans.html)

<comment><USER11> A small note: how can ever a private company claim the right to decide about "hate speech", "illegal contents" etc? If they have _suspects_ they have to go knock the police/other public authority door to _signal_ what they suspect and after comply to the _public authority_ decision.

Nowadays to many people do not comprehend really this _super-important_ concept... And many countries try to take advantage of it pushing private power.

<comment><USER15> "Hate speech" doesn't have a legal definition in the United States that I am aware of. If it does, it's still covered by the first amendment and legal. So its not a question of Patreon determining what is legal, they're determining what is acceptable to them.

<comment><USER7> > "Hate speech" doesn't have a legal definition in the United States that I am > aware of.

Then fix that, instead of using it as a loophole to ruin the web, and then still not having fixed that.

<comment><USER16> Either one of defining hate speech at the federal level or preventing businesses from enforcing their own hate speech policies would require a constitutional amendment in the us.

I highly doubt such an amendment could ever get popular or political support.

<comment><USER17> Seems like policing speech is a bad precedent to set, and even if you don't think it's a slippery slope, how do we make sure the government's definition of the phrase is/remains reasonable? Ideally the extreme left wing will be marginalized (i.e., no more dominating universities and newsrooms or tech companies) just like we marginalized right wing extremists.

<comment><USER16> Part of the problem may be that you're off the opinion that tech companies are the extreme left.

I've met people on the extreme left, they're not average Facebook or Google employees. No one on mainstream TV is "extreme" left. You have to get to theyoungturks or chapotraphouse. (And these are marginalized, given that you've probable maybe heard of Cenk and TYT, but CTH is a podcast and subreddit and nothing else).

If your ideal is that the US's center left (which is globally center or center right) is considered the extreme left and marginalized, your personal overton window is so far to the right that you probably shouldn't be making these decisions. And as you say, the government probably shouldn't be either, it would allow a government that believed that CNN was far left to censor it.

<comment><USER17> Let me set the record straight so you don't have to guess about whether I'm conflating far left and center left:

1\. I'm a moderate liberal by every measure.

2\. I don't view CNN as far left; while it is shamefully partisan, no more so than Fox News.

3\. I don't want the government to censor anyone, I'm more or less a free speech absolutist.

4\. I don't think tech companies in general are far-left; only that a handful appear to contain a sufficiently powerful contingent of far left ideologues who feel comfortable using their company to suppress dissent (social media platforms censoring moderate liberal and conservative viewpoints, Google firing Damore under patently false pretenses, Mozilla pushing out Eich, etc).

<comment><USER11> A small intervention: to my (western) European eyes saying that CNN is far left or even saying that far left exists in the USA is a fascist affirmation...

That's to add a different "relative" measure.

Apart of that far left and far right are essentially the SAME, their "lower labor force" are fanatic people used as a weapon/Ford models workers by the very same "sponsors" who want dictatorship instead of free society.

If you read about or know someone who have visited both Franco's Spain and Chernenko's Soviet Union you will see that they are _equally_ oppressive and use essentially the very same language, only with a little color variation in flags.

Do not forget that Lenin was massively financed by Kaiser's Germany, Stalin by UK crown etc just to stop socialism transforming it in a dictatorial regime with same symbols, not different by the hitler financing by German élites against socialism in Germany, mussolini financed by UK crown against a socialist Italy etc.

"left" is socialism, "center" is liberalism, the rest are only a grayscale of dictatorship movements disguised in various ways.

<comment><USER17> Yes, these political descriptors have different meanings in the US compared to Europe.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> With modern "web platforms" we are not customers but only lemons to be juiced and dropped, puppets, slaves. Nothing more.

Now think REALLY well about our future, especially imaging at actual trend a future with a banking system lead by big of IT instead of banks and of course usable only via proprietary services.

Think about the past when we have bankbooks with any transaction written and signed by the bank in _our_ hand vs today when we only have to relay on bank's servers itself. Think about how you can pay with physical money and how you need to pay with electronic one, especially observe the hard dependencies that both systems have.

Add to the soup the fact that power corrupt and interdependence force cooperation instead of wars.

Add to the soup the fact that in the past knowledge generally used to be in universities, so in public hand while now it's mostly in super-big-corps secret hands.

Add to the soup the fact that when we totally depend on something, including basic things like food supply/production/distribution there is no need of strong power to create a dictatorship simply because people can't live without the product of de-facto "dictator"...

</comment><comment><USER18> GoFundMe also suspended my account this way in the past. No response or explanation for more than 6 months.

</comment><comment><USER19> I'm not going to focus on the free speech part of this, or even the purpose of art. It's gotten to the point that watching well-funded companies go down this road is just painful. All of that money and education. Such idiots. I'm embarrassed to be part of the same tech community with them. Go buy a copy of On Liberty and take a time-out until you grok it. (Rawls can wait until later)

Instead, I'm curious as to a few other things.

1\. This looks prima facia like fraud. You say one thing, the TOS says one thing, you do another -- and you take money while acting that way. If that's not fraud, I don't understand the term.

2\. As I noted in a recent essay, the way that software generalizes communication, combined with a system/platform that has massive adoption, always leads to a bad place even when this has nothing to do with politics or content. Even if we get past the speech and fraud part of the problem, we still have a huge problem. [http://tiny-giant- books.com/1.html?EntryId=recEUbufzhAvph8K1](http://tiny-giant- books.com/1.html?EntryId=recEUbufzhAvph8K1)

3\. Are we a bulletin board or a publisher? I understand these companies want to take both stances simultaneously, and that the law allows this, but heck if it makes any sense to me how it's going to work out well. Yes, it's legal, but that doesn't make it any more tenable. Algorithms don't amount to magic sauce, no matter how much you wave your hands around.

4\. We are in need of anti-trust legislation when it comes to the _marketplace of ideas_. On the net, either there is no such thing as a public square or some legislative intervention is required. I don't think arguing that there's no such thing as a public square works for rational observers of the marketplace. Sounded pretty cool ten years ago, sure. And perhaps most of the public might still buy it. But its days are numbered.

Interesting place we have ended up. I note that "interesting" can have terrible connotations.

</comment><comment><USER20> Opinion: first big enough country that will force neutrality of payment processors will get all content creators, startups and the trillions in sound money and cultural value that come with them

</comment><comment><USER21> Trying hard to emulate PayPal behaviour :/

</comment><comment><USER22> I'm unclear whether this is due to an account being suspended, or an account on hold due to some kind of fraud detection.

I'd say the one clear indictment here is Patreon's absolute shit communications. Traditional companies have a phone number you can call to talk to a human and sort everything out, but that seems to have gone the way of the Dodo, replaced with a way less effective but cheaper solution.

</comment><comment><USER14> HN may have come to the rescue again. OP got his account restored on the 24th at 4:48 PM PST:

[https://pbs.twimg.com/media/DvQ75bUX4AMLblW.jpg:large](https://pbs.twimg.com/media/DvQ75bUX4AMLblW.jpg:large)

</comment><comment><USER23> Apparently J. Peterson is building something to solve this problem.

[https://m.youtube.com/watch?v=GWz1RDVoqw4](https://m.youtube.com/watch?v=GWz1RDVoqw4)

I wonder how they handle the payment part.

<comment><USER7> It's a video with the summary of discussion between a lot of people who are unhappy with Patreon and are looking for alternatives, from 9 days ago -- how is that not relevant?

And why are we not busy talking about and making alternatives, rather than downvoting an example of what _should_ be going on here?

</comment></comment><comment><USER24> Like someone else suggested, this is likely a case of automated flagging by fraud detection systems, but it does not excuse such terrible communication on Patreon's part.

I have been following the recent Patreon backlash with interest, which I think was triggered by Patreon banning a youtuber who goes by Sargon of Akkad for using the phrase "white [n-word]" in a youtube video. Sam Harris, who was one of the highest earning people n Patreon, closed his patreon account and explained why he did so [0]. Jordan Peterson and Dave Rubin (popular internet personalities who spoke out against Patreon's trust and safety policies) are planning on launching an alternative [1] to Patreon that is more pro free speech. It would be interesting to see if they manage to build a free speech alternative since the problem usually is that the worst elements on the internet flock to it before regular people and the site/service will be labeled a hub for nazis/white supremacists and no bank/financial institution will want to do business with such a service. It also sounds like companies such as Stripe and Paypal can do little even if they wanted to support a free speech alternative to Patreon, since that would cause issues with their payment networks.

I am interested in learning a little about how the financial infrastructure works (banks, payment processors, regulations), who decides what types of service should not be allowed even if it's legal and what it would take to build a free speech alternative to Patreon, so if there are some good resources that you know about, please share them in the comments.

[0] [https://twitter.com/SamHarrisOrg?ref_src=twsrc%5Egoogle%7Ctw...](https://twitter.com/SamHarrisOrg?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Eauthor)

[1] [https://twitter.com/jordanbpeterson/status/10772442911251742...](https://twitter.com/jordanbpeterson/status/1077244291125174275)

<comment><USER9> But notifying the owner is not a part of automated flagging? How hard is it to make it send out a short e-mail? This is basically very bad care and support for clients, however one spins it.

</comment></comment><comment><USER14> I wonder if anyone relevant at Patreon reads HN.

<comment><USER25> You'd think someone at Patreon would know someone who reads HN.

</comment></comment><comment><USER26> Patreon is very likely on mandatory US Holiday today. By the time they read this thread on Wednesday, it will be far too late for them to fend off the mob. They deserve one business day to reply, and they won't have had that until Wednesday at the _earliest_. Be kind.

EDIT: If your reply is "they should reply 24/7/365", ask yourself whether it makes financial sense to staff a support team on Christmas at triple-overtime pay; notice that essentially all US businesses do not staff support on Christmas; and then reconsider your reply.

<comment><USER27> I get your point that most businesses are closed but I didn't know it was mandatory or required triple pay. Is that true?

Disneyland is open on Christmas. Most movie theaters are open on Christmas. I think most convenience stores, many groceries stores, and most gas stations are open on Christmas.

<comment><USER28> It seems OP also missed this gem:

> This suspension came between 18 and 47 days ago based on my missed payouts. > No review has taken place in that time...

Patreon has had weeks to do this review, yet they haven't communicated or done anything.

<comment><USER14> True. But he just tweeted today, and it quickly hit HN front page.

<comment><USER29> I agree with your basic point about not grabbing the pitchforks out just yet, but wouldn't it be nice if online businesses had to be accountable in a reasonable timeframe to all of their customers (especially when it comes to handling money that is due to the customer) and not just people who happen to have large twitter followings?

<comment><USER14> Well, I actually would expect someone to be checking Twitter and HN ;)

But maybe they've given up paying attention, given the other stuff going on. Or maybe overwhelmed and frustrated.</comment></comment></comment></comment></comment></comment>


Why the new Macbook charger is a serious downgrade - <AUTHOR> https://vine.co/v/b9vUz5r32ti?fb_action_ids=10152848655290521&fb_action_types=vine-app%3Apost&fb_source=aggregation&fb_aggregation_id=288381481237582

<comment><USER2> I thought the old charger connector was very prone to being twisted and breaking?

I had two of my old chargers that broke. I've also never had an issue with the new charger disconnecting during that last month with my new Macbook Air.

</comment><comment><USER3> The new design is clearly just to accommodate the thinner profile of the rMBP. I guess Apple figured that the space savings was worth having a noticeably shittier connector latch; I think they're wrong.

</comment><comment><USER4> I never use my laptop on my legs while plugged in. That's what the battery is for, and if it runs out of juice then I know I've been sat in the same position for _way_ too long.

</comment><comment><USER5> And soon you will go to apple and complain about your battery life... It's going to be pretty clear what caused it...

I do agree it's annoying, my solution is to use large kitchen tray so that the whole computer and it's surrounding is protected from my knees. There are also easy to buy lap-desks (ikea has something), beanie bag underneath and flat plastic top.

</comment><comment><USER6> IMHO charger on my late 2011 Macbook pro is a better design and i'm not sure why they moved away from it. Without getting into the discussion of the plug face changing, this one does come undone way too easily.

<comment><USER7> Wasn't that the problem? I've never owned a Mac so I don't know, but I thought they changed it because the other plug was too secure, and people tended to pull their laptops off of tables when they tripped on the cord. I'd rather have to plug the charger in more often than have a broken laptop any day.

<comment><USER8> I thought they changed the plug because the old plug was too thick for the design of the Retina MPBs. If you have an old power adapter can compare it to the thickness of the Retina MBP you can see they'd have had to make the Retina MBP thicker or else have it not taper where the power supply meets the body.

<http://www.flickr.com/photos/greggman/8760819957/>

</comment></comment></comment><comment><USER9> Same issue with 3.5mm jacks :(

</comment><comment><USER10> first world problems. in all seriousness</comment>


Visual6502 Remix - <AUTHOR> https://floooh.github.io/visual6502remix/ <comment><USER2> For those interested in the 6502, Ben Eater is starting a new YouTube series in which he builds a computer around a 6502 chip.

[https://eater.net/6502](https://eater.net/6502)

<comment><USER3> An up-scaled replica of the 6502 with a lot of LEDs to visualize the state of the processor while it works:

[https://monster6502.com/](https://monster6502.com/)

<comment><USER4> Love it. Would be willing to purchase one of these to use as a teaching tool.

</comment></comment></comment><comment><USER5> The author of this also created the excellent Sokol cross-platform graphics/sound library, which is being used here.

[https://github.com/floooh/sokol](https://github.com/floooh/sokol)

<comment><USER6> Thank you for posting this. sokol_gfx.h looks really handy!

</comment></comment><comment><USER7> Really great performance, buttery-smooth. Excellent job!

Looking at the 6502, I've got to wonder if today's most powerful Place 'n Route tools could make any significant improvement to it.

<comment><USER8> Going the other way: [https://c74project.com/](https://c74project.com/) or even [https://monster6502.com/](https://monster6502.com/)

Edit: Western Design Center manufactures a pin-compatible DIP-packaged 6502. [https://www.mouser.com/ProductDetail/Western-Design- Center-W...](https://www.mouser.com/ProductDetail/Western-Design-Center- WDC/W65C02S6TPG-14/?qs=sGAEpiMZZMvu0Nwh4cA1wSNu7hWmGrIdvYIw7nZ2DMI=) I couldn't find any pictures or info about what's inside though.

<comment><USER9> I wish they'd release the monster6502 as a kit or at least release the brd files so others can make/improve on it.

<comment><USER10> With 4,769 surface-mount components and somewhere on the order of 16,000 solder joints, it's well outside the realm of what you can assemble at home.

<comment><USER11> IDK, it's meticulous work I'll give it that, but more impressive computers have been built component by component. Just take your time, test each piece as you go, and don't develop an ego and you'll be fine.

</comment></comment></comment></comment></comment><comment><USER12> Can someone explain what we're looking at?

<comment><USER13> The MOS 6502 [0] was an 8-bit CPU that powered many systems from the 70's and 80's, including the Atari game consoles, Commodore 64, Nintendo Entertainment System, and early Apple computers. It could also be considered the ancestor of the ARM architecture.

Visual 6502 [1] is a transistor-level simulation of the 6502, written in JavaScript. It allows you to investigate how the real hardware behaves in response to some input, and it makes it possible to investigate the circuitry responsible for this behavior. It has proven an invaluable resource in recent years for developers and emulator authors to nail down and document all the weird quirks of their 6502-based hardware. The simulator core is also very useful for modeling other 80's hardware, such as the NES's video and audio systems.

Looking at this project's GitHub [2], it appears this is a rewrite of Visual 6502 that compiles into WebAssembly, resulting in _vastly_ improved performance compared to the original JS implementation.

[0]: [https://en.wikipedia.org/wiki/MOS_Technology_6502](https://en.wikipedia.org/wiki/MOS_Technology_6502)

[1]: [http://www.visual6502.org/JSSim/index.html](http://www.visual6502.org/JSSim/index.html)

[2]:[https://github.com/floooh/v6502r](https://github.com/floooh/v6502r)

<comment><USER14> TBH, the main factor for the smoother performance is that rendering the chip visualization is handled very differently than the original visual6502.org. Instead of using 2D canvas, the "remix" uses WebGL and offline-precomputed static vertex buffers.

The actual simulation is most likely also faster than the original JS implementation, but I haven't measured that. This is done by [https://github.com/mist64/perfect6502](https://github.com/mist64/perfect6502), which is a rewrite of the original JS simulation code to C. but there's only at most one CPU half-cycle running per 60Hz frame, so the actual CPU performance for the simulation is hard to compare with visual6502.org which I think is running "unthrottled".

</comment></comment></comment><comment><USER15> Off topic: can already assembled 6502 kits (i.e. single board computers) be bought anywhere, just like this one for z80 [https://shop.mcjohn.it/en/diy- kit/22-33-kit-z80-mbc2.html#/1...](https://shop.mcjohn.it/en/diy- kit/22-33-kit-z80-mbc2.html#/13-kit-assembled) ?

<comment><USER16> Bring your own chip(s) [https://icomp.de/shop-icomp/en/produkt- details/product/c64-r...](https://icomp.de/shop-icomp/en/produkt- details/product/c64-reloaded-mk2.html) or get and old one. It's 6510, which is the same thing.

</comment></comment><comment><USER17> Question: what is the code for/from?

<comment><USER13> If you're referring to the code that's loaded into memory location $00 and run when the simulator starts up: it doesn't look like it's anything particularly interesting, just a simple loop to exercise the simulator:

          LDA #$00    ; A=0
        loop:
          JSR sub     ; call subroutine
          JMP loop    ; infinite loop
        sub:
          INX         ; increment X register
          DEY         ; decrement Y register
          INC $0F     ; increment memory location $0F
          SEC         ; set carry flag
          ADC #$02    ; A += 3 (add 2, with carry)
          RTS         ; return from subroutine

<comment><USER17> Yeah, it didn't look like it was doing anything useful so I was curious if it was a reference to something…

<comment><USER13> I very much doubt it's a reference to anything. It doesn't appear to have a useful purpose besides demonstrating/exercising a few of the important components of the processor: it performs operations using the registers, the stack (JSR/RTS), memory (INC), and the ALU (ADC).

A quick search through GitHub shows that this code is unchanged since the initial commit of the original Visual6502: [https://github.com/trebonian/visual6502/blob/4d8da5b680216dc...](https://github.com/trebonian/visual6502/blob/4d8da5b680216dcbe5705ecb831821cd6b81e479/macros.js#L2)

<comment><USER14> I just took the original testing code from [http://visual6502.org/JSSim/index.html](http://visual6502.org/JSSim/index.html), also to confirm whether the simulation and visualization works.

I don't think it has any significance except testing a few things like memory read/write access, whether the stack works etc...

</comment></comment></comment></comment></comment><comment><USER18> if all I want to to is build a Super Mario clone is the knowledge of the 6502 assembly language still necessary ?

<comment><USER11> It'd be helpful, but not strictly necessary.

Here's an extremely well commented disassembly of Super Mario Bros.

[https://gist.github.com/1wErt3r/4048722](https://gist.github.com/1wErt3r/4048722)

</comment></comment><comment><USER19> Nice, is it about ~6 times faster?

<comment><USER20> It's about ~6 times cheaper.</comment></comment>


Ask HN: Is online communication a solved problem? - <AUTHOR>

Today we have email, chat, instant messaging, video calling, video conference, blog, forums, QA groups, sms, mms and social networks. So, many ways to communicate on the web/mobile.<p>Is online communication a solved problem? Do you see any scope of improvement? <comment><USER2> I'd still like to see open standards for IM and video/audio chat. And I think Google was ahead of itself with Wave.

I'd use it as a back-end;a way to archive everything I say online in any format. Include pictures/files sent, maybe include those linked as well. And include correctable transcripts of audio in metadata for searching.

See the competition now between Gmail, Hotmail, Yahoo, etc. Consider how they could vary their services if they were all cataloging that much more.

Maybe I'm idealistic, but I think there's still room for a "Google moment" where someone comes along and does something else so well, we're amazed that everyone hasn't always been doing it that way. Though honestly, at this taste, Google may just get there first.

</comment><comment><USER3> I think the forms of communication are there, and they work well. What it's ripe for now is "convergence". Remember when your phone, internet, and TV were all separate things? Now it's just all IP packets coming over a big pipe (for most of us).

Now, your phone, email, IM, SMS Facebook/Twitter/Google are all separate 'things'. I think we're in the early days of convergence, where all of these things are smooshing together. Think Google Voice (phone/sms) in your mailbox, or IM along with Voice/Video (Skype). And we still have too many identifiers... your skype id, your twitter id, your google + name, your home phone number your office phone number etc. etc.

I really think the 'next big thing' will be the collapsing of all of these ID's and services into one agregator(probably google). I'm not saying it's a good thing, or that it will go smoothly, but it will happen.

</comment><comment><USER4> Are you interested in building cutting edge technology or building a business?

If you're interested in building a business, then there's a huge amount of opportunity the online communications space!

I could probably think of 5 cushy niches that will print $20k-60k per month with a very small team. Just look around you and identify occupations that involve communication and build a communication product around that occupation's process.

It's a relatively simple and straight-forward process to building a business that lots of technical folks overlook because it's not sexy. I'll take profitable over sexy any day.

</comment><comment><USER5> There are lots of problems with online communication, but most of the big ones are sociological rather than technological problems.

Tone of voice problems might have a technological component to the solution (c.f. spam).

Automatic translation needs improving. Yes, it's incredible what's been achieved, but the translations are low quality.

</comment><comment> mike-cardwell A major problem with online communication is the lack of privacy.

</comment><comment><USER6> of course not! as long as there is internet censorship!</comment>


Turning off less-secure app access to G Suite accounts - <AUTHOR> https://gsuiteupdates.googleblog.com/2019/12/less-secure-apps-oauth-google-username-password-incorrect.html <comment><USER2> This seems like a transparently disingenuous way to further platform lock-in using security as a pretext. I question the level of "security" this provides, especially given that there's little difference on the client side from using an app-specific password and using an OAuth2 bearer token, except the latter is more annoying to acquire and use. Either way, it's a small blob of text managed via Gsuite that the user has to have on their device and that an attacker could steal.

<comment><USER3> Except app-specific passwords are not app-specific at all. You maybe have a calendar app, but then someone steals that and uses it to read email, and delete account recovery emails sent, owning you to hell and back.

ASPs are a real problem and a liability. A read-only view into your calendar or email is not as much.

I'm not saying you're wrong about what their motivation _actually_ is (but you _are_ just speculating), but you can't throw a rock without hitting a security expert who can easily argue why ASPs are a huge security liability.

<comment><USER4> Perhaps they could support app specific passwords that behave similar to bearer tokens, with a scope that limits API access, etc. Not saying this is a good thing. OAuth is simple enough to set up.

</comment></comment></comment><comment><USER5> Microsoft's Office365 will make a similar change in October 2020.

[https://developer.microsoft.com/en-us/office/blogs/end-of- su...](https://developer.microsoft.com/en-us/office/blogs/end-of-support-for- basic-authentication-access-to-exchange-online-apis-for-office-365-customers/)

</comment><comment><USER6> Does mutt support oauth yet? If not, this will be the last straw for G Suite from me. I can sort-of understand turning off "less secure" apps in consumer Gmail, but forcing "security" requirements for private, paid enterprise accounts is ludicrous. Time to find a provider which treats me as a grown-up capable of independent security risk judgement.

<comment><USER7> Are there any decent alternatives to G Suite that support out of the box email hosting?

<comment><USER8> For email you can import your gmail account via IMAP to fastmail. I have a custom domain so it's been awesome to finally serve mail from it and a relatively painless transition.

<comment><USER9> The problem I've been having with this is that most of these alternative providers don't offer much space, even on their most expensive plan. My GMail storage use is around 300GB right now. Sure I could probably clean that up if I wanted to, but I don't. I'd rather just pay for 400GB of space, with options to go much higher as time goes on.

Fastmail's most expensive plan offers 100GB, and most alternative providers seem to max out in this range (or lower). Mailbox.org is the only thing that I've found that is (or at least claims to be) privacy-respecting that offers lots of space.

On a side note, given some of the anti-privacy and anti-encryption legislation passed in Australia in the last couple years, I'm not sure Fastmail would be my first choice to replace Google.

<comment><USER10> You can buy more storage at Fastmail: it's the same cost as an extra user to add the same amount of storage. e.g. for a Professional account, you can add an extra 100 GB storage for an extra $9/month.

Gmail reports a combined storage with Drive etc., so you may find not all of your quota use is actually email.

</comment></comment></comment></comment></comment><comment><USER11> This change will prevent us from using a large number of open source apps, effectively locking us into Google's own tools.

My org will be eyeing alternatives when this rolls out.

<comment><USER12> That's surprising, it's an open standard that plenty of open source apps do implement, isn't it? Is it just that the apps you're using happen to not have support for it?

Which apps are you using that you wouldn't be able to use?

<comment><USER13> I wonder though how many open source apps will go through the mandatory security audit process (15-75K annually) since IMAP via OAuth is a restricted API scope [1].

[1] [https://support.google.com/cloud/answer/9110914?hl=en](https://support.google.com/cloud/answer/9110914?hl=en)

<comment><USER12> Ugh, I forgot about that.

That said - from "What app types are not applicable for verification?" there are the following exceptions:

> _Personal Use: The app is not shared with anyone else or will be used by > fewer than 100 users. Hence, you can continue using the app by bypassing the > unverified app warning during sign-in._

> _Internal Use: An app is internal when the people in your domains only use > it internally. Learn more about public and internal applications._

> _Domain-Wide Install: If your app is intended for only G Suite enterprise > users, access will depend on permission being granted by the domain > administrator. G Suite domain administrators are the only ones that can > whitelist the app for use within their domains._

Also, in general, you don't want an OAuth client secret to be checked into a public repository anyway.

So I think there's a straightforward approach: OSS developers/contributors using the app with their personal account use the "personal use" exception to create client secrets for just themselves, and companies deploying the apps (including companies employing people to work on the app) create a client secret for use only within that company and use the "internal use" or "domain- wide install" exceptions.

If I were doing this for my own company, I would make a client secret for an app called "$company Internal OSS Apps," use config management to put a file in /etc with our client secret, make it world-readable to anyone who can log in, and tell employees that it's a violation of infosec policy to copy that secret onto non-corporate computers but they should feel free to use whatever OSS they like (that's otherwise compliant with whatever policies we might have) and configure it to read that file.

So then there's just the question of actually making OAuth support exist in whatever apps employees want to use.

EDIT: Also there's this exception which I think applies to the vast majority of OSS apps (things like mutt and Thunderbird and notmuch):

> _Local Data Storage: If you don't want to go through a security assessment, > you need to change your server storage to local storage only. If your app > has server-side OAuth flow implemented, your app also needs to change to > client-side OAuth flow. Local client applications don 't need to undergo a > security assessment because data is run, stored, and processed only on the > user's device (such as a computer, mobile phone, or tablet)._

</comment></comment></comment></comment><comment><USER14> If you want to add an email alias to GMAIL the merge step requires less secure access. I was unable to merge two gmail accounts last week because google kept blocking me thinking my account was getting hacked.

</comment><comment><USER15> This is going to be a bit cumbersome for those using Thunderbird or Mail.app (on Mac) or Outlook (Mac) over (plain) IMAP — the document instructs users to remove and re-add these accounts. That would mean (in my understanding, at least of Thunderbird) re-downloading all mails and folders once again into the newly setup account in the client. Those who use only a single device are probably going to have to schedule this appropriately to avoid having no visibility into mails for sometime.

</comment><comment><USER16> yandex has free mail with free custom domain hosting

[https://connect.yandex.com/pdd/](https://connect.yandex.com/pdd/)

<comment><USER17> Any company based in Russia, China (or any other regime perceived as authoritarian and lacking in the rule of law department) is going to struggle to get on the short-list of "organizations to trust with the master keys to your whole online life".

<comment><USER16> it depends on your threat model

</comment></comment></comment><comment><USER18> I wonder how to configure Postfix if I wanted to continue using it as a relay client to Gmail. Postfix doesn't support SASL XOAUTH2 yet does it?

</comment><comment><USER19> Google PR at work downvoting critical comments and post out of HN front page.

Money can buy position like it can on google search.

</comment><comment><USER19> It's better not to use such restrictive service which push you to the corner. Let the customer decide whether they want oauth or password authentication, but we are google why should we care for customer, you use us so you need to comply with our demands.

My feeling is all this are ways to increase the revenue of google and they are just doing the same Microsoft and oracle was known for. This is called circle of life, it's just instead of licenses they are locking users with API's and proprietary development. Now in hindsight old Microsoft, oracle looked better compared to today's google. In old days anyone can develop for win32 api and did not need Microsoft's audit and charge for approval. Obviously today's Microsoft is doing same as google so none is better.

This whole thing is nothing to do with security but mostly a way to lock in users into gsuite, once you design your apps without login and password with oauth specific workflow and approval by google, it will be hard for anyone to justify a change.</comment>


The Army Beat Its Recruitment Goals This Year by Targeting Students in Debt - <AUTHOR> https://www.vice.com/en_us/article/ne833d/the-army-beat-its-recruitment-goals-this-year-by-targeting-students-in-debt <comment><USER2> It fits too well together, not good really, using debt as a systematic driver this way is nothing other than exploitation.

</comment><comment><USER3> coming in 2020: get your student debt paid, end up in Iran.</comment>


Why does history repeat itself? - <AUTHOR> https://medium.com/lessons-from-history/do-you-ever-wonder-why-history-repeats-itself-5004cd064abd <comment><USER2> Similar situations crop up time after time. But because it happened so long before, most people don't even _know_ that it has happened before, and tend to do the same things to 'fix' the problem as was done previously. Naturally they fail or succeed, just like their forebears failed or succeeded.

Hence the saying "those who refuse to learn from History are condemned to repeat it". or its cousin "there is nothing new under the sun".

For us history buffs, it's always fascinating to watch the rerunning of historical patterns: "Don't the stupid bastards know what happened last time?"

Case in point: the Thucydides Trap leading the US and China slowly but surely into war. My estimate is Spring-Summer 2020. Any later than that and the US is bound to lose.</comment>


This is why your startup needs to ditch the pitch - <AUTHOR> http://venturebeat.com/2013/02/19/ditch-the-pitch/

<comment><USER3> I have a very particular view of pitchs. The other day, on my former job, I had a meeting with wery important CEOs. I had already quit my job and the meeting was to explain my decision, as these CEOs were important clients and I used to handle the contact. Explaining that I decided to move on and go full- time on my startup they casually asked "what your startup was about"? There it is! THIS is the pitch that matters. In two or three phrases be able to explain what it is, my vision of it and make that vision stays in their heads so, at some convenient moment, they will remember me. Not just because they were important CEO, this pitch is important so every founder must have it ready, by heart, without thinking, to present his idea do friends - so they understand and support you; to your father - so he doesn't tell you to get a job; to other founders and developers - in order to create a relevant network. The "nay-sayers" are just a result of a bad pitch. This pitch is very important. Is must go out with any thought, automatically. You only need two answers: a initial one, of about three phrases and a complementary one, if the interlocutor become more interested and give you space to evolve your answer. More than that is a conversation, not a pitch.

Do you know for who you don't need any pitch? Investors. I don't say potential investors, people that someday may remember you and decide do invest somehow (as the CEOs I mentioned before). No, I am talking about that meeting with interested investor, face to face, when you are there only to present your startup and he is there only to decide whether they will invest or not on you. A meeting is a conversation, not a pitch. It is the moment where you tell them what do you know, not what you have memorized. You must listen to the investors, understand their doubts, it demands a lot of empathy. Before a meeting like this you must prepare your knowledge, not your speech. Any PPT is only needed if you must show important, complex and specific data ( therefore, not worthy of memorizing).

Something different are startups events. To start with, I think these presentations on startup events are highly overestimated. In general, they exist more to promote the event itself (and the brand of the organizer) than to make your startup any good. Events are great for networking, learn new things, discover different opinions, but not for pitchs. The only exceptions are accelerators' demo days, but even so, I would guess that most investors go into these ocasions already briefed about whom they will talk to. But some serendipity may occur. These kind of pitch are more focused on memory than knowledge. Q&As at the end of your pitch are always more about mistakes or absences on your presentation than about investment decision doubts.

I don't want to rebel against the system here. I only think that "pitch" is a twisted concept these days. Too much influence on it of media, ego and vanities. In summary I think two things are essential: i) you must have a very memorized pitch, as a standard first answer, ready to go out without any further thought, to anyone who ask you what is your startup about - <USER2> clear, short and visionary at the same time, to show the idea and attract interest and ii) you must not have anything memorized when this initial pitch becomes and actual convesation, but, for sure, be deeply updated about all the knowledge that involves your startup.</comment>


Why OpenBSD Is Important to Me - <AUTHOR> http://ggr.com/why-openbsd-is-important-to-me.html <comment><USER2> I am an OpenBSD user, there is no OS I'd rather use currently (obviously) and I am sure there is no OS with a greater focus on security and clean code, the project as a whole deserves a great deal of respect and admiration for setting the bar when it comes to security, and for being the originator of great products that are used outside the boundaries of OpenBSD itself, however (with all due respect) what the author portrays here is paranoid philosophical mumbo-jumbo I'm normally used to from radical FSF-devotees.

Yes, there are NSA scandals, yes, the US government has repeatedly overstepped boundaries, yes, caution and scepticism is a very healthy and good thing, but on the other hand there are GNU/Linux distributions taking security somewhat seriously, they have to, they too work with open source code, have a lot of users, and review said code, I doubt someone is interested in your specific data, I doubt using a GNU/Linux distribution or some other BSD OS is some risk one shouldn't take, I doubt we should all have to automatically strive for an "ethical" all Free Software life or otherwise we are in risk of somehow being under totalitarian control, I doubt Apple and Microsoft are totally out to get you and by definition filled with evil backdoors the NSA uses to spy on _everyone_... I doubt they only do malicious things,... and talking about security, it's not all in the Software, a lot is in users' behaviour... not talking about him specifically, but "We are all spied on by the NSA, please like me on Instagram and follow me on Facebook for hourly updates on my life so we can join in the fight against totalitarian control"...

As you have guessed by now I am some kind of allergic to this... those idealistic over-simplifications... drawing everything in black and white...

Some of the OS X users I know are incredible technology-orientated and privacy concerned people, should I draw the conclusion they are being overly naive by not using OpenBSD for everything? I don't think so, they are just not suffering from paranoia, are pragmatic and living in the real world...

<comment><USER3> "As you have guessed by now I am some kind of allergic to this... those idealistic over-simplifications... drawing everything in black and white..."

I avoid oversimplifications, too. Yet, most of what the author wrote was proven by precedent. Only grip I have is calling Linux anti-security and anti- privacy given how much good work in those used the platform. Gotta be a kernel by kernel and distro by distro judgment on that. Rest seems accurate.

"Some of the OS X users I know are incredible technology-orientated and privacy concerned people, should I draw the conclusion they are being overly naive by not using OpenBSD for everything?"

The conclusion is that they prefer to use OS X. That simple. Far as its security, it's made by a company that spent a long time lying to its users that they were immune to malware because Mac's were just inherently secure. They added lots of mitigations sometimes 10 years behind Windows and UNIX per one firm. I recall one vulnerability where an administrative service required a username and password for log-in but _didn 't check it against database_. If you entered _any password_ , you got in.

Such a history of absolutely, terrible security plus deception of customers means Apple products shouldn't be trusted for security by default. Any "privacy concerned people" using it are making a foolish mistake or intentionally trading away privacy for some other benefit.

Now, what you just saw me do was the evidence-based approach to these things. Helps cut through the noise nicely.

<comment><USER2> And I appreciate it, I don't doubt that OS X isn't the best choice, and for sure there is some kind of trade-off going on, most likely, yet I assume a lot of it also has to do with how those products are used, meaning an inexperienced users fall into the pitfalls of maybe any system, while an experienced user will use the product rather differently?

Since you are a security researcher, aren't a lot of people of "your breed" using Macs as well?

As for the OS X security track record I don't claim to be incredibly well versed in that regard, thank you for the insight. But the piece doesn't primarily talk about security flaws, rather about systemic risks in using any sort of proprietary software whatsoever, especially by "evil" corporations like Microsoft and Apple (it might not say that directly, but that's how I conceived it) which I think is far over-emphasized.

<comment><USER3> "Since you are a security researcher, aren't a lot of people of "your breed" using Macs as well?"

I use Linux, BSD's, and custom systems. From what I've gathered, the people using Mac's do it for usability and apps more than anything. The Mac OS is pretty, well-designed components for GUI/desktop on top of a hybrid between a microkernel and UNIX (BSD). Let's ignore their bad choice of microkernel. The real benefit is you get a desktop with comparable usability to Windows, you can pull out command line for full power of the UNIX underneath, it's overall more reliable/consistent than Linux on desktop side, and there's plenty of apps from vendors who target Windows + Mac but not Linux.

So, that's the overall value equation. A UNIXy OS with many apps and nice interface. I considered attempting to secure its foundation, Darwin, at one point but it's a hodgepodge of crap thrown together. Clever way to get a system out the door for Jobs back in the NEXT days. Not so good later on when one is improving foundations. :)

Note: Addressing your other point in a new comment as I can never remember length restriction.

<comment><USER4> > The Mac OS is pretty, well-designed components for GUI/desktop on top of a > hybrid between a microkernel and UNIX (BSD). Let's ignore their bad choice > of microkernel.

Is it necessary to ignore the microkernel choice? Isn't MacOS X -not- microkernel, even though (or "because") it uses an old version of Mach? [0][1][2]

[0] [https://en.wikipedia.org/wiki/Mach_%28kernel%29](https://en.wikipedia.org/wiki/Mach_%28kernel%29)

[1] [http://www.roughlydrafted.com/0506.mk1.html](http://www.roughlydrafted.com/0506.mk1.html)

[2] [https://www.youtube.com/watch?v=8RwlEZ88rKM&t=445](https://www.youtube.com/watch?v=8RwlEZ88rKM&t=445)

<comment><USER3> Mach was a terrible microkernel because it tried to do too much. Good examples for you to look up are QNX, L4 (esp OKL4), EROS, and Minix 3. These all get stuff done more reliably, securely, and _faster_ than Mach. That they've built so much into the Mach model means anything you do to improve security or performance has to fight with its inherent weaknesses.

So, Mach is its own discussion of failure in and of itself. There was also a history... Trusted Mach, Distributed TMach, DTOS... of trying and failing to secure Mach using high-assurance methods. The security improvements in new Mac OS's, esp sandboxing and such, were actually recommended with that old research in mind. They realized the foundation wasn't going to be secured as it never worked in the past. So, they went for decomposition and isolation schemes for apps themselves plus IIRC integration of TrustedBSD mechanisms.

<comment><USER4> I appreciate the links. I'm still perplexed though -- isn't the Mach component of MacOS X not at all a microkerel? Are you saying "it sort of is", or "it certainly is" ?

The promises of microkernels seem extremely attractive to me, but we know that the promise of simplicity doesn't come for free (witness Hurd[0]). There were versions of Mach that were high-profile (i.e.: media/developer attention) microkernels, but I thought the Mach in MacOS X really was simply "not a microkernel". Interested to hear more about this if you've got illuminating info.

[0] [https://www.gnu.org/software/hurd/hurd.html](https://www.gnu.org/software/hurd/hurd.html)

<comment><USER3> Mach _is_ a microkernel but Darwin _is not._ This is what Mac OS X runs on:

[https://en.wikipedia.org/wiki/XNU](https://en.wikipedia.org/wiki/XNU)

[https://en.wikipedia.org/wiki/Darwin_%28operating_system%29](https://en.wikipedia.org/wiki/Darwin_%28operating_system%29)

XNU is monolothic software since it (a) merges code like BSD in with the microkernel and (b) has a ton of kernel-mode code in violation of microkernel principles. It can be said that microkernels can still benefit monolithic heaps of kernel code by providing a consistent, simple way for pieces to internally communicate. Windows has a microkernel inside of it for that reason IIRC.

"witness Hurd[0]"

Hurd is another failure. So many microkernels, including commercial deployments, have happened during the lifetime of that project not achieving its goals. Situations like Mach and Hurd are why people think microkernels suck. You have to see good examples. Did you ever use a Windows 95/98 box back in the day? Remember how it would choke trying to do anything intensive or concurrent? Check out what microkernel-based BeOS does on older hardware in my UNIX alternatives list:

[https://news.ycombinator.com/item?id=10957020](https://news.ycombinator.com/item?id=10957020)

Tannenbaum has a nice paper describing the two biggest problems plus different styles of handling them. It includes the microkernel techniques that are reason we like them for robustness.

[http://www.minix3.org/docs/jorrit-herder/computer- may06.pdf](http://www.minix3.org/docs/jorrit-herder/computer-may06.pdf)

On capability-security site, KeyKOS had fine-grained isolation, protected communication, and checkpointing of app's state in case of failures. Shapiro's successor, EROS, is described in this document along with many key principles to high-assurance reliability and security that good work must leverage:

[http://flint.cs.yale.edu/cs428/doc/eros- ieee.pdf](http://flint.cs.yale.edu/cs428/doc/eros-ieee.pdf)

Note: Unfortunately, project is dead as FOSS contributors had little interest and he got poached by Microsoft. Did deliver a more secure networking stack and GUI system on top of a prototype kernel. COYOTOS project papers have some lessons learned, too.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER5> We also owe the OpenBSD team OpenSSH, which greatly benefits from their attention to detail and commitment to small improvements towards better security.

Of course software is never perfect, but it's nice to know the (small) subset of OpenBSD developers working on OpenSSH are still working on keeping the proverbial doors locked.

<comment><USER6> Yes, the OpenBSD team's willingness to roll up their sleeves for software that I consider core to a functional Internet is pretty remarkable. Even though the last OpenSSL vulnerability also affected LibreSSL, in the past others haven't.

EDIT: Morning brain made context shift unclear. They do OpenSSH _and now_ LibreSSL. Also pf and more too.

<comment><USER7> [http://www.openbsd.org/innovations.html](http://www.openbsd.org/innovations.html) AnonCVS, OpenNTPd, OpenSMTPd, ...

</comment></comment></comment><comment><USER8> I just want to shake the hand of the person who made the OpenBSD installer the way it is.

In case you haven't used it, it's dead-simple, command-line based, and it may take a few times to get it right if you don't know what you're doing. It's nearly featureless.

But after you figure it out, you can automate installs, and roll your own distro by changing the contents of tar files, or add your own software and configuration the same way.

It's quite possibly the most satisfyingly transparent OS install method I've ever used.

<comment><USER9> Indeed, the only distros in the Linux world with installers that even come close are Alpine Linux (which is obviously heavily influenced by the OpenBSD installer) and Slackware Linux, coincidentally two of the better Linux distros for those who prefer a more BSD-style approach to managing the OS proper.

Alpine needs a little work in the desktop OS department, and is painfully lacking in a few essential packages for daily computing, but it's come a long way in a short time. Meanwhile, Slackware is due to drop 14.2 on us any day now, and has seen vast improvements over the past few years. Both are worth a look if OpenBSD for some reason doesn't work on one's system.

But having said that, OpenBSD is a cut above any other open source OS when it comes to stability, clean code, and well written, complete, thorough documentation.

</comment></comment><comment><USER10> I wanted multiple times to study the OpenBSD source code and I've downloaded it but I never managed to navigate through it, to find the "head and the tail" or to find a reasonable "map" of the source code. I would like for example to follow the execution path in the source code, from the boot up to the login prompt. Does any documentation like this exist or could anyone give me some hints ? Thanks

<comment><USER11> There are three parts in this sequence:

1\. Boot up - this is very machine-dependent ("MD") so you'll find it in each architecture's source code. Look for files named "locore.s" or "locore.S" in places like src/sys/i386/i386.

2\. Kernel - the machine-independent ("MI") part, or where the fun begins... this is in src/sys/kern/init_main.c, look for the function main(). You'll see the different subsystems initialized, from the lowest level (auto configuration of hardware devices and console initialization) through fundamental subsystems (virtual memory, disk, network, processes, etc.), all the way to the scheduler. The scheduler will only have one process to work with (PID 1) which is init (src/sbin/init), so that's what gets executed.

3\. Userland - /sbin/init is the first process that runs, and it takes care of running everything else, like daemons and eventually your login prompt. Your points of interest in init.c are runetcrc(), read_ttys(), and multi_user().

<comment><USER12> What a relief! Thanks for scratching that itch. Also turns out to be good code organization, but I needed that post to boot me up.

<comment><USER13> Someone should make a site for sharing little "guided tours" of open source code bases...

<comment><USER14> While not a walk through the code base, there are these wonderful volumes: [http://www.aosabook.org/en/index.html](http://www.aosabook.org/en/index.html) that have creators/maintainers/contributors walk through at a higher level how these amazing programs work.

</comment></comment></comment></comment></comment><comment><USER15> Probably worth noting as well how many software products OpenBSD has contributed back to the overall free software world; things like OpenSSH, (edit: NOT OpenSSL), a more secure ntpd and inetd.

Even if you don't run OpenBSD, you benefit from it.

<comment><USER16> > how many software products OpenBSD has contributed back to the overall free > software world; things like OpenSSH, OpenSSL, a more secure ntpd and inetd

One of them is not like the others -- OpenSSL is not an OpenBSD project and the code quality is markedly different :-)

<comment><USER17> perhaps jayofdoom meant LibreSSL.

and yes, OpenSSL is a bit of a code quality difference than the OpenBSD norm.

<comment><USER3> Yall don't be too nice to them. The code quality is shit. My favorite quip of all came from Ted Unagnst noticing they did endian-checks in one code that ran very often during use of protocol. He said something along the lines that they hadn't applied any sense to (important issue) but they had you covered if your CPU's endianness changed in mid-operation. No words. :)

<comment><USER17> I meant my comment in the same spirit as a Southerner means "Bless your heart".

I do believe Ted Unagnt's comment is included in the [https://www.youtube.com/watch?v=GnBbhXBDmwU](https://www.youtube.com/watch?v=GnBbhXBDmwU) LibrSSL first 30 days along with quite a lot of other oddities.

<comment><USER3> Alright lol. I lost the video but it was definitely a LibreSSL presentation at a conference. Thanks for the link in case it has it.

</comment></comment></comment></comment></comment></comment><comment><USER18> Great opinion piece. I think this is mostly the opinion of anyone that really discovers OpenBSD and gets caught up in it. Security does matter, and the developers accept nothing less than what they want.

My main problem with OpenBSD development is that all development is decided solely by the developers and there doesn't seem to be much care for what others want.. which is fine, they're doing all the work for peanuts.

Sometimes you just have to do things that aren't well suited for OpenBSD (imagine updating and ensuring hundreds of OpenBSD machines are up-to-date, and running high performant threaded applications). Many things work, but that is all they do. Sure it may be much more secure than other unix or linux offerings, it may be all there is. Much of the ports are just "get this to compile and work". That isn't always good enough. Truly evaluate if it fits your needs. If there is something you want on the platform, it may be up to you to fix it.

\--

Unrelated, I find it interesting that NetBSD isn't mentioned once in this entire thread.

<comment><USER19> I've seen this type of comments many times, in many different context, about many different open source software projects, and I never understood them.

> all (OpenBSD) development is decided solely by the developers and there > doesn't seem to be much care for what others want

This implies this is not the case for every other project.

To pick on your SMP performance example, Linux doesn't have better SMP because "developer saw that people want SMP, and decided to implement it". Linux has better SMP because some people came and implemented it. Not at other's people request, that is never relevant.

Different open source projects attract different (developer) audiences, and different project have different audience sizes, but don't make the fallacy that some projects chose what to work on (architecturally speaking) because user demanded it. That is _never_ the case. Everything big happens because _developers_ want it.

<comment><USER18> It isn't a "fight" or a "Linux vs OpenBSD" thing. It is just how they approach development. One could argue if it is "good" or "bad", but what matters is knowing it exists.

Many projects have different approaches to development. Sure, many people work on bugs most of the time, but there are big decisions about where the limited resources are going to be spent on new features. Those are the ones that truly matter.

There are examples of amazing things people have just done on a whim, but that isn't truly a standard and much of those things are generally huge.

</comment></comment></comment><comment><USER20> I'm curious why the author says Linux is "insecure, anti-secure, and anti- privacy software" Can anyone explain this?

Also, why OpenBSD specifically, and not FreeBSD for example?

<comment><AUTHOR> I'm lumping Linux in that group because my impression is that Linus is ambivalent about security--it seems to be just another feature to him (see [http://www.washingtonpost.com/sf/business/2015/11/05/net- of-...](http://www.washingtonpost.com/sf/business/2015/11/05/net-of- insecurity-the-kernel-of-the-argument/)). Additionally, with most of the popular distros, once I install the OS, I have to spend a bunch of time locking things down before I do anything else, whereas OpenBSD has pretty good defaults that I can build up from. Also, when Ubuntu, one of the most popular Linux distros, started capturing searches by default, that got me questioning their commitment to privacy.

That's not to say there aren't distros and contributors to Linux that care deeply about security--clearly there are. I just don't find the overall ecosystem nor the most popular distros nearly as focused on or as trustworthy on security and privacy. And as the stakes get higher with more of our lives going digital and more companies, states, and criminals trying to take advantage of that trend, I worry.

As for OpenBSD vs FreeBSD, I've had an easier time getting OpenBSD working on my hardware and OpenBSD seems to me more concerned with, focused on, and practically innovative on security--that is to say, they don't just introduce new security features that can be configured and used by someone smarter than me, the OpenBSD folks work hard to introduce new security tech that's on by default with no special knowledge required by the end user, i.e. pledge, W^X.

<comment><USER3> Then modify the claim to say "some Linux kernels/distros" instead of Linux as a whole. Meanwhile, thanks to CompSci, there's Linux's (eg Criswell's SVA-OS) and FreeBSD's (eg CheriBSD on CHERI) that run with _way_ more security than OpenBSD. They push the state of the art. So, it's a mixed bag.

OpenBSD is actually no different. The developers care a lot about security and quality. Yet, the mere fact that I see OpenBSD desktops in Google images running shoddy applications shows many OpenBSD users make similar tradeoffs to what you described of Linux camp. It's just the kernel and select userland that gets their attention to quality due to limited staff (and their preferences).

<comment><USER21> _> Yet, the mere fact that I see OpenBSD desktops in Google images running shoddy applications shows many OpenBSD users make similar tradeoffs to what you described of Linux camp._

Are these "shoddy applications" not more secure on OpenBSD due to the various mitigations applied to userland software?

<comment><USER3> We don't know. OpenBSD has so little market share that virtually nobody is testing those mitigations. However, many are similar to mitigations developed on other platforms and beaten. So, they'd probably be beaten with effort, too.

Don't you love reasoning by precedent? Makes these judgment calls so much easier. :)

<comment><USER21> People are testing the mitigations. For example Qualsys' audit of OpenSMTPD[0] noted that a buffer overflow they found was not exploitable on OpenBSD as even a single byte overflow would smash the stack canary.

[0] [https://www.qualys.com/2015/10/02/opensmtpd-audit- report.txt](https://www.qualys.com/2015/10/02/opensmtpd-audit-report.txt)

<comment><USER3> That's not trying to break the mitigations: it's simply testing if they stop an exploit which isn't designed to bypass the mitigations. Really easy to pull off. :) Below are examples of a clever scheme for stopping control flow attacks and a successful attempt to breaking it. When I say testing the mitigations, I mean work like what's in the second paper.

[https://www.usenix.org/system/files/conference/usenixsecurit...](https://www.usenix.org/system/files/conference/usenixsecurity13/sec13-paper_zhang.pdf)

[http://www.cs.berkeley.edu/~daw/papers/cfi- sec15.pdf](http://www.cs.berkeley.edu/~daw/papers/cfi-sec15.pdf)

Note: Native Client, which protects Chrome, is a form of Control-flow Integrity. Hence, me using it as an example.

<comment><USER21> I'm not seeing your point. A vulnerability was found in OpenSMTPD. That vulnerability could not be exploited on OpenBSD because there was no way to overflow the buffer without smashing the stack canary. If you had the same version of OpenSMTPD running on a generic Linux kernel or on Mac OS X, it was vulnerable. On OpenBSD it was not. Ergo, OpenSMTPD running on OpenBSD is more secure than OpenSMTPD running on other platforms that do not provide the same mitigations.

At least, that's the way I see it.

Now, are you saying that because it's possible to bypass the mitigations in some other cases, preventing that vulnerability (and others) doesn't matter?

Or, are you saying that it would be possible to craft an exploit that bypassed the stack protection for that particular vulnerability? In which case I would love to see your PoC.

Or something else?

<comment><USER3> What I'm saying is simple: there's the security of the code and the mitigation itself to consider. I know of no talented people interested in devrloping bypasses for OpenBSD mitigations since nobody uses OpenBSD. So, they break even more clever stuff in Chrome, Windows, etc. Given your example, lets change the mitigation to make it more obvious, though.

OpenSMTPD (email for short) is the target. Default are Windows, Linux, and OpenBSD on x86. OpenBSD devises a mitigation: use SPARC processor since x86 malware cant work. As you say, the malware works on everything but the SPARC box. You and others claim it means the mitigation is secure and so is what uses it.

Now, some guy named Nick claims it's no more secure than a BSD/Linux 0-day on x86: they just didn't target exploit for that environment. Sure, they have to learn SPARC ISA and how OBSD uses it. Sure there's work involved. Similar mitigations were beaten in the past by first person willing to invest effort, though. So, Nick posits reason SPARC is safe from x86 malware coders is that they don't care enough to deal with SPARC boxes. Maybe no market share.

See how that works now?

<comment><USER22> Whats the term, security by obscurity?

<comment><USER3> Basically. Now, it's fine to throw in obscurity or unusual mechanisms on top of good security practices. I used that to stop high-strength attackers before. Yet, we must be careful to note the difference between these mitigation results:

A. We stopped those vulnerabilities from working because nobody can bypass this mitigation.

B. We stopped those vulnerabilities from working because very little talent is working on beating our mitigation.

World of difference there as Chrome and SFI/CFI teams I linked up above found out when smart hackers and braniacs from CompSci began convergjng on their work. And shredding it.

Code-Pointer Integrity was last one standing after first round of peer review. I'll use it for medium-assurance if it survives 2-3 more. Check it out.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> End of the day, OpenBSD is a great example of the value of competition, and the necessity to maintain market rules that encourage it.

How awesome is it that we have dedicated operation system geared towards the niche of the market that cares deeply about security?

<comment><USER24> Just fyi we actually have multiple operating systems dedicated to security.

<comment><USER25> Can you elaborate on what the alternatives are? The more we all know, the better!

<comment><USER26> For any Linux distro, applying the grsecurity patchset will make your box more secure.

RHEL (and thus, CentOS) does a pretty good job of configuring and enabling SELinux for packaged software.

There is a Hardened Gentoo. All the fun of normal Gentoo, but with fewer companions to find the compiler bugs. ;-) Still, they've built quite a stack of security patches, including grsecurity.

There is (used to be?) Hardened Linux From Scratch. Educational, but not practical.

OpenWall Linux is dead-ish, but - as you'd expect from a Solar Designer product - introduced several interesting patches (some backported from OpenBSD). You may be interested in [http://www.openwall.com/presentations/Owl/](http://www.openwall.com/presentations/Owl/).

I recommend - and use - OpenBSD, but there are definitely people interested in security in the Linux world.

<comment><USER27> The bad thing is there's hardly a generic "more secure" switch.

> applying the grsecurity patchset will make your box more secure.

It also might not. Correct me if I'm wrong, but while grsecurity does a good job in kernel hardening, it won't protect from attacks like recent imagemagick system() injections, or from something like wordpress exploits, where you don't necessary touch kernel space or even binaries at all -- so it might be possible to have grsec enabled system and still be part of a botnet, or leak user data.

> enabling SELinux for packaged software.

This is a double edged sword also. Good thing is that a lot of software does have SELinux policies for it. Bad thing is that a lot of software runs in _unconfined_ domain and that can give a false sense of security. For instance, if I recall correctly, systemd runs unconfined, while being itself a a) rapidly changing and b) half a million plus LOC software. And to err is human, you know -- SELinux won't "contain the bomb as it goes off" in unconfined domain.

Another example of bad approach with SELinux would be grepping for something in the audit.log and making policy module, which is even recommended in the official docs [1]. I do understand that its a major PITA to find good balance between convenience and security, but this particular example trains users bad practice from the start. Its worse than dismissing UACs -- its as bad as grepping for dropped packets in firewall logs and autocreating permissive firewall rules. Attacker calls her rootkit "yoursoftware.sh", tries needed functionality so that denials appear in audit.log, waits until sysadmin greps for "yoursoftware" and voila -- SELinux is perfectly ok and silent with rootkit. Its simplified, but you get the idea.

> Hardened Linux From Scratch. Educational, but not practical.

If we disable unconfined domain -- and hence be forced to formalize literally every syscall in our access matrix -- then any MAC system also can be called unpractical.

I think every statement of a "Use X its more secure" kind is very dangerous, unless you explicitly specify against _what kind of threats_ its more secure. Otherwise, statement just adds false sense of security, and then human laziness kicks in, and we end up with a mess. Like, if I harden the system kernel, but fail to protect the user data -- or vice versa -- I simply end up without any sensible result, while thinking otherwise. Or I can start with perfectly reasonable defaults (same examples like OpenBSD or SELinux) and with few "convenient" commands open up huge security holes, and again, end up with not what I expect.

[1] [https://access.redhat.com/documentation/en- US/Red_Hat_Enterp...](https://access.redhat.com/documentation/en- US/Red_Hat_Enterprise_Linux/6/html/Security-Enhanced_Linux/sect-Security- Enhanced_Linux-Fixing_Problems-Allowing_Access_audit2allow.html)

<comment><USER26> You're right, but I just wanted to give some pointers, not write a novel on software security (modelling). ;-)

With respect to SELinux: I'm not a fan in all regards, but if you want to use SELinux, the fact that RHEL has pre-made policies for you _does_ help.

</comment></comment></comment></comment></comment></comment><comment><USER28> The biggest reason people don't use BSD of any type is that you can't go into a store and buy a computer with BSD on it. At least not in any store an "average" computer user would know where to look.

As for someone like me, I used to build computers (more than a couple hundred) back in the 80s and 90s with alternate OSs to Mac (classic) and Windows but never tried BSD. I did try BeOS and OS/2 and Corel and close to a dozen different Linux distributions (I have the Penguins to prove it).

At the time I didn't know anyone else that used BeOS or OS/2 other than me. Personally I mean. So that isn't my excuse for not using BSD. Mostly I rarely heard about it. Now I'm old (laughing) at 55 and left BeOS and OS/2 behind years ago and moved to Mac Classic and then Mac OS X which runs on top of BSD. That's the closest I've gotten.

If you want more people to use BSD you really need to promote it more. Not just in nerd magazines but put out flyers around companies (don't ask, just leave them) with an explanation of what OpenBSD is and why they should be using it instead of Mac or Windows.

It needs to be brief and clear and you need to make VERY clear how they find and install OpenBSD and not just, "Go out and buy a computer and install it." That's like telling most people, "Go out and buy a nuclear reactor and install for the OS for it." It's not going to happen unless you are clear and you make it as easy for them as possible. People like easy and they want to feel like someone cares and that they will be taken care of if they have ANY questions.

Personally I feel that one of the biggest bad jokes is that "Microsoft cares". Really? Would you like to buy the Brooklyn bridge? Because it's for sale for $1.

If you get everyone you know to lay out flyers at businesses with what I describe above then you may get a few more people to use OpenBSD. But be prepared to support them in not nerd languages and without any attitude. If you have emotional problems (low self esteem, and I'm not saying that YOU do, well those people shouldn't be helping anyone else with anything) then I would suggest leaving support to other people.

<comment><USER29> Do the downlable .ISOs boot these days? Back when I had time to check it out nearly a decade ago, it cost real cash money to buy a bootable CD-ROM from their store.

</comment></comment><comment><USER30> To paraphrase:

 _Speaking freely is essential to democracy. The more restricted your conversations, the more careful you are about what you say. And being careful leads to less candor, less criticism, and less innovation. Thought and free speech are the breeding ground for new, sometimes controversial ideas. They are how we prototype, think new ideas through, refine them, and get them ready for wider distribution and discussion._

The actions of many 21st century activists seem to be diametrically opposed to this ethos and designed create a social landscape of civic censorship and extra-legal punishment for "thoughtcrime." I think a society with laws supporting free speech on the books, but largely made of authoritarian and censorial organizations is no more democratic in spirit than the Jim Crow south was inclusive with its "technically" enfranchised non-white population. (It doesn't so much matter what laws are on the books, if society at large thinks something opposed.)

For democracy to work, there needs to be freedom to dissent. I think many young people who grew up with web forums were exposed to so much draconian censorship, they've come to unconsciously feel that censorship is a key means of expressing power and "justice." I just hope that enough of them work out how intellectually bankrupt such a society would be.

</comment><comment><USER31> > Plenty of hardware in my life has backdoors (I'm looking at you Intel[1])

That same libreboot article[1] says that AMD is not any better. Is there any alternative I'm not aware of? An ARM Chromebook is unfortunately not fast enough for me.

[1] [https://libreboot.org/faq/#intel](https://libreboot.org/faq/#intel)

<comment><USER19> I hope this will be good: [https://www.raptorengineering.com/TALOS/prerelease.php](https://www.raptorengineering.com/TALOS/prerelease.php)

</comment></comment><comment><USER32> I'm just getting started on setting up an OpenBSD router that I want to be the basis for making sure much of my data is secure. I figure I can start with the edge of my network and work in. And for such an important device as an internet gateway, I want to be able to trust it.

<comment><USER33> > I'm just getting started on setting up an OpenBSD router that I want to be > the basis for making sure much of my data is secure.

A bit of warning... I've seen this go wrong when people who don't know OpenBSD do this. Adding an additional OS means learning and "supporting" it.

* If learn your way around, get it set up well, keep your system updated the way you do for anything else, then you'll be in good shape.

* If you learn just enough to get it working and then set it on the back burner for when you can find the time to learn more, don't update it, etc., then you're better off going with an OS that you know and can keep secure.

I'm not trying to dissuade you, but I'd like you to evaluate if you will devote the time to using a new OS on a border device that it deserves. If you will then I think you'll be quite happy with your choice. :)

<comment><USER18> Indeed! Spoken by someone that seems to have experience maintaining many machines.

As secure as the machine is, its security slowly degrades the longer it is out-of-sync with updates (especially security ones) and/or admins administering the machines aren't good enough.

System administration isn't a set-it-and-forget-it type of thing.

</comment></comment></comment><comment><USER34> >Plenty of hardware in my life has backdoors (I'm looking at you Intel). But I'm slowly replacing the bad stuff with the good stuff, as I'm able to find OpenBSD (and open hardware) based solutions for my remaining use cases.

Use a blobless OS like Trisquel, Guix and get libre hardware from the FSF.

</comment><comment><USER35> > I imagine the NSA has a bag full of OpenBSD exploits [...]. But OpenBSD has > gifted to the world a fighting chance--

Doesn't the former sentence negate the latter?

At this point, it seems just about all systems are hackable, given enough resources.

<comment><AUTHOR> Reading Bruce Schneier made me especially aware that security has a strong economic component--its not that you can make your server secure against all threats, but with the right tools you may be able to make it uneconomic for the threats you are most worried about. There's probably not much you can do to defend against an NSA-scale attacker that's targeting you individually. But if you're more concerned about NSA-style dragnets or their corporate equivalents, OpenBSD can help.

<comment><USER35> > There's probably not much you can do to defend against an NSA-scale attacker > that's targeting you individually.

Hm. How is Phineas Fisher[1] is still on the loose then?

[1] [https://news.ycombinator.com/item?id=11512845](https://news.ycombinator.com/item?id=11512845)

</comment></comment></comment><comment><USER36> Carry on. I'm with you.

</comment><comment><USER37> Does OpenBSD have good SMP support yet?

<comment><USER7> Be more specific with your question or give an example where it is too slow.

In general: In userland yes, in kernel yes and no and working on whatever seems too slow.

</comment></comment><comment><USER24> I don't know how anyone can lump Linux in with Windows when it comes to security from NSA spying and then say OpenBSD is a good alternative.

HN seems to love the anti-Linux FUD though. Anything that further fractures the OSS community is upvoted fast.

I like the BSDs too, but there are a ton of reasons Linux is the most popular kernel in the world, it's not just because the NSA makes it so.

<comment><USER38> it's not just that though, there's the push for systemd which was not welcomed and alienated a lot of sysadmin folk who frequent hackernews.

personally I felt rather shafted by systemd, not because it's bad, but because my arguments were never even met, it was just a brushing off from some of the people who had already accepted it.

So I tried the BSD's and they were significantly better than I imagined they would be, I would put money on this being the case for other people who are upvoting these topics.

<comment><USER39> Indeed. If systemd were just a parallelized init system with better unit management, far more would be okay with this shift.

But that wasn't enough. They had to hijack bootloading, logging, device management, network, etc. For reasons that nobody seems to be able to actually explicate.

<comment><USER40> They want to control it all to give the best possible user experience but fail short and introduce bugs I've never had since the first day I've installed Linux in the 90s.

<comment><USER41> _They want to control it all to give the best possible user experience_

Or perhaps, since Poettering et al. are Red Hat employees:

Red Hat want to control it all ... for reasons</comment></comment></comment></comment></comment>


Man App: The Marketing of a Relationship Preserver - <AUTHOR> http://technologyvoice.com/2012/10/29/man-app-the-marketing-of-a-relationship-preserver <comment><AUTHOR> In the run up to Valentine's Day :-)</comment>