UEFI boot: how does that actually work, then? (2014) - <AUTHOR> https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/ <comment><USER3> > _And no, Secure Boot itself is not evil. I am entirely comfortable stating > this as a fact, and you should be too, unless you think GPG is evil_

Actually no, secure boot _is_ evil, and comparing it to GPG is fallacious. The objection isn't to code signatures in general, but the inevitability of baked- in privileged keys inherent in its design. Calling it just an impartial mechanism is flat out naive, and the author even goes on to describe why:

> _But it's worth noting it's no more bad or wrong than most other major ARM > platforms. Apple locks down the bootloader on all iDevices, and most Android > devices also ship with locked bootloaders._

While Microsoft exempts x64 hardware because they're concerned about further anti-trust action, the ARM ecosystem actually demonstrates the end result. By providing these companies the _capability_ to lock things down, they inevitably _will_ use it to enforce their inherent authoritarianism onto their customers. The majority of their customers will not care, accepting the age- old excuses for authoritarianism like "security". But capturing a pragmatic majority does not make something _right_ , as apparent to anybody who struggled due to Microsoft's monopoly in its heyday.

A freedom-preserving boot verification specification is definitely possible. In such, there must be no privileged key that cannot be disabled or augmented. Microsoft's x64 requirements do fulfill this, but as a result cause the system to fall to evil maid attacks. However, evil maid attacks can be prevented by incorporating an open-to-all proof-of-work / timed-lockout scheme. The core specification must incorporate this type of non-privileging scheme as a _required_ element, to preempt any contractual requirements like Microsoft's.

<comment><USER4> I can see why you as a consumer might not want hardware that you can't install custom software on. I can see why it might not be the best solution for legitimate non-nefarious engineering problems as well. What I've never related to, however, is the application of a moral dimension to someone selling such a thing.

I'm all in favor of pragmatic arguments for openness and hackability for the sake of good engineering, transparency, generosity, customer expectations, etc. Those are all good things. I've never gotten the sense that the absence of those things are necessarily evil, however. You clearly do, based on your choice of words.

Maybe that's the difference between the (for lack of a better term) BSD philosophy vs. RMS. The BSD (permissive?) philosophy seems rooted in the sense that sharing is a virtue, and not sharing is neutral (not necessarily evil). RMS' philosophy has always felt like, sharing is neutral, and not sharing is evil.

It's a gross generalization, but copyleft vs. permissive reminds me of western vs. eastern religions. The FSF philosophy is defined by a large number of very strict thou shalt nots, defined as carefully and precisely as possible. Permissive licenses like BSD/MIT/Artistic/Apache/etc. are defined by their lack of conditions, which usually just amount to "do whatever you want, but you can't sue the author".

Similarly, one of the ways western vs. eastern religions (from the outside looking in, at least) feel different is the focus on not being evil, by being aware of all of the behavioral laws you shouldn't violate, vs. the focus on trying to attain enlightenment by trying to elevate yourself. Stamping out bad behavior vs. encouraging good behavior. I see the merits of both, but for whatever reason the latter has always been much more relatable for me. I wonder if an individual's preference of copyleft vs. permissive is correlated with whether they think humans are inherently evil, vs. humans being inherently good or neutral. As cynical and pessimistic as I feel about humanity sometimes, deep down I do have a conviction that people are inherently good. It might be naive but I've never been able to totally shake it.

<comment><USER3> > _Maybe that 's the difference between the (for lack of a better term) BSD > philosophy vs. RMS_

I like your characterization of this, but keep in mind you're proceeding to apply a moral dimension here ;)

> _I wonder if an individual 's preference of copyleft vs. permissive is > correlated with whether they think humans are inherently evil, vs. humans > being inherently good or neutral. As cynical and pessimistic as I feel about > humanity sometimes, deep down I do have a conviction that people are > inherently good._

Most people have an internal narrative whereby they are doing good, yet we still get emergent evil behavior. I tend to look at good/evil in terms of describing constructive end results, rather than as intent behind individual actions.

Pragmatically, I'm seeing an awful lot of Free software that has been locked down through one scheme or another, making it non-Free for its end users. Since the intention of at least some of this software was to be Free for end users, I'd say nullifying that goal is moving in an evil direction.

While fewer restrictions is indeed "simpler", such a regime isn't necessarily sufficient to achieve certain goals. When something is existentially defined as "base primitives", complexity will build on top of it to undermine the goals that fostered the axioms. Only by defining universal quantifications on behavior can specific qualities be preserved through time.

</comment></comment></comment><comment><USER5> IMHO UEFI is an overly complex solution that seems to be optimised for multibooting in various complex ways, a use-case that is probably _extremely_ rare; how many "average users" do you know which have more than one OS natively installed on their machine? And of those, how many have more than two? Especially in this era of VMs, multibooting is becoming increasingly rare.

On the other hand, BIOS boot is optimised for the overwhelmingly common case of one OS; select a boot device, load its first sector into memory, and jump to it. The BIOS does not need to know at all about filesystems, partitioning, or other things which are more at the OS level, which I think is a good application of the principle of "separation of concerns"; UEFI however seems to have become much of an OS itself, with all the associated complexity and increased failure modes of such. Two memorable incidents:

[https://news.ycombinator.com/item?id=11008449](https://news.ycombinator.com/item?id=11008449)

[https://news.ycombinator.com/item?id=5139055](https://news.ycombinator.com/item?id=5139055)

 _There is no BIOS specification. BIOS is a de facto standard – it works the way it worked on actual IBM PCs, in the 1980s. That's kind of one of the reasons UEFI exists._

It's more like a collection of specifications, but you can find much of the important ones here and much of the API is in the _IBM PC /AT Technical Reference_:

[http://cs.dartmouth.edu/~bx/blog/resources/bios.html](http://cs.dartmouth.edu/~bx/blog/resources/bios.html)

The particularly relevant one for this article is here:

[http://www.phoenix.com/resources/specs- bbs101.pdf](http://www.phoenix.com/resources/specs-bbs101.pdf)

(Note the URL and the date of the document.)

 _The design doesn't provide a standard way of booting from anything except disks. We're not going to really talk about that in this article, but just be aware it's another advantage of UEFI booting: it provides a standard way for booting from, for instance, a remote server._

Network booting in the BIOS world is almost always done through PXE.

<comment><USER6> Thats interesting. I've booted UEFI machines using PXE and judging from the PXE ROM versions displayed, the PXE code hasn't changed much, on my boxes at least.

I would agree that UEFI _is_ an OS of its' own. But thats the whole point isn't it? That way writing drivers for peripherals can be done in C, etc.

I have a BIOS machine I cant boot using my SD card for example, which I need to do. I imagine writing (or porting) a driver for UEFI to interface with that SD card reader would be an order of magnitude simpler than doing the same by modifying my BIOS (which I've seriously considered doing).

<comment><USER7> The BIOS way to do this is with an Option ROM. During boot, the BIOS scans for a special signature, and jumps to a fixed offset in that block. The OPROM init routine then hooks the various software interrupts that the BIOS, boot-loader and other OPROMs use to read from disk.

You can inject a custom one into your BIOS image, but if you have PCI/PCIe available, you can get cards that have an OPROM onboard. The easiest/hacky way is an old NIC that someone has reverse engineered enough to flash its OPROM; you're just using it for the OPROM, the NIC functionality is unused.

<comment><USER6> Very interesting thank you. You may already be aware, but when I first saw the replies here mentioning Option ROMs I immediately thought of the thunderstrike EFI vulnerabilities for Macbooks. I've yet to actually mess with them, but apparently that was how they worked at least in the first generation, I haven't followed the research much further yet [[https://trmm.net/Thunderstrike](https://trmm.net/Thunderstrike)]. So since option ROMs, for obvious reasons, survived the "transition" to EFI, does this mean the same mechanism could be used in BIOS machines? At least this might also have implications for backporting peripheral drivers too (for whatever reason)...

</comment></comment></comment></comment><comment><USER8> Excellent summary.

A decade ago I was very well versed in how the bits and bytes of the MBR, partition table and BIOS boot process worked.

Since then, I was completely out of the loop, and this filled me in.

</comment><comment><USER9> I wrote a 5-minute tutorial on this (would appreciate feedback): [http://www.boostedsignal.com/blog/a28c2988-151e-42cd-b0ab-1c...](http://www.boostedsignal.com/blog/a28c2988-151e-42cd-b0ab-1ce73bafa714.html)

<comment><USER10> I like how it is concise and still seems to get the important points across. Well done.

<comment><USER9> Thank you! That was my goal. I banged my head so much against the wall trying to understand the process, even though it should have been conceptually simple. If there are other topics (not necessarily computer-related) that you feel might benefit from a short explanation as well, feel free to let me know, and if I know about them I'd love to write about them.

</comment></comment></comment><comment><USER11> _> Unless you're dealing with Macs, and quite frankly, screw Macs._

See also yesterday's story about the 2016 MBP not supporting Linux...

[https://news.ycombinator.com/item?id=12924051](https://news.ycombinator.com/item?id=12924051)

<comment><USER12> You mean yesterday's story about Linux not supporting the latest MacBook Pro?

<comment><USER11> Yeah, that. Oops, looks like my phrasing got me downvotes. Oh well.

<comment><USER13> It got an upvote from me, for what that's worth.

</comment></comment></comment></comment><comment><USER14> With all due respect for the Author (the article is seemingly a very nice one) there is the everstanding confusion between disk and partition/volume. I had hoped that - particularly for something intended to explain things - I would have had not to read "format a disk". Just in case, a disk is partitioned (in either MBR or GPT "style"), and the partition(s) or volume(s) on it thus created are later formatted with a given file system.

<comment><USER15> You can certainly format a whole disk. I did it, the disk in my laptop doesn't have a partition table at all. The whole disk is one big encrypted filesystem. The laptop boots off of an external USB stick.

<comment><USER14> Sure you can, but that disk won't be bootable in UEFI (it may still be in BIOS). The article is about UEFI booting, with parted he checks the partitioning "style", not the actual formatting. >See that Partition table: msdos? This is an MBR/MS-DOS formatted disk. If it was GPT-formatted, that would say gpt.

</comment></comment></comment><comment><USER16> Read was interesting, but I found myself pushing through by force of curiosity. It was hard, since the post itself was very agressive to me - <USER2> reader.

</comment><comment><USER17> The flaw with UEFI is that the list of installed operating systems is stored in the motherboard's NVRAM and not in the EFI system partion on the disk itself.

When your motherboard dies and you need to put in a new one, now you have to boot off a CD/DVD/USB Stick to get to the boot manager utility. Then you have to figure out the command line parameters since the first time the OS installer did it for you.

At minimum the motherboard setup menu should give you FULL editing cabability of the NVRAM variables. I should be able to add, modify and delete any and all entries without having to boot something first.

Last motherboard I tried using the efibootmgr on got bricked. And there was no way to clear it like you can with normal BIOS NVRAM.

<comment><USER18> This is nonsense. UEFI has a fallback path and all common OSes can or do install a fallback bootloader which restores the NVRAM variables.

<comment><USER17> You may not agree with me but don't call it nonsense.

From the article about the fallback path: "This mechanism is not designed for booting permanently-installed OSes."

Plus there is only one fallback path so we're back to the situation of multiple OSes fighting over the fallback path.

And from the article a disadvantage of the BIOS: "It's inconvenient to deal with – you need special utilities to write the MBR, and just about the only way to find out what's in one is to dd the contents out and examine them."

But now with UEFI we need a special utility to manipulate the EFI NVRAM variables. The motherboard setup only lists the names of the entries. No editing and no listing of the details.

So my criticism is valid. The information stored in the UEFI bootmanager NVRAM should have been in a file(s) in the system partition.

</comment></comment></comment><comment><USER19> 2014</comment>


How to build a Moon base - <AUTHOR> https://www.nature.com/articles/d41586-018-07107-4 <comment><USER2> There's a great book called "Welcome to Moonbase" by Ben Bova (1987) written from the perspective of an established colony on the moon providing an information handbook for someone recently relocated to live and work there. A lot of ground is covered, from governance, technology, buildings, recreation, mining, food, farming. I have fond memories of reading this book, and this article reminded me of it. I think about that book often, it was, like this article, very inspiring. It's interesting to see how the ideas about moon habitation have, and have not, changed over the past 30 years. The mention of "3d printing" the building structures in this piece, for example.

<comment><USER3> I would expect tunneling to take the place of printing buildings, for a couple of reasons. First, you can process the tunnel machine tailings for resources like water ice, which you can then use for air and fuel and biology. Second, you can live in the tunnels, which would give you as many meters of regolith as radiation shielding as you wanted. And, interesting side fact, the Boring Company TBM will fit inside a BFR.

[https://www.lpi.usra.edu/meetings/nlsc2008/pdf/2028.pdf](https://www.lpi.usra.edu/meetings/nlsc2008/pdf/2028.pdf)

[https://eps.utk.edu/faculty/taylor/Miller- radiation%20measur...](https://eps.utk.edu/faculty/taylor/Miller- radiation%20measurement.pdf)

<comment><USER4> Not to mention the added benefit of doing some valuable underground research during the process.

Wouldn't it be game changing if we found fossils really deep inside the moon as we did this? If the impact that hit Earth to form the cluster of rocks that eventually settled into what is now our Moon, I wouldn't expect it to pulverize earth into dust but rather into large pieces. Imagine of some fossils were encased in some of the larger rocks, which later settled deep inside the lunar core.

<comment><USER5> The problem is, burning those fossil fuels takes oxygen. Oxygen on the moon would probably be too precious to use that way.

<comment><USER6> Pretty sure they're talking about paleontology, not fuel.

</comment></comment></comment></comment></comment><comment><USER7> Standard reading on the subject and in my opinion should be added to the hacker/maker space bible is the 1980 report by NASA on the subject "Advanced Automation for Space Missions" [1]

In it they review all manufacturing capabilities to date and extrapolate them to zero-g fractions there-of as well as hypothesize the ability of self replicating robotic systems, with a final ephiany of energy break even using Von Neumann replicators of only 15 days... using 1970s technology! A thought engaging dry must-read.

[1] [http://www.islandone.org/MMSG/aasm/](http://www.islandone.org/MMSG/aasm/)

<comment><USER8> NASA source for this report:

[https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/198300...](https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/19830007077.pdf)

</comment></comment><comment><USER9> This year's FIRST Robotics Lego League Jr's theme is building a moon base. This article is likely too dense for the 6-10 year old crowd but can offer the coach/mentor some discussion ideas!

[http://firstlegoleaguejr.org/](http://firstlegoleaguejr.org/)

</comment><comment><USER10> Have they figured out how to deal with the abrasive lunar dust yet?

[https://www.sciencedaily.com/releases/2008/09/080924191552.h...](https://www.sciencedaily.com/releases/2008/09/080924191552.htm)

<comment> T-A [https://en.wikipedia.org/wiki/Suitport](https://en.wikipedia.org/wiki/Suitport)

<comment><USER10> That doesn't really solve the problem. The dust will still get into the joints and abrade the outer layers.

<comment> T-A It solves a big part of the problem.

As for the suits, they were designed half a century ago, before the problem was known (and still worked well enough to get the job done). There has been some progress since then:

[https://www.seeker.com/space/exploration/new-spacesuit- syste...](https://www.seeker.com/space/exploration/new-spacesuit-system-could- repel-destructive-moon-dust)

</comment></comment></comment></comment><comment><USER11> The Mars Society recently started a competition to design a Mars base. [http://marscolony.marssociety.org/](http://marscolony.marssociety.org/)

Edit: Actually surprised no one had submitted that to HN so have taken the liberty.

</comment><comment><USER12> Bearing in mind the moon exerts a significant influence on our planet (driving the seas tides and influencing the speed of the Earth's rotation), if humanity somehow managed to do this i.e. set up industry on the moon, how long would it be before what we did had an environmental impact on the earth?

That is to say, what would be a safe level of the moon's mass being lost to mining before we had to stop and at what point would we realise the moon's influence has become unpredictable?

</comment><comment><USER13> I am thinking people have to spend lot of time in VR to see colors (greenery, sunlight and other colors). Moon base looks so grey/dark dust with dark skies. I would die to see green tree!!

</comment><comment><USER14> Generally I'm pro-colonisation of space, but does anyone else feel uncomfortable about changing the face of the moon? Initially, any human presence of the moon will be indistinguishable from Earth, but if we look forward 25-50 years from the first colonistation what sort of impact will we have on the on the aesthetics of the moon by mining the regolith?

Life has been looking up at that luminous surface for hundreds of millions of years. Is it important enough to preserve or should we prioritise human progress? Maybe we can find compromise by building major installations and mining operations on the far side of the moon.

<comment><USER15> We seem pretty happy to chop the tops off mountains here on earth

</comment></comment><comment><USER16> Step 1 : get to the Moon

<comment><USER17> It's just one small step, I hear.

</comment></comment><comment><USER18> There's no carbon on the moon.

</comment><comment><USER19> 'How' is the easy part.

'Why' is what they should really answer.

</comment><comment><USER20> Plan B. Crash dozens of asteroids onto the moon at a few designated locations. (Use rocks that might hit the earth or pass fairly close). Offer free mining rights to companies on a first-there-first-served basis.

<comment><USER21> Why crash asteroids on the Moon when its surface is covered in impact craters from ancient strikes. The moon is geologically dead and has no atmosphere, so anything kicked up in those old impacts should still be around.

<comment><USER20> Hmm, interesting. I was thinking that we could mine fresh debris from the asteroids themselves, in concentrated form. Plus saving the earth, of course.

<comment><USER22> GP's point is that plenty of asteroids have crashed into the moon in a recent enough time frame that the debris is still "fresh". After all, there's not much erosion on the moon.

<comment><USER20> Yes but not all in the same place, so the ore would presumably be less concentrated?</comment></comment></comment></comment></comment>


Here's Facebook's plan to crack down on fake news - <AUTHOR> http://www.recode.net/2016/12/15/13967928/facebook-fake-news-plan-abc-snopes-politfact-factcheck <comment><USER2> Good

But even yesterday I reported a story and corresponding page as "hate speech" (It was not exactly that, but it was a heavily misrepresentation of facts with the intention of hate speech/bigotry) for fb to return my report as "does not violate standards" OKAY THEN

But yeah, allowing things to be flagged as fake news will make things better

<comment><USER3> Censorship is never a good thing. The 4 groups they picked are all hyper partisan.

<comment><USER4> They're ideological. Not partisan. The reason they seem to be leaning towards one party is due to the lack of choices in the two party system of the US.

</comment></comment></comment><comment><USER5> The AP is multinational by design and revenue, Snopes is multinational through revenue, the other three are US centric, all five are US based.

I presume this is a bone thrown to those upset and there is no real intention to solve the fake news issue - if there was there would be real international involvement and incentivisation.

</comment><comment><USER6> Very easy. Ignore user reports, because it will only lead to abuse. And wait for court orders to take down links, articles or infringing statements. As everyone else does. Don't give up on free speech.</comment>


MerbCamp Keynote and Introducing Nanite - <AUTHOR> http://brainspl.at/articles/2008/10/11/merbcamp-keynote-and-introducing-nanite

<comment><USER2> Looks like a rebuild of OTP, did the author have this in mind?

<comment><AUTHOR> I was definitely inspired by the erlang work I've been doing lately. Took a lot of those principles and applied them back to a ruby mentality.

<comment><USER2> Thanks for getting back to me. How do nanite and Vertebra relate to each other?

<comment><AUTHOR> nanite is for individual application where you know every part of the system is allowed to talk to one another. Vertebra is for wide area networking and assumes hostility so does a lot more security isolation.

Vertebra is for controlling clusters and clouds at large while nanite is for building scalable backends for individual apps.

<comment><USER3> Any idea on when Vertebra will be released ?

</comment></comment></comment></comment></comment><comment><AUTHOR> sorry about the slow download speeds. We will get it on a faster mirror later today and I will repost the link.

<comment><USER4> Great talk - thanks! I've mirrored the file (and changed the extension to .wmv). On mac I had to use VLC to play it and change the audio to Track 2 to hear it. It was definitely worth the effort though to get it downloaded and playing.

<http://mattjaynes.com/keynote-ezra.wmv>

<comment><USER5> Thanks for the mirror, I wasn't able to download the original file, speed was under 2k/s!

</comment></comment></comment><comment><USER6> Could you explain file streaming in more detail?

<comment><AUTHOR> The file streaming works by chunking up a file and broadcasting the chunks to an exchange. Any agents subscribed to the exchange will get a copy of the file. There is a small state machine for re-assembling files and each set of file packets is tagged with a token for easy re-assembly even on a multiplexed channel where multiple files are streaming at once.

<comment><USER6> Cool, thanks for replying.

</comment></comment></comment><comment><USER7> Nanite, looks cool we have built a similar system for requesting and completing jobs, but it would be nice to work on top of a well built and maintained framework.

</comment><comment><USER3> Also watch the other talks at MerbCamp, they are streaming live. <http://www.merbcamp.com/webcast>

</comment><comment><USER8> Will somebody please post a mirror? Tried downloading video from his blog and it is dog slow...

<comment><USER3> See above, somebody posted a fast mirror.

</comment></comment><comment><USER9> great presentation! i saw it by webcast and it was really good experience, like i was there.

</comment><comment><USER10> this could be a game changer</comment>


Apple shuts down Podcaster, again - <AUTHOR> http://almerica.blogspot.com/2008/09/apple-shuts-down-podcaster-again.html

<comment><USER2> I found the original post text just by putting their URL into Google Reader. Gotta love web-based RSS aggregators that cache. Here it is:

It seems that Apple has shut me down. I can no longer provision any more devices. The developers website that had a "remove device" link is now gone. I looked at the help tab but it still lists "removing a device" as one of the options. I guess Apple just shut my account down. I believe that all the copies of Podcaster I released will keep running. I will try to make an update and test it on my iPhone. If it works, I will release it to every user. I would recommend keeping version 1.0.8b around just in case.

On a more serious note, what does this mean for me? All I wanted was for someone from Apple to contact me and tell me how we can work it out so that I get into the app store. Instead, Apple took the cowards way out by simply disabling features in my developers portal. This seems like a childish move for a company that has been proving such high quality service and products in the past.

I plan to make Podcaster for the Android operating system. At least there, I will be welcomed instead of being walked all over. I will also try to port the app to a jailbroken iPhone.

So a final note to developers. Try to stay out of Apples grey area. Don't build anything that would compete with Apple. Don't spend too much time before you submit to the app store because it could be all for nothing.

P.S. Podcaster got a 4.3 our of 5 star from 63 reviews. You can read them at <http://www.nextdayoff.com/reviews.aspx>

UPDATE: I just wanted to add that I am not surprised that Apple has stopped me. The application seems to still be working and can still be installed if you signed up before 9/22/08 Midnight EST. If you are one of these people and still want to try it, email email@example.com I will also be making updates to the application and will still fix a lot of the issues users have bene having. Give me about a week.

</comment><comment><USER3> I think the most telling word in that post was "childish." Apple probably has legitimate concerns here, but by simply shutting him off instead of talking with him directly they are really missing an opportunity to develop loyalty with app developers.

</comment><comment><USER4> Apple are doing this to a lot of people. Surely this is anti-competitive?

<comment><USER5> Seriously?

iPhone has 1% of the market, they've got another 79% to go before we're even in the ballpark of antitrust.

<comment><USER6> 1% of what market? Last I checked the iPhone had a wee bit more than 1% of the smartphone market.

<comment><USER7> Hilarious. You're assuming the DOJ is actually trying to prevent monopolies; it seems to me their main motivation is responding to pressure from Congress and corporate lobbyists. If Apple were called into their offices to defend their market share, they would say something like "we have .001 percent of the mobile devices market. This market includes anything with a wireless connection, like laptops and all cellular phones." The DOJ would say "Ok, sounds good to us. No monopoly issues here." (Unless, of course, some powerful Congressperson was pounding on them, trying to cause headaches for Apple..)

As an example, the DOJ just let the only two satellite radio companies merge (Sirius and XM). They allowed them to define the market as "anything that can broadcast music". The market included all normal over-the-air radio stations, internet radio, and (for all I know) iTunes. By that definition, XM and Sirius only owned .01% of the "anything that can broadcast" market, so there were no antitrust issues.

I got a personal look at this when I sold my last company; we were bought by a competitor and the DOJ called us in to evaluate the merger and determine whether there were any anti-trust issues. We defined the market in the broadest terms possible and got absolutely no resistance from them. (Granted, even had we defined the market in narrow terms we still should have been ok.) To this day I'm amazed at how tractable they were.

The system is broken.

<comment><USER6> Actually, I think you meant to reply to my parent post. I don't disagree with you. I'm really seething mad over the Apple app store and iPhone bullshit (guess how many ignored/closed radars i have regarding iPhone and iPhone sdk right now?) and even moreso because a lot of my friends are worried about their future in iPhone development.

But I'm really curious as to 1% of what my parent post was talking about. Not ANYTHING ELSE related to monopolies and damned statistics.

</comment></comment></comment></comment></comment><comment><USER8> This is going to be a PR disaster for apple, from a developers point of view. He may have been asked to pull the blog post until they get time to talk to him about it.

<comment><USER6> You'd think it was a PR disaster a long time ago. Right now it's just tons of seething anger and frustration and stress. I have a fair number of friends worried about their current and future contract work because of the way Apple is handling things.

</comment></comment><comment><USER9> For anyone interested, the blog appears to have belonged to the author of Podcaster. The cached url is [http://22.214.171.124/search?q=cache:MP2KvHTWHQMJ:almerica.b...](http://220.127.116.11/search?q=cache:MP2KvHTWHQMJ:almerica.blogspot.com/) .

It doesn't contain the last post, though.

I'm curious to see how this develops.

</comment><comment><USER10> Did the author take down the post because of the NDA requirements or because it is a retraction or...? What?

</comment><comment><USER11> Apple Do no Evil

</comment><comment><USER12> They even removed the _story_ about Podcaster being shut down!

So... Anyone have a mirror/cache or whatever handy? Google cache is failing on this one.

<comment><USER13> Yup, I can confirm, the blog isn't there as of 23 Sept 2008 21:10 GMT+1.</comment></comment>


Show HN: I made a surf app – whentosurf.co - <AUTHOR> https://whentosurf.co <comment><AUTHOR> Hi HN!

Two months ago I started my journey to learn to code and build my first app. The result is When To Surf, it tells you the best time to surf wherever you are. There's been other surf apps like Magic Seaweed, but they're not usable for beginners and require a manual to use. My app is very simple and easy.

I'm interesting in your feedback.

<comment><USER2> Congrats on making your first app!

I don't surf, but it presents the information nicely :)

Here are a few tips:

1\. Consider putting the 'details' on the results page (instead of giving them their own page). There is definitely enough space, and it might help your users understand how you made your recommendation.

2\. When sites ask for location permissions on the first page load, a lot of users automatically click 'Deny'. One way you might fix this is to wait for the user to come to you, by using a link under the search bar, like this:

                         ___________________
      I want to surf in | San Francisco     |
                         </comment></comment><comment></comment><comment></comment><comment>-
                         Use my current location

3\. In the short term (before you do bigger changes like reorganizing the search bar, if you choose to), "Where you want to surf" should read "Where _do_ you want to surf"

4\. Consider hiding the subscription box until after your user has successfully gotten a recommendation.

Good luck!

<comment><AUTHOR> Hi,

Thank you for the useful detailed feedback.

1\. I tried it before and I users feedback was: I do not understand when actually the best time to surf. Probably my UI was bad.

2\. Is "Use my current location" should be a button after click it should open pop-up and ask for a permission to use location?

3\. Fixed.

4\. You mean after the search or after getting first success load home page with current location?

<comment><USER2> 1\. I tried it before and I users feedback was: I do not understand when actually the best time to surf. Probably my UI was bad.

Haha well whatever works I guess!

2\. Is "Use my current location" should be a button after click it should open pop-up and ask for a permission to use location?

Exactly.

4\. You mean after the search or after getting first success load home page with current location?

Either one. It just doesn't make sense to show it if your app didn't find anything

(Sorry for the late reply!)

</comment></comment></comment><comment><USER3> I like it, it's very simple for me, especially since I don't know one thing about what is a good weather for surfing. :) Too bad I'm in Chiang Mai and there won't be good time. :/

<comment><AUTHOR> Thanks man)

</comment></comment><comment><USER4> Nice, what API do you use to determine the current user's location?

<comment><AUTHOR> I used worldweatheronline.com API. They have free API 500 calls per day for 2 month

</comment></comment><comment><USER5> Don't give up the day job.

<comment><USER6> What a shameful thing to post.

Personal attacks are a bannable offense on HN. To do it in response to someone's Show HN is particularly low.

Since your account doesn't seem to have a pattern of commenting like this, we won't ban you, but if you do it again, we will. It's never ok to treat another user this way.</comment></comment>


VMware GPL Enforcement Suit in Germany Continues - <AUTHOR> https://sfconservancy.org/news/2015/oct/28/vmware-update/ <comment><USER2> I worked at VMware for a couple years and this was a contributing factor to why I left. I know a number of people that felt it was a GPL-violation and refused to work on that product because of it, myself included.

The lawyers in that company have a somewhat different interpretation of the GPL/LGPL than I've seen elsewhere in my career.

<comment><USER3> Are you at liberty to elaborate on how they interpret the GPL/LGPL differently than what you've seen elsewhere in your career?

<comment><USER4> At liberty to elaborate always sounded like a weird phrase to me. Of course he is. As a free citizen in a free society he can speak his mind freely.

<comment><USER5> People can choose to give up that liberty by signing contracts. :-(

<comment><USER6> Well no that doesn't technically mean he gave up his "liberty", it just means he promised not to do it at risk of being sued for breach of contract. That's all. You can't be thrown in jail for breaking an NDA.

<comment><USER7> But you can end up in bankruptcy court. And of course if you're found guilty of violating your NDA that shows up in background checks which pretty much makes you unemployable in the US (in the tech industry at least).

Basically it seems kind of silly to tightly define it as "going to jail", when the practical aspects of willfully violating an NDA can ruin your life (which may or may not be worse than going to jail depending on circumstances)

<comment><USER6> > Basically it seems kind of silly to tightly define it as "going to jail", > when the practical aspects of willfully violating an NDA can ruin your life > (which may or may not be worse than going to jail depending on > circumstances)

It was specifically referred to as your "liberty" which is incorrect. I never argued that violating an NDA could or could not result in something worse than jail time.

<comment><USER8> What is liberty if not the absence of restrictions on your choices. Clearly, the repercussions described might heavily impact your liberty in that sense.

(For that matter, even prisoners have some liberties...)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> This seems to hinge on the legal nature of the interface between vmklinux (a Linux kernel module created by VMware) and ESXi (VMware's virtualization software). If that interface separates two legally distinct works, then VMware is in the clear; if it doesn't, then VMware has created a derivative work of the Linux kernel and is in violation of the GPL.

I don't know of any settled law about this question; IANAL and I haven't really looked. But I think the distinction that would make the most sense would not be based on anything technical, but on how an API is used in practice, and in particular on whether it's used by multiple unrelated parties. Ie, the same set of function calls can be either an irrelevant division within a single work, or a partition which separates independent works, depending on whether there're several different vendors/programs who call and implement them, or only one, and on whether the author of a new program who wanted to use that interface could reasonably do so.

<comment><USER10> My IANAL impression of the courts is also that they don't want to make a judgement based on technical distinctions, but rather looks at how the work was used and what the intentions was. Did VMware distribute vmklinux without the linux kernel, and was it written with the intention to distribute it was a collected work.

The word "arbitrary separation" also seems to cover intention rather than technical facts. Did VMware create the ESXi intention to bypass copyright, or was it create as a natural part in the development of VMware products.

<comment><USER11> Wonder if they can "fix" this by sponsoring an open source project that would find some token "use" of the interface. Then court can point to it and say -- look, another use!

<comment><USER12> Your usage of the word "token" shows that it _can't_ work.

</comment></comment></comment></comment><comment><USER13> This is further complicated by the precarious position of copyleft in Germany in particular, and the EU in general. In German basic property law, there are certain "rights" of a creator which CANNOT be given away.

The German GPL has some interesting workarounds for a number of these rights; mostly they do it by declaring that the GPL is a contract and not a license. You can give away lots of "rights" in a contract I'd you're explicit.... But not quite all of them. Among the problematic clauses is the one that controls the license of derivative works. Another interesting clause is liability, but that's another conversation.

<comment><USER12> What in the world is "The German GPL"? As far as I know there is no such thing.

<comment><USER14> I don't know about German GPL, but you have licenses like CeCILL which could be called "French GPL" I guess: [https://en.wikipedia.org/wiki/CeCILL](https://en.wikipedia.org/wiki/CeCILL).

</comment></comment></comment><comment><USER15> > Finally, the response explains that vmkernel and vmklinux don't "communicate > over an interface", rather they run in the same process as a single computer > program. Thus, VMK API, as used by vmklinux, is not an "interface" as set > forth in the EU Directive 2009/24/EC.

The directive does not make such a distinction. If running in the same memory space would be a criteria then everything running on a MMU-less system would be a derivative work of everything it uses.

<comment><USER16> The argument is that they are literally the same process, with no API or interface between them. It's instead used like a library, loaded by the linker.

<comment><USER15> Everything in kernel space is "the same process". Using something as a library exactly means that there is an API to use. If the proprietary part of the kernel module directly pokes around in private symbols in the kernel then I can see that there might be a problem, but if only publicly available interfaces are used then it should be under the definition in article 10 as far as I can tell.

<comment><USER17> Reading the examples provided, it seems to be the case that they modified many of the kernel components to call directly into their proprietary component (not via an established abstraction, like driver hooks).

That seems damning.

<comment><USER15> That I agree might be a problem. If the case ends up being decided in favor of Christoph Hellwig based on that then I wonder if what happens isn't just that companies gets a third party to distribute a modified kernel (as source code) with the interfaces they need added and then use that. It may still technically be a violation, but judging intent isn't easy.

<comment><USER18> I think the question is really what resolution you would get. Consider the fictional situation where Company A makes a derived work of the novel Harry Potter without permission. They then sell a license to Company B to make derived works of their work. Company B writes a novel in the Harry Potter world, thinking they have a license to do so.

When Company B is sued by the copyright holder of Harry Potter, they hold up their license and say, "See. We have permission". My (very limited) understanding of copyright law is that the court would quickly find the license invalid since Company A never had the ability to grant the license. Company B would lose the lawsuit, pay some money and have an injunction against distributing their work. They would then be invited to sue Company A to recover their costs.

</comment></comment></comment></comment></comment></comment><comment><USER19> I should probably know this, but can anyone explain to me why other service providers like AWS don't have to release the source code of things like their brand of Xen running EC2 hypervisors?

Does it only apply if you resell / package the source code as a deliverable product? Where is this line drawn between software downloaded as a binary vs. software delivered to you in a hosted fashion with an API or similar (i.e. SaaS)?

<comment><USER20> Amazon don't distribute any of their Xen-derived code, so they don't have to give the source out either.

This is something that the GPL version 3 tried to fix.

<comment><USER21>
      > Amazon don't distribute any of their Xen-derived code,
      > so they don't have to give the source out either.
      >
      > This is something that the GPL version 3 tried to fix.

This is something the AGPL ([https://en.wikipedia.org/wiki/Affero_General_Public_License](https://en.wikipedia.org/wiki/Affero_General_Public_License)) tried to fix.

<comment><USER22> Well, it's never been tested, and I think that companies are not sure if it's safe to use it ever. I don't exactly know how much of the stack you have to provide the source for.

</comment></comment></comment></comment><comment><USER23> Took me a while to get that they are using the Linux kernel as a library, i.e. [https://www.gnu.org/licenses/gpl- faq.html#MereAggregation](https://www.gnu.org/licenses/gpl- faq.html#MereAggregation) applies.

I thought they have a kernel module with a GPL wrapper, like the NVidia graphics module which would be more contentious.

<comment><USER5> For what it's worth, the FSF's opinion (and they wrote the GPL) is that the nvidia blob is no different and that the Linux developers should defend their copyleft. I really don't get Linus's position in that he refuses to defend his copyleft here while at the same time gives nvidia the finger.

edit: oh, I remember I tried to ask him once, and he called me a Stallmanite or something like that and sent me some insults.

<comment><USER24> Both Nvidia and AMD bypass legal issues because they don't distribute mixed GPL and proprietary code. Basically their proprietary kernel modules is being linked with Linux kernel by end-user and this totally fine for GPL as long as result is not distributed.

<comment><USER5> > Both Nvidia and AMD bypass legal issues because they don't distribute mixed > GPL and proprietary code.

Not in the FSF's opinion. User-does-the-link does not change whether the blob is derivative work or not.

<comment><USER24> Personally I find Linus opinion on this more reasonable. There is nice collection of statements about GPL modules on LKML: [http://yarchive.net/comp/linux/gpl_modules.html](http://yarchive.net/comp/linux/gpl_modules.html)

So blob drivers that clearly wasn't originally designed for Linux and work via GPL-ed shim (which isn't the case with VMWare) may be not derivative work. Anyway I think it's wrong to say that kernel developers (at least Dave Airlie as we talk about DRM/GPU drivers) don't do anything because they do have anti- leech rules that actually working:

\- Some features only exposed as GPL-only as their usage clearly prove that driver is derivative work of kernel. See DMA-BUF.

\- Open source kernel drivers that only used by proprietary code aren't going mainline. This is benefit whole ecosystem more than GPL-only kernel with blobs in user-space.

So it's become more expensive to maintain out-of-tree drivers and not all features are available for them. This actually working because Intel does have open source kernel and user-space driver even if their Android user-space is proprietary. AMD also switching to hybrid model.

Personally I find these rules more reasonable than attempts to enforce copyleft that are extremely hard from legal standpoint as there is no single copyright holder. For example FSF require to sign CLA to contribute to their projects in order to relicense code to newer GPL version or enforce it.

<comment><USER25> > Some features only exposed as GPL-only as their usage clearly prove that > driver is derivative work of kernel.

The marking or not marking of things as GPL-only has no affect on whether or not using those things makes the using thing a derivative work. Whether or not X is a derivate work of Y is determined by how much of Y's copyrighted expression is incorporated into X.

<comment><USER24> Thanks for clarification. Sadly I'm not an expert in copyright law and post of "jnky" about GPL_ONLY probably explain better what I attempted to say.

What I wanted to say is that GPL_ONLY exist and does what it's intend to do: make it clear to driver maintainers (Nvidia as GPU vendor) that certain functionality shouldn't be used within proprietary code.

Of course this isn't actual legal limitation, but Nvidia also want to have open source drivers for Tegra and certainly don't want to get a finger on their next pull request.

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> Is there a list or registry of products which are GPL derivative [0] but only release source code under NDA, e.g. Xen derivatives?

[0] [https://twitter.com/rootkovska/status/518037037480697857](https://twitter.com/rootkovska/status/518037037480697857)

<comment><USER27> GPL bans adding restrictions on redistribution and other such rights. Automatic contract termination is the best you can do legally to try to get around GPL.

</comment></comment><comment><USER28> "Unfortunately, VMware has explicitly asked for the filings not to be published and, accordingly, Conservancy has not been able to review either document."

Anyone more familiar with German law that can explain this to me? Normally, civil filings are open to the public in the U.S., which seems like a good thing, so I'm wondering why German law allows this.

</comment><comment><USER29> I'll boycott VMWare over this!

Oh, wait, I haven't used their stuff in _years_. Heh.

</comment><comment><USER30> ugh why vmware, I really like their products

hope they make this right

<comment><USER31> They've been fighting for years to _not_ make it right. I don't think there is any scenario in which one could say they have "made it right". VMware is a company that won't participate ethically with the Linux community, even when given ample opportunity to do so, and they should be shunned for that behavior.

It's not even asking that much, honestly. The kernel components are a very small portion of the VMware stack, and are pretty clearly an extension of GPL code. The argument VMware is making would effectively destroy the GPL, if successful. Any company could fork a GPL project, build some extensions with some minor handwaving in the general direction of abstracting it out into "modules" and call it a non-derivative work.

This isn't, from my understanding, merely a binary blob that gets loaded into any standard Linux kernel, as some proprietary Linux driver modules do; there's seems to be a steady state around this use case, where Linus and the community is reasonably comfortable with it (even though some other GPL projects take a harder line on this sort of extension). But, what VMware is shipping is a broken version of Linux (i.e. one that does not have the protections of the GPL for end users).

The conversation with VMware has been going on for years, since it was first noticed they were non-compliant with the BusyBox license. VMware has always had no respect for the GPL. Which would be fine, if they stayed the fuck out of Linux. But, if they want to play in the Linux market, they need to play by the rules that the rest of the industry plays by.

</comment></comment><comment><USER15> So if VMware loses this what would prevent e.g. Microsoft from claiming that the kernel driver in Process Hacker is a derivative work of the Windows kernel? Or worse, anything that patches a Windows DLL is a derivative work of that dll?

<comment><USER32> Try to incorporate _any_ code from the Windows kernel into your proprietary product without permission, and count the seconds until lawyers from Redmond start calling.

<comment><USER15> Who said anything about that?</comment></comment></comment>


All around, we see dazzling technological change, but no progress - <AUTHOR> http://www.foreignaffairs.com/articles/136402/george-packer/the-broken-contract

<comment><USER2> The article is behind a paywall? I could only read the first two paragraphs.

<comment><USER3> [https://duckduckgo.com/?q=Iraq+was+one+of+those+wars+where+p...](https://duckduckgo.com/?q=Iraq+was+one+of+those+wars+where+people+actually+put+on+pounds.+A+few+years+ago%2C+I+was+eating+lunch+with+another+reporter+at+an+American- style+greasy)

[http://www.oddbloke.ca/2011/10/26/novemberdecember-2011-the-...](http://www.oddbloke.ca/2011/10/26/novemberdecember-2011-the- broken-contract/)</comment></comment>


Why we will never see a 15-hour work week - <AUTHOR> http://www.sphere-engineering.com/blog/15-hour-work-week.html

<comment><USER2> I saw this posted earlier. My records show it was here:

[https://news.ycombinator.com/item?id=7661641](https://news.ycombinator.com/item?id=7661641)

Have you deleted and re-posted?

 _Edit: Indeed, I see it was you that posted it at 18:50 BST, 17:50 UTC. I guess you did delete it and re-submit. Any particular reason?_</comment>


How can a disease with 1% mortality shut down the United States? - <AUTHOR> https://www.quora.com/How-can-a-disease-with-1-mortality-shut-down-the-United-States/answer/Franklin-Veaux?share=1 <comment><USER2> A well written overview. I think what is sometimes not read well by 'why don't we..' type comments is that the non-deterministic quality of this is quite strong. We can say your predicted risk as an 80 yo is higher than an 8 yo but we can't say much else. So, the 1% mortality and how it distributes over a cohort by age, sex, (ok more men) co-morbidities (ok so overweight, type-2 and pre-diabetic) .. but then we can't really say "oh, you're the high risk for subsequent heart attack" or "yep: you'll face life crippling mental acuity hits" or "we have to amputate now"

Ask anyone if they will take 1 in 100 risk and they will casually say yes. Ask again, if you present them with real risks of life changing outcome at shorter odds, they may reflect.

I wouldn't stand in front of a 1-in-100 russian-roulette machine personally.

<comment><USER3> Agreed. The penalty associated with the risk is important too. Probability theory and statistics can get us the risk fairly easily. But putting a number on the penalty associated with failure is a different problem altogether. If getting sick meant a 1:10 chance of getting a really bad headache for a week, I would take that chance. But if it was a 1:1000 chance of death I would probably not take the chance.

</comment></comment><comment><USER4> The problem is not the virus itself but instead it's impact on the availability of medical care.

If you wish to talk about statistics the death rate associated with the virus is declining in the US even though the numbers of infection are surging. That is because medical services are better learning what treatments are effective. The death rate will continue to decline inversely to the growth of infection rate only so long as medical treatment is available.

The real problems occur when medicine is over whelmed by the case volume, particularly when hospital beds fill up. When hospitals lack the space to provide appropriate care and triage is when the associated death rate shoots up from declining below 0.1% to over 10% (greater than 100x). Quality and availability of care impacts all medicine. For example appendicitis is an easily treatable and relatively common medical problem in the US, but without available care the patient will die of a blood infection. If that example is not properly triaged due to lost medical capacity then it shifts from a minor concern to a potentially fatal problem.

<comment><USER5> >That is because medical services are better learning what treatments are effective.

Not sure that's true. The average age of infected is much lower than it was a couple months ago. It's likely that more people who aren't at risk of serious complications are being infected now and we're testing much more than we had been -- including people w/o symptoms. A couple months ago most people who weren't considered at-risk couldn't get a test even if they had symptoms.

<comment><USER6> Anyone have a source for cases over time by age?

I've heard it hypothesized but never supported. I agree it's plausible but we need evidence before confidence.

<comment><USER5> [https://www.theatlantic.com/ideas/archive/2020/07/why- covid-...](https://www.theatlantic.com/ideas/archive/2020/07/why-covid-death- rate-down/613945/)

>In Florida, the median age of new COVID-19 cases fell from 65 in March to 35 in June.

<comment><USER6> Perfect thanks!

</comment></comment></comment></comment></comment><comment><USER7> Before you panic, note that this post is full of incorrectly computed conditional probabilities.

It claims 19% of the whole population will be hospitalized at 100% infection rate. This seems high, but let's go with it.

It then cites a study saying 18% of hospitalized patients' hearts showed evidence of scarring.

Later, it computes:

> _62,358,000 hospitalized. 59,076,000 people with permanent heart damage._

Multiplying the hospitalized count by 18% gives 11,224,440, or 3.7% of the population. I'm assuming that no people that avoid the hospital will have heart damage. The post assumes there is no correlation between disease severity and hospitalization.

The true rate is probably somewhere in between, and probably closer to 4% than 18%.

<comment><USER3> 4% of patients having heart permanent damage is still 13,128,000 people. Qualitatively, those numbers are equally hard to grasp, so why would it be any less terrifying?

<comment><USER7> Heart scarring (what the study looked for) is extremely common. For instance, flossing your teeth commonly leads to an opportunistic infection that leads to heart tissue scarring.

If most of the 13M are expected to be impacted in some way by the heart damage, then the number is terrifying, but the evidence doesn't back that up.

Also, there's a huge difference between 1/5 people need heart surgery, and the more realistic 60% * 18% * 19%, which is closer to 1/50.

To help put that in perspective: ~1/2 of Americans suffer from heart disease.

<comment><USER8> Can you provide a link for the claim that "flossing your teeth commonly leads to [...] heart tissue scarring"?

After some googling, it appears that the opposite is true. If you don't brush and floss your teeth, you increase your chances of gingivitis, which can become a systemic infection.

</comment></comment></comment></comment><comment><USER9> I just realized that this has similarities to the September 11th 2001 (9/11) terrorist attack.

A relatively small investment resulted in the USA invading Iraq, which had absolutely nothing to do with it, killing hundreds of thousands of civilians, indebting the US population for a few trillion dollars, and generally causing a ridiculous over-reaction in just about every way possible.

Has anyone seen any comparisons yet? If not I can't imagine it won't last. Both are astonishing failures of civil leadership and governance.

</comment><comment><USER10> [http://archive.is/JvTzm](http://archive.is/JvTzm)

</comment><comment><USER11> Sweden hasn't even been worse than the 2000 Flu season yet. The flu also does long term damage.

[https://www.reuters.com/article/us-health-coronavirus- sweden...](https://www.reuters.com/article/us-health-coronavirus-sweden- mortality/sweden-records-first-week-with-no-excess-mortality-since-pandemic- struck-idUSKBN23F1WK)

And I don't recall the 2000 Flu season shutting down Sweden/USA/World

Quora might be a good jumping point when doing research, but like 4chan and other hive minds you still have to think.

<comment><USER12> > Sweden hasn't even been worse than the 2000 Flu season yet.

Can you post the link to the Swedish statistics? I think you're counting flu and covid death differently.

For flu I think you're using a mix of all cause mortality and statistical modelling. For covid I think you're using either "died after being tested positive for covid" or "covid was mentioned as a cause on the death certificate".

<comment><USER11> Ok, the article actually is in Sweden's worst month for covid (April) it was better than 2000 and 1994.

This also talks about May -

[https://emanuelkarlsten.se/swedens-two-corona-months-are- not...](https://emanuelkarlsten.se/swedens-two-corona-months-are-not-more- deadly-than-the-flu-of-the-90s-but-that-does-not-mean-that-everything-is- normal/)

<comment><USER13> What people are trying hard to ignore is that we are seeing these numbers _despite_ shutting down the country and everyone using masks and washing hands and avoiding contact.

With a business as usual attitude we would see death rates 100 times higher.

<comment><USER14> There's no solid evidence of that.

</comment></comment></comment></comment></comment><comment><USER15> From the statistics I've been seeing, _of the people who get it_ , the mortality rate is closer to 10%. And the virus is so damned contagious that with no counter measures taken everyone would get it with say 18 months. And that would literally decimate the population. Not to mention all the devastating follow on covid-19 side effects some of which, it appears, never go away.

<comment><USER16> A breakdown of mortality by age group and prior health conditions shows that not everyone is equally at risk.

<comment><USER2> Do you have good insight into the effect on the economy of randomly killing a high percentage of type-2 diabetes? I know we like to ideate the poor into this state, but have you considered the effect on the economy, if the supersize-me generation at large in the economy at all levels suddenly took a king-hit?

<comment><USER17> We can roughly estimate this from the effects of the 1918 flu, which killed way more people, and killed healthy, working age people. The overall effect on GDP was tiny compared to the effect we're seeing from the lockdowns.

<comment><USER18> Two totally different economies. People will self-lockdown much more extensively today. Economies were much more local 100 years ago. GDP is also a meaningless metric when measured in currency, and is anyway antithesis of lockdown/war times. Sweden didn't lockdown but is still hit hard economically, and is more isolated today than surrounding countries.</comment></comment></comment></comment></comment>


Ask HN: Which chair do you code in? - <AUTHOR>

I am moving into a new apartment and am setting up a new office space. My previous chairs were pretty garbage.
Which chair do you code in?
Links appreciated. <comment><USER2> I'm on a Steelcase Leap I paid $200 for. It's way better than my old chair but you can probably get better if you were planning on paying full price.

Next chair I'll probably go for something with a headrest.

<comment><USER3> Another Steelcase Leap fan here. I've got one at home and at work.

Not really worth paying full price when they are available in great condition on eBay (same with a lot of high quality office chairs IMO).

</comment></comment><comment><USER4> Personally I'm using the IKEA Markus Chair. It's an excellent chair for the money and I'd definitely recommend it.

Link: [http://www.ikea.com/us/en/catalog/products/00103102/](http://www.ikea.com/us/en/catalog/products/00103102/)

<comment><USER5> I use that chair too (at home). Just about everyone who's visited and tried it said it was one of the most comfortable chairs they've used. Only disadvantage (for me at least) is that the arm rests aren't adjustable, but they are removable.

</comment></comment><comment><USER6> I have the Herman Miller Embody [http://www.hermanmiller.com/products/seating/performance- wor...](http://www.hermanmiller.com/products/seating/performance-work- chairs/embody-chairs.html)

At my last job I used the Stealcase Leap (v1) [http://www.steelcase.com/en/products/category/seating/task/l...](http://www.steelcase.com/en/products/category/seating/task/leap/pages/overview.aspx). It was good but not so good that I wanted to come home from work and work in the same chair.

</comment><comment><USER7> We just picked these up for most of our team. Everyone seems very happy with them. Very adjustable and I've found it to be quite comfortable and sturdy. [http://www.amazon.com/Lorell-Executive-High-Back-Chair- Fabri...](http://www.amazon.com/Lorell-Executive-High-Back-Chair- Fabric/dp/B000Q5XTE8/ref=sr_1_1?ie=UTF8&qid=1402027871&sr=8-1&keywords=lorell+chair)

</comment><comment><USER8> Roche Bobois Mistral Armchair [1], when not standing or sitting on the ball.

But around here we just call it _the chair_. It's perilously difficult to escape from.

[1] [http://www.roche-bobois.com/#/en- US/products/all/armchairs/a...](http://www.roche-bobois.com/#/en- US/products/all/armchairs/all/all/all/455/fullscreen/)

</comment><comment><USER9> [http://www.needforseatusa.com](http://www.needforseatusa.com)

This is my specific model: [http://www.needforseatusa.com/chair_dxracer_master](http://www.needforseatusa.com/chair_dxracer_master)

After almost a year of using it I have no regrets; the chair is comfortable and sturdy.

</comment><comment><USER10> The Markus chair from Ikea. It's a fantastic chair if you have a head:

[http://www.ikea.com/us/en/catalog/products/00103102/](http://www.ikea.com/us/en/catalog/products/00103102/)

</comment><comment><USER11> You might consider the FreedMan: [http://freedmanchair.com/](http://freedmanchair.com/) although perhaps wait until it's received some user reviews.

<comment><USER12> It looks intriguing, but why are there no photos of someone sitting in it? They have photos of a man holding it up in the air, but that is not the primary use case of a chair.

Ah. If you go to Kickstarter there are some (small, I cannot find a way to enlarge them) photos of the chair in use. They should put some of those on their actual website.

</comment></comment><comment><USER13> None: I use a stand-up desk at work, and at home I alternate between standing, sitting on the floor in front of the coffee table, and lying on the couch.

</comment><comment><USER14> I code and work standing with a high chair to sit for 10 mins per hour, relieving some stress on the feet and legs, if need be.

</comment><comment><USER15> Herman Millar Mirra chair.

I prefer them to the Aeron - a higher back makes them good for people with longer torsos.

</comment><comment><USER16> I like my Swopper [http://www.swopper.com](http://www.swopper.com)

</comment><comment><USER17> Have an Aeron at home and a Knoll Life @ work.

</comment><comment><USER18> Herman Miller Aeron size C

</comment><comment><USER19> A $20 exercise ball.

</comment><comment><USER20> i'm standing.

</comment><comment><USER21> In which chair do you code?

Ha.</comment>


A lawyer's analysis of Bilbo's contract in The Hobbit - <AUTHOR> http://www.wired.com/underwire/2013/01/hobbit-contract-legal-analysis/

<comment><USER2> "...given the contract's length and its role in the film... a lesser studio or artist might have been tempted to go with several pages of lorum ipsum"

So he's basically praising pointless lawyering! :)

Or a more charitable reading: he's geeking out as we might about the terminal commands in a 'hacker' movie.

</comment><comment><USER3> <off topic> I really can't stand it when websites like Wired usurp my back button. They even do it in a way where:

\- Clicking back twice in rapid succession doesn't bring me back;

\- Clicking and holding back button and selecting HN doesn't take me back;

which is a feat few other websites manage to pull off. I wonder if they had a team put together just for this purpose. Would have loved to be a fly on the wall in one of those meetings.

"How can we keep people on our site longer?"

"Sir, I know! Lets not let them leave!"

"Brilliant! Someone make this guy CEO stat!"

Utterly frustrating and inexcusable for a technology website.

</sorry>

<comment><USER4> This pissed me off as much as you and I couldn't help, but take a few minutes and dig into the site a little. I found the following:

* This only affects me in Chrome (using the dev channel).

* Firefox Aurora (20.0a2) with noscript off doesn't have the back button 'hijack'.

* A quick debug in Chrome with F8 (stop script execution) and immediately pressing back shows there's a few 'hidden' functions being run -- not sure how to view those quite yet.

<comment><USER3> Oh man, you're much braver than I.

FWIW I'm on Chrome 24.0.1312.52 OSX.

I tried to take a gander but it's such a jumbled mess of affiliate/ad bs that I doubt even they'd be able to fix it.

</comment></comment></comment><comment><USER5> On the issue of the Dwarven Kingdom, the point about choice of law is further complicated by the fact that Thorin, a party to the Contract, is the de jure ruler of Erebor (or 'King Under the Mountain'), and, depending on the Folk of Durin's constituional/legal tradition, could be considered a (even the only) judge - or else might issue royal decrees to overturn a ruling.

As the Shire lacks an effective government, and particularly lacks awareness of matters outside its borders, Bilbo could easily be strung up under a foreign legal system if he crossed Thorin.

<comment><USER6> Concerning your point about Thorin being the only judge:

 _> Disputes arising between the Contract Parties shall be heard and judged by an arbitrator of the Company's choosing_

By that clause, the company should be able to choose Thorin as the arbitrator regardless of the fact that he's the King Under the Mountain. That fact alone would put Bilbo in dire straights if, like you said, he ever crossed Thorin.

</comment></comment><comment><USER7> Proof that a Lawyer can suck the life out of anything?

<comment><USER8> The Hobbit is a story for kids; and by the point grown men make million-dollar budget movies out of it, there isn't much of the original life left, anyway.

The original contract is super short; the movie contract is extremely bloated... maybe it really does take a lawyer to call that bloating "an impressive piece of work". Impressive would have been to make a children's movie out of a children's book, instead of doing whatever with it and staining the careers of otherwise fine actors, just because it can't fight back and money is nice to have.

If this offends anyone; good. The existance of all these movies, their treatment of legit stories for children to turn them into brainless crap ala Star Wars, offends me as well.

<comment><USER9> > If this offends anyone; good. The existance of all these movies, their > treatment of legit stories for children to turn them into brainless crap ala > Star Wars, offends me as well.

Well, the inability to appreciate beauty or subtlety in a movie offends me. What's the more brainless, the person who watches a movie and contemplates it, or one who dismisses it without a thought?

<comment><USER8> _What's the more brainless, the person who watches a movie and contemplates it, or one who dismisses it without a thought?_

Without a thought, and without paying attention to any indicators.. or merely without watching the full-length movie? Huge difference. But I appreciate the irony of telling me how my decision-making process goes without having the faintest idea of it, not to mention my ability to appreciate beauty or "subtlety". Subtlety.. I might watch The Hobbit one day just to think back to this post and laugh.

<comment><USER9> So you made your comment without having even seen the movie? That seems to give you even less of a position from which to call something "brainless crap" surely? If I've mis-spoken because I haven't fully appreciated your decision making process, it's because you didn't make enough of an effort to articulate it in the first place.

But whatever. I think I'll take a lesson from The Hobbit myself right now, which is don't feed the trolls, for nothing good will come of it.

<comment><USER8> I've seen LOTR, and I read the book (at an appropriate age too haha). I "know" The Hobbit is no less pompous and derpificated a conversion. Just looking at _still images_ of it is enough for me. The good guys are good looking, the bad guys are ugly, music tells you what to feel every step along of the way, all of that crap; I know it, and I don't see anyone denying it. So I'm simply trusting my intuition on this, you know?

How much shovelware do I have to take before I am allowed to skip one? I don't even think Tolkien was the greatest author ever (there's just so much random stuff in LOTR for example), but for me there is bounds and leaps more humanity in one of any of those books than in all LOTR movies combined; so unless I missed the dude remarking that LOTR was horrible, and that he is making The Hobbit differently to make up for it, I know that for me this thing is going to be neither subtle, nor beautiful. I just didn't want to point all of this out in detail because it makes me seem like such a snob, I'll take the "troll" thanks. If this stuff is fine art for you, I'll be rolling in the dirt having fun.

<comment><USER10> > How much shovelware do I have to take before I am allowed to skip one?

Before you skip one? As much as suits your preference, of course!

But in this case, you took pride in offending other people, some of them with more information than you (e.g. they watched the movie). And you appear to be engaged in a protracted (3-comment) campaign to defend your analysis of the movie. It should be obvious that this campaign is doomed to failure, given that you explicitly admit ignorance of the actual subject matter. How much shovelware do you have to take before you successfully persuade other HN commenters of your analysis of the shovelware? Probably all of it.

I only mention all this as a suggestion on how to better enjoy your time commenting on fora, and how to help others to better enjoy their time. Just a suggestion, YMMV.

Maybe off-topic: I wasn't very impressed with the LOTR movie adaptation either, and I'm not bothering to see The Hobbit. But, you know, whatever. The books are available any time I want to re-read them. No big need to attempt to offend passers-by with my disdain.

<comment><USER8> Well, I seem to have at least 5 peeps who silently agree -- two who vocally disagree. And you didn't mention anything in the movie, you know, pointing out a flaw in what I said; and you won't even watch it yourself - so what exactly are you berating me for? lmao...

 _you explicitly admit ignorance of the actual subject matter_

Bullshit. Read it again, slowly this time.

 _No big need to attempt to offend passers-by with my disdain._

There is plenty of need. Nietzsche said "it's not your job to be a fly swatter", and I was all like "fuck you Nietzsche, you can't tell me what to do!". It's nice for you if that's not your thing, but not really relevant to me otherwise.

<comment><USER11> I can understand an appreciation, but a need seems pathological.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> Wow. Didn't realize a lawyer could have such nerd cred. Respect.</comment>


Ask HN: how productive and resource are you? - <AUTHOR>

I just wanted to ask HN the ways you manage your time and get work done. Work you do, such as programming projects, your startup and etc. Personally, I have been very unsatisfied with my productivity lately because I have set myself high goals and am struggling to complete them. Right now I am feeling a little discourage and need some advice from you guys. It would be great if you could share your stories on resourcefulness. <comment><USER2> You should focus on your I/O ratio, the balance between getting input (learning) and producing output (creating new knowledge).

I've found when there is no balance there is no productivity: if you read too much without writing you'll get frustrated by not producing anything; when just writing code without reading you'll realize your work was not fully productive, in the meantime some nice technologies were published which would make you far more productive if were used.

</comment><comment><USER3> divide your goals into smaller sub-goals, that way it'll be easier to manage and finish them, don't bite off more than you can chew</comment>


If It's Too Good To Be True, It Probably Is - <AUTHOR> http://www.informationsecuritybuzz.com/thom-langford-good-true-probably/

<comment><USER2> If it SOUNDS too good to be true, it probably is?</comment>


Brave Zoom Competitor - <AUTHOR> https://together.brave.com/ <comment><USER2> From the creators of "what if we fought ads on the web by making our own ads you can't block and attaching a cryptocurrency to it" comes video calling that doesn't work on Firefox. No thanks.

<comment><USER3> Ads are here to stay unless human nature about paying for shit changes. Brave's approach while still having ads may nor may not be worse than FireFox who receive the majority of their revenue by partnering with search engines, who, y'know, mine your data and dont pay for it

<comment><USER2> We don't need to guess about Brave's approach, it is worse: [https://practicaltypography.com/the-cowardice-of- brave.html](https://practicaltypography.com/the-cowardice-of-brave.html)

<comment><USER3> Wow, thats a long piece. He ends his essay with

> You know what would've been brave, Mr. Eich? Charging users for your > software—on the idea that personal privacy is worth it—and puncturing the > myth that web browsers must be free.

Which my point you were replying to already addressed. People dont like paying for shit.

> Or helping publishers find a way to induce more readers to pay for the > material they find valuable, without the unnecessary indirection of ads and > cryptocurrency. Like I do.

No indication how much money he makes "his way" or if he would make more with ads. No indication how to "induce more readers to pay". It may work on a single blog but doesnt work when you are scaling.

</comment></comment></comment></comment><comment><USER4> I think the main problem I (Along with many others I know) have with zoom is that it basically requires you to download and install something before you can join a call. Obviously you can call in but if you want good quality video you have to download their app. Being forced to download the Brave browser in order to join a call just seems like blatantly unreasonable bar of entry. If blocking website ads wasn't enough for me to download the browser, video calls with only other people who have download the browser certainly won't be either.

<comment><USER5> Well you also get a more privacy oriented browser as a perk. :)

<comment><USER6> maybe they could bundle an entire OS that's privacy enabled, that would be a bigger perk?

</comment></comment></comment><comment><USER7> Looks like they're using Jitsi Meet: [https://github.com/brave/jitsi- meet](https://github.com/brave/jitsi-meet)

<comment><USER8> Seems odd that it doesn't work on Firefox in that case, as Jitsi meet works on Firefox. I wonder what they've done / added that lead to dropping support for Firefox.

Edit: I guess it's strategy, pushing more people to use Brave browser, rather than an actual limitation of the software.

<comment><USER9> It literally just checks whether navigator.brave.isBrave(). The following Greasemonkey script is sufficient to fool it:

        // ==UserScript==
        // @name        Very brave
        // @match       https://together.brave.com/*
        // @grant       none
        // ==/UserScript==
        navigator.brave = { isBrave: () => true };

</comment></comment></comment><comment><USER10> Any page with actual details? This just says "download brave", which I don't want to do.

<comment><USER3> if you are running brave browser, it just allows you to launch a video call, gives you a link to share

<comment><USER11> It is very strange that they don't even try to give non-brave users any details.

<comment><USER3> agreed, was just explaining.

</comment></comment></comment></comment><comment><USER12> Sounds like a good idea. We need more competition-- and if it increases privacy, all the better.

</comment><comment><USER13> Where's the case of this being a true Zoom competitor without some type of comparison, or any other info that pertains to the specific solution it is supposed to be the answer to?

 _Scratches head.

_ Me = Zoom user/admin that doesn't love Zoom.

<comment><USER14> The person who posted this link claims it's a "Zoom Competitor" with the title. I don't necessarily think Brave believe it's a direct competitor.

</comment></comment><comment><USER15> Sorry, Zoom has a Linux client. That makes them awesome.

</comment><comment><USER16> Wasn't that something Firefox had implemented for a while before scrapping the feature for some reason?</comment>


Ask HN: Ebook or Membership website which is better? - <AUTHOR>

Hi HN Community,
I have written a well researched content on a particular web design niche, to monetize the content I have 2 options either I can sell it as an ebook or create a membership website, but I am confused which one to go for
Ebook:
Pros: >Easy and fast to implement >Simple HTML page + e-junkie >Easy for users to buy and download
Cons: >Once it is downloaded it will be uploaded on all file sharing servers
Membership Website: Can use WP + membership plugin
Pros: >Membership content usually doesn't get copied and uploaded on file sharing servers
Cons: >Implementation will take some time >Users have to create a separate userid/pwd which seems to be a bit of work for them
Plz share your 2cents, advice and experiences :) <comment><USER2> I think the biggest pay off may be from the membership site, but you'll have to keep it updated. You should update it with a lot of content like once every 6 months. And you should probably do big launches that day with a limited number of seats (but "leak" information about what's coming during the 6 month period). When doing the launches you should also partner with other big sites in your niche to bring you traffic, and so you can let a lot of people know about it at once.

This model comes from <http://teachingsells.com>. He also owns <http://copyblogger.com> which has over 100k subscribers, but he also partnered with others, and in the 2 launch days they managed to make $800,000. They have a in-depth course on how to make membership sites, but it's pretty expensive. It was $1600 lifetime membership fee then. However, they also have a forum where all those members can partner up for other projects and so on.

So you could go this route, too - charging a pretty high fee if you're content is very good, but it will be very hard to grow it from the ground up if you don't partner with some big sites.

As for the e-book idea, you might have a chance to make a lot of money if you make it a Kindle e-book and sell it for $0.99 or $1.99, which is the limit for impulse buy. If you're market is not that big, it might not be wise to price it so low. Either way, I think it's best to partner with some sites that can let a lot of people know about it at once.

If it's really good content, and it's good for their readers, and they also stand to make some money from it, I don't see why it wouldn't work. It's probably best to coordinate this so you have a "launch day" where everyone writes about it in the same day or so. If you can make your e-book sell a lot at once, you might get picked up into Amazon's best sellers, and then you'll get even higher volume. Again, one of the ways you can manage that is by making the e-book very cheap so it sells in bigger volume.

I would prefer the membership route because it has bigger potential for growth in the long term and more "stickiness". But it's probably not a bad idea to start off with an e-book, become a "renowned" author, and then get some of your readers to join your new membership site.

<comment><AUTHOR> Thanks a lot

</comment></comment><comment><USER3> You might consider a "micro-continuity" style website. The user pays like a membership site, but it is a fixed number of payments, and they get new content fed out in increments as they pay. So if you can split your content into 6 modules for instance, you could see it for 6 equal payments over 6 weeks, or something along those lines.

Pro -> Less up front commitment than a membership site (assuming recurring billing as long as you are a member), gives you reason to contact users over and over again for the duration of the mini-course, potentially creating opportunities for subtle upsells.

Con -> Cap on earnings, potential for users to cancel before the course completes to try to get whatever guarantee is offered, users have to follow the pace you set, also a little harder technically to setup.

Your call, just wanted to give you another option. As to the choices listed, ebook prices seem to be watered down. If you are very good at writing sales copy, an ebook may still be worth doing, but IMO, if priced right a membership site should give you a better return.

<comment><USER3> Oops, forgot the other main pro -> no need to update content unless you are updating to keep it current as users don't expect anything more than the content you sell, where-as with a membership site users generally expect continual updates.

</comment></comment><comment><USER4> I would personally go the ebook route, getting people to sign up for a recurring membership to a site that may or may not be frequently updated would probably be the biggest hurdle.

A one-off payment for something they can download and keep is much more appealing imho.

Regarding the piracy issue, try ways of dynamically creating a PDF that will embed the users name & address in the footer of each page. Seen it done before and can act as a deterrent.

<comment><AUTHOR> Thank u very much</comment></comment>


Hacker Newsletter - <AUTHOR> http://www.hackernewsletter.com/

<comment><USER2> Can I request a text/plain version of this? I saw no option and while the confirmation email did contain both MIME types, Mail.app removed the functionality to prefer plaintext in Mavericks.

</comment><comment><USER3> "curated by hand" \- that's redundant. You could simply write "hand-picked" or "curated", although the latter is definitely more of a buzzword these days.

<comment><USER4> I wouldn't say it is redundant. Digitally curated content is a thing now and sometimes its nice to be reminded there is a person at the other end of the content you are consuming. There may be a better way to say it, but I don't think you can assume that curation implies a human touch anymore.

<comment><USER3> I mostly assume that 'curated' means someone's playing buzzword bingo because the word has pretty much lost most of its meaning.

<comment><USER5> To be fair, I started using that word back in 2010 when I started Hacker Newsletter and it wasn't much of a buzzword at the time. I put the "by hand" in there b/c so many others use automated processes to create similar things.

</comment></comment></comment></comment><comment><USER6> There's nothing on a privacy policy? Or maybe I just missed it?

Would be pleased to know my email address isn't going to be sold on :).

</comment><comment><USER7> If you are looking for a daily newsletter for top 5 HN Post, signup at [http://top5hn.launchrock.co](http://top5hn.launchrock.co)

Stats after creating the landing page in last 24hours: 944 Page Views 101 Signups

Newsletter Stats 41% Open Rate 40% CTR

</comment><comment><USER8> This is cool, shame the last issue was July 2013.

<comment><USER5> Yeah, sorry for the confusion. I had a script that was suppose to keep that updated... but it broke and I obviously haven't fixed it. I will get that fixed. Issue #190 goes out this Friday.

</comment></comment><comment><USER9> I want an RSS feed

</comment><comment><USER10> I have seen this more than 10 times. Why this posted again?

<comment><AUTHOR> I haven't seen it even once. I just discovered it today. Judging from the number of upvotes, I'm not the only one.</comment></comment>