Ironclad Apps: End-to-End Security via Automated Full-System Verification - <AUTHOR> http://research.microsoft.com/apps/pubs/default.aspx?id=230123 <comment><USER2> That's impressive. Proof of correctness has been slowly advancing for years. The version of L4 that manages the cellular air link in most smartphones has been formally verified. Drivers for Windows have been formally verified to not crash the rest of the OS since Windows 7. A few CPU designs, notably AMD's floating point processor after the Intel divide debacle, were formally verified. This is another step forward.

There are a few self-contained products that could be verified now. A secure BGP gateway and a secure DNS server are within reach. Since those are often in standalone machines, they're good candidates for this approach.

(I used to do this stuff. It's embarrassing how long ago. "[http://www.animats.com/papers/verifier/verifiermanual.pdf"](http://www.animats.com/papers/verifier/verifiermanual.pdf"))

<comment><USER3> > There are a few self-contained products that could be verified now. A secure > BGP gateway and a secure DNS server are within reach. Since those are often > in standalone machines, they're good candidates for this approach.

I completely agree! There's lots of crappy but crucial components of networked systems ("the cloud") that we rely upon not to be bugged, that could do with a healthy dose of verification. While the examples you picked are excellent candidates, what's even more fascinating is that even if we only had a few _extremely dumb_ systems verified correct - such as a trusted box that did nothing but provide a verified incrementing counter - that itself is surprisingly useful. The Ironclad paper does discuss this in Section 3.3, but it's worth looking at the description of the TrInc paper as well: [http://research.microsoft.com/apps/pubs/default.aspx?id=7836...](http://research.microsoft.com/apps/pubs/default.aspx?id=78369)

<comment><USER2> Right. The Internet needs a few "tough nuts" like that. BGP and DNS servers are good places to start because they're 1) in wide use, 2) important, 3) usually standalone, 4) not too big, and 5) attack vectors.

Next up should be a Kerberos server, which is a central security controller for high security networks. A major vulnerability in Microsoft's Kerberos server was announced three days ago:

([https://www.us-cert.gov/ncas/current- activity/2014/11/18/Mic...](https://www.us-cert.gov/ncas/current- activity/2014/11/18/Microsoft-Releases-Patch-MS14-068-Vulnerability))

 _" The Microsoft Windows Kerberos KDC fails to properly check for valid signatures in the Privilege Attribute Certificate (PAC) included with the Kerberos ticket request. A domain user may forge the information contained in the PAC to request higher user privileges than should be allowed. Since the KDC does not verify the signature correctly, it will award the user the requested privileges, effectively making the user a domain administrator and allowing complete compromise of the entire domain."_

Yes, there's an exploit. Applying the patch isn't enough, either.

 _" The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain. An attacker with administrative privilege on a domain controller can make a nearly unbounded number of changes to the system that can allow the attacker to persist their access long after the update has been installed."_

</comment></comment></comment><comment><USER4> Summary:

* TPM at the root of trust.

* CPU state cleared to known-good using SKINIT to reset a core.

* "Formally verified" kernel/stack.

* Dafny, a safe language to write it in.

* Verifiable machine code, like Google's NaCl (verifiable x86 subset in fact)

That's great, but there's still a bunch of issues this doesn't solve, and it's a stretch to call this "end-to-end" or "full-system". No, the issues aren't goals of the paper, but that's my concern - this is asserting software stack guarantees which the human-side and hardware-side can't provide:

* Compulsion. This relies on a remote chain of trust, which can easily be subverted without your knowledge if the platform owner and another actor collude (or are compelled) to generate a chained cert which allows access to your system.

* Every CPU I've seen which declares an instruction or register is a big "reset switch" for a core _doesn 't actually do that_. Usually a ton of state is left the same as before reset. This leaks information across reset, and can be used to subvert the post-reset core if it isn't careful to manually erase anything it relies on. For example, cache data, TLB entries and even most general purpose registers tend not to be reset.

* Subverting the memory subsystem results in the CPU executing arbitrary code which wasn't what you provided, undetectably, out of reset.

* It is not possible to formally verify an entire platform. This is somewhat unfair of me, but it feels like this is securing the software stack far beyond the capability of the hardware to provide those guarantees.

* Every CPU has bugs which result in information leakage or privilege escalation. It helps that this is only running a verifiable x86 subset, but I've seen plenty of bugs resulting from rare instruction pairing/ordering. Usually they just deadlock a core, but sometimes result in escalation.

So it's great work, but it's an advance way beyond what the rest of the system (human and hardware) can guarantee.

</comment><comment><USER5> TPM and Remote Attestation. This is an article on Microsoft working hard on DRM schemes.

> An Ironclad App enables a user to securely transmit her data to a remote > machine with the guarantee that ev-ery instruction executed on that machine > adheres to a formal high-level specification.

... ...

> Today, when Alice submits her personal data to a remote service, she has > little assurance that her data will remain secure. At best, she has vague > legal guarantees provided by the service's privacy policy and the hope that > the owner will follow industry best practices to secure her data. Even then, > a vulnerable OS, library, or application may under-mine the service > provider's best intentions [46].

If we presume the user is a DRM-demanding media company, the translation is easy to a member of the public:

> An Ironclad App enables a media company to securely transmit data to a > user's machine with the guarantee that every instruction executed on the > user's machine adheres to a formal high-level specification.

... ...

Today, when Alice submits her copyrighted data to a user's machine, she has little assurance that her copyrighted data will remain secure. At best, she has vague legal guarantees provided by the service's privacy policy and the hope that the user will follow industry best practices to secure her copyrighted data. Even then, a vulnerable OS, library, or application may under-mine the digital restrictions management.

<comment> jude- FWIW, their threat model assumes that Alice can't subvert the software with hardware-based attacks. Relying on this system for DRM would be pretty shortsighted, since (1) Alice obviously has physical access to her hardware, and (2) Alice could emulate the hardware in software, and mount "physical" attacks against it without any dedicated equipment or electrical engineering know-how. A simple screen-grabber would circumvent this.

<comment><USER5> That point of remote attestation. If you have the hardware module signs all software and the processor, coupled with an unblockable secure mode that only runs if the TPM authorizes it, then you have created a secure zone in the processor of which only TPM-authorized software can run. This defeats (1) and (2), with (2) having the obvious exception of human-observable components being observable anyways. This does serve DRM nicely. They don't care if you put a camera in front of a monitor for the purposes of DRM.

They coupled this with an OS and driver that is formally verified to eliminated security bugs.

</comment></comment></comment><comment><USER6> > In other words, if she encrypts her personal data with that key, it can only > be decrypted by a software stack that guarantees, down to the assembly > level, that it preserves differential privacy when releasing aggregate > statistics about the data.

Mindblowing, Microsoft Research is pushing out some cracking stuff recently.

</comment><comment><USER7> From the paper:

> Trusted Platform Module (TPM). Deployed on over 500 million computers, the > TPM provides a hardware-based root of trust; that is, it records information > about all software executed on the platform during a boot cycle in a way > that can be securely reported, via an attestation protocol, to a remote > party.

Why does the TPM need to send anything to a remote party? It seems to me TPM was designed much more like a DRM module than a "secure enclave" module.

<comment><USER3> You need the TPM to bootstrap trust from the root. Just as you need a certificate authority to guarantee that an SSH session is end-to-end secure from MITM attacks (or some other out-of-band key signing scheme), you need a way to ensure that the Ironclad system you're talking to over the network is running on the raw hardware, and not in some emulated form. The TPM boot is what lets you do that.

Ironclad Apps make promises like "send us your private data, we promise not to reveal anything about you except through this information theoretically secure differentially private channel". To do so it needs to be running on bare metal, and prove over the network to the user that it is running on bare metal. For instance if it was really running in a VM controlled by an adversary, then the guarantees would be useless as the adversary could leak your information after inspecting the VM's memory. The only way to ensure that you're running on bare metal is with a TPM attestation.

<comment><USER8> >The TPM boot is what lets you do that.

Fine. Where can I go download my TPM key? Perhaps it is etched on the chip or on a sticker?

Nope? What do you mean it's kept from me? Hmm.

<comment><USER9> You can upload one, but not download, since TPM's very purpose is to take hold of the key and never disclose it. Well, not sure if that's true for any module, but this is how it worked on my old ThinkPad X300 (I have no other machines with TPM, they're restricted technology here in Russia, no idea how my X300 had slipped through)

No idea how one's initialized at factory. However, I'm totally fine with TPM if I can control one, that is upload my own keys and use it for my own security. Still, there's an issue lurking around, if everyone's got a factory- initialized module with industry's trusted keys and the majority keeps those defaults, users who don't trust may be a minority that will be just ignored thus either left without any entertainment of forced to submit.

</comment></comment></comment></comment><comment><USER10> ...And then you wait for a RAM error and your security goes out the window.

This has already happened (there was a proof-of-concept attack against the JVM at one point that relied on this).

</comment><comment><USER11> substantiating a scientific argument with a dilbert comic [check]</comment>


TouchCards for Android, share all your social network in one touch  - <AUTHOR> http://www.youtube.com/watch?v=TEfvZJjAVNg

<comment><USER2> what is the purpose of those cards? and what did that person send to those social sites? a card? is it a greeting card?</comment>


Intel In Bed with NSA? - <AUTHOR> http://cryptome.org/2013/07/intel-bed-nsa.htm <comment><USER3> It is really, really hard for me to see this as anything other than utter paranoia. As one of the messages in the thread stated:

> Right. How exactly would you backdoor an RNG so (a) it could be effectively > used by the NSA when they needed it (e.g. to recover Tor keys), (b) not > affect the security of massive amounts of infrastructure, and (c) be so > totally undetectable that there'd be no risk of it causing a s __tstorm that > makes the $0.5B FDIV bug seem like small change (not to mention the legal > issues, since this one would have been inserted deliberately, so we 're > probably talking bet-the-company amounts of liability there).

<comment><AUTHOR> Well, it is documented that the NSA made DES weaker by using less bits for key size (this makes brute forcing easier). I aslo noted that Schiener's AES submission was passed over (I speculate that Rijndael is easier to brute force).

The feds used to fight civilian crypto tooth and nail. Then they allowed it, and in one of the crypto books a story was related that the feds were bummed about RSA and friends. The listener questioned why, when surely their efforts were feeble compared to the government's. The response was the pace of development was much faster than expected.

<comment><USER4> > _The feds used to fight civilian crypto tooth and nail._

Curious. I'd like to read about this. Can anyone post any links?

<comment><USER5> Read up on the Clipper chip: A chip which sort of being promoted to be the "official" way to do crypto in the US. Specifically designed to be decryptable by the NSA via "key escrow".

[https://en.wikipedia.org/wiki/Clipper_chip](https://en.wikipedia.org/wiki/Clipper_chip)

It died when Matt Blaze figured out a way to trick the clipper chip doing encryption that the NSA could NOT decrypt.

<comment><USER6> " Then-Senators John Ashcroft and John Kerry were opponents of the Clipper chip proposal, arguing in favor of the individual's right to encrypt messages and export encryption software."

Wow. What happened?

</comment></comment></comment></comment></comment><comment><USER7> The comments about RdRand being impossible to verify because it's on-chip seem quite reasonable. (Although Intel have tried to be quite open about how it works. [https://sites.google.com/site/intelrdrand/references](https://sites.google.com/site/intelrdrand/references))

I have no idea if RdRand is the _only_ source of entropy for /dev/urandom in the kernel these days but that does seem quite silly. Especially as RdRand is documented as having two error conditions, not enough entropy, and that the hardware appears to be broken.

In any case, here's the LKML thread where it was merged too [http://thread.gmane.org/gmane.linux.kernel/1173350](http://thread.gmane.org/gmane.linux.kernel/1173350)

<comment><USER8> >I have no idea if RdRand is the only source of entropy for /dev/urandom in the kernel these days but that does seem quite silly

If I understand correctly, the idea is to use RdRand to feed the entropy pool (which is also fed by other noise)[1] from which urandom pulls. So it doesn't seem RdRand would be the sole source of entropy if it were to be used in this context.

[1][http://linux.die.net/man/4/urandom](http://linux.die.net/man/4/urandom)

<comment><USER9> Most servers do not have any serious source of randomness (unless you buy another hardware RNG) which is partly why these were introduced (Intel used to have a motherboard RNG, and VIA had on CPU ones years back).

You can buy one of these [http://www.entropykey.co.uk/](http://www.entropykey.co.uk/) which are unlikely to be NSA "certified" instead.

</comment></comment></comment><comment><USER10> If the NSA is working with Intel, they're not going to bother with an RNG... The processor is the most trusted part of the computer security model - <USER2> would you choose bad random numbers as your attack vector?

Relevant talk: Hardware Backdooring is Practical - Jonathan Brossard [https://www.youtube.com/watch?v=j9Fw8jwG07g](https://www.youtube.com/watch?v=j9Fw8jwG07g)

</comment><comment><USER11> This issue just does not pass the rubber hose test. If the NSA wanted and got a backdoor in intel chips there are so many better ways to do it than introducing a bad hw rng. If you wanted one exploit in the chip, why would you pick a hard to exploit one and user controlled one on top of that? It's classic paranoid thinking: People have a choice to use the hw rng or not. So it becomes a big deal. All the while not addressing the non-choice issue like having a potential backdoor triggered by a specific instruction sequence.

<comment><USER12> It also needs to be hard to detect and relevant specifically for crypto operations. So where would you put a backdoor on a chipset?

</comment></comment><comment><USER13> It's safe to assume every core technology company has been compelled to be in bed with the NSA in _some_ form or another. Intel has been anti-trust managed by the government for nearly two decades. Getting access to the monopoly desktop / laptop processor maker would be far too rich a target to ignore.

<comment><USER14> This is why I show preference towards AMD chips even when they have the competitive disadvantage. Any sufficiently large company ends up, through their will or the gov'ts, wrapped up in politics. Which is the one of the larger issues of our age.

<comment><USER15> AMD is probably cooperating with the government on the same level as Intel.

<comment><USER14> Any company with over 1k employees probably is. I'm just saying if there are any systemic backdoors in Intel chips, AMD probably doesn't have them because they are 5 - 10% of the market and the gov't doesn't care to jump through hoops to get them implementing whatever backdoor they want.

</comment></comment></comment></comment><comment><USER16> Would appreciate some sort of a summary. Reading some mile long email exchange just to figure out what the headline is really about makes it kinda tricky.

<comment><USER17> I read the whole thing, but few here would truly feel that my summary of 'paranoia. paranoia everywhere' is not a government plant.

The core concern seems to be the idea that an RNG embedded into Intel's latest kit might actually be a PRNG that could be backdoored by NSA on command somehow with resultant catastrophic effects to crypto primitives on that box, if the Intel RNG were the only source of entropy on the box.

<comment><USER18> Uh, RdRand is definitely a pseudo random number generator. The question is about whether it's cryptographically secure or not, or more specifically, whether it can be or is backdoored.

</comment></comment></comment><comment><USER19> I upvoted but the current title ("Is Linus Tovalds 'evil'?") is downright horrible and I hope a mod will revert it to the original one soon.

<comment><AUTHOR> Linus is (was?) one of my living heroes. But he controls the Linux kernel.

FTA:

"It's worth noting that the maintainer of record (me) for the Linux RNG quit the project about two years ago precisely because Linus decided to include a patch from Intel to allow their unauditable RdRand to bypass the entropy pool over my strenuous objections. " \-- Eugen* Leitl

Linus has close ties to Intel and has for a long time.

<comment><USER20> Yeah, like when he worked for Transmeta, and that stint in the mid 200x's where a PowerPC64 was his main machine?

He may have a lot of Intel connections, but he doesn't seem to be committed to any specific vendor.

</comment></comment></comment><comment><USER21> Submitted a question here: [http://crypto.stackexchange.com/q/9210/2512](http://crypto.stackexchange.com/q/9210/2512)

Feel free to edit the question if you have anything to add!

</comment><comment><USER22> Hanlon's razor help in this kind of discussions. Maybe when Linus took that option didn't saw Intel as something that would intentionally make predictable its RNG for following government orders, and just choose to not reimplement the wheel where it was already available.

Would he take another option since last month? Maybe in the light of this he could take back that choice.

<comment><USER23> Linus does not have the option to reimplement the wheel. Software cannot generate random numbers.

<comment><USER24> > Software cannot generate random numbers.

Can hardware? [0]

[0] [http://en.wikipedia.org/wiki/Hardware_random_number_generato...](http://en.wikipedia.org/wiki/Hardware_random_number_generator#Problems)

</comment></comment></comment><comment><USER25> Intersting discussion, but incredibly bad title.

<comment><AUTHOR> I was trying to be concise. I also put quotes around evil.

<comment><USER26> Looks like it has been flagged, and is now dead. Too bad...

</comment></comment></comment><comment><USER27> This is nothing more than speculative emails.

</comment><comment><USER28> Did anybody look @ [http://leitl.org/](http://leitl.org/)

This email could just as easily be the musings of an insane person, which is what's suggested by the contents of the website.

</comment><comment><USER29> The thing that the thread about is kinda interesting, too. [https://heml.is/](https://heml.is/)

</comment><comment><USER30> One reason it would be a poor decision for the NSA to recommend Intel backdoor the RNG: Intel would be in a position to sell/leak the backdoor secret to other governments.

The NSA would have no way of blocking it from being used to attack the US. And you can't roll out a hotfix for billions of CPUs worldwide.

</comment><comment><USER31> Doesn't the NSA end up using these machines as well? It seems like a lot of work to introduce a flaw that you have work around for you own use later. And if it's a hardware flawu, I doubt even the NSA could demand intel or amd manyfacture seperate batches for their own use.</comment>


Show HN: Yakuza – Scraping framework for Node.js - <AUTHOR> https://github.com/Narzerus/yakuza

<comment><USER2> This looks absolutely great. I am a big scraping nerd, so this will be a nice addition to my toolbox. Just looking at the thinking behind how Yakuza works, I am impressed. Good job, I will gladly provide feedback and contribute where I can if I run into any issues.

<comment><AUTHOR> Thanks, looking forward to your feedback, Yakuza is still a baby but I think it can grow into a very useful tool if the right people come and boost it up <3</comment></comment>


How Ma Bell Shelved the Future for 60 Years by Tim Wu - <AUTHOR> http://io9.com/5699159/how-ma-bell-shelved-the-future-for-60-years <comment><USER2> It was precisely because of Bell Labs that I invested in Lucent back in the mid-90's just as the bubble started going. Their partnership, I imagined, would lead to great things. Did well in the stock (heck, you could do well in any stock then) despite the partnership never really achieving anything.

Bell Labs was a great story. This dark tale of innovation burying and cover-up is even more incredible. One must wonder what other great discoveries lie boxed up in some warehouse.</comment>


IGDA about the Amazon Android Appstore: just say no. - <AUTHOR> http://pastebin.com/cH7PZENi <comment><USER2> I'm surprised the IGDA didn't also call out Amazon's apparent requirement that a developer must allow Amazon to distribute all the software the developer is distributing through other channels. In other words, there's no way to try out Amazon's service with just one title -- it's all or nothing.

<comment><USER3> I was surprised they didn't mention this as well.

Plus, the Timing of Deliveries section.

</comment></comment><comment><USER4> Say hello to the new boss, same as the old boss.

Amazon, Apple et al are becoming new middle men of the digital marketplace. Want to sell content online? If you want mass market exposure we'll have 30-70% of the revenue from the sweat of your brow and you better thank us for the privilege.

I wonder how long until they band together and form a lobby group called the Digital Content Providers Association of America.

<comment><AUTHOR> And, like all middlemen, they very much deserve their cut.

What are you going to do with that pile of books in your cellar if there's no bookshop to sell them for you? Open your own single-book store?

If you build a store, you should certainly get a healthy cut of what you sell through your store.

<comment><USER5> I certainly wouldn't generalize that to _ALL_ middle men. Have you heard about sub prime mortgages..?

<comment><AUTHOR> Ok, probably not all. Let's say "many".

</comment></comment></comment></comment><comment><USER6> Sounds like Amazon is trying to extend to apps the weird pricing racket that's standard in the bookselling industry. A lot of books are cheaper via Amazon than via the publisher's or author's own site precisely because of these kinds of terms, which require you to sell to the bookseller at a steep discount over list price, _and_ simultaneously prohibit you from selling below "list price" yourself, outside the bookseller channels.

<comment><USER7> I don't think an agreement with Amazon is what prevents the publisher from selling at list price. It's the fact that Amazon (and every other bookseller) would simply refuse to buy the books from the publisher if they were being undercut.

<comment><USER8> With billions of dollars on the line, I'd be shocked if it's not in writing.

</comment></comment></comment><comment><USER9> Amazon does however have an incentive to maximize revenue and there is a lower bound to what a developer gets (a percentage of the list price), even if Amazon promotes it for free, so Amazon loses money on that.

I think Amazon is better at optimizing pricing than most game developers are, so I expect this to improve revenue for both Amazon and the game developers. But only time will tell for sure. Panicking is not the right response.

<comment><USER6> I can believe that if Amazon were sticking to terms for its own market, but Amazon is attempting to prohibit anyone who sells through its market from simultaneously trying other pricing strategies in other channels. That seems more like a classic attempt at using market power in one channel to coerce behavior in other channels, rather than competing on the product's actual strength (unlike Google or even Apple).

<comment><USER8> You can try other pricing strategies, it's just that you need to give Amazon the lowest list price. No different than Apple really, requiring your in-app content to match the lowest pricing available.

Amazon and [to a much greater extent] Wal-Mart play these games with physical goods too. It's just you never get to read the terms and big distributors don't complain publicly.

<comment><USER10> _No different than Apple really, requiring your in-app content to match the lowest pricing available._

IGDA says the Amazon terms limit you to the lowest price "available or previously available on any Similar Service" — it's the "previously available" that's the sticking point.

Tweetbot is having a $2.00 introductory sale on the iOS App Store, where the price will eventually go up. If Tapbots were foolish enough to do an Amazon version, they'd be constrained to offer that price forever. Absurd.

<comment><USER8> I don't think Tweetbot would have any trouble launching at whatever list price they wanted on Amazon. Amazon isn't selling iOS apps so the Apple App Store isn't a similar service. Google's Android Market would be though.

<comment><USER10> Your optimism would be touching, if it wasn't coming in the defense of such flagrantly hostile behavior.

Even if this clause did apply only to Android recompilations and not to ports, I trust you'll concede it is not status quo ante with Apple's already- appalling pricing terms.

<comment><USER8> Apple has a monopoly in the iOS app distribution game, so their pricing terms are appalling for a different set of reasons (regardless of what they are you must agree if you want to ship the app). While I think Amazon is playing hardball, they in no way are the only way to sell Android applications. If the terms aren't agreeable, just don't use their store.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'd need to read the Amazon agreement much more closely, but what's to stop developers from gaming this by taking all their apps released on Amazon's app store and making them special "Amazon Editions"?

Then the argument is there that the minimum list price on Google's store doesn't apply, because the Google Edition and the Amazon Edition are two different apps.

<comment><USER12> You can't loophole your way out of a merchant/producer relationship. They decide what qualifies; they'll slap down your loophole and kick you out.

</comment></comment><comment><USER13> The post in the IGDA blog: [http://igdaboard.wordpress.com/2011/04/14/important- advisory...](http://igdaboard.wordpress.com/2011/04/14/important-advisory- about-amazon%E2%80%99s-appstore-distribution-terms-2/)

</comment><comment><USER14> It is curious that there haven't been any prominent developer blog posts about how well an app has done on Amazon's store. Where are the developer comments?

</comment><comment><USER15> I understand the ire, but still... IGDA can pool resources, and are in perfect position to start their very own branded Android store where they can set the rules as they see fit.

No reason why a game specific store shouldn't exist. If the user goes the distance to install the Amazon store, chances are they will install another.

<comment><USER16> It's not a bad idea. Google's choice of game categories in the Market is bizarre, to say the least. There are a few highly specific categories which don't particularly represent popular genres on any platform, and everything else gets dumped in "Arcade & Action".

It's a total misunderstanding of the market, and it does quite a poor job of selling games (at least from a customer's perspective), which is the thing you really want in an app store.

</comment></comment><comment><USER17> Three words people: In App Purchases! If you have a free app, and then use In App Purchasing for your real revenue stream, you won't be affected by these Orwellian terms and Amazon's whims.

It's relatively new on Android, but a number of iOS apps are raking it in this way and giving away the app for free...

<http://mashable.com/2011/03/29/android-in-app-live/>

<comment><USER18> Apple has already closed this loophole, and if this becomes widespread others will too.

<comment><USER19> How did they close it? This is how all my iOS apps generate revenue. They're all free with In-App Purchases. It works great.

Also, why would anyone consider this a "loophole"?

<comment><USER18> Apple are taking their 30% cut, right? I'm not sure how Amazon's terms interact with in-app purchases, but presumably they've thought of this.

If the NYT sells an app with bundled one-year subscription, Apple gets 30%; if the NYT sells (well, sold) an app and a separate one-year subscription, Apple gets nothing. If the original app is sufficiently useless, this "in-app purchase" is clearly just a way of not paying Apple.

(Apple is not free of blame in that particular fiasco, and they take quite a large cut. But taking an equal cut in either case is not necessarily unreasonable.)

<comment><USER19> Either you misunderstood IDGA's letter or you misunderstood gacba's comment, or both. None of this has anything to do with the 30% cut they take, so I'm not sure why you're mentioning that.

The complaint is in regards to Amazon controlling the cost of the app rather than the developer controlling the cost of the app. That's all. Gacba was simply saying that if you don't want Amazon controlling the cost of your app, then make it free and sell in-app purchases. Since Amazon doesn't control how much you sell your in-app purchases for, they lose total control over the cost of your app and the developer gains the control back.

</comment></comment></comment></comment></comment><comment><USER20> From my limited experience (a friend's and my own app in the Amazon store from the first week) the exposure is pretty negligible anyway. I imagine the requirement to enable side loading (not possible with AT&T), downloading another store app, enabling 1 click, etc is really hindering adoption. So I don't think developers need to loose any sleep over this right now.

</comment><comment><USER21> Until Amazon fixes that, there is quite frankly no incentive to use their store for anything that isn't free. I had thought that cross-promotion for software that works with hardware Amazon sells would be win, but until Amazon fixes their pricing policies I've no interest at all in their store. 30% off the top is bad enough but at least you got to determine the price. 20% of list price on a 99-cent app? Really?

FAIL. Call me back when you get your mind right.

</comment><comment><USER22> does anyone know how the free app-a-day promotion is being handled? does amazon pay the developer 20% of the price for each free download?

<comment><USER23> point 9:

"Furthermore, Amazon dictates that developers cannot set their list price above the lowest list price "available or previously available on any Similar Service." In other words, if you want to sell your content anywhere else, you cannot prevent Amazon from slashing the price of your game by setting a high list price. _And if you ever conduct even a temporary price promotion in another market, you must permanently lower your list price in Amazon's market._ "

This seems to imply that if you offer your app in a free-app-a-day promotion, you're required to offer it for free permanently to Amazon, although there's no way that can be correct

[Edit: it seems I misunderstood the parent comment. I'm referring here to free-app-a-day promotions like this <http://www.freeappaday.com/>. I wan't aware Amazon offered something similar

I was saying it looked like if a developer promoted their app on a site like this, point 9 make it look like they'd be forced to offer it for free, forever, on the Amazon store]

<comment><USER24> "And if you ever conduct even a temporary price promotion in another market, you must permanently lower your list price in Amazon's market." seems to not be entirely accurate with regards to the prior statement "cannot set their list price above the lowest list price available or previously available on any Similar Service".

If the _list_ price on the similar service doesn't change, but there is a temporary promotion on the similar service, this condition would seem to _not_ apply.

</comment></comment></comment><comment><USER25> All i see is that most of the top selling apps are already on Amazon Store :/

</comment><comment><USER26> _Amazon steeply discounts a large chunk of its Appstore catalog (imagine: "our top 100-rated games are all 75% off!"). Some developers will probably win in this scenario, but some developers -- most likely, those near the bottom of the list -- will lose, not gaining enough sales to offset the loss in revenue per sale. Amazon benefits the most, because it captures all the customer goodwill generated by such a promotion._

There might be some chance of Amazon doing something like this, but it is important to point out that even in this case the developers of those 100 apps will on average be making more money. Amazon is trying to optimize prices to maximize their own profit and in doing so they also increase it for the developer. Lets look at an example...

Say that Amazon sells n copies of a game per day at the list price of $1. Then they make .3n dollars per day and the writer of the app makes .7n dollars. Now if they lower the price by 75% like the author suggests and sell m copies per day then the app writer makes .2m dollars and Amazon makes .05m dollars. Moneywise, this obviously only makes sense for Amazon to do if m > n6 because they would be losing money otherwise. If this condition is met then the app writer will make at least .2n6=1.2n that day and their profit increased by at least 71% if Amazon was smart about their decision.

As long as Amazon changes a price such that it increases their own gain then it also increases the gain of the developer. In the price range from .2/.7=.286 to 1.0 of the list price this is trivially true because your profits are directly proportional to theirs in that range. In that case you have a minimum increase in profit of 0% but will likely see something higher. In the range from 0.0 to 0.2 of the list price Amazon is losing money to pay you so I'm assuming that this isn't going to happen. In the range of .2 through .286 things get a little more complicated. Look at this plot ([http://www.wolframalpha.com/input/?i=Plot%5B100*%28%28.3%2F%...](http://www.wolframalpha.com/input/?i=Plot%5B100*%28%28.3%2F%28x-.2%29%29*.2-.7%29%2F.7%2C+{x%2C.20%2C.2%2F.7}%5D)) which shows the absolute minimum percent increase in profit that the developer sees compared to list price given that Amazon isn't losing money on the decision. If Amazon thinks that it's a good idea to sell your app for 78% off then you're probably about to start making a lot more money than you would otherwise.

I understand that at first glance .2 of list price sounds scary, but as I've shown above the developer also makes an increased profit whenever Amazon does. This doesn't totally negate the proposition that Amazon might take a loss on your app to help sales elsewhere but they could just as easily take a loss elsewhere to help sales of your app. On average you'll still be making more money. I've assumed throughout this that Amazon knows how to adjust prices to maximize their own profits but I have a feeling that they're pretty good at this. They have a treasure trove of data on people's shopping habits that I can't even begin to comprehend and they're just trying to apply what they've learned to an app store.

tl;dr: The pricing policy actually increases your profits compared to a .7/.3 split at list price as long as Amazon is acting in a way that increases their own profits. It sounds scary at first but it's actually pretty cool that you can have a company as experienced at this stuff as Amazon optimize the price of your app so that you make as much profit as possible.

<comment><USER26> There is one serious problem with this reasoning though. A realistic scenario might be that somebody decides that they want to buy your app and then compares the price at a couple of different app stores and decides to buy it at Amazon because there's a 10% discount but would have otherwise bought it elsewhere. In this case Amazon would have gained profit from the discount while you would have lost it.

How this ultimately plays out for the developer is hard to predict because it depends on how the market develops. If the Amazon store becomes very successful and their audience shops there regardless of whether or not there is a discount then this effect will be small. The terms guarantee that users will only find discounts at Amazon and this will make them less likely to check other stores when they find an app at Amazon even if it's full price. If that's how customers behave then the optimization will stay more favorable for the developer.

</comment></comment><comment><USER27> Just wait folks..remember most device users have do one extra step to get these apps..if we pressure Amazon enough these terms will change..

In my own case I am going with:

1\. Android Market 2\. SlideMe 3 GetJar

..when Amazon changes the terms as it should be pricing only at their market pricing at other markets should not bear on pricing at theirs..its a anti- trust potential violation via the collusion implications of anti-trust law..

<comment><USER28> Users having to go through all of the extra steps just to install and enable the Amazon app is enough reason for not publishing via Amazon's app store.

Also, users have to enable Amazon's 1-click mobile purchasing. A 2nd huge hurdle.

<comment><USER2> That probably won't be true long-term. Amazon is perfectly capable of cutting deals with manufacturers/carriers to get their apps pre-installed; their MP3 app comes with many Android phones.

</comment></comment></comment><comment><USER29> or... be an entrepreneur and take a chance...

</comment><comment><USER30> Any Indie developer with experience on Steam sales to light up this issue?

Seems to me that the arguments of IGDA sound very close to the arguments of the RIAA and real numbers will show a very different outcome, specially for the smaller devs.

<comment> jim-greer I don't see how the numbers could show that this scenario is fair.

\- Developer sets a minimum list price of $0.99 (fair)

\- Amazon has an 80% off sale (fair)

\- Developer later has an 80% sale on Android Market (fair)

\- Amazon can now sell the app for 96% off, because the sale on Android Market resets the minimum list price (unfair)

The developer is punished for having a sale on a competing market by now allowing Amazon to sell the app for $0.04, forever.

</comment></comment><comment><USER31> Kind of paints the Apple / Amazon spat in a new light.

<comment><USER32> What spat?</comment></comment>


An Interview with Vincent Connare, creator of the Comic Sans font - <AUTHOR> http://postdesk.com/blog/comic-sans-creator-vincent-connaire-typography

<comment><USER2> That may be the worst interview I've read. To sum it up:

"Comic Sans has its purpose. I still design fonts, and I do it as a business not as an art. I hate driving."

Just pepper that summary with typographical errors, formatting mistakes, and then remove all the substance. There, I saved you a click-through.

</comment><comment><USER3> _A great font is one that fit's it's purpose._

Sentences like that burn my eyes in any font.

<comment><USER4> Maybe the author just _really_ likes apostrophes and doesn't think they get enough usage.

</comment></comment><comment><USER5> When it comes to Comic Sans, this monologue cracks me up every time: <http://www.mcsweeneys.net/articles/im-comic-sans-asshole>

</comment><comment><USER6> What I got from this is that this guy does not have any passion for typography at all. It's a job title for him.

</comment><comment><USER7> I'll just leave this here. <http://m.assetbar.com/achewood/uuad4vm7n>

</comment><comment><USER8> re: "For every person that doesn't like Comic Sans there are two that love it."

Pro tip: defensive answers like this don't help your case.

I'd like to see the survey results for actual designers; I suspect the dislike to like ratio would be in excess of 99-1.

<comment><USER9> I believe he wasn't referring to designers in that equation. Based on the number of times I've seen Comic Sans used by non-designers I would say he may be correct.

</comment></comment><comment><USER10> DESTROY. WITH. FIRE!</comment>


PHP: The Good Parts - <AUTHOR> http://phpthegoodparts.tumblr.com/

<comment><USER2> This has been done better. Check out the PDF:

<https://jeena.net/php-the-good-parts>

</comment><comment><USER3> I just bursted out in laughter!

</comment><comment><USER4> "No posts yet". Does that say something?

</comment><comment><USER5> You'll never stop posting that "soooo 5 years ago" rants about PHP, would you?

</comment><comment><USER6> hahaha. cruel!</comment>


NSA does surveillance on Santa letters - <AUTHOR> http://www.duffelblog.com/2013/12/nsa-letters-to-santa/#ixzz2oszWOCKj

<comment><USER2> Aha! I new I wasn't being so clever when I referenced Yule-235 in a letter to my aunt last Christmas.

<comment><AUTHOR> Haha. Hope you were not asking for a pressure cooker, etc.

"We're only looking for any unusual presents, like children who ask Santa for pressure cookers, large amounts of ammonium nitrate fertilizer, hyzadrine rocket fuel, things like that. I mean a six-year old with a hammer is bad enough; just try to imagine that same six-year old with a truck bomb."</comment></comment>


Internet centralization is not a conspiracy - <AUTHOR> http://blog.zerotier.com/post/58157836374/op-ed-internet-centralization-is-not-a-conspiracy

<comment><AUTHOR> This article is kind of daft. "Decentralised" doesn't necessarily mean strictly peer to peer, it can mean "write native code, release it under an open license, design protocols to federate".

This way you're not butting up against NAT busting (notably though NAT busting as I understand is a pretty well sorted science at this point, e.g. STUN and friends), but if you don't like your service provider you can still move (or run your own server) and continue to inter-operate.

XMPP ([http://xmpp.org/](http://xmpp.org/)) is a great example.</comment>


The Myth of the Myth of the 10x Programmer - <AUTHOR> https://payne.org/blog/the-myth-of-the-myth-of-the-10x-programmer/ <comment><USER3> 10X programmers DO exist. They aren't just a myth, and they aren't just about knowing when to buy vs build, or when to use a particular framework or toolkit, or how to "mentor" other developers.

Chris Sawyer wrote 99% of the code for RollerCoaster Tycoon in x86 assembly language, with the remaining one percent written in C.

RollerCoaster Tycoon was a beautiful game which still stands the test of time to this day. The fact that a single person was able to build a blockbuster- level game almost entirely by themselves _in assembly_ is a truly impressive feat which very few programmers would even dream of undertaking.

Being a "real" 10X programmer is like being a savant. It's about being FUCKING SMART, and it's about being able to deliver a working, polished product in the same time that a normal team of ten people would be able to deliver it (or in a tenth of the time that a single person might).

<comment><USER4> Not to diminish the achievement, but worth noting I think that RollerCoaster Tycoon was based on his earlier Transport Tycoon engine, so at least he did get to split the work up between two projects.

I have a personal theory the that the average 10x programmer is say 2.5x smarter than average, but also 4x more focused on work, netting a 2.5x4=10x total when you remove all the procrastination and general fumbling around of the average developer.

<comment><USER5> > worth noting I think that RollerCoaster Tycoon was based on his earlier > Transport Tycoon engine,

The 10x productivity comes in large part from the code they DON'T write.

<comment><USER6> And from writing things the right way the first time around rather than on iteration #3 or so.

</comment></comment></comment></comment><comment><USER7> Here is your 10x programmer:

[https://norvig.com/sudoku.html](https://norvig.com/sudoku.html)

"In this essay I tackle the problem of solving every Sudoku puzzle. It turns out to be quite easy (about one page of code for the main idea and two pages for embellishments) using two ideas: constraint propagation and search."

If you gave this task to an "average" developer, how long would it take for them to implement? How many lines of code would it be? Would the implementation be correct? How long would their code take to execute?

        % python sudo.py
        All tests pass.
        Solved 50 of 50 easy puzzles (avg 0.01 secs (86 Hz), max 0.03 secs).
        Solved 95 of 95 hard puzzles (avg 0.04 secs (24 Hz), max 0.18 secs).
        Solved 11 of 11 hardest puzzles (avg 0.01 secs (71 Hz), max 0.02 secs).
        Solved 99 of 99 random puzzles (avg 0.01 secs (85 Hz), max 0.02 secs).

Does the average developer know what "constraint propagation" and "search" mean in the above sense, or remember enough about them from their CS class to recognize them as the right tools and how to implement them?

Also, can the average developer implement a spell checker from scratch on a single transcontinental flight?

[https://norvig.com/spell-correct.html](https://norvig.com/spell-correct.html)

So Norvig is always the paradigmatic example of the 10x developer, for me. Having a broad range of CS techniques at your disposal and knowing how and when to deploy them, is almost a super power.

<comment><USER8> I'm sure Norvig is very good, but I think the sudoku webpage is presenting a finished program in an idealised way, not recording the process he used to write it, false starts and all.

(It seems likely to me that there were some false starts, because eliminate() returns either `values` or False, when both of its callers would be just as happy if it returned True or False.)

<comment><USER7> He didn't give an implementation time for the sudoku solver, but he did say he completed the spell checker in a single transcontinental flight.

<comment><USER9> I don't remember how long it took me to do the spell checker challenge:

[https://github.com/dlang/dmd/blob/master/src/dmd/root/spelle...](https://github.com/dlang/dmd/blob/master/src/dmd/root/speller.d)

but I'm sure it was much longer than it took Peter. This checker is used by the D compiler to look for a misspelled identifier when a symbol lookup fails. The identifiers in scope form the dictionary.

It works surprisingly well. I added it to the Digital Mars C++ compiler as well.

[https://github.com/DigitalMars/Compiler/blob/master/dm/src/d...](https://github.com/DigitalMars/Compiler/blob/master/dm/src/dmc/dspeller.d)

</comment></comment></comment></comment><comment><USER10> > highly productive developers (10x or otherwise) are problem-solving at a > much higher level

This is a very important point, but calling these highly productive developers "10x" doesn't really make sense. They are more like "infinity times" compared to the average when it comes to getting a difficult task done, since the average developer would just get stuck and never be able to invent good designs and solve the difficult problems. Even worse, some programmers are in the negative on many tasks, adding additional complexity and overhead while making little to no positive contributions, especially when you give them a problem beyond their capabilities.

<comment><USER11> Joel Spolsky's "Hitting the high notes" always comes to mind for me when this debate arises.

<comment><USER12> Spolsky is a 10x blogger. Neither he nor any of his employees were ever 10x programmers. There was nothing algorithmically clever about FogBugz or CityDesk or whatever.

<comment><USER13> Did you miss how they cross-compiled Vbscript to PHP? I'd say for a lot of programmers this would have been quite the challenge, algorithmically speaking. And I would classify it as clever. With both the positive and negative connotations of the word.

</comment></comment></comment></comment><comment><USER14> I think part of the objection to 10x programmers is around expectations, self- assessment, and attitudes.

There are people out there who have difficulty working with others. Some of those people feel that this difficulty is because they're so FUCKING SMART and the others are morons who are beneath them. They're extremely difficult to work with in a team environment, but come across as completely confident about their own abilities.

These people are toxic to work with. They drag everyone else in the team down (part of the reason they are productive is that everyone else has to spend time and effort dealing with their bullshit).

Management should spot this and deal with it. But in a lot of situations the "10x" has managed to get into a position where they have a lot of information that the rest of the team doesn't have (deliberately, usually) and getting rid of them would be difficult. And some managers buy into the whole myth as well, and having a toxic "10x" on their team that they have to carefully manage is a point of pride, or something.

This archetype, the lone genius developer who is 10x everyone else, is extremely appealing to some people. Regardless of their actual ability, they start believing that they are this. And worse, behaving like this.

So while, yes, there are some programmers out there who are very productive, the majority of self-proclaimed "10x programmers" you're actually likely to meet are just socially unaware assholes with inflated egos.

<comment><USER15> Being a consultant for a considerable part of my career, whilst sometimes working solo on writing a system from scratch.

In one example, re-writing a system written by 7 team members + architect, taking half the time.. Maybe due to working in an organization without a formal org position.. I had to make sure bad requirements, process, tech decisions etc.. don't get in the way of properly collecting requirements, designing and building this system, seen today as a hugely successful project for this company. I have to say, some people see me as an asshole, no doubt, other's see me as a bulldozer that got the work done and stand behind me and keep in touch to this day.

Our interaction will depend heavily on if you are in my way or not, though I don't consider my self toxic or hoarder of information.

<comment><USER14> I'm glad this appears to give you some satisfaction, but I hope I never have to work with you, or around you, or on any project you've worked on.

<comment><USER16> What is wrong with ignoring and working around toxic people who only undermines the project?

<comment><USER15> Ignoring sounds passive but there is nothing passive about telling people their ideas and cooperation is unproductive (be it people from product, RnD, management, QA etc), you spend much time and energy convincing them their ideas are not concrete, or are going in a bad direction, or are simply bad.. Having the burden of completing the project (successfully!) on me, I have to cut through the BS and provide results, not attend to egos and fragility of everyone involved.. Never the less, I try to be dry and not personal as I can to communicate the situation as simple as possible to the other party.. In my consulting career I learned that being "nice" is not worth it and ends up costing me in mental health..

</comment></comment></comment></comment></comment><comment><USER17> Y'know, productivity is kind of overrated. The programmers who I admire aren't the people who could implement a React CMS in record time, but the people who built React. Or Rust, or Haskell, or FFmpeg. I guess one could argue that the programmers are 10x, 100x or even (10^n)x simply because their work has helped other programmers become more effective, thus through the multiplier effect resulting in massive productivity. Or because you need someone who can work at 10x to build something of large impact. But first, that just means that Large Impact => 10x, not that 10x => Large Impact. Second, that's oversimplifying a massive, nuanced impact into a number for no real reason.

Honestly I suspect the idea of 10x developers was created as a way to explain to managers why you need to pay ol' Leslie over there the big bucks. If you claim Leslie works at 10x the speed and only needs 2x the salary, the math works out for a business major. So I guess that's the reason you need the number.

<comment><USER18> > If you claim Leslie works at 10x the speed and only needs 2x the salary, the > math works out for a business major. So I guess that's the reason you need > the number.

I think that's perfectly justified. So much is lost in software quality because those people think programming as dry labour and outsource to cheap sources, losing so much in future revenues but unfortunately that's not even measurable.

Joel Spolsky put it nicely in a post: It is not that it requires `n` bad programmers to do what one good programmer does. It is that `n` bad programmers can't build what a good programmer builds, no matter how big `n` is or how much time it takes.

</comment></comment><comment><USER19> The concept of the 10x programmer seems to have been drifted from its original meaning. It isn't that there's a coder that is 10x better than a _good_ coder. It is that a lot of people are really bad at their jobs, and a coder that thinks and learns about problems can be far better than those people. It comes from terrible "corporate drone" software developers in the 80s and 90s - <USER2> ones that would takes weeks to developer simple routines. Bring in someone that loves software dev, and they appear magical.

Today, with Google and Stack Overflow, that gap has diminished, but there is definitely people still way better than "average" developers. However, if you have someone that keeps their skills sharp and their problem solving desire sharper, you won't fine anyone 10x - maybe 2 or 3x, at best.

<comment><USER20> Agreed.

I've never encountered someone that I think is genuinely a 10x programmer. I've worked with a few people that thought I was one, which I'm most certainly not, and I've explained that to them.

I've encountered a lot of what I would call .2x programmers though. As you've said, there are a lot of people that are really bad at the job. It's not a slight either - there are a lot of people doing this job that really don't care for it at all.

It's hard to be good at a job you don't enjoy. Especially if life forces you to do it 40+ hours per week.

<comment><USER21> > I've never encountered someone that I think is genuinely a 10x programmer.

I have. (Interestingly, some of these people knew this and had a surprising lack of modesty about it as well…) Usually I think it boils down to being able to have the experience to consistently guess right on things, come up with new ideas, and not get tangled in the weeds: most of them are smart, but not so smart that you're just lost when talking to them.

<comment><USER22> >> not so smart that you're just lost when talking to them

That, BTW, is a sure sign that someone is trying to appear smarter than they really are. Having worked at 2 research labs over the course of my career I know more than my fair share of genius-level people. Without fail, they are humble about it, and can explain complex concepts in a way the rest of us can understand. This is something that just blows my mind pretty consistently actually, and IMO it is a sign of true, deep understanding of a complex subject. The person didn't just memorize formulas (although many of them excel at that as well), they understand why things are the way they are, the real meaning behind it all.

It could be that this is selection bias though, and I only got to know geniuses who aren't also assholes.

<comment><USER23> As Feynman said: you don't really understand a subject until you can explain it to your grandfather.

<comment><USER24> And that's how I explained the cloud to my grandma: the company buys big daddy servers which make baby computers that the company sells for profit. She was so happy she finally understood what my job was at the time.

<comment><USER25> When I read this gestation/birth analogy, it makes it seem to me like a large piece of hardware assembles and ejects a small piece of hardware. I assume in- person there was more detail or different imagery?

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I personally know many programmers who are easily 10x average programmers. No question about it.

They crank out code that is easy to read, easy to understand, works right out of the box, and gives years of trouble-free operation.

Sean Parent is one of those programmers. It's pretty obvious when he describes how he replaced a nightmarish tangle of code that re-invented a simple rotate algorithm.

It's a remarkable talk:

[https://www.youtube.com/watch?v=W2tWOdzgXHA](https://www.youtube.com/watch?v=W2tWOdzgXHA)

</comment><comment><USER26> The OP's example is perfect: he didn't go to the leaf-nodes and write _each test by hand_. Instead, it was clear that writing a tool to do the job would be better. Software is all about leverage. This is what defines a 10x programmer.

However, I'm constantly amazed how many programmers fail to see the forest for the trees.

To a large extent, not seeing (or seeing and ignoring) this type of solution is learned behavior. Many environments are hostile to this world view. Writing tools (especially those that generate code...eek!) is seen as "over- engineering" and "unnecessary complexity". If you're in a factory, on a line, your job isn't to climb away from your leaf-node.

Any programmer has the potential to be 10x, they just have to see and act upon it. Few do.

<comment><USER27> It seems like you're almost debating yourself here, making arguments for opposite sides. If anyone could do it and environmental effects make all the difference, why emphasize individual initiative?

But maybe the best thing to do would be to find a better environment, if you can?

</comment></comment><comment><USER28> It's worth pointing out that the research found a 10x _spread_ between the least-productive and most-productive engineers - a '10xer' isn't someone who does ten times more than the average, so it becomes less mythical if you think about someone who does, e.g. 2x more than average in an organization with a few burned out engineers doing 20% of the average.

<comment><USER29> Ah, so the secret to having a bunch of 5x engineers is to not burn them out.

</comment></comment><comment> BXLE_1-1-BitIs1 I remember one programmer that I characterised with "He writes a lot of code". I ended up with one of his not small routines that I replaced with a one page assembler routine in MVS NIP rather than OPEN.

When reworking printing software to support multi color, I researched a commonly used subroutine though several layers of calls and replaced it with, yes, a single character constant.

I lost count of the many legacy applications where I tossed out great gobs of code produced by "productive" programmers.

<comment><USER30> I do not think 10x means "churns out code" but rather "produces results". And by this metric, by golly, there are a couple 10x out there for sure.

<comment><USER23> I think OP here was asserting that he was 10x in comparison to that guy, as being much more efficient.

</comment></comment></comment><comment><USER31> 10x programmers do exist. But here's the thing: its not worth being a 10x programmer. Managers don't necessarily want them.

First of all, if you complete a project 10x faster than the expected time, managers will assume that they had overestimated the project, as opposed to recognizing that you're a 10x programmer. I have seen this time after time after time.

Secondly, if a manager does recognize that you're a 10x programmer then you will be seen as a risk: what happens if you leave the company? If the product was built by a team then that's a legit business. If the product was built by just 1 person then that's not a legit business as the business can suddenly collapse if that 1 person leaves.

Third, you make your co-workers look bad by raising the expectations bar. You will not win any popularity contests. You may make your manager look bad too, if your performance diminishes the value of the manager.

If you're indeed a highly capable programmer here's my advice: don't be a 10x programmer by doing 10x the quantity of work or completing projects in 1/10th the time. Instead be a 1.1x programmer, then expend your remaining energy helping your teammates grow, and broadening your influence. (So scale yourself horizontally instead of vertically.) This advice is often not easy to heed if you're introverted, and if you're extroverted you are already a manager instead of a programmer.

<comment><USER32> The modern workplace for an employee is really not designed to incentivize above average productivity. I don't claim to be an anything-X developer but I find my productivity runs in cycles. In the circumstances I've turned out high value work in a matter of hours or days, I've literally been told by colleagues to slow down because I was making them look bad, while management assume that's just how long the task takes. At the other end of the spectrum when I'm (relatively) under-performing nobody cares: that's just how long a task takes, and nobody feels threatened.

The damping effect is real.

</comment></comment><comment><USER33> I think we instinctively recognize the outsized levels of certain pros: a 10x leader that is a different creature from a typical manager, or a captivating writer that is 10x better than the average novelist, or a 10x actor vs a standard-issue LA newcomer, or a 10x teacher who inspires far beyond what curriculum mandates. Can we accept 10x lawyers, coaches, artists, or musicians based on their impact? We do, and we seek and celebrate them. Why fashion designers but not app designers, why essay writers but not program writers?

</comment><comment><USER34> One thing I have observed recently is the existence of "10X projects".

This might be a symptom of working at a big company, but I have been really impressed by the ability of some projects to achieve their ends while others get stuck in quagmires due to the fault of nobody on the project per se, but rather the definition of the project itself.

</comment><comment> 1e-9 Harder problem => Increased productivity variance

For extremely hard problems, it's not difficult to measure greater than 10X differences between highly-talented senior developers and the average productivity of those capable of meeting requirements.

</comment><comment><USER35> This whole 10x programmers debate is tiring. Why do we even argue over such a dumb thing? OF COURSE THEY EXIST. That is not even debatable. It's a fact of life that there are people who can achieve more than others. It is the case in sports, in politics, in school, and not surprisingly also in tech.

You have football players who play their entire life and they don't progress beyond a hobby team and then you've got the likes of Christiano Ronaldo and Lionel Messi.

The question is does it give a 10x dev a justification to behave like a dig? No, it doesn't. You still have to be a good team player, just like in a football team a 10x player won't perform well if he/she is pissing off the rest of the team.

So can we stop debabting about facts of life and just get on with it?

<comment><USER36> I never understood the concept of 10x apart from it being a (misused) meme. For (almost) every developer you can find one that will do "the thing" a few times faster and one that will do it a few times slower. It also depends on what is "the thing".

<comment><USER37> This is another example of this delusion people have about specificity when comparing outliers to normal people.

Genius level programmers are better than you at everything related to computer science. And if they aren't familiar with it, they will become familiar with it in a fraction of the time and then easily surpass you. This is why we call human intelligence 'general'. Because it applies everywhere.

Unless you think your ability to do your job is entirely dependent on tooling and learned knowledge, smarter people will quickly become better than you.

</comment></comment></comment><comment><USER38> I think the way to think about this is that there are some people who figure out ways to do things or invent things that just wouldn't be figured out or discovered by other people.

So, it's not 10x or anything-X even, it's just that, if the stuff that can be uniquely provided by "10x" people is important to you, then you need someone like that. 10 1x developers aren't likely to give you that (except to the extent that you have 10 chances to discover that one of them is actually a 10xer on some dimension).

</comment><comment> bloody-crow I think team sports is a good analogy here. There's no people who are 10x stronger, or who can run 10x faster than their teammates, but there's certainly people who'd score 10x points in certain circumstances than anybody else, and that is what 10x programmer is about.

<comment><USER39> Team sports is a terrible analogy. Like someone else mentioned, software is about leverage. There is no leverage in team sports.

</comment></comment><comment><USER40> The reality of the situation is that rather than 10x programmers, there are actually 0.1x programmers. Frequently you will have teams that are so burdened by whatever hurdles are in their way that they produce only a tenth of what they could be producing. Interestingly, there are programmers who self impose those hurdles. There are programmers to impose those hurdles on others as well. Quite frequently, though, the hurdles are either imposed from afar, or occur as a result of unfortunate decision making that has accumulated over a number of years.

A real "10x" programmer is a programmer who is able to unshackled themselves from the burdens that turn them into 0.1x programmers. Beware, however, because many of these people achieve their productivity at the expense of others on the team. Indeed, there is a special breed of programmer who will inflict 0.1x burdens on the rest of the team precisely so that they can appear to be a 10x programmer.

I once worked on a team of 5000 programmers, where the average number of lines of code produced per programmer per day was 1. We can all argue that KLOC per month is a terrible productivity measure. However when your productivity is around 20 LOC per month (without the K), there is something _seriously_ wrong ;-) 0.01x programmers (at best)????

<comment><USER41> Are we talking about a case where a given developer has re-written 100 lines of code, and added 1 line net?

Or do you mean that only 1 line was written or re-written? If so, what are people doing, having 7-hour meetings?

<comment><USER40> No. We had 31 million lines of code and it was so complex that even changing 1 line had massive implications. Definitely the worst code base I've ever worked on. I originally started working there as a contractor because they had single functions which had reached the file size limits for their build system and they didn't know what to do (you know... maybe split this function up into smaller functions... maybe...). There were people who were unrolling loops because they were unaware that the compiler would do it for them under the hood. And then somebody would modify one part of that loop, so you'd be looking for some strange behaviour and it would be buried in the middle of some code that was copy and pasted 100 times. Total nightmare. Don't even get me started on how they did their memory allocation.

<comment><USER42> Very curious to know what you were working on! 31 million lines of code?

<comment><USER40> It was a telephone switch (Now defunct Bell Norther Research)

<comment><USER42> The scale of this is too vast to even conceive....

</comment></comment></comment></comment></comment></comment><comment><USER43> It doesn't matter whether 10x programmers exist. Programming is not a sport and as such, competition will only lead to narrow thinking, useless optimization and hatred. What we should really strive for is making programming a more creative activity where people learn from and inspire each other, not a competition.

Oh and also, "finding the 10x engineer" feels like a hotspot to inject hidden bias into recruiting.

<comment><USER44> Communication overhead is expensive. All else being equal, it's much better to build a small elite team that can operate successfully with less structure and process, rather than a large average one.

<comment><USER43> Right. But you can't build a functioning team that works together and can rely on each other by fostering a culture of competition and hiring only the "predestined" 10x engineers.

If the team culture is to help each other, forgive mistakes and learn from each other without measuring who's the best the team will automatically build itself without the need to hire only "10x engineers".

Or so I suppose. I'm not an HR person or anyone else with expertise in this field so you should take what I say with a grain of salt. I've just been thinking about this a lot as of late.

<comment><USER44> Where I've seen teams with high concentrations of unusually smart people, they gelled and collaborated at least as well as anyone else. In fact the bandwidth and fidelity of their idea transfers is part of what made them impressive. It's like they had their own little language to describe the codebase and what to do with it.

These were mature and soft-spoken people; might be different with brash young hotshots.

<comment><USER43> To me that sounds like an environment where there's not a lot of competition involved. (Which is what I was describing.)

<comment><USER44> They were far and away the most selective team in the company.

I've seen this before in university too; competitive to get into can still be cooperative once in.

<comment><USER43> HN thread limit might cut this off but what if someone in that team starts experiencing problems and self-doubt? If everything in the team has always worked smoothly before they might not be able to handle it.

Additionally, elitist teams might scare off some people that could otherwise be great engineers if they just got a little entry help. Sure they can "get that elsewhere" but if every team behaved like that there's not only nowhere to enter, but there's also sort of an omnipresent assumption that you have to be good from the start in order to be able to achieve something in engineering.

I'm not saying your described team doesn't work but it's not exactly the kind of culture HR should be striving for in my opinion. (Albeit it's still far better than than a team that doesn't work at all or works against each other.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER45> I've been a 10x developer compared to my yesterday self.

I needed to add a feature that required a big rewrite of my framework. This would take maybe 2 weeks.

The next day I realized I could support that exact same user benefit with only a few lines of code.

Sometimes just looking at the problem differently, or sleeping over it can have a huge impact, not only compared to other developers, but also to yourself.

</comment><comment><USER46> > I think 10x developers, like world-class athletes, musicians, and authors, > absolutely do exist.

For this question to make sense, one should give a better definition of what constitutes the output of a programmer.

In a sense, there are Nx programmers for any arbitrary N because some developers can build things that other can't.

But we can't reduce the work of a software engineer to "programming". Most "programmers" today aren't developing some new hobby systems from scratch (it's the easy part IMHO). They work in the context of a team, they have to deal with legacy code (possibly boring, using technologies they don't like), they write doc, review code, discuss designs and solutions, they give talks to present their work, they train or supervise colleagues, they interact with difficult managers or colleagues and so on...

In that context, I wonder how "star programmers" operate. I wouldn't be surprised if some of them are even under-performers.

</comment><comment><USER47> A few people have touched on it here, but I'll add my voice. I firmly believe that there are programmers who are better described as a "1 vs. 0" programmer. Some programmers have a creative talent in them that leads them to create elegant solutions that literally a team of 50 average programmers would not.

</comment><comment><USER48> If you look at the original paper (going back to 1968) where the data for a 10x difference was first found, there are a ton of... issues.

I've covered this in detail here: [https://www.youtube.com/watch?v=Gho89X72Xas](https://www.youtube.com/watch?v=Gho89X72Xas)

</comment><comment><USER49> There are 10x salespeople, 10x authors, 10x basketball players, and 10x scientists; why should there not be 10x programmers?

</comment><comment><USER50> I agree with the article, but I also think it leaves out something fairly important, which is minimizing huge time sinks. Instead of being 10x better, how can you reduce wasted time 10x?

I remember working with this one guy that was light years smarter than me, but if you watched him use the IDE it was _painful_. He did _everything_ in the menus, slowly. How much of his life could he have back from memorizing f5 and a couple other shortcuts?

Maybe you could reduce waste in various ways:

* Learn keyboard shortcuts instead of pecking through menus

* Use search instead of browsing (especially with keyboard shortcuts!)

* Have you ever lost half a day debugging something that turned out to be dumb? (I have!) Is there a way to modify your coding style or your testing habits so you never hit that again?

* Do you know your stack well enough that (given the time) you could reimplement the same ideas yourself? (Or is it a magic box that you can't debug? How much time and effort do you spend prodding the magic box?)

* Have you automated all the manual things you currently do?

* Are you wasting a lot of time dealing with bad abstractions when something much more basic would suffice?

* Are you mastering your tools/languages/frameworks, or are you switching around so often that you spend a lot of time looking things up?

* Do you have input into how your tasks are written, or are you stuck with whatever breakdown someone else came up with? Is your work getting awkwardly twisted to fit into these milestones? Can you work out a better system with your leads?

That's the tip of the ice berg -- I think if you look at almost anything you do, you can generally find some aspect of it that's cumbersome and wasting your time. I feel like when you account for wasted effort/time, and removing it, becoming "10x" starts to seem a lot more reasonable -- it's not about being a genius, it's about being introspective and careful about how you perform your work. It saddens me to say this, but I think that sort of introspection is rare. I see so many programmers doing uncomfortable awkward things every day, because it's only like 10 extra seconds, except those 10 seconds times 20 times a day times a year and now that cost is out of control

<comment><USER51> If you think 10x programmers are merely more efficient and writing code, you're wrong. A 10x programmer produces 10x less code to solve the problem which is why they're 10x faster at it and the quality if higher.

Some of this advice is good but actually being _speedy_ is not necessary.

</comment></comment><comment><USER52> They are rare, but definitely out there. I've worked with one, managed one, never been one. One charateristic I observed over these 2, they'd take a manual home and read it over a day or two. They'd retain most of it. They tend to be touch typist not needing to look at the keyboard often. This reduces context switching and lets them flow when they are being creative. They know and remember syntax, library routines and interfaces so they aren't stopping to look things up. They "try on the fly", fail fast and often, and move to alternatives when blocked. The ones I know I'd love to start a company with. But I would be the bottleneck...

</comment><comment><USER53> I don't know if there is truly such a thing as a 10x programmer, but I have no doubt that 0.1x programmers exist in hordes. Even people who at small scale seem competent can often end up making a complicated mess when dealing with bigger projects.

</comment><comment><USER54> Considering how software development has become relatively lucrative and so many want to throw themselves at this, it's bound to create a large pool of incompetent engineers. Specially because this isn't an industry that is regulated like medical doctors or architects. Given that, I think it should be relatively easy to find 10x performers on different teams.

However, to find a 10x guy in a high-performing team, that'd be a sight :)

</comment><comment><USER55> If we take a simple application of Price's law:

The square root of the number of people in a domain do 50% of the work.

In a group of 121 the top 11 are doing 10x the work of the other 110.

</comment><comment><USER56> The best way to carry 8 gallons of milk across a muddy field in a leather bag is to leave it in the cow.

I never assumed that the 10x programmer was actually writing 10x the amount of code in the same time but instead knowing how to do something in a 10th of the time, with less risk and cost (by a using a better algorithm, novel approach, or 3rd party package etc).

It's the difference between being a developer and a programmer

</comment><comment><USER57> > I developed them in 3 days, by writing a C program to automatically generate > the range of tests.

So they were 10X at that task. Are they like that, consistently, all the time? Maybe next time it's another person's turn to have the insight on how to drastically simplify the task.

This is not "10x people" at all then. This is a "10x day" or a "10x week" in a fairly normal person.

</comment><comment><USER58> I find that I am a 10x developer when I compare myself to other versions of myself. I have had days where I honestly feel bad because I got almost nothing done, and other days where I get a ton done. If I was able to correctly channel my focus and effort, I would be 10x then I used to be. Now sure, maybe the time spent not as focused allows me to have those bursts of productivity.

</comment><comment><USER59> I'd argue today a team could be 10x. Yes it requires someone who knows the concepts and can effectively communicate them but also awesome project managers, designers and QA personnel. A great team (I am lucky to be part of one) functions like a well oiled machine churning out acceptably quality features and fixes the problems at a surprising rate.

</comment><comment><USER60> To make an analogy with the ancient Roman trieme ships with three tiers of rowers. A 10x rower in that context is not the guy who can pull the oar 10 times harder, it's the guy who, while he can pull the oar, can also tell you when the ship is on course because he knows how to navigate and thereby makes everyone's effort more efficient.

</comment><comment><USER61> Despite the differences in definition, reading the comments on this page has been lovely. I've enjoyed the many perspectives.

</comment><comment><USER62> The author of this article is a 10x self-promoter for using a hotly debated precept to humblebrag about his accomplishments.

</comment><comment><USER63> Why wouldn't there be such thing as a 10x programmer? Is the average programmer so good? There are outliers in every industry. Professional athletes are a clear example — they are often many orders of magnitude better than the average player of their respective sport.

There are probably also a few 100x engineers, maybe someone like Elon.

<comment><USER64> The equivalent comparison would be professional athletes at the top of their sport to other professional athletes in that sport working or playing in a lower league. Would the the top performers be 10x the other ones? Hard to quantify this, but I'd say no, more like 2x or at most 3x

<comment><USER47> All you have to do is look at someone like LeBron. He single-handedly makes a team a championship contender.

</comment></comment></comment><comment><USER65> If you're really 10x and you're giving that 10x to some company and not getting 10x value, you're doing yourself a disservice! Either get fair value (probably won't happen) or give them less than that 10x and use your spare energy for other pursuits (relaxing, entrepreneurship, art, hobbies, etc)

</comment><comment> d--b He's saying 10x developers are those won't don't code 10 times faster the same code, but those who find ways to code 10x less for the same results. that I agree with.

But then he compares 10x developers to world class athletes... That's a bad comparison. The 10x developer is the guy who takes the bus instead of running marathon!

</comment><comment><USER66> How does an industry so full of brilliant people who consider themselves much smarter than their users keep arguing in these absolutes about programmers like their skills are easily classified.

Many things have become popular that were originally written like ass by someone who was better at making something people found useful than they were at data structures or thinking in big O.

A lot of genius language design people are nearly useless when the whole messy world of shit like network, filesystems and interacting with things not their language is involved.

Programmers being human also are not some consistent machines that constantly maintain some level of productivity regardless of what is going on in their personal life or their interests waxing or waning in a given problem space.

The people whose code has changed the world are maybe a handful or two. So, astounding developers much better than most do exist. But even they are not some multiple of every coder for every problem.

Nevermind, it's time to stop even thinking about programmers alleging truisms about programming and go get my MSNBC|FOX fix so I can get the necessary stimulus to knee jerk.

</comment><comment><USER67> It's not that Alan Turing was a 10x or 100x programmer (not that there were many others to compare him to at the time), but that he had a deep intuitive understanding of mathematics, which he could apply to many problems from different fields.

</comment><comment><USER68> It is very easy to find -10x programmers, which proves that there are also 10x programmers. It depends on the reference skill level.

</comment><comment><USER69> Can we stop the self hate already? There definitely are 10x musicians, 10x painters, sportsmen and 10x programmers. You know what never exists in 10x form? Burocrats and middle managers who write articles like this one.

I suggest to flag this as fake news and all future articles intended to devalue young talented programmers who yet are to discover their true market value.

<comment><USER70> Not trying to be a jerk, but I think you might need to re-read the article as the author is clearly a developer themselves and thinks that there are definitely 10x developers (just that they can't be found with a simple coding test).

<comment><USER71> I would like to think I'm one of them, I'd flail about in attempt to solve some random programmer test, but I'm also the guy that sits back and says 'hey how about we rethink this i n s a n e architecture?'

</comment></comment></comment><comment><USER72> 10X programmers do exist but good luck finding them as Job Seekers.

It is also a concept which is NOT SCALABLE.

</comment><comment><USER73> Problem is the scale. Script kiddies and junior programmers are 0.1x to 0.6x or people reinventing the wheel by not using a framework, they could be far less and let's not talk about security. Experienced (senior) devs should be counted as 1x. Beside knowing to programming fast, they (should) know how programm more correctly.

</comment><comment><USER74> What have the company done in the past 15 years to build a progressive learning culture?

</comment><comment><USER75> If you look at it the other way, is there any field where some pro aren't 10x « better » than other pros, at least by some metrics ?

In sport it's pretty obvious there are, and you can measure it because there's a « winner » and a « looser » at the end of each game. But i'd imagine it's there in pretty much anything.

</comment><comment><USER76> Being a 10x programmer is not sustainable and doesn't scale well.

A great team is not made up of lone rangers and wild stallions.

</comment><comment><USER77> 10x programmer @ 1x pay

</comment><comment><USER78> If you use [The Pure Function Pipeline Data Flow v3.0 with Warehouse/Workshop Model]([https://github.com/linpengcheng/PurefunctionPipelineDataflow](https://github.com/linpengcheng/PurefunctionPipelineDataflow)), although the development speed will be a little slower, thinking will be a little more, but later reading, incremental development and maintenance will be less than ten times.

</comment><comment><USER79> As a 10x programmer myself (NOT TO BRAG) I will tell you we definitely exist. My greatest annoyance is watching the rest of you peons crawl along at a snails pace while I am inventing the next groundbreaking technology that will completely flip your existence upside down. Perhaps the only person who could even understand my level of motivation is Elon Musk, but I'm not even sure if I would have the patience to explain it to him.

It is a daily occurrence that while you are trying to find a missing semicolon that I'm already cleverly arranging your old commits using git rebase to turn your finger-painting into a Van Gogh. My only advice is just to get used to it, because we aren't going away. The best thing you can do is hope to get a management role so that you can be freed from the burden of competing with us. Let's be frank: most of us 10x programmers are on the deep end of the spectrum and therefore won't want or perform well in a management role, but for those of us that can, managing normal programmers would be excruciating.

<comment><USER52> This guy is so 10X his/her user didn't exist before this response. And he's been 10X and productive talking about it!</comment></comment>


Windows 8 is Already Fragmented - <AUTHOR> http://www.dreamintech.net/2012/02/windows-8-is-already-fragmented/

<comment><USER2> I think this is what will make Windows 8 the _least_ popular OS version in the past 12 years. The interface is so different, most users will feel uncomfortable switching to it. If they want to sell Windows 8 they'll have to evangelize it and its interface to users, just like they need to do it with WP7. Users will not accept it by default just because it's the next Windows, especially with all the inconsistencies between the "Windows 7 mode" and "Windows 8 mode".

I believe most will keep using Windows 7, just like they kept using XP when Vista came. It's actually worse now than it was when Vista came out, because people were already getting tired of XP back then, but still didn't switch. I doubt too many feel tired of Windows 7 already.

<comment><USER3> The UI is different on a touch-tablet. Not on a desktop, or server, or your regular PC.

<comment><USER4> Tablets only have the new UI, but it's the default on desktops as well. They just have the option of switching back and forth to Aero for legacy apps.

<comment><USER3> I just don't see people running away from Windows 8 as much as I see them running towards it. The mass market is absolutely looking for a Metro type experience.

For everyone else, you get into Desktop mode by clicking on the desktop tile, that's right there in your face after bootup. One click.

The desktop is now an application in itself, but I'm not sure if I'd call the desktop a legacy app for legacy apps. There are plenty of workflows, stories, and apps that simply can't be reduced to a Metro type use-case.

<comment><USER5> The other thing people don't think about is the form factor of the Samsung Series 7 x86 tablets. You can use the Metro UI when on the go for basic navigation and switch back to desktop when you dock it. The Metro UI should also make it easier to navigate for people remoting in with tablets.

</comment></comment></comment></comment></comment><comment><AUTHOR> The post content for those that can't read because of my server problems:

As many of you already played with Windows 8 beta, and if you didn't at least you know it well from tech sites, it's already a fragmented OS and in my opinion it's more fragmented than Android. Maybe a lot of things will change when the final version comes out, but I don't think this will happen.

I'm talking about the two OSes that come on the Windows 8 pack. One has a Metro UI with all the new and cool stuff borrowed from Windows Phone and built for a tablet, since it's very bad to use that interface with a mouse. The second is the good, but old, Aero interface which we all know is perfect for a mouse. If you want to have a complete new interface you should use it across all the apps. On Windows 7 I could run any app built specifically for XP and it would have the same Aero look as any other Windows 7 app.

Now imagine at the user side, someone that is just ok about computers and think that OS = Windows. This person will need to relearn almost everything about Windows all over again and deal with apps that must run on Metro and others that only run on Aero. Having to switch between them over and over will make the user feel uncomfortable about the OS because it doesn't have the consistency to stay in a single type of interface.

And what about Windows on ARM? Of course apps compiled for x86 won't run on ARM-based Windows machines, and vice-versa. This will add another layer of fragmentation on Windows, maybe more work for the developer too if it the ARM version of the SDK has limitations.

Microsoft is fragmenting Windows before it even gets released.

</comment><comment><USER6> There is an unavoidable fragmentation between the tablet, and the desktop. Please show me an OS that does both better? It is _unifying_ not fragmenting. I'd really like to hear what people think MS _should_ have done.

From a desktop perspective windows 8 IS just like windows 7, except it has replaced the start menu and uses ribbons (can be disabled). The metro UI works reasonably with a mouse, and power-users will no doubt search with the keyboard -- exactly like they do now.

On the touch side, it will be possible to use your 'pc' with a touch interface and it will _work_. Which is obviously a big change from a windows 7 tablet. Instead of trying to force the desktop experience they have embraced things like full screen apps, and it is all still usable with mouse/keyboard. It is not a 'drastic change' for consumers who have been lapping up iOS and android devices.

If MS don't make a move then they will lose the touch world to android and iOS.. which will eventually become the laptop market of today (ie the mainstream). Their WP7 attempt shows that people aren't keen on a new, separate OS, even though it is often said to be good. So now is their chance to leverage their ecosystem (whether it be recompiled apps for arm or intel actually becomes common in the touch space), or lose that advantage. This, IMO, is the point of windows 8.. MS isn't going to care if you stay with windows 7. 8 is about not being shut out of the touch market. ie the survival of windows and it's advantage.

</comment><comment><AUTHOR> Sorry for having to reboot the server every 5 minutes. Wordpress and apache2 wasn't a good choice... :(

I'm planing to move away from Wordpress and apache, but I don't have any skills on this area :'(

<comment><USER7> Wordpress and Apache2 can handle it just fine. You probably just need to enable caching.

<comment><AUTHOR> I had, but it can't for some reason. And I checked the processes, it's only running mysqld and apache2, nothing more. :/

<comment><USER4> I see WP-Super-Cache there and doing its job, and your site responds instantly most of the time. Then all of a sudden it hangs.

It's probably a bad Apache configuration... you're allowing more workers/threads to spawn than you have RAM to run on that system, and a high KeepAlive timeout (15 seconds) tying them up on connections that aren't needed anymore.

If you configure it right, Apache on an old box with little RAM can easily handle HN-level traffic for a static site (which a cached blog is).

</comment></comment></comment></comment><comment><USER8> I don't see Microsoft's problem here being fragmentation. Sure, some versions of Windows will run the Aero desktop and some won't, but everyone will have access to the same touch interface in Metro UI. This is markedly different from the Android ecosystem in which every device has its own spin on the interface. Further, it was clear from Build that MS is clearly propping up Metro as the future of Windows, regardless of whether you prefer mouse and keyboard. I think it's safe to say that need for the Aero desktop will decline over time.

The real problem Microsoft has then is not fragmentation, but getting users to accept its vision.</comment>


Low cost mobile IMSI-Catcher Catchers to detect surveillance attempts [pdf] - <AUTHOR> https://www.sba-research.org/wp-content/uploads/publications/AdrianDabrowski-IMSI-Catcher-Catcher-ACSAC2014-preprint-20140820.pdf

<comment><USER2> Sorry if I'm missing it, but is there any additional info/source on their stationary implementation? I'd love to implement a smaller, cheaper version with one of Telit's embedded chips.</comment>