TrueCrypt must not die - <AUTHOR> http://truecrypt.ch/ <comment><USER2> Also, it appears someone finally got a hold of a Truecrypt dev. The project was just shut down from lack of interest. No drama about auditing or, crazy NSA conspiracies after all: [https://twitter.com/stevebarnhart/status/472203503478509568](https://twitter.com/stevebarnhart/status/472203503478509568)

Edit: That tweet was deleted for some reason, but the rest of the thread is still there: [https://twitter.com/stevebarnhart/status/472192457145597952](https://twitter.com/stevebarnhart/status/472192457145597952)

<comment><USER3> For me this tweet is 404, what is its content?

<comment><USER4> Sorry, I didn't really want people trying to further bug the supposed dev. Steve Gibson has a good enough roundup. I wish he didn't use my info though :)

<comment><USER5> You'll be alright.

</comment></comment></comment></comment><comment><USER6> It would be nice if the people who pick up and run with the "reboot" of Truecrypt's project management had a background in cryptography. Do these people?

<comment><USER7> Did you not see the .ch domain name ?

You can rest assured.

<comment><USER6> Also what is it with the people who suddenly seem to believe Switzerland is a cypherpunk haven? It _really_ isn't.

<comment><USER8> It's _clearly_ a ploy to get everyone backdoored. Just look at Crypto AG.

<comment><USER6> Hm. Is that Websters definition of "clearly", meaning "easy to perceive, understand, or interpret", or HN's definition, as in "it's clear someone or some agency got to the developers and they just pulled the ejection seat for their own legal protection"?

<comment><USER8> I was hoping the italics spoke for themselves, but I'd better clarify it's the latter. It seems to be an Internet-wide phenomenon to jump to the most bombastic possible conclusion given a limited set of facts.

<comment><USER6> Sorry, I was just trying to use you to riff.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> I don't believe the TrueCrypt license allows this kind of redistribution, does it?

Then again, with anonymous developers and unknown jurisdiction, it may be moot.

<comment><USER10> It says derived programs shouldn't be called "TrueCrypt" and shouldn't be ascribed to the original publishers, which honestly seem like pretty mild requirements.

[https://github.com/warewolf/truecrypt/blob/33c0b8457051796fa...](https://github.com/warewolf/truecrypt/blob/33c0b8457051796faae1249950cb896dca027e49/Release/Setup%20Files/License.txt)

<comment><USER11> So they are right off on the wrong foot, with that domain name.

I belive any TrueCrypt fork should require contributions to be dual licensed under TrueCrypt's original license and BSD. In time, the project can shed original files and re-implement them under BSD or any other GPL compatible license.

<comment><USER12> So far there isn't any derived code. The truecrypt.ch domain seems a reasonable place for people to regroup. If/when a new release comes out, the community can think about a new name and register a new domain.

</comment></comment></comment></comment><comment><USER13> My opinion, the fact that some security researcher was going to be getting more money than the actual developer ever made off the project must have been infuriating. I think that's good enough reason to burn the project to the ground.

<comment><USER14> or not start it at all

<comment><USER13> The license issues surrounding TC are reason enough to not restart the project.

</comment></comment></comment><comment><USER15> The signatures and binaries are not served over HTTPS. It would be prudent to compare them to other sources.

<comment><USER16> Actually it would be good if the webmaster behind this reboot got SSL set up. Especially if this is going to be the new most authoritative download source.

<comment><USER17> SSL is better than no SSL, but for better assurance they should offline sign the downloads.

</comment></comment></comment><comment><USER18> This looks like a bootstrap site that was thrown together in an hour by two guys with twitter accounts and $10 for a domain name. I really doubt they're going to be doing any dev work.

<comment><USER19> Why does the amount of effort on the site matter? I don't understand how that tells you anything about the project or its likely outcome.

<comment><USER20> well the fact that they are asking for a copy of the original site isn't a good start.

The original dev's made it clear they don't want people to continue with the TrueCrypt name. If they were really interested in continuing the project for the sake of security they would have chosen a different name.

<comment><USER21> Original site archived here > [http://archive.today/www.truecrypt.org](http://archive.today/www.truecrypt.org)

</comment></comment></comment></comment><comment><USER22> Still have no idea what's the "unfixed security issues", and few guys mention about it. I image there the "security issues" will be (if it exist): 1\. because key are easy to stolen by coolboot or trojan. 2\. because it has backdoor, will save key to a hidden place. 3\. because it will leave some information in other place, like 2 but it's implantation problem. 4\. because it use a vulnerable algorithm to generate key. 5\. because pbkdf2 or aes256 is _broken_ but nobody known it. exclude 2 and 3, change to other software it's not help at all, algorithm almost same.

<comment><USER4> If we believe the person I was in contact with (big IF, I know), there are no current issues, but it is by definition "harmful" to continue use because it is no longer being maintained. In fact, the person requested I tell Steve Gibson to not distribute or include a notice telling people not to use it.

</comment></comment><comment><USER23> if the developers of Truecrypt are anonymous and the license doesn't allow something like this, would this allow us to find out who the developers are if they sue?

<comment><USER24> To what end? Just because one can steal someones code or force them to reveal their identity doesn't mean it's a good or nice idea.

Apologies if I missed anything, I don't follow this truecrypt stuff too closely.

</comment></comment><comment><USER25> Honestly, I was hoping this drama would result in the implementation of hidden containers for other crypto solutions (dm-crypt, etc).

Hopefully that may still happen.

<comment><USER26> The FAQ for cryptsetup states: [https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQue...](https://code.google.com/p/cryptsetup/wiki/FrequentlyAskedQuestions#5._Security_Aspects)

 _This means that if you have a large set of random-looking data, they can already lock you up. Hidden containers (encryption hidden within encryption), as possible with Truecrypt, do not help either. They will just assume the hidden container is there and unless you hand over the key, you will stay locked up. Don 't have a hidden container? Though luck. Anybody could claim that._

<comment><USER25> I think that's a very narrow view.

It assumes there are only two possibilities, either you live in a "free country" where you can refuse to hand over the key, or you live in a totalitarian state where the police will decide to beat you if they suspect you have crypto software, and will keep doing so no matter what you say.

There is a lot of middle ground there. For example in the UK, I believe you are legally required to provide the decryption password. But I don't think the police there would be likely to beat you if they think you may have a hidden container. They could argue that they believe you do, and you would respond with "prove it!", and I doubt it would go any further (unless they had some evidence that you specifically were using hidden containers).

There is value in hidden containers in some circumstances. It's disappointing to see the cryptsetup maintainers take this position.

</comment></comment></comment><comment><USER27> This is a bad idea. TrueCrypt should be put to bed for good. An event of this magnitude is easy justification for dropping TrueCrypt. It serves an extremely delicate purpose and this raises far too many red flags to ignore.

Place your energy in the alternatives. I wish you could downvote things on HN, if only because this is downright dangerous and needs to be read by as few people as possible.

<comment><USER28> There is a $30,000 audit currently underway. There will be no security problems un-turned when they are through. That's assuming there are any to begin with (Personally, I think not).

I see no issue picking up the codebase and running with it.

<comment><USER27> Of all the subsets of the software development world, crypto is the one to be taken most seriously. TrueCrypt was always developed in the shadows, and the recent controversy takes the nails they've set and hammers them firmly into the coffin.

Audits aren't perfect.

<comment><USER28> It's code. There are no secrets.

Problems come up when nobody reads the code. Right now, there's an awful lot of people reading this code (Given the strange warning's posted on the TC site).

<comment><USER29> That's a fine attitude for normal code, but crypto is a whole different ball game. Linux security was significantly reduced at one point because somebody changed _int i_ to _int i=0_ , something most developers would thing is a positive. Side channel attacks are extremely easy to create and extremely hard to find. And, unfortunately, the "many eyes" thing doesn't work here because it requires experienced, knowledgable eyes, and there aren't enough of those, and they are usually busy getting paid, researching how to break software or building their own stuff.

<comment><USER30> > Linux security was significantly reduced at one point because somebody > changed _int i_ to _int i=0_

Could you please elaborate on this one?

<comment><USER31> Seems to me they relied on the uninitialized memory of a stack variable as a partial source of randomness for key generation.

Initializing the variable with 0 removed that part.

<comment><USER30> Your explanation makes sense. Though I'm still curious as to when this happened and what the impact was.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER32> I would love to see it live on with no new unneeded features, no changes made unless they are to fix bugs. Keep a stable long-term product and get as many people as possible looking over that code for flaws.

</comment><comment><USER33> Search off the phrase "TrueCrypt Developers Association. All rights reserved." and you will find many other projects that include embedded TrueCrypt code. Food for thought...

</comment><comment><USER34> _Anonymous development on a security relevant Project is no longer an option._

Why not?

<comment><USER35> Because trust is an important commodity on a project like this. Higher trust means fewer horrible things slipping past the review process.

<comment><USER36> Anonymity is out and I'd say that being an "independent" crypto person that has to defend themself will not get you very far once you have come to the attention of the wrong people.

So what options remain for the person that starts the "next Truecrypt"? The only true safe haven I can think of is employment at a public university. In many countries here in Europe the security researchers working at universities can operate under what is called "academic freedom".

I wonder how that will be destroyed.

</comment></comment></comment><comment><USER37> Why don't you send TrueCrypt.org a few dollars then?

<comment><USER38> The developers have already decided to call it quits. More money probably won't help.</comment></comment>


Fastest database for Tornado - <AUTHOR> http://www.peterbe.com/plog/fastestdb

<comment><USER2> Thanks for this - this is something that I've been planning to do myself. I seem to be able to find so much stuff for Django and Flask and Tornado seems to always slip under the radar.

+1

<comment><USER3> With Django and Flask you don't have the dimension of having to decide between sync and async.</comment></comment>


What Does "Wish We Could Say More" Mean? - <AUTHOR> http://josh.io/wish-we-could-say-more

<comment><USER2> Some may want a Dick Tracy style "talk into the watch" device, but colour me surprised if many people use them in this way. The most obvious forms of smartwatch input are touch and gestures (both of the wrist and the touch screen). I can't imagine you'd want much more input than this. That said, did see an interesting project on Indiegogo where someone had designed a watch with a small projectable input that went on your hand.</comment>


Silicon Valley's Technolibertarian Dream Was Invented By Timothy Leary - <AUTHOR> https://theoutline.com/post/1030/timothy-leary-silicon-valley-technolibertarian <comment><USER2> Leary was tapping into an existing techno-utopian dream in that part of the world.

FTA: >First published in his book Terra II (1974), it's a neat summary of Leary's vision of the future of the human species, the next step in human evolution.

Yet we have poems like 'All Watched Over by Machines of Loving Grace'[0] by Richard Brautigan written in 1967. The same year Brautigan was made Poet-in- Residence at CalTech.

This isn't to say that Leary didn't help shape the modern and stable form of west coast techno-utopianism we see today. I think he did, however he did this by amplifying a subset of the already existing techno-utopian ideas into the greater sphere of American culture.

[0]: [https://en.wikipedia.org/wiki/All_Watched_Over_by_Machines_o...](https://en.wikipedia.org/wiki/All_Watched_Over_by_Machines_of_Loving_Grace)

</comment><comment><USER3> "There are two major products that came out of Berkeley: LSD and UNIX. We don't believe this to be a coincidence."

<comment><USER4> Do they mean to say BSD?

<comment><USER5> BSD is one of the first Unices (probably second only to AT&T UNIX), so both would be correct, although "LSD and BSD" might make for a punchier joke :)

</comment></comment></comment><comment><USER6> _"... In the 1980s, [Leary's] vision could be summed up in one word: SMI2LE.

A neat summary of Leary's vision of the future of the human species, SMI2LE stands for Space Migration, Intelligence Increase, and Life Extension. (First published in his book Terra II (1974))

... [Leary] came to this conclusion while rotting away in prison."_

\----

My 2 cents:

Space migration: an obscenely expensive way to sideline earth's environmental problems

Increased Intelligence: Not that helpful in an era when humans are going to have to re-articulate their raison d'etre in the face of superhuman machine intelligence. I would expect an LSD guy like Leary to have a better grasp on the purpose of being human than that. See also Superintelligence by Nick Bostrom

Life Extension: One of the key features of being human is being mortal. It's not just an inconvenience to be done away with. (That's a personal view; disagreement is welcome.) I sort of wonder if LE is a screwball project for people who secretly are afraid of a judeo-christian afterlife? Again, it boggles me that Leary failed to make peace with death? Maybe drugs are not as awesome as I thought.

<comment><USER7> > Space migration: an obscenely expensive way to sideline earth's > environmental problems

What‽‽‽ There are so, so many reasons for space migration that have nothing to do with earth's environmental problems – assuming you mean global warming/dimming/<things humans are affecting>. Asteroid. Super volcano. Gamma ray burst. Magnetic field reversal. Pandemic. Super fungus. Artificial super intelligence. Nuclear war.

Our understanding of life, geology, climatology, astronomy, etc., has improved much in the last 6000 years, but at a fundamental level, we are extremely rudimentary. We don't really know what's normal on a galactic/universal scale.

It's like saying having a failover server is just an expensive way to sideline taking good care of your primary server. Huh? No, having a backup plan is what you do when something is important, because shit happens. On a long enough timeline, shit that you can't predict _always_ happens.

<comment><USER8> > There are so, so many reasons for space migration that have nothing to do > with earth's environmental problems. Asteroid. Super volcano. Gamma ray > burst. Magnetic field reversal. Pandemic. Super fungus. Artificial super > intelligence. Nuclear war.

I understand everything on that list with the exception of magnetic field reversal. Can you explain why it's so bad?

<comment><USER9> When Earth's magnetic field reverses (it's periodic and we're overdue), it does not protect from solar radiation for a while, making the outdoors toxic and destroying most electronics as a result.

</comment></comment></comment></comment><comment><USER10> See: Fred Turner (2006), _From Counterculture to Cyberculture: Stewart Brand, the Whole Earth Network, and the Rise of Digital Utopianism_. [http://press.uchicago.edu/ucp/books/book/chicago/F/bo3773600...](http://press.uchicago.edu/ucp/books/book/chicago/F/bo3773600.html)

</comment><comment><USER11> I highly recommend finding a bunch of Leary's out of print material. A lot of it's been scanned and uploaded to various places. It's both fascinating and culturally very significant, not to mention stylized and weird to the point of being a work of art.

I also highly recommend his biography _Flashbacks_.

<comment><AUTHOR> Thanks for the recommendations. Can you provide any links to resources?

</comment></comment><comment><USER12> Nothing exists in total vacuum. Check out early 20th century Russian cosmism: [https://en.wikipedia.org/wiki/Russian_cosmism](https://en.wikipedia.org/wiki/Russian_cosmism)

>The Earth is the Cradle of the Mind—but one cannot eternally live in a cradle.

</comment><comment><USER13> I would be curious to hear some opinions from people here on The Outline, both in terms of design and content. I was really pumped for its launch, which happened in late 2016 (maybe November?), but in the time since I've only occasionally used it (less than weekly). This is in contrast to NPR, Hacker News, and news-twitter, all of which I check several times per day.

<comment><USER14> Pretty much my exact experience with it. I think I just haven't found many of the articles I _have_ read very interesting, and I find the site a little hard to navigate.

</comment></comment><comment><USER15> What about the cypherpunks?

</comment><comment> d--b The author does not understand the term libertarian. Certainly Silicon Valley is chasing utopian dreams, but not necessarily libertarians. Thiel is a libertarian, but it's not obvious that Musk is. Musk doesn't seem to have a big opinion about fat or lean government (for instance). And some very prominent people in the Valley (starting with y combinator guys), are very far from libertarianism.

70s technology-inspired utopias are really interesting though.

Buckminster Fuller and Superstudio have been very influencial too

<comment><USER16> This was my thought as well, but for somewhat different reasons. I think Musk does fit this modern definition of libertarian -- a lack of faith in government progress is a necessary logical foundation for attempting to pioneer space travel privately. I definitely agree, though, that many YC guys don't seem to be libertarian at all. It's also definitely worth noting that this modern definition of "libertarian" is so divorced from it's original anti-capitalist meaning that it's almost a different word. Leary's vision was "libertarian" in the sense that it was wholly at odds with capitalism as it currently exists, and put the onus of human progress on people instead of government. It was not "libertarian" in the sense of advocating for exploitative private companies like those we see in the Valley.

</comment></comment><comment><USER17> The author lost credibility with this paragraph

 _Musk is very typical of the Silicon Valley technolibertarian mold. He was happy to take a $465 million government loan for Tesla Motors, then soon after paying it off, he was more than happy to speak out against government subsidies like the one he just paid back. This has been Silicon Valley's modus operandi for years, of course: promoting the tech sector's independence from and superiority to mundane governance, while relying on it. In a nutshell, this is the reality behind the myth of the "free market."_

The author doesn't understand the hidden subsidies on fossil fuels. If we were to bake in the cost of climate change and pollution into the price, solar energy would have never needed subsidies. And what is Musk supposed to do? Ignore and reject subsidies that are available? The author is grasping at straws here and should have done more research.

<comment><USER18> Not to mention the lack of sufficient pollution taxes that would exist in a 'libertarian society' to counter the inherent infringements on individual liberty.

<comment><USER19> Libertarians tend, by and large, to be amenable to taxing externalities like pollution.

</comment></comment></comment><comment><USER20>
        It is not true that the map of freedom will be complete
        with the erasure of the of the last invidious boarder
        when it remains for us to chart the attractors of thunder
        and delinate the arrhythmias of drought
        to reveal the molecular dialects of forest and savana
        as rich as a thousand human tongues
        and to comprehend the deepest history of our passions
        ancient beyond mythology's reach

        So I declare that no corporation holds a monopoly on numbers
        no patent can encompass zero and one
        no nation has sovereignty over adenine and guanine
        no empire rules the quantum waves

        And there must be room for all at the celebration of
        understanding
        for there is a truth which cannot be bought or sold
        imposed by force, resisted
        or escaped

~~ Greg Egan, forward of the novel Distress

</comment><comment><USER21> I think it's worth remembering/noting that Leary was heavily manipulated by the intelligence agencies, not just in their search for knowledge of mind control ala MKULTRA/ARTICHOKE/BLUEBIRD, but also as a general informant and counter-culture insider and influencer. For example, many of his space ideas were pushed through L-5 Society, but L-5 society was on the brink of collapse when rescued by huge donations from military intelligence people.

I don't necessarily think all the things they were aiming for were bad, even though I have major issues with the type of domestic experimentation they were (and probably still are) performing (Sirhan Sirhan anyone?), but in the case of the space focus, they were very much wanting to be on the edge of science for the betterment of humanity with a side effect of keeping American genuis at the head of the game for national pride reasons.

Just goes to show you that the motivations inside the dark recesses of the three letters can sometimes be at odds morally, but let's not paint people manipulated by that system with too white a brush, or forget their connections to the darkside.</comment>


Machine Learning: The High Interest Credit Card of Technical Debt (2014) - <AUTHOR> http://research.google.com/pubs/pub43146.html <comment><USER2> This article keeps going around.

There are lots of things wrong with "Machine Learning" practice that are problems of the practice instead of the subject itself.

One of the most dangerous things that comes out of academia is the "project orientation", that is, the idea that something is "done" at a certain point in time.

The "technical debt" aspect comes in when you are managing a product or a program, which can be thought of as a series of projects that influence each other.

The "paradigm" is that somebody wants to learn machine learning so they download the same set of digits that Hinton used in his papers, and then they replicate the result, and then they announce they are done. When you see everybody is chasing the same problems (Hinton's digits, the Kaggle of the day) you start to realize that the setup of a problem which can be solved by machine learning is actually worth more than the learning.

<comment><USER3> > you start to realize that the setup of a problem which can be solved by > machine learning is actually worth more than the learning.

This is a fantastic point, but I'd like to also caution readers that they should spend some time understanding the elements of statistics and machine learning before jumping into theano or Weka tutorials. Lately, I've seen a lot of voodoo ML in the valley, starting with billboards on Highway 101 that pretty much _just_ say "Artificial Intelligence & Machine Learning" along with the name of some company, like its some sort of panacea.

</comment></comment><comment><USER4> An upcoming NIPS paper seems to be a followup

"Hidden Technical Debt in Machine Learning Systems" D Sculley*, Google Research; Gary Holt, ; Daniel Golovin, Google, Inc.; Eugene Davydov, Google, Inc.; Todd Phillips, Google, Inc.; Dietmar Ebner, ; Vinay Chaudhary, Google, Inc.; Michael Young, Google, Inc.; Jean-Francois Crespo, Google, Inc.; Dan Dennison, Google, Inc.

(see [https://nips.cc/Conferences/2015/AcceptedPapers](https://nips.cc/Conferences/2015/AcceptedPapers) )

Unfortunately, I haven't been able to find the paper yet.

<comment><USER5> That's because NIPS 2015 will be held in December. Final papers are due Oct 30th : [https://nips.cc/Conferences/2015/Dates](https://nips.cc/Conferences/2015/Dates)

</comment></comment><comment><USER6> The worst are the organisations that don't have any reproducibility in their work.

Models in production that are total black boxes. There's no way to deterministically recreate them.

But I treated it as an opportunity --- was able to teach some engineering to the data science guys and they taught me some data science :)

<comment><USER7> It is surprising how often we take reproducibility for granted in the software world. With unit tests and continuous integration scenarios it becomes such a fundamental concept that it would be unheard of for developing products without them.

Then all of a sudden you have terabytes of data updating a model faster than you can keep up with it, and after a couple months, starting from scratch to get the same model doesn't seem plausible anymore. Two years of production time and you have a honking mess.

Also it is easy to fall into the trap of prototype-to-production, when you've developed a nice looking demo that suddenly has all of the real customers and none of the engineering rigor.

It is an interesting time to be in software :)

<comment><USER6> I agree - it's so challenging to keep up with Terabytes and Terabytes of moving data ... but reproducibility is so fundamental to science in general.

I'm not disagreeing, I'm just wondering if there's somehow a middle ground. What do you think? Can you share any experiences or tips?

I am running my own company at the moment, and my main dataset is about 2.5 TB, it's a very skinny table (it's actually a 191,000,000 x 6,000,000 matrix). It takes too long to iterate the whole dataset, so when I'm training my machine learning classifier I subsample the large dataset then compare previous model results to the new model, and inspect the differences.

<comment><USER7> If I have one piece of advice to give (that you probably already know), it is to have a sound way to measure results and ensure that you are improving. Usually that involves custom tooling that falls within the integration test layer. So if 'inspecting the differences' is a reproducible and statistically reliable way to know that you are good - then you probably are!

</comment></comment></comment></comment><comment><USER8> Previously

[https://news.ycombinator.com/item?id=10006293](https://news.ycombinator.com/item?id=10006293)

[https://news.ycombinator.com/item?id=8775772](https://news.ycombinator.com/item?id=8775772)

</comment><comment><USER9> These finance analogies are getting out of hand...

<comment><USER10> too subtle. better stick to "climate science".</comment></comment>


McClure steps back at 500Startups after internal sexual misconduct investigation - <AUTHOR> https://techcrunch.com/2017/06/30/mcclure-steps-back-at-500-startups-after-internal-sexual-misconduct-investigation <comment><USER2> The one person that I would have never suspected is Dave McClure. Here's a guy who didn't fit the investment world and he was smart and hustled his way in.

He started 500 startups with a female co-founder and said he chose her because she was smarter. He saw an opening for himself and talked about playing Moneyball for venture capital. He spoke often in interviews about chasing investments among founders who didn't fit the profile but were eminently backable and that included women. He blogged publicly about his insecurities and campaigned for diversity.

[https://500hats.com/commitment-to- diversity-d8a4ac8b1c12](https://500hats.com/commitment-to- diversity-d8a4ac8b1c12)

Guess it proves you can't really know a person through their writings and interviews. He was someone that I admired and I'm more than a little disappointed.

<comment><USER3> I have seen questionable material come from him [1]:

Examples: "Money Shot" with kitten spreadings its legs and "Great Products...Get you LAID".

[1] [https://www.slideshare.net/dmc500hats/how-to-pitch-a-vc- or-a...](https://www.slideshare.net/dmc500hats/how-to-pitch-a-vc-or- angel-13504703/)

edit: link directly to slides and deleted nested comment.

<comment><USER4> To be fair, the second slide directly says it is guaranteed to offend.

<comment><USER5> "heh, this is guaranteed to offend, but if you go out to dinner with me you'll definitely get this job!"

<comment><USER4> Conflating two things here. Saying something exaggerated and offensive, specifically for effect and attention, is not the same thing as a power play for sex.

</comment></comment></comment></comment></comment><comment><USER6> Without defending anyone, My honest takeout by the whole sexual harassment threshold in the bay area or the US in general is that you could never end up together or even married with a colleague in that paranoid atmosphere.

Which is exactly what I did where I live in Italy. Happily married and yes, after saying things to a colleague of mine that would have made me accused in the bay area.

<comment><USER7> There's a difference between being involved with a peer or with someone outside your reporting structure on the org chart, and being involved with someone who is inside your reporting structure. It's the differential in power when combined with sexual advances that creates problems, not the sexual advances alone.

Of course, unwanted sexual advances are a problem regardless of the relationship of the two parties, but unwanted _or_ wanted advances between two people with a superior/subordinate relationship is where we get into trouble.

At all companies I've worked for in the US, there's never been a ban or stigma against colleagues dating, as long as there's no power differential between the two people. We still of course always expect people to behave professionally within a professional setting, but after-hours is your business.

If relationships between people with a power differential are commonplace in Italy, that's... unfortunate.

<comment><USER8> Relationships with a power differential are common in the US too.

Women generally date up. This is especially common within professions with a high status since it is difficult to meet someone equal/better. View [https://www.bloomberg.com/graphics/2016-who-marries- whom/](https://www.bloomberg.com/graphics/2016-who-marries-whom/)

People generally are poor at reading others and end up pushing too far or getting offended easily ( _not_ referring to this case)

What's more likely to happen is what has been highlighted in the "sex partition" \- [https://www.amazon.com/Sex-Office-Partition-Dividing- Workpla...](https://www.amazon.com/Sex-Office-Partition-Dividing- Workplace/dp/1493007947)

Men are more likely to create more barriers to protect themselves and prevent bad optics rather than walk on egg shells around women. This in turn limits opportunities for women (aka glass ceiling).

<comment><USER9> If men feel the need to "walk on eggshells" to avoid offending women, then they're already in a bad place. Most men don't actually feel this way. If your first instinct in dealing with a woman at work is to make a sexual joke, or comment on your colleague's attractiveness, or to scheme about how you could convince her to date you, then _you_ are the problem, and you have problems, and you should do something about it. That is not normal or excusable behavior.

As for "women generally date up", that is a near tautology given the imbalance in power generally between men and women. By the mere fact that men overwhelmingly hold positions of power, women will typically "date up". There is no way around that. So it's not a useful statistic and certainly isn't evidence of anything.

</comment></comment></comment></comment><comment><USER10> Oh and he referenced his penis size at a startup event: [https://twitter.com/founderofstick/status/880977488494469122](https://twitter.com/founderofstick/status/880977488494469122)

Sarah Kunst, the woman quoted in the NYT, mentions that other women have reached out to her about McClure. Like Caldwell, also all women of color: [https://twitter.com/sarahkunst/status/881004317674577920](https://twitter.com/sarahkunst/status/881004317674577920)

<comment><USER11> I saw him speak at a fireside chat here in Berlin, and was struck by his overall juvenile attitude and idiocy. Given that that was his "shtick" I guess he was just hiding in plain sight. But I'm surprised that his poor judgement is such a shock to people when it's evident from his performances __in public __.

<comment><USER7> Yeah, that's the thing I don't get. I'm certainly no stranger to foul language (2 minutes with me in a social setting and that's obvious), but his shtick always seemed to me to be about shock value and getting a reaction, and a certain amount of braggadocio around being an "outsider", which has always turned me off.

<comment><USER12> You'll just looove his inane tantrum about Trump then: [https://www.youtube.com/watch?v=eVTVf7ffShg](https://www.youtube.com/watch?v=eVTVf7ffShg)

If one wishes to virtue-signal it helps to at least be virtuous.

</comment></comment></comment></comment><comment><USER13> Slightly OT: Everyone wants to become a CEO or VC. But the truth is you don't want to. You'll miss the times when you were a naive intern who could mess around with just everyone you met both on a private and professional level. Once you juggle millions it's over. The slightest advance is treated--with good reason--as sexual harassment.

<comment><USER14> That's only true strictly in the context of dating within the professional pool. I would argue that having more money and power is good in general, but NOT for dating subordinates and coworkers.

<comment><USER13> Yes, you are right, but it's not that easy. Also the private environment has its pitfalls.

Without noticing you become quickly a public face the more powerful you get. Then, even in a private context you have to be careful who you approach, how you approach and how many. Often private and professional environments are not clearly separated as well.

Let's take again the intern example: There's nothing wrong with a cocky intern approaching and kiss-closing dozens of women on a night out. There's nothing wrong doing this every Friday and Saturday. But some CEOs or VCs would face immediate trouble if such behaviour even in a private context would become public.

Their life isn't better.

<comment><USER15> The only way the CEOs or VCs would get in professional trouble for that behavior is if the women who they were slobbering on were women who _they have power over in their business relationships._ Rich men can (and do) slobber on as many women they want to who they have no professional relationship with, and nobody has a problem with that. It's fine, as long as you don't bring that behavior _into the workplace._

It's not rocket science. You can fool around with as many women as you want, as long as those women aren't subordinate to you in their professional roles. It's when you insist on mixing your business with your pleasure that you get yourself into trouble.

I legitimately cannot understand why so many men have so much trouble understanding this.

</comment></comment></comment></comment><comment><USER16> Very disappointing. As a 500 alum I would never have expected this, as the environment was very professional and there were a lot of powerful women in leadership positions. In fact if memory serves, at least at mountain view, the women were more numerous than the men.

Kudos to Christine for being transparent, as expected.

</comment><comment><USER17> How can a newly born organization build an organizational culture that avoids sexual misconduct as much as possible?

<comment><USER18> Proactively: Be overt about your policies and values. Even though everyone will shift uncomfortably and roll their eyes, have occasional training sessions. Make a discussion of "what is not ok to say" part of your onboarding process. Have 1 on 1s. Collect anonymized feedback.

Reactively: When offensive behavior occurs, it has to be nipped in the bud ASAP. A quick chat with a junior employee (and maybe perhaps handing over a pamphlet on sexual harassment) may be all it takes. Egregious and/or repeat offenders should be fired.

</comment></comment><comment><USER19> Someone should proofread that bio at TC, it says they have 'more than $200 in assets under management'.

<comment><USER20> That's how I characterize my beanie baby collection!

</comment></comment><comment><USER21> > "The change I want to see is a startup environment where everyone, > regardless of gender and background feels welcome and safe."

So basically her message is "it's ok to be inappropriate and stay as partner in our firm. Our investors' money is more important than sexual misbehaving". Sounds like she doesn't really deliver on her change.

</comment><comment><USER22> The sexual harassment allegations that have pervaded the tech industry this year is really awful to see.

I hope each and every person is exposed and held accountable for their actions.

It's inspiring to see all the women who are standing up and speaking out about these issues.

</comment><comment><USER23> Glad to see that guy taking a fall. He's been a complete asshole when I've seen him interact with people. Couldn't have happened to a better person.

</comment><comment><USER24> Dave McClure? No way! Who is next?

</comment><comment><USER25> something I've never understood. These guys (Kalanick, McClure) are multi millionaires, and could probably get any number of women to take interest in them on that basis alone. Why risk career suicide?

Why would they _need_ to hit on women at their _workplaces_? Why isn't the normal dating game (where they have a massive edge via being loaded) sufficient? I don't get it (at all).

What am I missing? These guys seem to be (borderline) insane and incapable of rational thought.

At the workplace do the _work_! Leave the political/religious/mating etc games outside.

<comment><USER26> I don't think that's fair to lump Travis Kalanick into the same boat as Dave McClure. Kalanick didn't sexually harass anyone personally, his subordinates did. There isn't really any evidence that Travis Kalanick tried to cover anything up either. If you read that Susan Fowler blog post regarding sexual harassment at Uber, it sounds like she was sexually harassed by one person, and the HR department wouldn't do anything about it. To me that sounds like the harasser and the HR department are the guilty parties, not Travis Kalanick.

<comment><USER25> I concede the point (and it is a good one, Thank You).

I don't follow this stuff in any great detail and those are just the first names I thought of. Erroneously, as it turned out, and as you correctly point out.

Fwiw, I am not really interested in "social justice" issues and I use this forum mainly to get insight into purely technical issues, and I really should keep out of such politically/ideologically charged threads. Note to self.

Thanks again.

(me exits thread and topic)

</comment></comment></comment><comment><USER27> Full report from NYTimes [https://www.nytimes.com/2017/06/30/technology/women- entrepre...](https://www.nytimes.com/2017/06/30/technology/women- entrepreneurs-speak-out-sexual-harassment.html)

</comment><comment><USER28> Apologies, I misattributed a quote.

<comment><USER29> We detached this subthread from [https://news.ycombinator.com/item?id=14674708](https://news.ycombinator.com/item?id=14674708) and marked it off-topic.

</comment></comment><comment><USER26> "This guy f*cks!" \- Russ Hanneman

<comment><USER30> Actually he doesn't.

</comment></comment><comment><USER31> When these reports about sexual harassment are so vague about what actually happened it does a disservice to everyone. How is anyone supposed to know where the line is between hitting on someone and sexual harassment? Many women like to play hard to get. Many men out there are just plain dumb when it comes to how they show their interest in a woman, not malicious. With more specifics they'd be able to learn what's right and what's not.

<comment><USER32> I assume you actually realise why they are vague, but in case you don't: it's polite. Many victims find it humiliating to talk about, and adding details often adds to this humiliation.

In this case many details were published elsewhere already, in enough detail to offer little excuse.

<comment><USER31> Was the victim(s) identified? If not, then we should be free to talk about the specifics without making any identifications. Again, there's no details to go on here.

<comment><USER32> _Was the victim(s) identified?_

Yes, in the other coverage.</comment></comment></comment></comment>


Auctomatic launches better tools for eBay powersellers - <AUTHOR> http://venturebeat.com/2007/10/22/auctomatic-launches-better-tools-for-ebay-powersellers/

<comment><USER2> What they're trying to do sounds great... but I wonder how well they really know their user base...

Scheduling: Without basic feature like scheduling, I CAN'T even test them out. Most "power seller" sell the same items over and over, so it doesn't matter how much I love the interface, if I have to sit there manually launching the listings myself, it's just not going to work...

Inventory management: The idea is nice, but guess what... I'd say 80% of the successful eBay seller will branch out to other platform like amazon & their own site. If you're only monitoring my eBay inventory, it's pretty much pointless... because the idea behind monitoring inventory level for eBay seller is so they don't over list and piss off their buyers, but unless it's synced up with my other selling platform, it's not going to do me any good...

<comment><AUTHOR> hey cyggie,

thanks for the feedback. to address your points:

Scheduling - yes we totally agree scheduling is a critical feature and it's at the top of <http://features.auctomatic.com> and we'll be working on it asap. We've found that powersellers are still happy to test out the beta and give us really useful feedback without it - that was the purpose of the first beta launch so it's not been a problem.

Inventory management - there's nothing tying inventory in the app to eBay specifically. It just happens that eBay is the first platform we're supporting but we'll be offering multiple channel support as soon as the core ebay product is ready. We'll also be tying the inventory into a backend accounts package like Quickbooks to provide a one-stop shop system for complete inventory control.

Please let me know if there's any other feedback you have - it's exactly to hear this that we launched the beta so it's much appreciated. If you have specific feature requests please feel free to submit and/or vote at <http://features.auctomatic.com>

</comment></comment><comment><USER3> Smalltalk?

<comment><USER4> Smalltalk!

<comment><AUTHOR> and some ruby :)

<comment><USER5> and what about Patrick's CROMA Lisp?

</comment></comment></comment></comment><comment><USER6> Congrats!!</comment>


They Will Steal Your Idea. They Cannot Steal What Really Matters - <AUTHOR> http://www.businessinsider.com/they-will-still-your-idea-they-cannot-steal-what-really-matters-2010-7?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+typepad%2Falleyinsider%2Fsilicon_alley_insider+%28Silicon+Alley+Insider%29 <comment><USER2> dup: <http://news.ycombinator.com/item?id=1532412></comment>


New Threat Can Auto-Brick Apple Devices - <AUTHOR> http://krebsonsecurity.com/2016/04/new-threat-can-auto-brick-apple-devices/ <comment><USER2> So, all this encryption and passcode security but iOS trusts any response it thinks is from ntp.apple.com?</comment>


Show HN: Reflect and remember more from reading - <AUTHOR> https://kaffae.com <comment><AUTHOR> "Reflection enables us to correct distortions in our beliefs and errors in problem-solving." \- Jack Mezirow, Columbia University.

I felt so stupid. As a self-taught engineer, I felt I needed to stay on top of everything online, driven by constant reading. But what's the use if I don't remember anything?

This is a Chrome extension that assists your memory on the premise of spaced repetition. It tracks articles read, and give you a daily report.

Features:

\- Daily report with read time \- Memory from the old similar articles \- Automating 81 taggings \- Article/book suggestions \- Web interface for search \- Friends' update

</comment><comment><USER2> As usual with anything that isn't open source, I have significant doubts about the longevity of this. Making a few questions on each article and putting them in Anki is probably more effective and also pretty much certain to still work in a few years time, for free.

<comment><AUTHOR> I used Anki before and that is definitely useful for vocabularies or studying for exams.

To give a context, I read about 10 articles every day. Some users do for 40 a day. At that point, Kaffae becomes more useful as a general reflection. Either way, there's nothing stopping people from using both as it fits their need.</comment></comment>


One Thing That Makes Google's Self-Driving Cars Work - <AUTHOR> http://www.theatlantic.com/technology/archive/2014/05/all-the-world-a-track-the-trick-that-makes-googles-self-driving-cars-work/370871/

<comment><USER2> If you're wondering what the One Trick is to decide whether it's worth reading the article, it's that their maps of Mountain View are more detailed than normal maps: they're full world-level models of all of the spaces and areas of streets in the city. (The article also touches on general machine learning strategies, rather than hard-wired functionality.)

If you wish a less irritating title, then, I'd put it at: "Google-scale machine learning and data collection is the thing that makes Google's self- driving cars work"

<comment><USER3> TL;DR:

1\. They map the streets to _inches_ , right down to the height of the curb.

2\. They record prior trips in such detail, data-mine it appropriately, and then hand-massage the results.

So far they've done this in little more than the Mountain View area. Having done the hard work in that limited region to that much detail, they now can derive how to automate the process. I imagine their recent high-detail-mapping "phone" will be a key part of this, tracking minute aspects of how someone travels from A to B, and merging that info with many other identical & overlapping trips so the cars can make the trip darn near blind, with a little help from monitoring immediacies (like actual position, pedestrian detection, weather, etc).

<comment><USER4> Odd that the article mentions Oakland as one of the places you couldn't use a Google car because the New Yorker's article mentions Levandowski driving Berkeley to Mtn. View through Oakland via 880.

[http://www.newyorker.com/reporting/2013/11/25/131125fa_fact_...](http://www.newyorker.com/reporting/2013/11/25/131125fa_fact_bilger?currentPage=all)

They also hinted that the cars drive over the speed limit to match prevailing traffic.

<comment><USER5> My understanding is that they need the ultra-specific maps for the (more challenging) city-street driving, not the (less challenging) highway driving.

</comment></comment></comment></comment><comment><USER6> HERE maps has been mapping the world at this precision for years. Look up HERE HD map and our partnership with Mercedes. Disclaimer, I work for HERE and my opinions are my own and I don't speak for the company. It is just frustrating to read articles that make statements similar to, and i am paraphrasing here, "there is possibly no other company other than google that can get this level of detail".

<comment><USER7> i think the sentiment isn't that other companies can't gather that scale of data, but that they probably are unable to tie the whole stack together and apply state of the art algorithms to it. it seems that the self driving car project is formulated as one giant online learning problem. google seems to stand head and shoulders above pretty much anyone when it comes to running production-quality, large scale, online learning algorithms.

</comment></comment><comment><USER8> This also seems like a good place for some 80/20 value. Doing this for all highways and major roads would be a small fraction of all roads, but likely cover a very large percentage of miles driven. Car drives 90% of the way, and you take over for the first and last couple minutes. Or trucks drive a known route, and somebody meets them at the end.

<comment><USER9> I was thinking the same thing. Sure it'd be cool to have your car park itself and all, but I don't mind doing that myself. The value is in dealing with the monotony of commuting or taking a road trip. If I could be doing something else on middle 95% of that 150km trip I take every couple of weeks, that'd be awesome.

</comment></comment><comment><USER10> The article made it seem Nissan's engineers couldn't fathom not using car-to- car communication to enable autonomous driving.

I found it hard to believe anyone act that way. Relying on car-to-car communication would create an enormous chicken and egg problem.

I suspect the author overstated the level of disbelief here.

</comment><comment><USER11> I wonder about things like:

1\. sudden road changes, like the appearance of potholes

2\. avoiding puddles which can cause one side of your car to hydroplane

3\. taking a 'rain line' when the road is wet. (Traffic tends to put slight ruts in the road. They're enough to make slight puddles. If you drive slightly off-center, your tires will be on the high spots and less likely to hydroplane, that's that 'rain line'.)

4\. avoiding icy spots

<comment><USER12> That's why the car has a ton of sensors all over it. For modeling all the dynamic behavior occurring on or around the previously-modeled road.

It's much easier for the on-board processing to start with a baseline and then figure out how the world differs than to start from scratch from the sensors.

<comment><USER11> Detecting puddles can be awfully tricky, they can be lighter than the road or darker than the road, depending on the angle of the light.

There are other issues, too, such as I've been behind gravel trucks that were constantly dropping gravel, and other vehicles with a clearly unstable load that I get away from. I also give wide berth to cars that don't appear to be driven in a stable manner.

</comment></comment></comment><comment><USER13> Really this is something that almost everyone who drives does subconsciously every time they drive. Driving in a new environment is stressful and more difficult because you haven't mapped out the terrain and so you're working entirely from what you see and not from a virtual model in your own head.

Obviously the Google car's data collection is more extreme and precise than that which happens in your head, but that seems like it's mostly just because they don't yet entirely know what they need.

And this, in the long run, will be part of the advantage of these cars once they get the process more automated. I expect that when you can finally buy one of these cars they'll have a (perhaps opt-out) system where terrain data is collected and merged into Google's own system to provide better data for future drives for not just you, but everyone else as well.

And that'll be one of the reasons it'll be safer. If also a whole bunch more creepy.

</comment><comment><USER14> Very interesting. I never knew that Google was collecting all this data for their cars; I assumed they worked by assessing the scene in real-time. I guess this means that, if Google's self-driving cars are ever widely legalized, their users may have to stick to a set of "allowed roads", and not venture off the beaten path without manual control.

Like the author says, the idea really does have a strong whiff of Googleyness. Bind-bogglingly ambitious, technically extremely impressive, and fairly creepy.

<comment><USER15> > if Google's self-driving cars are ever widely legalized, their users may > have to stick to a set of "allowed roads"

one can also imagine that to renew car registration one would have in addition to evidence of insurance to also provide evidence of updated subscription to the Google road database

<comment><USER16> I'm sure the end goal is to actually be able to plop down a car anywhere and have it go, doing all of the data processing in real time. Even if Google could map out all those details, the world just changes too darn often. Feels like it'd be a liability to rely on potentially out of date Google information.

</comment></comment></comment><comment><USER17> Doesn't this make the cars, in some sense, less 'autonomous'? Plonk a google car down in some unknown street and it won't be able to drive there.

Or, more likely, if you haven't kept your google car data subscription up to date (or can't agree with their latest privacy policy change), your self- driving vehicle suddenly becomes useless?

<comment><USER18> Of course. We are still decades away from being able to replicate the human visual system (and whole brain really) that is needed to unable autonomous vehicles. Of course by then we may not need them anyway because anywhere not covered by a sufficiently high bandwidth signal in 30 years is probably somewhere you wouldn't take a self driving car to anyway.

</comment></comment><comment><USER19> We edited the linkbait title.

<comment><USER20> They didn't even get the linkbait right; it's supposed to be "one weird trick".</comment></comment>


Chocolate Helps Eliminate Cough. - <AUTHOR> http://sbms.blogspot.com/2010/12/chocolate-helps-eliminate-cough.html

<comment><USER2> I hate headlines like this.

Chocolate doesn't help eliminate coughing, because it doesn't contain enough of the active ingredient.</comment>


Jack Ma and Elon Musk Hold Debate in Shanghai - <AUTHOR> https://www.youtube.com/watch?v=f3lUEnMaiAU <comment><USER2> Jack Ma talks on completely different level it seems.

But I agree about artificial intelligence is as bad as name as alibaba intelligence.</comment>


Company ignores giants, sues small fry over wishlist patent - <AUTHOR> http://arstechnica.com/news.ars/post/20080717-patent-troll-targets-small-fries-for-quick-win.html

<comment><USER2> There's a reason they're avoiding the giants. They can knock out the little guys who can't mount much of a defense, and then use it as a precedent to go after bigger fish who can give them hard cold cash. Amazon would pony up the big guns lawyers and squash these bugs - tiny startup types will roll over and die because they can't weather it.

Of course, I can't imagine demonstrating prior art on a "Method and apparatus for creation and maintenance of database structure." is going to be very difficult if the patent as awarded in 2005.

</comment><comment><USER3> "Method and apparatus for creation and maintenance of database structure."

Clown-shoes. I think they also hold the patent on "process and action of making outlandishly stupid patent claims".

I think they should be sued for wasting the patent office's and court's time.</comment>


EFI Sucks (2012) - <AUTHOR> https://plus.google.com/+LinusTorvalds/posts/QLe3tSmtSM4 <comment><USER2> UEFI is a really unfortunate second system with all the markings of Intel's internal cultural issues imbued onto it that are hard to not see if you've worked with intel for any length of time. In the common case of an end user running an operating system, it's really hard to botch that without being kicked out of the market in ways that can't be worked around so it wont matter to most computer users. But UEFI is only a minor improvement over BIOS versus other industry standards for the people that could reap the benefits of an open and extensible bootloader in embedded, appliances, and hyperscale -- device manufacturers and operating system developers.

</comment><comment><USER3> I'll go against the grain here: I go out of my way to use UEFI over BIOS, because it Just Works for me.

When I got my first UEFI-using notebook in 2012 (same year as the submission), things were a bit rough because the Arch wiki did not quite know what it was talking about, and the Arch ISO was not UEFI-bootable, so you had to use some trickery to install an UEFI bootloader, but even then, it only took me two hours to figure out partitioning and install the bootloader.

Since then, stuff has gotten much better. Just recently, I switched my VirtualBox VMs to use UEFI emulation instead of BIOS emulation because it allows me to use the well-designed systemd-boot (previously known as gummiboot) instead of that absurd abomination called Grub 2.

<comment><USER4> Now try to install arch to a bootable USB stick from your UEFI booted system, and see all hell break loose.

I boot UEFI, but it's just so bloody cumbersome and fragile. The entire concept of having boot configuration in NVRAM is _terrible_.

<comment><USER5> Not to turn this into a support thread but this weekend I tried to install Arch on a new, UEFI-enabled laptop and I've been stymied so far because I can't get the laptop to recognize my Live USB. I've built it with Rufus, dd for Windows, and Easy2Boot all with the same result (no bootable device) even though it works on another machine. Could it be because I created the USB on a PC using UEFI?

<comment><USER3> Huh? I just `dd` the official image onto a USB drive and it works 100% of the time, with various UEFI-using machines.

(Except for that one Gigabyte mainboard which I returned upon finding out that its v1 firmware will only boot Windows 8.1. Not even Windows 8.0. There was a firmware update that fixed the issue, but without a bootable OS, applying it is a chicken-and-egg problem.)

<comment><USER5> Well then, I guess my problem likely lies elsewhere. Thanks for the reply. :)

And that has to be the strangest "feature" I've ever heard of from a hardware firm. Was it maybe purpose-built for a bulk order of machines that were going to be pre-loaded with Win8?

</comment></comment></comment></comment></comment><comment><USER6> The one thing I really love about EFI on non-macs is that you don't need a boot loader. You just compile your kernel with an EFI stub and whatever you want in the initrd and then select it with the firmware GUI.

 _That 's nice_

<comment><USER7> I didn't understand a lot of what you said. Any sources?

<comment><USER8> The Arch wiki in the sibling comment is a good resource for learning a lot. I'll try to (over)simplify the short version here:

With the old BIOS-based boot process, the computer (the hardware/motherboard; not the operating system you ran on it) would, when it started up, look around for installed operating systems to boot. It wouldn't look too hard: on each hard disk, it would look in one (or, if you were lucky, four) places for a specially-prepared segment _outside_ of the data installed by the operating system. This segment isn't a file or something that you can browse to normally on the drive (though some things shimmed it so it appeared thus); it's a non- file special segment _outside_ of the OS's normal data/files. That segment (well, segments, but still) had to be set up just so otherwise the computer (BIOS) wouldn't find your OS to boot it. Doing this was often tricky, even more so when you needed multiple operating systems to be bootable. Doing this was also pretty inelegant, since if you wanted to stick an operating system on a sub-partition of a disk, as part of the installation process you had to mess with data that affected _everything_ on that disk, not just what was in the sub-partition. It worked, and was simple, but it was the equivalent of being forced to modify a single central global variable in a software project every time one sub-part (file, function, whatever) of that project wanted to use a new library. For an excellent writeup of the gritty details of the BIOS/MBR startup process, see this document: [https://neosmart.net/wiki/mbr-boot- process/](https://neosmart.net/wiki/mbr-boot-process/)

UEFI, put most simply, looks around for installed operating systems a lot harder than the BIOS method did. It does a lot more than that, but the benefit GP was describing accrues from UEFI being much more capable in terms of discovery: instead of checking a single global prepared location for bootable OSes, UEFI can look in the files on the drive and do the intuitive thing: "looks like these files are part of an operating system; I'll give the user an option to boot from it".

This doesn't always work perfectly, and there's a lot of complexity (and criticism) I'm hand-waving away here, but that's the gist of the difference.

Sorry, turned out to be a not-so-short version.

<comment><USER6> If it just did discovery that would be pretty annoying. Most firmware actually lets you select a file to boot manually, that's what I like.

</comment></comment></comment></comment><comment><USER9> Many of the issues are just that BIOS is old and stable while EFI and UEFI are new and immature. There should be a testing suite for UEFI like the CSS Acid test so there is a baseline of working functionality. But instead the test is 'does it run Windows' and that really is only a small part of it all.

</comment><comment><USER10> A lot of the painpoints are gone, understandbly, but some still exist.

The biggest suck on EFI is that it uses PE fileformats. I would have liked it more if it would have just loaded a raw PIC binary or ELF. And not used Windows Calling Conventions.

<comment><USER11> That is not important. The real bad part is that you still cannot easily load modules of your own to work around broken setup by mainboard manufacturer or Intel or boot rom in the device. This essentially causes lock in. Or even disable some broken modules.

(Security has nothing to do with it, the module can be crypto signed by user installed key.)

Plus the critical hardware setup documentation is not being released at all.

Another is the use of SMI to communicate with the thing which just does not play well with a preemptible OS.

Memory map handling is additional badness on top.

<comment><USER12> That's more of an implementation problem of common EFI vendors, not EFI itself, sans SMI and mmaps.

</comment></comment></comment><comment><USER13> So more of Torvalds on EFI:

[http://yarchive.net/comp/linux/efi.html](http://yarchive.net/comp/linux/efi.html)

And here he is on ACPI:

[http://yarchive.net/comp/linux/acpi.html](http://yarchive.net/comp/linux/acpi.html)

<comment><USER14> Linus spent a lot of energy and Management by Perkele to make sure stuff worked and kept stable under ACPI. People would submit patches that fixed some things and broke others, and Linus put a stop to this

I'm not so sure about the ACPI standard, it certainly has some warts but the main issue seems to be manufacturers who ship the thing once their hardware manages to boot Windows. Once. And note I said boot, not run.

</comment></comment><comment><USER15> There's a lot about it that's bad, but the worst is definitely that it allows the firmware to keep running after the OS boots, interfering with its normal operation. Thanks to SMI, the system is non-deterministic: No latency promises can be made.

<comment><USER9> The same happens with BIOS, that is how many of its settings work.

<comment><USER15> Yes it does, but that's only of historical value by now.

Sigh, they had one job, and they managed to screw it up, so we do still have to put up with this.

</comment></comment></comment><comment><USER16> Is EFI the system that my newer motherboards use when booting up?

Is he talking about the system that has replaced grub on most of my machines with a more reliable one that's built into the hardware?

In 2012, EFI/UEFI was pretty unreliable because the implementations were bad and the software support was terrible. Nowadays, I find it preferable.

</comment><comment><USER17> Unfortunately his statement is still valid even after 6 yrs, it is still a complicated disaster. And it uses Fat32 and PE. An abomination in my view.

<comment><USER18> FAT32 is a good choice IMO. It's the simplest of the "mainstream" filesystems.

<comment><USER19> correct me if I am wrong but it's still patented by Microsoft. Also time precision is up to even seconds (i.e. it can not store file stamp 'modified at 10:00:01')

<comment><USER20> > Also time precision is up to even seconds (i.e. it can not store file stamp > 'modified at 10:00:01')

In the pure form of the file system, yes, but with VFAT (which also adds long file names, creation time stamps, and access time stamps), the precision is exactly 1 second increments.

<comment><USER21> My main memory of VFAT comes from Windows 95 (or was it 98), I remember that when you saw this word anywhere, this meant your operating system is now borked beyond any repair.

</comment></comment></comment></comment></comment><comment><USER22> > It's just sad how people always try to "improve" on old standard interfaces > by then over-designing the improvements to the point where the new interface > is just overwhelmed by complexity.

Did Linus also criticize the complexity and untested nature of systemd?

<comment><USER23> How is systemd an 'interface'?

<comment><USER24> It's how you interact with daemons.

<comment><USER23> Ah, right.

I suppose it could also be argued that the kernel is also unnecessarily complex as well?

<comment><USER25> Possibly, but a pretty obvious retort is that it's necessarily complex; there is nothing else to do all the things that it does. Whereas for BIOS and EFI the argument would be that they should do as little as possible to hand over to the real operating system.

<comment><USER26> > but a pretty obvious retort is that it's necessarily complex

I would like to offer, as a counter example, every micro kernel ever.

<comment><USER12> You mean all those micro kernels that are in widespread use and see huge market shares?

The closest relative is NT and that is a hybrid, not purely micro. Modular and hybrid kernels (Linux and NT respectively) offer better external vs internal complexity tradeoffs; Linux and NT are internally complex since they do all the hard stuff, micorkernels are externally complex since someone else needs to do the hard work.

Microkernels will shove this exact complexity elsewhere not make it go away.

<comment><USER26> The most prolific (non-embedded) operating system on the planet is MINIX, a micro kernel based OS. On the embedded, medical, automotive, and aviation side there are plenty of micro kernel OS's that give Linux a run for its money. Just FYI.

<comment><USER12> But is that because it's a microkernel or for other reasons? Crash stability can be achieved in monolithic and modular kernels too, it's not unique to microkernels.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER27> I remembering reading this a while ago. EFI just tries to do too much and thus is too complicated.

Let alone the concerns that secure boot and other OSes.

</comment><comment><USER28> Arch Linux on VirtualBox using EFISTUB

Super simple steps to install an Arch Linux guest on VirtualBox with pure EFISTUB. No bootloader! Fill in the blanks with [https://wiki.archlinux.org/index.php/installation_guide](https://wiki.archlinux.org/index.php/installation_guide)

timedatectl set-ntp true

gdisk /dev/sda

# 256 MB partition type EF00

mkfs.fat -F32 /dev/sda1

mkfs.btrfs /dev/sda2

mount -o discard,compress-force=lzo /dev/sda2 /mnt

mkdir /mnt/boot

mount /dev/sda1 /mnt/boot

pacstrap /mnt base base-devel btrfs-progs vim openssh

genfstab -U /mnt >> /mnt/etc/fstab

arch-chroot /mnt

ln -sf /usr/share/zoneinfo/America/New_York /etc/localtime

timedatectl set-ntp true

vim /etc/locale.gen

locale-gen

vim /etc/hostname

vim /etc/hosts

systemctl enable dhcpcd

systemctl enable sshd

passwd root

useradd -m user

passwd user

# /boot/startup.nsh

fs0:\vmlinuz-linux rw root=/dev/sda2 initrd=\initramfs-linux.img

exit

umount -R /mnt

poweroff

</comment><comment><USER29> Had the same experience with my plastic MacBook from 2007 and I could install Fedora 27 and Mint using a related program to iso master. Good to know about ISO master.

Wrote about the process: "The 2007 plastic MacBook lives again with Mint-y Linux awesomeness" @harijay [https://medium.com/@harijay/the-2007-plastic- macbook-lives-a...](https://medium.com/@harijay/the-2007-plastic-macbook- lives-again-with-mint-y-linux-awesomeness-374469cc977e)

</comment><comment><USER30> For this area, my ideal world is one where both the BIOS and UEFI are dead, replaced by something that is inspired both by OpenFirmware and coreboot.</comment>


Most Beautiful Places to Visit in France 2019 France Travel - <AUTHOR> https://rythere.com/best-most-beautiful-places-visit-france/ <comment><USER2> My favorite is the lavender fields of Provence. When we came over the hill and this purple landscape opened up, it felt like a completely different world. The only problem with scenery in France (especially around the Rhone river) is all the power-lines from all of the power plants.</comment>


Just 4 miles from Center City, a heroin hellscape hidden in plain sight - <AUTHOR> http://www.philly.com/philly/health/addiction/A_hidden_heroin_hellscape.html <comment><USER2> > "Police arrest a heroin addict along the tracks."

We humans think that we are intelligent and just, yet I would love someone to explain the wisdom and/or logic behind this policy; to arrest someone who is addicted; to give someone a criminal record which removes any possibility of bettering oneself all for the so-called 'crime' of succumbing to an addictive drug. Even more appalling is that it is a subjectively produced list of drugs that will get you arrested, as other drugs won't.

<comment><USER3> I'll give it a try.

Why arrest an addict? Its because by attaching a punishment to the behavior we attempt to alter the fundamental utility calculation that is taking place when someone decided to take a hit. That person knows it is illegal to take that hit, but they also know two additional things. First they are going to enjoy it, a lot. Secondly the chances of being caught are very slim. In an attempt balance this calculation on the side of "don't do the drugs" we make the penalty for getting caught harsher and harsher. The idea being if you make the penalty harsh enough eventually people will see its not worth it and they will choose not to do the drugs.

While you might immediately reply that this is nonsense since the addicts are not driven by rational thought in that moment when they are seeking their next fix there are many people who aren't as fatalistic about the rationality of people in that moment, and the penalty isn't really about _that_ person. Its about the person who is choosing to take their first hit, or who is on the rebound and is thinking about relapsing. That stiff penalty might just be the factor that makes a recovering addict not go back to his old habit.

The case against punitive policy's isn't as cut and dry as your comment might make it out to be, and unfortunately our understanding is still evolving. There is a lot that goes into policy making besides just what to do with someone addicted right there in that moment.

<comment><USER4> When someone is already an addict, the addiction almost always wins the "fundamental utility calculation."

<comment><USER3> The addiction doesn't always win. I personally know people who have kicked a heroin habit. From talking with them one thing they will tell you is that while the addiction doesn't always win, it never gives up trying either.

<comment><USER5> And those people would be the first to tell you that it almost always wins, because it likely did until they finally kicked it.

</comment></comment></comment></comment></comment><comment><USER6> Open-air drug situations always get the attention (google Philadelphia Badlands for previous coverage).

But if you drive around Philadelphia without knowing which areas to avoid, you'll quickly realize that no part of the city is more than a handful of blocks away from extreme poverty and all the mayhem that comes with it.

(Aside: one of my Philly cousins has a steel plate in his head after being attacked with a baseball bat near the Temple campus a few years ago; another one keeps a gun at work in North Philadelphia and has had to use it.)

</comment><comment><USER7> Philadelphia like most cities, is good every couple of blocks. North and west got bad pretty quickly. I had a coworker, who bought and sold drugs. He was openly doing this in the break room. He mentioned places where the cops just ignored drugs, and focused on violence. Knowing they couldn't curtail the drug use. I know on the weekend in Rittenhouse pot was sold in plain sight. Cops were on patrol but didn't do anything about it.

The problem mentioned else where is gentrification. If you're kicking more and more people out. They live on the streets or abandoned houses. No jobs, then they just sell drugs. Temple area is a prime example. The school had like their own private force. Stay on campus fine, a couple blocks off nope. This was due to subsidized housing, where people were living at extremely low rates. The city was trying to fight this tooth and nail. Brewerytown was another example. Two property managers were buying up all the reality, and kicking people out. I didn't really want to step outside my apartment for fear of being harassed.

The surrounding neighborhoods as well were bad. Just from a filth standpoint. I forget the name but it was West Philly a few miles from 64th street station. I was cleaning up the streets making up for a DUI. There was trash all over, needles, diapers, etc.

Then there's the unspoken, or less spoken bit. The drug triangle between NYC, Baltimore, and Philly. Heroin came in on the docks in Philly from what I've gathered.

Living in Wilmington I got to see first hand the turf war between NYC and PHIL. There were constant drive-bys and you'd hear on the police scanner. Either NYC or PHIL license plates fleeing the scenes. The genius kids in Wilmington, decided to stop acting as a trading point along I95. And instead start making and selling their own stuff. That went over well.

So they're trying, but what's the solution when there are no real jobs to be had. People are being kicked out from their homes?

</comment><comment><USER8> I visited Philly a couple of times last year while staying in NJ. I was really impressed with the downtown area, it was clearly a nice city with tonnes of potential. Then we went for an excursion to somewhere on the west side of the river and wound up driving for a few miles through a hellscape of run down poor urban neighborhoods that were depressing, and frankly scary. It blew my mind that an area like that existed. It surprised me such a well laid out urban area right on the fringe of a major city would be in such bad shape, I expected it to be full of hipsters.

<comment><USER9> West Philadelphia is mostly students from Penn and Drexel, at least up until 45th St. or so. The "hipsters" you're talking about mostly live in south/east Philly (Italian market, fishtown areas). Both are being gentrified at an accelerating rate.

<comment><USER3> Philly is late to the gentrification that most other cities are dealing with, its going to take a bit longer for the really prime places to price out people who are willing to move into the seeder neighborhoods.

</comment></comment></comment><comment><USER10> 4 miles? In San Francisco, they are shooting up right on Market St in the middle of the city. And recruiters wonder why I am not willing to re-locate to SF for an incredible opportunity.

<comment><USER11> At 6th and Market, a woman was screaming at her (boyfriend?) about the people whose dicks she'd sucked to get (I'm not quite sure), and he'd run off and used it all without sharing just after buying it. I was honestly tempted to give her money to get her whatever it was she needed so badly.

</comment></comment><comment><USER12> > ... heroin market, smack dab ...

Heh. That must be deliberate.

</comment><comment><USER13> that's possibly the most obnoxious case of scrolljacking i've ever seen: attempting to scroll down the page triggers an auto-playing video that prevents further scrolling.

<comment><USER14> NoScript deals with that issue flawlessly, it seems.

</comment></comment><comment><USER9> You could find something like this in or around most major areas.

<comment><USER15> What about Manila? Do people take drugs openly in Manila?

<comment><USER11> Are you seriously suggested we kill these people? They are _people_ for fucks sake.

<comment><USER15> I'm just asking whether the Philippines' policies are sufficient to deter people from taking drugs. You're the one who is inferring anything on top of that.

It seems to me, however, that the overwhelming priority of our heroin policy should be ensuring that people who aren't already taking heroin _don 't start_. Those who have already got hooked are pretty much doomed already, they should be a lower priority than those who can easily be saved. It seems to me that many people advocate a "softly softly" approach to drug users that fucks over the first group to help the second, and thus ensures that our drug problems continue instead of being wiped out.

<comment><USER16> > Those who have already got hooked are pretty much doomed already

That is definitely not true (you can recover from an addiction and there are examples all around you) and a really bad policy to follow if you really want to eradicate addiction, since you are basically marginalizing large groups of people. Saying that you need to "save" those who are not addicted implies that everyone is at risk, but the mechanics of addiction vary from person to person and are heavily influenced by socioeconomic background.

Please refer to professionals that work in this field before proposing approaches like this.

<comment><USER15> Argument from authority? Is that the best you can do? Those "professionals" don't have a great track record, which is why drugs are still a huge problem.

So I repeat my question: how are things working out in the Philippines? Are the harsh policies being pursued doing a good job of decreasing the drug problem? If they are, perhaps we can think about adopting aspects of those solutions while leaving out some of the more problematic aspects such as extrajudicial executions.

<comment><USER3> In the eyes of most of the rest of the world the policies in the Philippines are doing a good job of slaughtering citizens for morally dubious causes. The drugs are being fronted as a way to usher in dictatorial authority for the state and corrupt criminal elements.

Drug use is no different from any other vice, and the nature of addictive behavior is that most people will find some object to attach themselves to if you removed all drugs from the picture ( perhaps it would be human trafficking or gambling, both of which are widespread ) essentially what the people have done is shown that by being presented with a present danger they will willingly give over the very decency that allows a society to function. So no even if mass slaughter did manage to end the drug problem in the Philippines there is no way it should be accepted anywhere else, because it's an inhumane policy.

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> The internet means you can ignore this, and this is why Trump won. You don't have to see it if you stay home and commune electronically with people with the same backgrounds who agree with you.

<comment><USER5> A lot of us walk past it everyday and still ignore it. The internet and Trump is nothing new here.</comment></comment>


Partially Stepping Down Isolation - <AUTHOR> https://www.jefftk.com/p/partially-stepping-down-isolation <comment><USER2> > Getting closer than that with people who have had COVID and tested positive > for antibodies with a reliable test is generally ok

I haven't done the research -- but I get the impression that a positive test result in MA, where the base rate is very low, would be more likely a false positive than a true positive.

I suppose the false positive test varies a lot between tests too. But do people generally know which test (and hence which false positive rate) they received?

<comment><USER3> (author)

The person would need to both have pretty plausibly had COVID (positive viral test, clear symptoms during the time when COVID was widespread in their area) and also test positive for antibodies.</comment></comment>


Calculating Mean Time To Data Loss (and probability of silent data corruption)  - <AUTHOR> http://www.zetta.net/_wp/?p=147 <comment><USER2> I have a laptop harddrive that is about 5 years old. I backup to a USB drive every other day. It is inevitable that this drive will fail at some point. When is the optimal time to buy a replacement drive? I have always assumed that I should just get one when my current one fails, but this could come at an bad time (when I'm travelling etc.) Is it ever better to just buy a new HD when I have a chance to mess with doing reinstall?</comment>


New York pressures Tesla to open up Supercharger network - <AUTHOR> https://electrek.co/2019/07/23/new-york-pressures-tesla-to-open-up-supercharger-network/ <comment><USER2> This wasn't unexpected by many. Tesla put forth such a robust system that it was obviously going to be a temptation for "do good government officials" who want a feather in their cap regardless of how they get it. They will do this out of "fairness" but the real game here is, getting all charging systems to a point to where they are easier to tax. As in tax consumers to make up for the losses in petrol taxes. Many states are already putting up yearly tag renewal fees on EVs that are in some case excessive.

There are all sorts of regulatory pressures that can be brought to bear on Tesla if they don't comply, changing the law is nothing to people like these commissioners. They can simply make it to where systems that don't accept Credit cards or support all models of cars pay additional fees or penalties.

<comment><AUTHOR> You should probably read the article. Tesla wants a government hand out. The government will give them a hand out as long as they use CCS plugs and any EV can use the charger.

Sounds fair enough to me.</comment></comment>