Joseph Stiglitz: The economic mess private-equity giants have created - <AUTHOR> https://www.businessinsider.com/joseph-stiglitz-private-equity-impact-us-economy-jobs-wages-2019-12 <comment><USER2> Joseph Stigltiz is a nobel prize winner so it seems ridiculously of me to disagree... but as someone who worked in the industry, the amount of debt that lenders are willing to lend was not in our control - its a market with supply and demand like any other. I don't believe that legislation that decides how much leverage is OK is more efficient than a market that decides</comment>


Despite S.E.C. Warning, Wave of Initial Coin Offerings Grows - <AUTHOR> https://www.nytimes.com/2017/08/07/business/dealbook/initial-coin-offerings-sec-virtual-currency.html <comment><USER2> I was involved with one of the bigger ICO right at the beginning of the ICO craze. I had pretty regular conversations with the project founder and was in talks to become the dev evangelist. The project had raised ~$5 million in ETH (this is when ETH was trading around $80). Despite the fact that this project had raised a crazy amount of money the whole project was being conceptualized and coded by a single 23 old guy who was promising features that much larger projects with teams of the best people in the field were yet to solve. Not to mention the project was blatantly lying about it's PoW algorithm.

When I tried to point out that the project should use some of that money to organize the software engineering aspect the founder got pissed off with me accusing me of trying to run the project. They had a second round and raised even more money (in addition to the insane capgains on their first round).

I check the github from time to time and it appears they've got at least 2 other devs involved and may actually bring a blockchain to market but this doesn't hide that fact that the project needed nowhere near the amount of money they raised. Hell they could've used a couple hundred grand from the first round and literally just paid a team of people to build the blockchain for them. did I get off of a gravy train? Yes. But there are more things to life than money.

<comment><USER3> If you're launching one of these, you don't really need investment. You just make sure you own the first batch of currency and get rich if it takes off. If you need investment then you don't really believe in your own stuff do you?

Ponzi Ponzi Ponzi.

<comment><USER4> That guy on TV keeps telling me how awesome owning gold is... it is so awesome he wants to sell me his...

<comment><USER5> That guy on TV is a broker. He doesn't want to hold any gold. He wants to sell and buy at the same time and make money off of the spread.

<comment><USER6> Not sure if the answer is obvious here but I don't know much about finance, does 'spread' here mean the difference in the asset price from purchase/sale time (whether by market change or artificial markup) or the brokering fees involved? or both?

<comment><USER7> #2:

Any vendor will buy a good at say, $9 and sell at $10. In the US there are many pawn shops saying "We buy and sell gold!" \- it's never at the same price.

#1: A smart gold trader will buy low, sell high.. they will buy more gold when prices are low and advertise to sell more when the price is high.

</comment></comment></comment></comment></comment></comment><comment><USER8> The problem is projects like these: [http://bitqyck.me/](http://bitqyck.me/) A classic hard-sell 80s pump and dump scam reborn in the ETH era. Bitqyck came to my attention through a family friend with very limited understanding of cryptocurrency, but just enough financial literacy to be in an investment group being fed these scams by people they trust as technical leadership. I imagine, ultimately, these people will demand protection from having to vet ICOs themselves, and twenty years later there will be an awesome movie about this time starring Leo DiCaprio.

<comment><USER9> The _problem_ is the whole idea of cryptocurrency as a growth investment. The symptom is a bunch of copycat scams trying to freeload on the broader market. Without the bull market of the early '90's, Belfort would have had no one to sell to. Same deal here. The root cause is the insanity happening in bitcoin (and now Ethereal, I guess).

Mark my words: this will all come crashing down. I can't tell you when or why, but it's not sustainable. Probably it will happen in a way that makes the bitcoin nerds "right" in some sense of personal justice: the PRC will close the great firewall to bitcoin traffic, or backdoor the protocol in some unsupportable way. Or the SEC will shut it down somehow.

So sure: when the crash happens cryptocurrency "would have worked" if not for the meddling government. But it will fail nonetheless, and all those people (again, most of whom are not investors in scams like bitqyck) are going to lose all their "money".

<comment><USER10> The worst of is that early adopters will cash out boat loads of money and use that fact to claim they were right all along, as if somehow the top of the pyramid making money proves it's not a pyramid.

<comment><USER11>
      Mark my words: this will all come crashing down. I can't tell you when or why, but it's not sustainable.

The irony: lots of people feel the same way about the "real" debt-based modern economy. A ridiculous Ponzi scheme, clearly unsustainable in the long run.

As always, the time horizon matters when talking about investments and sustainability. Given the right time window, everything works, and everything fails.

<comment><USER12> Let me know when BTC is backed by tanks and fighter jets.

<comment><USER13> Only a matter of time until a group like shadowbrokers in some sense has ICO for managing rooted military/civilian infrastructure and occasionally "deploying"/commandeering (and supply chain, because jets and tanks wont work very long without such) around the world…

</comment></comment></comment></comment></comment></comment><comment><USER14> If you want to really see what the environment is like now, read the bitcointalk ico announcement threads. It's absolutely insane. Very little of that stuff makes its way to hn.

People are raising money with 10 page vague 'white papers' with ideas that make no sense or are completely unworkable on the blockchain.

There is very little skepticism or research with these icos . Most of the commenters are trying to help the project and receive tokens in return, do tasks to qualify for free tokens ( bounties ) , or promote the ico so their token value increases

If there was a good way to short individual ico tokens it might bring some sanity

<comment><USER15> How much of the money raised actually exists as liquid and accessible? Is this just a big MMO?

<comment><USER16> According to coinmarketcap.com volumes on gdax for btc and eth and $115mm and $53mm over the past 24hrs. If you didn't want to increase overall volume by more than 10% you could sell out to USD around $12.5mm btc and $5.3mm eth per day.

<comment><USER17> Volume is not liquidity. You can't deduce anything about the impact of a $10mm ETH market sell from looking at volume.

If you dump $5mm ETH on the GDAX ETHUSD market right now, the price would fall from $290 to $250[1].

[1] [https://www.gdax.com/trade/ETH-USD](https://www.gdax.com/trade/ETH-USD) (click "depth chart" in upper right corner)

</comment></comment></comment></comment><comment><USER18> The SEC guidance galvanized us on not offering tokens. Instead, we are going to offer shares directly in the company, even if they are mostly issued via an ERC20 contract. If we are going to get heat from the SEC, might as well go all out and issue proper shares.

Plus tokens don't even make sense most of the time. You can't buy a Tesla car with TSLA and you do not get dividends/trading with a car. And no one outside kids at Chuck E Cheese want to use venue-specific currency.

<comment><USER17> I'm not particularly knowledgeable on the subject, but isn't the purpose of the SEC to prevent unauthorized entities from selling securities — including company shares — to people?

<comment><USER18> You are correct. If we're going to violate SEC rules then we might as well do it right. Instead of dancing around the topic, using IP bans and a wink- wink-I'm-not-a-US-citizen box, issuing tokens for services that totally aren't investments, we'll just come right out and offer shares with dividends and voting. This was our plan all along, but the SEC guidance just made it more obviously correct one.

</comment></comment></comment><comment><USER19> Even the SEC realizes that not all token sales are securities. Some people in the industry simply aren't getting it, they are creating a straw man which the agency isn't even arguing for.

> The agency said that it would focus on coins that should be categorized as > securities.

So there are all these people on the periphery just HOPING for their prophecy of a heavy handed government breaking the cryptocurrency rush.

They read the headlines.

They create the headlines.

They purposefully don't read the SEC report or consider any information to the contrary of what they are expecting.

Despite S.E.C. WARNING? This is an article about everyone getting smarter and restructuring their offering where necessary, and continuing to move forward.

Even the WARNING in the SEC's DAO report two weeks ago acknowledged that not all token offerings were securities. But detractors and regulated entities with a legitimate reason to be skittish, used it as the WELP SHOW'S OVER GUYS argument which is completely unfounded.

> Nick Morgan, formerly a lawyer in the S.E.C.'s enforcement division, said > that the security label was likely to apply to any coin that an investor > buys with the expectation that it will increase in value as a result of the > efforts of the entrepreneurs who created it.

The SEC still answers to the courts, and this consolidation of capital will allow these new organizations to take it to the courts efficiently. The Howey test from the 1940s did not consider this kind of asset to ever exist. It isn't an end all be all, it is a test.

The SEC is not mandated by Congress to undermine interstate commerce, it is created to provide confidence. So far, they've been playing it smart.

<comment><USER20> Matt Levine, today: [https://www.bloomberg.com/view/articles/2017-08-08/ico- risks...](https://www.bloomberg.com/view/articles/2017-08-08/ico-risks-and- wells-fargo-mistakes)

"To me, it seems odd that people would pay millions of dollars to reserve space on a new cloud storage network, and obvious that they're really paying that money for a speculative investment."

"If you do an illegal securities offering, people who bought your securities have a right to get their money back. If token prices keep rising everywhere, this is not a big concern -- why would anyone want their money back when they have such valuable cloud storage? But if the ICO mania fades, expect a lot of lawsuits from investors who are shocked to learn that they were buying unregistered securities."

<comment><USER21> Off-topic, sorry: Levine gets a lot of praise around here, and he does have a great talent for breaking down complex finance topics so that they're easy to understand and often entertaining to read about. That being said, sometimes he is _awfully_ sanguine about bank misconduct and crimes. Edit: from the article:

"A bank that keeps very careful track of how much money it has, and who owes it money and whom it owes money, and sometimes does evil stuff with that knowledge -- that's fine, really."

<comment><USER22> That's an unfair quote, taken completely out of context. His articles frequently cover fraud and illegality in the financial markets, and he's never in favour of it.

The quote in question was pointing out how bad the latest Wells Fargo scandal is. A bank that can't keep track of money is in serious trouble and is woefully incompetent. The banks ripping off customers but accounting for the profits are evil, but at least they are being competent.

<comment><USER21> I think even with the broader context it doesn't sit right with me, because he could have easily made the completely serious and valid point about banks needing to be competent at their core functions without characterizing "doing evil stuff sometimes" as "fine". Totally possible that my sarcasm detector is broken right now but it seems like he's "only half-joking" here (another of his favorite phrases).

</comment></comment></comment></comment></comment><comment><USER23> Most ICOs usually exclude Americans. Because these scamsters know it's a bad idea to get Uncle Sam angry.

<comment><USER22> Bizarrely, some of these non-American ICOs still advertise in the US. I can't remember the exact ICOs, but some have paid for billboard ads, taxi ads, and so on. I suspect that the 'no Americans' is just a tickbox that they know is easy for their investors to ignore.

<comment><USER24> Yeah, EOS had both a Times Square ad and a no US investor policy: [https://twitter.com/jeffscottward/status/879434713114578946](https://twitter.com/jeffscottward/status/879434713114578946)

<comment><USER25> There might be more foreigners in Times Square than Americans, actually.

</comment></comment></comment></comment><comment><USER26> To put it into perspective, the tezos ICO recently raised a little more than $200,000,000 worth of BTC and ETH.

Here's their twitter: [https://twitter.com/tez0s?lang=en](https://twitter.com/tez0s?lang=en)

Here's their subreddit: [https://reddit.com/r/tezos](https://reddit.com/r/tezos)

Here's their website: [https://tezos.com](https://tezos.com)

It doesn't look like they have really updated anybody on what they're doing with $200,000,000 since their ICO closed.

<comment><USER27> Why are people throwing money at these? It makes no sense. You have no guarantee that they won't just run off with the money, except your trust in the operators.

<comment><USER28> > Why are people throwing money at these?

Futures for Tezos are already trading at 6x the amount people invested during ICO.

> It makes no sense.

In the short term it makes a lot of sense (600% ROI). In the long term: An Ethereum based on OCaml has an interesting potential.

> You have no guarantee that they won't just run off with the money

If the developers are not anonymous, while no guarantee, it makes it less likely. When you cross the road you also have no guarantee that the cars won't run you over. Some amount of trust is needed, whether for money or your entire life. Benefit of crypto is that you don't necessarily need to rely on trust. I doubt Tezos has contractual access to all the money they received, or are allowed to dump their shares as soon as it starts trading for real.

<comment><USER29> Can you, in one sentence, explain what Tezos is? Something of the form:

Uber - Order a taxi with your phone

Facebook - Connect with your friends online

Google - Find stuff on the internet

Wikipedia - An encyclopedia that anyone can edit

Amazon - Buy stuff online, without going anywhere

Tezos - ???

(And "Tezos is a new decentralized blockchain that governs itself by establishing a true digital commonwealth" doesn't count as an explanation).

<comment><USER30> It's a competitor to ethereum - a place to create more ICOs basically from what I understand. Maybe they're running out of ideas

<comment><USER31> Token sales may end up being worth a ton of money. There's going to be competition.

</comment></comment></comment></comment></comment></comment><comment><USER32> I am thinking a short position in bitcoin is in my near future. I am not saying bitcoin is doomed to fail but I am pretty confident this shit coin crazy is going to hit the fan sooner or later and it's going to drag the "legitimate" crypto currencies down.

<comment><USER33> Beware that:

"The market can stay irrational longer than you can stay solvent." (John Maynard Keynes)

Especially relevant to short selling

<comment><USER34> Shorting has got to be the dumbest way to invest. With a normal investment there is a ceiling to how much you can lose (the amount you invested) but there is no ceiling to how much you can gain.

The complete opposite is true for shorting, not a bet I would make on any certainty level.

<comment><USER35> You can just artificially limit your losses by bailing out when you lose as much as you shorted.

You run a small / theoretical risk of getting stuck in a short squeeze situation where you can't get out, but that risk varies substantially by security and there are often laws or mechanisms you can use to protect yourself.

<comment><USER36> Crypto currency is the wild west,there's no one coming to save you, exchanges and whales have access to the books on who they can squeeze.

Its how many operate.

</comment></comment></comment></comment></comment><comment><USER37> There is a great bit of anecdotal advice for situations like this:

"When your hairdresser starts discussing it, it is time to get out..."

[https://blogs.cfainstitute.org/investor/2014/02/10/top- anecd...](https://blogs.cfainstitute.org/investor/2014/02/10/top-anecdotal- signs-of-a-market-bubble/)

</comment><comment><USER38> Add to this "Beyond Bitcoin: Overstock Lets Customers Pay With More Than 40 Alt Coins" [http://fortune.com/2017/08/08/overstock-digital- currency/](http://fortune.com/2017/08/08/overstock-digital-currency/)

<comment><USER39> huh?

> Out of the leading 500 internet sellers, just three accept bitcoin, down > from five last year.

[http://www.businessinsider.com/merchants-arent-accepting- bit...](http://www.businessinsider.com/merchants-arent-accepting- bitcoin-2017-7)

</comment></comment><comment><USER15> Is there an honest non-scummy way to raise capital through this mechanism for something without an inherent scarcity built into the system and that doesn't carry nasty future litigation risks (or at least doesn't carry them more than a SAFE or a convertible note)?

My impression so far is no but I could be wrong.

<comment><USER22> None so far. There's plenty of crowdfunding sites that could be used instead, but ICOs allow the companies to raise money before they even produce a beta of their software. They also have no investor protection, so the company has no obligations to deliver. Finally, these people know that there is a pool of investors out there who think that crypto coins are bound to increase in value, so they will throw money at any new coin.

</comment></comment><comment><USER40> Aren't all these people just going to be arrested?

It's not illegal today, but it will be soon enough, and when you piss off powerful people they find a way to shut you down, one way or another.

<comment><USER41> The SEC's point is that it is already illegal today, and only the most egregious ones (e.g. Trendon Shavers, Charlie Shrem, Alexander Vinnik) will be criminally prosecuted.

</comment></comment><comment><USER42> How exactly are ICOs performed?

1) Set up mining software.

2) Start running it on your own machines and mine enough tokens for ICO.

3) Sell tokens. Profit. ??

Are investors at some point invited to run the mining chain on their own machines? Surely they don't just trust that the company raising money will do manage the accounting on their own.

<comment><USER2> Most are ERC20[0] tokens with a promise to convert them to the projects native token when their blockchain is stood up.

[0]: [https://theethereum.wiki/w/index.php/ERC20_Token_Standard](https://theethereum.wiki/w/index.php/ERC20_Token_Standard)

</comment></comment><comment><USER43> So how about making investors explicitly state that they are not US persons?

<comment><USER44> Makes no difference I think. Burden of proof is on the emitter. Matt Levine at Bloomberg has it explained perfectly: The ICO emitters seem to have no idea that once the SEC declares an ICO to be a security, any US-person investor who had put their money in such an _unregistered_ security and lost some, is entitled by the full force of the law to all of their $, paid back in full...

<comment><USER45> All of their $ or all of their ETH? Most ICOs don't take $.

<comment><AUTHOR> > _All of their $ or all of their ETH? Most ICOs don 't take $. reply_

Doesn't matter. Delaware law has allowed contributions "in kind," _e.g._ with labour. When something goes wrong, the promoter has to pay cash restitution, penalties and, often, legal fees.

 _Disclaimer: I am not a lawyer. This is not legal nor securities advice._

</comment></comment></comment></comment><comment><USER46> I started with quarters years ago before it was cool.</comment>


The story of our work on Foundation - <AUTHOR> http://build.onfoundation.com/

<comment><USER2> This is apparently something that's not Zurb's "Foundation". That was confusing.

</comment><comment><USER3> not an encyclopedia galactica :(</comment>


Unethical Army PSYOP experiments on private citizens - <AUTHOR> http://www.huffingtonpost.com/entry/587fe170e4b0fb40bf6c462a <comment><USER2> This seems to be a legitimization of a report that has all the hallmarks of crackpot conspiracy theory -- the report compiler is not an independent researcher on the subject, but is allegedly the target of the action that is the subject of the report. The official investigation into the issues raised was cancelled because he refused to actually provide the details to the investigating authority, etc.

</comment><comment><USER3> OK, I can well imagine DARPA or other agencies would be interested in doing this kind of "research". And of course I wouldn't put it past the Army (or other services) to conduct this kind of experimentation on unwilling subjects (despite the glaring methodological downsides that they would have to take into account) -- based on what we know from their history. So I'm not going to attempt to tar with any kind of "tinfoil", or "conspiracy theory" label.

But does the gang stalking community have any, you know... evidence... that this kind of experimentation actually, in fact, happening? Like, any at all?

Someone out there -- please do share.

</comment><comment><USER4> Huffington Post is not a credible news source.</comment>


ICE arrests 90 more students at fake university in Michigan - <AUTHOR> https://eu.freep.com/story/news/local/michigan/2019/11/27/ice-arrested-250-foreign-students-fake-university-metro-detroit/4277686002/ <comment><USER2> I'm genuinely puzzled as to what crime these students had supposedly committed. ICE had not told these students that the university was fake. They marketed it as a legitimate and accredited university, and even got other governmental agencies to vouch for this fake university:

> _Attorneys for the students arrested said they were unfairly trapped by the > U.S. government since the Department of Homeland Security had said on its > website that the university was legitimate. An accreditation agency that was > working with the U.S. on its sting operation also listed the university as > legitimate._

It sounds like most of the students were specifically looking to enroll in an accredited university, so that they can be in compliance with the law. And they would have succeeded in that as well, if not for ICE deceiving them into thinking that the university was accredited, when it actually wasn't. How is this not entrapment?

 _" entrapment is a practice whereby a law enforcement agent or agent of the state induces a person to commit a criminal offense that the person would have otherwise been unlikely or unwilling to commit"_

<comment><USER3> I don't buy it, but the article includes a quote that appears to attempt to address your concern:

> "Their true intent could not be clearer," Assistant U.S. Attorney Brandon > Helms wrote in a sentencing memo this month for Rampeesa, one of the eight > recruiters, of the hundreds of students enrolled. "While 'enrolled' at the > University, one hundred percent of the foreign citizen students never spent > a single second in a classroom. If it were truly about obtaining an > education, the University would not have been able to attract anyone, > because it had no teachers, classes, or educational services."

Their argument is that, because no student ever attended class, all of the students were knowingly attempting to commit fraud. That claim seems suspect, considering that there were no classes for the students to attend.

I suppose you could argue that, if a student found out that there were no classes and did not attempt to report the university or un-enroll, that they were complicit in the fraud, but still, what the hell?

<comment><USER4> > Reddy said, though, that in some cases, students who transferred out from > the University of Farmington after realizing they didn't have classes on- > site, were still arrested.

</comment></comment></comment><comment><USER5> This makes no sense. The main issue here is recruiters in India and the USA promoting these types of universities to students there. These people should be caught. People seeking a better life apply, pay the tuition and show up. Now if they know it is fake is another issue. If you place a million dollars on the sidewalk and someone takes it and never reports it and you arrest them, is it fair. You are basically testing the persons ethics, which is not a criminal offence.

<comment><USER6> While some feel it may border on entrapment in this case, a failed 'test of ethics' generally is illegal. If you do unethical things because the threat of getting caught is all that matters, you are not a good person by any standard.

<comment><USER7> Ethics cuts both ways: if you are too lazy to find real illegal acts and contrive one as part of your job because it is more convenient and profitable, then you are not a good person by any standard and are certainly in no position to judge others.

</comment></comment></comment><comment><USER8> I'm curious as to how much money this entrapment program cost compared to the cost of extending visas/offering citizenship.

<comment><USER9> Apparently, this program made money. Students paid a million dollars in tuition that they aren't getting back.

<comment><USER10> Which we can all be sure will be used for the benefit of the union! _cough_ Iran-contra _cough_

</comment></comment></comment><comment><USER11> How is this allowed to happen? I don't understand what the students did wrong

</comment><comment><USER12> The people who set up this 'college' should each spend a day in jail for every day any of the 'students' spent in jail.

</comment><comment><USER13> "fake university in metro Detroit created by the Department of Homeland Security"

</comment><comment><USER14> Reminds me of the movie Accepted from 2006. Justin Long, the guy from all the older Apple commercials played in it.

I thought this statement was a bit untrue though:

"Attorneys for ICE and the Department of Justice maintain that the students should have known it was not a legitimate university because it did not have classes in a physical location."

There are online universities that are accredited as far as I know, but most of them are for-profit schools and heard some of their credits aren't transferable. Chances are if you watch television, you've seen commercials for some of them. Some of them will accept almost anyone though, no test scores just to get your student aid funding, such as your pell grant. I know also some were reported to aggressive target Veterans for their GI bill money. Not sure if people see these schools are legit, but probably teaching similar brick and mortar curriculum.

Some of these schools also have brick and mortar campuses, offering fully online programs and some programs are a mix of online and in-classroom, for example, nursing schools. So some online schools for sure are doing shady things, but I wouldn't discredit a school only because it's online. However you should really do your research and look into the accreditation, job stats but even then those are useless as you could go to college for engineering but if you got a job after flipping burgers you count as getting a job even if not in your field, reviews, etc. Being able to not transfer credits would also be a turn off if other schools aren't willing to accept.

I think online schools should be a option and hope they improve over time and flexible. Maybe you are a stay at home mom, so while you aren't helping your children you can be working on your degree. Maybe you got a degree already, and wanted to advance in your company. So you decide to go back to school and get your MBA so your organization will value you more, then in your spare time and weekends you could be earning your MBA. I was interviewing with a company that made software for set top boxes, she seen my Github and said she really liked me, and thought I had a lot of fire in me but said couldn't move any further because not having college. Plus I had a vision to reinvent TV, I shared about on blogs/social media. This was 2012, but a lot of those same ideas such as the Cloud DVR are incorporated into real products now. So some companies don't care about your skills 100%. Looked up the company, looks like last year they went bankrupt. Seems like they were mostly just contracting for cable companies.

However, if you are a foreign student from India, I don't see why you'd need to come to the US when you can do the same programs online.</comment>


Ask PG: What's with the limit on accessing older items? - <AUTHOR>

A couple of times today I've hit the message that you're temporarily restricting access to old items.  Any chance of a heads up on this? <comment><USER2> Also, why are thousand day old Ask HN items on the front page of Ask HN?

I was going to reply to a question, only to find out it was 562 days old...</comment>


How to Choose the Right Startup to Join - <AUTHOR> http://estromberg.com/post/7886304364/how-to-choose-the-right-startup-to-join

<comment><USER2> This article is really helpful. For one it gives a great primer for those looking to join a startup, but even more so, a good indicator of how a solid startup should operate. Definitely made certain aspects of looking for a startup to join much clearer (things you may dismiss like whether or not people have left the company, how much cash they have in the bank, etc).

</comment><comment><USER3> Very good points. There was one I felt was missing, or could have been integrated with #3 or #7 a bit:

Know what your part of the startup's vision is.

What is the startups expectations of you in the long term? Do they need some development help to get their product out to get their next round of funding before they run out of runway? Or do they want to give you some time to lead a new product within the bounds of their vision? Or start to spread out from their original vision?

If one goes into a startup with a different set of expectations than what the startup has, there will be a lot of friction, and it will waste time of both parties involved.

</comment><comment><USER4> Great read. This is an equally good perspective on why to leave one startup for another. I think it's a pretty healthy practice for a developer at a startup to ask themselves these same questions as if they were interviewing for their own job.

</comment><comment><USER5> Another gem from Eric. This is a must-read!</comment>


Reading the Soil - <AUTHOR> https://www.oxfordamerican.org/magazine/item/1423-reading-the-soil <comment><USER2> Title isn't super descriptive -- this article is about relocating dead bodies when cemeteries move/close.

</comment><comment><USER3> When I die, after the state picks out what organs it can use, I hope they dump the rest in shark-infested waters or some place the wild finds it nutritious.

I won't complain if my body doesn't get a grave.

<comment><USER4> In the Parsi faith, neither burial or cremation are used. In Mumbai there is the famous Tower of Silence (not visible, or accessible to non-believers), where the bodies of the deceased are laid out on top for vultures to eat.

</comment></comment><comment><USER5> All excited for a rare scholarly article on soil structure and it turns out to be an episode of six feet under. Sigh.</comment>


How to hack yourself to prevent other from hacking you? - <AUTHOR> I am learning to become a website and software developer. I want to be prepared for eventual future hacks on my apps and programs. I want to learn about ethical hacking so I can ensure the best security of my products.<p>I was looking for free beginner hacking PDFs to read, but there are too many of them.
Do you guys have any free PDF book recommendations on practical beginner hacking for websites and software? <comment><USER2> Devseccon is a great conference for learning about such things. I'd start with watching a few talks that interest you here:

[https://www.devseccon.com/london-2018/london-2018-videos/](https://www.devseccon.com/london-2018/london-2018-videos/)</comment>


Janki Method | Jack Kinsella - Rails Developer London - <AUTHOR> http://www.jackkinsella.ie/2011/12/05/janki-method.html <comment><AUTHOR> Has anyone attempted this yet for any length of time? How's it going?</comment>


Is there another GCHQ challenge? - <AUTHOR> http://blog.jgc.org/2011/12/is-there-another-gchq-code-challenge.html

<comment><USER2> Potentially off-topic, but am I the only one who finds it absurd that GCHQ are offering a miserly £25k salary for people who manage to work their way through this puzzle and arrive at the job description?

This would seem to imply that the people at the sharp end of my country's cyber defence are fairly junior (because it's trivially easy to earn more than £25k in the UK if you have even moderate skills).

<comment><USER3> For someone joining the GCHQ grad scheme it isn't all about money. They'll hand-hold you through decent security clearance, you'll get to learn the ropes and a good grounding in national security.

I believe these things are more difficult for graduates wanting to start in a private company for or in the same field.

<comment><USER4> A lot of the graduate roles are part of what in the UK is called the 'fast track' civil service scheme. Graduates start on a standard level salary (£25k), but progress much faster than people not on the fast-track scheme.

<comment><USER3> Yep, that too. I didn't mention the fast-track as I wasn't sure if it was still open.

</comment></comment></comment></comment><comment><USER5> The other possible clue is that they seem to have added "The challenge continues" to the home page sometime in the last few days e.g. see [http://www.guardian.co.uk/media/2011/dec/01/gchq-computer- ha...](http://www.guardian.co.uk/media/2011/dec/01/gchq-computer-hackers-ad) for how it looked on or before 1st Dec.

</comment><comment><USER3> I note that they'd added "The challenge continues" to the <http://canyoucrackit.co.uk/> website. I'm sure that wasn't there before...

</comment><comment><USER6> For those wondering: the complete and detailed solution can be found on [http://www.craig-wood.com/nick/articles/how-i-solved-the- gch...](http://www.craig-wood.com/nick/articles/how-i-solved-the-gchq- challenge/)

</comment><comment><USER3> [http://www.theregister.co.uk/2011/12/06/hidden_gchq_code_bre...](http://www.theregister.co.uk/2011/12/06/hidden_gchq_code_breaking_challenge/)</comment>


Open Source DC/OS - <AUTHOR> https://mesosphere.com/blog/2016/04/19/open-source-dcos/ <comment><USER2> This is big news.

Great move and necessary to compete in the fast growing market of data-center automation. I hope that DC/OS gets as much attention in the open-source community as Kubernetes already does.

</comment><comment><USER3> TL;DR: [https://dcos.io/](https://dcos.io/)

<comment><USER3> There's a separate thread for it: [https://news.ycombinator.com/item?id=11525612](https://news.ycombinator.com/item?id=11525612)

</comment></comment><comment><USER4> Nobody does containers better than illumos / SmartOS with Solaris zones. Battle tested, enterprise proven technology since 2006, and SmartOS just took it to the next level, and the level beyond next with Manta, and then a level beyond that with Triton.

<comment><USER5> That's your opinion and not at all fact. Solaris really? What year is it 1999? I know nobody that uses "illumos / SmartOS with Solaris zones" nor do I ever recall seeing it as a skill that either established companies or start ups are looking for.

<comment><USER4> ZFS, kdb, mdb, FireEngine, isaexec, Crossbow, vmadm, imgadm, SMF, and FMA make it a fact, not an opinion.

<comment><USER6> Oracle being a lock-in and lawsuit heavy company make it any solution depending on them a high-risk one. That they tried to make illegal to do a clean-slate implementation of an API means they want to lock you in even more. It's best to just avoid using any I.P. from a company like that unless the licensing terms protect you in present and future.

Feel free to get your hands tied to a company like that. Whereas, there's alternatives for rest of us that are both capable and extortion-free.

<comment><USER4> illumos code base, on which SmartOS is based, is free, open source software. It has nothing to do with Oracle and it runs best on intel hardware.

<comment><USER6> You mean the tech that has nothing to do with Oracle that's built on this foundation:

[http://www.infoworld.com/article/2617566/open-source- softwar...](http://www.infoworld.com/article/2617566/open-source- software/after-oracle--opensolaris-rises-again.html)

So, it was started by a devious company. They tried to kill it off. It's being maintained and extended by a small pool of talented labor. Many of its features are migrating over to BSD and Linux. They have lots more work going into them. Also less risk of copyright and patent lawsuits in the future.

All in all, it seems that it's a dead-end, Oracle project that's probably going to stay behind the others in various ways with unknown risk from its parent company. And should still be avoided.

<comment><USER7> Your biggest concern seems to be that a litigious Oracle could come after someone using an illumos-based system:

> It's best to just avoid using any I.P. from a company like that unless the > licensing terms protect you in present and future.

But this is _exactly_ what the CDDL does as a copyleft license with a patent grant. There's a good reason why Oracle hasn't gone after anyone for using illumos or OpenZFS: they can't, because these people are protected by the license the software is developed under. The most Oracle was capable of doing was changing the license under which they develop internally.

The rest of your concern seems to be about development effort and the number of contributors. While illumos-developer is not as busy the LKML, there is definitely a lot of work going into continuing development of illumos, and regular improvements.

<comment><USER6> I appreciate you actually addressing the concerns with some evidence. :) The CDDL would then knock out the patent side of the issue far as that licensed material goes. That Oracle keeps doing things like trying to copyright the API's and such might still be a risk. Not to mention it's hard to defend against a company like that whether they have a case or not. So, some residual risk there.

Good that there's significant work going into it. Although my comments don't seem this way, I'm actually a fan of multiple codebases being developed for UNIX for diversity purposes. Especially preventing one-bug-hits-all situations. I also wanted IRIX and other defunct UNIX code open-sourced for that reason. I'll give OpenSolaris bunch as doing better than anything else based on a legacy, commercial UNIX. ;)

<comment><USER4> > I appreciate you actually addressing the concerns with some evidence. :)

After all the comments and the tone, I seriously doubt that. It is common knowledge that illumos is licensed under the CDDL, and besides had you researched it instead of dinging me personally, you would have easily found that out.

Also illumos is very actively developed, and considering it has features like DTrace, ZFS, zones, and FMA, it is annything but legacy. Linux has yet to get those features, and will likely never get them. Not only that, but its mainline filesystems are from the '80's of the last century. Talk about legacy.

For someone who bills themselves as a researcher, you did not research anything I wrote about: not ZFS, not kdb, not mdb, not the FireEngine, you didn't research about isaexec, nor Crossbow, nor vmadm, nor imgadm, nor SMF, nor FMA. Not only did you not do the homework, but went off on a "Snoracle" tangent, which has nothing whatsoever to do with anything I wrote about.

The biggest irony is, for someone who claims interest in, and I quote, "systems with rigorous design and assurance argument to ensure the failures stay rare plus recoverable", you dissed an operating environment which is paranoid about data integrity and correctness of operation. illumos and SmartOS are all about being paranoid, functioning correctly in the face of failure (hence FMA and SMF), and protecting one's data (hence ZFS with meta- and data block checksums). FMA and SMF are big parts of self healing technology SmartOS is built on, the very things you claim to be interested in. In yet another twist of irony, all those features are sorely needed ingredients for massive cloud and container deployments. I for one do not want any more Linux-caused priority one incidents at 02:03 in the morning, because I actually like sleeping through my nights, thank-you-very-much!

<comment><USER6> Oh wow, this is a treat. Your post is an impressive attempt to demolish my own. It resembles mine here on certain topics albeit without the linked references I usually have. It certainly earned a reply. Let me do a tad of introspection to see where one or both of us went wrong here.

re CDDL. Not common knowledge for someone that doesn't use illumos. A quick look at the homepage people linked to in the past wasn't very enlightening:

[https://www.illumos.org/home](https://www.illumos.org/home) [https://www.illumos.org/projects](https://www.illumos.org/projects)

Would you seriously have studied a random project more if you saw that vs what's typical of BSD. Linux, or proprietary pages? That looks like hobbyists throwing stuff together. The few posts here about it on front page are full of buzzwords and zeal common with fads that disappear after a few years. Doesn't prove it is one but I hope you understand the mental filter being applied given I have to look at dozens of pages & claims made online.

"ZFS, kdb, mdb, FireEngine, isaexec, Crossbow, vmadm, imgadm, SMF, and FMA make it a fact, not an opinion." "or someone who bills themselves as a researcher, you did not research anything I wrote about"

This is what started the style of my comments. I thought you were a zealot or trying to troll me with a reply like that. You're right that I didn't Google most of them after recognizing a filesystem and some networking/VM tools. Your post was written as if similar tools, including ZFS itself, weren't available for Linux and/or BSD's. You might be shocked to find what OS's that market leaders in cloud segment and SaaS have been running on. Hint: not Solaris. That you named off those as if nobody could do something similar or good enough on Linux/BSD... on top of their ecosystem benefits... led to the style of my reply.

"you dissed an operating environment which is paranoid about data integrity and correctness of operation"

You read my profile but clearly have no experience in my field where nobody would make that claim about any UNIX, including Solaris. Let's start with Solaris's reliability issues going back to the conception of it. It was much like other UNIX's: focus on features, cost, and performance instead of quality. Lots of lost work and crashes before it (or any UNIX) started being reliable. Even so, all of them in a cloud or business critical deployment are too unreliable to trust by themselves: usually in clustered configurations optionally with clustered filesystems, backups, and standby's that don't even trust ZFS due to single point of failure. Far as uptime, AIX wins over it in proprietary sector per surveys and OpenBSD probably in open sector. That's reliability part.

Now, let's talk my end: security. The strongest version of Solaris, either Trusted Solaris 8 or the 10 variant of it, was designed against B1 standard for Compartmented Mode Workstations plus equivalents under Common Criteria. That means it had _features_ of highly-secure systems but not _assurance of correctness or security_. They did not have their code pentested or try to meet requirements like covert channel suppression important for shared resources like cloud deployments. Many versions and years where neither Sun nor Oracle would submit for strong pentesting despite smaller companies (eg Secure Computing Corporation, Sentinel) with custom or BSD-like OS's submitting theirs. Sun didn't even volunteer for free ones like SPOCK. Further, the features were even behind those like Argus Pitbull which is why said company is still in business.

Meanwhile, UCLA Secure UNIX and Trusted Xenix did aim for assurance requirements and stronger pentesting requirements. Security assessment showed inherent design weaknesses in UNIX and coding problems in commercial codes. No retrofits possible. So, they clean-slated the kernels and certain software with high privileges. Many improvements but still had lots of critiques in evaluation vs high-assurance stuff. Non-UNIX's with UNIX/Linux app layers like XTS-400's STOP did much better during multiple pentests with source. Over two decades, Solaris codebase produced avoidable vulnerability after vulnerability often with kernel mode takedown while software like Boeing SNS, XTS-400, and OpenBSD just kept going without any major breaches detected. None for SNS & maybe XTS. So, the security of UNIX and Solaris were as shitty as the reliability with vulnerability metrics and lack of pentesting (despite opportunities) to show it.

"I for one do not want any more Linux-caused priority one incidents at 02:03 in the morning"

My company has same perspective. That's why they wouldn't get off their AS/400's at various offices that never crash. OpenVMS is another option. I know they both can crash but have never seen either go down and nobody I know admining them has either. That's despite us using the hell out of them for 5-8 years between upgrades. VMS clusters have gone 17 years with IBM mainframes doing something like 30. I hear UNIX's are catching up slowly.

Now, all that said, a number of people here indicate that Solaris and its cloud technology have gotten a lot better in past 5 years or so. They think it's highly reliable and manageable. I was impressed by ZFS, Dtrace, and some self-healing parts of Solaris 10 that reminded me of NUMA and mainframe advantages. I'll at least give it another shot for non-security applications in the near future since I now know it's unencumbered and people in other threads (plus this one) testified to reliability. Curious, though, do you have some links on OS, installs, and common deployment better than the crap I have above?

<comment><USER4> SmartOS does not require installation, as it is a type 1 hypervisor running in read-only mode from random access memory. All of the stable storage in a system is used for /zones, which store the actual containers.

Set up a pxegrub, TFTP and DHCP server, and boot it straight from the network on a node. Console on ttya or ttyb recommended but not required.

SmartOS can also be booted from a USB stick. All of the above is available on [http://smartos.org/](http://smartos.org/)

<comment><USER6> Thanks for the tips and link. :)</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


A Dutch first: Ingenious BMW theft attempt - <AUTHOR> https://mrooding.me/a-dutch-first-ingenious-bmw-theft-attempt-5f7f49a96ec8 <comment><USER3> I used to fix cars for a living. Sometimes it involved "cracking" alarm & immobiliser systems.

My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driveway, etc). Sometimes less so, but I'd do it anyway because I needed the money and I had no proof of the contrary (innocent until proven guilty right?), although given the sad conditions of the cars I really doubt anyone would bother stealing them.

Car security is based on obscurity. There is very little cryptography involved (if any), and where there is, the car's "computers" would happily install new, untrusted firmware through the diagnostics (OBD) port, which means you can do pretty much anything - program new keys, disable the immobiliser or alarm completely (by installing patched firmware) or even rewind the odometer.

I'm frankly surprised it took this long for "high tech" car theft to appear, unless it's been going on for a while but executed perfectly so nobody would find a trace.

Happy to answer any questions if anyone's curious.

<comment><USER4> In Russia and, I guess, similar countries, it's quite rare to encounter a car which isn't protected by an external protection system (not sure how it's called in English, in Russian it's usually called "Сигнализация") which includes shock sensors, alarm system, remote control and car block which protects some vital engine circuits. There are systems with dialog protocol between remote control and car with actual encryption inside, so it might be not so trivial to break it. In practice such cars are either stolen inside trucks or an entire system is by-passed by a separate automobile computer connected directly to necessary engine sensors, ignition coils, etc. Quite clever technique, you don't need to bypass protected electronics if you can bring and connect your own electronics.

<comment><USER5> > not sure how it's called in English

"Immobiliser", usually. :)

<comment><USER3> "Сигнализация" would be more akin to alarm.

</comment></comment></comment></comment><comment><USER6> Reading this article is honestly a bit of a domestic culture shock for me, where does this guy live in The Netherlands?

Here in downtown Amsterdam we called the police because the rear window of someone's car had just been smashed outside our office, and the police's response was "Has anyone been hurt? Nope? Then we're not coming".

Meanwhile, wherever this guy lives they're sending officers because some BMW call center calls the police in the middle of the night telling them that some car reported unspecified distress within some radius, and they sent officers to search the whole neighborhood for the car and locate the owner.

I guess the next time I need police help I'll use a burner phone and tell them a BMW is in distress.

<comment><USER7> > Here in downtown Amsterdam we called the police because the rear window of > someone's car had just been smashed outside our office, and the police's > response was "Has anyone been hurt? Nope? Then we're not coming".

Amsterdam currently has a big police shortage, that's why. It's not normal, it's just a problem in Amsterdam.

[https://www.dutchnews.nl/news/2018/07/amsterdam-is-not- lawle...](https://www.dutchnews.nl/news/2018/07/amsterdam-is-not-lawless- jungle-but-it-does-need-more-police-says-new-mayor/)

<comment><USER8> > It's not normal, it's just a problem in Amsterdam.

Right, the two times we needed police in Limburg (Echt and Maastricht, few years apart) it didn't happen either. It had to be life-threatening and the people didn't literally shout "we'll kill you" so the police wasn't gonna bother.

Meanwhile on TV they're cycling through parks to fine people some 99 euros for not having a well-behaved dog on a leash (could have used discretion there), or fining some poor dude 370 euros for standing literally 2 minutes on a disabled spot to pick someone up.

<comment><USER9> Poor dude? You don't park in a disabled spot unless you have a right to be there. That should be common sense.

<comment><USER8> It was wrong and s/he was caught, but that fine is just ridiculous. Sure, someone who stood there for 2 hours in a busy spot where disabled people were indeed turned away, then they definitely chose to risk that fine. But when someone was standing with the car (not even parked) for 2 minutes, I might (as police(wo)man) decide to give a warning instead. That fine is disproportionate. Most people on HN probably earn enough to sustain it easily, but for many people, that's an entire month's worth of food that just went down the drain. Sure, it's a good deterrent, but is it fair and just? Should we just give exorbitant fines on every petty crime just as a deterrent? That's not the kind of country I want to live in.

</comment></comment></comment></comment></comment><comment><USER10> This definitely isn't the first time this technique has been used. I'm sure I've heard many similar stories before and the internet backs me up.

[https://www.askaboutmoney.com/threads/attempted-car-theft- wi...](https://www.askaboutmoney.com/threads/attempted-car-theft-wires-cut- with-hacksaw-blade-thru-door-jamb.181216/)

[https://rutlandnhw.org.uk/crime-update/rutland-south- crime-r...](https://rutlandnhw.org.uk/crime-update/rutland-south-crime- report/)

</comment><comment><USER11> Hi guys, very cool to see how this is being picked up over here. Shame on me, but I actually forgot to submit it to Hacker News.

The key fob method is out of the question for my car. I've known about it for a while and store my keys in special bags.

I see quite a few people asking why a sting wasn't organised. I of course shared the M.O. with the police and we actually had a few phone calls from them over the past few days. They are sharing the information with their colleagues but to be frank, they are not going to spend an entire night waiting around for a potential car theft.

We live in Ijsselstein, a city just south west of Utrecht, and car burglary and theft is quite a big issue in our area. My previous car, a BMW F20, actually got broken into twice in 2 weeks. Both times they stole the entire nav system. I've become quite adapt at filing reports but besides filing a report the police can't do anything for you.

The first time it happened they asked me whether or not I saw visible blood stains. Only then would they send a patrol car to do sample research. In any other case, they just ask you to file a report and be done with it.

Let me know if there are any questions you'd like me to answer while I'm at it.

I'm also interested in writing some follow-up articles about car security/theft prevention. If there's anyone willing to contribute, let me know!

<comment><USER12> You may want to look into rewiring your OBD port so that it doesn't work without you flipping a switch somewhere, or building a "key" with a male and female port + some wires, then storing the "key" in some hidden location (spare tire?).

Or just expose two data lines from the OBD wiring harness and jump them together. Remove the jumper to operationalize the OBD port.

FYI: cutting off VCC may not always work since some devices may derive enough power through other lines that have pull-up resistors to function. I've seen it happen in other industries.

Not sure if such products exist commercially, but it would have some value for someone to build them.

<comment><USER11> A few days ago, I read on the most reliable source in the world, the internet, that if you have a class 3 alarm system from BMW, the OBD port is blocked as soon as the alarm goes off. I do want to verify this with the dealer once my holiday is over.

I also read about the OBD key cloning, but I'm not sure whether or not that was an issue with the first F30s. I'm unsure whether or not it still works with the F30 LCI from 2017 that I have

</comment></comment></comment><comment><USER13> I've anecdotally heard a lot of stories about the relay/replay attacks on keyless ignition systems used in many BMW models and other cars as well. No need to smash the window at all in some cases. Remarkably simple attack in principle, and probably a nightmare to explain to your insurer given there will be no evidence of a break in.

Makes you wonder if you should start storing the key in a metal/RF shielded box at home...

> [https://www.bbc.com/news/uk-england- > birmingham-42132689](https://www.bbc.com/news/uk-england- > birmingham-42132689)

<comment><USER14> That's actually not hard to explain to your insurance or the police at all. This happened to me 5 weeks ago. The car was parked directly in front of my entrance door and the key was basically on the other side of that door.

The scene of my car not being where it was supposed to be was so surreal that I did not even realize it was missing the first time when I walked out the trash. I basically walked around an invisible car.

Only when I wanted to leave the house and thought, well shouldn't my car supposed to be there did it dawn on me that something is amiss.

When I went to the police, the first thing they asked me was how far my keys were away from the car. My insurance was asking the exact same thing.

Remarkably the car was found when the police in our neighboring country stopped a driver under the influence of drugs.

Getting the car back (still ongoing) was so much hassle that I almost would be happier if it would not have been found.

It goes without question that all my keys are now stored inside a metal box when not in use.

I was a bit worried that the box does not shield the signal enough. The best way I could think of to test it was to put the key inside the box and hold the box to the steering column and try to start the car. It's probably not foolproof but I hope it is enough.

<comment><USER15> > I was a bit worried that the box does not shield the signal enough.

They make "Faraday Bags" exactly for this purpose.

<comment><USER14> I needed a quick fix that everyone in our house would be adopting quite quickly, and it should also fit into the style my wife used to decorate the entrance area. So the bowl where our keys were usually collected was replaced by a metal box with a lid.

However, in the long run I won't bet on workarounds to prevent the signal to be repeated, I will rather use one of those steering wheel locks that's brightly visible from the outside. That does not prevent someone from breaking into the car, but it will prevent them from easily driving away with it.

A security camera has also been placed there, so I hope overall it is enough of a deterrence

<comment><USER16> I think you can also disable the keyless entry (that is, entry without hitting a button on the fob) in most cars. Said cars should also just stop if it doesn't detect the key while driving, so starting keylessly should still work.

</comment></comment></comment></comment></comment><comment><USER17> The thieves would have been wiser to take something, _anything_ to make the narrative of the original break in more believable. They didn't sell the narrative well enough, which left people curious.

<comment><USER18> I wonder why they bothered with the smash - broken glass would make people take their car to a dealer. Just the "failed jimmying" might have gone if not unnoticed as a police issue procrastinated in fixing. Maybe they were just frustrated auto thieves.

<comment><USER19> How would they have disabled the alarm without breaking into the car?

</comment></comment></comment><comment><USER20> Why did they not park the car back and wait with the police on call in order to catch the thieves that would have come back the next night?

<comment><USER21> With the alarm disabled, they could wait a month.

<comment><USER16> I'd argue they would have to act quickly though - there was an alarm going on the dashboard when the car was started.

</comment></comment></comment><comment><USER22> I was sure he would wake up next morning and find the car missing. I think he was really lucky that this wasn't the case and the thieves waited(?) for the next night.

<comment><USER23> Yeah, I don't understand this. After you went through all the work of disabling the SOS, you can just take the car then, unless breaking the window was the way they initially got inside, and maybe they were thinking that the person would blindly repair the broken window to increase the value of the car on the black market? I don't know.

<comment><USER24> Because the police arrived 5 minutes after they disabled the SOS button.

The next night, there would be no SOS notification when they broke the window again. Or maybe they'd only have to tear away a plastic bag, if the owner hadn't gotten the window replaced.

Or maybe they were hoping to find a valet key in the car, making their job even easier, either that night, or the next night.

<comment><USER25> I don't know why he didn't talk to the police and tell them what he suspects and see if they would set up an ambush for the car thieves that night. Put the car back in place and wait for them to show up

<comment><USER26> The thieves didn't have to come back the first night. Could have done it weeks later.

<comment><USER16> Yeah but would you drive around in your brand new car for weeks with a big SOS error light in the dashboard? Knowing it's covered by insurance and/or warranty, too.

<comment><USER19> The theft relies on the few people who would actually ignore the error light, I mean theft shouldn't be so easy...

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> After the frst paragraph(s) I was expecting the security center to be fake, the actual thieves, and have them send out a 'customary repair service' that would have to take the car back to the dealer or something.

</comment><comment><USER28> I think the proper cause of action in that case was to return the car and do an old fashioned stake out with lots of beer.. I mean redbull and catch the burglars redhanded.

<comment><USER20> yes. I honestly don't know why this was not done. It sounds like the most obvious thing to do if you know that the burglars are going to come back anyways the next day.

</comment></comment><comment><USER29> The smart thing to do would have been to leave your car outside again, and have the police hidden down the street, so when they returned they could catch the crooks!

</comment><comment><USER30> It's clear what has happened here...

Cutting that wire loom disables the cars 'call home' functionality (probably by cutting it's antenna), as well as conveniently disabling the alarm.

The thieves who cut it this time were too slow though. Presumably, the 3G connection takes ~30 secs to boot up, find a cell tower, and connect to BMW servers. The thieves hoped to break the window and cut the loom immediately, before the connection to the server was made.

<comment><USER31> Aren't they just always on? Also the modem would have to be on the other end of that cable loom for that to work when it's much more likely to be down in the glove box with the rest of the control modules and you don't need an antenna that long for a WAN modem.

<comment><USER30> You probably want the antenna away from all the metal body panels of the car. Hence normally running a cable up the A pillar.

The modem itself probably isn't booted up to reduce vampire power drain. If it was always on, it would drain the battery after a few weeks. More likley, when the alarm goes off it starts booting up.

<comment><USER31> My cell phone still gets decent signal sitting down in the center console in the cubby below the entertainment system, enough to stream music at least which is more than it'd need for an SOS function. If your phone can send a text it's got more than enough signal to do the SOS functions.

</comment></comment></comment></comment><comment><USER32> More surprising that the car has some call home feature that the owner doesn't seem to know about.

<comment><USER33> Having recently gotten a new BMW (in USA), they give you a huge packet of about 30 pages explaining the BMW TeleService and the "SOS" button. They also make you sign a power of attorney-style doc giving them rights to notify police in case they believe your vehicle is in trouble and provide police/EMS with its exact location.

Mercedes and Audi have similar systems, as do others via OnStar. This is one of few cases where i believe having an "oh shit" button/system that automatically activates in case of serious accident or another event is valuable.

EDIT: oh, and this is entirely opt-in, at least on BMW.

<comment><USER34> No, not entirely. Please give me the instructions on how to opt out. Whenever someone asks (which is rare), the forums are filled with replies like "why would you not want BMW to monitor you? are you a fraudster?" IOW the forums do not know how to opt out either.

Everytime I take my 2016 in to service, I ask both sales and service to disable teleservices. They say they cannot. I then call BMW teleservices (every time), and they tell me that the dealer has to do it.

There are explicit instructions _from BMW_ online that _in Germany_ you can take it to the dealer to have it disabled. No mention of any other country.

Yes, the emergency aspect of it is valuable. It's not worth the compromise in privacy, at the complete discretion and ineptitude of a corporation that has a profit motive.

In 2016, I certainly did not sign (and was not asked) any kind of doc authorizing location disclosure. My car definitely does have teleservices activated. (don't know if they will report my location)

<comment><USER35> Can you pull the SIM card?

<comment><USER36> No, because this is an embedded system and fiddling around with that is maybe going to void your warranty?

<comment><USER35> Not in the US. So long as your changes don't cause damage your warranty can't be voided.

</comment></comment></comment></comment></comment></comment><comment><USER37> It seems overly complicated when just relaying your key fob is a known attack that's working. The scenario of them just failing to steal the car seems more plausible.

</comment><comment><USER38> Would it be possible, that the order of actions was actually different? The thief first pushed thin tools through the door gasketing and actually cut the wires from the outside. Not sure how well and how successfully, but i actually presume that this wasn't as good cut as they tried to achieve. Then, they tried to break the window and continue with the theft, but the system reported them too fast anyways...?

<comment><USER11> I doubt that this is what happened. I'd like to see someone remove the jamb cover from the outside and also cut the loom from the outside. Not sure what kind of tool would be able to fit through the door and do these things. You can clearly see on the third image that they forcefully removed the cover with a screw driver or something else since it's completely bent

</comment></comment><comment><USER39> If you have a car that has keyless entry store your keys in a metal box and confirm it wont unlock the vehicle even if you take the box and put it next to your door. Also if you drive a modern ford do everything you can to block access to odbii port as they can clone a key in seconds using special tools.

</comment><comment><USER40> BMW burglars appear to be very skilled. The entire board computer was taking from a friend's car and the screws and cables etc were all tidily set aside as if it was a professional replacement. And this within an hour, on the front porch..

<comment><USER41> Makes me wonder how many of the thieves of modern cars are professionally trained service people from the respective car companies who are paid off to get the vehicle into a state where it can be cleanly taken away.

You are basically just paid to bypass security.

<comment><USER3> The difference is that in IT, whether you are a professional or not, the systems you're working on will still ask you for authentication.

In cars, it's security by obscurity. If you know the protocol to talk to the car's computers via the OBD port, you are pretty much root without even providing any credentials.

</comment></comment></comment><comment><USER42> Funny reading this. I had the same experience with a rental bmw 530 in italy.

Nothing stolen, only window shaddered and SoS going blind.

I left for Germany that day though, so I must have been lucky.

Thanks for posting

</comment><comment><USER43> Since all protection in cars (no matter how complex is) is mass produced, it is very easy for thieves to purchase same/similar car and study it. However, I'm wondering what will happen if an ordinary Hacker Joe (a guy who knows a little bit of electronics and software) installs custom protection, no matter how simple is?

Knowing that for thieves, the most precious resource is time and if you force them to work more than expected, they might gave up...

</comment><comment><USER44> Thieving isn't a good life -- for one thing, thieves lie awake at night worrying that someone's going to steal their stuff.

</comment><comment><USER45> I wonder if they were in fact intending to steal the airbag, but were disturbed in the process. Airbag theft is fairly common and lucrative. You can extract the A-Pillar bag through the window without opening the door. In cars without the radar/pressure sensors you have some chance of doing that without setting off the alarm.

</comment><comment><USER46> Immediately, I'd be wondering what very powerful spy agency or organisation felt the need to break into my car, and why.

<comment><USER47> I'm not sure I'd be so paranoid. We've read of people managing to hack the key openers, etc. They're an attractive target.

I mean, if you were going to leave a box containing $30,000 on your doorstep. A box not only containing 30k, but a box that was labelled that it contained 30k. How would you protect it? Put a serial number on it so you can prove it's yours? A bike lock? A motion sensor? Cement it into the ground?

What lengths would you expect someone to go to, to try to walk away with this box? Just give it a little kick to see if it moves? A screwdriver or a pry bar? Angle grinder?

Once you divorce yourself from the commonality of a car, it's quite bizarre to think that not only do most people leave their second most valuable possession (or most valuable, if you rent your home) on their doorstep .. but that they just assume it won't happen to them. It doesn't take a targeted attack for someone to realise that that exposed, valuable, mobile asset is .. well, exposed, valuable and mobile.

<comment><USER48> $30k in cash is not the same as a $30k car. A $30k car that's been stolen is not worth $30k, then there's liquidity, risk and a bunch of other things. Having your car parked outside is not at all like having a box containing $30k outside your house.

<comment><USER47> I have to worry about a $1,000 bicycle. For some reason it's just socially accepted that this will happen to a $1,000 bicycle. But park a car worth an order of magnitude, and the level of worry actually goes down. That's the bit that throws me for a loop.

I'm not trying to argue that anyone should live in fear. Just that assumptions of state-sponsored action severely overestimate which ballpark this lives in. This is more complex than an opportunistic thief, but well within career criminal - and probably well below "steal to order".

<comment><USER49> That's because most of us recognize that 20 seconds with angle grinder will make that $1,000 bicycle disappear. 20 minutes at a stolen bike dealer - <USER2> are everywhere - will turn it into $50.

20 seconds with an angle grinder will not make a $30,000 car disappear. Selling it on the black market is also a much bigger pain in the ass, then selling a stolen bicycle.

People leave $300,000 dollar homes unattended all the time - protected by nothing more then a flimsy lock, and a few panes of glass. Yet, most of the time, people don't worry about someone stealing their house.

</comment></comment></comment></comment></comment><comment><USER50> In Sacramento car theft is a big problem. The scheme there is to steal a nice car, purchase a wrecked one at a lot (salvaged) for pennies, then swap the vins and serial numbers with the salvaged car then sell it. It works really well. So if you buy a used car in sacramento there is a %90 chance it has a salvaged title.

<comment><USER51> However large an issue it is, I'm pretty confident a majority of used cars sold in Sacramento are not stolen, let alone 90%. (Maybe you were just exaggerating.)

</comment></comment><comment><USER52> The author should feel lucky that he encountered "fancy" thieves.

Modern cars are so hard to steal that mots thieves resort to violence to get your car.

Contrary to insurance companies, I'd rather have my car stolen than to be knifed.

</comment><comment><USER53> It would seem the person took the time to review a wiring diagram or had some previous experience.

</comment><comment><USER54> Hope he still went on vacation as planned, I kind of miss that information

<comment><USER11> We are actually. Not with the BMW as intended but with my girlfriends car. Currently driving from the south of France to Bretagne for our last week. The car has been fixed by now and will be picked up the 18th. I'll update the article later today too!

</comment></comment><comment><USER55> Amateurs, frankly.

The current modus operandi is to find your BMW/Land Rover/Mercedes. Wait for it to come to your hand carwash, tyre company etc and get uninterrupted access to the OBD port along with the key. Program new key, find the address of the vehicle, walk up a few days later and drive it off at 3am in seconds.

If that's too much like shooting fish in a barrel, then the 'keyless relay theft' is probably more your bag. Using a relay transceiver, if the key is in the house within range, then you can trick the motor into thinking the key is present. Many cars will allow you to continue to drive them even if the key if out of range. Provided you don't turn the engine off, this gives you plenty of scope to get away and clone a new key in the meantime.

Tl;DR, OBD and keyless technology is basically flawed. The best countermeasure is a good old fashioned crook lock.

</comment><comment><USER56> Sounds like a perfect opportunity to do a sting.

</comment><comment><USER57> Just use a steering wheel lock.

</comment><comment><USER58> Theives are usually lazy and they don't make more efforts then required.

My friend has holes in the front of the car to make it easier for theives to attach a hook and then tow the car into a truck.

But if you put pressure above a threshold on any of the holes, car keeps sending one SMS to his number every 5 minutes.

This is in Romania.

</comment><comment><USER59> How is cutting the line to a car's panic button unlike cutting a car's brake line? (that is, attempted murder)

<comment><USER51> Even cutting brake lines wouldn't automatically be attempted murder; it would depend on circumstances. Equating that to cutting off the panic button is quite a stretch though. I've never owned a car with a panic button, nor known anyone whose life one has saved (unlike brakes).</comment></comment>


One hundred clock codes - <AUTHOR> https://github.com/a-jie/clock-shop <comment><USER2> Can't we have a very small, simple device which just has a browser?

That way we could put games and stuff like this which can work with just HTML, CSS and JS.

I feel as the browser gets more capable, I think these kind of functionalities be way more easier to create and deploy.

I don't know if network connectivity would be such a mandatory thing for a device like this. Maybe I could just download offline maps, and have the map app run in the browser, or the clock app, or the Mario app.

In the good old days, I don't remember being concerned about having connectivity. We used to be more concerned about not having RAM and CPU (probably still are!). But creating programs, or browsing images, or playing gamees, videos and mp3s, none of these actually require connectivity. Yet everything now has to be always online.

I know Firefox tried this with FirefoxOS, which is currently become KaiOS, but even they are working around an online experience. I'm just thinking if something opposite would actually work.</comment>


Show HN: Steal back your productivity - <AUTHOR> http://www.heyfocus.com/ <comment><USER2> I've been using StayFocusd for this exact purpose for years. As others have mentioned, there are rather a lot of extensions and apps that will selectively block distracting sites for you.

[http://lifehacker.com/5452620/stayfocusd-blocks-and- manages-...](http://lifehacker.com/5452620/stayfocusd-blocks-and-manages- time+sucking-web-sites)

Clearly, I have not added HN to my blocklist :)

<comment><AUTHOR> I saw a lot of these apps out there but none that worked quite how I wanted. I wrote a little more about this in the case study: [http://bradjasper.com/blog/case-study- focus/](http://bradjasper.com/blog/case-study-focus/)

Eventually my goal is to make Focus pretty extensible so you can run your own custom scripts on focus & unfocus. Hope to have some of this out soon.

</comment></comment><comment><AUTHOR> This is a small Mac app I made that helps me stay off Hacker News :). It's a menu-bar app that with 1-click blocks certain websites.

If you're interested I did a little write-up here: [http://bradjasper.com/blog/case-study- focus/](http://bradjasper.com/blog/case-study-focus/)

Also open-sourced it: [https://github.com/bradjasper/focus](https://github.com/bradjasper/focus)

<comment><USER3> The case study link on the page is broken actually.

<comment><AUTHOR> Thanks for catching that! Fixed

</comment></comment></comment><comment><USER4> I've been using an app called Concentrate ([http://www.getconcentrating.com/](http://www.getconcentrating.com/)) for probably 5 years that does the same thing, but it also lets you define apps and services to block (so for example, if I want to get really focussed, I block my Mail app so that I can't check it for the next hour).

<comment><USER5> I had the pleasure of working with Made By Rocket (makers of Concentrate) when I was a senior in high school (I was 17). Living alone in downtown Boise Idaho, working 40 hour weeks for two different startups, and finishing high school, man that was a rough year.

</comment></comment><comment><USER6> There's an older app called Self Control that does this but for a specified time window and cannot be disabled once it's started, including by rebooting. [http://selfcontrolapp.com/](http://selfcontrolapp.com/)

<comment><USER7> Considering the number of machines, physical and virtual, that I have laying around, that wouldn't be much of a barrier.

<comment><USER8> In my experience, it's not about making accessing these sites _impossible_ , just harder. An alternative is artificially injecting a 30-second delay to any interaction with those websites. When it takes that long for a page to load, it can slowly teach you to un-learn compulsive checking.

see alt text of this comic for example: [http://xkcd.com/862/](http://xkcd.com/862/)

</comment></comment></comment><comment><USER9> I'd really like a one-click focus app that:

        * blocks distracting websites (and arbitrary hosts so I can't SSH to my IRC bouncer!)
        * starts playing some elected noise (either generated -- pink noise -- or pre-selected rain/ocean/etc.)
        * blocks notifications (can the OSX notification stuff be set to DnD?)
        * is a Pomodoro timer: will unblock everything by itself in 25min (or whatever time is elected)

Unfortunately, I don't have the time to make it :(.

<comment><AUTHOR> I'm working on integrating some of this into Focus already, and plan on adding pre-focus & post-focus hooks to add your own custom functionality to cover everything else.

Should be out soon and the app is set to auto-update, so stay tuned :)

<comment><USER9> Awesome :)

</comment></comment></comment><comment><USER10> Thanks for making this. It's beautifully crafted and great attention to detail is shown with the inspirational quotes and the optional b/w icon.

</comment><comment><USER11> Nice, exactly what I'm looking for. A few ideas for features:

More options in the filter preferences. How are wildcards handled and multiple domains?

A system-wide hotkey for turning on and off the distraction (I'm an avid Vim user and do a lot of text editing so I'd prefer not to use the mouse too much). Maybe even make it work together with Alfred.

Custom messages for the blocked website.

<comment><AUTHOR> Thanks, these are great suggestions. Should definitely be able to get these added.

</comment></comment><comment><USER12> Nice touch showing a motivational quote when you try to visit the blocked website.

I've been using Concentrate[1] so far with great results. It has a few more options (such as a growl message every X seconds) but no nice motivational quote for websites! :) Also – the first version is actually free (click the buy button).

[1] [http://www.getconcentrating.com/](http://www.getconcentrating.com/)

</comment><comment><USER13> I just can't seem to get Focus to work.

I am using DNSCrypt from OpenDNS, but when I disable it, I still can't get Focus to work. I have Automatic Proxy Discovery and Automatic Proxy Configuration turned off in System Preferences -> Network, but turning these on didn't seem to work either.

Could you add a quick install guide with the required settings?

Thanks!

<comment><AUTHOR> Hi, if you email email@example.com I would be happy to help you set it up.

</comment></comment><comment><USER14> There's a great free Safari extension called WasteNoTime which does something similar without a proxy, and also has the added benefit of tracking the time you spent daily, weekly, or monthly across all sites (including non-blocked ones) so you can see which ones you _need_ to block.

</comment><comment><USER15> The unfinished video alone deserves the upvote. Cool idea, now I need to get back to work :)

</comment><comment><USER16> This app is awesome! I've tried out others, StayFocused, manually editing /etc/hosts, but I love the simplicity of this.

Would it be possible to add exceptions to sites? For example, certain subreddits allowed only?

</comment><comment><USER17> It would be cool if you could set a schedule for certain times to block sites (or time limits). There are various browser extensions for this, but it would be more effective on the system level.

<comment><AUTHOR> Thanks this is something I'm definitely thinking about, but can't resolve what happens when you really do want your internet connection back.

Should it just let you?

What happens if a client calls or an emergency happens and you need access?

Would love feedback from anyone who wants this feature.

<comment><USER17> Most time-wasting sites never need to be accessed, though some of them are occasionally useful.

I think the app should let you access blocked sites when you need to, but make it difficult in some way. E.g. it could pop up with a warning and require user to enter a code. Often people waste time impulsively so a small block is enough to get them back to work.

(Alternatively, it could send out an email or post it online when a user over- rides a blocked site. Or it could fine the user!)

<comment><USER18> Regarding entering a code: would it be possible to use the google two factor Auth app somehow for that?

</comment></comment></comment></comment><comment><USER19>
        Bandwidth Limit Exceeded

        The server is temporarily unable to service your request due to the site owner reaching his/her bandwidth limit. Please try again later.

</comment><comment><USER20> Looks pretty useful but since its OS X only, so I can't use it.

Btw, just cursious:

>Do you have a grayscale icon? I don't like colorful icons in my menubar.

Wow, are all Mac users this... particular?

<comment><USER21> > Wow, are all Mac users this... particular?

I can't speak for all, but me, yes. It's just a visually very quiet area in the upper right, because most icons are black or greyscale. So it is slightly annoying if one of them is colorful.

</comment></comment><comment><USER22> In Chrome when going to https version of a blocked site, I get the "Error code: ERR_TUNNEL_CONNECTION_FAILED" instead of the inspirational quotes!

<comment><AUTHOR> I couldn't find a way to intercept SSL traffic that wasn't insecure (method I used was a custom root certificate), so opted for a broken connection instead.

I think the only way to do this securely is a browser extension which I was planning for a later version.

</comment></comment><comment><USER23> 509 Bandwidth Limit Exceeded

The server is temporarily unable to service your request due to the site owner reaching his/her bandwidth limit. Please try again later.

</comment><comment><USER24> Would this interfere with RescueTime? I like having the metrics of which app I use the most but want to block things using Focus.

</comment><comment><USER25> I just use RescueTime's get focus functionality.

</comment><comment><USER26> sudo vim /etc/hosts - just add the website you want to block. Be smart to Skip downloading softwares. :)</comment>


Is elimination of vert transmission of HIV in high prevalence environs feasible? - <AUTHOR> https://www.bmj.com/content/364/bmj.l687 <comment><USER2> I assume "vert transmission" is due to HN length limitations, but it reads awkwardly and isn't an abbreviation commonly understood.</comment>


Reducing DRAM Footprint with NVM in Facebook - <AUTHOR> https://blog.acolyer.org/2018/06/06/reducing-dram-footprint-with-nvm-in-facebook/ <comment><USER2> >"Facebook swap 80GB of DRAM for 140GB of NVM. The lower latency of NVM is therefore compensated for by the higher hit rate from having a larger cache."

Should this be "the higher latency of NVM"? I'm assuming the comparison is to DRAM and not Flash in this sentence. Or am I misunderstanding something?

<comment><USER3> Someone pointed that mistake out in the blog comments. Yes, MyNVM has ~20% higher P99 latency

</comment></comment><comment><USER4> Maybe this is obvious to those working with this, but did something change about what "NVM" means aside from "non-volatile memory", i.e. what "Flash" memory is? Is the assumption that "NVM" == "NVMe" or?

<comment><USER5> NVMe is the spec for controllers supporting NVM.

Think PCI vs PCIe [https://en.m.wikipedia.org/wiki/NVM_Express](https://en.m.wikipedia.org/wiki/NVM_Express)

<comment><USER4> Thanks. I guess that still doesn't clear up why the whole article considers "Flash" and "NVM" as two distinct technologies/concepts/whatever.

Edit: even on that wikipedia page:

"The acronym NVM stands for non-volatile memory, which is often NAND flash memory"

I feel like I'm taking crazy pills here

</comment></comment></comment><comment><USER3> I submitted this before as a link to the research itself about a month ago, but here it is again just in case: [https://dl.acm.org/citation.cfm?id=3190524](https://dl.acm.org/citation.cfm?id=3190524)

<comment><USER6> Even better → [https://research.fb.com/wp- content/uploads/2018/03/reducing-...](https://research.fb.com/wp- content/uploads/2018/03/reducing-dram-footprint-with-nvm-in-facebook.pdf)?

</comment></comment><comment><USER7> Why not just increase L1 Cache size, and avoid off-chip references? Sure, non- volatile isn't met, but as bang-for-buck, the win would be many hundreds of ns better surely?

<comment><USER8> How do you avoid off-chip references? As mySQL do not use query caching by default, only indexes, I guess most of the memory is HDD cache managed by the file-system.

<comment><USER9> That's not actually true. With InnoDB the data is largely cached specifically by the database in the Buffer Pool.

Of course they are using MyRocks here and while I don't actually know I'd be very surprised if it wasn't the same. File system cache only really helps you with reads in an ACID-ish system and write speed ups/journaling require a more actively managed cache.

</comment></comment></comment><comment><USER10> That is roughly $1000 Saving per server. But is it really worth the effort? Even for Facebook.

<comment><USER11> (How many servers they use it on * 1000)

If that is 1000 servers, then it's a million in savings. Also think about it in the way of all the servers they have now + all the servers they'll use it on in the future.

<comment><USER12> Plus, strategies like what is described in the article will become more useful as the usable bandwidth to NVMe improves. The write endurance limitations won't disappear or see massive improvement, but NVMe is apt to keep droping in price, and perhaps Intel will figure out how to manufacture XPoint at a reasonable price, providing flash memory on the low latency, high bandwidth DDR bus. Not holding my breadth on XPoint, but it would be a sea of change if Intel can figure out its production issues (and price it significantly cheaper than DRAM)!

[https://semiaccurate.com/2018/05/31/intel-dodges-every- quest...](https://semiaccurate.com/2018/05/31/intel-dodges-every-question-at- apache-pass-xpoint-launch/)

<comment><USER10> To answer the above comments.

1 Million for 1000 Addtional Servers. And that is precisely my point. A saving of 1 million is a drop in the bucket for facebook. They will have to grow out of their current additional capacity, and ADD another 1000 Database Sever to achieve this saving. That is 3PB of Data, I doubt if they store video or images in it. So this is still quite a large amount of data, even for Facebook.

NVMe isn't going to see price drop, not in 2019 and 2020. Right now Intel aren't making much money for Optane. So any yield or other improvement would only increase Intel's margin. For it to see a significant price drop would require some ground breaking changes. Which I doubt will happen in 2 years time frame. Testing the NVMe on DIMM would be a much more interesting test. For the 128GB Server price that could have 1TB of NVMDIMM, although I think the speed would be decreased, the question is, would the speed still be acceptable?

I think this is merely an exercise for Facebook engineers to play around with.

</comment></comment></comment></comment><comment><USER13> I find this positioning for Optane to be a little scary.

If you replace one storage tier with one that is unambiguously faster (say HDD with SSD) that is definitely a win.

If you add a new storage tier which is supposed to be cheaper than another tier but also slower, you can't take it for granted that real life performance is better. For Facebook which has talent on hand and a very large scale to amortized R&D efforts it is one thing. But for the rest of the market it is a very different.

The use of Optane for an HDD cache is a case in point. Although macers seem to believe that Fusion drives are good, people in the PC space have been disappointed in hybrid hard drives, to the point that I think they'll be skeptical about Optane cacheing solutions.

A big part of it is that it is by no means certain that cacheing will provide a perceptible improvement in performance. It is almost the ideology of the corporation that nine women can have a child in one month, that throughput matters, latency not so much. However, people perceive that their computer is fast or slow in terms of latency, not throughput. In particular, it is 99% or higher latency that causes your computer to "go to lunch", become unresponsive, causes you to get frustrated with.

Caches don't help with 99% requests as well as they do at the median. If the cache does anything to waste time, it could make it worse.

You could make the case that Optane has advantages over SSD as a cache medium (for one thing you can write to it a byte at a time so you don't have to deal with the overhead of an SSD which needs to write in 16 MB or larger pages) and also Intel has been barking up the "storage cache in microprocessor firmware" enough to work out the bugs even if they have discredited the concept in people's minds so far.

Still, if Intel had decided to put an "Intel Inside" stickers on computers that had Intel SSDs, they would have build up their brand because people would experience Intel being associated with performance. Instead Intel is associated in people's minds with logos, stickers, and brands that are mindless and meaningless -- and with the stagnation of the PC platform even if they don't understand the many specific own goals that Intel has committed against it.

(Just for instance, PCs have been starved for PCIe lanes ever since Intel switched to PCIe. I think the intention behind that was to kill off NVIDIA, AMD and the PC gaming industry by not giving you enough bandwidth to really use an advanced graphics card or card(s) Thanks to cryptocurrencies and AI, NVIDIA and AMD have done well or stayed alive. However, Intel lost mindshare to phones by removing a reason why you would buy a PC instead of a phone.)

<comment><USER3> It looks like the research team has submitted some commits for parts of their work from the paper to be merged into RocksDB at large. If the work is shared for others to use, it shouldn't be so scary.

[https://github.com/facebook/rocksdb/pull/2795/commits](https://github.com/facebook/rocksdb/pull/2795/commits)

Personally, I think research papers like this should open source their work completely so others can replicate their results. That's how science is supposed to work, after all.

<comment><USER13> I don't think the research is scary, but Optane isn't the droid Intel is looking for.

<comment><USER3> _If you add a new storage tier which is supposed to be cheaper than another tier but also slower, you can 't take it for granted that real life performance is better. For Facebook which has talent on hand and a very large scale to amortized R&D efforts it is one thing. But for the rest of the market it is a very different._

But you said the positioning is scary, seemingly because of the additional work that's needed to make it work. If it's shared, does that not help?

<comment><USER9> Facebook's database team has many smart folks.</comment></comment></comment></comment></comment>


Ask HN: What do you use for project generation? - <AUTHOR> What do you use (if you do use) for project generation?
Use case: have a project template with all the names/dependencies/best practices baked in. Run one command with project name, have everything set up.
It would be nice to have one system to generate whatever projects: Java, C#, you name it.
I'm aware of Yeoman, and will explore it. Any others?
Related question: one you have your template, how do you make sure it actually works and is properly set up? <comment><USER2> I have something that is exactly this in the works, planning to open up on GitHub in the next month or two. It generates multiple technologies for full- stack e2e app implementation and management. It can do more than apps, really anything file based.

I'd be interested in hearing your impressions. I can show you around and/or get you early access. firstname.lastname@example.com</comment>