Intel Skylake Launch, with Architecture Analysis - <AUTHOR> http://www.anandtech.com/show/9582/intel-skylake-mobile-desktop-launch-architecture-analysis <comment><USER2> The most interesting to me is that Intel apparently stopped publishing transistor counts starting with the 14nm node.

This is significant because as structure sizes become smaller, the restrictions on possible layouts (so called DRCs, design rule constraints) become ever stricter. For example, you can't just place wires wherever you want; you have to take into account the relationship to other wires. With stricter rules, the end result _may_ be that the effective scaling achieved is worse than what the structure size suggests, because the rules force a lower density of transitors.

So what are Intel hiding? Are they far ahead of the competition in terms of DRCs and don't want others to know how much, or are they struggling (like apparently everybody else) and want to hide a less-than-ideal effective scaling? Obviously, your guess is as good as mine, but it's certainly fascinating to watch the competition as Moore's law is coming to an end.

<comment><USER3> How has/hasn't CPU reliability changed over the decades? Are these generally as sturdy as a 486? A 286 machine was mentioned in a recent article here, will you be able to find a running Skylake machine in 2045? How does the process size affect this? What other factors?

<comment><USER4> _A 286 machine was mentioned in a recent article here, will you be able to find a running Skylake machine in 2045?_

I've been thinking about this lately, and between the jihad against lead ([https://en.wikipedia.org/wiki/Tin_pest](https://en.wikipedia.org/wiki/Tin_pest)) and these machines storing the BIOS etc. in flash memory, I'm beginning to doubt it.

</comment></comment></comment><comment><USER5> Intel processors are great and really blow competition away (on desktops). But that's kind of annoying - when there's no competition, Intel holds on releasing high end CPUs (w/ 6 cores) on new architecture and their price is insane...

<comment><USER6> This is a real issue. At my company, we always buy the $300-$400 CPUs but they are barely getting faster with each generation. The last time there was a big jump was with Nehalem.

<comment><USER7> The performance jumps just got more specialized. For instance, introduction of AVX instructions made a _huge_ performance bump for some areas, especially scientific, albeit you needed crazy cooling to run a program using AVX extensively for more than a few seconds. I can remember having around an 80% performance jump with one code I used compiled with vs. without AVX. x86 hardware virtualization extensions were another enormous performance boost. Hardware transactional memory was supposed to be a big (order of magnitude) boost to some things on Haswell but they ended up having to disable it.

Through all this time though, I haven't noticed a massive _overall_ performance boost in a long time. If all I wanted to do was browse the web and read email I'd probably still be using my Core 2 Duo MBP from forever ago. The speed boosts have been piecemeal, one generation improves one thing, the next something else. This is different from Ye Olden Days, I can remember upgrading from a 386 to a Pentium II to a Pentium 4 and each upgrade was so dramatic that it completely redefined what I could do with my computer. The last real performance jump I can remember was the Core Duo upgrade that brought real multicore.

I do kinda miss my beloved old SPARCstation though. Makes me wonder what computing looks like in the alternative dimension where SPARC or one of the other architectures had taken over the PC market like Intel ultimately did.

<comment><USER8> There have been lots of other performance improvements, but I think they're less visible than other stuff. The CRC instruction that got added in SSE4.2 seems to get fairly wide use in hashes and stuff like btrfs. I think _rdrand_ , _aes_ , and _clwb_ are interesting ones as well. I guess power consumption is kind of another visible gain.

I think the biggest visible change recently though, at least as a software engineer, is the continuously lowering cost, increasing availability of, memory. I can literally store an entire project in memory and not have to worry about any network or disk bottleneck.

</comment></comment></comment></comment><comment><USER9> Call me crazy, but I want a processor that's just that - a processor. No integrated GPU that's just sitting there taking chip resources (die space, power leakage, etc) that could be used for better things (designing things for lower leakage current, async sections of the chip, etc).

Among other things, discrete GPUs blow integrated GPUs out of the water, and the time-to-obsolescence of a GPU isn't anywhere near that of a CPU. It also makes sense from a cooling perspective - it's a whole lot easier to cool two chips in separate areas than one larger chip, generally speaking.

<comment><USER10> For desktops, sure. But the desktop form factor is dying.

Where it matters is mobile. Even if you have a dedicated graphics processor, it makes sense to have integrated and then to have it auto-switch as needed. This saves on electrical power, reduces heat, and may extend the life of your mobile devices (since heat is damaging).

Ultimately if your want to force-on dedicated 24/7 then normally you CAN, but integrated simply gives you more options if you wish to extend the battery life of your device significantly.

<comment><USER11> "Dying" is a pet peeve of mine. Usually it's not true.

The desktop form factor is declining significantly in popularity in the mainstream market in favor of laptops and mobile devices. The reason is obvious: laptops and mobiles are portable, and the average user (and even many pro users) do not need _that_ much power in their local device.

It's still very popular in the gamer and professional workstation market, and likely will be for a long time. It's just hard to cram the processing power that gamers, hard-core developers, CAD and simulation users, etc. need into something as small as a laptop without creating what's comically referred to as a "ball burner" or "weenie roaster." I'm sure there's a female equivalent expression but it's even less polite. :P

Intel has many-core options for these machines, but they tend to lag a little behind. If you have deeper pockets and _really_ want power you can always put a high-end GPU in a server board with 2-4 Xeons and put it in a tower case. Now you have a data center node with a 4K monitor on it.

<comment><USER12> > _It 's still very popular in the gamer and professional workstation market, > and likely will be for a long time. It's just hard to cram the processing > power that gamers, hard-core developers, CAD and simulation users, etc. need > into something as small as a laptop without creating what's comically > referred to as a "ball burner" or "weenie roaster."_

Gaming is a niche market mostly for younger ages (people with "game rigs" drops rapidly after a certain age) and most hard-core developers use laptops -- the laptops you see in each and every dev conference are their main boxes, with or without external monitors.

As for CAD and simulation that's too niche to even mention. Of course some people will always have a need for a more powerful form factor. But if CAD users are part of the counter-argument for "it's not dying", then it very much is.

<comment><USER4> I'm not sure you're right, or at least as of late Supermicro has been selling X[9/10]SAE workstation motherboards, which will take a Xeon or consumer chip and ECC/non-ECC memory. No IPMI, lots of the sorts of slots we want, and onboard sound. The first X9SAE model, with which this message is being drafted, would appear to have been successful enough they repeated it in the next generation:

[http://www.supermicro.com/products/motherboard/Xeon/C216/X9S...](http://www.supermicro.com/products/motherboard/Xeon/C216/X9SAE.cfm)

[http://www.supermicro.com/products/motherboard/Xeon/C220/X10...](http://www.supermicro.com/products/motherboard/Xeon/C220/X10SAE.cfm)

They didn't make such a class of boards in the '8' generation.

Not dead yet!

</comment></comment></comment></comment></comment><comment><USER13> It seems that all Skylake CPUs suitable for new MacBook Pros won't ship until early 2016. I was hoping for a new MBP this fall, but it seems that my old MacBook Air has to do it's job a little longer.

<comment><USER14> I'm really looking forward to a benchmark of the GT4 graphics; I'm a game developer, and it might just be the first time I can work on a laptop with integrated graphics.

Of course, it'll still be a rare and power hungry configuration, so it's not like I'll suddenly be using a Macbook, but it's a nice progression.

<comment><USER15> _I 'm a game developer, and it might just be the first time I can work on a laptop with integrated graphics._

Please don't :). New iGPUs may be catching up to old dGPUs, but meanwhile new dGPUs are just skyrocketing in power far beyond them.

I made this chart to easily see relative performance of most common notebook GPUs:

[http://alteredqualia.com/texts/notebooks/nvidia- gpus.png](http://alteredqualia.com/texts/notebooks/nvidia-gpus.png)

Or if you are interested in both desktop and notebook GPUs relative performances:

[http://alteredqualia.com/tools/gpus/](http://alteredqualia.com/tools/gpus/)

What Intel does is great for rising minimal specs you can expect in notebook graphics, but you can do much better than that, even cheap modern dGPUs wipe out the best iGPUs. You can extrapolate Skylake Iris Pro from Intel marketing claims vs older Iris Pros, it's going to be better but not Earth-shatteringly better.

And this gap is just going to get wider in 2016, with HBM2 and 16 nm node sizes finally coming to GPUs (both to Nvidia with Pascal and AMD with Arctic Islands).

<comment><USER16> Even if you're developing a high-end crazy graphics game in UT4 on your desktop with SLIed GTX 980s, it's still useful to be able to work on it from a laptop at more than 2 FPS.

<comment><USER14> That's exactly my situation. Going to 720p requires half the fill rate of 1080p. Turn off some postprocessing and antialiasing and you might get double the performance again.

So if you're at 1/4 peak performance, you're still running a smooth game albeit not quite at full detail.

If you're at 1/16 peak performance... things aren't looking too good by the time you get your game smooth.

</comment></comment></comment></comment></comment><comment><USER17> Intel SGX is possibly huge. With a trusted enclave that's verifiable, you could do things like verify that a server is actually running certain code (like a bitcoin mixer).

Of course it also allows real DRM, where a remote server can verify you're running unmodified code.

But how does the key management work?

My personal interest is the continuing quest for a machine strong enough to develop, but not warm my hands at all. Macbooks are insanely hot (how can Apple even pretend to be about quality with those designs??), X250 ThinkPads is "alright" if I aggressively throttle the processor. Seems like the perf improvements are effectively dead so maybe we'll see cool laptops. Though OEMs seem to screw up as much as possible so who knows...

<comment><USER18> _Of course it also allows real DRM_

I think thats's the scariest part. 16 years ago people strongly oppposed the processor serial number in the P3( [https://news.ycombinator.com/item?id=10106870](https://news.ycombinator.com/item?id=10106870) ), something that seems almost harmless compared to what (anti-user) "security" features are in today's hardware. It's not only DRM, but no doubt other ways of taking control away from the user will be found for it.

With performance not being all that much better, I'm personally going to stay on older, "more free" hardware for a while.

<comment><USER19> I would think the real target market is cloud computing though.

</comment></comment></comment><comment><USER20> Am I alone in wanting a small (NUC or (thin?) mITX) board with a Core M on it? :-(

<comment> ju-st No! I still want to try out a Core M with a beefy cooling solution. You could propably beat mobile i3/i5's with it while having a very low idle power consumption...

</comment></comment><comment><USER21> I wonder why there were so few laptops with iX-5... processors in the market. Most laptops with 5th generation Cores seem to have low-power U processors, but even these are hard to find with some manufacturers. Did the full-power versions arrive too late, so manufactuters just chose to wait for Skylake?

<comment><USER22> Pretty much. Apple is a good example; the Macbook Pro 15 inch skipped over the 5xxx series, and the next update should be a Skylake chip.

</comment></comment><comment><USER23> I've seen a lot of references to skylake "supporting wireless charging" but with no explanation on what that means. I read this article hoping for an answer but it was not mentioned.

Can someone enlighten me? What does the chipset and CPU have to do with the power supply method? I'm assuming they're not including an RF power antenna on-die, so is this just code for "we got peak power consumption below the threshold practical with today's wireless power transmission devices"?

<comment><USER24> Intel doesn't market chips; they market "platforms" that are bundles of chips that they want you to buy together. Centrino was the most infamous one and maybe now Intel is trying to bundle some wireless charging chips for tablets or something.

</comment></comment><comment><USER8> I'm honestly still trying to figure out the implications of eDRAM. It seems like the main benefit is offloading traffic from the memory bus, particularly now that it's coherent.

Am I missing something?

<comment><USER25> It's to increase the effective memory bandwidth of the system. GPUs have very high memory bandwidth requirements, so the models with the high end GPU would be limited by the memory subsystem. Using the extra cache the amount of fetches from memory can be reduced, increasing the amount of memory bandwidth available.

<comment><USER8> That makes sense. Using it as a victim cache seemed kind of odd, but I think it makes more sense now. It seems like it's a still evolving technology. I wonder if there are corresponding performance counters.

</comment></comment></comment><comment><USER26> "4.5W ultra-mobile Core M" \- does it means if someone uses it with a typical 2250 mAh cell phone battery, it only last half hour?

That's a long way to catch up with ARM SOC, right?

<comment><USER27> That's the TDP of the chip, or the maximum amount of heat it can generate, not necessarily the power draw. Also, you were assuming it was running at full load 100% of the time. I don't have a source, but for comparison I believe Apple's AX chips have a TDP of ~2-3 W.

</comment></comment><comment><USER28> i'm pretty pissed. skylake-h chips will only have hd 530 graphics which is slower than the current version. and still no hdmi 2.0. just laughable.

<comment><USER29> HDMI 2.0 support is supplied by the motherboard, and not a required feature. Skylake's Alpine Ridge can drive two 4k 60hz displays, and supports HDMI 2.0 operation.

<comment><USER30> Alpine Ridge is an extra cost option that won't be included in the vast majority of laptops.

<comment><USER12> Then don't buy the "vast majority of laptops" but on that includes it.</comment></comment></comment></comment>


A step towards new nitrogen products - <AUTHOR> https://news.yale.edu/2020/08/12/new-nitrogen-products-are-air <comment><USER3> [https://www.nature.com/articles/s41586-020-2565-5](https://www.nature.com/articles/s41586-020-2565-5)

The activation of abundant molecules such as hydrocarbons and atmospheric nitrogen (N2) remains a challenge because these molecules are often inert. The formation of carbon–nitrogen bonds from N2 typically has required reactive organic precursors that are incompatible with the reducing conditions that promote N2 reactivity1, which has prevented catalysis. Here we report a diketiminate-supported iron system that sequentially activates benzene and N2 to form aniline derivatives. The key to this coupling reaction is the partial silylation of a reduced iron–dinitrogen complex, followed by migration of a benzene-derived aryl group to the nitrogen. Further reduction releases N2-derived aniline, and the resulting iron species can re-enter the cyclic pathway. Specifically, we show that an easily prepared diketiminate iron bromide complex2 mediates the one-pot conversion of several petroleum-derived arenes into the corresponding silylated aniline derivatives, by using a mixture of sodium powder, crown ether, trimethylsilyl bromide and N2 as the nitrogen source. Numerous compounds along the cyclic pathway are isolated and crystallographically characterized, and their reactivity supports a mechanism for sequential hydrocarbon activation and N2 functionalization. This strategy couples nitrogen atoms from N2 with abundant hydrocarbons, and maps a route towards future catalytic systems.

<comment><USER4> It's "easily prepared", eh? Let's take a moment to appreciate the toxic, volatile, pyrophoric nature of this concoction:

"sodium powder, crown ether, trimethylsilyl bromide and N2"

Well, the N2 is probably fine.

The pyrophoric sodium powder might even be a good thing, because it will cause an inferno long before the crown ether has a chance to form explosive peroxides.

<comment><USER5> The reaction should be conducted in an oxygen-free, pure nitrogen atmosphere where those compounds should be safe to handle.

<comment><USER6> When it's boiled to dryness, crown ether can produce peroxides that are unstable enough to explode on their own with shock or additional heat - <USER2> oxygen needed.

It's a not-uncommon mistake to make in a synthetic lab.

<comment><USER5> My understanding is that evaporating solvent away doesn't form peroxides. Rather, as an ether ages, it can peroxidize. Removing the solvent concentrates the peroxides is all. Sure, it's a little tricky, but they're reporting results of chemistry research, which doesn't mean immediate real world application.

</comment></comment></comment></comment></comment><comment><USER7> As far as I understand, the non-nitrogen atoms in the reaction are provided by benzene.

Fun fact: benzene is so important in chemistry that it has two unicode code points, ⌬ and ⏣.

<comment><USER8> Well, unicode doesn't have much to do with chemistry, or with importance. Those two symbols both long predate unicode (as you'd expect given the nature of unicode).

The reason for the second symbol is that the positioning of the double bonds within the ring is underdetermined (and indeed, doesn't really exist) -- they are in a state of indeterminate flux much like the bonds in a molecule of ozone. The circle explicitly acknowledges that we can't really identify particular bonds as being the double bonds.

<comment><USER9> >Those two symbols both long predate unicode (as you'd expect given the nature of unicode).

Yes, but notably they are not included in Unicode for compatibility with legacy character sets.

<comment><USER8> Are they included in Unicode for any reason? They're not textual and don't make any sense (they are actually ill-formed[1]) as independent glyphs.

[1] OK, they're not ill-formed if you really want to insert a miniature icon of a free benzene molecule into running text, but in chemistry you're mostly talking about benzene rings as a structural element in larger molecules, not molecular benzene.

</comment></comment></comment></comment><comment><USER10> One of the uses of aniline is hypergolic rockets although its pretty toxic stuff and as not used for large rockets anymore. Making test tube rockets with aniline, pretty interesting: [https://www.youtube.com/watch?v=OszX18NLtrY](https://www.youtube.com/watch?v=OszX18NLtrY)

</comment><comment><USER11> Catalytic nitrogen fixation is one of the holy grails for chemists, so papers that get within spitting distance often get a lot of attention.

This paper seems very interesting, but unless I'm mistaken it's not catalytic and that's a big caveat.

<comment><USER12> Apparently none of the components of the mix get used up except the nitrogen and the benzene. It may be not one-step catalytic, but this should not be a problem.

What am I missing?

</comment></comment><comment><USER13> Atmospheric nitrogen is a big source of environmental and human harm in the Low Countries. The nitrogen deposits are literally smothering what little nature is left.

It already led to a full-blown crisis in The Netherlands where construction sites were ordered to shut down. In Belgium, with the lack of effective national governance, the nitrogen problem is not being laying dormant.

This kind of innovation hopefully bodes well for Belgium which has both an abundance of nitrogen _and_ a pervasive petrochemical industry.

<comment><USER14> Atmospheric nitrogen sounds bad.

And the Netherlands has to contend with some serious dihydrogen monoxide issues, too.

<comment><USER8> > dihydrogen monoxide

I always wanted to know why this name was picked over "hydrogen hydroxide".

<comment><USER15> Because people know carbon monoxide is toxic and will quickly make the false association.

<comment><USER8> People know chlorine is toxic and salt is half chlorine... :/

</comment></comment></comment></comment></comment><comment><USER16> There is a book which tells the story of fixing nitrogen from air and its a fanatic read:

[https://www.goodreads.com/book/show/3269091-the-alchemy- of-a...](https://www.goodreads.com/book/show/3269091-the-alchemy-of-air)

its non-fiction

</comment><comment><USER17> I find it interesting that I initially interpreted the headline "New nitrogen products are in the air" as a story about pollution. I.e., new nitrogen products (pollutants) have been detected in the atmosphere.

<comment><USER18> Ah well Nitrogen is the most abundant gas in the atmosphere so it's not by any stretch a pollutant.

<comment><USER19> N2 isn't a pollutant but many nitrogen compounds are major pollutants, and its not so far fetched to call something like NO2 a "nitrogen product"

</comment></comment></comment><comment><USER20> > The discovery comes from a team of Yale chemists who found a way to combine > atmospheric nitrogen with benzene to make a chemical compound called > aniline, which is a precursor to materials used to make an assortment of > synthetic products.

Ok, great. This is stated in a fairly neutral way. But one wonders if we are considering the negative effects of those synthetic products. That was the problem with plastics -- although revolutionary, there was a dearth of discourse about its negative effects, which we are feeling now.

<comment><USER21> Aniline is already a widely used industrial compound (used to make polyurethane). The novelty here is making it from atmospheric nitrogen.

<comment><USER22> Nitrogen also makes up 2.6% of the Martian atmosphere and Nitrogen gas will likely be an important feedstock for future Martian ISRU plans.</comment></comment></comment>


Grace Hopper to Programmers: Mind Your Nanoseconds - <AUTHOR> http://highscalability.com/blog/2012/3/1/grace-hopper-to-programmers-mind-your-nanoseconds.html <comment><USER2> Rant inspired by seeing her for the 5th time this week:

It's like every time I hear about Grace Hopper, it's got to do with a piece of wire. Or tube. And any comments on it are usually strangely excited, almost awestruck. What's up, people? She did some other stuff too. Like, no big deal back then, writing a god damn compiler.

It's like people treat her like a dancing bear. Look, woman! Look, uniform! Look, she said "nano"! Take a step back and a deep breath. Chill out.

"Bike shed" comes to mind, in a weird way.

<comment><USER3> Darn Hipsters.

</comment></comment><comment><USER4> From SICP:

> Programs must be written for people to read, and only incidentally for > machines to execute.

When programmers care about lack of efficiency before it's a problem, they're doing it wrong.

<comment><USER5> until you get to the end game and you realise you have a lemon on your hands which is going to require a rewrite because it's so slow when you throw 10,000 users at it...

"Be mindful" is probably better advice. Tradeoffs are easier to make earlier on and everything is a compromise after all.

<comment><USER4> What I said was:

> When programmers care about lack of efficiency before it's a problem, > they're doing it wrong.

That doesn't mean that you shouldn't identify problems as quickly as possible, just don't try to improve performance when you haven't got a problem in front of you.

</comment></comment></comment><comment><USER6> That also affects sensor resolution, if your processor is counting the clock cycles while photons are flying through the air. Like radar.

</comment><comment><USER7> The article is ok, the video is a must watch. She's witty.

</comment><comment><USER8> third or fourth time this has been posted within the past 12 months.

I sure hope someone posts the Letterman interview with her next, so I can see that to the nth as well.

<comment><USER9> Your account is only 47 days old?

<comment><USER10> HN cannot be read without an account?</comment></comment></comment>


How the Doves Type Was Nearly Lost - <AUTHOR> https://www.buzzfeed.com/hayleycampbell/when-doves-type <comment><USER2> I feel really conflicted about a typeface like this not being public domain. It's true that Green has put a lot of work into making a modern digital version. But he also didn't design or create the original and it's over 100 years old.

<comment><USER3> Anyone can create a similar typeface from scans of Doves Press books, as Green originally did.

<comment><USER4> And he said as much himself in an earlier discussion on HN:

"The name Doves Type® is copyrighted to protect my drawings. But if someone wants to go ahead and do what I did and recreate the type from the original printed sources there's nothing to stop them, as long as they do not use my font data as a basis for their font. It took me 5 years, on-&-off, to reach the stage where I was satisfied that I had captured the overall essence of the original. Though one can never recreate the patina of a letterpress type – the appearance of each glyph varies from word to word, line to line, page to page. That's why I prefer to call my digital type a facsimile."

Trademark-copyright confusion aside, seems right on.

<comment><USER5> > as long as they do not use my font data as a basis for their font

The law is not on his side.

You can't use the actual digital font file, but if you print the font, or even just screenshot it you can reproduce it completely legally. You can even automate the conversion if you are careful in how you do it.

A typeface can not be copyrighted: [https://en.wikipedia.org/wiki/Intellectual_property_protecti...](https://en.wikipedia.org/wiki/Intellectual_property_protection_of_typefaces)

> Trademark-copyright confusion aside, seems right on.

That's not what the law is though. Typefaces simply can not be copyrighted.

As an aside I've always found it completely bizarre how of all the digital media used on a web page, for some reasons fonts have copyright restrictions built into them, but nothing else does.

<comment><USER6> A well made digital font file is a lot more than pictures or even vectors of letters. There's a whole bunch of hinting and even a virtual machine with opcodes for tweaking how letters appear at particular pixel sizes and in combination with surrounding letters. A well made font file really is a compiled software program with built-in assets that someone sat down and developed and debugged, not unlike a full game or an app.

<comment><USER7> could you point me to some resources about the "virtual machine" you mentioned? sounds very interesting.

<comment><USER6> Here's a random Google hit: [http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.ht...](http://home.kabelfoon.nl/~slam/fonts/tticomp/introduction.html)

And another, with an opcode list: [https://github.com/janelia- flyem/go/blob/master/freetype-go/...](https://github.com/janelia- flyem/go/blob/master/freetype-go/freetype/truetype/opcodes.go)

And an example font program: [https://developer.apple.com/fonts/TrueType- Reference-Manual/...](https://developer.apple.com/fonts/TrueType-Reference- Manual/RM03/Chap3.html#font_program)

Notice the presence of "if" and "call" and "loop".

Before super highres retina type displays, properly hinted fonts made all the difference. A naive vector rasterization might bulk up from a 1px to a 2px line width completely inappropriately as font size increases. A properly developed one would ensure pixel perfect rasterization at most font sizes, even in the case of very lowres pixels.

The complexity of truetype is a source for many bugs, not least because some operating system interpret the font virtual machine in kernel mode. Also, it looks like the font code for a large amount of systems trace back to a common ancestor.

This one is a very good read:

[https://googleprojectzero.blogspot.no/2015/07/one-font- vulne...](https://googleprojectzero.blogspot.no/2015/07/one-font- vulnerability-to-rule-them-all.html)

"For example, most TTF engines are based on Microsoft's original implementation of the format, including Windows GDI (win32k.sys), Microsoft GDI+, Microsoft DirectWrite, Adobe Reader and Adobe Flash. Likewise, most OTF engines are based on Adobe's original implementation, including Microsoft GDI (ATMFD.DLL), Microsoft DirectWrite, Microsoft Presentation Foundation and Adobe Reader. As a direct outcome, any bugs present in the original implementation that was later branched and included in multiple products were likely propagated, and may affect various programs or operating systems. This is of course an extremely frightful scenario, with a single 0-day vulnerability (...)"

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Here seems to be the fruit of Robert Green's labor: [http://www.typespec.co.uk/doves-type/](http://www.typespec.co.uk/doves-type/)

<comment><USER9> They want $40 per 10K views? Does anyone know if I'm reading the license description correctly?

Related question: Do the licenses for desktop users only cover print works?

<comment><USER10> No, £40 for a perpetual license to use it as a web font on website with up to 10k average monthly views. And a desktop user could use the font to create digital works like images and videos, just not ones that embed the font.

<comment><USER9> That makes a lot more sense. Thanks for clarifying.

</comment></comment></comment></comment><comment><USER11> I have nothing to add. I just wanted to that say when I read "Most Beautiful Typeface" I thought it was going to be another boring post about Helvetica, and it was not, and I'm really glad for that.

<comment><USER12> Funny, first thing that came to my mind was Comic Sans...

</comment></comment><comment><USER13> Some discussion from a year ago [https://news.ycombinator.com/item?id=9951869](https://news.ycombinator.com/item?id=9951869) and three years ago [https://news.ycombinator.com/item?id=6964013](https://news.ycombinator.com/item?id=6964013)

</comment><comment><USER14> What a nice story... Here's a good book if you want to learn more about the world of type setting: Just my Type by Simon Garfield.

[http://www.simongarfield.com/pages/books/just_my_type.htm](http://www.simongarfield.com/pages/books/just_my_type.htm)

<comment><USER15> Loved this book, it was a surprisingly entertaining and witty read for a book about fonts.

</comment></comment><comment><USER16> Not a typographer ... It _looks_ nice, all the letters have elegant curves and all ... But I personally find it hard to read.

<comment><USER17> I also wouldn't call the most beautiful, although beautiful it is.

<comment><USER18> You can't say that without saying what the most beautiful is?

</comment></comment></comment><comment><USER19> The Economist originally covered the topic 3 years ago:

[http://www.economist.com/news/christmas- specials/21591793-le...](http://www.economist.com/news/christmas- specials/21591793-legendary-typeface-gets-second-life-fight-over-doves)

And here was the (little bit) of discussion here about it: [https://news.ycombinator.com/item?id=6964013](https://news.ycombinator.com/item?id=6964013)

</comment><comment><USER20> Looking at [http://www.typespec.co.uk/doves- type/](http://www.typespec.co.uk/doves-type/) I see that if you use this typeface on a webpage, then you have to pay-per-viewing of said page.

Is there a discussion for the arguments for and against pay-per-view when using font? Have their been licensing schemes for typeset work where the printer had to pay each time a person opened the book using said typeface?

<comment><USER21> I think you may have misinterpreted the license. There's no pay-per-view.

From the description:

"It is also available in web font formats for self hosted websites (up to 10K monthly pageviews on average)."

You buy a license for your website. Large websites (with more than 10k monthly pageviews) need to contact them for a license.

<comment><USER22> How do you know what the average page views will be when you buy it? How do you measure a page view?

For a blog or newspaper it may be obvious, for web applications it can be very hard to determine.

<comment><USER23> You might not know up front, for sure. I know when I load our website, I see a "transferring data from hello.myfonts.net" in the status bar, which I guess some sort of phone-home mechanism. If we go over the limit, I assume they'll notify us.

</comment></comment></comment></comment><comment><USER24> The most beautiful Latin typeface? Do these hold a candle to semitic calligraphy?

<comment><USER25> Truly beautiful semitic calligraphy can't be captured by a typeface; this is a different sort of aesthetic appeal.

</comment></comment><comment><USER26> Also an interesting Radio 4 programme on the same topic: [http://www.bbc.co.uk/programmes/b07lhh6z](http://www.bbc.co.uk/programmes/b07lhh6z)

</comment><comment><USER27> heathens! computer modern uber alles!

</comment><comment><USER28> Good old British eccentricity!

</comment><comment><USER29> Can't believe Buzzfeed didn't run with their click bait subheading: You won't believe what happens next! -or- What happens next is incredible!

<comment><AUTHOR> I had submitted it with _How The World's Most Beautiful Typeface Was Nearly Lost Forever_ which is pretty baity. I thought so at the time but nothing better came to mind. The current title is a big improvement from small changes.

(look at all the comments here that respond pretty narrowly to the superlative)

</comment></comment><comment><USER30> was expecting some kind of comic sans troll.

</comment><comment><USER31> Only thing worse than a repost is the person commenting that it's a repost. Or that was true til I posted this.

<comment><USER32> We detached this subthread from [https://news.ycombinator.com/item?id=12480957](https://news.ycombinator.com/item?id=12480957) and marked it off-topic. From the FAQ:

> _Are reposts ok?_

> _If a story has had significant attention in the last year or so, we kill > reposts as duplicates. If not, a small number of reposts is ok._

</comment></comment><comment><USER33> Is buzzfeed simply incapable of publishing without clickbait headlines? Are there people who don't find it patronizing?

These questions plague me.</comment>


The Ruby project discusses adopting the Contributor Covenant - <AUTHOR> https://bugs.ruby-lang.org/issues/12004 <comment><USER2> As usual, nobody advocating a CoC can point to any situation in the project's history where having a CoC would have improved the situation. There's also a few classic kafkatraps in the discussion ("your opposition to my proposal is just proof that my proposal is required.") All it'll need is to wrap up with some high-level authority ramming the code of conduct down the community's throat to be a classic example of how these discussions usually go.

</comment><comment><USER3> Seriously? Can we go a day without some political invader trying to make open source into a cudgel? It's a shakedown, because if you don't give in they cause an 'opalgate' clickbait storm.</comment>


Intel Issues Updates to Protect Systems from Security Exploits - <AUTHOR> https://newsroom.intel.com/news-releases/intel-issues-updates-protect-systems-security-exploits/ <comment><USER2> Why did CERT modify their vulnerability disclosure to remove the text:

> Fully removing the vulnerability requires replacing vulnerable CPU hardware.

Proof: [https://webcache.googleusercontent.com/search?q=cache:rzc6iQ...](https://webcache.googleusercontent.com/search?q=cache:rzc6iQmgrIcJ:https://www.kb.cert.org/vuls/id/584653+&cd=4&hl=en&ct=clnk&gl=us)

This smells really bad to me, as if Intel pressured CERT into removing language that could have caused their market value to instantly vaporize as every consumer for the last 20 years joins a class action suit...

<comment><USER3> I don't get these calls to a class action suit... If it was intentional, it could have a reason. But I just don't get this attitude when they are having a really bad day after someone discovered a new type of attacks on their chips.

<comment><USER4> Intel isn't having a bad day. The people who are stuck with chips that enable severe security exploits are having a bad day. Actually they are going to have a bad year till the design flaw is fixed in hardware. Or maybe even 5 years. Who knows.

Intel is 100% liable to face a lawsuit over this. Consider if a major car brake manufacturer discovered that there was a design flaw in the brakes that prevented them from functioning in certain situations. It'd be facing multiple lawsuits by now whereas Intel is going with "our chips are the most secure ever" line.

<comment> GuB-42 I think you are confusing security and safety. Security is about dealing with malicious attackers, while safety is about making sure random events and mistakes won't kill you.

Your example with the brakes is about safety, i.e. making sure the car won't kill you during normal operation. Normally, unless their CPUs start bursting into flames, this is not a problem for Intel.

The problem here is about security. A car analogy would be that to start your car, you need a code and that code can be found by measuring how long it takes to process the input, making life easier for thieves.

As for liability, I don't think you can be liable in court if you didn't plan for something that wasn't known at the time and isn't trivial.

<comment><USER5> Ironically, isn't your analogy a literal thing?

[http://www.bbc.co.uk/news/business-41367214](http://www.bbc.co.uk/news/business-41367214)

</comment></comment></comment></comment></comment><comment><USER6> It looks like they expose some MSR to control the branch predictor, see:

[https://twitter.com/aionescu/status/948753795105697793](https://twitter.com/aionescu/status/948753795105697793)

[https://twitter.com/aionescu/status/948818841747955713](https://twitter.com/aionescu/status/948818841747955713)

<comment><USER7> It appears the retpoline fixes don't work in Skylake or later (it's smart enough to speculate out of it?) and will require new support for IBRS/IBPB in the microcode to mitigate.

From: [https://lkml.org/lkml/2018/1/4/615](https://lkml.org/lkml/2018/1/4/615)

<comment><USER8> What I don't understand is why the kernel patches and microcode updates are still been worked out today. They had 6 months to work on it.

No secret channel to communicate with Linux Kernel developers? No coordinated effort? Last minute findings?

On this thread [https://lkml.org/lkml/2018/1/4/174](https://lkml.org/lkml/2018/1/4/174) looks like that the author is disclosing the info on the last minute.

<comment><USER9> IIRC Intel employs people to work on the linux kernel on behalf oh Intel. Either Intel fumbled or it isn't that easy to circumvent the problem plaging Intel's processors with a software hack.

<comment><USER10> Or, they were holding out hope for a workaround that didn't make the entire Cloud 20% slower and they couldn't make it work.

<comment><USER11> Code for the solution and then code for performance. Direct performance coding is a bad return on investment.

First prove it works and then prove it can be made better and faster ...

<comment><USER10> That's easy for you to say. You're not the person having to admit to a billion dollar mistake.

Everybody stalls for time when the stakes are this high. How long can I reasonably spend tying to turn this into a small problem before I have to go public with it?

Saying it's a bigger problem than it turns out to be is a PR nightmare of its own. If there was a cheap fix then you cried wolf and killed your reputation just as dead.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> I'm disheartened by the number of comments here who are taking the stance that Intel has idiot designers or that management doesn't care about security. This attack is very clever and unexpected. Even though side-channel attacks have been talked about for awhile, even the guy who developed Meltdown was surprised that it worked. It just seemed like an "in theory" security hole, not an exploitable one.

AMD isn't vulnerable to Meltdown not because they foresaw this issue, but probably because they simply weren't as aggressive as Intel in allowing speculative execution. For years people have preferred Intel over AMD cpus due to their performance advantage, due in part to that higher sophistication of their pipeline.

Or to recast it, nobody is hating on AMD right now, but AMD CPUs do allow a user process to learn some things about the kernel via timing attacks. If next month a researcher develops Meltdown2 for AMD, are AMDs designers now suddenly idiots for missing an obvious security hole?

<comment><USER13> AMD did things the right way competing for performance without sacrificing security. What's happening right now are the consequences of Intel's actions.

<comment><USER14> If AMD spotted the issue and avoided it deliberately all those years ago, why didn't they tell anyone?

<comment><USER15> There is a difference between following good security practices (gratuitous isolation, defensive design) and having exploits ready to show the world how valuable it is. Noone was claiming AMD knew of such exploits beforehand.

</comment></comment></comment></comment><comment><USER16> They are still sticking to this line:

"This is not a bug or a flaw in Intel products. These new exploits leverage data about the proper operation of processing techniques common to modern computing platforms, potentially compromising security even though a system is operating exactly as it is designed to."

[https://www.intel.com/content/www/us/en/architecture-and- tec...](https://www.intel.com/content/www/us/en/architecture-and- technology/facts-about-side-channel-analysis-and-intel-products.html)

<comment><USER17> Well, that's true (at least for the spectre attack). It's not a bug in _Intel_ products. It's a bug in _any CPU that uses branch prediction_ (please correct me if I'm wrong, this is my current understanding)

<comment><USER18> The effect on Intel is far more severe than on other architectures. There were three vulnerabilities, two grouped together as "spectre" and one called "meltdown." Intel products are uniquely vulnerable to the meltdown attack, while many CPUs are vulnerable to spectre. The summary AFAIUI is that for most CPUs you can attack userspace processes with these techniques (think Javascript running in a browser), while for Intel CPUs you can also attack the kernel. Intel CPUs also seem to be somewhat easier to attack than others because of a higher-bandwidth side channel.

<comment><USER19> > Intel products are uniquely vulnerable to the meltdown attack

More precisely, there is only a PoC for Intel at this time. AMD processors are believed to not be vulnerable. Some ARM processors _are_ believed to be vulnerable.

> for most CPUs you can attack userspace processes with these techniques

Spectre can attack the kernel as well, at least according to [http://www.tomshardware.com/news/meltdown-spectre- exploits-i...](http://www.tomshardware.com/news/meltdown-spectre-exploits- intel-amd-arm-nvidia,36219.html) . It's just harder to use than meltdown.

<comment><USER20> That link no longer loads for me.

AIUI, Spectre can be used to attack the kernel, only if you can get code running in kernel-space, via, e.g. eBPF.

<comment><USER21> No, you could also find a gadget with ROP techniques. The eBPF thing in the paper was purely due to convenience of exploitation.

</comment></comment></comment></comment></comment></comment><comment><USER22> Lenovo has BIOS updates that specifically mention CVE-2017-5715 (Spectre). I wonder if this is an Intel microcode update.

[https://pcsupport.lenovo.com/de/en/products/laptops-and- netb...](https://pcsupport.lenovo.com/de/en/products/laptops-and- netbooks/thinkpad-t-series-laptops/thinkpad-t470/downloads/ds120429)

<comment><USER23> For those like me are running Linux and asking how to update the BIOS, lenovo provides a ISO file. Quoting from [1]:

"The BIOS Update CD can boot the computer disregarding the operating systems and update the UEFI BIOS (including system program and Embedded Controller program) stored in the ThinkPad computer to fix problems, add new functions, or expand functions as noted below."

[1]: [https://support.lenovo.com/fr/en/downloads/ds120430](https://support.lenovo.com/fr/en/downloads/ds120430)

<comment><USER24> Yeah, basically all BIOS have that. Some simply need a FAT usb key inserted with a specifically-named file that the BIOS looks for instead of a "true" bootable media.

</comment></comment></comment><comment><USER25> And how do I get these firmware updates and microcode updates on Windows?

Checking AsRock, there aren't any Bios updates.

Also:

> Customers who only install the Windows January 2018 security updates _will > not receive_ the benefit of all known protections against the > vulnerabilities. In addition to installing the January security updates, a > processor microcode, or firmware, update is required. This should be > available through your device manufacturer. Surface customers will receive a > microcode update via Windows update.

From:

[https://support.microsoft.com/en-gb/help/4073119/windows- cli...](https://support.microsoft.com/en-gb/help/4073119/windows-client- guidance-for-it-pros-to-protect-against-speculative-exe)

(There is also a powershell script to check if you are protected fully or not)

<comment><USER26> Microcode updates are distributed via Windows update.

<comment><USER25> But Microsoft says they are not:

>In addition to installing the January security updates, a processor microcode, or firmware, update is required. This should be available through your device manufacturer. Surface customers will receive a microcode update via Windows update.

[https://support.microsoft.com/en-gb/help/4073119/windows- cli...](https://support.microsoft.com/en-gb/help/4073119/windows-client- guidance-for-it-pros-to-protect-against-speculative-exe)

<comment><USER27> If the microcode update requires motherboard vendors to issue BIOS updates we are all doomed.

<comment><USER28> This appears to be the case at least on my Windows 10 laptop.

I've installed the hotfix for Windows, but when I run the PowerShell script to determine whether mitigation is active, the script tells me that it's not active, due to lack of hardware support. The script then goes on to give the recommendation to "Install BIOS/firmware update provided by your device OEM that enables hardware support for the branch target injection mitigation."

It's a 1-year-old ASUS laptop and I would be surprised if they even give a sane response to my question to their technical support (I doubt they will even know what I'm talking about).

<comment><USER29> "Dear OEM Vendor Technical Support,

There has been recent news about critical security issues in Intel CPUs, requiring a firmware update for all laptops and motherboards with Intel chips.

The vulnerabilities include the potential for malicious websites to read sensitive system memory, including passwords and encryption keys.

I have model XXYY-ZZZZ, do you have any information on when an update will be available, and where I can access it?

If not, can you attempt to escalate this ticket? The security issues are starting making their rounds in the news, and more information can be found at [https://meltdownattack.com](https://meltdownattack.com)

Thank you, and happy new year :)"

Seems like it might be worth a shot.

<comment><USER30> "Dear usr frend,

thx for ur interst in our product. our team will reach u. we have many new products. hope u have great new year!

\- OEM volume sales"

</comment></comment></comment></comment></comment></comment></comment><comment><USER31> > Intel has developed and is rapidly issuing updates for all types of Intel- > based computer systems — including personal computers and servers — that > render those systems immune from both exploits (referred to as "Spectre" and > "Meltdown") reported by Google Project Zero.

Now I really wonder how they managed to patch both? Does someone know how you could patch something like that from Intel's side of things?

<comment><USER32> [https://en.wiktionary.org/wiki/chicken_bit](https://en.wiktionary.org/wiki/chicken_bit)

The first example usage given there is very illustrative:

 _As an example, modules such as branch predictors and speculative execution units can be turned off with a variant of the "chicken bits", control bits common to many design developments to control the activation of specific features._

<comment><USER33> I kinda doubt they'd be able to turn off branch prediction and speculative execution entirely and still be able to claim that

> the performance impact of these updates is highly workload-dependent and, > for the average computer user, should not be significant

<comment><USER34> If your workload does not branch, no performance impact AND Average user's computer is mostly idle = Above intentionally misleading PR statement.

</comment></comment></comment></comment><comment><USER35> > _that render those systems immune from both exploits (referred to as > "Spectre" and "Meltdown")_

The language used seems to imply that they have patched all three identified vulnerabilities.

Is it possible that if this update is applied to a system running an unpatched Linux kernel on an Intel CPU that the system is no longer vulnerable to Meltdown?

Or does this microcode update complement work done by the kernel developers implementing KPTI as well as by the browser developers mitigating some portion of Spectre?

(My initial take is that the efforts by CPU manufacturers and OS/Software developers are orthogonal to provide better coverage to affected parties, such as those on CPUs where no update exists yet)

<comment><USER36> I'd also be interested in an answer here. Right now it seems like this might even just add support for OS vendors and software developers to mitigate this down the road by selectively disabling pipelining features in their code or at least that's what I'm reading seems to imply.

</comment></comment><comment><USER37> If it was kept secret, what would the value of this zero day exploit have been on the black market?

<comment><USER38> I'd be surprised if Meltdown was worth less than $2B. And I wouldn't be surprised if it was worth over $100B.

Of course that is raw value, however in practice it would be EXTREMELY hard to launder such a large amount of money into and out of an online transaction.

The question then becomes, what kind of person is the hacker? Are they in a position where they can wait and find a good deal or would they rather wash their hands of it over $100M or so?

<comment><USER39> For this kind of exploit, I don't think you'd have to worry about the transaction. The NSA/(insert spy agency here) would gladly send a truck full of cash to your house for it (assuming they didn't know about it already).

<comment><USER40> I like to think the NSA/TLA folks are sitting in an office somewhere incredulous that someone found this bug they'd never have even dreamed up, whilst a catalogue of simple buffer overflows and mandated backdoors that no one has yet found sits on the shelf ready for offensive use.

<comment><USER41> > they'd never have even dreamed up

Side channels in general have been known for a long, long time in mil and intel communities, so it is likely that folks there long ago identified and understood that it's a bad idea to share a single x86_64 core between multiple tenants in a public cloud, for example, even if this specific attack vector was not explicitly tagged & bagged.

<comment><USER38> I was under the assumption that it's worse than just sharing cores or servers. Even machines that do not share cores but share a common hypervisor are cross- vulnerable.

From Wikipedia [0]:

 _Spectre has the potential of having a greater impact on cloud providers than Meltdown. Whereas Meltdown allows unauthorized applications to read from privileged memory to obtain sensitive data from processes running on the same cloud server, Spectre can allow malicious programs to induce a hypervisor to transmit the data to a guest system running on top of it._

However I have also read that Spectre is confined to userspace, so I'm not sure who is correct.

[0] [https://en.wikipedia.org/wiki/Spectre_(security_vulnerabilit...](https://en.wikipedia.org/wiki/Spectre_\(security_vulnerability\)#Impact)

</comment></comment></comment></comment></comment></comment><comment><USER42> So just to be clear, I'd need to install the OS patch as well as the OEM update (to BIOS? Processor?) in order to mitigate both Meltdown and Spectre.

Additionally, how does this interact with VMs? It makes the most sense to me that I'd need to microcode patch the hosts, but what about the guests?

<comment><USER43> My understanding of this situation is this:

Meltdown: Easier to exploit, fixable in software but perhaps up to a 30% performance hit for some operations.

Spectre: Harder to exploit, not fixable in software, needs new hardware.

See these two links for more detail:

[https://twitter.com/nicoleperlroth/status/948684376249962496](https://twitter.com/nicoleperlroth/status/948684376249962496)

[https://googleprojectzero.blogspot.co.uk/2018/01/reading- pri...](https://googleprojectzero.blogspot.co.uk/2018/01/reading-privileged- memory-with-side.html)

<comment><USER44> I was under the impression that the changes for Clang with retropipe was for specter. Mitigation of it then can be done by recompiling... everything.

> Introduce the "retpoline" x86 mitigation technique for variant #2 of the > speculative execution vulnerabilities disclosed today, specifically > identified by CVE-2017-5715, "Branch Target Injection", and is one of the > two halves to Spectre..

<comment><USER45> Can't you just compile your own code without the mitigations inside the vm?

<comment><USER46> Yes, but then you'd just end up with having a vulnerable application running inside of the VM. The mitigations in the compilers are for making programs compiled by those compilers immune(ish?) to Spectre, not to make it impossible for those programs to use Spectre to attack other processes.

</comment></comment></comment></comment></comment><comment><USER47> These exploits are the result of the games we play to get high performance when memory is slow but processors are fast (speculative execution; caches).

It's time to figure out how to make RAM dense, cheap, AND fast, so we can finally eliminate the cache layer from the ridiculous hierarchy of storage technologies.

<comment><USER48> Flops are cheap. Bandwidth is expensive. Latency is physics.

We aren't at full lightspeed latencies ram technologies, but we're closer than you may realize, and it's unlikely we can do substantially better any time soon without revolutionary advances.

<comment><USER49> Electricity moves around 2/3 of light speed.

<comment><USER50> More precisely the electromagnetic waves on the waveguides of the motherboard (bus) move around 2/3 as fast as electromagnetic waves in vacuum. Not as fundamentally separated as one would imagine.

</comment></comment></comment></comment><comment><USER51> They will update 90% of the chips 5 years old or newer, which I assume includes Ivy Bridge and later. But the bug affects older chips, too. Important to keep that in mind.

<comment><USER52> The actual quote is:

> Intel has already issued updates for the majority of processor products > introduced within the past five years. By the end of next week, Intel > expects to have issued updates for more than 90 percent of processor > products introduced within the past five years.

The post is silent on what will be done with older chips, it didn't say that they are not going to be updated. It makes sense that Intel prioritizes the newer chips.

<comment><USER53> It makes sense but 5-10 year old laptops aren't uncommon nowadays.

Had this occurred 20 years ago nobody would have cared because computers would get replaced super fast anyway. Nowadays, even a geeky household can have 5+ year old CPUs lying around and still used.

<comment><USER54> Anecdotally: I game, compile, transcode, and do any other number of CPU- intensive tasks on my machine. My household is definitely "geeky".

I still run an i7 2600k, which is a Sandy Bridge CPU introduced 7 years ago.

I don't (didn't? may not?) have any pressing reason to upgrade, although I was considering it. Funnily enough, even before now I was considering the AMD Zen architecture, and although I'm still undecided I'm being pushed further and further towards AMD through ethical considerations alone.

<comment><USER55> You won't need a microcode update. The microcode update is only needed for Broadwell and newer (for those, retpolines don't work). Also, hello, fellow 2600k owner :D

</comment></comment></comment></comment></comment><comment><USER56> > including personal computers and servers — that render those systems immune > from both exploits (referred to as "Spectre" and "Meltdown") reported by > Google Project Zero.

I thought you couldn't patch out Spectre

<comment><USER36> You can't in conventional software, this is almost certainly a microcode update. It remaining to see at what cost. This change may well just totally disable features that normally are heavily used in pipelining.

</comment></comment><comment><USER57> It's interesting to see what companies choose to work on instead of security. With Intel it's speed, with Apple it's the animated poop icon.

<comment><USER58> Like Intel didn't spend tons of money over the past 20 years on TV commercials playing a unique set of musical tones to convince you to buy a computer with a flawed chip inside.

<comment><USER59> > inside

</comment></comment></comment><comment><USER60> They don't explicitly say. Is part of this a microcode update?

<comment><USER32> If it is (very likely, because only Intel can issue them thus far), they probably figured out how to turn off the branch predictor.

The performance drop will still be there, but better than the "recompile everything to not use indirect jump and call instructions"[1][2], at any rate.

[1] [https://news.ycombinator.com/item?id=16066968](https://news.ycombinator.com/item?id=16066968)

[2] [https://news.ycombinator.com/item?id=16070050](https://news.ycombinator.com/item?id=16070050)

<comment><USER61> If it's a timing attack, they probably don't need to fully turn it off, but turn it off and on randomly every now and then..

<comment><USER62> That wont do it. The true data will still bias the results.

<comment><USER63> Even this PoC was limited to 2000 bytes a second; even a little noise may well render the attack largely theoretical - or at least make the attack so slow as to make it feasible to use other (expensive) mitigations only very rarely.

But yeah, it's not a brilliant solution. But it would help.

<comment><USER62> Even one byte per minute would be enough to cause serious issues. Imagine if some add served up by a torrent site could read information from another tab rendered by the same process?

<comment><USER63> Not good, but still thousands of times better. And don't forget that you still need to guess where to read from, which better be a very very accurate guess at that rate. Making such an accurate guess is difficult when your runtime is as complex as a browsers, and so even without that extra timing noise no PoC exists (AFAIK?) attacking browsers.

But you know... you're not wrong ;-). I'm just not particularly worried about the likelihood of this attack hitting anything I care about anytime very soon.

<comment><USER62> Google does have a PoC for spectre that attacks Chrome via Javascript. That said, I am not super worried either. Its not like all my personal data isn't already out there for all to see (Thanks Equifax).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER64> Has anyone written anything on how process affinity would help with Spectre/Meltdown?

<comment><USER65> The attacks require co-scheduling with the address space (thread/process) to be attacked. So, exclusive process affinity is a working mitigation against these attacks and other per-core micro-architectural attacks.

<comment><USER66> Using a thread to keep mispredicting as desired is just one (though faster) possibiliy. It can be done in single threaded mode as well.

Also doing that on purpose would again worsen cache performance.

</comment></comment></comment><comment><USER67> I just did a "sudo yum update" on CentOs and I see a slew of firmware/microcode packages. Are these security patches ready to go already?

</comment><comment><USER68> I noticed a microcode update which was expected, but there's also been firmware updates for Intel WiFi cards - which I wasn't expecting.

I don't suppose anyone can comment on why the WiFi update?

<comment><USER69> AMD CPU microcode is contained in the linux-firmware package/repository ( [https://git.kernel.org/pub/scm/linux/kernel/git/firmware/lin...](https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux- firmware.git/tree/amd-ucode) ) which also contains Intel WiFi card firmware.

So if your Linux distribution provides a new release of linux-firmware package, you may get new versions of WiFi firmware packages as well with no actual changes to those. This seems to be the case with at least RHEL: [https://access.redhat.com/errata/RHSA-2018:0015](https://access.redhat.com/errata/RHSA-2018:0015)

The RHEL linux-firmware update contains an AMD microcode update that involves Spectre mitigations. AMD microcode is mentioned at [https://access.redhat.com/articles/3311301](https://access.redhat.com/articles/3311301) and the linux-firmware package changelog says:

      * Wed Dec 27 2017 Rafael Aquini <firstname.lastname@example.com> - 20170606-57.gitc990aae
      - Add amd-ucode for fam17h

(Intel CPU microcode is part of microcode_ctl package, updated separately)

<comment><USER68> Thank you very much for the response; I didn't realize RHEL would every version-bump a package without anything actually changing!

For the sake of my own sanity, i tested the iwlwifi-1000 firmware package iwl1000-firmware-22.214.171.124-57 and "-58" and can see no changes when hashing the files.

</comment></comment></comment><comment><USER70> I wonder if the terminology of blocking specific exploits vs fixing vulnerabilities is intentional.

Even the "facts" page consistently uses "these exploits" and says stuff like: "These exploits, when used for malicious purposes, have the potential to improperly gather sensitive data. Intel believes these exploits do not have the potential to corrupt, modify or delete data."

Is this lawyering so they can say they never claimed to have addressed the vulnerabilities?

</comment><comment><USER47> It's easy to fix Meltdown with a microcode update. Do we know if Intel (or AMD or ARM for that matter) are also attempting to fix Spectre? Spectre seems much more difficult.

</comment><comment><USER51> I wonder what Linus thinks about all of this. Does he still believe this is no different than a random UI bug, as he used to say not too long ago about security bugs?

<comment><USER71> He's pretty pissed, actually. [https://lkml.org/lkml/2018/1/3/797](https://lkml.org/lkml/2018/1/3/797)

<comment><USER72> I think that only scratches the surface of pissed for Linus. He barely even swore.

</comment></comment></comment><comment><USER73> Can we avoid Windows 10 update? Frankly, I don't want to have my gaming & machine learning rigs slowed down (whatever you may say about negligible impact) and would like to opt out of this update on some of my systems. Is it possible? Or am I forced to just waste at worst 30% of my CPU cycles on mitigating this issue, even if my computer never gets into browser for more than a few seconds on very specific _trusted_ domains?

<comment><USER74> These patches should only affect syscall entry/exit performance. So if you're not doing things that do enormous amounts of syscalls, you should be more at the 3% end of the scale. The 30% number comes from doing things like calculating the file sizes of a directory with a lot of very small files, where the performance overhead of a single syscall matters. In most performance sensitive applications like games, you probably won't see any syscalls in a hot loop since that'd be too slow anyway. Even if you're doing heavy IO, then that is most likely also done in batch and blocked on disk IO speed, not on syscall overhead.

<comment><USER73> There are reports on Reddit that NVidia's driver is affected due to heavier usage of patched functionality which would mess with both gaming and Deep Learning. In both, 5-10% drop is pretty unacceptable as that is often basically performance offset to lower-tier card (e.g. non-Ti vs Ti card).

</comment></comment></comment><comment><USER75> I wonder if an optional microcode update disabling usermode access to cache flush and rdtsc instructions would make it impossible to do the low level timings required to make the measurements

(of course it would break other stuff, but maybe being able to enable these process by process might be appropriate)

<comment><USER75> thinking about it more a patch that masks out (or sets) the N LSBs of the value returned to user space accesses to rdtsc might do the trick, it wouldn't break anything, and time would still be monotonic

The recent CCC paper on how to write your own microcode (for AMD CPUs) means that AMD owners can actually experiment with a fix of this on their own CPUs ... now if only Intel would let us hack the microcode on our own CPUs too ....

<comment><USER74> Just masking the lower bits is not enough: you can easily reconstruct a high- precision timer from that by observing the clock edges (waiting until rtdsc increases): wait for clock edge, do your experiment, increase counter until next clode edge in busy loop. the counter now correlates strongly with the amount of time taken for the experiment.

Also, while cache flushes are the easiest way to trigger this, I am not convinced that there aren't other ways to do it. For example, you could attempt to clear the cache by spamming it with new data to cache, or you could try to use one of the other sidechannels (I've seen ALU ports being mentioned as one alternative: instead of accessing cache lines, you do some heavy math operations that will cause the ALU ports of the cpu to be used and then you observe how long ALU operations take in userspace)

</comment></comment></comment><comment> oh-kumudo Any idea how would they fix Spectre with this update? Or tries to make it harder to exploit?

</comment><comment><USER76> So this was reported half a year ago and only now after publication Intel releases updates?

<comment><USER25> The Embargo was until January 4th.

</comment></comment><comment><USER77> With these fixes and the performance losses, does that stack?

IE if you have a Server on amazon running a newer kernel with the patches but then that underlying hardware is also running the newer kernel?

</comment><comment><USER78> noob question here. Why isn't normal data readable? Why is only predicted branch executions readable?

<comment><USER79> In at least one of the variants, I believe that the branch predictor is primed in the attacker program with some value, say 0x00ABCDEF by jumping there consistently in certain circumstances.

Then the CPU switches to running another program that is allowed to access different memory. The CPU encounters a branch and predicts that it will land at 0x00ABCDEF and begins running attacker code briefly. Since it's working on the victim program, the code can access the victim program's data. After several cycles the CPU realizes it made the wrong prediction and NOPs out all of those instructions. However, the malicious code stores its results by shuffling things on the cache, which aren't rolled back because the CPU doesn't consider that to be nominal.

Therefore, the exploit can access memory from other programs. This is my limited understanding of Spectre. Reading the white paper, it must be much more complicated.

Apparently the CPU would normally stop accesses even speculatively when running from the malicious program (except for Meltdown, where it doesn't even stop that).

<comment><USER66> No, Spectre can only read its own memory, which makes it boring for programs, but interesting for stuff running interpreted code because it can suddenly peek outside, e.g. javascript.

Meltdown goes one step further in that it can read kernel memory (but not memory of other processes either, unless it was explicitly mapped in).

<comment><USER80> Spectre allows one process to extract the memory of another process (assuming certain conditions are met). I would not call that boring.

<comment><USER66> Damn, that is indeed possible. And I thought I understood these conceptually, now I have to read the papers again.

<comment><USER81> As i understand it, you can extract memory from another process by controlling input data to that process. First sending data to train an exploitable branch prediction point for success and then sending data which will use a misprediction to extract some data.

The paper sited has an example C program that works within a single process, but sets the stage to show how it could be achieved across process boundaries.

C program source: [https://pastebin.com/9GSrXhi3](https://pastebin.com/9GSrXhi3)

<comment><USER66> This branch prediction inside a "gadget" needs to be mapped into the address spaces of both attacker and victim (i.e. shared lib). But even if the attacker can get this code to run on both sides and examine the dependent timings to find out underlying values, the victim code can't be tricked to sequentially read-by-speculation all its internal data.

Does the instruction cache get poisoned as well on a mispredict and carried over?

</comment></comment></comment></comment></comment></comment></comment><comment><USER82> Oh nice. I know the average user is going to go right ahead and update their CPU microcode.

<comment><USER83> Yes, they will. Microcode is hot-loaded. There is no way to permanently update a CPU's microcode; it is uploaded to the CPU on each OS boot. They come packaged in the appropriate Windows update or macOS update, or for example on Ubuntu you'll get them the next time you upgrade with apt. So to answer your question, the next time the user updates their operating system, provided the OS manufacturer has included the new firmware, the user will automatically get the new microcode which will get patched onto the CPU on each boot of that OS from then onwards.

<comment><USER82> Do you know why it can't be so easy with BIOS or Management Engine?

</comment></comment></comment><comment><USER84> So is this the first year that computers will actually get slower vs. the year before?

<comment><USER50> Yeah, also it's not about new computers. It's a huge portion of all existing computers. Even my 10 years old Core 2 Duo laptop will get slower after I update it (I'm not too happy about it).

</comment></comment><comment><USER85> Funny that nowhere to be found: the actual link to the fix and how to patch it.

<comment><USER86> Indeed, the latest linux microcode package has yet to be updated: [https://downloadcenter.intel.com/download/27337/Linux- Proces...](https://downloadcenter.intel.com/download/27337/Linux-Processor- Microcode-Data-File?product=873) . Are they shipping specific CPU fixes to vendors first before updating the full package?</comment></comment>


Still Friends? The trouble with old sitcoms - <AUTHOR> http://www.bbc.com/news/entertainment-arts-42690207 <comment><AUTHOR> You could also view it from a different perspective: it's interesting to see what people get offended by these days.

Of course, a lot of it is tied to the culture you live in. For instance, I do not feel like the same shift in what's deemed acceptable today has happened in Europe the same way it has in the U.S. since the 1990s.</comment>


Trends in Income From 1975 to 2018 - <AUTHOR> https://www.rand.org/pubs/working_papers/WRA516-1.html <comment><USER3> 1/3 of that is health insurance.

Health insurance is a weird one because even though people think they want it when "daddy" is paying for it, if they got to trade health insurance for something that cost about as much such as

* two months of vacation a year * free housing for life, etc.

many would pick the later. Michael Foucault, in his "birth of the clinic" points out that rich people who could afford (say) Heart Bypass Surgery couldn't get it unless somehow other people who couldn't afford the surgery could get it, because otherwise the surgery wouldn't be done often enough to not be a death sentence.

<comment><USER4> But this also means that the average person now has access to heart bypass surgery, which is still (I think) the most powerful "life extension" technology ever developed (statistically speaking).

That means the _actual_ reduction in income is less than it appears, as a lot of it is just going to far superior but more costly health care. That being said, US health care costs are higher than many other developed nations for a variety of reasons and this could be improved.

What's the other 2/3 then?

I am going to take a wild guess: outsourcing / labor arbitrage, the collapse of unions, and automation reducing labor demand. I would prefer hard evidence though to wild but reasonable guesses.

<comment><USER3> "Superior" is not always clear.

In the case of heart-bypass the economics have always been ambiguous and are more so now when you put it in competition with angioplasty, statins, aggressive treatment of hypertension and type II diabetes, etc.

I remember Issac Asimov writing about his circa-1970 thyroidectomy and circa-1980 heart bypass and being amazed at how few articles he'd have to write to pay for these services. (I found out 30 years later that he got AIDS from that heart bypass operation and that was why he wrote all of those sequels that he said he wasn't going to write.)

Note though that the surgeon's job is checklistable (Asimov wouldn't have lasted 10 hours if either surgeon had displayed much creativity or had to wrestle with contractions while working) whereas Asimov's monthly essays involved reading maybe ten scientific papers, resolving contradictions, probably rewriting a few times just to get the organization write, never mind catch all of the errors you'll find in a piece like I am writing now where I have neither the time nor the tools set up to do that work.

Although the surgeon seems to be "restoring order" to the body, Asimov's mind was directly engaged in removing entropy -- taking a wide area of scientific information and composing it to create meaning.

My wife works (part time) as an aide for an extraordinarily nice dementia patient and is own the other side of the "cost disease" problem from myself, a computer programmer.

Even distant relatives of the man she works for might think is he high functioning if they saw him most of the time, but left on his own he might "get stuck". Basically my wife and other aides help him get through his daily checklist. This guy is fun to hang out with, but other people get paid the same to do the "same" thing for a person who might not recognize them, think they are a home invader, and try to strangle them. (e.g. don't wear a necklace if you do this job)

Me? Asimov inspired me to study physics and I became a computer programmer and if something is checklistable either my team decides that I'm going to spend my time programming the computer to do it, or it decides that it is going to spend somebody else's time doing the work. So I spend a lot of time seemingly "in a daze" or "going in circles" because I am often in a place where I haven't yet resolved the contradictions in the situation, don't really understand the problem, etc. I do figure it out and then spend some fraction (less than 50%) of my time looking "engaged" in the way that my wife looks "engaged" when she does her work.

The work of all four people are hard to compare because of those differences. Unlike the other three, I'm in the one sector of the economy that seems to be improving in productivity, but even that seems to be questionable.

The spectre of marxism (not leninism, stalnism, maoism, trotskyism ...) is that behind it all our life lacks a dignity of work that makes all we toil for meaningless. That is, the root cause of the heart problem might be in your "other" heart as opposed to the physical organ -- the emotional stress caused by not being engaged where decisions are made about where we spend our time.

We could say that we're getting "half our share" of the produced by our labor, but we might be happier (get more utility) for less currency if we had more choice about what we buy and sell as individuals.

</comment></comment></comment><comment><USER5> > "Capital income amounts for two percent of income for the bottom 99 percent > of households." (page 7 of the pdf)

so 98% of capital income accrues to the 1% who have no monopoly on how best to allocate capital--see irrational capital flight into tech stocks and real estate, and a lack of real innovation, rather than iteration, in the past 50 years.

blind faith in market efficiencies in a profoundly unfair and corrupt marketplace only worsens our economy overall. this must be kept in mind in any discussion of the captured regulatory environment and tax policy.

we're losing economic dynamism to the whims of the rich, and to the detriment of all.

<comment><USER6> Free markets tend to become positive feedback loops for those with skills or access to capital. Calling this feedback loop "unfair and corrupt" really does not necessarily follow from this fact alone. At the very least, it is not the best choice of words.

<comment><USER7> One of my favorite professors in college was my economics professor, who forbade us from using the word "fair" during lecture seminars. Even referred to it as the "F-word". The idea was that "fairness" is subjective and ill- defined.

<comment><USER8> Could be relevant: [https://evonomics.com/more-evidence-that-learning- economics-...](https://evonomics.com/more-evidence-that-learning-economics- makes-you-selfish/)

<comment><USER7> "In a study of over 28,000 students in Switzerland, 62% of economics students gave money at least once to help students in need, compared with 69% of non- economics students. These differences were already present before the students took a single economics course: students with lower giving rates were drawn to economics. As freshmen, before their first lectures, 71% of the students who chose economics contributed, compared with 75% of non-economists."

That's...not a significant finding by any means.

Secondly, I would take these psychological studies with truckloads of salt. In what is possibly the most damning indictment of the social sciences: they have among the lowest replication rate of any of the sciences, and even after retraction (due to replication failure), the vast majority of positive citations continue after retraction, specifically in the social sciences: [https://fantasticanachronism.com/2020/09/11/whats-wrong- with...](https://fantasticanachronism.com/2020/09/11/whats-wrong-with-social- science-and-how-to-fix-it/)

</comment></comment></comment></comment></comment><comment><USER9> People are much more mobile today than in the 60s. So while the top 5th may be improving, I would guess that much of that is in major cities where the cost of housing and education far exceeded income growth. It's not just growth in income it's growth in income relative to your local cost of living.

<comment><USER10> A quick search located a study on mobility from 1940 to 2000, finding that mobility is on the decline. Do you have evidence that mobility has been increasing since then?

> We find that mobility increased from 1950 to 1980 but has declined sharply > since 1980.

[http://jhr.uwpress.org/content/43/1/139.refs](http://jhr.uwpress.org/content/43/1/139.refs)

<comment><USER11> They are definitely more mobile. One example(adjusted for inflation and family size):

"Eighty-four percent of Americans have higher family incomes than their parents had at the same age, and across all levels of the income distribution, this generation is doing better than the one that came before it."

[1] [https://www.pewtrusts.org/~/media/legacy/uploadedfiles/pcs_a...](https://www.pewtrusts.org/~/media/legacy/uploadedfiles/pcs_assets/2012/pursuingamericandreampdf.pdf)

<comment><USER12> I think a flaw here is adjusting for overall inflation and not measuring something like "disposable income" from one generation to the next. Healthcare, housing, and education have all increased faster than inflation and are non-optional expenses[1].

[1] [https://slatestarcodex.com/2017/02/09/considerations-on- cost...](https://slatestarcodex.com/2017/02/09/considerations-on-cost- disease/)

<comment><USER11> In terms of percentage of income spent, the amount spent on food and clothing has gone way down, housing has stayed the same more or less. Education and healthcare both have very very heavy government involvement in the US so there's your common factor.

</comment></comment></comment></comment></comment><comment><USER13> We all agree that people in general act in their economic self interest. We also agree that people prefer to donate money to specific causes they support rather than pay extra in taxes - I think this is a fair statement. Redistribution as a concept has widespread support, but the mechanism to do so has wide disagreement, so each person tends to prefer selecting their own mechanism of redistribution through donations to non-profits rather than pay extra to the government.

Therefore, any solution proposed through the (long, compromised, imperfect, special-interest ridden, full-of-holes) government legislative process will be relatively easy to bypass by motivated rich people with the means to pay professionals to structure their assets accordingly, as has been the case for centuries. And the rich won't necessarily do it with sinister intent - <USER2> may still give a huge amount of money to causes they support, but simply disagree with giving it to the government as a blank check. Or maybe the rich are just greedy and self-interested. But either way, the government will be unable to take this money.

I don't think any redistribution mechanism implemented by the government can attack the rich long-term. They may get snagged initially, then quickly reorganize their assets to avoid such issues. The true people who get snagged are the middle class, who actually do pay taxes (while the poor often have negative-taxes and receive the redistribution), but do not have the means to restructure themselves to avoid the taxes.

So we are left with 2 options - the first are broad, universal tax increases (which no one advocated for in the US election except Bernie Sanders) rather than (inevitably-failing) soak-the-rich taxes, and the second being to restructure society to provide the same or more services to people using less taxes.

I prefer the latter - we should be adding efficiency to the state, while giving people more choice on how to help each other. I don't want to delve into the details in this comment. But my overall point is that taxes targeting the rich and super-rich will fail, as they always have and always will, so we need some other solution if we desire to reduce inequality.

<comment><USER14> > I prefer the latter - we should be adding efficiency to the state, while > giving people more choice on how to help each other.

Agreed. The state has become much too inefficient. Sadly, much of that is the state's own doing by continuously adding layers of bureaucracy and complexity. Many of the problems could be solved with technology at scale. We could use software to measure government like we measure every other business process.

We can and must enforce checks and balances.

<comment><USER12> > Agreed. The state has become much too inefficient.

This is frequently stated as fact, but no evidence is provided.

> We could use software to measure government like we measure every other > business process.

Perhaps we could get SoftBank to measure government efficiency. They seem to be trusted with vast sums of money so they must be particularly good at evaluating business efficiency.

<comment><USER7> I mean, when a corporation is unable to collect enough money to continue operating, it goes out of business. When a government program is unable to collect enough money to continue operating, we increase its budget.

SoftBank is a good example; as long as they continue to lose money, they lose the confidence of shareholders. If their track record continues, they risk going the way of other big banks (Bear Stearns, Lehman Brothers).

Ask yourself how many companies from the 20th century are now defunct vs government programs. Efficiency is a byproduct of change & evolution. Inefficiency is a byproduct of institutional sclerosis.

<comment><USER15> > when a corporation is unable to collect enough money to continue operating, > it goes out of business

This is different from saying an organization is inefficient. From my experience in the corporate world, some businesses can be VERY inefficient compared to other businesses and still be getting enough done to move the ball forward to the satisfaction of stakeholders. As much as people complain about bureaucratic government organizations being too inefficient, I'm not convinced that they are less efficient than many "successful" large corporations. The difference is that they are essentially like a non-profit and complaints are made without sufficiently measuring the value of their work (especially in comparison to massive for-profit organizations). I'm not saying more nimble organizations cannot produce more per-capita value, but there are disadvantages with size and also sometimes advantages such as economy of scale.

<comment><USER7> It's not different, because businesses that are "VERY inefficient" often end up dying. There's no structural permanence baked into the corporate system that guarantees that a corporation will exist forever. On the other hand, governments and state actors are largely static. The institutions and systems that govern them seldom change. And the larger the polity, the harder it is to build up the political will for democratic institutions to evolve/change. It is very difficult (IMO impossible) for an inefficient government to "go out of business", so to speak.

> There are disadvantages with size and also sometimes advantages such as > economy of scale

This is absolutely correct, but the market system ensures that whichever corporation becomes large enough to deliver on those economies of scale is selected as a function of their ability to deliver (for the most part). Ask yourself what would happen if we democratically granted Sears a legally authorized monopoly to essentially exist in perpetuity like states and state programs exist today. Would they have been able to efficiently continue delivering value as the world changed? Would we have allowed them to die and be replaced? The fact that they were defeated to the point of bankruptcy by Amazon et al is a feature of the system that is notably lacking in state institutions.

In fact, the state institutions that perform the best are the ones that are the smallest/most decentralized: [https://www.reuters.com/article/us-health- coronavirus-podcas...](https://www.reuters.com/article/us-health-coronavirus- podcast-breakingvi/breakingviews-the-exchange-too-small-to-fail-idUSKBN21P3E3)

<comment><USER16> > It is very difficult (IMO impossible) for an inefficient government to "go > out of business".

The Soviet Union will be glad to hear that.

<comment><USER7> As with most data distributions in life, there are notable exceptions/outliers. You can probably count the number of inefficient governments that "went out of business" in the last 50 years on one hand.

You'll need several people to tabulate the set of corporations that have gone bankrupt, defunct, or M&A'd out of existence over the same timespan, in the US alone.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Hasn't the definition of taxable income changed over this period? I wonder how a normalized version would look.

<comment><USER18> Indeed. Also strange not to consider transfer payments and other (non-taxable) government benefits: How else are we supposed to be rebalancing against market-determined income?</comment></comment>


Google and Apple Partner on Covid-19 Exposure Notification API - <AUTHOR> https://www.google.com/covid19/exposurenotifications/ <comment><USER2> [https://blog.google/documents/73/Exposure_Notification_- _FAQ...](https://blog.google/documents/73/Exposure_Notification_- _FAQ_v1.1.pdf)

 _" a. Can I turn it off?

Yes. The choice to use this technology rests with the user, and he or she can turn it off at any time by uninstalling the contact tracing application or turning off exposure notification in Settings."_

Does this mean the device owner has to turn it off? Or is it opt-in? Also, can random apps turn this on again after it has been turned off? And how can the user not get this update at all?

</comment><comment><USER3> > a joint effort to enable the use of Bluetooth technology

I imagine you're walking down the street, your phone starts to vibrate like crazy and you think "is it an icbm" no this person across from me is contagious.</comment>