Inferring and hijacking VPN-tunneled TCP connections - <AUTHOR> https://seclists.org/oss-sec/2019/q4/122 <comment><USER2> Disclaimer: I work at AWS, on Amazon Linux and our VPN products; those aren't impacted by this issue.

The attack that the researchers describe is very impressive, and using traffic analysis and error messages to find the details of an open TCP connection is extremely clever.

Unfortunately a similar approach can be used even more practically to target DNS on the VPN: [https://www.openwall.com/lists/oss- security/2019/12/05/3](https://www.openwall.com/lists/oss- security/2019/12/05/3)

Encrypted DNS queries and replies can be profiled by traffic analysis, and the reply "paused", making it easier to ensure that a DNS spoofing attempt will succeed. This is a good reminder that cryptographic protections are best done end to end; DNSSEC does not help with this attack, because it does not protect traffic between the stub resolver and the resolver. It's also a good reminder that traffic analysis is still the most effective threat against network encryption.

<comment><USER3> An actual high-quality DNSSEC implementation would protect against this. Using an untrusted stub resolver is a mistake; end-user OSes should verify DNSSEC responses directly.

<comment><USER4> What end-user OS does this?

<comment><USER3> Fedora has a prototype:

[https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Res...](https://fedoraproject.org/wiki/Changes/Default_Local_DNS_Resolver)

I ran it for a while. It was problematic from a UI perspective (nothing to do with DNSSEC per se — it was just immature), and it wasn't fantastic with captive portals.

Also, it noticed that I visited an internet connection where the ISP was hijacking google.com. So it worked!

<comment><USER4> So by "actual high quality DNSSEC implementation", you mean one that exists only in prototype form for desktop Linux users.

<comment><USER3> I'm saying this should be done, not that it is done. The AD bit is garbage.

<comment><USER4> DoH _actually_ addresses this attack, directly, regardless of whether the affected name is in a signed zone (most queried names aren't!), and it actually works on mainstream operating systems. Why would anyone waste even a moment with DNSSEC?

<comment><USER5> DoH moves the attack point to a different place - either between the recursive resolver and the authoritative servers, or (with DNSSEC) to the recursive resolver host itself. This is certainly a step up for security against malicious neighbors, but doesn't address malicious infrastructure.

<comment><USER4> DoH moves the attack we're talking about to a place where the attack can't be carried out.

<comment><USER5> Modifying DNS results can certainly be carried out ahead of or at the recursive resolver.

DoH without DNSSEC means the results are modifiable by authoritative servers, recursive resolver, and any of the links between them. DNSSEC with a local recursive resolver prevents this. (Of course if you want privacy from your ISP, you then have to tunnel the recursive lookups through VPN(s)).

If DoH is the best one can do, then do DoH. But it's wrong to shout down DNSSEC until an alternative method for _authentication_ comes along.

<comment><USER4> The same argument applies to DNSSEC: if the DNSSEC authority server is compromised, it can fake records, the same way your DNS recursor can fake records if it's compromised. If you do DoH across the path, at each step, DNSSEC does literally nothing, rather than practically nothing.

Regardless: for the attack that we're discussing _on this thread_ , DNSSEC is not relevant; or rather, this particular attack is a good illustration of how irrelevant DNSSEC is to realistic attack scenarios.

<comment><USER5> I wasn't aware that DoH was currently being touted for authoritative servers as well. So, comparing the best possible adoptions of each protocol to each other on their unique strengths:

1\. DNSSEC (with clients doing full recursive lookups, ofc) is able to have zones signed _off of_ the authoritative server, meaning a compromise of the authoritative server isn't an attack point.

2\. With the client performing full recursive lookups themselves, DoH provides partial query privacy.

3\. With the client delegating to a trusted third party (eg Mozilla), DoH provides full query privacy modulo that trusted third party (the TTP can break both privacy and integrity)

Comparing (2) to (1) I do see your argument much better now.

However, DNSSEC still has the property of E2E validation that can be used for more than what current software does. One could write a resolver that shipped records _laterally_ between peers to extend its privacy properties beyond either DoH setup. Adopting this wouldn't require all the authoritative servers to get on board, just a community of end-users. This is where my argument is coming from, especially with DoH meaning (3) to most users and the general course of what happens to trusted third parties.

<comment><USER4> In reality, DNSSEC signers are online, and need to be, because the way you keep DNSSEC from revealing the full contents of your zone is to dynamically inject signed "whitelies" responses to queries. That, and then just the dramatic extra ops burden of keeping offline signing keys, means that the realistic real-world deployment of DNSSEC is, like that of TLS, based on online keys.

DNSSEC _does not have E2E validation_. DNSSEC is validated between the recursive cache server and the authority server. The protocol explicitly delegates validation away from endpoints with the AD bit. You can run a full resolver on your laptop the same way you can run a full-feed defaultless BGP4 peer on your laptop; it'll "work fine", but that's simply not how it's deployed in reality.

Another dramatic difference between DNSSEC and DoH is that DoH works whether or not zones sign (a tiny portion of the zones people actually make queries on are actually signed). Nobody needs "permission" to protect their queries with DoH, but everyone has to cooperate to make DNSSEC work.

Since the value DNSSEC provides is made more marginal with each passing quarter --- because of MTA-STS, because of multi-perspective CA DNS validation, because of DoH, because of LetsEncrypt making X.509 certificates free, because of certificate transparency --- the rationale for its continued deployment has become extremely thin. It's 1990s cryptography --- queries aren't even encrypted! --- that people are advocating we forklift into the Internet to solve... it's hard to see what problem?

A better plan would be to take DNSSEC back to the drawing board and come up with a modern alternative to it. DNSSEC itself is a failed protocol.

<comment><USER5> > _DNSSEC does not have E2E validation_

My comment compared the strengths of each protocol with the fairest interpretation of each. Your judgement here does not do this - it's obvious that a stub resolver relying on a third party to do verification is braindead, and clients doing a full recursive lookup is the correct answer. How clients are currently setup has little bearing on discussion of a protocol's properties.

> _Nobody needs "permission" to protect their queries with DoH_

This is also false if you compare the protocols on equal footing - if the authoritative servers are not speaking DoH/DoT, then queries are only partially protected. In order to do " _DoH across the path_ " as you said above, cooperation is needed.

> _A better plan would be to take DNSSEC back to the drawing board and come up > with a modern alternative to it_

Sure, but this becomes harder when things like DoH are touted as being a sufficient replacement...

<comment><USER4> It is not at all obvious that stub resolvers are "braindead" and the "correct answer" is full recursive lookups on the desktop. One way you know this is that no mainstream operating system works this way; another way you know it is that the DNSSEC designers explicitly took stub resolvers into account; yet another is that full recursive lookups eliminates caching, which the DNS depends thoroughly on.

I'm not interested in a debate about a fictitious version of DNS that you make up as the discussion progresses. I think we can probably just wrap up here.

<comment><USER5> You've written off the whole protocol because of 1990's cryptography. I think it's reasonable to just ignore the specific parts that don't require cooperation to change.

I would be interested in any stats that the DNS system actually "relies" on having clients share caches. Firing out UDP packets is a heck of a lot easier than a TCP/TLS session, and modern websites take the latter for granted for every single user.

If clients sharing a cache is actually important, that's actually a negative point for DoH/DoT as increased resource utilization means that major authoritative servers will be tempted to form a clique with major recursive resolvers, rather than everyone being able to query the zones directly.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> "This attack did not work against any Linux distribution we tested until the release of Ubuntu 19.10, and we noticed that the rp_filter settings were set to "loose" mode. We see that the default settings in sysctl.d/50-default.conf in the systemd repository were changed from "strict" to "loose" mode on November 28, 2018, so distributions using a version of systemd without modified configurations after this date are now vulnerable. Most Linux distributions we tested which use other init systems leave the value as 0, the default for the Linux kernel."

Anybody happen to know _why_ systemd decided this was something they should be messing with?

<comment><USER7> `git blame` is your friend

sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2

This switches the RFC3704 Reverse Path filtering from Strict mode to Loose mode. The Strict mode breaks some pretty common and reasonable use cases, such as keeping connections via one default route alive after another one appears (e.g. plugging an Ethernet cable when connected via Wi-Fi).

The strict filter also makes it impossible for NetworkManager to do connectivity check on a newly arriving default route (it starts with a higher metric and is bumped lower if there's connectivity).

Kernel's default is 0 (no filter), but a Loose filter is good enough. The few use cases where a Strict mode could make sense can easily override this.

The distributions that don't care about the client use cases and prefer a strict filter could just ship a custom configuration in /usr/lib/sysctl.d/ to override this.

[https://github.com/systemd/systemd/commit/230450d4e4f1f5fc9f...](https://github.com/systemd/systemd/commit/230450d4e4f1f5fc9fa4295ed9185eea5b6ea16e)

There was NEWS entry for this here: [https://github.com/systemd/systemd/blob/230450d4e4f1f5fc9fa4...](https://github.com/systemd/systemd/blob/230450d4e4f1f5fc9fa4295ed9185eea5b6ea16e/NEWS#L73-L80)

as to _why_ they would make the change? Systemd trieds to be project for distros to have a sane base system. Introducing this change was probably something they deemed as being useful in a base system. Especially in the context of laptops and mobile devices this default seems sane.

<comment><USER8> > Systemd trieds to be project for distros to have a sane base system

Systemd tries to force a monolithic operating system to behave like a microkernel, and uses propaganda and manipulation to enforce whatever preference its designers have for how all systems should run onto all the Linux distributions it can. You can call that 'sane', I'll call it totalitarian empire-building.

</comment></comment></comment><comment><USER9> Sorry if I seem stupid but what are the security implications ?

As far as I understood the attacker can :

\- Detect an active VPN connection (and maybe close it/monitor it)

\- Attempt to inject packets : for this part I am skeptical of the usefulness. The connection between the server and the client are normally encrypted, meaning that the injected packets will be dropped or can be used to forcefully close the connection making it a DoS attack.

<comment><USER10> > The connection between the server and the client are normally encrypted

Keyword: Normally. What about DNS? DNS without DNSSEC via an untrusted AP cannot be trusted, that's for certain. Hence, you recommend your user to activate VPN first to avoid such attacks because now it's encrypted. Suddenly, that might change and your trusted-page.internal resolves to a different hostname. This /should/ be preventable via HSTS and certs for example with HTTP, but those are assumptions again. Or what about RDP? It's not encrypted, so you hide it in a VPN - mostly due to the cleartext password. But suddenly there's a vector that might be able to inject data into an RDP stream inside a VPN connection.

> \- Detect an active VPN connection (and maybe close it/monitor it)

Not just that. They can detect TCP connections inside the VPN connection. Hence, you can start tracking if users of an access point accept anti-gov.com even if they go through a VPN. It might be detectable on the client side and it should be possible to mitigate this via configuration, but that's still plenty scary.

<comment><USER11> Or in short, the authentication premise of VPN-routed traffic can be violated by an attacker without knowing the authentication keys, due to some misalignment of (in some cases, valid) routing behavior and VPN integration.

</comment></comment></comment><comment><USER12> > This vulnerability works against OpenVPN, WireGuard, and IKEv2/IPSec

> It should be noted, however, that the VPN technology used does not seem to > matter

I was wondering which VPNs, but after reading it seems that it doesn't matter the VPN but is instead a kernel bug? I wonder if this also affects a host that has two network interfaces, with no VPN involved whatsoever?

Also, it's good to see Jason Donenfeld involved, which many will likely recognize as the author of Wireguard.

<comment><USER13> Donenfeld has been great and makes a wonderful product. We've been using WireGuard as our primary VPN solution for a long time now and don't anticipate a change anytime soon.

I think this class of attack can best be mitigated at the kernel level, but unfortunately, side-channels exist anywhere that maintains state, and this might be a more general routing problem.

<comment><USER14> We're working around this CVE in WireGuard's wg-quick(8) with a rule something like:

        iptables -t raw -I PREROUTING ! -i wg0 -d 10.182.12.8 -m addrtype ! --src-type LOCAL -j DROP

where wg0 is the WireGuard interface and 10.182.12.8 is the local IP of the interface. This says to drop all packets that are sent to that IP address that aren't coming from the WireGuard interface. And it's done very early in netfilter, in the "raw" table.

I don't like having to use iptables in wg-quick(8), and so Willy Tarreau and I have been discussing a deeper kernel-level fix, which should be posted to netdev@ sometime soon.

<comment><USER12> Won't this break the use case of using Wireguard as a gateway to a private subnet, in the typical many-clients-one-server VPN setup?

For example, suppose I have a private physical subnet 10.12.0.0/24 (perhaps in an AWS VPC).

I want to allow clients to access to these private hosts using a Wireguard VPN, so I set up a VPN with all clients having IPs from the 10.34.0.0/24\. Because I want these clients to have access to the private physical subnet, so each client's config has

        AllowedIPs = 10.34.0.0/24, 10.12.0.0/24

Which adds both subnets to each client's routing table.

I add a new route for the VPC to send all packets destined for 10.34.0.0/24 to the central Wireguard "server", thus the Wireguard server acts as a gateway between the virtual 10.34.0.0 subnet and the physical 10.12.0.0 network.

The packets originating from the 10.12.0.0/24 hosts are not local, but I definitely want to route them onto the virtual 10.34.0.0/24 network.

<comment><USER15> I don't think the filter quoted in parent would stop this. In your example what it would stop is clients in 10.12.0.0/24 from connecting to the IP of the wireguard server itself (but not clients it routes to) on the 10.34.0.0/24 network (but not its IP on the 10.12.0.0/24 subnet).

</comment></comment></comment></comment></comment><comment><USER16> > The access point can then determine the virtual IP of the victim by sending > SYN-ACK packets to the victim device across the entire virtual IP space (the > default for OpenVPN is 10.8.0.0/24).

So, would a bit of address space randomization mitigate step one for ipv6? fd00::/8 is pretty big, right? Even just picking a random IP in a random /64 from that /8 should help? Or am I missing something?

Also interesting comments in the reply on the list regarding "policy based" vpns. I wonder if some subset of that infrastructure could be used by Wireguard without completing it all the way out of its current nice and secure-by-simplicity design?

[https://seclists.org/oss-sec/2019/q4/123](https://seclists.org/oss- sec/2019/q4/123)

> Only route based VPNs are impacted. In comparison, policy based VPNs are not > impacted (On Linux only implementable using XFRM, which is IPsec on Linux > specific) unless the XFRM policy's level is set to "use" instead of > "required" (default)) because any traffic received that matches a policy > (IPsec security policy) and that is not protected is dropped.

</comment><comment><USER17> > I am reporting a vulnerability that exists on most Linux distros, and other > *nix operating systems which allows a network adjacent attacker to determine > if another user is connected to a VPN, the virtual IP address they have been > assigned by the VPN server, and whether or not there is an active connection > to a given website.

I'm not sure that I understand exactly what "network adjacent attacker" means. But I'm guessing that it means an attacker on the same subnet. And that it doesn't involve actually hacking VPN encryption.

But isn't it well understood that sharing LANs with untrusted neighbors is hugely risky? At least, I always segregate critical machines in protected subnets.

Or am I missing something?

Edit: OK, I was missing that this focuses on using VPNs via WiFi APs. And depends on the AP being malicious. So yeah, this is a huge issue, for that use case.

</comment><comment><USER18> Huh, I wonder how the OpenBSD team will regard this one.

I'm unfamiliar with exactly how to tell what's in the base system and what's in ports, but I can see openvpn* entries over at [http://ftp.openbsd.org/pub/OpenBSD/6.6/packages/amd64/](http://ftp.openbsd.org/pub/OpenBSD/6.6/packages/amd64/) \- does that mean there's arguably a hole in the base distro?

In any case, nice work.

Question. Besides randomizing packet lengths (preferably with minimum and maximum tunables (per each packet type) that each site can change, to further add entropy), what else can be done to mitigate against this family of attack?

Asking as someone interested in developing "ubiquitous secure container" type protocols that are application- and use-case-specific but (theoretically) high-stakes.

<comment><USER2> Best practice for preventing traffic analysis is to send encrypted messages of a constant size, at a constant rate. It's better to pad to a max size, than to randomize the packet length. Sending at a constant rate may not always be feasible or cost-effective, but it can still be useful to send data at a constant rate for a minimum block of time.

<comment><USER19> It's just easy to implement constant rate, hence why it's best practice. But adaptive rate might be ok, like, for example, if you only pick from 4 different rates and adapt exactly every second, you only leak 2 bits of information per second. The question then becomes which leaking rate is safe enough in practice?

<comment><USER2> constant max rate tends not to be practical in remote roaming VPNs for cost and contention reasons. It would blast through typical mobile usage rates, for example, or get you throttled on a shared wifi network.

</comment></comment></comment></comment><comment><USER20> I just can't understand how this attack can be implemented in real world, it not only needs having an adjacent network access to the VPN client but most importantly knowing the destination of a currently open TCP connection encrypted by the VPN and then guessing the right sequence numbers. Since most TCP connections are also carrying TLS these days, this attack is pretty useless in the vast majority of real world situations I can think of.

</comment><comment><USER21> > nping --tcp --flags SA --source-ip 192.168.12.1 --dest-ip 10.8.0.8 -- rate 3 > -c 3 -e ap0 --dest-mac 08:00:27:9c:53:12

Why is Linux accepting packets coming from one interface into an IP address belonging to a different interface? It feels like it is "forwarding" the packets internally, but `ip_forward` is turned off.

Is there any case where this behavior is legitimately useful?

<comment><USER22> IP addresses don't "belong" to interfaces in the general case. It's just a hard problem. In fact there are lots of multi-homed use cases where you want to internally route packets across interfaces without an affirmative mapping of what address is supposed to be used where.

For the specific case of point to point VPNs, there's a rule that makes sense. But that's not part of the network stack per se and there's no way to enforce it generically.

<comment><USER11> Do network stacks drop 127.0/8 packets from external interfaces today? Superficially (I'm not an experienced TCP/IP or routing stack developer, although I do work in the kernel) it seems like the same treatment could be used for VPN-registered interface addresses. You just need an API to specify "I'm a VPN interface" when the device is created or the IP assigned, no?

</comment></comment></comment><comment><USER23> It seems for the attacker to find out about active connections to any given website they have to already know the IP of the website and then brute force the virtual ports. Being able to determine what website the target has an active connection to without prior knowledge would probably take even more brute forcing. A small solice.

<comment><USER11> This is a very noisy attack, for sure.

</comment></comment><comment><USER24> Correct me if I am wrong, but...

If I just make sure that incomming packets that are destined for the VPN LAN are dropped, this attack does not work?

 _Of course there are such rules in our firewalls??_

Is everyone walking around without any firewall filtering nowadays? How is this a bug? Maybe I am just stupid. Did I miss something?

<comment><USER25> TCP/IP stack was dropping this by default .. until systemd decided to switch the default [https://news.ycombinator.com/item?id=21713479](https://news.ycombinator.com/item?id=21713479)

<comment><USER26> The default behaviour of the kernel is no rp filtering at all. Older versions of systems enabled strict to filtering, no doubt causing the same sort of complaints from people who like to complain about that sort of thing. Newer versions relaxed this to loose rp filtering for the reasons explained in the commit message.

</comment></comment></comment><comment><USER27> Disseminating vulnerabilities like these to less savvy people should be a critical imparitive for the next century. I imagine a team of animators at a non-profit or foundation that illustrate how these attacks work at different levels of technical backgrounds.

</comment><comment><USER28> I'm having trouble understanding why the randomly sprayed bits from the attacker to the client are even accepted at all at the crypto boundary. Shouldn't it hard-fail (not decrypt) due to an invalid key?

<comment><USER11> The bits aren't VPN-framed packets; the attack isn't VPN specific. They're just sending ordinary TCP setup packets and ordinary TCP stream packets with fudged parameters until they find the right ones by brute force. It's a really noisy attack that uses weaknesses in packet routing to find existing TCP sessions and inject into them.

It's also, like, an escalation from a relatively high privilege level. You need both a passive network observer (compromised router or ISP) and a noisy, active LAN device (to inject IP addresses that a router would filter as bogons). That's not to say this is crazy hard; these are definitely within the reach of a motivated attacker. Routers were the original the-S-in-IoT-is-for- security, and if you've got an IoT type device on the LAN it's probably vulnerable once you've popped the router.

</comment></comment><comment><USER29> Is this mitigated by iptables filter firewall? For example, FORWARD policy DROP and no other rules?

<comment><USER30> Yes, if you are doing firewalling properly. The problm is that most people aren't and are just using their distribution defaults.

</comment></comment><comment><USER31> Someone know if there is some kind of pronouncement by distros implicated?

</comment><comment><USER32> Can we merge these? I posted this 10 hours earlier here: [https://news.ycombinator.com/item?id=21709693](https://news.ycombinator.com/item?id=21709693)

<comment><USER30> There's really nothing useful there that isn't also here.

</comment></comment><comment><USER33> "We discovered a vulnerability in Linux, FreeBSD, OpenBSD, MacOS, iOS, and Android..."

What about NetBSD.

This also appears to be wireless only, i.e., the need for attacker to have control over the AP. Am I reading this wrong.

<comment><USER33> I was reading it wrong. It is not wireless only. Technically, it only requires that the victim is sharing a local network with the attacker.

</comment></comment><comment><USER34> This doesn't seem nearly as bad as 'hijacking' implies.

> The attacker can now inject arbitrary payloads into the ongoing encrypted > connection using the inferred ACK and next sequence number.

First, it's hard to get to this point. Then, you're injecting garbage because you don't know the payload encryption keys. So it's just disruptive, even though yes technically it is 'hijacking'.

Unless I missed something, of course! I found the writeup to be vague on the payload encryption point. It should have explicitly stated the impact one way or the other.

<comment><USER35> For your first point, this isn't hard if you're in the appropriate position (adjacent or upstream), as the post details. There are already tools available that can do all of this, example invocations are also there.

For your other point, they don't need to know the keys (unless the traffic travelling /over/ the VPN is /also/ encrypted). That's the whole point. This is about being able to trick the machine into accepting traffic for a connection, from an interface that the connection's traffic isn't travelling over. If it's plaintext within the VPN, this sidesteps the VPN interface and you can indeed inject your own malicious plaintext traffic into that connection.

<comment><USER34> 1\. Yes, you have to already be in position. That's limited to specific actors. Once that is achieved, you have to probe for specific IP addresses the victim might be connected to. IOW a list you are targetting. Then the port probing and seqno guessing.

These facts reduce the impact because it's not just "be a guy on the internet", eg like if there were an open database of PII sitting there for the taking, only needing discovery to find it. In no way am I claiming the attack isn't feasible. It's definitely a real risk, beyond the theoretical.

2\. Thanks, got it. That makes more sense.

I think I actually _like_ this vuln. It reinforces the need for defense in depth. It reduces a takeover to an annoyance (could be critical for some apps, yes) assuming you use TLS at the app layer.

<comment><USER35> > That's limited to specific actors.

1) Anyone who can compromise the residential gateway in your home

2) Anyone & anything connected to the same home network as you (incl. any IOT devices; and no, they don't need Internet access)

3) Anyone who can compromise the residential gateway in whatever coffee shop you happen to be in

4) Anyone & anything connected to the same coffee shop network as you

5) ...

... and, like I said, easily scriptable, with the tools already available to carry it out.

It's not a doomsday scenario, but it is pretty bad. The one saving grace is that most apps these days use some kind of application-level authentication and/or encryption, e.g. TLS.</comment></comment></comment></comment>


Obama orders review of US police use of military hardware - <AUTHOR> http://www.reuters.com/article/2014/08/23/us-usa-missouri-shooting-militarization-idUSKBN0GN0O920140823 <comment><USER2> I can only hope something good comes of this and it's not just "We reviewed it and decided it's fine."

I really have no problem with state police having _access_ to some of this kind of equipment. It's probably good for equipment to be distributed throughout the country but it's obvious that there is a severe lack of training and an really strong desire to break it out and parade around with it like a bunch of teenagers with their first gun. I hear people talking about how the police are the "thin blue line" between law and order but in this case they are clearly a fat green line. This equipment should have gone to the national guard.

If the police use military gear, it should be kept under lock and key and if it is authorized for use, should trigger a bunch of additional reporting requirements as an incentive not to use it.

<comment><USER3> I think people might have the wrong impression of the 1033 program. The program makes sense - instead of wasting extra military equipment, give it to local police who can use it. A lot of this equipment is very benign types of things, stuff like shoes, first-aid kits, blankets, etc.

As far as I know, local police aren't getting attack helicopters or artillery units. I don't think the equipment needs to be "kept under lock and key" except for a very few things.

Edit: You can see a list of the most distributed stuff here: [http://www.usnews.com/news/blogs/data- mine/2014/08/21/most-p...](http://www.usnews.com/news/blogs/data- mine/2014/08/21/most-popular-items-in-the-defense-departments-1033-program)

Or the full data here: [https://github.com/TheUpshot/Military-Surplus- Gear](https://github.com/TheUpshot/Military-Surplus-Gear)

<comment><USER2> I get what you're saying. And by the raw numbers there's a lot of good stuff in there too. But if you look through that list you see a lot of things like "MINE RESISTANT VEHICLE" (probably an MRAP? [https://en.wikipedia.org/wiki/MRAP_(armored_vehicle)](https://en.wikipedia.org/wiki/MRAP_\(armored_vehicle\)) )that are totally inappropriate for the local police force to be rolling around in. I'm not saying the 1033 program is a bad idea… I just think if you give someone an armored assault vehicle, it should come with the requirement that they only use it if the country is under attack or something very very serious. Better yet, give it to the guard.

I used to live in NYC and have family that is NYC police and I know they deal with some crazy stuff. They dress a bit more aggressively than most police forces. I'm currently living in Japan where the image of the police is more Norman Rockwell than Soldier. I'm also reminded of reading of a hospital that switched from customizable scrubs where the nurses were picking their own patterns to standard white uniforms and got behavioural change from both patients and doctors. I wish I could find the link.

So.. in some sense I do think there is a bit of a problem with even a set of boots coming from the military to the police. If you wear a respectable blue uniform your mindset turns toward earning your community's respect. If you wear jack boots, body armor and a military uniform, you look intimidating. I'm sure that's what the police want, but it's not appropriate for most normal police work and I believe it's the public's job to tell them so. Police are civilians who have special privilege to enforce the laws of society. They should be protected by the legal system, not body armor. If you need body armor to handle a protest, call in the Guard.

<comment><USER3> We're probably mostly in agreement, even if we lean slightly different directions on some of the issues. For example, I can't think of any legitimate MRAP uses by local police either (although if anyone can point our a realistic use case, I'd definitely like to hear it).

I completely agree that the police should be part of the community they work in and not some military-like third-party authority force. And because of that it presents an issue when the police look like a pseudo-military. However, I don't think in most cases police look like this, although I might be wrong.

Body armor is a tough call. Just yesterday a Texas police chief was killed making a routine traffic stop, and it's understandable why officers feel constantly threatened. As far as I could find, about 65 police officers die in the line of duty each year. My first reaction is that that is pretty low, perhaps policing isn't as dangerous as one would think, but I'd need to look into it a lot more before drawing any real conclusions. It's quite possible the relatively low death toll is a result of more aggressive policing, but it could also indicate that aggressive policing isn't needed.

</comment></comment></comment></comment><comment><USER4> The so-called "North Hollywood Shootout" in 1997 was a big instigator of this. Two heavily armed bank robbers were able to hold off the LAPD by virtue of superior weapons and body armor.

There was a big public outcry and support for giving police the "tools they needed" to be able to take on the better-armed criminals, gangs, and drug dealers.

So now that the police have become essentially local armies in many jurisdictions, people think they have gone too far.

What troubles me most is that neither Obama nor most legislators in congress have the first clue or any experience in law enforcement. So anything that happens is going to be driven by political concerns, not what makes the most sense for effective and appropriate law enforcement.

<comment><USER5> _Obama nor most legislators in congress have the first clue or any experience in law enforcement_

He was a practicing civil rights attorney, taught constitutional law and was president of Harvard Law Review.

You may not like him, but to say that someone who has that level of professional legal experience doesn't have any experience in law enforcement, would seem ridiculous.

<comment><USER6> You know attorney and police officer are really different jobs, right?

<comment><USER5> They both have experience in law enforcement. Law enforcement thankfully still includes the court process, not just arresting people.

<comment><USER7> >They both have experience in law enforcement

You realize that police don't think that, right? And other than those attorneys working for Dept of Justice and other agencies with a law enforcement mandate, I don't think many attorneys consider themselves "law enforcement" either.

The local ambulance chaser or deed auditor hardly goes around calling himself "law enforcement".

<comment><USER5> You seem to have confused experience with title.

It doesn't matter what someone calls themselves when asking what they have experience in.

A deed auditor would tend to think that they have had some experience in the enforcing of the area of law pertaining to deed auditing without ever needing to title themselves as law enforcement.

</comment></comment></comment></comment></comment></comment><comment><USER8> [http://en.wikipedia.org/wiki/Second_Amendment_to_the_United_...](http://en.wikipedia.org/wiki/Second_Amendment_to_the_United_States_Constitution)

One aspect of the gun control debate is the conflict between gun control laws and the right to rebel against unjust governments. Blackstone in his Commentaries alluded to this right to rebel as the natural right of resistance and self preservation, to be used only as a last resort, exercisable when "the sanctions of society and laws are found insufficient to restrain the violence of oppression".[71] Some believe that the framers of the Bill of Rights sought to balance not just political power, but also military power, between the people, the states and the nation,[72] as Alexander Hamilton explained in 1788:

[I]f circumstances should at any time oblige the government to form an army of any magnitude[,] that army can never be formidable to the liberties of the people while there is a large body of citizens, little, if at all, inferior to them in discipline and the use of arms, who stand ready to defend their own rights and those of their fellow-citizens.[72][73]

</comment><comment>=

If you accept above interpretation, why don't local police have nuclear weapons? Also why aren't nuclear weapons sold to citizens who have a right to "keep and bear arms"?

<comment><USER9> The nuclear arms argument is a classic fallacy bandied about frequently when gun rights come up.

There can be no argument in favor of nuclear weapons used for individual, or even small group or very localized, self-defense. In fact, I'd argue there can never be a valid argument in favor of nuclear weapons for _self-defense_ (with emphasis on self).

For defending a larger population base, the police have no reason to have nuclear weapons because they are not in charge of national defense or national security. That is left to the military, which does have nuclear weapons.

There can be no precise or selective targeting with nuclear weapons, in the sense of shooting a bad guy and not shooting an unarmed civilian near by. Nuclear weapons also do not function to defend against individual crime, which is something a gun can defend against. In any act of attempting to defend yourself from a localized attack by using a nuke, you will kill yourself and countless civilians nearby. There's an exceptionally long list of reasons why the floated nuclear weapons counter makes absolutely no sense.

Ultimately you can tell the nuclear arms argument is irrational, because if you follow the logic behind it to the proper conclusion, no person ever has a right to self-defense under any circumstances: because you should thus never be allowed to wield any weapons, including a knife or baseball bat in self- defense. It's the ultimate argument in ridiculousness: if you can't be allowed to do X very extreme thing, then you can't be allowed to do X drastically less extreme thing. A scale comparison would be, if I'm allowed to drive a car - cars kill 30,000 people per year in the US - then why can't I 'drive' an aircraft carrier.

<comment><USER8> That makes sense. Now, the general point I think would be that at a smaller scale we're hearing accounts of local police (or perhaps state police) riding around in tanks shooting tear gas into groups of citizens.

Where are the accounts of organized groups of citizens riding around in tanks firing tear gas at who they believe to be oppressive police force? Are those available in the free market?

I guess I'm trying to figure out where the line is supposed to be drawn in terms of who gets what kinds of arms? I'm sure alot of folks would argue that as soon as a local police force is given particular types of weapons, it's perhaps assumed that citizens will have same or similar weapons available to them to organize to protect themselves from oppressive government.

EDIT: Or more precisely, as soon as certain types of weapons are turned against its own citizens, is it right that those citizens don't have the same or similar weapons at their disposal to protect themselves?

<comment><USER10> Police militarization is an issue with or without the second amendment.

[http://en.wikipedia.org/wiki/Death_of_Jean_Charles_de_Meneze...](http://en.wikipedia.org/wiki/Death_of_Jean_Charles_de_Menezes)

One thing I think you're missing is that citizens only really need to have modern weapons (not every weapon) to be in ultimate control. There are 1,000+ armed citizens for every police officer.

As for what the second amendment should mean, the supreme court has spent the last 100 years hearing arguments in every direction. You might guess that your "nukes" argument is about as old as nukes (and before that people just used other examples).

If you want to learn more about it here's a good place to start Wikipedia'ing: [http://en.wikipedia.org/wiki/District_of_Columbia_v._Heller](http://en.wikipedia.org/wiki/District_of_Columbia_v._Heller)

<comment><USER8> Agreed. This is a highly nuanced and multi-faceted space in general. Specific to US and what Obama is proposing, how do you think they'll be framing the question in order to understand what the right answers are?

<comment><USER10> Hopefully they'll look at the problem facing police and help them solve it using more brains and less brawn.

Personally I look at this all through the lens of technology. George Holliday using his new Sony Handycam to show the world the beating of Rodney King was merely the initial trickle of justice. The torrent is coming and only genuinely good police officers will survive it.

<comment><USER8> Great observation. I agree. I'm excited to see how technology will continue to transform this space in substantial ways.

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I'd like to see _more_ work on police-specific weapons.

Weapon retention is a HUGE problem for the police. They open-carry pistols, aren't terribly well armed, are easy to get to show up, and have to grapple with suspects. This means more of them die by their own weapons (taken by someone else) than by an attacker's own weapon!

Retention holsters (the level 3 stuff, like SERPA) are great, but this is the one area where weapons with biometric or other authentication make sense. Particularly for non-SWAT police, they'll probably carry the gun openly for an entire career but never actually fire in self defense.

Police weapons having an integrated "guncam" and "gunradio" which start recording and calling for help the instant they're removed from the holster would be great, too.

<comment><USER12> Those would be awesome. What do you think about the ``smart weapon'' laws, though? New Jersey, for example.

<comment><USER11> For civilian ownership, it's wrong to require the smart weapons; civilians have an entirely different use case for weapons than police do.

</comment></comment></comment><comment><USER13> strawman.

it is not about the gizmos, it is about training and education.

LEOs who do no respect basic rights of citizens and journalists.

LEOs who point their weapons at unarmed civilians, nilly willy, shouting racist slurs.

LEOs who have no means of deescalation, run by pure panic and fear like beaten dogs.

the gear doesn't matter. the triggerfinger does.

listening to the eyewitness statements the officer should get maximum punishment, locked up for life. betrayal of every single principle of law enforcement.

</comment><comment><USER5> Should the review call for demilitarization of police forces, it will be interesting to see how the federal government will actually go about getting the stuff back.

I would imagine it would go about as well as the US army's current attempts to get the 200 Apache helicopters back off the various state national guards.

<comment><USER14> I suspect the dynamic would be a bit different but you raise a good point. Maybe just hire repo men? I've heard some incredible stories. [http://www.salon.com/2009/06/06/lear_jet_repo_man/](http://www.salon.com/2009/06/06/lear_jet_repo_man/)

<comment><USER15> That would truly be an example of an irresistible force meeting an immovable object.

</comment></comment></comment><comment><USER16> I am sure they will get on it right after they close gitmo six years ago.

<comment><USER17> [http://www.foreignaffairs.com/articles/136781/carol- rosenber...](http://www.foreignaffairs.com/articles/136781/carol- rosenberg/why-obama-cant-close-guantanamo)

<comment><USER16> Except he is the Commander-in-Chief of the entire armed forces. And he gave an order for gitmo, a military prison, to close. Which means everyone that shows up to work there every day is in serious violation of an order from a superior.

Everything else is just words. He ordered it closed, it should be covered in dust and tumbleweeds by now with not a person to be found.</comment></comment></comment>


Rothenberg's VC firm was young and loaded with cash. It's all come crashing down - <AUTHOR> https://backchannel.com/mike-rothenbergs-vc-firm-was-young-splashy-and-loaded-with-cash-now-it-s-all-come-crashing-down-e76fa076c7c5#.n8a1pfwpn <comment><USER2> Previous discussion from two days ago

[https://news.ycombinator.com/item?id=12487518](https://news.ycombinator.com/item?id=12487518)

<comment><AUTHOR> Thanks. Just curious as to why this was not caught during submission. The URLs are 96% same except for the bit after the #</comment></comment>


The wealth of Sapiens - <AUTHOR> http://www.dpegan.com/the-wealth-of-sapiens/ <comment><USER2> Well said. We must always worry about everyone having access to the "avoiding misery" fruits of the human colossus. I don't worry about inequality so long as the poor can avoid misery (at least the kind money can stave off) and live in comfort.</comment>


Please Stop Saying 'Cloud' - <AUTHOR> http://redmondmag.com/blogs/it-decision-maker/2011/04/stop-saying-cloud.aspx

<comment><USER2> The IT community is telling the IT community to stop saying "cloud" because the marketing community says it too much.

Yes, this will work.

It's a phrase that people, _normal_ people, are somewhat comprehending. That makes it one of the most well-known computer-related terms around. Why should it be abandoned, just because it's vague? The non-geek world (ie, _the world_ ) rarely gets this far into comprehending the geek world, why change it underneath them?

<comment><USER3> No one actually knows what it is. A few weeks ago, my sister asked me "What's the cloud?" and I had to explain it to her. She still doesn't understand it.

Microsoft and IT marketing fools in general are just throwing around a buzz word, except that this one is confusing to people due to its incorrect and frequent usage.

<comment><USER2> They do tend to have a vague understanding that it involves the internet, though. Which is all it really implies, with an emphasis on off-site storage and/or computation when spoken by a geek.

This is a brand-new term, relatively speaking. Ask people what a browser is, something they've had for years and use for hours every day: <http://www.youtube.com/watch?v=o4MwTvtyrUQ>

</comment></comment></comment><comment><USER4> The Windows 7 "to the cloud!" commercials enrage me. Remoting to your home PC from the airport is not "the cloud."

<comment><USER3> Seriously. Those commercials play a pretty significant role in confusing everyone as to what the cloud is. It's going to become 2011's Web 2.0 buzz word.

</comment></comment><comment><USER5> So an IT director doesn't want to outsource IT to the cloud? Shocking :-) And I guess they didn't talk about private clouds at the conference.

<comment><USER6> It may surprise you, but some people have trouble being responsible for things they have no control over.

When outsourcing to the 'cloud' works it's evidence that internal IT is flawed. When outsourcing doesn't work it's evidence that internal IT is flawed.

<comment><USER5> No surprise at all, but we are all continually depending on things we have no control over, hardware, software, people, networks, politics, disasters, health, etc. In the cloud you have the option of a private cloud, which is a lot of control with a better operations model. There are several clouds to select from, some are less wild west than Amazon, so you do have control in your selection criteria, your negotiated SLAs, your negotiated support plan, your architecture and deployment policies, your disaster and recovery and redundancy plans, and your strategies for moving to another cloud. So you have a very high degree of control if you think about it, act to take it, and make smart decisions. What you can't do is just move an enterprise wholesale into the cloud, but that's a good thing.

</comment></comment></comment><comment><USER7> I'm sure the same guy complained about the word 'Grid' or the word 'Cluster' or the words 'Tier 1.'

Buzzwords come and go, when they get over used they are more confusing than clarifying. Since many (if not most) of the folks who buy computers don't have any formal education in computers and what they do, the only way they can reason about them is by analogy. Reasoning by analogy begets buzzwords (tautology). Amongst professionals, reasoning by analogy is an OK place to start but it should quickly solidify into something you can walk back to first principles.

I once heard someone say that they called it 'cloud' computing because "You can't touch it, if you're in the middle of it you can't navigate, and sooner or later its going to dump a pile of crap on you and ruin your picnic." Seemed like they 'got it.'

</comment><comment><USER8> I always believe in using a term correctly, no matter how confusing it is. It's not imorotant whether people understand what exactly the cloud is, but they should understand that VPN/remote desktop is not using the "cloud" and email just barely qualifies. This phenomenon happens with other terms like "nanotech" just as frequently. The solution isn't necessarily to teach everyone what the technical meaning is, it's to not apply it liberally to situations that don't qualify.

</comment><comment><USER9> The headline reminded me of a video of Larry Ellison: <http://www.youtube.com/watch?v=8UYa6gQC14o>

</comment><comment><USER10> My site Tagxedo (<http://www.tagxedo.com>) makes is a word cloud app, so naturally I set up a Twitter search on the phrase "word cloud", and I track it using Tweetdeck.

However, I think at least 1/3 of the tweets captured by this search is of the form:

"Stop using the word cloud!"

"If I hear the word 'cloud' one more time my head will explode!"

and so on.

</comment><comment><USER11> Disagree.

Let's stop saying "Please Stop Saying".

</comment><comment><USER12> This guy blames the IT marketing industry. I blame everyone (including myself) that ever handed a management-type a Visio diagram with a cloud graphic representing the Internet.</comment>


Unconfirmed reports that Yahoo has sold Delicious for $5 Million+ - <AUTHOR> http://thenextweb.com/industry/2011/03/11/unconfirmed-reports-that-delicious-has-been-sold-for-5-million/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheNextWeb+%28The+Next+Web+All+Stories%29&utm_content=Google+Reader <comment><USER2> I have been sticking with Delicious in the hope that Yahoo will sell it off to a good team, who can revive Delicious. Strange that no other company takes bookmarks seriously. Google Bookmarks is a joke - it doesn't even sync with Chrome.

<comment><USER3> >Strange that no other company takes bookmarks seriously.

Cannot uparrow enough. Anyone care to shed some light on this?

<comment><USER4> Google Search killed bookmarks, it's faster and easier to simply Google a vague string you remember from the page, rather than type a tag into a different service, or trawl through six hundred sites you have incoherently organised.

<comment><USER5> That was true five years ago maybe, but these days Google is pretty much a cesspool. It often takes me over an hour just to find something vaguely related to what I'm looking for, even if I remember three or four different strings from the page.

Especially for things like academic journal articles, if you don't bookmark it then it's pretty much gone forever.

<comment><USER6> _It often takes me over an hour just to find something vaguely related to what I'm looking for, even if I remember three or four different strings from the page._

I find that hard to believe. Can you give me an example?

<comment><USER5> I saw a writeup of a journal article just a few months ago about how there is a lot of randomness in how academic grants are distributed. They basically created several different panels of the people who write the grants and gave them each the same proposals to review, and there was an enormous variance between the proposals each panel funded. I think this was for NSF grants, but I'm not sure. Anyway I can't for the life of me find either the writeup or the journal article.

Similarly, I heard a story on NPR about a research study that found the best predictor of how much 8th graders would earn as adults wasn't race, gender, IQ, grades, or anything else like that, but rather was how much they thought they would earn as adults. Can't for the life of me find that one either.

In fact there is an entire field of research that's disappeared. I know for a fact that there is a field that's basically scientists researching scientists/science, but I can't find more than a couple of the papers in this field or even the appropriate wikipedia articles.

<comment><USER7> Have you tried a Google Scholar search? That's what it's tailor-made for; I remember it having a few search quality issues when I was in college, but if I was looking for academic work, that was the first place I'd go.

AFAIK Scholar also doesn't push more often than once every couple of years, so you can be fairly sure it wasn't broken by a recent ranking change, and what you see now is what you would've gotten in 2005, modulo additional articles published.

<comment><USER5> Yes, I tried Google scholar and couldn't find what I was looking for. Maybe I've just outgrown Google?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> My problem with delicio.us was always the amount of time I had to devote to managing everything. I had to manage the links, the tags, my page, the plugins, etc... It's a wonderful service, but I always froze in that moment of bookmarking: what do I tag this? Where am I going to put this that I remember?

To that end, I've been trying historio.us. I'm not so sure about it, but I like that I just click one button and I know that if I really have to find it some day, I can. They killer feature that would make it truly useful is some sort of auto-filtering for what you're inputting.

<comment><USER9> If you like convenience, I think you will like <http://mybucket.co>

It operates and accessible via bookmarklet. Care to give it a try?

Oh, and tagging is as simple as #youruniquekeywords

<comment><USER10> "create bucket" gave me a 500. fortunately i want this enough that i will come back later today! edit: works now. two bookmarklets please! one thing that annoys me about trunkly and delicious is that i have to click twice to save: once on the bookmarklet, and once to save.

<comment><USER11> Didip replied to you but his reply is "dead." I think his first word might have caused his post to get caught by a filter so I've reposted what he said but changed that word.

>Didip said: [500 error solved]. I knew that 3am new feature addition is not a good idea =) UPDATE: yeah, two clicks bug me as well. The technical reason is that often times i want to bookmark a few images on that page. To do that (the most convenient way), is to save the image, onclick() event when the bookmarklet menu appears. Sorry, I'd love to have 1 click bookmarklet as well. If the UI makes sense, I'll make the simpler bookmarklet.

</comment></comment></comment></comment><comment><USER12> To save RiderOfGiraffes a few moments: <http://news.ycombinator.com/item?id=2313351>

<comment><AUTHOR> It's deleted now

<comment><USER13> Hmm what's the story here?

<comment><USER14> RiderOfGiraffes: unofficial #1 flagger of duplicate submissions (a.k.a dupes).

</comment></comment></comment></comment><comment><USER15> I wonder who the "competitor" is that bought delicious.

The first one that comes to mind is Digg, since Kevin Rose said he would like to buy it and Yahoo contacted Digg if they would by it[1]. The second one that comes to my mind is StumbleUpon, especially two days after raising a Series B of $17 Million[2].

[1]: [http://techcrunch.com/2011/01/26/kevin-rose-yahoo- contacted-...](http://techcrunch.com/2011/01/26/kevin-rose-yahoo-contacted- digg-to-see-if-we-wanted-to-take-over-delicious/)

[2]: [http://techcrunch.com/2011/03/09/stumbleupon-stumbles- onto-1...](http://techcrunch.com/2011/03/09/stumbleupon-stumbles- onto-17m-from-accel-and-others/)

<comment><USER16> I doubt Digg (the company) would bother. They are having more than enough trouble keeping their own ship afloat.

EDIT: then again, I wasn't aware of this: [http://techcrunch.com/2011/01/26/kevin-rose-yahoo- contacted-...](http://techcrunch.com/2011/01/26/kevin-rose-yahoo-contacted- digg-to-see-if-we-wanted-to-take-over-delicious/)

</comment></comment><comment><USER17> so having joshu and not selling in desperation is worth at least $13 million

<comment><USER7> It's funny that multi-billion-$ Yahoo seems more desperate than angel-funded joshu.

</comment></comment><comment><USER18> One day after we launch a new social bookmarking and community news site - <http://www.rinnku.com> \- and Yahoo calls it quits!

The cowards... :)

<comment><USER19> good site there, good luck

seems the secret its to fake the traffic at the begging, let me know if you find out how ;)

</comment></comment><comment><USER20> I've been running social bookmarking service Faves.com for a couple of years. We had to cut our team as we were not making enough money to support it.

This year we've actually been cutting features to emphasize performance. I'd like to transition to a subscription model, myself. Prior to pinboard I wouldn't have thought that was an option.

</comment><comment><USER21> StumbleUpon may be? They just raised 17M...and seem to enjoy buying stuff back.

</comment><comment><USER22> Hm if they are really moving it, should probably make a more recent backup of my bookmarks just in case. Though I've not used the service much since word came down they are selling or sunsetting it.

</comment><comment><USER23> Bad missteps at Yahoo!. Apparently they have a new _faster_ e-mail. Yahoo email in Flash/Javascript + visual ads really ruined my experience with Yahoo.

</comment><comment><USER24> I interested to know, how much is OPEX per month to keep afloat a consumer web service, like delicious?

<comment><USER25> I think it depends on how aggressive you want to be about spam fighting. The marginal cost of running delicious is not high for Yahoo (especially now that they fired the entire dev team), but you need someone to go in there and tidy up after the spammers.

</comment></comment><comment><USER26> Onion?

Why so under valuated?

<comment><USER27> What makes you think $5 million is undervalued?

<comment><USER26> Because., It is Delicious. If they made an internal bid between Digg, Reddit, Google & Bing. They could sell it between $15-20 million. Because., It is the #1 social bookmarking service.

</comment></comment></comment><comment><USER28> hope the will use the old domain again, del.icio.us was so much better than delicious.com

<comment><USER29> How exactly was that a better domain? I always thought that part of the issue with delicious was that you couldn't _easily_ tell someone about it.

"Del dot". "No, D-E-L, not Dell, it's not a Dell site". "DEL dot icio dot US". "Right, there is no www and no .com. It's just D E L dot I C I O dot U S. I don't know why they didn't use www or .com, maybe they wanted to seem hyper confusing to new users"

<comment><USER30> Now that it's 2011, I'd probably say, "Google 'delicious'."

<comment><USER31> Or bookmark it!

</comment></comment></comment></comment><comment><USER32> I want my browser to develop and improve the History feature so I don't have to rely on manual bookmarking. Strangely, no one is paying attention.</comment>


The Nifty MiniDrive: The simple, elegant solution to put more memory in your Mac - <AUTHOR> http://www.indiegogo.com/The-Nifty-MiniDrive-More-Space-Pretty-Package

<comment><USER2> 55 USD seems like quite a bit to pay since I need to supply my own microSD anyway. I'll pass.

</comment><comment><USER3> I don't get it. Why is this better than just using an SD card?

<comment><USER4> Because it doesn't stick out from the case at all. Decent idea, I suppose, but micro SD is not designed for the kind of drive activity it looks like their selling this for. If people came to rely on this for storage/backup, I bet they'd regret it at some point once they start burning through what's really cheap, disposable storage cards.

</comment></comment><comment><USER5> microsd's are not meant for constant read/write. they will degrade incredibly quickly. Its a beautiful project, but a flawed idea.</comment>


iOS 8 Privacy Updates - <AUTHOR> http://lmjabreu.com/post/ios-8-privacy-updates/ <comment><USER2> I wonder how Google will react to this? I already feel betrayed by how apps seem to meaninglessly and without reason request arbitrary information.

Microsoft also seems to be making a trend about "We care about your data privacy."

<comment><USER3> Good point about Microsoft - if they bandwagon and properly implement some of the good-privacy approaches Apple takes, it will put big pressure on Google to do the same.

Ultimately, that will help all users, and in the long run, even app developers as trust increases.

<comment><USER4> Although IE sucks, Microsoft is the only one to enable "Send Do Not Track" by default. Chrome and Firefox have this feature disabled.

<comment><USER5> Chrome I expected, but why does Firefox have it disabled by default?

<comment><USER6> "As we have been arguing for a long time, the point of the feature is to reflect the individual's preference, so the user must make a choice before we send any stance on tracking."

[https://blog.mozilla.org/privacy/2013/01/28/newdntui/](https://blog.mozilla.org/privacy/2013/01/28/newdntui/)

</comment></comment></comment></comment></comment><comment><USER7> I do hope this privacy conscious software becomes a trend and a race to the top. The amount of data collection is scary and the worse thing is the encouragement of sharing this information. I would like it even more if the data is encrypted to the point where not even the company has access to it... but with the cloud trends that doesn't seem like that's going to happen.

With the recent android updates to reduce importance of application permissions already has me urked, and I'm not a big fan of google now nagging me to enable search history. I'm considering to install a more privacy conscious ROM or put firefox OS soon on my phone.

</comment><comment><USER8> Also I understand that it will be possible to set DuckDuckGo as the search engine in Safari.

<comment><USER9> DuckDuckGo is set as default if you choose "Private Browsing" option.

<comment><USER10> Private windows continue to respect the user's search engine preference.

</comment></comment></comment><comment><USER11> This article is so very thorough and great.

I'd love to have some anchor links within the piece though, so when I'm referring my team to some of the changes, I can direct them right to the relevant information.

<comment><USER12> Pick a phrase in the spot you want and CTRL - F. Almost the same thing.

<comment><USER11> Sure, that's possible. When you're passing around the links to other people, it gets old to have a bunch of "[link] and search for 'Keychain|HealthKit|HomeKit'"

</comment></comment></comment><comment><USER13> I really like the changes they are making here.

One that stands out that I think will cause plenty of issues is the "Block Cookies not from Current Website". This should basically block all tracking, like, +1 etc... buttons, right?

I think it will even impact the SSO that Google has across its properties.

<comment><USER14> I'm running Yosemite and the default is "block cookies not from current or previously visited websites". Not sure if it's the same on iOS 8, but that would seem to allow the buttons to use cookies as long as the user has been to that website (e.g. Facebook, for a "like" button) before.

<comment><USER15> With comprehensive shared web history via iCloud this could sort of work, but I never (for example) visit the Facebook mobile site from my phone, despite using their apps daily.

</comment></comment></comment><comment><USER16> I think Secure Enclave and other hardware crypto technologies are massively important, especially if cryptocurrencies are to be widely used.

Trezor ([http://www.bitcointrezor.com/](http://www.bitcointrezor.com/)) and other dedicated wallets are a decent stopgap, but I'd really like to let my phone do everything, _if_ it can be done securely, which I think it can with the right hardware (of course _auditing_ hardware is a lot more difficult)

Hal Finney has done some good work here, applying TPMs to Bitcoin: [https://bitcointalk.org/index.php?topic=154290.0](https://bitcointalk.org/index.php?topic=154290.0)

</comment><comment><USER17> It's fascinating how so many apps can be rendered useless by the simple mistake of tapping "Deny" instead of "Allow."

<comment><USER18> You can, of course, navigate to settings and toggle the switch for anything you accidentally denied, but I wonder how many users know that. Also, unless a developer explicitly adds some message reminding the user that they have already denied access to some resource, the user may very well forget that they ever denied anything and think that the app just doesn't work.

All that said, I think Apple is making the right choice by favoring privacy and security even if it's at the expense of a completely frictionless user experience.

<comment><USER8> At least in iOS 8 the developer can add actions to send the user to the correct part of the settings app.

<comment><USER19> And let's hope the review process is very tight about this. If I deny you some permission, you shouldn't be able to pester me every time I run the app to turn it back on. Some apps ( _cough_ Facebook _cough_ ) are already REALLY bad about this.

<comment><USER20> I denied location access and Facebook never asks me anything more than once.

<comment><USER14> The Facebook "Messenger" app pops up a full-screen modal pestering you to enable notifications EVERY TIME you start it, if you choose to keep them disabled. I prefer to batch electronic communications and check them a few times a day at most, and find the constant nagging to change my communications style pretty infuriating. I ended up deleting the app.

<comment><USER21> ok, but given that Messenger is about, err.... real time messaging it is probably very important to have push notifications enabled.

</comment></comment></comment></comment></comment></comment></comment><comment><USER22> A welcome change. But, for this to work, the violators (even past) can't be allowed to bypass the rules.

For example, how many of the top apps that explicitly allow kids, violate some or all of the COPPA standards?

Clash of Clans is just one example, ages 9+, but allows custom usernames and p2p chat with very little filters. Those social features are key to long term engagement, even of 9 year olds.

</comment><comment><USER23> I'm trying to get my head around the keychain changes, and whether they fix one particular annoyance that I have with iOS.

Currently I have the Gmail app installed on our family iPad. My Google account details are therefore stored in the keychain.

If I use the Google Maps app, it PERSISTENTLY asks the user to sign in (using my account already in the keychain). My wife doesn't want her location searches saved to my account, nor those of my kids.

I don't want to login to the Google Maps app, but Google seems to want to force me to, even though this is a shared device. There doesn't appear to be an option to say "no, thanks, stop f%*king asking".

So instead I use Google Maps in Safari and cringe if I really need to use Apple Maps - slooooooooow.

Can anyone shed any light on whether I'll be able to block the sharing of my Google account details between Google apps?

<comment><USER24> No, this actually goes the other direction. If you have stored your Google login credentials in Safari, then the Google Maps app could login automatically without prompting you. Currently only apps from the same developer can share keychain items.

Apple would rather you buy two iPads than share one, and their OS is designed around that.

</comment></comment><comment><USER18> I had somehow missed the news from WWDC that accessing the camera now requires explicit permission from the user.

I'm really surprised camera privacy took this long to arrive, and I wonder what the reasoning was for not implementing it at the same time as microphone permissions arrived in iOS 7.

<comment><USER25> > _I 'm really surprised camera privacy took this long to arrive, and I wonder > what the reasoning was for not implementing it at the same time as > microphone permissions arrived in iOS 7._

I don't think apps could take photos without you explicitly triggering the process, so no permission was needed anyway IIRC.

<comment><USER18> Using the lower level AVFoundation classes to start a capture session, any app could absolutely get live camera access to either front or back camera without the user knowing anything. I know because my app shows a live preview to the user right when the app starts up, no permission required, direct access to pixels, and if I chose not to display the UIView that shows the live camera data, that would not change my app's access to the data (under iOS 7 and earlier, I mean).

It's possible Apple screened for non-camera apps using those APIs to keep spying apps out but (Edit: bad example, this was an Android app. I had said: "there was that flashlight app that was storing/reporting user GPS locations without permission so obviously things were slipping through the old system.")

</comment></comment></comment><comment><USER26> On the iOS 8 preview page for the Photos App the iCloud Photo Library integration is featured very prominently.

I wondered what this means for privacy. It isn't mentioned in the original post, probably because it's an extra app therefore out of scope of the article. I'd be interested anyway in any information on this, primarily: Will Photos be practically usable without iCloud? Syncing my devices with iPhoto is pretty seamless, will it still work?

[1] [https://www.apple.com/ios/ios8/photos/](https://www.apple.com/ios/ios8/photos/)

<comment><USER27> You can disable iCloud Photo library, atleast in current betas. Regarding iPhoto, it is being discontinued in favor of a new Photos app in Yosemite. Existing app should work with maintenance updates to it.

</comment></comment><comment><USER28> Random question: If the specially blessed form names for user signup is 'username' and 'new-password', what's the name of the field that's "password again" (for typos)?

<comment><USER29> I don't think autocomplete is supposed to work for fields that check typos?

<comment><USER30> Autocomplete doesn't make typos so why shouldn't it work?

<comment><USER29> Because it defeats the purpose of the field that's checking for typos.

<comment><USER30> And that purpose is obsolete when a computer is inputting the password.

</comment></comment></comment></comment></comment><comment><USER31> The biggest win for me is contact access control, it drives me absolutely nuts when a messaging app or whatever insists on having full access of my very private and valuable contact info.

<comment><USER32> What's more worrying is my contact information on friends devices. I have zero control over that.

Some of them are even on Android! ;)

</comment></comment><comment><USER33> I wish networking was sandboxed in iOS 8, at least for particular kinds of apps (e.g. diary apps). Apple could use the chance to promote iAds and CloudKit at the same time by whitelisting them. :)

</comment><comment><USER34> Screenshots, created with Sketch... Doesn't look good on devices that don't have "Helvetica Neue" installed.

<comment><USER35> What is this "installed" you speak of?

<comment><USER36> This: [http://i.imgur.com/AoR40fw.png](http://i.imgur.com/AoR40fw.png)

</comment></comment></comment><comment><USER36> Nice detail on SVG graphics.

</comment><comment><USER37> Unrelated to content, it's interesting that I could reduce the scaling to not 90, not 75, not even 67, but a whole 50%, in order to have the font sizes be of comfortable normal size rather than extremely large. It's a pattern I'm noticing more and more, and it makes me worry.

<comment><USER38> Odd, it looks like you're getting down-voted. I mean, I'm no more of a fan of "page layout complaint that has nothing to do with the article" comments than anyone else, but I don't know that it's down-vote-worthy.

Anyway, at the apparent risk of being on the receiving end of some down votes myself, I'm more curious _why_ giant fonts are a trend. I'm old, I wear progressive lens (what used to be known as "bifocals"), and I still hit the Cmd⌘-+- combo a few times to crank it down to a readable size. Is it some attempt to capture the aging baby boomer market? (I ask with tongue somewhat in cheek...)

<comment><USER39> _I 'm more curious why giant fonts are a trend_

If you imagine that page on a phone screen, you'd find that the font size is probably a lot more normal than it is large. If you're expecting > 50% of traffic on mobile then that's the use-case you optimise for.

<comment><USER40> Why not use media queries to apply screen-appropriate CSS?

</comment></comment></comment></comment><comment><USER41> Is there a reason the author's name is in the title. Seems to violate the HN's guidelines.

Is the author so important that we should know of him/her?

Having said that, the article is awesome and if the author keeps writing pieces like this I'll be reading more!

<comment><USER42> It seems the title is fixed now? It's a good document, anyway.

</comment></comment><comment><USER43> Looks like they just copied another feature as usual from some competitive OS and made it sound like something new.

<comment><USER44> I swear there is no weaker criticism on tech forums than people complaining about how technology X is lame because it has some nifty feature that competing technology Y has been doing for a long time, which is always followed by a complaint that whoever made technology X is guilty giving the false impression that they are 100% responsible for inventing whatever that feature was, by virtue of the fact that they don't include a long list of thank yous to said competitors in their marketing materials.

In previous decades, this argument was every bit as silly when someone used it to claim that Windows sucked because the Mac came first, or that the Mac sucked because the Xerox Alto came first, or that the Xerox Alto sucked because the Analytical Engine came first, or that the Analytical Engine sucked because the abacus came first, or that the abacus sucked because fingers came first, or that fingers sucked because...well, I don't know. Maybe there were a bunch of flagella graybeards on the forums who would get super pissed anytime someone made a positive comment about fingers without acknowledging the evolutionary contributions of their species.</comment></comment>


Being Steve Jobs's Boss - <AUTHOR> http://www.businessweek.com/magazine/content/10_44/b4201096309840.htm?chan=magazine+channel_top+stories

<comment><USER2> Link to the actual interview (this article looks like just a rehash): [http://www.cultofmac.com/john-sculley-on-steve-jobs-the- full...](http://www.cultofmac.com/john-sculley-on-steve-jobs-the-full- interview-transcript/63295)

HN discussion: <http://news.ycombinator.com/item?id=1790566>

</comment><comment><USER3> _So Intel (INTC) lobbied heavily to get us to stay with them … [but] we went with IBM and Motorola (MOT) with the PowerPC. And that was a terrible decision in hindsight. If we could have worked with Intel, we would have gotten onto a more commoditized component platform for Apple, which would have made a huge difference for Apple during the 1990s. So we totally missed the boat. Intel would spend $11 billion and evolve the Intel processor to do graphics … and it was a terrible technical decision. I wasn't technically qualified, unfortunately, so I went along with the recommendation._

I'm not confident he's correct. It certainly wasn't the wrong technical decision -- it may have been the wrong business decision.

<comment><USER4> Thought that, too: good thing he's not CEO anymore, I could just imagine him in a meeting "Why does A4 run RISC? We got burned by that already, we're sticking with CISC this time!"

</comment></comment><comment><USER4> _He felt the computer was going to change the world, and it was going to become what he called "the bicycle for the mind."_

I'd heard Alan Kay repeat this many times. I don't know of much hard evidence (I'd really appreciate some, if you do), but I have a feeling that Alan Kay and the Smalltalk community was a great inspiration to Steve Jobs and Apple's way of thinking.

<comment><USER5> Alan Kay and Steve Jobs go way back...

<http://en.wikipedia.org/wiki/Xerox_Alto> <http://en.wikipedia.org/wiki/Objective-C> <http://en.wikipedia.org/wiki/Dynabook>

That said, Smalltalk is overrated.

<comment><USER6> I think its probably more fair to say that after many years of being massively underrated and overlooked the lip service which computer science pays to Smalltalk is way higher than the actual amount of work put into the ecosystem around the language.

<comment><USER5> Smalltalk is like Libertarianism. It allows for those who find reality too difficult or hard to understand an escape to an ideology that is simple, elegant, and wrong.

</comment></comment></comment></comment><comment><USER7> _> People say he killed the Newton- your pet project- out of revenge. Do you think he did it for revenge?

> Probably. He won't talk to me, so I don't know. _

They still don't talk? After all these years?

<comment><USER8> Why would you expect Steve to talk to him?

In an interview, Steve said, "I hired the wrong guy. He destroyed everything I spent 10 years working for."

[Direct link to the segment: [http://www.youtube.com/watch?v=0MwD- TZ6r9Y&feature=relat...](http://www.youtube.com/watch?v=0MwD- TZ6r9Y&feature=related#t=5m27s) ]

Hear him say the above words, you will feel the pain in his voice. If I was in his place, I would never ever talk to Scully again.

</comment></comment><comment><USER9> I thought this was hilarious. "I remember going into Steve's house, and he had almost no furniture in it. He just had a picture of Einstein, whom he admired greatly, and he had a Tiffany lamp and a chair and a bed."

<comment><USER10> Famous photo which captures this:

<http://www.life2point0.com/images/2007/12/14/stevejobs.jpg>

<comment><USER11> This looks like a very luxurious crack den, which actually probably isn't too far off.

You have to wonder whether, given his LSD use and whatever underlying emotional issues he may have had, how psychologically healthy he was at the time.

</comment></comment></comment><comment><USER12> As he puts it Apple is foremost a design company. I see interesting rivalry brewing up between Apple and Google. One where design is paramount and other where engineering is paramount. In fact in the tech world, Apple stands out as a design company where as pretty much everybody is more or less engineering and marketing company.

<comment><USER13> Apple can do engineering, Google cannot design.

<comment><USER14> I remember back in the day <http://google.com> was touted as masterpiece of design.

</comment></comment></comment><comment><USER15> I love this quote - "We talked a lot about how perception leads reality and how if you are going to create a reality, you have to be able to create the perception."

It sounds like the concept of the reality distortion field.

</comment><comment><USER16> I offer a counter to the assumption on page 2 of the article..

Its not User experience in its end-all but reducing R and D costs with right R and D choices that allowed the focus on user experience. Let me explain.

Several universities concentrated on Mach Kernel OS design patterns. Thu,s when SJ left Apple he founded NEXT based upon extending this pattern with an OOP C language as the trade-offs with MACH in the OS do not benefit unless you adapt an OOP language to build the apps sitting on top that Mach Kernel OS and to be blunt C++ is a poor OOP computer language.

So when NEXT was acquired by Apple they had the opportunity to lower R&D costs as the initial R&D costs for this new way had already been paid by NEXT. Apple in its purchase of NEXT was just securing a price level of R&D for the next 20 years by buying the R&D team.

The assumption that Apple started with user experience is somewhat miss-guided and completely wrong.

To give you an idea of that initial R&D investment ..how many decades has GNU Hurd been limping along? Exactly..</comment>


What do you like or dislike about Elance and ODesk? - <AUTHOR> Let's discuss... <comment><USER2> If you're a decent developer in a relatively prosperous country I think you shouldn't waste much time on these types of sites. You're going to be competing against developers in very poor countries who can afford to work for much less than you. You're not going to be competing for great clients but for people that are very price sensitive and demanding. There's exceptions to every generality, but odds are you're better off developing your local client base.

<comment><USER3> We started Lambda ([http://getlambda.com](http://getlambda.com)) as an Elance/Odesk competitor for precisely these reasons. Most of the people looking for developers on the big offshoring platforms aren't the types of clients we'd want to work with ourselves.

The big problem is education. We speak with a surprising amount of people who've never hired a developer before. They often don't understand the difference between Wordpress dev and someone who's been doing high-performance numerical computing. If they tried to hire a dev on Elance, it would almost certainly be a frustrating experience for both parties, since they're unable to write a reasonable job description.

Our solution has been to take a very unsexy approach: anyone who wants to hire a dev through our service needs to first hop on a phone call and tell me a little about what they're looking for. Sometimes we reject potential clients outright (particularly if they have poor expectations about price) other times we suggest they hire a different type of dev than they initially thought they needed.

Unless Elance is willing to start offering this sort of concierge service, it's unlikely to grow into the sort of place where qualified devs will want to find qualified clients.

<comment><USER4> Good luck - I just applied.

Although your 100/hr minimum rate does cause me a bit of concern. I'd find it difficult to justify that rate for most of the work I do, which is PHP and javascript development.

<comment><USER5> For me the $100/hr minimum is an excellent filtering mechanism for serious clients. As a consultant I think there's a place for this, a place for Elance, a place for Odesk, and a place for AWS Mech Turk (AWS's horribly named labor market).

</comment></comment></comment></comment><comment><USER6> Elance, Odesk and alikes are infested with middlemen posing as an actual developers who are re-hiring poor developers from inidia, pakistan and alike countries in a hit-n-run fashion for pennies.

The marketplace is craving for quality local (north american only) freelance service providers powered by strong job platform service.

Many enterprises are slowly realizing that outsourcing is what-you-pay-is- what-you-get business and it's a prime time to negotiate services with local quality talents.

</comment><comment><USER7> I have used Elance for a few years as my primary source of income.

Positive:

\- meritocratic

\- satisfactory rates. I get as much work as I want at $50 (sometimes more) doing upper four or lower five figure projects

\- flexibility - I can dump a client, change workload, take a year break, anytime - and come back to where I was. A safety net.

\- no need to do anything else than talking to clients and building software. No marketing besides the profile, no Linkedin profile, no Twitter, no conferences, no interacting with HR etc useless people

\- no phone or IM. As a rule, I only communicate through email, which I check once a day, tops

Negatives:

\- huge fees (close to 10% per transaction)

\- have to actually work to earn, but that's how it is with freelancing Elance or not

\- overall low prestige, though some clients are top-notch

As others pointed, some clients try change the scope. I just send them back quotes for any changes I don't feel like doing for free. Problem solved.

Most projects are boring CRUDs, but I also got to do some interesting pieces of software.

I appreciate the freedom that Elance gives. Still, I treat it as a convenient alternative to flipping burgers, and I would not recommend it for someone who wants to make a career as a developer.

BTW the screen making software is abomination and no one should ever agree to use it.

</comment><comment><USER8> I've had a couple of engagements that went well. And I've been invited to bid on some team engagements that appeared to be well defined, well managed, and well structured. But the customer "required" 40 hr/week and paid "okay", but not well enough to suck up 40 hours of my week. I would have considered it if it had been deliverable-based rather than time-based.

But, as the other commenters have stated, most of the jobs pay too little, require immediate turnaround and/or have initial scopes which turn out to be poorly though-out.

</comment><comment><USER9> The oDesk software is great. But I don't like that they force taking screen- shots for you to be paid. For one client (in finance industry) we had to disable screen-shots due to NDA and it caused all sorts of problems.

But, yes, as others have said, it's hard to make a living if you're in a high- cost-of-living country. My rate on there is $100/hr. I get about 1 inquiry a month and maybe a few jobs a year from it. I did have one long-term job on there at $60/hr so I made it to the top %1 of devs though.

</comment><comment><USER10> I have worked over 2000 hours on odesk and a smaller number of hours on rentacoder. For me those sites have been a lifesaver and a curse.

The reason I ended up on them is because I have chronic health problems and have not been able to get much in the way of health insurance or when I did I wasn't able to really solve my problems. So I have not been able to show up on time and put in the hours or had the energy to hold a regular full time job. Being able to work from home on my own schedule has been necessary.

At the moment I have a bit of freelance work that is not from those sites and pays OK. But I may end up going back on odesk or something and scrambling for another project out of necessity.

There is a reason those projects are posted on outsourcing sites, which is that the resources available are very limited or at least too limited to pay for US based developers.

This initial underfunding usually doesn't bode well for the overall project management.

Well let me soften that a bit. Usually the project managers are not completely clueless and are doing the best they can in a situation that is not ideal. That's not always the case.

The other developers I have worked with have been very capable contrary to what people say about outsourcing. But more often than not delivering some kind of usable system is required even though there isn't adequate time or developer resources and is never any QA. So you pretty much have to cut corners everywhere or just lose the fee and get a bad report on your record.

The thing is that so many people want custom software and development is so expensive that tools like WordPress with plugins etc are taking the place of custom development. Sometimes taking advantage of those tools can make what would be completely ridiculous underfunded projects a few years ago now realistic.

I think that is great, but we are actually going to have to change our societal structure because there really aren't going to be enough jobs.

Within 10 or 20 years quite a lot of the application/plugin configuration work now being done by programmers and even much of the custom software development will be done by interactive AI programs.

The reason I can say that confidently is that we have such a rich ecosystem of for example open source web applications and plugins that have already been developed. More than half of all software projects are minor improvements in areas where problems have been solved dozens or hundreds of times. With such an ecosystem of existing solutions and most problems already solved the level of language understanding or general intelligence required is low and either already accomplished or will be within our reach shortly. And to be clear I'm not just talking about outsourced programming but software development in general. Certainly there are lots of software projects that require true human level intelligence, but the majority of them do not if we take advantage of existing solutions and employ leading-edge AI.

</comment><comment><USER11> I really can't work for a few dollars an hour or meet the unrealistic high expectation from someone who cannot afford to pay the full price of a project.

<comment><USER4> Yeah. I especially like the ones which insist the work has to be done immediately, or within a couple of hours, or that DESCRIBE EVERYTHING THEY HATED ABOUT THE LAST DEVELOPER IN CAPITAL LETTERS, or clearly just pasted in the default job description without even bothering to _describe the job_.

<comment><USER12> Exactly, and you can't even charge them for the time you _lost_ _convincing_ them to describe what exactly they want and giving them new ideas as you go through the process. Such a mess. But hey, sometimes you get great connections there, I found one of best hackers I know there (but I'm afraid he was the exception).</comment></comment></comment>


Who is Europe's Ron Conway? - <AUTHOR> http://hackful.com/posts/353

<comment><AUTHOR> Most European 'Angels' are myths as it is... but surely there MUST be someone pulling the strings, joining the dots and sporting such incredible hair!</comment>


Dell XPS 13 (late 2019) review - <AUTHOR> https://www.theverge.com/2019/12/6/20997044/dell-xps-13-2019-review-six-core-intel-comet-lake-10th-gen-test-price-specs-features <comment><USER2> I liked my old xps 13. The build quality was probably the best of any non-mac machine I've used, and the carbon fiber is a cool design choice. But the coil whine was awful and it felt like they tried to make a workstation out of a 13 inch ultrabook.

I haven't seen many people using these, which is kind of surprising to me.

</comment><comment><USER3> They added more cores and still haven't fixed the thermal throttling issues they have been having for years?</comment>


A megathread on breaking away from Google - <AUTHOR> https://www.reddit.com/r/privacy/comments/8l3vjy/can_we_get_a_megathread_on_breaking_away_from/ <comment><USER2> I've recently moved from Gmail to Fastmail (which also has a calendar), and to MicroG + Yalp instead of Google Apps on my phone. Both have worked very well for me as privacy-conscious alternatives, with minimal hassle after the initial setup. I'm still using Google search, YouTube, and Chrome on the desktop, for lack of alternatives I've gotten along with, but that's about it. I'm very happy how much less of my data that exposes to Google, but at the same time, it does still feel like a bit of a pyrrhic victory.

</comment><comment><USER3> I've been mostly Google free for a while now, other than for some work stuff where I have to access some Google Apps docs. I also still use YouTube because that's where lot of the content still is sadly. What I'm using instead:

\- Search: DuckDuckGo, occasionally Bing

\- Phone: Windows Phone, pre ordered a Purism Librem 5

\- Browser: mostly Firefox and Brave, Edge on mobile and occasionally on desktop

\- Maps: Bing Maps (occasionally resort to Google Maps tho)

\- Email: ProtonMail

\- Calendar: Outlook.com, but I still use Google Calendar for some things

\- Cloud storage and backup: Dropbox and OneDrive

<comment><USER4> Same here, but instead of getting in bed with microsoft I've moved to using FLOSS components.

<comment><USER5> That's what I was thinking. Are people just leaving google to use all the microsoft products? That makes 0 sense to me.

<comment><USER6> Some of it is for support reasons.

</comment></comment></comment></comment><comment><USER7> YouTube is the most difficult service to break away from, simply because it has all the content - and more and more of my entertainment time is spent watching YouTube. I'm thinking YouTube was Google's most ingenious purchase.

<comment><AUTHOR> YouTube subscriptions work fine with RSS, just to add to this. I have them added to my ttrss, don't even have to log in to watch videos (which is not exactly 'breaking away from YouTube', but I think it's a healthier approach.)

<comment><USER4> Or use hooktube.com, which strips out all Google-related tracking stuff from video links on YouTube. There are even greasemonkey scripts to rewrite YouTube.com URLs to hooktube.com automatically.

<comment><USER8> I just use youtube-dl, it's simple and can be automated easily. Toss a URL at it and get a nice quality version. I really wish people would start publishing videos elsewhere for download, with high bitrate versions. I can (and do, as we all) live with the artifacts, but I don't mind some bandwidth. Even if it were patreon exclusive (to offset the costs for hosting) I would become a patron for that alone.

<comment><USER9> How would you deal with video hosting? It's a high bandwidth application, and would be very expensive to self host.

Just an hour of streaming takes about 1 GB or $.25 if you're using AWS. Multiply that out across a couple hundred users and many hours of streaming that's very expensive.

<comment><USER10> Dedicated servers: [https://news.ycombinator.com/item?id=17113244](https://news.ycombinator.com/item?id=17113244)

<comment><USER9> Even with dedicated servers, the new hosting site would have to find a source of revenue. The creators typically don't want to shell out. The sites with premium hosting are still kind of terrible too. They offer very little in the way of discovery of new content or moderation.

[https://vimeo.com/upgrade](https://vimeo.com/upgrade)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> What's with all the tinfoil hats? Google != Facebook.

Unpopular opinion perhaps, but I believe they use the information I share to enrich my user experience. It seems less about monetization and more about providing customized services.

What am I missing?

<comment><USER12> > I believe they use the information I share to enrich my user experience.

Manifestly false. They use your information to target ads. The pages that you've browsed will affect the ads you see on youtube and the paid search results you get. That's right, the paid search results you get are modified not to enrich your experience, but because some advertisers pay more for people with your browsing profile. Does that improve your experience, or does that improve google's advertiser's experience?

<comment><USER13> YMMV but it improves my experience because I get to use all these great products and features Google has, without lifting a finger, and in most cases without paying a penny. All I have to do is ignore the ads on my screen (which my brain seems to already do).

<comment><USER12> > all these great products and features Google has

My post wasn't meant to dissuade anyone who's happy with being tracked from using google.

I was merely pointing out that the post I was responding to tone of "google is tracking me for my sake" is in most instances based on nothing but faith, and in other cases known counter-examples exist.

</comment></comment></comment></comment><comment><USER14> There are pretty complete alternatives to all Google services in mainland China, well, because the Great Firewall blocks Google. I doubt if anyone really want to move from Google to those Chinese alternatives though because privacy is even worse.

</comment><comment><USER15> Does it sound odd that I've always been Google-free anyway? By virtue of being a Mac user. Search? Switched to DDG or Bing. I gave up Google Maps ages ago, using Bing/MS's map offering, and when Apple Maps came out I went to that. Email, has always been IMAP on servers I host myself.

I never even went down the Google rabbit hole like many of my friends did. It's curious how they claim Apple is so proprietary when they're using Android, Google Photos, Gmail, Google Maps, Google Drive, Google Docs, Google Chat (or whatever it's called this week,) Google Music, Google Play, and maybe youTube, I mean Google TV.

The Apple ecosystem has been pretty good for me.

<comment><USER16> Apple is just using Google.

[https://www.cnbc.com/2018/02/26/apple-confirms-it-uses- googl...](https://www.cnbc.com/2018/02/26/apple-confirms-it-uses-google-cloud- for-icloud.html) Apple confirms it uses Google cloud for iCloud - CNBC.com

<comment><USER15> And to the end users, that's absolutely meaningless.</comment></comment></comment>


Technological Hero Lee Davenport Dies at 95: Here are his 7 Rules for Innovation - <AUTHOR> http://www.xconomy.com/boston/2011/10/03/lee-davenport-a-technological-hero-dies-at-95-here-are-his-7-rules-for-fostering-innovation/ <comment><USER2> > 7) Hire young blood. A research staff's average age must not increase even > one year per annum. In a high-tech lab, a nice average is under 35.

Oh man, that needs some updating.

<comment><AUTHOR> which way are you thinking? down or up?

<comment><USER2> I'd have to take the average up a couple of years. ~40 probably. There exponential growth of information, processes and technology makes it hard for someone to gain the blanket knowledge by their early thirties that would enable them to be the person they could've been twenty or thirty years ago.</comment></comment></comment>


Bots please: Slack needs a news feed - <AUTHOR> https://bencollier.net/2016/03/bots-please-slack-needs-a-news-feed/ <comment><USER2> Or if you're looking for a news feed, you could try something different than Slack. [https://www.talkspirit.com/](https://www.talkspirit.com/) seamlessly mixes real-time communication and asynchronous conversations to answer all the needs your team has to share information efficiently. The main part of the UI is for threaded topics, with services integration like Slack and the sidebar is for chat conversation.

</comment><comment><USER3> Flowdock does exactly that. [https://www.flowdock.com/](https://www.flowdock.com/)

<comment><AUTHOR> oh wow - that's pretty much how I imagined it!</comment></comment>