FBI tells lawmakers it can't access Dayton gunman's phone - <AUTHOR> https://thehill.com/homenews/administration/456742-fbi-tells-lawmakers-it-cant-access-phone-of-dayton-gunman <comment><USER2> > Attorney General William Barr said in a speech last month that encrypted > messaging services allow "criminals to operate with impunity." The cost of > encryption is "ultimately measured in a mounting number of victims — men, > women and children who are the victims of crimes, crimes that could have > been prevented if law enforcement had been given lawful access to encrypted > evidence,"

This disgraceful, emotionally manipulative statement is an obvious lie. Police/FBI/etc have have access to far more information about criminals than any point in history. The average person (criminals included) leaves behind an incredible amount of "digital exhaust". They should be able to build a complete pattern-of-life easily with 3rd party data (e.g. ad tracking), various side channels, and the massive amount of metadata[1] recorded every time criminals used their phone.

Of course, using all of that data to find a criminal requires actual detective work specific to each case. Encryption (especially on a phone examined _after_ a crime) isn't preventing law enforcement from investigating crimes; it is, however, harder to _automate_. This anti-encryption argument is really about _automated mass surveillance_ , not finding specific criminals.

[1] "We kill people based on metadata" [https://www.youtube.com/watch?v=UdQiz0Vavmc](https://www.youtube.com/watch?v=UdQiz0Vavmc)

<comment><USER3> It isn't just detective work, it is personnel with the skills to identify and pursue likely evidence.

Digital forensics is way outside typical leo training and believe it or not you can make a lot more money in the private sector with IT training.

Local, state and federal case loads get backlogged behind, leaving the highest priority cases to get staffed.

<comment><USER4> What stops LEO from contracting with a digital forensic company or consultancy?

<comment><USER3> They do this at the federal level a lot and there is a lot of money in it.

</comment></comment></comment></comment><comment><USER5> Is the American government position "Guns don't kill people, encryption kills people", or am I just combining the personal opinions of a bunch of unrelated people who work for the government?

<comment><USER6> In the US, there are more firearms than people. About one-third of all households have at least one firearm [0]. The vast majority of these people have never had a serious brush with law enforcement, but some significant portion would refuse to part with their guns if a ban were enacted tomorrow. While it is said that nearly all Americans are felons [1], most Americans do not intentionally commit felonies or think of themselves as being on the opposite side of things from law enforcement. That would suddenly change for millions of ban-defying US citizens, and it's hard for me to imagine a likely scenario where that decreases violence in the US.

[0] [https://www.npr.org/2016/01/05/462017461/guns-in-america- by-...](https://www.npr.org/2016/01/05/462017461/guns-in-america-by-the- numbers) [1] [https://ips-dc.org/three-felonies-day/](https://ips- dc.org/three-felonies-day/)

<comment><USER7> America has vast and currently unimpeachable rights to weaponry. There is a huge swath of policy space between that and banning gun ownership. We can reduce gun ownership, trafficking and weapon deadliness a thousand different ways while not adversely impacting legitimate usage. Universal background checks, limiting purchase frequency, banning 100-round barrels, increasing liability for dealers.

<comment><USER8> _...banning 100-round barrels..._

Not sure if you're joking there -- maybe you meant magazines?

Like so many other gun regulation ideas, it seems superficially reasonable based on "danger" but it's almost never the case that items like that contributed measurably to gun deaths. They don't need to be banned -- they are niche items. Mass shooters who have access to them rarely use them. They rarely use 40 or 50 round magazines. Indeed, people rarely purchase magazines larger than the standard 30 rounds.

 _We can reduce gun ownership..._

That is not a legitimate policy goal. The earlier poster points out that gun ownership is not correlated with crime at all. We shouldn't set policy goals that are merely about partisanship -- trying to cut down on gun owners because we don't like them -- rather than a clear public benefit.

 _...increasing liability for dealers._

I would like to better understand what you have in mind here. In general, modern legal systems reject holding one person responsible for the crime of another. If a mass shooter lawfully purchases a firearm, what possible liability could a dealer have?

<comment><USER9> > That is not a legitimate policy goal. The earlier poster points out that gun > ownership is not correlated with crime at all. We shouldn't set policy goals > that are merely about partisanship -- trying to cut down on gun owners > because we don't like them -- rather than a clear public benefit.

A 2014 review in the Annals of Internal Medicine concluded having a firearm in the home, even when it's properly stored, doubles your risk of becoming a victim of homicide and triples the risk of suicide. [0]

Guns are intrinsically dangerous, in much the same way as certain aggressive dog breeds and industrial explosives. While many/most people can safely raise rottweilers, store dynamite, and keep guns, some will not. Is there a marginal benefit associated with the removal of each marginal gun? Obviously. Is gun ownership reduction a legitimate policy goal? Obviously. It's strange that you think otherwise.

> In general, modern legal systems reject holding one person responsible for > the crime of another. If a mass shooter lawfully purchases a firearm, what > possible liability could a dealer have?

Part of a more involved system of background checks would necessarily involve more action by dealers to verify that the customer's purchase is legal. Prosecuting and holding liable individuals who fail to follow established precautions when selling dangerous products is not unusual.

[0] [https://annals.org/aim/fullarticle/1814426/accessibility- fir...](https://annals.org/aim/fullarticle/1814426/accessibility-firearms- risk-suicide-homicide-victimization-among-household-members-systematic)

<comment><USER8> _A 2014 review in the Annals of Internal Medicine concluded having a firearm in the home, even when it's properly stored, doubles your risk of becoming a victim of homicide and triples the risk of suicide._

It doesn't say that, exactly, since it doesn't distinguish between properly stored and not properly stored cases. It is a meta-analysis; they took a bunch of papers and did the best they could. We can't say that if they're properly stored it's about the same, or worse, or better.

It also acknowledged some methodological limitations, including studying overall death rates, and not specifically deaths due to guns:

 _...we considered studies of suicide and homicide victimization by any means, and firearm-specific outcomes may differ._

Another issue the study encountered, was that gun ownership rates were not directly available to many of the aggregated studies, which therefore relied on various proxies.

What makes relying on a study like this to initiate a policy of reducing gun ownership not premature?

 _Part of a more involved system of background checks would necessarily involve more action by dealers to verify that the customer 's purchase is legal. Prosecuting and holding liable individuals who fail to follow established precautions when selling dangerous products is not unusual._

We do have laws like this already -- FFLs do background checks for every purchase and if they fail to do so, they can lose their license. What are the expansions that you'd like to see?

</comment></comment></comment></comment></comment></comment><comment><USER10> _We_ (HN commenters) all know that the demonization of encryption is bullshit. What we need to do is to figure out how to communicate that effectively to the public.

<comment><USER11> "Authorities want every house in America to be remodeled to include a second front door with a special government lock. They promise to only give police departments, contractors, and/or federal employees access to the single master key that can be instantly and easily copied and shared over the internet and opens every single house and business in America. Even if we trusted the government with this power, how could that go wrong?"

<comment><USER12> I think most Americans know that the government can quite easily enter anyone's home if they want to.

<comment><USER13> Generally, not legally without a warrant, which can be a good enough deterrent. Or at least should be if our legal process is working at all.

<comment><USER14> You could say the same about a hypothetical encryption backdoor. The question is whether consumers should be allowed to use encryption the FBI can't crack even _with_ a warrant. I think the answer is "yes", but…

<comment><USER13> Right, which is why the locked door is the _wrong_ analogy.

It's more like burying treasure. The location is a secret map (key) that only you know. The critical distinction here, I believe, is between "having" and "knowing".

And I like to believe we have even stronger rights to what we know than to what we have.

All that said, this is assuming use of working cryptography. With the exception of the technically savvy (those who know how to hid things properly) asking for backdoors into encryption is akin to registering your treasure with the feds, something I'd assume gold miners wouldn't have put up with, for example.

</comment></comment></comment></comment></comment></comment><comment><USER15> Why is it important that the FBI can access that person's phone?

<comment><USER16> I'm wondering this too. The person already killed a bunch of people. The person is dead. What more to they hope to gain? Some secret cell of others? Unlikely .. and if there is, why not regular warrants, wiretaps, e-mail searches, etc.

They already have sooo many tools they can use, both with a warrant and bypassing it via FISA. They had all this domestic spying stuff and still couldn't prevent the shooting!

They get nothing with phone access, so why even bother brining up compromising everyone else's security just because they failed to use all their current surveillance means to detect and prevent the shooting to being with?! You want more access? Why? That's fucking unbelievable.

<comment><USER17> Probably to understand motive, and check for potential involvement of others.

And whilst they have a metric shit-ton of spying capabilities on US civilians, those are not really intended to avoid crime. (Maybe the shift of perception of what is terrorism might change that, though)

<comment><USER18> He posted a manifesto online. Think his motive was pretty clearly outlined in it.

<comment><USER19> You're thinking of mass shooting 2019/247, not mass shooting 2019/248\. (Yes, we're up to more than one a day on average now)

[https://en.m.wikipedia.org/wiki/List_of_mass_shootings_in_th...](https://en.m.wikipedia.org/wiki/List_of_mass_shootings_in_the_United_States_in_2019)

<comment><USER20> This list gives me shivers...is the USA a scary, uncivilized country?

<comment><USER21> Yes, _and it always has been._ The murder rate per capita in the US has consistently been 5-10x higher than in Europe _for the entire 20th century._ Long before gun control, social safety nets, the drug war, or any other difference you might want to blame. The US is a low cohesion, high violence society.

<comment><USER16> As someone who grew up in the US, lived in the EU, Australia and NZ for a number of years, I can say on a day to day basis, it's still pretty much nothing.

The average American rarely ever has to directly confront violence. I've even spent years in major metropolitan areas and the majority of people don't walk around each day anticipating violence. My sister got mugged once, in our small home city, like 20 years ago. I've never personally been mugged or assaulted, but I did have one break in while in NZ (they took all my electronics) and I had a bicycle stolen in Australia.

I haven't lived in "bad parts of town" through (although friends told me I lived in a bad part of town in two places I lived in; but I really feel they were exaggerating) and in high crime areas I'm sure it's different.

But the portrayal the rest of the world sees of America is through a very limited lens. And German or Irish or Chinese person who comes to visit the US will see kids playing in parks, people in the cities walking to work or lunch, others browsing through stores or pumping petrol into their cars and it will generally looks pretty much like every other part of the mid/high income industrialized world.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> They also can't access his brain. Neither of these situations are ones I feel compelled to fix.

<comment><USER23> I think this is a great analogy and easy for the layman to understand.

<comment><USER24> I agree. BUT - the response will be: "well even if we wanted to, we don't have the technology to read his brain. we DO have the technology to read his phone, but you nerds are keeping it from us."

(Disclaimer: I don't agree with this position but I have a lot of friends who think the government can do no wrong)

<comment><USER25> And if we had the technology to read the brain we would demand to read everyones brain 24/7

</comment></comment></comment></comment><comment><USER26> Law enforcement needs to go back to old-school detective techniques if they really need that phone data. Encryption is code, code is speech. Encryption keeps banks safe from criminals.

Are we going to go through this for every administration now?

Even if you do not have a problem with giving government keys to, say, the iPhone, then you have to deal with every piece of software someone writes to enable encryption.

You'd literally have to convince every person in the world to not write or use encryption software in "the wrong" ways. And, that's impossible because encryption exists to protect society from criminals. I don't see another way around this.

<comment><USER19> "Are we going to go through this for every administration now?"

No. Nobody cares about this or that shooter (there'll be another one next week) but the next time there's a 9/11 you can be sure encryption will feature in the news and in a subsequent law.

</comment></comment><comment><USER27> "It is prudent to anticipate that a major incident may well occur at any time that will galvanize public opinion on these issues ... Whether we end up with legislation or not, the best course for everyone involved is to work soberly and in good faith together to craft appropriate solutions, rather than have outcomes dictated during a crisis." -- AG William Barr, July 23 2019

"Never let a good crisis go to waste" \-- Winston Churchill, probably

<comment><USER28> > "...best course for everyone involved is to work soberly and in good > faith..."

Well, AG Barr is probably sober. I'll give him that.

<comment><USER29> Maybe so. Except perhaps for some prescribed pharmaceuticals. Plus endogenous neurotransmitters, and chemical mediators.

</comment></comment></comment><comment><USER30> Of course. The FBI always claims this shit because in their opinion no longer having access to everyone's data is "going dark" and throughout history they have always had complete access to everyone and everything.

They don't stand here saying "we need to deal with white supremecists", they say "we need the ability to violate everyone's rights". They already have a public track record of mass illegal surveillance.

</comment><comment><USER31> "ultimately measured in a mounting number of victims — men, women and children who are the victims of crimes, crimes that could have been prevented if law enforcement had been given lawful access to encrypted evidence,"

I don't understand this. How would getting into his phone post facto stop the shooting? Do they have a time machine?

<comment><USER32> Maybe they believe that he was communicating with other people who are planning similar attacks, and they believe they could stop those attacks before they happen if they had access to the Dayton guy's phone.

</comment></comment><comment><USER33> FTA: "The cost of encryption is "ultimately measured in a mounting number of victims — men, women and children who are the victims of crimes, crimes that could have been prevented if law enforcement had been given lawful access to encrypted evidence,".

By the same reasoning, had the shooter ran away because he drove a car faster than police ones, we should ban all sports cars then?

</comment><comment><USER34> If the NSA can't keep foreign intelligence from stealing its encryption keys, how can we expect the government to protect any backdoor into our devices? I'm not willing to trade ownership of my phone and my bank accounts to the government on some promise they'll use it to keep me safe. Only an idiot would take that bargain.

</comment><comment><USER35> > FBI tells lawmakers it can't access Dayton gunman's phone

Lawmakers tell FBI it's too late the dead don't come back to life, and ask what the fuck were they all doing before the massacre given all the warning signs (regarding both the shooter and the readily availability of firearms for purchase)...

</comment><comment><USER36> I want to know what changed between 2016, when the FBI bought a tool to hack the San Bernardino shooters iPhone[1] for $900,000[2] and now — with presumably an up-to-date iPhone running 2019 iOS — that forced them to come to this conclusion.

1: [https://www.engadget.com/2016/04/07/fbi-iphone-third- party-t...](https://www.engadget.com/2016/04/07/fbi-iphone-third-party-tool/)

2: [https://www.engadget.com/2017/05/08/fbi-paid-900000-to- unloc...](https://www.engadget.com/2017/05/08/fbi-paid-900000-to-unlock-san- bernardino-iphone/)

<comment> matthew-wegner That was an iPhone 5C, which did not have a Secure Enclave. Apparently it is/was easier to image the device to brute force passcode attempts at high speed.

There are technical articles out there explaining it in more detail. On my phone now or would paste some URLs.

<comment><USER37> The apple security whitepaper is actually a decent place to start [https://www.apple.com/business/docs/site/iOS_Security_Guide....](https://www.apple.com/business/docs/site/iOS_Security_Guide.pdf)

There is also a blackhat talk from Ivan Krstic (one of the top security people at apple) where he goes surprisingly deep [https://www.youtube.com/watch?v=BLGFriOKz6U](https://www.youtube.com/watch?v=BLGFriOKz6U)

</comment></comment></comment><comment><USER38> 50 years from now: AG Joe Bare said in a speech last month that FBI couldn't access recordings of the felons thoughts because the opted out from brain chip implant; he further said that the practice of letting some individuals hiding their thoughts from authorities has a high cost of mounting number of victims, some of whom are kids. He added that the 1st amendment gives far too much freedom and needs to be rethought in the changed society.

</comment><comment><USER39> this will escalate quickly. figure 5 years or fewer until we see laws that have insanely harsh penalties (20 years in prison) for using non-backdoored encryption.

</comment><comment><USER40> Here we go again.

This will not work for many reasons, most importantly:

\- Key escrow or government-enabled crypto doesn't work

\- Creating classes of encryption doesn't work (Excluding a group and not allowing them to use the same crypto as another group)

\- If someone is going to do something unlawful, they will use something else that isn't accessible by the government; take away phone encryption and they will simply use something else

Unless those points are solved, the whole 'should we allow it' discussion is pointless anyway.

Tacking on to that: most of that stuff doesn't work because you can't really physically enforce it; it's an intellectual barrier which due to the way we can simply talk to each other as humans is super easy to circumvent. This was tried with export controls, but that didn't actually work for the information itself; only for commercial products.

</comment><comment><USER41> Is the argument that, without access to his phone, they can't stop this guy from killing more people?

Is it that they need the phone to tell them that white supremacy and assault rifles are things that exist in the US?

Do they need the phone data for a conviction?

I don't understand what they expect to do with whatever they find that they can't get from other sources.

They can get location history and a pretty good idea what and who he communicated with from ISP and cell logs, etc.

<comment><USER42> The Dayton shooter was not a white supremacist. He was Antifa affiliated.

</comment></comment><comment><USER43> To reframe the common argument against banning guns: when u ban encryption, only criminals, computer geeks, and mathematicians will have encryption.

</comment><comment><USER44> If they got access but don't find anything of interest, it's of no use to them to let folks know they can access the phone. It will only make the paranoid more paranoid.

Access to the phone I think is overrated. Getting access to social media accounts, email accounts, text message, chatting apps, and cloud backup probably gives them more than 80% of what they need.

</comment><comment><USER45> Seems like the EFF's analysis from when this happened last time is still relevant.

[https://www.eff.org/deeplinks/2018/04/fbi-could-have- gotten-...](https://www.eff.org/deeplinks/2018/04/fbi-could-have-gotten-san- bernardino-shooters-iphone-leadership-didnt-say)

</comment><comment><USER46> I take it that without the phone data they can't prove that the "suspected gunman" was the person who committed the crime? Perhaps the next suspected gunman will destroy his phone before the crime, or maybe not own one in the first place, so perhaps destroying or not owning phones needs to be made illegal.

</comment><comment><USER47> There was just a thread on here about the attack surfaces of an iPhone. While the article didn't mention the brand of phone one wonders if it's possible to access the phone or at least plant phone unlocking malware via an sms or mms message.

</comment><comment><USER48> Why is this even an FBI case? What exactly makes this an FBI case? Why we want this to be an FBI case?

I don't know much about American law. I was under impression that things are reserved to states unless important reason for them to be handled on federal level.

<comment> kube-system Terrorism is in the FBI's jurisdiction to investigate, so it makes sense they would be involved to determine whether or not terrorism was involved.

It also appears some federal legislation has been passed that directs the FBI to provide assistance to state authorities in this cases:

[https://www.fbi.gov/about/partnerships/office-of-partner- eng...](https://www.fbi.gov/about/partnerships/office-of-partner- engagement/active-shooter-resources)

</comment></comment><comment><USER49> I'm curious about Macs. If I have Firmware Password and FileVault enabled, is it same FBI-proof as iPhone? Does T1 and T2 chips or absent Tx chip (older Macs) make difference? Is storing FileVault unlock key in iCloud makes difference?

<comment><USER50> I'm not sure how FileVault is implemented, but so long as your key is derived solely from your passphrase and not stored outside your brain (iCloud can be subpoenaed) the strength of your encryption should be proportional to the strength of your passphrase. Computers have less of a reason to use the baked- in CPU or security chip data in deriving the encryption key because longer passwords are more feasible on a laptop than a phone, so brute force attacks are already not likely to succeed.

The only difference I can think of is the ease of an offline brute force attack due to the fact that you can remove a hard drive somewhat easily and then image it and use an entire datacenter's power at attacking the passphrase. But a strong passphrase (note, not a pass _word_ ) stored only in your head should be quite secure.

<comment><USER49> FileVault 2 Recovery key is 120 bit, I guess not feasible to bruteforce? Actual low level key is 256-bit XTS-AES. Still unsure what is the process of converting typed login password to low level key.

</comment></comment></comment><comment><USER51> Yes, that encryption on phones is really a big problem.

No, definitely not the easy access to military weapons for any disillusioned nutjob. That's nothing to worry about. Move along, nothing to see here.

</comment><comment><USER52> Okay, good. I'm glad that we've now tested out the security of our devices and found that they are secure enough to vex government entities.

<comment><USER53> _Some_ government entities.

As with all strategic information, they could still possess the ability to backdoor / crack this phone but deem that ability a strategic asset. Only using it in private or when the stakes are much higher than an already committed crime.

</comment></comment><comment><USER54> This is maybe the only response to a heinous act like a mass shooting that is more despicable and pathetic than wrapping an event like this around a politically charged baseball bat.

More so than even using this event to claim that "guns are the problem" or the sole factor in this issue.

We all know the FBI can access the information on this phone, they're just playing into the hands of emotional trauma and emotionally driven people who are ill informed to de-value the perceived sanctity of privacy and data security...

</comment><comment><USER55> Lies: [https://graykey.grayshift.com/](https://graykey.grayshift.com/)

</comment><comment><USER56> Now imagine if the gunman had been complaining about restricted access to guns...

That would have been a more suitable situation, I'm sure.

</comment><comment><USER57> If there was such a thing like gun control they wouldn't need to access his phone. Just restrict access to guns.

<comment><USER58> It is politically more feasible to ban encryption in the US than it is to ban guns (or even significantly restrict them).

Wait, I'm wrong. Even essentially _insignificant_ changes to gun laws at the federal level are harder than banning crypto.

<comment><USER59> Can you please elaborate on why guns are so sacred in the US? Is it for cultural/historical reasons?

<comment><USER8> Roughly 30% of the population owns guns, and has everyday experience with people owning assault rifles who aren't a harm to anyone. The gun culture is the locus of a lot of important values in the US -- service to the country, acceptance of danger, self control, precise and accountable behaviour -- and gun owners are overall more law abiding than the general population. Gun owners haven't done anything wrong and don't see why they need to be punished.

<comment><USER57> So gun owners feel punished when their guns are taken away, and they feel this punishment is more severe than all the lives that are taken away because of mass shootings? And all the families that are ripped apart? If my 'right' harms so many people, I would not even want that 'right' in the first place. Guns perhaps made sense in an era where you had to protect yourself agains outlaws. Now we have governments to take take care of your daily security. Now the freely available guns don't make any sense at all.

<comment><USER8> Guns don't need to make sense -- in a free country people don't need to justify their actions. Rather, the government needs to be able to justify its policies -- we need to be able to show that the trouble and expense we are putting people to makes a real difference.

 _So gun owners feel punished when their guns are taken away, and they feel this punishment is more severe than all the lives that are taken away because of mass shootings?_

The underlying thinking here is a kind of collective punishment trading or social bargaining; but that's not generally how regulating dangerous stuff works. There are lots of things that kill comparable numbers of people to guns. Do I need to list them? Generally with things that most people use safely but some people use in a way that gets them or others killed, we don't try to ban them but instead we:

(a) Criminalise misuse adjacent to death based on data (not based on emotion or intuition about what seems "dangerous" to uninformed people). For example, criminalising drunk driving because although it doesn't always kill people, it certainly kills them all out of proportion to other driving.

(b) Introduce restrictions in venue that are conducive to safety.

(c) Try to educate the public and post warnings.

(d) Opportunistically encourage people to delegate responsibility to make things safer, even if we don't change their rights overall. For example, Uber seems to reduce drunk driving deaths; but that was not accomplished by either taking people's cars away or preventing them from drinking.

With regards to guns, there simply is no data to support the idea that assault rifles are more deadly than other weapons; or that other things which leftists oppose -- open carry, 30 round magazines -- lead to much change in the overall rate of gun deaths. Banning these kind of things makes about as much sense as banning liquor that's "too strong" because you tried it and "no sane person would like it".

Rifles are rarely a cause of murder, suicide or accidental death. Yes, they are used in mass shootings -- they aren't used in much else. Do you know how rare mass shootings actually are, and how small a cause of death mass shootings actually are? If we took the same approach to other small causes of death as you are proposing taking with regards to assault rifles, what are the policies we might have?

What definition of mass shootings are you actually using? How frequently are assault rifles used in them? There is a lot of variation in the way they are counted so it's hard to talk about the real impact of what you're proposing.

</comment></comment></comment></comment></comment></comment><comment><USER60> Does that even make sense from a technical perspective? They are talking about a PIN code to unlock the phone to access the data on the phone. Could they not just remove the memory chip and access it directly? Even if the data on it is encrypted using a 6-digit PIN, brute-forcing that should be a trivial task.

<comment><USER61> If it's an iPhone, the data is encrypted with a key derived from the PIN and a random key that is baked into the phone's CPU. The CPU has instructions for encrypting and decrypting with this secret key but no instruction for reading the key directly. Short of decapping the chip and going in with an electron microscope to figure out what this key is, your only option is to brute force on the phone's own CPU. But that CPU won't run software that isn't signed by the manufacturer, and that software imposes ever-increasing timeouts when unlock attempts fail.

<comment><USER62> So why don't they decap the chip and go in with an electron microscope? Has that type of exploit ever been successfully used against modern devices, or is it only a theoretical vulnerability?

<comment><USER63> Because it's highly unlikely to work in the first place, not to mention likely cost as much as their annual operating budget.

<comment> kube-system Mostly the former. There's nothing expensive about decapping a chip and tossing it under an electron microscope.

<comment><USER61> How much time and effort would it take to go from a chip under an electron microscope to the embedded crypto key, though? Seems like a substantial reverse engineering effort. (Although only for the first time you do a particular type of chip.)

<comment><USER63> An electron microscope alone won't work not to mention you have a high likelihood of damaging to chip as the voltage of the electrons deposited on the sample can exceed what the IC can tolerate.

You need a cryo probing station of some sort I'm not sure if these even exist for 12/10/7nm logic yet.

</comment></comment></comment></comment></comment></comment></comment><comment><USER49> Must be iPhone then, not Android.

</comment><comment><USER35> > _In the US, there are more firearms than people. About one-third of all > households have at least one firearm_

Nothing than

1) a total banning of sales,

2) a law that requires existing owners to return them for destruction,

3) 5 years jail minimum time for anybody even seen with one (and 20 years if they were involved in any criminal act while carrying it, regardless of the act),

4) and a mass confiscation campaign can't fix...

<comment><USER64> Basically mass incarnation?

<comment><USER65> 9HZZRfNlpR says> "Basically mass incarnation?"

"mass incarnation"?

Like

[https://www.bing.com/th?id=OIP.dL31G5Y3BQIg5Xv075saegHaHa&pi...](https://www.bing.com/th?id=OIP.dL31G5Y3BQIg5Xv075saegHaHa&pid=Api&rs=1)

??

Is this some new Internet meme (e.g., "spam") that I missed?

<comment><USER35> Obviously means "mass incarceration" (throwing everybody to jail).

</comment></comment></comment></comment><comment><USER66> dead people is... the worst... arguing that we should give up freedom is bad... what, do we do here?

<comment><USER8> If there were clear and transparent -- like public -- procedures -- by which the FBI could get into an iPhone, it might be alright. Say that if they broke into the iPhone it was indelibly marked -- it flipped a flag in the hardware and there was no way to disguise it, and the OS would broadcast it over the web and over BlueTooth and WiFi, making it easy to provide tools that caught the message and published it. Then people lose their privacy, but only if the government is willing to defend in a credible way the necessity of it.

<comment><USER67> No, it's not alright. I'm sick of giving up freedoms every time some violent psycho/group of psychos decided to commit more violence.

<comment><USER68> Other than all the other psychos who kill a lot more people but are considered legitimate in their doings... We need more access to their information, drug companies making opiates that kill tens of thousands, various other corporations, various world leaders... etc. If we can tolerate them, then we can tolerate your run of the mill psycho doing things now and then and usually immediately being stopped from doing anything else.

<comment><USER69> Please try to use a different example. I have CRPS, the most painful disease known to man, and have not been prescribed any analgesics two years in because of fear around opioids. You might think you're excluding my ilk when examples like this are used but you're not in practice...Just trading tragedy you know for tragedy I hope you never learn about. Almost exactly like the freedom from unreasonable searches. Ty

</comment></comment></comment></comment></comment><comment><USER70> This is all a pony show - the fusion centers absolutely have access to everything on your phone at any given time.</comment>


Travis Kalanick is joining the real estate startup City Storage Systems as CEO - mark-ruwt https://www.recode.net/2018/3/20/17145032/travis-kalanick-uber-new-job-ceo-real-estate-startup-city-storage-systems <comment><AUTHOR> Is this a startup or just an old-school company rebranded as a startup? Couldn't find a website for them (unless it's storage racks).</comment>


CoreRT – A .NET Runtime for AOT - <AUTHOR> http://www.mattwarren.org/2018/06/07/CoreRT-.NET-Runtime-for-AOT/ <comment><USER2> I think it is really cool how much of the CoreRT is written in C#. Garbage collection and stack frame walking are implemented, but most everything else is C#, including exception dispatch:

[https://github.com/dotnet/corert/blob/master/src/Runtime.Bas...](https://github.com/dotnet/corert/blob/master/src/Runtime.Base/src/System/Runtime/ExceptionHandling.cs)

and type-casting:

[https://github.com/dotnet/corert/blob/master/src/Runtime.Bas...](https://github.com/dotnet/corert/blob/master/src/Runtime.Base/src/System/Runtime/TypeCast.cs)

<comment><AUTHOR> Yeah, that's what impressed me as well!

Turns out that even more components could be written in C#, but the ROI just isn't worth it, see [https://github.com/dotnet/coreclr/issues/17576](https://github.com/dotnet/coreclr/issues/17576) for an interesting discussion

</comment></comment><comment><USER3> quick unrelated show of hands - who here uses .NET for their after hour / geeking session / projects?

I know .NET quite well, I've used it a lot in enterprise, but I just never find it to be my go-to language. It just feels like work, it doesn't feel fun.

I usually end up with nodejs, nim, or even pascal.

<comment><USER4> I find development "speed" to be directly correlated to happiness in side projects, as in getting things done quickly.

So with that in mind, C# with the right IDE (VS + Resharper, or Rider) is faster to write than anything else I've ever used and makes working on projects incredibly nice. Add in the solid standard libraries and the ability to make everything from websites to desktop apps in the same language and it's the best choice around, for both work and play.

<comment><USER5> I can recommend getting a a licensed copy of LINQPad. It's a brilliant tool for trying out ideas and prototyping.

<comment><USER6> I love LINQPad. This tool alone is a huge reason why I have a problem using my Macbook for .NET development.

</comment></comment></comment></comment><comment><USER7> If the compiler does tree-shaking, I wonder why it takes ~4 MB just to print a message on the console using the standard library. Is there any way to do a more fine-grained breakdown of where all that code is coming from?

<comment><USER8> They are big leaves/fruit and there are only about 30(?) or so of them.

There is no easy way that I'm aware of. IIRC, early versions of this included the entire framework, so it's gotten a lot better.

<comment><AUTHOR> > They are big leaves/fruit and there are only about 30(?) or so of them.

Ah, yeah that makes sense, I'd not thought about it like that.

> IIRC, early versions of this included the entire framework, so it's gotten a > lot better

Yeah, they're definitely improving things over time

</comment></comment></comment><comment><USER9> As I understand it, this paves the way for .NET based wasm implementations. Exciting stuff!

<comment><USER10> .NET already runs on WASM, see: [https://github.com/aspnet/Blazor](https://github.com/aspnet/Blazor)

Although I personally don't think it's a good idea to build HTML UI's with C#, which adds overhead + friction.

<comment><USER11> Blazor currently runs on Mono. CoreRT might allow it to run on .net core

<comment><USER10> The important part is that it's AOT compiled into WASM so it can run in the browser which is what you can do now with Blazor.

<comment><USER12> no, blazor uses a Mono version that interprets at runtime .NET. AOT is in the pipeline though

</comment></comment></comment></comment></comment><comment><USER13> Alright, so here is the big question since ILASM is so powerful really and .NET Native can potentially reduce the footprint here...What would be the strategy for a bespoke native CoreFX? The mscorlib/System.Private.CoreLib issue is that for new platforms it needs to be built PE agnostic temporarily. PAL needs a placeholder platform to get itself created. CoreCLR is great but a huge moving target which receives updates at such a furious pace- well imagine trying to contain dynamite in a closed fist. Actually, mad props to MS and the open source community for actually making this so solid on a consistent basis! So, CoreFX needs a seed CLI distributed platform specific. CoreRT may have the answer to this and really interested in what happens next. You see I wonder with this platform sharing if a CoreFX could be potentially created with CoreRT _first_ and then backtrack into a full platform? We'll see- I'm glad this was shared here on HN also gives me a lot of hope for C#.

</comment><comment><USER14> Waiting for the day to use CoreRT with ASP.NET.

<comment><USER15> You can with aspnet core. Bit tricky tracking down all the reflection types in the rd.xml file, but once done it results in a really nice, zippy little deployment

<comment><USER14> Are there any tutorials for this? I would love to learn more.

<comment><AUTHOR> I'd start with the WebAPI sample and it's rd.xml file, see [https://github.com/dotnet/corert/blob/master/samples/WebApi](https://github.com/dotnet/corert/blob/master/samples/WebApi)

Also take a look at this project [https://github.com/shtik/cli/tree/dev/src/slidey](https://github.com/shtik/cli/tree/dev/src/slidey), AFAIK it's the project that inspired the video I embedded in the post</comment></comment></comment></comment>


Poll: Do you think it is a good time to answer polls? - <AUTHOR>

<comment><AUTHOR> Well, now that you make me think... uh.... I guess not?? ... This just popped into my mind: "They might find sort of interesting to profile our life details out... these days... After all we are just the ones who have the mental & physical tools to turn their things upside down and less importantly to make all other people aware... ... Yeah now that you make me think, I find I am asking myself... 'If you were them and would like to maintain your dominant position, wouldn't you hunt us first?' ... Alright, I think I might be keeping these thoughts in consideration now on... .. Hey, thanks for asking! :-) "

</comment><comment><AUTHOR> Yes, no worries, map us all, we don't share private & sensible data on FB, instead we simply wait for a HN poll, or a "rate your income based on your country" js project... Give us some nice JS fx and "We'll feel the forms" (tm).</comment>


IBM Container Service - <AUTHOR> https://console.ng.bluemix.net/#/store/cloudOEPaneId=store&serviceOfferingGuid=3a79bdf2-a8d3-4b72-b70d-db1650124c73&fromCatalog=true

<comment><AUTHOR> Hi HN,

Over the past several months, I've had the honor of working with an amazing set of people to build this service. Would love it for people to try it out, and give feedback.

I know there are videos and press releases coming out. Also, since we are just releasing the service, there might be a queue for access. You can take a look at the CLI docs until you get access. Thought the dev community would like to see more detail :)

<comment><USER2> It's an amazing accomplishment by an amazing team! Very excited for the future.</comment></comment>


Amazon Chime - <AUTHOR> https://chime.aws/ <comment><USER2> The first (and personally the only) requirement I have with any chat system is that it should _not_ modify the text I enter in any way - especially if I am pasting something.

Sometimes I have to paste a line or two of code, or a few lines of a stack trace. Sometimes I have to paste a string which contains some particular set of characters. Microsoft Lync absolutely destroys the pasted text. It subtly converts the double quotes into some unicode nonsense. Then it converts some common character sets into smilies. When you copy text from Lync it is almost always guaranteed to be different from what what entered originally. God, I hate Lync with a passion.

<comment><USER3> Microsoft had a much better chat before:

[https://en.wikipedia.org/wiki/Microsoft_Comic_Chat](https://en.wikipedia.org/wiki/Microsoft_Comic_Chat)

<comment><USER4> Not sure how the heck I am just learning about Comic Chat and thus the creation of Comic Sans

<comment><USER5> Note that Comic Sans predates Comic Chat.

</comment></comment></comment></comment><comment><USER6> I liked the part about Chime calling you at the scheduled start of meeting. So simple yet I had never thought of this since my org uses WebEx.

With a smart phone that would pretty well via a push notification or an actual call, but not sure how that would work when you want a join a meeting from a physical meeting room with its own AV system. I'm sure there is a way to get that set up.

<comment><USER7> Seemed like it was just a mobile join notification in the video similar to Skype for business or WebEx if you are using VoIP. No?

My company used WebEx and I could make it dial me and start up my conference line without having to go through all the regular pin entry stuff. Now we're using Lync (Skype for business) which is similar although tragically buggy. That can also dial me and sends notifications if you hook it up.

The key for these kind of apps is cost and reliability. Seems like they're advertising substantial cost reductions and better quality. If either one is true they'll likely make out really well.

<comment><USER8> Lync is still buggy? I haven't used it in about two years, but I'd have thought Microsoft would have solved those issues by now.

<comment><USER7> I must say I've been really disappointed with how often it crashes outright or has major rendering issues during screen sharing. When it works it's really convenient but 20% of meetings with screen share involved seem to have an issue. I really think quality is life or death for these products. If my company weren't a tight Microsoft partner I really doubt we'd be using it.

WebEx wasn't as convenient but at least it worked correctly the vast majority of the time.

<comment><USER9> > I really think quality is life or death for these products... > _If my > company weren 't a tight Microsoft partner_ I really doubt we'd be using it.

You answered yourself - no, quality is not life and death (at least not _fast_ death) for this product. :)

<comment><USER7> Ha you got me there

</comment></comment></comment></comment></comment></comment><comment><USER10> Enterprise conferencing software is so bad and so expensive I'm astonished it took this long for a decent competitor to come in. I'm really surprised Google didn't go all in with making Hangouts a decent competitor. I have a feeling this will make a lot of money.

<comment><USER11> You're right in that 99% of them are complete garbage. However I was pleasantly surprised when my company switched to Zoom[1]. A company I had never heard of before. In terms of call quality I've never experienced anything better. Beyond that their mobile experience is almost better in terms of raw features than their desktop app (which is still very good in its own right).

1.) [https://www.crunchbase.com/organization/zoom-video- communica...](https://www.crunchbase.com/organization/zoom-video- communications#/entity)

<comment><USER12> I refuse to use anything that requires proprietary plugin/app. AFAIK so far the only thing that works natively in the broswer is Hangouts.

<comment><USER13> appear.in

<comment><USER14> appear.in requires a plugin for screen sharing but otherwise, I do like it.

<comment><USER15> The plugin is dummy, required by chrome and just gives permission to share screen. Appear.in has been whitelisted on firefox and requires no plugins there.

</comment></comment></comment></comment></comment></comment><comment><USER16> Amazon acquired Biba[0], this is that product with the backend swapped out. It's currently being beta'd internally and they haven't yet added anything over Biba the product. There are some great features planned, from what I've heard.

[0] [http://www.biba.com/](http://www.biba.com/)

</comment><comment><USER17> I really do not like conference systems which do not work on Linux. Not everybody is using a Mac or Windows. Microsoft is also ignoring Skype and Skype for Business on Linux. This is all crap.

<comment><USER18> We are mostly Mac and Linux at my company.. give Zoom a shot, it's worked out well for video, audio, and sharing... (Europeans in this post have had latency issues though)

<comment><USER19> I can vouch for this, used it daily for most of last year.. And we didn't have much of any latency issues with our team in Canada and 2 others in Turkey.

<comment><USER20> same here, people from all over the globe, 30+ people on a meeting, everything just works®.

and the linux client works really well (it's on aur, if you use archlinux)

</comment></comment></comment></comment><comment><USER21> They tout security but I don't think it's open source and it looks like everything is stored on Amazon servers.

Minimally it is centralized, and you can't verify that there's no backdoor. In this day and age, that means we're both trusting their core intentions, and also trusting that some government won't step in and silently force their hand. I don't personally feel that is good enough to be considered secure anymore.

<comment><USER22> Like any other hosting, if it's in the US, it must be considered compromised in these terms. That's the world we live in now.

<comment><USER23> > Like any other hosting, if it's in the US, it must be considered compromised > in these terms.

s/, if it's in the US//

There, fixed it for you. Any data not under your control can and will be used against you, especially by a state wielding a monopoly on force.

</comment></comment></comment><comment><USER24> "With Amazon Chime, you can feel confident you're communicating securely."

This wording has always struck me as being awful. People felt confident investing with Bernie Madoff as well. I'd rather _have_ confidence from proven security instead of just _feeling_ confident.

<comment><USER25> confidence is a feeling. there's no other way to experience confidence than to feel it.

<comment><USER24> I'd word it something along the lines of: "Communicate securely with your team, confident that we've taken care of your online security via [list of reasons]". Yes, confidence is a feeling but for me it sounds better this way. Saying "you can feel confident" reads to me like "with MtGox, your funds _can_ be secure".

</comment></comment></comment><comment><USER26> Great product idea. At work we use Skype for business and it's a disaster - especially bad is it seemingly randomly says 'your device is causing poor audio quality' and mutes you. The only way to recover is to dial out and in. Before that it was the AT&T solution - such an ugly application with poor usability. If Amazon really polish this product and provide a great user experience and quality they could pick up a lot of business.

Edit: there's a problem here. Skype for business allows up to 250 participants. The AT&T solution (webex maybe) allows, I think, an unlimited number. Amazon Chime has a limit of 250 people. This wouldn't cut it for presentations in large companies e.g. announcement of annual results or divisional virtual 'town hall'

<comment><USER27> All conferenincing systems have a limit on the number of first-class participants (people who can listen and speak). Broadcast is a different problem and there are a ton of really good solutions when you have less than 250 speakers but many listeners.

There are no conferencing products, to my knowledge, that support more than 250 first-class participants over the internet in a reliable way.

If you have an example, I'd be very curious to play with that product.

<comment><USER26> So can Chime allow more than 100 listeners. I interpreted the 100 limit as a hard cut off on the number of participants irrespective of their class.

</comment></comment></comment><comment><USER28> > Amazon Chime works seamlessly across your devices.

> No Linux support

<comment><USER29> Haven't looked but probably no Windows Mobile support either. I know I'm a infinitesimal user base, but the lack of support from services makes me not use them. This is one place Slack really excels and why I hate Hangouts.

</comment></comment><comment><USER30> I'm definitely going to try this (even though unusable for us because of missing Linux support). We have currently settled on Zoom and it's okay, they do have Linux support.

One problem I have with all video conferencing solutions we've tried (same for my colleagues, all Mac or Linux users, sadly no Windows users to compare) is high CPU usage. I have a 2015 MacBook Pro and when I share my screen CPU usage skyrockets to 150-200% basically pegging the whole CPU. Without sharing my screen CPU usage is at 80-100%.

I have similar problems with certain videos on the web (e.g. Ted.com and others).

Is this something everyone else here sees as well? I always assumed they must because we see it across devices and products.

<comment><USER31> I wonder if it's a function of _what_ you're sharing? I use zoom with PowerPoint and Keynote all the time and have never had my fans spin up when sharing. Haven't noticed it sharing Safari or my whole desktop either...

As a test I'm currently on a video+computer audio+full screen sharing zoom, and my overall CPU load is at <20%, with Zoom accounting for about half of that.

<comment><USER30> That's interesting. I'm mostly sharing either Powerpoint, IntelliJ stuff or just Chrome.

I more or less can't use IntelliJ any more productively while sharing my screen because it's starved for resources.

</comment></comment></comment><comment><USER32> Their claim of "a third of the cost of traditional solutions" is an apples and oranges comparison.

The basic and plus pricing options, while cheap, are practically useless with only 2 maximum attendees and the $15/user/month pro plan is hardly "a third of the cost...".

Looks like a great product with an average price point.

<comment><USER33> I suspected they were directly challenging either WebEx or Skype for Business.

<comment><USER34> [https://products.office.com/en-us/business/compare-more- offi...](https://products.office.com/en-us/business/compare-more- office-365-for-business-plans)

Skype for Business is available in all Office 365 Business plans except the software-only one (ProPlus). That includes the $5/6 plan ([https://products.office.com/en- us/business/office-365-busine...](https://products.office.com/en- us/business/office-365-business-essentials)) as well as the $8.25/10 plan that includes all of Office.

It's not a very good competitor on that front...

</comment></comment></comment><comment><USER35> This is really cool but I wish they had more details on the Chat part of the solution. What does it look like? Can you theme it? Does it have any integrations (ala Slack)? Can you have inline pictures? Does it have a rich message API?

<comment><USER36> More importantly, does it support GIFs?

<comment><USER37> It does not. Just tried it. Displays as a static image, even when you open it in the chat window.

</comment></comment></comment><comment><USER38> > Amazon Chime is a communications service that transforms online meetings > with a secure, easy-to-use application that you can trust.

\- Amazon, _PRISM partner_

<comment><USER39> "Amazon never participated in the NSA's PRISM program." \- Stephen Schmidt, CISO @ AWS

[https://aws.amazon.com/blogs/security/privacy-and-data- secur...](https://aws.amazon.com/blogs/security/privacy-and-data-security/)

(Full disclosure: I work on AWS}.

<comment><USER40> And what do all the PRISM documents say?

You don't admit this as it's bad for business.

<comment><USER41> Amazon wasn't listed on the PRISM partners slide. What documents are you referencing?

EDIT:

General info on PRISM: [https://en.m.wikipedia.org/wiki/PRISM_(surveillance_program)](https://en.m.wikipedia.org/wiki/PRISM_\(surveillance_program\))

"PRISM Partners" slide: [https://commons.m.wikimedia.org/wiki/File:Prism_slide_5.jpg](https://commons.m.wikimedia.org/wiki/File:Prism_slide_5.jpg)

<comment><USER40> I double checked and you're right, they are not mentioned. I could have sworn they were.

I stand corrected.

</comment></comment></comment></comment></comment><comment><USER42> Not sure what the long term play for Amazon is with a WebEx competitor, something likely to do with getting enterprise business, hope it works out.

In case you hadn't seen it, this is basically the anti-marketing video for how conference calls actually work: [https://www.youtube.com/watch?v=DYu_bGbZiiQ](https://www.youtube.com/watch?v=DYu_bGbZiiQ)

</comment><comment><USER43> Everything else aside, I am surprised/impressed to see that Amazon has the '.aws' top level domain! Does that mean they will be now branding all their AWS infrastructure under this domain?

<comment><USER33> This pisses me off to no end. I hate how ICANN approved these product name, (mostly) single company TLDs! I think allowing this is terrible. I know it's just a DNS entry, but it's a fundamental change in the way we think of DNS and the Internet.

DNS should not degrade into AOL keywords!

<comment><USER44> I don't know. I agree with you on one hand. On the other hand, though, the second-level domain name that is typically up for purchase is all about branding. I have a hard time justifying treating TLD as special and distinct from the rest of the domain name.

After all, TLD is just the widest level of the hierarchy that DNS names allow. Why limit TLDs to countries if a particular organization has grown large enough to benefit from it, and wants to pay for it?

</comment></comment></comment><comment><USER45> Are they competing with WebEx, Skype, or Slack? Looks like a compelling B2B offering from Amazon. I bet they'll have an accompanying hardware to go with this in the coming months.

<comment> m-app Looks to me a bit more akin to Cisco's Spark, although without the video endpoints, digital whiteboard and end-to-end security.

[https://www.ciscospark.com/products/overview.html](https://www.ciscospark.com/products/overview.html)

D: I work at Cisco and use Spark daily.

<comment><USER46> so cisco employees don't use webex? no wonder it sucks ...

</comment></comment></comment><comment><USER47> We use Zoom at Userify and love it. Fantastic Linux client, too. However, it automatically calling me (and saving me time auto-dialing auth codes) would be a pretty nice feature.

</comment><comment><USER48> So, no video conferencing in basic/plus plan (1:1 doesn't count). It's funny how many attempts there are at making conferencing software that just have audio and some basic chat.

Entry level needs video, since you can get it for free elsewhere (i.e. hangouts).

<comment><USER49> Not a bad idea. Have a poorer quality (free) version and then offer an upgrade to a higher quality stream.

</comment></comment><comment><USER50> Amazon's horizontal expansion is pretty fascinating. From an online stores and cloud service provider to consumer products and now b2b apps.

</comment><comment><USER51> ...application available for Android, iOS, Mac, and Windows

Why not Linux?

<comment><USER52> Probably because they crunched the numbers and came to the conclusion that the potential revenue didn't justify the development costs.

<comment><USER53> Don't overlook that a team might keep using something else because they need to make a conf call between 3 Macs, 1 Windows and 1 Linux (a case with a customer of mine).

</comment></comment></comment><comment><USER54> I absolutely love the startupish way aws launches new services. They have the whole "landing page" and marketing pitch class A, but the product is alpha if being nice.

There's long, long way to go for this thing to compete with hangout, zoom, or anything else out there.

Source: I've just tried it out, chatting with myself on native app + 2 browsers.

</comment><comment><USER55> No screenshots of the product?

</comment><comment><USER56> Does this feature end-to-end encryption?

<comment><USER52> I don't believe so. If you look under the FAQs and the "Security and Control" heading of the Features page, there is no mention of encryption beyond AES-256. Companies offering E2E typically like to highlight that somewhere, even in a non-technical way.

Furthermore, the security is apparently "fully managed", which to me translates to "keys securely stored on our servers, not client-side."

</comment></comment><comment><USER57> No Linux client? What's the advantage over WebEx then?

Both hangout and zoom can do Linux, but they aren't seen as corporate as WebEx.

</comment><comment><USER58> Speaking of.. can Slack hurry up and buy Zoom? Aren't they pretty flush with cash? It seems crazy that they are letting this huge market (where they have a foothold) slip away to new competitors.

<comment><USER59> A better question would be: How long until AWS has a Slack competitor? That natively integrates with the entire AWS stack?

<comment><USER60> That's what I figured this was, before I read what it did. Someone will come up with a decent competitor one day.

<comment><USER61> The page claims it has chat and can replace your entire communications stack. Curious to see how it executes on that.

</comment></comment></comment></comment><comment><USER62> I clicked through, and was accosted with a gigantic video. I wanted to close the tab right there, but I've seen this before, so I scrolled down to make the giant video go away. No dice, _every_ single page element dances and animates and moves, and there don't seem to be any static images on the whole page. I can't scroll to a single position to read the actual text without some large part of my monitor animating in a suitably distracting fashion.

Why. Just... why? Why is this necessary?

<comment><USER63> You instantly see what the product is good for. It's something many startups fail at. If you are really interested you will endure a lot to get it.

</comment></comment><comment><USER64> This looks awesome; I'm regularly told that Amazon is a horrendous place to work yet they seem to be producing great software and interesting startup type concepts all the while. Not sure how they do it? AWS is a bit of a mess, maybe it's just there that is problematic...

<comment><USER33> There are good people everywhere. There are also terrible people in every business. The best people tend to not care about money and leave to go work as paramedics or line cooks or attempt a startup .. and then end up back in software after a year or two. One day we'll get out of here.

</comment></comment><comment><USER65> How do they authenticate who they are when they call you? I've gotten bogus calls before from "the credit card company", so there needs to be a way to be certain you're talking to the right people.

<comment><USER66> I think it's the app "calling you", not an actual phone call.

<comment><USER65> Okay, that makes sense, wasn't completely clear from the video.

Still, they would need to somehow verify it's the right conference call, and not one set up by a phisher.

<comment><USER67> If it's anything like Slack, the call can only originate from within the application (which is isolated to the single business), so there is no chance for outside calls.

</comment></comment></comment></comment><comment><USER68> Someone please do what you say and make one that's clearly better than all the other shitty dwarves out there today so the industry can standardize.

"Should we call, or Go to Meeting, or Google Hangout, or Skype, or Lifesize, or Slack, or Adobe Connect, or Zoom, or WebEx, or Chime, or..." It's getting ridiculous.

For new services: Please don't be based in the US or willing to cooperate with the US Government. Remember, "We don't snitch!" is an excellent marketing line -- I'll give you money for that. I don't trust Amazon or any of these at present.

</comment><comment><USER69> This is the first time that I've heard Amazon really call out AWS as a name brand in a non aws-dashboard oriented product (maybe they have already in the past?) Are Chime user identities AWS IAM users under the hood?

AWS as a more consumer-facing platform probably has a long climb ahead of it but it could be quite helpful for Amazon to differentiate from their many product misses released under the Amazon name.

</comment><comment><USER70> I don't know how any of these could compete with Zoom, in terms of their offerings. Perhaps Zoom just doesn't have enough of a big name branding push, otherwise, it is hands down a product one should use over any other. I am a free-user of Zoom and I have explored many others out there; there's just no one who come close to Zoom's offerings.

</comment><comment><USER71> For those who tried screensharing, does it have a pointing-feature (i.e. viewer can point to something)? There's so many products out there like Skype and Hangout that don't support it and I don't understand why not, it seems pretty basic to me (just only show the arrow on platforms that support it, i.e. OSX, Windows and Linux).

</comment><comment><USER72> Super expensive dial-in rates. $0.214 per minute in India is basically twice the ISD calling rate.

<comment><USER73> For some reason they only have toll-free for India, which explains the cost, I guess. (Still seems pretty high.)

[https://chime.aws/dialinnumbers/](https://chime.aws/dialinnumbers/)

</comment></comment><comment><USER74> Wondering if you have a Plus account and setup a call if you then have remote access, group chat etc - a little unclear what happens between Plus and Basic user. if all users need to be Plus then can see this being a problem.

</comment><comment><USER75> Only amazon would reveal a product without including any screenshots or details.

</comment><comment><USER76> I'm really curious how this all-in-one concept will compare to the Slack approach of chat as the central functionality augmented by a bunch of integrations with external services.

</comment><comment> tea-flow My Amazon login doesn't work. Is anyone else experiencing this issue? I just logged in on Amazon.com just fine using the same credentials (I use a PW manager). Thanks in advance.

</comment><comment><USER77> While we're on the topic of conferencing software, is there a List for Software to use when you want 4k/30p or 1080/60p?

Skype seems to not be up to the task. Our Gbit Connection is.

<comment><USER78> Have you tried Slack video?

<comment><USER77> That's only 1on1 for now. We need at least 3 people (more often 5) in a video conference.

</comment></comment></comment><comment><USER79> Screen sharing not being available for free is going to make us skip the free trial. We have plenty of options for voice and chat. And video just isn't that important to my teams. Screen sharing, however, is vital. And we are willing to pay, but as long as hangouts works for free, why pay?

I know everyone says hangouts is dead and Google isn't putting much work into it. But it does work. And unless they actually shut it down, it gives us what we need. Free. We don't use it for large webinars or anything, and it has its flaws, but... free. That is a really hard point to beat.

</comment><comment><USER80> I'm so sick of proprietary walled garden messaging systems. So now I need slack, chime, skype, hangouts, imessage, allo, facebook, etc depending on who I want to talk to.

</comment><comment><USER81> Interesting that you pay per user per month. I wonder how it works for occasional and one-off users.

Eg if you want a vendor to join your team's chat or you use it to talk to clients.

<comment><USER31> With most (all?) of these conferencing, the host is the one that has to have an account and pay - otherwise nobody would be able to use them for support, sales calls, etc.

</comment></comment><comment><USER82> One thing I'd like to hear the official policy on is message privacy (i.e. is management reading your stuff?).

That's a personal concern I have with slack.

</comment><comment><USER83> Plus plan: $2.50 per user, maximum 2 attendees - seriously, $125/mo for 50 users? I think they missed the mark.

Join.me: 50 meeting participants, $22/mo.

<comment><USER73> No, "user" means someone who can initiate meetings. The Pro Plan ($15/m) allows up to 100 attendees per meeting. So twice the limit and 30% cheaper :-)

</comment></comment><comment><USER84> The Chime app for Android is very invasive. Instead of asking for permissions as they are needed it asks you to give up everything immediately.

</comment><comment><USER85> No linux support?

</comment><comment><USER86> So this is basically what lifesize.com has been providing for ages, sans the Linux support. Truly revolutionary I guess.

<comment><USER87> From my own experience lifesize voice and video quality is so awful that anything from an egineering company should be superior. Also the stability of the lifesize appliance is horrible. Often enough we've to reboot them before every meeting, because the microphone went dead again. The only positive point is that it works with Chromium on Linux including the window sharing extension. I hope it's of slightly better quality then webex. But I fear that is overly optimistic at least.

On the other hand Google Hangouts is for free, has from my experience a better quality and all of them ship your data to the US. If amazon offers something similar they and can offer an option that keeps your data in Europe that would be an interesting option.

</comment></comment><comment><USER88> Zoom competitor?

</comment><comment><USER89> I see Amazon making a successful social network faster than Facebook making a successful market place.

</comment><comment><USER90> Is Chime based on WebRTC in any way?

<comment><USER91> Found in Chime MacOS 3rd party licence :

      ** WebRTC; version 90 -- https://webrtc.org/
        Copyright (c) 2011, The WebRTC project authors. All rights reserved.

</comment></comment><comment><USER92> I hope they don't get in the habbit of releasing -ime products. Wow that's old already

</comment><comment><USER93> As the guy who has owned chime.tv for well over a decade, this is a bit concerning IP-wise.

<comment><USER94> Instead of a chime, you should be hearing a cha-ching!

<comment><USER95> Yes, proceeded by a bang of the gavel. Kidding, kinda.

</comment></comment></comment><comment><USER96> A new player in the area! Is this the first Amazon enterprise service not for developers?

<comment><USER97> They have a online email interface and a virtual workstation solution also targeted at enterprises.

</comment></comment><comment><USER98> I noticed that this is from AWS. Is this the first SaaS application coming from AWS?

<comment><USER99> Amazon already has WorkDocs and WorkMail in the business productivity segment: [https://aws.amazon.com/products/?nc2=h_l3_bu](https://aws.amazon.com/products/?nc2=h_l3_bu) (couldn't find a better page with the list)

I guess some of the other services in AWS could be considered as SaaS?

<comment><USER100> I would add QuickSight to that list [https://quicksight.aws/](https://quicksight.aws/)

</comment></comment></comment><comment><USER101> Appear.in can't be beat.

<comment><USER102> Agree it's great for small meetings (2-3 people). P2P without any server in between, works as good as your connection.

One thing that bugs me though is using it in Chrome in Mac. 50% of the times the microphone doesn't work and I have to kill coreaudiod and restart the session. I came to a point where I do it before I start a meeting just in case.

It's not appear.in problem though, it happens in Hangouts in Chrome as well

</comment></comment><comment><USER103> > ... transforms online meetings ...

(has no mention of collaborative white-boarding)

<comment><USER104> you can check out Acrossio for a new experience with recording and bookmarking during the meeting! www.acrossio.com

</comment></comment><comment><USER105> UI Seems to be inspired from goto meeting.

</comment><comment><USER106> No screenshots?

</comment><comment><USER107> Not sure if more impressed with the product or use of a TLD of .aws

<comment><USER108> Go with the product. ICANN making dumb decisions isn't impressive.

<comment><USER95> Is it a dumb decision, or a corrupt/biased one?

<comment><USER33> Yes, yes and yes.

</comment></comment></comment></comment><comment><USER60> "Meetings call you" is a good idea, as is the reconnecting stuff. Who knows if anyone will use this, but even with all the supply in this market, there is still space for something that actually works well. As someone who works remotely I can't wait until this gets figured out.

</comment><comment><USER109> No Linux. Buh-Bye

<comment><USER110> Why is this surprising ? Just get it for iOS

</comment></comment><comment><USER111> I didn't know there was a .aws tld..

</comment><comment><USER78> How did they get that TLD .aws?

<comment><USER112> By asking ICANN: [https://newgtlds.icann.org/en/applicants/global- support/faqs...](https://newgtlds.icann.org/en/applicants/global- support/faqs/faqs-en)

</comment></comment><comment><USER113> For simple and secure meetings, We should give Amazon chime a try.

</comment><comment><USER114> In soviet Russia...

</comment><comment> happy-go-lucky No wonder Amazon is the most innovative company of 2017.

[https://www.fastcompany.com/3067455/most-innovative- companie...](https://www.fastcompany.com/3067455/most-innovative- companies/why-amazon-is-the-worlds-most-innovative-company-of-2017)</comment>


Getting a Program Right (1) - <AUTHOR> https://cacm.acm.org/blogs/blog-cacm/242967-getting-a-program-right-1/fulltext <comment><USER2> Unfortunately, I've seen this example before and already know the answer. It comes down to this:

> To justif a yes answer we need to provide a credible argument that for every > t and x the program sets Result as it should.

Is there a "reasonable" t or x which breaks the program? We can write test cases all day and never really discover what "t" actually breaks the program.

Now spoiler alert: here's the answer. Overflow when t is large, such as a 16GB array with 32-bit integers. At ~4-billion items, the m := (i + j) // 2 does NOT result in a binary-search step correctly.

Lets say i is 2-billion, and j is 4-billion. m = 2-billion + 4 billion == 6-billion, but this overflows to ~2-billion or so. As a result, m = (2 billion + 4 billion) // 2, with 32-bit integer math, results in 1-billion.

For all array sizes less than 2-billion numbers, I expect the code laid out in the example here to be correct. But in the obscure ~2+ Billion sized array case, you get overflow error.

\</comment><comment></comment><comment></comment><comment>

Understanding this example is to understand bugs: how and why they form. A "bug" works in the exceptionally common case (say, all array sizes less than 2-billion), until decades later, 16GBs of RAM becomes common and people start to actually run into the bug in practice.

Similarly, most of the code we write is implicitly fragile, even if well tested. There may be a time, sometime in the future, where the use case assumptions no longer hold (ie: it becomes reasonable to assume 4GBs or more of RAM on one computer) and suddenly the bug appears.

<comment><USER3> The specification of the problem doesn't say anything about integer size, wrap-around, and the like, so we should assume that they mean 'mathematical integer' when they say 'integer'

One can easily hit a bug in that code for small arrays, even for an array with only 2 elements.

There also is an edge condition bug for an array of size zero.</comment></comment>


Bitcoin Available at 10,000 Indomaret Stores in Indonesia - <AUTHOR> http://www.coinsetter.com/bitcoin-news/2014/09/03/bitcoin-available-at-10000-indomaret-stores-in-indonesia-1455 <comment><USER2> I'm living in Indonesia currently and I haven't seen anything being sold in bitcoin or any bitcoin-related advertising anywhere.

This also seems like a big drawback:

"There is currently no offline way to purchase Bitcoin through the Indomaret stores, however, since the users will need to log into their accounts and get a code."

That said, it's interesting how many essential services are a la carte here. You buy phone minutes by finding pretty much any seller on the street, handing them some cash, and they punch in some codes into their phone for you. You then use your phone minutes ("pulsa") to buy other phone credits (different tiers of 3G service, text service, etc). When your power goes out you wander down to the market and give them cash and your meter number.

This is probably a byproduct of a lack of banking and consumer credit infrastructure for most people here. Can bitcoin / other cryptocurrencies change that? I'm skeptical because bitcoin/etc don't solve the consumer credit problem. And if someone's going to go through the ropes to set up an account on a bitcoin wallet service and deposit money into it at the market, they're also likely to be able to do the same with a banking service.

So there's the credit problem (everything must be paid up front) but then there's the deposit problem. If the phone company or the electrical company just had my <whatever> ID and could withdraw from it, I wouldn't have to pay them every time the thing ran out. And I'm not really sure bitcoin/etc really solves the deposit problem here, either.

<comment><USER3> > bitcoin/etc don't solve the consumer credit problem.

True. Bitcoin should be compared to debit cards instead of credit cards. It isn't a credit-based system. The things Bitcoin is good for though (in its current stage) are more specialized, like paying someone the equivalent of $5 in Nicaragua.

> And if someone's going to go through the ropes to set up an account on a > bitcoin wallet service and deposit money into it at the market, they're also > likely to be able to do the same with a banking service.

Bitcoin wallets are far easier to create than bank accounts. It's by design that so few people in the world have a bank account, but anyone with an internet connection can get a Bitcoin wallet.

<comment><USER4> > Bitcoin wallets are far easier to create than bank accounts.

That might be so, but transferring real-world money into one (a requirement until value stabilizes †) is not nearly as simple.

> It's by design that so few people in the world have a bank account, but > anyone with an internet connection can get a Bitcoin wallet.

This reads a little funny when you remember that far fewer people in the world have a Bitcoin wallet. Could this be a mere matter of implementation of the design?

† IDR-USD moved 1.6% in the past month, Bitcoin-USD moved 19%

<comment><USER5> > far fewer people in the world have a Bitcoin wallet. Could this be a mere > matter of implementation of the design?

imho it has more to do with the fact that banks have been around for hundreds of years and Bitcoin is brand new.

<comment><USER4> What is the rate of Bitcoin wallet creation, compared with rate of de- unbanking?

<comment><USER6> That sounds like a fair question but could equally be disingenuous.

Is the rate of lack of use of bank accounts ever likely to be public knowledge? There's zero incentive on the banks' side to publicise that kind of information.

If it's not publicly available then your question sounds quite loaded.

<comment><USER4> > Is the rate of lack of use of bank accounts ever likely to be public > knowledge? There's zero incentive on the banks' side to publicise that kind > of information.

Public authorities can estimate this (FDIC in the U.S. has done so) and general trends should be evident (if half of previously unbanked Indians get bank accounts we won't need banks to tell us).

But fair - just the rate of Bitcoin wallet creation then? Maybe compare to global/country population growth.

<comment><USER7> Bitcoin wallet creation went from 1 million to 5 million since last year and it keeps increasing.

<comment><USER4> Thanks! For comparison, Indonesia's population has grown by around 2-3 million people per year over the last two decades; India's by around 17 million people per year; and the world's rate as a whole is about 70 million per year.

<comment><USER7> Those are absolute numbers. From 1 million to 5 million is a 500% increase. I doubt any nation has seen anywhere close to a 500% increase in their population numbers.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Interesting. What is the path for redemption?

</comment><comment><USER9> Alfamart jangan mau kalah dah, hahaha!

</comment><comment><USER10> nice to know that. i will soon check that.

</comment><comment><USER11> Sweet. I will check this out later this month.</comment>


Ask HN: What does your workspace look like? - <AUTHOR>

Trying to get inspired for my year off work (to work on a start-up).<p>Keen to see what space HNers work in. I have a pretty boring desk, dual monitor, macbook set up at the moment. <comment><AUTHOR> Good link to get us started.

[http://www.hongkiat.com/blog/50-greatest-computer- workstatio...](http://www.hongkiat.com/blog/50-greatest-computer-workstation- pcmac-setups/)</comment>


I got busted by the SEC. Where should I flee to?  - <AUTHOR> http://www.slate.com/id/2212107/?from=rss <comment><USER2> The article links to this list of countries you wouldn't flee to if you were in that situation. It has a map, too.

[http://en.wikipedia.org/wiki/List_of_United_States_extraditi...](http://en.wikipedia.org/wiki/List_of_United_States_extradition_treaties)</comment>


Uber Moving Away from Microservices - <AUTHOR> https://twitter.com/GergelyOrosz/status/1247132806041546754 <comment><USER2> It's almost like microservices make sense when they make sense, and macroservices (or, as I like to call them, services) make sense when they make sense, and it's our job as professionals to make those calls.

Nah...we should just pick one and laugh at everyone who doesnt make the same choice until 3 years later we pick the other and then laugh at everyone who hasnt refactored and switched as well.

<comment><USER3> When I first heard of microservices, it confused the hell out of me when I tried to define my company's code base. In some ways we had microservices, for other applications or features we were working on a monolithic service. I used to think it was my lack of understanding, but I eventually realized our code didn't have a binary definition that all the blog posts I was reading seemed to apply to.

I feel like we should have been using verbs this whole time. At least when applying it to legacy systems. Similar to say for databases we can normalize data, or denormalize data. Is there a verb for this already?

</comment></comment><comment><USER4> Weren't they boasting about their microservices and how great it was a few years ago? I guess they're like Airbnb and all these companies that are continuously rewriting and refactoring their whole tech stack every year, gotta keep the army of engineers busy.

<comment><USER5> It's almost like make-work so that their competitors don't have a pool to draw talent from...

</comment></comment><comment><USER6> I'm glad this microservices hype is coming to an end. So many people have jumped on the hype train, introducing so much unnecessary complexity into their environments.

</comment><comment><USER7> I remember watching some demo where authors put a separate server per REST endpoint of a basic JavaScript/AJAX shop-like app. That was a peak microservices time.

</comment><comment><USER8> We've moved from micro services to macro services.. I don't see a problem with that /s

</comment><comment><USER9> This isn't a whole company thing, this is just an observation he is seeing.

He clarifies what he means more here: [https://lobste.rs/s/mc3k1c/at_uber_we_re_moving_many_our#c_f...](https://lobste.rs/s/mc3k1c/at_uber_we_re_moving_many_our#c_f8vacm)

</comment><comment><USER10> Reminds me of the old proclamation:

Thou Shalt Use Only Seventh Normal Form For All Databases — Or Die</comment>


.com vs .net domain name? - <AUTHOR>

<comment><AUTHOR> Here's a scenario: my co-founder and I are trying to finalize our company/website name. We have two names right now, one we like slightly better than the other.

The problem is, the .com for the 'better' name is held by a squatter who wants $25k! I hold the .net and .org.

The 'worse' domain is slightly longer (an extra syllable), and from my tests so far people find it a bit harder to pronounce. The positive is I own the .com/.net/.org

So my question to the bright minds here: how hard do you think it is to brand a company with a .net domain (and potentially purchase the .com when we can afford it)? I know some companies have done it.

Would you go with a slightly-better-name.net, or a slightly-worse-name.com?

<comment><USER2> Email the squatter and be very firm and offer a reasonable amount for the .com you want. Couple hundred bucks at the most. Don't go higher, and don't give him twenty five grand or the pisant will just go buy more domains he won't use.

If you can't get it up front, go with the .com you own now. I may be bitter and jaded, but I'm sure anyone who has ever tried to register a domain name feels the same way. Domain squatters and ad spammers are lifeforms barely above spammers and slightly below the bacteria that grows in sewer sludge. If you get enough success to let you be exploited into paying his ransom, he'll just raise it.

After all, it's now more valuable. Get it now, get it cheap, or get another name.

</comment></comment><comment><USER3> <http://radar.net> seems to be working fine and radar.com is something entirely different and dumb. They went with the .net because the .com was taken.

</comment><comment><USER4> .com</comment>


We're doing a Wi-Fi startup and asked people to explain what Wi-Fi is [video] - <AUTHOR> http://www.youtube.com/watch?v=LK7Pp1TjhjI&feature=youtu.be

<comment><USER2> I have met some of the Instabridge people and heard the founder pitch the project at a networking event. They have quite an interesting business idea, and despite being newly started they seem to have a very strong team. I for one will be following this project closely!

</comment><comment><USER3> Am I allowed to go running off into the weeds, screaming?

It seemed best to ask permission first.</comment>


Twitter Raising New Venture Round at $3 Billion Valuation - <AUTHOR> http://techcrunch.com/2010/11/17/twitter-raising-new-venture-round-at-3-billion-valuation/ <comment><USER2> Can someone please explain how twitter is worth 3 billion?

<comment><USER3> Not to be too flip, but because someone's prepared to pay (proportionally) that much for it.

Why are they prepared to pay that? Maybe they know something you don't, like Twitter's business plans, their current revenue, project revenue growth, those sorts of things.

It's easy for people to say that Twitter has little-to-no value because they can't think of ways to make money out of it - but that only means that they shouldn't be in charge of Twitter, not that someone else couldn't turn a profit on it.

<comment><AUTHOR> Understood about the acquirer. But is there a list somewhere of the revenue they generate from which source?

This is not that much money for half the 100Mtweets/day over a year... "Twitter to Sell 50% of All Tweets for $360k/Year Through Gnip" [http://www.readwriteweb.com/archives/twitter_to_sell_50_of_a...](http://www.readwriteweb.com/archives/twitter_to_sell_50_of_all_tweets_for_360kyear_thro.php)

</comment></comment></comment><comment><USER4> I can't wait to see the DHH post on the 37signals blog about this one.

[http://37signals.com/svn/posts/1941-press- release-37signals-...](http://37signals.com/svn/posts/1941-press- release-37signals-valuation-tops-100-billion-after-bold-vc-investment)</comment>


The Quiet Crisis Unfolding in Software Development - <AUTHOR> https://medium.com/@billjordan1/the-quiet-crisis-unfolding-in-software-development-cffbdafbf450#.cts5ksybx <comment><USER2> >Odds are far better than good that your high performers are achieving what appears to be high levels of productivity by building technical debt into the application by taking shortcuts whether intentionally or unintentionally. Examples of shortcuts are not taking the time to design and architect things well at all levels (low to high — think objects and object hierarchies, database schema changes, etc.), failing to test adequately, and crafting code that is hard to read, maintain and extend.

I've seen this: young developers who get things done quickly, but when you look closely at it, it's not really well architected and ends up needing a lot of fixes and changes. And worse, as said here, it's hard to read and maintain, and seems to have almost no commenting so it's very hard to understand quickly what's going on when you're not familiar with that code.

<comment><USER3> Lots of code is write-once, and in that situation productivity at the cost of technical debt is absolutely the right decision. There's no easy right answer.

<comment><USER2> I disagree. It doesn't take any real time to write a comment while you're thinking of it; coding for work is not a speed contest where seconds count, and if you're trying to save 60 seconds not writing comments, you're doing something wrong.

Most likely, people who don't comment have the exact same mentality you have ("this is write-once, no one's going to look at it"), but the problem is they're wrong. Other people do come back and need to change it later.

</comment></comment></comment><comment><USER4> If we're advocating for comfort, why stop at collared shirts and jeans? As somebody whose commute includes a mile of walking each way, I appreciate being able to wear shorts and a t shirt when I like.

</comment><comment><USER5> You have nicely summarized how important to take care of employees. Though I am not manager, there is lot of stuff in common of the suggested advice. Hope every manager think/work the way you have written or at least try.

</comment><comment><USER6> How does the content of the article justify the dramatic title?</comment>


Is your kid really gifted? Probably not. - <AUTHOR> http://www.cnn.com/2008/HEALTH/family/08/27/gifted.kids/index.html?imw=Y&iref=mpstoryemail

<comment><USER2> You are a product of your environment. --Clement Stone</comment>


Teachers more likely to "mark up" girls' work - <AUTHOR> http://www.bbc.com/news/education-31751667 <comment><USER2> As a teacher, I guess I'd agree. But I think that the bit about girls tending to have better attitudes toward school is the key point. It's much easier to be err on the side of giving marks (not awarding marks for incorrectness, but I guess trying to find the reasoning in partially correct answers?), providing more detailed feedback etc when you know the student will appreciate it or displays what the article refers to as a "school friendly" attitude.

</comment><comment><USER3> "Mr Schleicher says the study shows there is nothing innate, immutable or inevitable about gender differences in education."

natural selection provides for gender (and, it must be said, racial) differences. we waste a lot of resources pretending the world works like we wish it did rather than how it actually does.</comment>


Ask HN: What constitutes a "hotfix"? - <AUTHOR> At my company we are trying to define some new policies and procedures to prevent wild, partly untested code going into production under the basis that it is a hotfix. To help us implement said policies & procedures we are trying to define what requirements must be met before a "hotfix" is to be deployed.
In your eyes (or your companies if they have something alike), what sort of quantifiable metrics do you use to determine if a fix is a bugfix or a hotfix.
- Is this "fix" going to solve a critical production issue? - Are customers affected, and how many? - Could/does this fix introduce regressions?
Any ideas / thoughts would be greatly appreciated :) <comment><USER2> We don't have quantifiable metrics, but I could distill our habits into some qualitative ones:

First, we hotfix only for data loss bugs or for breakage of one of 3-5 absolutely central pieces of functionality without which our site might as well not exist. Anything else goes through the usual testing and deployment cycle, even if we try to accelerate said cycle a bit.

To qualify for a hotfix, a bug (other than data loss) has to make the functional area unusable or pointless for a substantial percentage of users (off the top of my head, we'd probably start panicking around 20%). There can't be a workaround or the workaround has to be so non-obvious our users would be unable to use the site without customer service help.

In 3 years here, we've deployed a lot of major bugs that were fixed within the hour - that probably happens once every week or two. Nearly allf those fixes passed acceptance testing and cursory code review but not all wait for CI. A handful or two of those may have even met the hotfix criteria above.

But I can only think of one or two true hotfixes where we skipped any sort of QA process or proper merge procedure - and those were cases where the site never came up properly at all after the deployment, so they were essentially failed releases. The ones I can think of were production-only configuration errors, where breakage was massive and testing in a staging or CI environment wouldn't have accomplished anything.

</comment><comment><USER3> Yeah, commit message containing "hotfix" means you got a call from someone complaining something is unexpectedly broken in production so you reproduce, fix it as fast as possible and deploy.

Or, maybe you just "ssh rambo@production" and apply the "hotfix" to the appropiate file(s) [the ssh rambo stuff read first at reddit X)

</comment><comment><USER4> I'm sure there are a lot of differing opinions on the definition, but to me, a hotfix is a fix that's committed directly to the master / production branch of the codebase and then immediately deployed. If there are other changes included with the deployment, then it's not a hotfix.

</comment><comment><USER5> Hotfix is the fastest fix that can be released to fix a serious production bug. It's hot off the press, there's no cool down period. Fix, Test, Release. The release happens almost as soon as a fix is found</comment>


Phoenix Channels vs. Rails Action Cable - <AUTHOR> https://dockyard.com/blog/2016/08/09/phoenix-channels-vs-rails-action-cable <comment><AUTHOR> Written by Chris McCord the creator of Phoenix. His summary when comparing to Rails for real-time push notifications is below.

"... the sweet-spot for Action Cable today is small workloads with few subscribers on any given topic. Going beyond this means engineering efforts and resources must be spent on managing multiple nodes and optimizing code out of channels. Higher workloads with broadcasts to more than a few dozen subscribers risks availability. With Phoenix, we've shown that channels performance remains consistent as notification demand increases, which is essential for handling traffic spikes and avoiding overload."

Source code: [https://github.com/chrismccord/channelsac](https://github.com/chrismccord/channelsac)</comment>