Walgreen's now selling $99 Android tablet - <AUTHOR> http://www.the-digital-reader.com/2010/10/26/walgreens-now-selling-99-android-tablet/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+NatesEbookNews+%28The+Digital+Reader+blog%29 <comment><USER2> Interesting. I would suggest anyone considering a tablet of any kind, buy one of these.

I bought the K-Mart Augen tablet on a lark. I figured it was a good way to gague how much I would actually use a tablet.

Mind you this thing is an utter peice of shit but what it showed me was that I could justify buying a Galaxy Tab. With both the B&N and Amazon clients on there and the native Android applications, a 7" tablet is really the perfect size for me and has the exact functionality I want (youtube for the kids, google web apps and reader clients for me.)

EDIT: You will be UTTERLY frustrated by the resistive touch screen on one of these tablets. That's one of the major reasons I'm looking forward to my Galaxy Tab.

<comment><USER3> What's so bad about the resistive touch screens?

<comment><USER4> No multitouch, and responds better to a small hard tap than a large soft finger. Unlike iDevices, women with long fingernails would probably find it works better for them; for everyone else, a stylus is practically a necessity.

Not the end of the world, but a subpar experience if you're used to a capacitive touchscreen.

<comment><USER5> I hate being the city snob, but are we really cheering on the incoming mass of people that are OK with using resistive touch screen onto our apps/websites? Try this test: take a resistive touchscreen and a capacitive touchscreen, and scroll through a long list of names (like the address book). Drop your finger to stop the scrolling when you see a name zoom by. Come back and tell me which one was better. Apple is slowly incrementing the specifics of scrolling gestures across their technologies... the same scrolling gestures that works on my phone work on my macbook (except they're inverted, what's up with that?).

<comment><USER6> > I hate being the city snob, but are we really cheering on the incoming mass > of people that are OK with using resistive touch screen onto our > apps/websites?

Yes, because until capacitives drop in price enough to make resistives utterly redundant, devices like this mean that they're going to represent 80% of the market (well, for some markets. Markets which it would be foolish to ignore). The people who have iPads now are lead users. Give it six months to a year, and the mainstream will catch up; the vast majority won't be buying iPads _because_ they're seen (and priced) as premium products.

Besides, modern resistives don't have to be _that_ bad. The one on my Nokia N900 is more than usable, and I have no issues whipping the stylus out for detail work.

Unless we explicitly opt out of being accessible to the mass market, it's incumbent on _us_ to make our apps and websites work well for as many types of interface as possible. If the flick-and-stop gesture for contact searching doesn't work well on the majority of devices, then we need to find something which does. Just because Apple have picked something they can uniformly implement across _their_ range doesn't naturally make it the best option for everyone; in fact, they're more likely to pick something that only they can implement well as a differentiator.

<comment><USER5> I think your points really get at the heart of the matter, thanks :)

I think the flick-and-stop gesture is truly brilliant HCI, and Apple went through a lot of testing before figuring out exactly how fast things should scroll for each piece of hardware they make. Once people are used to it, it truly becomes second nature, and doubly so because it's consistent across devices (with the exception that on the MB line, you "scroll the camera", while on the iPhone you "scroll the page").

Again, I'm conscious of my solipsism, I wouldn't want to create apps for users that don't know how to scroll on a trackpad or use the 'enter' key for the same reason I imagine making bikes targeted at professional athletes is a lot more fun than for recreational consumers.

</comment></comment></comment></comment></comment></comment><comment><USER7> Has anyone seen this in stores yet? For $100 it'd be fun just to hack with (both the software and the hardware, since I doubt that you could get all of those components for cheaper).

Also, I love that the screenshot shows the browser with a IE-esque icon. Really shows the target market.

<comment><USER8> Walgreens website says they are not sold in stores.

[http://www.walgreens.com/store/c/maylong-7-inch-m-150-wifi-m...](http://www.walgreens.com/store/c/maylong-7-inch-m-150-wifi- middie-tablet/ID=prod6047418-product)

<comment><USER9> Does anyone know if that picture is just an iPad with the screen photoshopped to Android or is that what it actually looks like?

<comment><USER10> It is absolutely a picture of an iPad, since you can see that it (the iPad) has been stretched out to accommodate the screenshot. The square on the home button isn't a square anymore.

<comment><USER11> its not. They just copied the look. (Check out the epad, and the apad and other versions of this pad)

<comment><USER12> Then why do all the hardware buttons (sleep, mute, volume, home) exactly match the layout of the buttons on the iPad? It looks exactly like a stretched out iPad with a mocked up screen shot.

<comment><USER6> I wouldn't be surprised if the product design spec _was_ a stretched-out image of an iPad :-)

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> This runs Android v1.6 and at least according to Maylong's (the manufacturer) support you can't upgrade to the latest Android due to hardware requirements.

<comment><USER14> The WM8505 Android 1.6 release has some custom hacks in the UI library layer to work with their video hardware.

Since VIA released Linux kernel source for this SoC a few months ago, some other people have successfully worked out more about the graphics driver and started developing an alternative kernel from scratch[1]. With this understanding, the possibility of the community porting Froyo is higher than it was before.

However, AFAIK noone has really put strong effort into it. One of the reasons I lost interest is that 128Mb of RAM is apparently not enough to run 2.2 decently regardless, and that's all most of the tablets have. If this one has 256Mb then it might actually be up to it.

[1] <http://groups.google.com/group/vt8500-wm8505-linux-kernel>

</comment></comment><comment><USER15> Outfits like dealextreme.com have had $85 Android tablets with V1.5/1.6 for the last year.

Until they support something newer (with app store ability) they are basically junk - so bad you might almost suspect Apple of building them just to poison the none-iPad market.

</comment><comment><USER16> This thread contains a review from someone who actually received one.

<http://www.mobileread.com/forums/showthread.php?t=102746>

</comment><comment><USER17> I feel bad for the thousands of kids (with well-meaning parents) that will get this under the tree instead of an iPad this Christmas.

</comment><comment><USER18> So from reading a couple of forum posts of people who actually bought this, the device does not have Android Market installed and does not have a setting which allows you to put it in "USB Debug" mode - which is a prerequisite for installing apps you have developed.

In short, hold on to that $99 if you are looking for anything other than a paperweight.

<comment><USER14> As it's a WM8505 based system then I'm sure these two things will be fairly quickly worked around. The modder community around this device's predecessors ($99 Eken M001 & others) is fairly strong and there are a lot of custom firmwares, with both these features.

EDIT: The slatedroid.com forums are probably the best reference source if you're interested in what people are doing with them.

</comment></comment><comment><USER19> Disposable computing is here at last.

<comment><USER20> I tend to put laptops in this category.

Like any good nerd I spent countless hours trying to figure a way to remove and use the screen on one of the broken laptops piled up in my closet. There's no good reason for that level of waste.

<comment><USER21> any success on that project?

<comment><USER20> brk sums it up. It's one reason I don't like laptops in general. Tossing those perfectly usable screens attached to a faulty motherboard is pretty distasteful.

<comment><USER22> For me it's always been the screen that died first...

</comment></comment></comment></comment></comment><comment><USER23> Its got a resistive touchscreen and probably no Market access, but it would be a really good Ubuntu tablet, if you don't mind using a stylus. The price is so low, I imagine a lot of hackers might start buying it. It shouldn't take long in that case to get a functioning port.

<comment><USER20> Might make a decent car computer, with some add-ons.

It's kind of crazy you can't buy a discreet touch screen this size for less than twice the price.

<comment><USER24> If it had a GPS it'd make a great car computer.

Never mind, I'll wait a year and probably be able to pick up something exactly as I described. Replace my car iPod and my GPS with one device. I suppose I could do this right now with an iPad but I'd have to pay for the 3G to get google maps -- I'd rather have internal maps.

<comment><USER25> No you wouldn't. You'd have to buy the 3G version to get the GPS censor, but there are plenty of apps available that store your maps on the iPad. I'm pretty sure the GPS censor works fine without a 3G plan...

<comment><USER26> it does.

</comment></comment></comment></comment></comment><comment><USER27> Are there any good Android tablets that are iPad size? I don't care about spending near iPad prices, but so far all I've been able to find is 7" crap Android tablets.

<comment><USER28> No, there aren't. Nor the iPad size, nor any other size (not counting smartphones ;-)). The first good one is Galaxy Tab.

<comment><USER29> Why is it good? I have played around with the tab, and while It wasn't bad, I expected it to be way cheaper. Since they are about the Same price, choosing an iPad would be a total no-brainer for me

<comment><USER28> You are right, but the question was if such an Android tablet exist. Maybe someone would choose tab due its more portable size.

</comment></comment></comment></comment><comment><USER30> This reminds me of a Palm Zire I got free with a set of tires, way back when people actually carried PDAs around with them. I quickly discovered how much of an impractical piece of junk it was to use, and it's been collecting dust in a drawer or box somewhere ever since. I predict a similar fate for many of these underpowered resistive screen tablets.

</comment><comment><USER31> You know, with all these commodity tablets popping up, I wonder how you can actually _trust_ the manufacturer. Each tablet appears to run a customized version of Android...how do you know that the manufacturer didn't modify it to send along all of your private data as you use it?

<comment><USER14> It's funny you say that because the version of Android developed for the WM8505 (the SoC in the Walgreens) silently phones home to a company in China for "license verification". Or, at least it did a few months ago.

<http://projectgus.com/2010/07/eken-m001-phone-home/>

(As I said in my blog post, nothing in the device indicated it was phoning home and the code was obfuscated to disguise these details. There's nothing particularly stopping any of these small companies from choosing to send other details if they wanted to.)

</comment></comment><comment><USER14> I wonder if Walgreens is complying with GPL by including a notice for source with the device, and some way for customers to access it. Certainly Maylon Group doesn't seem to have anything on their site.

(Sorry to sound like a broken record.)

<comment><USER32> I mean this in a genuinely inquisitive spirit: is it Walgreen's responsibility to provide such a thing, considering they are just the retail outlet for the device?

I would expect that Maylon Group (or whoever is the actual system integrator) is on the hook for publishing customizations.

<comment><USER14> If Walgreens are distributing (ie selling) a product containing GPL licensed software, my understanding is that they are legally responsible for GPL compliance.

Of course, in practice, it's really the Maylon Group or whoever that will have to provide the source.

However, to the best of my knowledge, the customer's only legal contract is with Walgreens, and its up to Walgreens to deal with Maylon Group (or whoever their supplier is) and ensure compliance - the end customer can't make any claim on Maylon directly.

</comment></comment></comment><comment><USER33> FWIW, there's a bunch of similar Android tablets at DealExtreme. I can't speak to the quality, and I assume its not good, but you can get a 7" tablet with Android 2.1 for $160.

[http://www.dealextreme.com/search.dx/search.android%20tablet...](http://www.dealextreme.com/search.dx/search.android%20tablets)

</comment><comment><USER34> Just put in an order for one. I'll do a review here on HN when I receive it.

</comment><comment><USER35> I'd like to compare the performance of this tablet to that of a 7" USB touchscreen connected to a SheevaPlug or BeagleBoard.

I bought a Nokia N770 tablet back in the day for the same price, but was never able to get the development environment working right (everyone had moved on to the N800). I hope the Android OS on this tablet is as hackable as Maemo.

<comment><USER14> So, to eyeball it:

This is an ARM9, probably @ 350Mhz[1], hand-wavey-performance around 1.1DMIPS/Mhz, minimal video acceleration.

BeagleBoard is a Cortex A8, 720Mhz, 2.0DMIPS/Mhz, with video acceleration (probably not via a USB video output, but via one of the Beagle adapters.)

SheevaPlug is 1.2Ghz, no idea what ARM series the Kirkwood is equivalent to. Obviously no possibility of accelerated video there.

N770 was a 250Mhz ARM9 with some video acceleration features.

Speaking from my own experience, I have a tablet with the same WM8505 SoC (Eken M001) and it runs Android 1.6 fine. I find for normal browsing and such that its biggest limitation is the poor quality touchscreen, far before anything else.

>I hope the Android OS on this tablet is as hackable as Maemo.

Nope. I've already posted a comment about it, but there are a bunch of proprietary library-level video customisations that noone has yet fully reverse engineered.

If you want a tablet with BeagleBoard-like performance and good hackability then there are some OMAP3 Cortex-A8 tablets for around the $200 mark (Wits A81e is one). Better performance, better open source support.

[1] Despite what Walgeens say, all of the previous WM8505 devices top out at 350Mhz.

<comment><USER35> I think it would be relatively straightforward to do accelerated video on USB touchscreens (like the MIMO) using a BeagleBoard. The GPU would be set up to render to an off-screen buffer, the udlfb frame buffer pointed at the off- screen buffer, and the udlfb damage ioctl called for the entire frame every time glSwap() is called (or using normal damage events for non-immediate-mode applications). It would probably be good for about 30fps.

</comment></comment></comment><comment><USER3> Can this access the app store? Are there only certain apps it can run?

How would this be for reading?

</comment><comment><USER36> I wonder if this will force apple to drop the price of the base iPad now. Probably not seeing as they didn't do it for the iPod which had a lot more competition, but the spread between $99 and $499 is a bit too much...

<comment><USER37> Apple isn't one to compete on price.

Also for people that want an iPad, this isn't competition, in the same way that people who want a BMW a Kia isn't competition.

<comment><USER38> This is probably the most succinct analogy on computer pricing discussion I've seen that a lot of people just don't seem to realize. Perhaps we haven't had the concept of a "luxury computer" long enough in our heads to make it seem natural in the same way we think of luxury / economy cars.

</comment></comment></comment><comment><USER39> they have been selling this since july

</comment><comment><USER40> Does anyone know if these cheap android devices can be hacked to run real Linux? One of these plus a Bluetooth keyboard might be kind of fun

</comment><comment><USER41> I just ordered mine

</comment><comment><USER34> Here is the FAQ <http://www.maylonggroup.com/support_tablet.htm>

</comment><comment><USER42> Here are the specs, since the walgreens page was made by an idiot:

<http://www.maylonggroup.com/M-150_MID.htm>

\---

CPU ARM9(VM8505+)

Memory RAM 256MB DDR

Flash Built-in Flash

Display Touch Panel 7" TFT LCD

Resolution 800 X 480 Pixels

WIFI 802.11b/g

Input/Output

Touch Panel Resistive type touch panel

Speaker Built-in loud speakers

SD/MMC T-Flash card slot

Network/USB Dongle for RJ-45 network and USB connection

Buttons/Switches Power On/Off, Volume adjustment

Battery Built-in Li-Polymer battery

Charger Input AC 100-240V, 0.5A

Output 9V, 1500MA

Physical Characteristics Dimension 7.5" X 4.6" X 0.3"

Weight 12 OZ

<comment><USER43> What the hell is an Internet Explorer icon doing in the "Dock" on that screenshot?

<comment><USER44> In my experience, you really only see Integer Explorer in China.

That being said, locally modified versions of Internet Explorer are extremely common. I can't remember their names off the top of my head, but even relatively unsophisticated users frequently download alternative versions of IE, which are generally based off of older IEs. (At least last time I was living there, which was about 16 months ago, so take this with a grain of salt)

Web designers / developers aren't focused on standards in the same way they are in the US/Europe, so other browsers may not display pages as expected. The Chinese Internet is quickly catching up with the rest of the world's in terms of quality, but it still lags behind.

Also, a significant chunk of the population primarily uses computers in Web Cafes rather than at home, so they don't even have the option of installing other browsers.

<comment><USER45> Perhaps you were thinking of Maxthon (<http://www.maxthon.com/>)?</comment></comment></comment></comment>


Ask HN: Mailbox sensor feedback - <AUTHOR>

I'm working on a device that turns any mailbox into a smart one. If you insert my device into your mailbox, it will send you an electronic notification when mail comes in or is taken out. Currently working with a functional prototype. Thoughts? <comment><USER2> Ross, we're launching a kickstarter campaign for such a device in 2 months, that we've been working on for over 2 years. It will have a lot more features than just alerts. Wanna learn more about it?</comment>


Warewolf is great for integration and orchestration - <AUTHOR> You can use Warewolf to: 1.	Integrate multiple systems through 3rd party and native connectors 2.	Build remote services straight into your local workflows 3.	Visually inspect, maintain and configure integration points 4.	Synchronize data in real time 5.	Drag and drop connectors to integrate disparate systems 6.	Simple Active Directory integration Download your free trial and seamless integrate your systems 400% faster! Download free from: https://warewolf.io <comment><USER2> Seems like you actually want this to be a Show HN link instead of a description like this.</comment>


International Team Develops Open Source Ventilator (Zoom Presentation) - <AUTHOR> https://twitter.com/respiraworks/status/1270486313217687553 <comment><AUTHOR> Thursday, June 11 at 9AM PDT

RespiraWorks invites you to a conversation with the volunteers who are inventing an open-source ventilator to assist in the fight against COVID-19.

We are a group of over 100 doctors, engineers, web developers, artists, project managers, and software programmers in 6 countries, all working together remotely. We will talk about where we were when the pandemic started, how we found each other, how we came together to design a ventilator, what skills we are using, and how we are collaborating with so many people around the world.

[https://respira.works/](https://respira.works/)</comment>


The Faces of Microsoft (2017) - <AUTHOR> https://www.typemag.org/post/the-faces-of-microsoft <comment> tech-historian The article is an interesting history lesson, but that sub-heading at the top sort of threw me for a loop, referring to Microsoft as "the first big tech company"

Microsoft was, and still is, a giant tech company starting in the 90's and on. But if one looks at the digital corporate landscape back in the 1980s, IBM was an absolute _behemoth_. Consider this. In 1985, IBM had a market cap of $95 billion. That was more than the next 13 largest tech companies at the time, combined! This other group includes Apple, HP, Hitachi, Intel, Motorola, Sony, AT&T, Texas Instruments, Verizon, Xerox, National Semiconductor, DEC, and Control Data.

It's hard to overstate how powerful IBM was at its zenith.

I only know this because I was curious and looked up the data the other day, and it blew me away.

<comment><USER3> The word "tech" itself changes every decade or so. Agriculture was considered "tech" at one point of time. The companies you listed are all "electronics tech" while Microsoft is purely "software tech" which is the prevalent definition of tech today.

<comment><USER4> Microsoft is not software only, and tech doesn't only mean software as far as I understand it. Or would you say Tesla isn't a technology company?

<comment><USER5> I'm not sure if this is intentionally obtuse, but yes "tech" as a slang term doesn't mean "technology", it describes a type of company largely known for the prowess and scale of their user-facing software. This includes such entities as Facebook, Google, Apple, Microsoft, Netflix, and Amazon, but is not inclusive of course.

Tesla, on the other hand, clearly produces technological artifacts - <USER2> impressive ones, at that - but they are not a "tech" company within the colloquial context you've stumbled into

<comment><USER6> It must be _very_ context specific; I'm in IT, in an English-speaking country (Toronto,Canada), and don't even remotely think of "Tech" as "front-end user- facing software only". :-/

<comment><USER5> What kind of companies do you call "tech" companies then? I can't really understand the objection I'm facing, when people tell you their stock portfolio is heavy in tech do you really think companies other than the one I listed? I live in the Bay Area so maybe things are skewed to "local" companies but I held a similar opinion when I was still in Canada too...

EDIT: Just to hammer it home, search "is faang tech" and weep that "corporatefinanceinstitute.com" is on my side

<comment><USER7> of course faang is tech. Your assertion was not "faang is tech" it was "faang is all that tech consists of". These are not equivalent, and I recommend you view [1].

[1] [https://en.wikipedia.org/wiki/List_of_fallacies](https://en.wikipedia.org/wiki/List_of_fallacies)

EDIT: Just to hammer it home, view [2] and weep that money.usnews.com is on everyone else in this discussions side.

[2] [https://money.usnews.com/investing/stock-market- news/slidesh...](https://money.usnews.com/investing/stock-market- news/slideshows/best-tech-stocks-to-buy-this-year?slide=3)

To everyone else in this thread, sorry for feeding the trolls.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> > The new fonts had to mimic the established core set of PostScript fonts, > which included Times Roman and Helvetica. Since Monotype had originally > developed the Times fonts back in the hot-metal days, that part was easy. To > compete with Helvetica, though, they chose to adapt an earlier Monotype > design with similar characteristics, called Arial.

I'm really annoyed at this particular substitution. Yes, I understand that Linotype was being annoying, but the choice of Arial as a Helvetica replacement just grinds my gears. It's a Helvetica replacement, all right: one worse in literally every way. It's all the bad parts of Helvetica with none of the good ones. Helvetica is precise with its terminals; it's styled with its graceful flourishes on letters like the capital "R". Arial has none of that charm. But it has all the downsides of Helvetica: it's really wide; it's not the best for readability. Helvetica really is a pretty font, but Arial is utterly awful.

I'm just so sad it ended up being given such a foundational place in digital typography. I subconsciously wince I see a default Google Doc, or when someone says to "just use Arial" when Helvetica isn't available. I really wished they had gone with something completely different instead of using a bad-looking, copycat font.

<comment><USER9> I quite like Helvetica Neue, it just "suits my eyes" and the shapes and proportions feel so natural to me. Your rant about Arial made me curious how it came about.

Ah, right, Helvetica Neue has been used for iOS and macOS for a number of years. That makes sense why it feels so familiar.

[https://en.wikipedia.org/wiki/Helvetica#Neue_Helvetica_(1983...](https://en.wikipedia.org/wiki/Helvetica#Neue_Helvetica_\(1983\))

\---

As for Arial, I found its history on the same page, as a Helvetica clone.

[https://en.wikipedia.org/wiki/Helvetica#Arial_and_MS_Sans_Se...](https://en.wikipedia.org/wiki/Helvetica#Arial_and_MS_Sans_Serif)

In particular, a visual comparison of a few letters with Helvetica:

[https://en.wikipedia.org/wiki/Helvetica#/media/File:Helvetic...](https://en.wikipedia.org/wiki/Helvetica#/media/File:Helvetica,_Arial,_MS_Sans,_Bitstream_Vera_comparison.png)

Yes, I see what you mean about the flourish on R. Same with G, and the tail on "a". I agree that Arial is inferior for pretty much every letter in the comparison.

\---

Apple recently replaced Helvetica Neue with San Fransisco (the name is confusing to me, because they had a font of the same name years ago).

Why Apple Abandoned the World's Most Beloved Typeface - [https://www.wired.com/2015/06/apple-abandoned-worlds- beloved...](https://www.wired.com/2015/06/apple-abandoned-worlds-beloved- typeface/)

I was curious if you had any opinion on the San Fransisco font?

</comment></comment><comment><USER10> I am always amazed by so much effort and so much research in something that is often taken as granted and not really appreciated to its true value by most users (me included).

<comment><USER11> An absolutely insane amount of research, testing, and polishing went into Windows 3.11 and Windows 95, and I think the ratio of polish to code reached its peak for Microsoft.

Edit: Just to clarify, I am talking mainly of the UI here, not the underlying OS, which was, of course, very basic.

Although with virtualized hardware, my experience of running both Windows 95 and Windows ME have been quite good.

<comment><USER12> Seriously? Windows 95 and 98 were extremely prone to crashes and it took many years for Microsoft to get past a reputation for low quality.

It took until Windows XP to get a reasonably stable desktop OS.

<comment><USER13> As my other reply here notes, the thin (and permissive) virtualisation layer means that badly written applications could crash the system, but I blame that on the applications more than anything else; too bad that most people seemed to think MS was to blame, when DOS had even less protection. I used 98se as my daily OS until well into the Vista era (at which point I gradually switched into XP), and it was definitely not the "reboot multiple times a day" that some others have experienced, but then again, I also wasn't in the habit of running lots of low-quality applications either. Uptimes of over a month weren't uncommon, and were usually brought to an end more often than not due to myself doing something stupid with the application I was writing.

(In fact, I've experienced far more trouble of various sorts with a recent new machine that runs Win10.)

<comment><USER14> See also [https://news.ycombinator.com/item?id=2281932](https://news.ycombinator.com/item?id=2281932)

> The original version of Sim City was written for windows 3.x and included a > bug that read memory that had been freed to the system. It worked in windows > 3.x, even though it shouldn't, because that particular range of memory > wasn't being used for anything else until the program was terminated.

> In beta versions of windows 95 Sim City didn't work because the operating > system allocated memory differently, and Sim City would crash as expected > because of the bug in the program. Amazingly, in the final version of Win95 > the original Sim City worked. Microsoft engineers had actually tested > backwards compatibility with Sim city, located the bug, and worked around it > in their sourcecode.

<comment><USER15> Workarounds like that which detect a particular app running and enable a special mode are called a Shim, Microsoft created hundreds of them to ensure compatibility in new OS versions with popular apps.

</comment></comment></comment></comment></comment></comment><comment><USER16> I've been using the new Cascadia font that Windows released with their new terminal for a bit and I can say I enjoy it. It's playful.

I don't use color schemes and have a white background, so this typeface provides all the joy I need/want. I don't mean this as anything more than an opinion of course. It's a matter of taste.

</comment><comment><USER17> I love the font used in this article. It's an easy to read slab serif without too much slab and with lovely bits of serifs.

<comment> iso8859-1 How can you find out what it is called? The inspector in Chrome shows the highest preference font as LAText, but I can't find any good results when I search for that.

<comment><USER18> It does! I use the inspect element cursor and hover at any text, it'll automatically show the popup with details and font family of said text.

<comment><USER19> If you click the "Computed" tab next to the CSS rules, and scroll down, at the bottom there's "Rendered fonts", which confirms that it's LAText.

</comment></comment></comment></comment><comment><USER20> Fantastic read, there is sufficient material for someone to author a sizable book covering the history of digital type in computing and how it came to be standardized. Digital type is such a critical part of our computing experience but so deep under the covers that is does not get any attention.

</comment><comment><USER21> Reminds me of Jobs' commencement speech at Stanford, he attributes the explosion of fonts to his previous studies. The bit about connecting the dots looking backwards.

</comment><comment><USER22> as a slight aside, i found this article very easy to read...

i appreciated the break-up every few paragraphs with a new heading and a picture or two

makes for a big contrast to "wall of text" articles that can get tiring after a pqge or so</comment>


Zoom still don't understand GDPR - <AUTHOR> https://www.threatspike.com/blog/zoom_cookies.html <comment><USER2> I love how when you go to enter a Zoom meeting, they bury the no-install, run- in-browser link in small type in a footer. And then, if you manage to see the link and use the browser, they withhold "Gallery View", forcing you to deal with the extremely annoying "Active Speaker View".

<comment><USER3> > And then, if you manage to see the link and use the browser, they withhold > "Gallery View", forcing you to deal with the extremely annoying "Active > Speaker View".

Is this a browser limitation or something? I think microsoft teams has the same issue.

<comment><USER4> Browsers do generally have a limit on simultaneous outgoing connections per domain[1] - it could be related to that. (This is also why e.g. TFS breaks down when you open too many tabs).

[1] [https://docs.pushtechnology.com/cloud/latest/manual/html/des...](https://docs.pushtechnology.com/cloud/latest/manual/html/designguide/solution/support/connection_limitations.html)

<comment><USER5> I doubt that has anything to do with it. Zoom almost certainly handles composing the image for gallery view server-side; you're not maintaining a separate connection for each participant.

<comment><USER6> It's possible that the server just forwards a selection of packets from each participant (hopefully dropping some from those who aren't speaking or moving) and the client stitches them into the view.

<comment><USER5> Sure, that would be the SFU doing it's job, but my point is that you aren't maintaining a connection per participant, but one connection with Zoom itself where you get all the video data. It's true that could be in the form of a single video stream of the entire gallery, or separate streams of only the participants visible to you.

</comment></comment></comment></comment></comment></comment><comment><USER7> It's unfortunate that they bought and destroyed Keybase [1] in a bid to improve their security and even still there seems to be no improvement. Guess even the best folks can't make an impact if company culture prevents it.

[1] [https://github.com/keybase/client/graphs/commit- activity](https://github.com/keybase/client/graphs/commit-activity)

<comment><AUTHOR> Same, they were my preferred platform for secure messaging, which is bizarre when you think about the fact that this wasn't even their original purpose. I guess this was indicative of the general lack of a single defined direction the product was going in near the time of the Zoom acquisition. What a shame. Hopefully someone makes something similar.

<comment><USER8> What was the draw of Keybase? I wasn't interested when it was a "post all your website usernames here, but with crypto somehow" site, and by the time I looked in on it later, it was an unreadable startup homepage and had some kind of cryptocurrency scam attached to it. If it had a good messaging featureset that should be cloned, former Keybase users should speak up!

<comment><AUTHOR> It had excellent chat functionality that worked well, and this was at a time in which the Signal client for Android was still quite buggy (hundreds of _Bad encrypted message_ messages flooding group chats, messages delivered hours late and all at once, poor performance etc.) My group naturally gravitated towards Keybase as our secure messaging platform. The other killer feature was KBFS, which was a sort of shared encrypted filesystem with which you could sync files securely across all of your devices, share files publicly or with specific users or sets of users or groups in cryptographically protected ways.

The unintelligible foray into cryptocurrency with Lumens made very little sense to me, but apparently the coins I was gifted for free by Keybase are worth over 100 USD now. I'll probably hold on to them.

<comment><USER9> FYI, if you want to liquidate those, AnchorUSD makes it really easy to transfer them out to a US bank account.

<comment><AUTHOR> Thanks for the heads up :)

</comment></comment></comment></comment></comment></comment><comment><USER10> C'mon, what does it take for Zoom to understand that when people uninstall software they don't want parts of it to stick around forever?

<comment><USER11> Usually this happens because the person who wrote the file or daemon didn't write the uninstaller and no one gives a hoot about it at review.

Never assume malice that which can be explained by a poor engineering culture

<comment><USER12> Always assume that the malicious outcome is the intended outcome. Somewhere at zoom a tech lead looked at the features planned, saw 'uninstaller' and deprioritized it to P4. That was the malice, even though they did not cacke and wore a top hat with a monocle while doing it.

<comment><USER13> I've never worked somewhere where the tech lead would make that call; product would make the call after the team or tech lead gave estimates on different trade offs.

</comment></comment></comment></comment><comment><USER14> Why do you guys not use [https://whereby.com](https://whereby.com) (formerly appear.in), it's free for 4 people, in-browser only, no-login, WebRTC, allows sharing the screen alongside faces.

But they made the 5+ rooms $9 per month, which is way too expensive. There are not enough competitors for WebRTC conf tools, it should be quite simple and $4-5 a month (WebRTC doesn't incur data costs on the servers since the data is peer-to-peer).

<comment><USER15> > WebRTC doesn't incur data costs on the servers since the data is peer-to- > peer

There are probably some operators that do pure p2p, but vast majority use some kind of bridge past certain number of users (& TURN might also be used for p2p). Usually this is to limit the amount of bandwidth participant needs.

Another alternatives are [https://meet.jit.si](https://meet.jit.si) & [https://8x8.vc/](https://8x8.vc/). I cannot remember what was the current limit of participants in Jitsi (it was 75 back in June), but on 8x8.vc it's 100. In cases where you simply need a lot of viewers and limited number of participants there is also an option to livestream to Youtube.

(Disclaimer: I work at 8x8, but not directly on Meet or Jitsi)

<comment><USER16> 8x8 has intrigued me, but I'm a bit confused as to what happened. Did 8x8 buy the Jitsi brand from Atlassian? And what's the benefit of 8x8 vs Jitsi pure? I might be a customer if 8x8 is a compelling alternative to Zoom without some of the downsides of Jitsi (generally less reliable).

<comment><USER17> Disclaimer: I work at 8x8 (not specifically on meetings, but related)

8x8 offers more than just meetings.

You can see the feature list here: [https://www.8x8.com/products/video- conferencing](https://www.8x8.com/products/video-conferencing)

Yes we bought Jitsi from Atlassian.

The Jitsi based meetings are integrated into our complete UC offering (yet we still deliver stand-alone meeting clients for customers who might want only meetings).

</comment></comment></comment></comment><comment><USER18> This is what we need app sandboxing for. No reason third-party apps should be able to read the browser's cookie database.

<comment><AUTHOR> As an aside, the Chrome cookies database on Windows is protected using the Windows Data Protection API[1], which ties encryption keys to a specific user. In the case of the Chrome cookie database, each cookie's payload/value is encrypted using a cryptographic key generated by the DPAPI which is only accessible to that Windows user. Of course, (and as is the case with most situations like this), this does absolutely nothing to protect users against malicious or intrusive programs running with the permissions of that user.

So yeah, you're right. App sandboxing please.

[1] [https://en.wikipedia.org/wiki/Data_Protection_API](https://en.wikipedia.org/wiki/Data_Protection_API)

<comment><USER19> I thought the rule was: If you can see it plaintext on the screen, it's not safe.

<comment><AUTHOR> Could you elaborate on that? Of course no computer is completely secure against all forms of attack, but I've found statements like these to not contribute very much towards solving any practical security problems.

<comment><USER20> On windows any program can read the contents of any window on the current desktop (with some exceptions, like UAC prompts and other windows that dim your entire screen). This has legimate use cases for screen readers or dictation, but of course it can also be abused. Same for X11. On more modern operating systems like Android the user needs to take very explicit action to allow an app to do that.

<comment><AUTHOR> Wow, I had no idea this was also the case on Windows! I was aware of this on X11 and switched to a Wayland compositor as a result. Is this true for macOS? I know for sure that on more recent versions of macOS, applications which want to capture the entire screen require special user-approved permissions, but can they selectively read other windows?

</comment></comment></comment></comment></comment></comment><comment><USER21> It is difficult to get a man to understand something when his salary depends upon his not understanding it. -- Upton Sinclair

</comment><comment><USER22> Brief: adds cookies to Chrome on the UNinstall process. Includes a funny "everlogin" one that lasts 10yr

<comment><USER23> Worth mentioning that the uninstaller sets the cookie by adapting your cookies file after reading contents of the file entirely unrelated to Zoom.

<comment><USER24> Worth mentioning that the author speculates that this happens not for a nefarious reason, but in a binary tree search to locate your zoom cookie.

<comment><USER25> Further, it's a SQLite database. It's not like it's hard to check this behavior, or instrument the database file to see exactly what it's doing.

It was really odd they didn't bother.

[https://imgur.com/a/jBaW7RL](https://imgur.com/a/jBaW7RL)

<comment><USER26> What tools would you use to instrument a sqlite file in order to monitor reads?

<comment><USER27> When Julia Evans wanted to learn what SQLite does, she just stuffed some printf calls into the code and rebuilt it :).

[https://jvns.ca/blog/2014/09/27/how-does-sqlite-work- part-1-...](https://jvns.ca/blog/2014/09/27/how-does-sqlite-work- part-1-pages/)

You could do similar at API entry points.

Or, if you're after writes, it would be simpler to attach an "on insert/update" trigger that just records the changes in another table. See [https://www.sqlite.org/undoredo.html](https://www.sqlite.org/undoredo.html) for an example of using triggers this way.

</comment></comment></comment></comment></comment></comment><comment><USER28> At least zoom has privacy statement / policy page available on their web site unlike threatspike.com

<comment><USER29> Fair point. threadspike's homepage talks about how they store data in a - according to them - secure fashion in a secure data center in London. What this tells me is that they collect data and store data. Moreover, their article tells me that they do have access to a lot of information, or else they couldn't have known about the zoom behavior if their stuff didn't phone home such information.

</comment></comment><comment><USER30> Have you seen Zoom's stock price? Wall Street don't give a shit about security unless the company goes under due to a massive fine.

Let's accept the fact that US govt doesn't give a shit about little privacy/security like this. EU will sometimes strike a big hammer but even that is sporadic.

Zoom has built momentum on "dark growth hacks" and they're reaping the rewards. This is standard Silicon Valley.

</comment><comment><USER31> Zoom is a joke on Linux. You enter a meeting, it goes automatically into full screen mode and when you put in windowed mode, the window can get lost. Then you need to reconnect the session.

</comment><comment><USER32> I argue Zoom does understand GDPR and the ePrivacy Directive from a legal perspective.

The specific citation about the length of a cookie is a recommendation and not a law[0]. The key word is 'should'.

I'm not a lawyer nor claim the ability to interpret GDPR legally, but I have seen companies that actively worked to edge case GDPR to their advantage (I was part of one). We would have lawyers and other 'GDPR experts' tell us what was possible and what wasn't then simply extend into the grey area.

Here, I reject the Halon's Razor[1].

[0] [https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%...](https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%20have%20an,you%20do%20not%20take%20action).

[1] [https://en.wikipedia.org/wiki/Hanlon%27s_razor](https://en.wikipedia.org/wiki/Hanlon%27s_razor)

<comment><USER33> I imagine GDPR doesn't apply to Zoom, as a non-EU company. Much like China bans what it doesn't want, the onus is on the EU to set up a GFW of their own and ban Zoom (and other GDPR-non-compliant foreign websites) if they disagree with it.

Otherwise, Zoom only needs to obey the laws of USA and wherever else they have offices.

Disclaimer: IANAL

Also: I'm not arguing for Zoom's sketchy practices but just saying that GDPR might be the wrong card here. The EU isn't the world police.

<comment><USER32> Any company that has an operating entity in an EU country must comply or risk being fined by regulators.

If the target is big enough, EU regulators will ask for help from other countries.

Zoom operates offices in a few EU countries[0] so they'll definitely have some sort of entity(ies) setup - regulation pressure can be applied.

[0] [https://zoom.us/contact](https://zoom.us/contact)

<comment><USER33> You're right, I checked and Zoom does have offices in Paris and Amsterdam.

I suppose then they have the choice of doing Google's playbook in China and just close their EU offices if they wanted, instead of complying. I mean, China wanting censorship and EU wanting GDPR aren't any different. Without arguing for or against either, China's censorship and GDPR are both local laws and foreign-based companies with no local offices don't need to comply. Foreign companies may be blocked, that's all.

Not that I'm advocating for Zoom violating privacy, but I'm not in support of EU unilaterally setting rules for the world or their right to police EU laws outside their borders. They should set up a GFW if they don't like certain things being sent into their country borders over the web, but they can't tell me what to do if I haven't set foot in their jurisdiction. (Neither can Iran, Russia, or North Korea, so why does EU get a pass to police you? If Kim Jong Un sent you a fine for $1 million would you pay it?)

<comment> yjftsjthsd-h > but they can't tell me what to do if I'm not in their jurisdiction.

True, but if you have offices and do business in their jurisdiction, then you get to follow their laws.

</comment></comment></comment></comment></comment><comment><USER34> Google Meet features seem so much better suited for government and education, especially if using G Suite on top of it. It is like the same price of Zoom but includes a lot of other great features, including unlimited storage using Google Drive.

</comment><comment><USER35> Does anyone expect any consequences? It's not like any EU member would ban Zoom in the middle of the pandemic.

<comment><USER36> The first step wouldn't be banning, it would be helping Zoom to be compliant, then if they were uncooperative, a fine.

</comment></comment><comment><USER37> Why is an uninstaller allow to access a browser's files on the first place and then modify it? There's a name for that category of software.

<comment><USER38> While it's annoying that this is the case, pretty much all software on all commonly-used operating systems has complete access to everything.

When you install software in Windows, either it installs without Administrator permissions (in which case it still has access to every single user file) or it asks for elevation to Administrator, and users blindly click Yes (in which case it has access to the entire machine).

When you install software in Unix/Linux, you're almost certainly using sudo, giving up complete control. User permissions on single user systems are almost irrelevant. It's all about blind trust. People think nothing of installing software via "curl | sudo bash", or adding random PPA repositories to apt, downloading a binary and running it as root, or deploying a docker container linked from a blog. I know the risks and I do it all the time, because convenience always wins and popular things are reasonably safe due to the "mob trust" factor.

MacOS has made some incremental steps to wall applications off from each other, requiring explicit authorization for some actions via System Preferences toggles, but really, it's just adding inconvenience for your average user, and people will generally blindly agree, in part because some of the categories are too vague or broad (small UI widgets that alter e.g. keyboard bindings or window placement require carte blanche).

Phone operating systems are better at this than most, requiring explicit permission to access e.g. contacts, but there are still limits on how protected your data is. Most of the security on phone apps comes from the vetting required by the vendor lock-in stores. Yet we still had apps able to invisibly steal global clipboard contents until earlier this year.

So, yeah, it's stupid that Zoom's uninstaller has access to browser cookies, but do you think there's a single piece of software you use that doesn't? Everything on your system has access to everything else in most cases.

</comment></comment><comment><AUTHOR> Disclaimer: I used to work at ThreatSpike Labs but left before this article was written and before any of the findings on this article were discovered.

<comment><USER39> HN is cool with self-posting, so in all cases you're in the clear.

<comment><USER40> Yes, but they (we) still like disclosure.

</comment></comment></comment><comment><USER41> It seem Zoom is so big that a small bone to pick on can yield clicks for them.

<comment><USER42> a desktop uninstaller messing with chrome cookies isn't a small bone imo

</comment></comment><comment><USER43> Read between the lines: a company established on the territory of a state where there is no concept of "private property" does not understand that it is impossible to collect personal data.

<comment><USER44> Who what now? Zoom? California? Because of that one squatting case?

Whatever it is that you are referring to, it sounds political and can't possibly have anything to do with the topic at hand. Save it for a different thread.

</comment></comment><comment><USER45> If you have run the native programme (for me it keeps breaking up in the browser), run it from a dedicated unpriviledged user, without installing it on the system. (Run ./opt/zoom/ZoomLauncher.) If you have to log in (I couldn't change the input device without logging in), when your browser tries to open the not installed programme, copy the link and give it as a command-line argument to ZoomLauncher.

Looking forward to a working alternative.

</comment><comment><USER46> I really don't like how Zoom forces the download of an executable, how doesn't this trip the antimalware? What a bad practice.

<comment><USER47> It's annoying when you don't have the client and you want to jump into a meeting. or you don't want to install client for different reasons.

They obviously focus on pushing their client because they can offer more features and better user experience. It's easier to sell their product to you. Otherwise most web clients are limited in features which means it's harder to compete for them.

</comment></comment><comment><USER48> I find the name of the _NPS_0487a3ac_throttle_ cookie suspicious enough, but the article does not comment on it. Is this a common practice? Throttling the website for users who uninstalled your application?

</comment><comment><USER49> I'm sure Zoom would be doing privacy-iffy things even if in full compliance with the GDPRAnd the possibility they might be surveying other cookies, and uploading them elsewhere, would be a giant concern if verified.

But the specific complaint here, about a cookie with an expiration longer- than-12-months, seems pretty silly.

It's not stored on some remote machine - it's stored locally, transparently. The user – and their own software – can control this easily & completely. If there's a good rationale for expiring cookies earlier, a browser can easily do it directly - it needn't involve regulators, or ineffectually hoping every one of thousands of different companies/websites do something the laws of one place ask.

</comment><comment><USER50> Why people still uses zoom? Something like Google Meet or Microsoft Teams are better.

<comment><USER51> Because it's frictionless. It's very easy to set up a Zoom meeting with anyone in the world.

When I tried MS Teams, my impression was that it required a fair amount of advance configuration. This is no problem if you're meeting the same people repeatedly and they work for the same employer as you. Indeed, as the name of the software suggests, it's good for "teams". But for me, anyway, this hasn't been my typical use case.

<comment><USER52> Zoom seems pretty high-friction vs jit.si . It forces (kinda, tricks I suppose) install of a client exe for example and IIRC requires registration.

Jitsi you just follow the link, webrtc means no download.

<comment><USER44> The high friction with Jitsi is browser permissions. You need to interact with both the webpage and the browser's chrome to set up and switch media devices, which can get confusing even for someone with deep knowledge of the browser APIs, let alone for someone who couldn't tell a UAC prompt from a MsgBox().

That's why Zoom uses all these dark patterns to get native code running as soon as possible and as privileged as possible so it can do all the work for you. See also: Mac installer disaster.

<comment><USER52> Browser just says "give permission to use mic and camera" and you click yes.

If you click no, then I think you're going to struggle to intuit how to proceed; but it's no harder than navigating UAC dialogs to install software, much easier IMO.

None of the olds in my family had a problem. YMMV I guess.

<comment><USER44> Except that the permission popup is very difficult to spot and disappears if you touch anything other than it, after which it's pretty hard to find again. It also asks you to select an input device and if you pick wrong, you might have to track it down again to fix that.

On a fast and stable machine and Internet connection this is much less of an issue, but in my experience at least, that is not the norm.

<comment><USER52> Cool, thanks for expanding on that.

</comment></comment></comment></comment></comment></comment></comment><comment><USER53> This is excellent work by threatspike and we should commend/support efforts like this that help keep us informed of the sneaky and intrusive actions of certain pieces of software

</comment><comment><USER54> My bet is that Zoom _understand_ the GDPR just fine, and don't care.

They have repeatedly shown that they will do whatever they want, and then act contrite later if they're caught out. They are not trustworthy, and I won't run their software on any nonsandboxed environment AT ALL. There's utterly no reason to.

</comment><comment><USER55> The author is referring to the ePrivacy directive - its not the same as the GDPR.

Does he mean the ePrivacy regulation?

The ePrivacy regulation (not directive) is no binding law yet.

</comment><comment><USER56> Maybe it's obvious but how does this break GDPR?

<comment><USER47> You shouldn't set a cookie without expiry date especially after user opt-out. This particular example isn't really a big issue. But, perhaps you wouldn't read it if the title was too accurate.

</comment></comment><comment><USER57> *doesn't

<comment><AUTHOR> It caught me off guard too. The company is UK-based so it's probably a British colloquialism.

<comment><USER58> As far as I can find online, it's american street language; I only know it from US shows and Eminem (and other rap) songs. Maybe here it's used to indicate that "zoom be stupid".

<comment><AUTHOR> Perhaps. I'm American but live in the UK, and I have observed how people in the UK use "don't" as opposed to "doesn't" when the thing being referred to is an organisation, I suppose with the idea of it being an organisation comprised of many people (i.e. "they don't") as opposed to an inanimate non-human entity ("it doesn't").

Still incorrect to my understanding of how English works.

<comment><USER59> Perhaps it's built into a different perception of what a company is. In America, I get the feeling people think more of companies (large companies) as human beings with rights (but no responsibilities), and that's far less than the general view in the UK where the view is often they are parasites with valueless shareholders.

I wonder if a company with a well known single owner (amazon/bezos, spacex/musk) is also thought of as a group Or a person subconsciously.

Two countries separated by a common language

<comment><USER60> No, it's just that American English in general is much less free with the use of plural agreement with collective singular nouns. So e.g. "My team are" is much less acceptable in American English than in British English.

</comment></comment></comment></comment></comment></comment><comment><USER61> Zoom is terrible, but when you deep dive into GDPR it's pretty clear that nobody understands it.

</comment><comment><USER62> As an American company, are they subject to GDPR regulations?

<comment> yjftsjthsd-h They have European users and offices.

<comment><USER47> The fact that they operate and have revenue in the EU is enough. They are still subject to GDPR even without offices.

</comment></comment></comment><comment> awinter-py wow as with everything that's come out about them it feels like they're trying to get the job done but with limited platform support and badly

it's not absurd for a product manager to want your desktop zoom app to inherit your browser login

though as a user if I saw this behavior I would have a few wtfs. But as a user I would _never ever_ install zoom on a laptop

my takeaway from this isn't GDPR implications, it's that desktop OSes need to get serious about permissions, especially filesystem walkabouts

<comment><USER44> > it's not absurd for a product manager to want your desktop zoom app to > inherit your browser login

Of course not, and there are many ways to do this while respecting the application boundary. In no particular order: passing a token in the launch URI, a bundled WebExtension, a local WebSocket/HTTP server, on-demand executable customization.

</comment></comment><comment><USER63> "Zoom cookies are firstly written when the user connects to the website zoom.us and accepts the cookies options."

That was the moment Zoom received your consent to store data transmitted by cookies. Adding a few more cookies to the pile, regardless of expiration date, doesn't change the agreement.

Rummaging round the cookie bin on uninstall is a nice find and deserves a raised eyebrow but this doesn't really have anything to do with GDPR.

<comment><USER64> > According to the ePrivacy Directive, they should not last longer than 12 > months.

( Quick search about cookies)

<comment><USER63> The ePD text says nothing about a 12 month cookie expiration and also ePD != GDPR

<comment><USER64> > While GDPR only applies to the processing of personal data, ePrivacy > regulates electronic communication even if it concerns non-personal data. > Also, in the case of cookies, the ePrivacy generally takes precedence.

[https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%...](https://gdpr.eu/cookies/#:~:text=All%20persistent%20cookies%20have%20an,you%20do%20not%20take%20action).

> persistent cookies have an expiration date written into their code, but > their duration can vary. According to the ePrivacy Directive, they should > not last longer than 12 months, but in practice, they could remain on your > device much longer if you do not take action.

<comment><USER63> > According to the ePrivacy Directive, they should not last longer than 12 > months

The quote you keep referencing is false. The ePD says nothing about this.</comment></comment></comment></comment></comment>


China's biggest startups ditch Oracle and IBM for home-made tech - <AUTHOR> https://www.scmp.com/tech/enterprises/article/3015931/chinas-biggest-start-ups-ditch-oracle-and-ibm-home-made-tech-us <comment><USER2> Western companies were so blind by the "possible" money to be made in China that they didn't care that the Chinese government forced them to partner with Chinese companies, and then the Western companies were forced to hand over their technology to their Chinese partners. The Western companies did worry that every Chinese company is partially owned by the Chinese government, so the Chinese partner handed over all the technology and IP to the Chinese government and the Chinese government shared that IP and technology with any Chinese company that could benefit.

Now all the hubris is coming home to roost.

</comment><comment><USER3> I foresee a serious International Tech War on the horizon.

<comment><USER4> The West is weak. It surrendered a long time ago. I see no reason to believe it would suddenly grow a will to stand for itself. Trump is but a blip, and he's merely a caricature to begin with.</comment></comment>


'DiceKeys' creates a master password for life with one roll - <AUTHOR> https://www.wired.com/story/dicekeys-cryptography/ <comment><USER2> What's the benefit of this? You have to trust the website to faithfully scan the dice and not send their state anywhere else. If you trust the website, then you could just wiggle the mouse for entropy to seed a cryptographically- secure PRNG, generate a password in the usual way, and write the password down (or memorize it, or print it, or print it as a QR code if the scanning is important, etc.). That seems equally secure, and more convenient than carrying a set of dice with me everywhere I go.

And of course a YubiKey or equivalent is the real answer. I'm trusting the developer there too, but I get a nice compact package that fits on my keyring, and a secret that never goes outside that package.

<comment><USER3> I like the physical nature of it. Cryptography is so abstract. I like idea of master password generating code device being a physical object.

<comment><USER4> The physical route is a good idea, but if you're going to do it there's no reason to introduce a weak link in the chain of having an app scan the dice. You can just get a set of 5 dice and do the lookups yourself using a word list like this [0].

[0] [https://www.eff.org/deeplinks/2016/07/new-wordlists- random-p...](https://www.eff.org/deeplinks/2016/07/new-wordlists-random- passphrases)

<comment><USER5> The author of that post is on the DiceKeys advisory board.

At some point, you're going to feed the entropy source into software. Having the app be part of your trusted computing base reduces the chance of a data- entry error that could leave users forever without their data.

<comment><USER4> Feeding the entropy source into software might take many different forms depending what is the password to (e.g. login/full disk encryption key on your computer, password manager master password, password to a specific online service, etc). For most uses you'll have to enter it as text, and have to enter it multiple times, potentially on different devices that you are accessing the service on.

For almost any real-world use case, memorizing the password and typing it in on a keyboard is pretty much a necessity. There are many kinds of inputs that don't allow another software like DiceKeys to enter the secret, so I'd still definitely rather stick with the simpler, human-readable option.

</comment></comment></comment></comment></comment><comment><USER6> It's a really clever idea with technical merit. More practical than the old lava lamp CRNG. It's an entropy source, and I think there are an infinite number of possible variations on what I'm calling "entropy rituals," which may or may not generate a sufficiently large field that mitigates brute force attacks.

In its favour, good, exogenous entropy mitigates part of post-hoc decryption attacks and wrecks the economics of passive bulk interception and surveillance. It means that threat actor needs to a) use direct attacks on user endpoints, b) sabotage algorithm implementations to truncate keys or c) bias the entropy source with loaded dice (because everybody knows...) or longshot d) use a TAO-like operation to add dice with duplicate facets from other cubes to dice kits in transit to reduce the total field size, which would be easily discoverable, but chalked up to a "printing error."

</comment><comment><USER7> So at first glance, this is vaguely like Diceware, you just don't stop "playing"?

[http://world.std.com/~reinhold/dicewarefaq.html](http://world.std.com/~reinhold/dicewarefaq.html)

</comment><comment><USER8> It's not the only option if you don't like a master password.

I use passwordless (GPG keys on an Yubikey) with a PIN code. The PIN can even be replaced by biometric soon. This is the way forward IMO. No more passwords at all, even master ones. If you turn on the tap-to-sign function on the yubikey you can also protect yourself from malware 'milking' your entire password database while the key is inserted. Of course I create the secrets on-key as is best practice.

Of course losing the token is an issue, but I have multiple and each password is encrypted against each of them.

I like this idea though. But I don't like that anyone who has a picture of the dice can generate the passwords. And I don't like leaving my password managers logged in all the time. It wouldn't work for my desired level of security, though I can imagine users who do leave their PW managers logged in, would be happy with it.

<comment><USER9> > No more passwords at all, even master ones.

Then... how do you prove you're you? And not merely someone who has your physical body in their possession?

Edit: Obligatory "biometrics are usernames, not passwords."

<comment><USER10> passwords don't prove you're you either. They just prove you're someone or something that knows the appropriate password.

<comment><USER9> Yeah but if you're reasonably good with security, they at least prove you were conscious and present when someone logged in.

<comment><USER11> No they don't. See "rubber hose cryptography", shoulder-surfing, hidden cameras, keystroke loggers, phishing.

</comment></comment></comment></comment></comment><comment><USER12> I like the idea of this, however I do not like that you are expected to keep the master key in your drawer somewhere. It's like writing your master password on a sticky note and putting it in a drawer.

I know there is always a risk of forgetting your master password but keeping it only in your brain gives you the most protection. I suspect law enforcement would have an easier time compelling you to give up your DiceKey object than forcing you to repeat your brain key. However I am not a lawyer and would be interested to hear more from those who know more about this kind of situation.

<comment><USER13> > It's like writing your master password on a sticky note and putting it in a > drawer.

People should do this, and people should stop telling other people it's bad security to do this. And then people should stop using password managers.

The idea that the sticky note is bad is hilariously old school, and the result has been everyone putting their passwords in cloud-stored apps instead, which is 10,000% worse than a sticky note.

Remember: If it's on the Internet, your potential attacker is "every human on earth". If it's on a sticky note, your potential attacker is "everyone who can get access to the physical place you keep it". The former will always be an increasing number of billions of Internet users. The latter can be reduced to one or two if you store your sticky note somewhere very secure, like a safe or security deposit box.

Also, for added security... just lie on your sticky note. It doesn't have to be a high entropy lie to befuddle people.

<comment><USER14> Encryption is a thing. If we can't trust encrypted data then security the password is worthless anyway as everything is owned.

This is why password managers are generally considered secure. They store only client side encrypted blobs and do not store or know your master password.

Like you, I have no concerns with storing your master password on paper in a locked drawer or something, but it's unrealistic to securely store post its for every password you need as well as have them readily accessible.

<comment><USER13> Readily accessible to you is readily accessible to hackers. People should re- evaluate how many things they must have access to everywhere they go.

For example, my 2FA tokens are backed up in physical storage. This means if I'm traveling and I lose my phone, I don't have access to them until I get back. But that's a lot safer than leaving them somewhere others can access them too.

<comment><USER14> Hackers don't have quantum computers to crack my password vault.

</comment></comment></comment></comment></comment><comment><USER15> This is pretty cool. But you do need to trust their website and app, and your scanning device.

Also, the website says you get about 192 bits of entropy. It's been a while since I did any combinatorics. It seems you should have 25! * ((6 * 4) ^ 25) possible dice rolls. 25! combinations of dice placement times (6 face up possibilities * 4 rotational possibilities) for 25 dice.

Python gives:

import math math.factorial(25) * (6 * 4)^25

496508538648719564809316402287439226010265627463254016000000

2^196

100433627766186892221372630771322662657637687111424552206336

<comment><USER16> They divide by four as there's a "canonical" direction to read the dice. See "Security Strength" at [https://dicekeys.com/](https://dicekeys.com/)

<comment><USER5> Correct. We believe a two-bit reduction in strength is a small price to pay to ensure you get the same key even if you scan the box at a different orientation (e.g. up-side down).

We could have designed the software to try to recognize the top of the box, but the box for the steel version may look very different (or not be what you'd think of as a box at all.)

</comment></comment></comment><comment><USER17> I just use 1337-speak versions of lyrics from bands I like that vaguely remind me of the subject matter for whatever I'm using the password for. I can't forget a password because I don't actually have to remember them, just be able to derive them using my personal ruleset. Excepting where data breaches or security policy forced a change, I haven't had to reset a password in over a decade.

<comment><USER12> Rules like that lower the entropy orders of magnitude compared to the truly random processes described in this article. Probably still enough entropy to give you good protection, but maybe not enough from a motivated nation state or multination corp.

<comment><USER18> Surely a box with some plastique cubes in it will protect you from these nation states.

It's not like they're buying a $5 wrench or anything.

<comment><USER12> Sometimes there is value is cracking someone's password without them knowing.

</comment></comment></comment></comment><comment><USER19> This is cute and might work around the house, but I wouldn't entrust anything serious to it. As soon as your traveling and don't have it, or your kids rearrange it, or someone else gets a picture of it, then it the novelty is definitely gone.

You could just as easily use a deck of playing cards or to construct a password and it would have exactly the same issues.

Yubikeys win the day again and again, I just more sites support them. The financial sites that would benefit most are still stuck on easily spoofed SMS authentication - if they even have that.

</comment><comment><USER20> The site [1] of the app is quite simple. Actually it's refreshing to see such minimalism :)

\</comment><comment>----

[1] [https://dicekeys.app/](https://dicekeys.app/)

<comment><USER20> For the adventurous, see the page source!

<comment><USER21> And take a look at the 4.8MB javascript file.

<comment><USER22> I'm assuming that's due to needing both crypto polyfills and opencv?

<comment><USER5> OpenCV, but for crypto we use an open-source crypto library built on top of lib-sodium.

[https://github.com/dicekeys/seeded-crypto- js](https://github.com/dicekeys/seeded-crypto-js)

</comment></comment></comment></comment></comment><comment><USER23> What they need with this is a human computable function that can take a short nonce and combine it with the arrangement of rolled dice to produce a secret value. This eliminates the problem of the trusted scanner. It also allows the same dice arrangement to be used for different services. If you are ever at risk of compromise, just simply discard the dice.

<comment><USER5> And if you can demonstrate that there are functions are computable by a user community that would benefit from them, it would make a fantastic submission to the Symposium on Usable Privacy and Security (SOUPS).

But, most people are trusting software at some point. We're making sure our software is small and relatively simple so that you can audit it. That's one of the reasons why we don't take dependencies on Google's Tessearact OCR engine, or on frameworks like React. (The one big dependency we haven't removed is OpenCV.)

<comment><USER14> One of my concerns would be durability of the software over time. In 20 years from now, will the site still be running? Will I need to hunt down old hardware or dependencies to regenerate my key?

<comment><USER24> The mapping seems pretty straight forward, I don't see why it couldn't be manually done.

<comment><USER5> You can, in fact, do it manually. T4r means letter T, digit 4, facing right. The directions are 't', 'r', 'b', 'l' (top, right, bottom left), which makes for a mnemonic you can follow with "right here in river city".)

Before you transcribe, just rotate the box so that the first letter in the alphabet appears in the top left, than read in English order (left to right, then top to bottom).

The crypto library: cpp: [https://github.com/dicekeys/seeded- crypto](https://github.com/dicekeys/seeded-crypto) ts/js: [https://github.com/dicekeys/seeded-crypto- js](https://github.com/dicekeys/seeded-crypto-js)

<comment><USER14> Neat! Thanks for sharing.

</comment></comment></comment></comment></comment></comment><comment><USER25> This isn't a whole lot different than `cat /dev/urandom | base64 | head -c 33`, printing it out, and laminating it.

<comment><USER12> The difference here is that there is virtually no way for there to be a bug, virus, malware, keylogger, etc that might break the _true_ randomness of the dice roll where all those are a possibility for the computer generated version.

<comment><USER26> I feel that the risk of my /dev/random being broken is _much_ lower than some random website being intercepted or assimilated.

<comment><USER12> The website is just an easy way to transfer the random numbers to your computer (which you arguably shouldn't use if you need something like this.) The actual randomness generation is the dice roll, which is less likely to be broken than your /dev/random (which is probably not broken and totally fine to use)

<comment><USER26> I'm not comparing my /dev/random to my dice roll. I'm comparing the likelyhood of my /dev/random being broken to the likelyhood of the website being intercepted or assimilated when I use it.

</comment></comment></comment></comment></comment><comment><USER27> WTH - why would they use a shitty plastic box to hold them? Drop the box, dice fall out, lose access to all your secrets?

<comment><USER28> No worries my friend, I will sell you some hot glue to keep those dice in place. I'm working on the Kickstarter for it as we speak!

</comment></comment><comment><USER29> > It's "toddler-proof,"

Not a parent, but this is one of the first things I thought of.

</comment><comment><USER30> At the very least it's a really cool talking point and way to lead into crypto, esp. when talking to kids about it. And some cool dice ;)

</comment><comment><USER31> I love supporting small security initiatives like this to bring more attention to these cool concepts. Ordered the two dice sets and four keys.

</comment><comment><USER32> So you roll the dice and then leave them in the case and never roll them again?

<comment><USER33> If you want to be able to recover _that_ key at some point.

</comment></comment><comment><USER34> [https://dicekeys.com/](https://dicekeys.com/) may be more useful than the paywalled article.

</comment><comment><USER35> I feel like his t-shirt is on backwards in the video. Does that add to the geek cred?

<comment><USER5> It's my daughter's shirt. She didn't approve of any of my shirts. The front has Bugs Bunny.</comment></comment>


How to Buy a Business Jet - <AUTHOR> http://www.openthemagazine.com/article/living/how-to-buy-a-business-jet

<comment><USER2> Is there a second page to this article? It just kind of trails off at the end there, leaving me wondering how much the jet actually costs/etc.</comment>


Most(Ly Dead) Influential Programming Languages - <AUTHOR> https://www.hillelwayne.com/post/influential-dead-languages/ <comment><USER2> Extensive discussion a couple of weeks ago: [https://news.ycombinator.com/item?id=22690229](https://news.ycombinator.com/item?id=22690229)</comment>


The 'Flying Carpet' - The fastest way to fill a plane - <AUTHOR> http://www.roundpegin.com/html/aircraft_boarding.html <comment><USER2> One thing which this (and a lot of boarding systems) ignore is that high- revenue customers for airlines demand preferential treatment

If I'm a frequent flyer, regardless of whether i'm sitting in coach or first class, i'm going to expect to be seated first so I don't have to wait in line and can be sure I get a space in the overhead bin. Airlines (like southwest) who don't provide this lose out on business travelers who book last minute, full-fare tickets -- and major carriers who rely on this revenue will be reluctant to switch to systems which don't account for this.

</comment><comment><USER3> Ever single boarding time research project I've seen ignores one simple truth that anyone who flies notices immediately:

Most people don't care about the order, they just clump to get into their seat first. They ignore the zone / rows / etc called by the gate person and I've yet to see a single gate person tell someone they have to wait because their zone / row / etc hasn't been called yet.

People already treat air travel as a necessary evil, I don't see any possible way how they would agree to this kind of boarding pattern.

<comment><USER4> It's not really a pattern though, is it? The row numbers are spaced closely enough that there'll be some space between people.

You might get some people who don't pick their seat but just grab the nearest patch of carpet. I doubt that would have much effect.

<comment><USER5> It depends on the airport and airline. Southwest arranges by row groups, and I had the same experience in the Hong Kong airport (flying on Cathay, I think).

</comment></comment></comment><comment><USER6> That's a nice idea, but row boarding doesn't allow couples or families - obviously wanting to sit together in a "column" ("row")? eventually - to stay together during the boarding process. This could be especially difficult if there are parents with young children.

<comment><USER4> Yes it does - just go stand on the carpet with your family.

</comment></comment><comment><USER7> phys.org had an article with some research on optimal plane boarding [1] describing what seems to be another alternative, sadly sans the infomercial.

One thing I find curious about all of these is that they assume back-to-front as the baseline. I've never ever seen a plane being boarded in something resembling an ideal back-to-front. On most flights it's basically a random pounce where the stewards try to keep some sequence but usually fail. I tend to have a small carry on and just sit it out until most everybody has boarded, regardless of my seating.

[1] <http://phys.org/news122215582.html>

</comment><comment><USER8> On Southwest Airlines I often sit on the plane waiting for baggage loading.

That's no assigned seats + more checked baggage since it's free.</comment>


Azure, We're having issues - <AUTHOR> https://azure.microsoft.com/en-gb/status/#current <comment><USER2> It's impacting any O365 web based login across Europe. If you're logged in, everything works. Mail is delivered by activesync/ Outlook still.

[http://downdetector.com/status/office-365](http://downdetector.com/status/office-365)

<comment><AUTHOR> yip, I can't get logged in at all

<comment><USER2> It appears to be an Azure AD issue at the root.</comment></comment></comment>