When Driver Error Becomes Programming Error - <AUTHOR> http://www.insidescience.org/content/when-driver-error-becomes-programming-error/2591 <comment><USER2> I'm wondering how we engineers will deal with situations like carjacking and other extreme situations. Sometimes you just need to go, even if it breaks the law, or even if it involves hitting something or someone.

These situations don't occur every day... at least where I live. Thank goodness.

But this is a PR nightmare in the making, unless it is somehow addressed now, before such vehicles become commonplace.

At the very least, there needs to be some kind of 'safety override' button that you can press in an emergency.</comment>


Collective clog control: Ants optimize traffic flow in excavation - <AUTHOR> https://science.sciencemag.org/content/361/6403/672 <comment><AUTHOR> * summary article [1]

* related read about ant societies [2]

[1]: [https://www.sciencedaily.com/releases/2018/08/180816143231.h...](https://www.sciencedaily.com/releases/2018/08/180816143231.htm) [2]: [https://www.nature.com/articles/121819a0](https://www.nature.com/articles/121819a0)</comment>


NIH Clinical Trial Shows Remdesivir Accelerates Recovery from Advanced Covid-19 - <AUTHOR> https://www.niaid.nih.gov/news-events/nih-clinical-trial-shows-remdesivir-accelerates-recovery-advanced-covid-19 <comment><AUTHOR> The drug caused 31% faster recovery.

Fauci says that this will be the standard of care.

[https://www.reuters.com/article/us-health-coronavirus- gilead...](https://www.reuters.com/article/us-health-coronavirus-gilead- remdesivir/gilead-says-experimental-drug-helps-covid-19-patients-raising- hopes-in-pandemic-fight-idUSKBN22B1T9)</comment>


Arrakis - <AUTHOR> http://arrakis.cs.washington.edu/ <comment><USER2> This is pretty interesting, but unfortunately their intro page doesn't do a good job of explaining why. (For instance, they use the word "unprecedented" without really saying what makes Arrakis different from previous exokernel- like designs.) I'll try to summarize what I got out of skimming the paper[1]:

When you have multiple applications running on the same machine, you need some way to safely share resources between them; for example, incoming network packets are a resource. A kernel handles this by keeping a data structure mapping sockets to processes, and demultiplexing data that comes in from the network card. Hypervisors work the same way, except at the level of virtual machines rather than processes.

Arrakis does the same thing, but relies on hardware support in the network card to dispatch packets to the right process. This relies on a standard called SR-IOV[2] which allows the OS to configure a PCI device to present itself as multiple virtual subdevices. The kernel programs the NIC to dispatch packets to different buffers depending on the incoming MAC address; after that, packets can be dispatched with no kernel involvement at all. Similarly, you can tell a disk controller to present a particular extent of a disk as a new virtual storage device.

The blurb about memory protection seems to be a red herring, because as far as I can see they haven't done anything to change that. There's still a kernel, which handles requests for resource mappings, and processes are still isolated from each other. But once they've requested the mappings that they need, the normal execution path doesn't involve any syscalls, and so there's no kernel overhead. The real contribution of the paper is designing an API around this idea and proving that real applications like Redis can be ported to it.

[1] [http://arrakis.cs.washington.edu/wp- content/uploads/2013/04/...](http://arrakis.cs.washington.edu/wp- content/uploads/2013/04/arrakis-tr-ver2.pdf) [2] [http://blog.scottlowe.org/2009/12/02/what-is-sr- iov/](http://blog.scottlowe.org/2009/12/02/what-is-sr-iov/)

<comment><USER3> But where does one get SR-IOV devices to experiment with? It looks like the Intel 82576 chipset has SR-IOV, and can be had in a $50 card, two ports, 8 filters per port. The Intel 82599 is a 10Gb chip with more filters per port. (with linux support for the SR-IOV, it can manifest as multiple devices)

Disk storage is less obvious. The LSI 2308 and 3008 controller chips probably support it, but I'm not finding a commodity card or a motherboard integrating one.

They mention in the paper that existing devices have problems which prevent them from actually securely isolating clients of the sub devices. Combine this with seeing a lot of web activity about SR-IOV in 2009 and not much now. Either it became too common to mention, or is dwindling into an idea that didn't catch on. The wait for secure SR-IOV might be interminable.

<comment><USER4> In the paper, they say they are using "an Intel MegaRAID RS3DC040 RAID controller with 1GB cache of flash-backed DRAM, exposing a 100GB Intel DC S3700 series SSD as one logical disk". I'm not familiar with it, but is that raid controller insufficiently commodity?

Edit: I see now it's around $500. This list of cards and motherboards using the LSI 2308 and 3008 might be a starting point for finding something less expensive: [http://forums.servethehome.com/index.php?threads/lsi-raid- co...](http://forums.servethehome.com/index.php?threads/lsi-raid-controller- and-hba-complete-listing-plus-oem-models.599/)

</comment></comment></comment><comment><USER5> Interesting, its a fork of Barrelfish [1] which is the one-core-one-OS OS. When I first heard about it, it sounded like Multi-DOS (several instances of MS-DOS running at once) but its a bit more sophisticated than that :-). Other than cache contention (which is always going to be a problem) its an interesting approach.

[1] [http://www.barrelfish.org/TN-000-Overview.pdf](http://www.barrelfish.org/TN-000-Overview.pdf)

</comment><comment><USER6> _" Applications are becoming so complex that they are miniature operating systems in their own right and are hampered by the existing OS protection model"_

Sure, that's true for browsers, as they mention, and a few other degenerate cases (eg. virtualization software?) - but that's certainly not the case for the vast majority of applications I run (text editor, terminal, mail client, IM client, etc.). How does this argument hold?

<comment><USER7> A lot of programs have more complexity than what is immediately obvious:

* The Microsoft office suite has a VB interpreter for every application,

* 3D (Blendr, Rhino) and graphics (gimp) tools have inbuilt python interpreters,

* And, it seems like there's always notes coming out from postgresql about how to deal with os limitations/gotchas

<comment><USER8> But the point still hold. Let's say the script interpreter of MS Office (or gimp or sublime, etc.) needs access to the hard drive. The system, no matter how locked up, still needs to give full access to the hard drive, unless they want to break the app.

From there, the same exploits that were previously possible are possible again - they can, if they break out of whatever sandbox is in place, access everything. I guess the OS might work better for apps that don't need these rights to begin with, but then these apps usually aren't much a problem in regular OSes anyway.

<comment><USER9> The thing is, _parts_ of the app might need access to the hard drive, but that doesn't mean the _whole_ app needs it. For example, your email client as a whole needs hard drive access, but the email _parser_ just needs a channel to receive the messages and return a data structure, so you can isolate it and then if an email is sent that tried to explore some bug in the parser that achieved code execution, it still couldn't delete or read your files.

For example, see the Chromium architecture: [http://www.chromium.org/developers/design-documents/multi- pr...](http://www.chromium.org/developers/design-documents/multi-process- architecture#Sand_boxing_the_renderer)

</comment></comment></comment></comment><comment><USER10> If you like this concept, you may also find Mirage[1] interesting. Mirage compiles the application code into the kernel to run directly on the Xen hypervisor. (Thus system calls become ordinary function calls. They do some tricks to maintain security.)

[1] [http://www.openmirage.org/](http://www.openmirage.org/)

</comment><comment><USER11> Heh, this sounds analogous to what Gary Bernhardt finished "The Birth & Death of Javascript" with: [https://www.destroyallsoftware.com/talks/the-birth-and- death...](https://www.destroyallsoftware.com/talks/the-birth-and-death-of- javascript)

<comment><USER12> Or what a bunch of projects have been doing for years -- Erlang on Xen, HalVM, etc. etc.

</comment></comment><comment><USER13> Is this the same idea as "exokernel", and thus a (probably valuable) attempt at implementation of one, or does it differ in some important points?

[https://en.wikipedia.org/wiki/Exokernel](https://en.wikipedia.org/wiki/Exokernel)

<comment><USER14> It's interesting to see many concepts and general design philosophy of exokernels make their way into modern systems. Zero-copy, mmap, RDMA, vectored I/O, fibers/switchto, FUSE - all of these are attempts to push as many policy decisions into user space as possible so that the OS only deals with securely multiplexing the hardware.

The irony is that rather than new kernels, these are being added on as new APIs to the Linux kernel. I suppose that makes a lot of sense because it's much easier to expose a new syscall and see if it gets any adoption rather than convincing everybody to switch to a whole new OS.

</comment></comment><comment><USER15> In reply to many comments about the lack of safety of the approach: They claim that _" [they] demonstrate that operating system protection is not contradictory with high performance"_.

Abstract of their latest paper:

 _Recent device hardware trends enable a new approach to the design of network server operating systems. In a traditional operating system, the kernel mediates access to device hardware by server applications, to enforce pro- cess isolation as well as network and disk security. We have designed and implemented a new operating system, Arrakis, that splits the traditional role of the kernel in two. Applications have direct access to virtualized I /O devices, allowing most I/O operations to skip the ker- nel entirely, while the kernel is re-engineered to provide network and disk protection without kernel mediation of every operation.

We describe the hardware and software changes needed to take advantage of this new abstraction, and we illustrate its power by showing 2-5x end-to-end latency and 9x throughput improvements for a popular persistent NoSQL store_ [i.e. Redis] _relative to a well-tuned Linux implementation._

[http://arrakis.cs.washington.edu/wp- content/uploads/2013/04/...](http://arrakis.cs.washington.edu/wp- content/uploads/2013/04/arrakis-tr-ver2.pdf)

</comment><comment><USER16> >"The application gets the full power of the unmediated hardware, through an application-specific library linked into the application address space."

This is pretty concerning, actually. I don't think I want or trust shady companies like Adobe to be running DRM-laden code directly on my hardware.

Vendor lock-in is an increasingly common phenomenon and I'm picturing a really alarming future if this sort of OS takes off. I _like_ that the linux kernel sits between my software and my hardware.

Want to watch a Sony DVD? Better hope you have a webcam so that the media player application can directly access your facial reactions to the media being played and upload it to Sony's servers.

<comment><USER9> There's no reason why you couldn't run those apps on a sandbox, even inside Arrakis. And if Sony wanted to force you to have a webcam, they could do it now - they don't need Arrakis.

</comment></comment><comment><USER17> Been done before (some would say to death), and the reason we have memory protection between applications is forgotten because people don't realize how nice it is. Sure, sure, your big "well engineered" web browser needs direct access to the hardware for speed, but painful experience has taught us that giving apps programmers direct access to hardware is a recipe for failure. Besides, there are already plenty of workarounds to get faster (eg, mmap) or even direct access to hardware from userland, not to mention the myriad of virtualization and protection schemes and levels in userland (eg, SELinux). This seems like a solution in search of already solved problems. Although as a research project, it does seem interesting . . .

<comment><USER18> > Been done before (some would say to death)

How is that George Santayana thing? "Those who cannot remember the past are condemned to repeat it"?

I like seeing new ideas being tested in the OS arena. It's a real shame the two dominant OSs these days are Unix and VMS. I refuse to believe these two are the best humans can come up with.

<comment><USER19> From "The Rise of 'Worse is Better'", written in 1989:

"The good news is that in 1995 we will have a good operating system and programming language; the bad news is that they will be Unix and C++."

The predicted date was a little early, but otherwise he pretty much got it right. I think that, from a late 80s Lisp perspective, modern Windows fits into the "UNIX" category, and Java/C#/ObjC/whatever are close enough to C++ to count.

<comment><USER20> >The predicted date was a little early

wouldn't say so - my first Linux machine (slackware, shoebox of diskettes :) i installed exactly in the 95 :)

>from a late 80s Lisp perspective, modern Windows fits into the "UNIX" category

while psychotropic mind-altering effects of Lisp are well known, i'd doubt that it can produce such perception changes or even in such a direction.

<comment><USER19> Windows and UNIX are not so different. Monolithic kernels written in C or C++, permissions largely done with user granularity, byte-addressed memory, virtual memory with per-process address spaces, no hardware support for tagged pointers or garbage collection.... Compared to the variety that's gone before, they look nearly identical in their fundamentals.

</comment></comment></comment></comment></comment><comment><USER21> Looks like they have reinvented part of a capability-based Multics system. Perhaps they should go read Organick:

[http://dl.acm.org/citation.cfm?id=1095599](http://dl.acm.org/citation.cfm?id=1095599)

</comment><comment><USER22> Just wanted to say that I love the naming of the OS. Brings back memories to the classic Dune games I played when I was younger.

<comment><USER23> In case you didn't know, the game is part of a whole franchise that started with Frank Herbert's Novels.

[https://en.wikipedia.org/wiki/Dune_%28franchise%29#Games](https://en.wikipedia.org/wiki/Dune_%28franchise%29#Games)

But yeah, the game was pretty awesome, even on it's own.

</comment></comment><comment><USER24> Hrm, I wonder what they were using for their source control before making it available on GitHub, they've squashed all commits into one giant commit which is really, really unfortunate, especially for people who might want to contribute or understand the code base better. There are tools to port commit history over into git, they should have used such a tool.

[https://github.com/UWNetworksLab/arrakis/commits/master](https://github.com/UWNetworksLab/arrakis/commits/master)

<comment><USER25> Or they found the history too messy, didn't want to publish full author information with email (possibly, because it would mean getting permission) and similar cases.

</comment></comment><comment><USER26> No abstraction is better than having abstraction. See [http://pdos.csail.mit.edu/exo.html](http://pdos.csail.mit.edu/exo.html)

</comment><comment><USER27> Isn't this what DOS did?

</comment><comment><USER28> Where exactly is the framework to build operating systems?

I just want a layer (ie all current linux drivers) without virtual memory or a protected mode (context switches) or process management.

Just a nice API to run code on a core of my choosing, and read and write data from device "streams".

<comment><USER29> These aren't exactly what you're asking for, but check out [http://www.cs.utah.edu/flux/oskit/](http://www.cs.utah.edu/flux/oskit/) and [http://wiki.osdev.org/Main_Page](http://wiki.osdev.org/Main_Page)

</comment></comment><comment><USER30> Although this might be the best operating system ever in existance, I think it's quite hard to get anywhere in the desktop OS market. How can they find users? And if they don't find users, how can they find people who work with them on their software?

<comment><USER29> Arrakis is more of a server OS.

<comment><USER30> Well, if that's the case I misunderstood the landing page. Thanks for the correction!

</comment></comment></comment><comment><USER31> I was really excited when I saw "Arrakis" on the front page but after looking at the project I'm not sure why they chose the name.

If anything should be named Arrakis it should be a terraforming project...or a worm farm.

</comment><comment><USER32> I see the benefits to performance and arguably flexibility. I don't see why this provides "unprecedented reliability".

</comment><comment><USER33> Isn't Arrakis something out of Dune?

<comment><USER34> Yes, it is the name of the planet that is home to the Fremen and the sandworms. In the book(s), the name "Dune" is a nickname for Arrakis.

</comment></comment><comment><USER35> Pretty much sounds like they're trying to turn my laptop into a PS3.

</comment><comment><USER36> I wish our office coffee machine had a direct demultiplexing port into my mouth. For the coffee, that is. Not the waste.

 _application-specific library_ : Yeah, all my circles are squares, too.

</comment><comment><USER37> OK but how do you do pre emptive multitasking?

<comment><USER29> I think the idea is to give each app dedicated cores. (And maybe save one core for miscellaneous stuff.) If the app wants threads it can use a libOS that provides whatever flavor of threads it prefers.

</comment></comment><comment><USER38> what language is it being written in?

<comment><USER39> C

</comment></comment><comment><USER40> arrakis...dune...desert planet...

 _ducks_

<comment><USER36> To be more exact: Duckies! See: [http://www.zefrank.com/theshow/](http://www.zefrank.com/theshow/)

</comment></comment><comment><USER41> This is embracing the second system effect & NIH syndrome that many large apps eventually get.

</comment><comment><USER42> If I understand this correctly, they want all userspace applications to be Ring 0? That sounds.... problematic, to put it lightly.

<comment><USER43> goto fail means an entirely different thing in that operating system

<comment><USER20> until your application implements memory protection, etc... ie. their premise is that modern complex applications contains an OS inside it [ i don't fully agree with such premise, though remembering "nspr" state even back in 1999 i'm not surprised that 10+ years later Mozilla dind't have a problem coming up with their own OS, i'm more surprised that it didn't happen much earlier :) ]

</comment></comment></comment><comment><USER44> As an operating system for a dedicated, single purpose server this may be okay. As an operating system for mobile phones, this may one day be alright (when phones get about 12 cores). As an operating system for workstations and desktops, this is probably the worst idea I have heard in a long time. It sounds like a hipster version of multidos. At one application per core (or at least I think that's the idea), you are severely limiting the ability to multitask. So, on an 8 core system I have one core running the exokernel (1), another core running a gui (2), another core running an audio application (3), another running my web browser (4), another with my editor (5), another with git (6), another with a torrent going (7), and another with email (8). Due to the description, I am hoping that the GUI using a core and other applications having access to it is possible. I also hope that audio services don't need a core, or else the audio application developer will need to reimpelement OSS4 and/or ALSA in his/her application. That's just about idiotic... oh well...</comment>


Ask HN: What's the gravest lack of professionalism you've witnessed at work? - <AUTHOR> <comment><USER2> Our project manager constantly complaining out loud about how our female clients are "cunts" & "bitches" on a weekly basis, in our open office of 10+ designers & developers (two of which were female designers). Talk about killing morale...</comment>


Visa Invests in Square for Mobile Payments - <AUTHOR> http://bits.blogs.nytimes.com/2011/04/27/visa-invests-in-square-for-mobile-payments/

<comment><AUTHOR> This is a very good, and to me a very surpising move by Visa. Instead of ignoring innovation (like brick&mortar bookstores, cable companies), they embrace it. Something I definitely didn't expect from a corporate mogul like Visa.</comment>


Where to Live Next - <AUTHOR> https://www.redfin.com/blog/2018/03/where-to-live-next.html <comment><USER2> Interesting that of all of their recommended locales, not _one_ was majority Republican.</comment>


AWS Elastic Beanstalk adds Docker support - <AUTHOR> http://aws.amazon.com/about-aws/whats-new/2014/04/23/aws-elastic-beanstalk-adds-docker-support/

<comment><USER2> I'm happy that AWS is bringing Docker into the ecosystem, but note that this currently allows for a maximum of _one_ container per instance, which is a rather inefficient use of Docker and doesn't add a lot of value.

Docker shines more when you can have a number of containers side-by-side, isolated from each other. If there's only one thing to "isolate", you don't get as much benefit.

<comment><USER3> I'd love to turn this around and ask - what would you feel is a good experience integrating the two?

I spend a ton of time thinking about / talking about this; your insight is valuable.

<comment><USER2> I'd want to see it as a `foreman`-like description: identify the Dockerfiles, map to an instance type, and say how many of each container you want.

<comment><USER3> Sounds lovely.

</comment></comment></comment></comment><comment><USER4> Additional discussion: [https://news.ycombinator.com/item?id=7636785](https://news.ycombinator.com/item?id=7636785)

</comment><comment><USER5> How much CPU power does one instance get then? I mean are this the default ec2 instance types or something special?

<comment><USER6> You choose the instance type yourself when creating the Elastic Beanstalk app.

</comment></comment><comment><USER7> Makes you wonder when Docker will go 1.0 and be officially "ready for production".

<comment><USER3> We've been pretty transparent (I think!)

We will deliver 1.0 as soon as we feel that the core api is intact and we are comfortable supporting for 6-12 months.

<comment><USER8> Well done guys. An important step in adoption and a vote of confidence.</comment></comment></comment>


Hash escrow - <AUTHOR> http://pdf23ds.net/2010/09/28/hash-escrow/

<comment><USER2> What's actually needed is a secure time stamping service. You can read about those at:

<http://en.wikipedia.org/wiki/Trusted_timestamping>

A personal favorite which I highly recommend is the following:

<http://www.itconsult.co.uk/stamper.htm>

Under normal circumstances, one would need an expert witness to authenticate the signature, but in several jurisdictions which enacted digital signature laws statues, that may not be necessary depending on the evidentiary status of e-signatures.

<comment><USER3> ah ya beat me to it. double vote for bamf right here.

</comment></comment><comment><USER4> These guys did exactly what's being proposed in the article.

<http://www.win.tue.nl/hashclash/Nostradamus/>

In November 2007, they posted the MD5 hash of a PDF file containing the name of the winner of the 2008 election. That of course doesn't prove that they knew who would win the election, because they prepared 12 different PDFs with 12 different names in it, all of which were crafted to generate the same MD5 hash. I don't think the hypothetical jury is going to like it.

Okay, let's try again with SHA256...

<comment><USER5> The article mentions hashing the same data with multiple hashing algorithms; I would think this would be effective at preventing collisions (presumably different hashing algorithms are not vulnerable to the same collision attacks).

</comment></comment><comment><USER6> Isn't this whole timestamping thing overcomplicated? Just set up a twitter account and post the hash codes. The code in itself is useless, so it does not have to be kept secret, and you will have a way to proof that you had the document generating it at that time.

<comment><USER7> This would work if you could search all of your tweets. I don't think that is currently possible, is it?

It also assumes that twitter is going to be around when you finally need the timestamped hashes, and that you can prove that twitter (or any other service for that matter) can't have back-dated hashes inserted.

Posting to a usenet group, like alt.test, where independent systems store and timestamp the message would be a better idea.

<comment><USER8> Why not just use multiple webmail services?

<comment><USER9> Email timestamps are laughably easy to fake.

<comment><USER8> Surely Google et al, record the _actual_ arrival time of the email in the headers do they not?

If not, then I'm sure they do in their logs.

<comment><USER9> What stops you copying in a crafted email via IMAP, though?

</comment></comment></comment></comment></comment></comment><comment><USER10> _In criminal cases I can see it often being necessary to within a day or two_

Oh, if only. Digital evidence is seeing a lot more acceptance in recent years - but just recently there has been a sudden resistance to it, partly, I think, because of all the noise being made in the media about the ease of faking such things and the prevalence of viruses.

Oftentimes an audio recording tagged to within a couple of days will be fine.

But don't rely on that - it could easily be rejected out of hand by a judge who is not convinced.

Any sort of ambiguity in digital evidence and timestamps is being frowned on at the moment - at least here in the UK.

</comment><comment><USER11> Is there anything wrong with the idea in the first blog comment? I would think sending the hashes to one or more webmail accounts in your own name would accomplish the feat of proof, and it would not require you to rely on other people to safeguard the data or give testimony.

<comment><USER12> How do you prove the e-mail wasn't changed? At least gmail allows you to upload pretty much anything (which is useful when migrating mail), and may not be able/willing to turn over (old) logs.

<comment><USER13> If they were simply unwilling, a subpoena would fix that.

</comment></comment></comment><comment><USER14> <http://www.registeredcommons.org/></comment>


Ello – A simple, beautiful, and ad-free social network - <AUTHOR> https://ello.co/

<comment><USER2> I've seen this posted a lot on my Facebook by members of the LGBT community after FB decided that drag queens have to use their legal name. I'm curious to see how the community develops and to try it out when my invite comes through.

Are there any other specific communities that are shifting to Ello?

</comment><comment><USER3> Ello.co = el loco = the crazy one Pun intended?</comment>


Brisk = Cassandra + Hive + Hadoop - <AUTHOR> https://github.com/riptano/brisk/tree/brisk1

<comment><USER2> The main selling point is that Cassandra has replaced HDFS as the underlying filesystem for Hadoop.

I'm curious: what are the performance implications of using CFS instead of HDFS? Is it faster/slower/more fault-tolerant? (It appears to be the latter, given that there's no single point of failure in CFS).

<comment><USER3> That's one point: CFS means it's more fault tolerant and simpler to run (only one type of node), with equal-or-better performance. You also get multi- datacenter support essentially for free.

The other big win is you can run analytic queries against your realtime data (data in Cassandra columnfamilies/tables, rather than a blob interface like CFS/HDFS) instantly, with no ETL. (An example: <http://www.datastax.com/docs/0.8/brisk/brisk_demo.>)

Finally, Brisk takes care of integrating the Hadoop job/task trackers with Cassandra automagically, which otherwise requires fairly deep knowledge of both Hadoop and Cassandra (<http://wiki.apache.org/cassandra/HadoopSupport>).

Brisk also integrates the full stack (including Hive queries) with DataStax OpsCenter: [https://s3.amazonaws.com/uploads.hipchat.com/6528/23268/uohl...](https://s3.amazonaws.com/uploads.hipchat.com/6528/23268/uohlm21erckytzx/jt.png)

</comment></comment><comment><AUTHOR> Documentation: <http://www.datastax.com/docs/0.8/brisk/index></comment>


What are the most frequently asked questions by a VC? - <AUTHOR>

When you go for a fund raising, what are the most frequently asked questions by a VC? <comment><USER2> Why are you bothering me? Can't you see I'm checking my Blackberry?

</comment><comment><USER3> * How are you going to use my money ("put it to work")?

* To what point will my money get you?

* Who is your competition?

* How are you better/different than your competition?

(Paraphrased of course and pretty limited VC experience here. I'm not actually sure how common they are, but I've heard these questions.)

</comment><comment><USER4> One of my favorite VC questions was, "This all sounds nice, but if it doesn't work out, what other levers do you have to pull?"

I like thinking about my company that way--there's a lot of opportunities out there so it's never the end of the world if the one you're looking at dries up.

</comment><comment><USER5> What gives you a sustainable competitive advantage?

</comment><comment><USER6> What problem do you solve? How do you scale this? How big is the market? What do you want to do this the money? What key assumptions do you need to prove to make this a success? WHat metrics are you going to use to validate these assumptions?

</comment><comment><USER7> How are you going to get really really really really big?

</comment><comment><USER8> Good question... I have nothing to contribute but look forward to reading the posts.

</comment><comment><USER9> How will you make money?</comment>


Alternatives to Global Variables: Singletons or Dependency Injection? - <AUTHOR> https://levelup.gitconnected.com/alternatives-to-global-variables-34982becfcc?source=friends_link&sk=0370dd69ebaa7b92c32a743c459d7a71 <comment><AUTHOR> Global Variables are often termed as evil. Considering the hurdles you'd face with them(when used in excess), what are your alternatives? Using Singleton Design Pattern--which is nothing but a fancy global or passing arguments like Dependency Injection?</comment>


Ask HN: Should I become a DNS registrar? - <AUTHOR> I want to update the root servers for my few dozen hobby domains and I can see running a registrar as a hobby.  The requirements look rather easy to meet. [1]  I sit through audits all the time.  Not sure if I really still have to run a Whois server, since that is going away.
I can not find an existing registrar that meets my requirements:
- No web UI, just an API
- Easily define apex nameserver records in API
- Drop domains no longer in use via API
Has anyone else tried to create a registrar and what technical or bureaucratic challenges did you run in to?
[1] - https://www.verisign.com/en_US/channel-resources/become-a-registrar/verisign-domain-registrar/index.xhtml <comment><USER2> I think you are vastly underestimating what it takes to become a registrar, specifically requirement #1 from your link "ICANN Accreditation". Take a look at points 24 and onward for yourself.

[https://www.icann.org/resources/pages/application-2012-02-25...](https://www.icann.org/resources/pages/application-2012-02-25-en)

Additionally there are fees associated with being ICANN accredited. The application fee alone is $3,500, on top of that you have to pay a yearly $4,000 accreditation fee.

I seriously doubt you would even get approved if the required business plan you provide them is "Hey, this is my side hobby/gig".

<comment><AUTHOR> I am ok with the fees. I suppose I could create a business model and even use a funding site to get more interest. Perhaps there are a handful of other hobbyists that could benefit as well.

I agree this is non trivial. That said, I have done crazier things on a whim with some level of success.

<comment><USER3> Tell us more! I love crazy stories!

</comment></comment></comment><comment><USER4> > No web UI, just an API

I'm not sure there's is a market for it unless you have a bunch of other dev related services that you'll provide and also are willing to spend a lot on promo campaigns besides the ICANN accreditation fees.

<comment><USER5> Perhaps "All the options of the UI are available in the API and more!" is a better selling point.

Disclaimer: I like UI. I use TortoiseGit 99% of the time and I use the CLI for scripting and weird cases.

</comment></comment><comment><USER6> I had no idea this was possible. I would like to see what people have to say about it.</comment>


PostmarketOS // PinePhone CE available for pre-order - <AUTHOR> https://postmarketos.org/blog/2020/07/15/pinephone-ce-preorder/ <comment><USER2> These are exciting times. It's encouraging to see this among all the waves of new devices that restrict what one can do with their own hardware.

I feel like there's a silent war on general purpose computing, (in the sense of having open, non AppStore platforms, ability to boot other OSes etc.), so these efforts are very important in my opinion.

I already have an earlier revision, but pre-ordered this as well both to have a "daily driver" device and a secondary one for more risky tinkering and to support the projects involved, (PINE64, postmarketOS).

I feel like GNU/Linux on smartphones is where the excitement currently is if you want to see rapid improvement on an open platform in the hacker spirit of early Linux desktop. There are daily builds with major, visible improvements, excellent geeky community, lots of potential on this frontier.

One major recent improvement is that battery life is now on par with most mainstream smartphones, (with the modem disabled much, much longer even).</comment>


The most overlooked market for sex robots is women - <AUTHOR> https://qz.com/1050997 <comment><AUTHOR> Really? Last time I checked, event moderately unattactive women can basically get sex anytime they want because of the nearly infinite, perpetual supply of horny males on Craiglist. Also, the competition of the assortment of toys already in existence. Seems like an article in search of a "problem."

</comment><comment><USER2> Seems like no matter what you believe, you'll find an article online supporting it.

<comment><AUTHOR> Pretty much. Self-fulfilling prophecy-reinforcing eyeball readership combined with a sense of not wanting to miss the Next Big Thing(TM). The rise of social media and decentralization of information broadcasting deemphasizes professional editing, journalistic filters and may lead to rumors and odd views being more often catapulted into popularity. It seems like each major social media platform needs a volunteer "army" of common-sense combined with deep-learning to moderate things that are unnecessarily hateful, harmful, conspiracy theories and such nonsense.</comment></comment>


Google Bans Infowars Android App over Coronavirus Claims - <AUTHOR> https://www.wired.com/story/google-bans-infowars-android-app-alex-jones-coronavirus/ <comment><USER2> Google kicked out this guy: "Jones disputed the need for social distancing, shelter in place, and quarantine efforts"

As a former attorney, I fully appreciate the importance of the 1st amendment for our country. Nevertheless, I commend Google for doing this. Great job!</comment>


pfSense: Open source network firewall distribution - <AUTHOR> https://pfsense.org/ <comment><USER2> Last time I checked, pfSense was good at firewalling but bad at everything else security-wise.

\- Web panel allows root code execution on the device (every XSS is full RCE!)

\- Everything runs as root

\- No ASLR or other hardening flags because FreeBSD

\- Lots of XSS and CSRF opportunities (probably got better with the new UI)

\- Did not replace SSL certificate after Heartbleed (on packages.pfsense.org!)

\- No package signing, either (not sure if this is still true with pkgng)

\- Did not even _have_ SSL on packages.pfsense.org until one or two years ago

I'm also missing the fq_codel queueing discipline on my home network (prevents bufferbloat).

I still use it since it's awesome, but I hope their security posture has improved since.

Most of the commercial vendors are even worse, but still.

<comment><USER3> Are there other valid open-source alternatives, possibly Linux-based ?

<comment><USER4> Just use OpenBSD. They are the upstream developer of pf anyway.

pfsense uses FreeBSD's fork of pf, which is _years_ out of date. They forked in order to add multithreading, ostensibly for performance. But the diff is too complicated to keep rebasing on top of upstream, so they're stuck with a pf from 2009.

Here are a few resources to get you started. You'll learn plenty about routing!

[https://www.openbsd.org/faq/pf/example1.html](https://www.openbsd.org/faq/pf/example1.html)

[https://www.22decembre.eu/2016/05/27/openbsd-router- en/](https://www.22decembre.eu/2016/05/27/openbsd-router-en/)

Compared to Linux, OpenBSD is starkly minimal. It can be a little bewildering when common programs seem to be missing, but the man pages are outstanding. And the system is very simple and reliable. Config files are almost comically short. My /etc/hostname.re0 config is just five bytes: `dhcp\n`.

<comment><USER5> I appreciate pfSense offering something that's better than the average firewall, but I really wish they would just build it on top of the latest release of OpenBSD.

OpenBSD and pf really is the best. As noted above, FreeBSD has wandered off into the weeds with pf for no good reason. There have been so many improvements to pf since 2009 that I wouldn't even consider using something that old.

I used pfSense years ago when I was first learning firewalls. These days the best GUI for me is no GUI but a CLI, but some people don't want to take the time to build a firewall. Granted, once you know how to do it, it doesn't take that much time to build a firewall, but it does take time to understand what you're doing and why. But really, not that much time, considering the aggravation it can save you down the road.

<comment><USER6> Why does pfSense use FreeBSD vs. OpenBSD?

<comment><USER7> Mostly because m0n0wall was written on top of FreeBSD.

<comment><USER8> you also dislike many OpenBSD policies, and developers.

<comment><USER7> There are exactly two things I dislike about openbsd.

One is the past behavior of one developer who claimed to reverse engineer code that obviously wasn't.

The other is a mistake made in 2003, to which they've still not owned up.

You don't silently patch security issues, especially when they are discovered and fixed by someone outside the project.

Other than these, I have nothing but admiration for the project and it's developers.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I liked pfSense until it got too beefy for my ALIX board. That forced me to move to OpenBSD, and boy am I glad I did.

Once you grok the syntax, it is so much easier to directly update settings in pf.conf than the pfSense web GUI--especially traffic shaping rules.

That, and OpenBSD has great documentation, decent IPv6 support, and almost everything you need already baked-in.

Here's a basic set of config files for a home setup: [https://github.com/BourgeoisBear/OpenBSDFirewall](https://github.com/BourgeoisBear/OpenBSDFirewall)

If you need IPv6 or anything fancy, PM me.

<comment><USER10> ugh, i wish we could use that syntax on the linux side of the computing world

<comment><USER11> I recently switched to nftables on Linux and the syntax is great, you should give it a go. I wrote a blog post demonstrating my server configuration. Shameless plug: [https://stosb.com/blog/explaining-my-configs- nftables/](https://stosb.com/blog/explaining-my-configs-nftables/)

<comment><USER12> Does nftables support packet tagging/policy filtering ala pf's "tag" keyword [1]? It's so nice to tag a packet as "trusted" once it has passed an input filter, and then just pass trusted packets on outbound interfaces based solely on the tag.

For example, on my OpenBSD firewall I can write the following simple rules to restrict outbound Internet access to a specific set of IP addresses or networks:

      # internal_if is the LAN-facing interface; isp_if is the ISP-facing interface, i.e., the Internet.
      match in log on internal_if from <internet_allowed_networks> tag OUTBOUND
      pass in  log quick on internal_if tagged OUTBOUND
      ...
      pass out log on isp_if inet tagged OUTBOUND nat-to (isp_if) static-port

The tags are sticky, so that you can apply multiple tags to packets and sort through the tags later in the pipeline.

If nftables supports something like this, I'll probably make the switch, as I prefer Linux in every other way to OpenBSD.

[1] [https://www.openbsd.org/faq/pf/tagging.html](https://www.openbsd.org/faq/pf/tagging.html)

<comment><USER11> I'm not familiar with the pf "tag", and I gtg so I don't have time to read more, but it seems very similar to "mark"[1]. It essentially lets you mark a packet with a tag (if memory serves it's a 32 bitmap you can do whatever bitwise/assignment operations to). I used it in the beginning, but then I managed to find cleaner ways to do what I was doing.

For me nftables changed the game for linux firewalls. From the almost incomprehensible mess that was iptables we now have a clean language that lets me be quite DRY, and is easy to work with.

1: [https://wiki.nftables.org/wiki- nftables/index.php/Setting_pa...](https://wiki.nftables.org/wiki- nftables/index.php/Setting_packet_metainformation#mark_and_conntrack_mark)

<comment><USER12> nftables "mark" would behave like pf "tag" _if_ you can filter a packet further downstream based on the value of the mark. (It looks like the mark functionality is also present in iptables.)

If people are using marks for policy-based firewalls a la tag in pf, it doesn't look like a particularly common practice, based on a quick Google search. Anyway, it's a start. Thanks for the pointer.

<comment><USER11> There's a page somewhere on the nftables wiki that shows all the operations you can do, but you essentially can bitmask and compare, or just compare and do something based on the result of that conditional, so I guess exactly what you want.

</comment></comment></comment></comment></comment></comment></comment><comment><USER13> Netgate/pfSense has been notoriously anti-community, with their own co-founder attacking other projects, including a recent fork called OPNSense.

They've also been very hostile towards the OpenBSD developers, and project. Despite the fact they've effectively built a business on OpenBSD innovations, like pf and CARP, even incorporating the name 'pf' into their trademark having not contributed a bit of code.. n̶o̶r̶ ̶a̶ ̶d̶i̶m̶e̶ (but perhaps some hw).

But feel free to keep using it.. no need to take my word for it.

[https://www.openbsd.org/donations.html](https://www.openbsd.org/donations.html)

[http://www.openbsdfoundation.org/contributors.html](http://www.openbsdfoundation.org/contributors.html)

<comment><USER14> I won't defend their demeaning public behaviour towards OpenBSD. I find it revolting.

But they did make one donation to this OpenBSD developer. They sent me 3 rcc- ve boards which I am still using for development: [http://cvsweb.openbsd.org/cgi- bin/cvsweb/www/want.html#rev1....](http://cvsweb.openbsd.org/cgi- bin/cvsweb/www/want.html#rev1.945)

They took much more than they have given (which the source code licence allows them to do, even if it's morally wrong). Claiming they never gave anything at all is incorrect.

<comment><USER15> > They took much more than they have given (which the source code licence > allows them to do, even if it's morally wrong).

I don't want to start a flame war, but if the BSD license allows for them to do this, why is it morally wrong?

That is - how can you complain when the license explicitly allows for this? If you (not you personally, of course - but the OpenBSD project) didn't want this to happen, then the license would need to be changed to prevent it.

Of course then, companies wouldn't be as willing to use the code, as we tend to see with the GPL.

But if companies are just going to take the code, modify it, and not contribute the changes back (or contribute little back), where's the loss by using another license?

If the loss is "but the code then won't be used in the greater ecosystem", why complain when it is?

Again - I'm not trying to cause a flame war; everybody has their license and needs. I'm just trying to understand why there is complaints when code isn't contributed back under the BSD license, when it explicitly allows for this.

Furthermore, I am wondering if there is anything we can do about it, that doesn't cause the kind of ire to rise when the GPL is invoked instead. Perhaps there isn't a solution, but I'd love to hear ideas on the subject.

<comment><USER16> There is a difference between forcing what you believe to be right onto others via legal means, and wanting people to do the right thing because it is moral to do so.

<comment><USER17> The GPL exists because Stallman knew that corporations seldom do the right thing if not required so by law.

<comment><USER18> And like the DRM he detests so much, he hurts the "good guys" more than the "bad guys".

Plenty of companies simply avoid the gpl because it complicates things, and stick to more permissive licenses for their open source efforts.

Plenty more just do what the fuck they want regardless of what the gpl says.

<comment><USER19> And yet there are many thriving GPL projects, running on billions of devices worldwide, from routers to servers. GPL has created an environment where Netgear and Linksys collaborate on developing the same pieces of software, not due to morals, but due to it being the best option for themselves. Same with IBM and many other companies working on GPL sofware.

<comment><USER20> > not due to morals, but due to it being the best option for themselves

Indeed, and this is why the same thing happens in the BSD world. There are many examples of large and small companies, competitors, working on the same parts of FreeBSD.

Enlightened companies contribute to Free and Open Source software because it's in their best interest, not directly because of the license. Conversely, there are countless examples of companies who don't think it's in their interest, and willfully violate the GPL.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> If you want a pf firewall, you should probably get it from OpenBSD.. they created pf.

[https://www.openbsd.org/faq/pf/index.html](https://www.openbsd.org/faq/pf/index.html)

</comment><comment><USER21> I used pfSense for a long time and ultimately the conclusion was it was a 75% solution. It made those 75% things pretty easy to set up and configure. But once you needed something from the 25% you had to dig into the BSD configuration and now had to deal with how that interoperated with the pfSense stuff. Better to just bite the bullet and configure BSD (or linux for some things it does even better) from scratch and get exactly what you want and need.

</comment><comment><USER22> I can't say enough good things about pfSense. I'm running three of 'em and would gladly trash my Checkpoint firewalls to use pfSense, if our parent company didn't mandate them.

I've run it on everything from tiny, Atom-based machines to kitted-out HP DL385s, and even on ESXi virtual machines. It works great in all scenarios.

</comment><comment><USER23> Happy user here. I have used this exclusively for the past eight years. It's gotten better as it's got more commercial – better UI, more polished plugins, better features, etc.

</comment><comment><USER24> PfSense is awesome! It runs very well for very little money on your own hardware [1].

You can do so many things easily. For example force all local chromecasts via a VPN for netflix.

[1] [https://pcengines.ch/apu2.htm](https://pcengines.ch/apu2.htm)

<comment><USER25> Agree. I've been running pfSense on HP thin client (T5740[1] with expansion module + gigabit dual port ethernet NIC) and was pretty happy. Cost to me was about $60 for fully working firewall/router.

[1]: [http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_...](http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c01926335)

</comment></comment><comment><USER26> We've had a lot of success with pfSense. BGP works, IPSEC works, most things work quite well with no headaches. My previous employer used a Watchguard firewall and to be honest pfSense was a much better experience all around.

Except for cloud VOIP. Neither 8x8 nor Shoretel worked worth a darn through this firewall. We even paid for the gold support and opened more than one support case with no luck. It appeared to be a RTSP issue, SIP didn't have any trouble. And it was intermittent. Most of the time it would work, occasionally it would not. Eventually we replaced pfSense with a Cisco router for our phones and it worked fine.

</comment><comment><USER27> I always had this question - can something like pfsense be built on linux _with comparable performance_ or is there something inherent to the whole stack that makes this effective?

I have always wondered if building pfsense on a modern linux kernel + selinux + BPF with something like nginx/lua scripting (for addon packages) would make more sense.

[http://www.brendangregg.com/blog/2016-10-27/dtrace-for- linux...](http://www.brendangregg.com/blog/2016-10-27/dtrace-for- linux-2016.html)

<comment><USER28> [https://vyos.io/](https://vyos.io/) might be what you're looking for.

<comment><USER29> So is VyOS the successor to Vyatta?

It looks like maybe this project forked after the purchase by Brocade.

As a side not Vyatta is the base OS in many of the Ubiquiti Networks routers. It's quite nice for small office/ home office.

<comment><USER30> I would say it's nice enough for more than just "small" stuff. Depending on your definition of "small", I guess.

I'm running a VyOS machine (old desktop with a couple of NICs) which handles the traffic for our Copenhagen office. That's ~15 CI boxes, and 30 people. This is on a 100/100 connection.

For Ubiquiti, I'm a fan. I helped our co-working space setup a network on another floor, and we used an EdgeRouter Lite to handle the 200/200 connection. The ERL handles it without breaking a sweat. That's for 60 people on a daily basis.

For another building, I just finished setting up an ERPro (the 8-port rack- mounted version). It's again on a 200/200 connection, and for roughly 150 people on average, with a maximum around 300-500.

At home, I have an ERPoE, which handles my home lab just perfectly. I'm only on a 100/100 uplink at the moment, but will be upgraded to 1000/500 soon, and I know the ERPoE will handle that just fine as well (thank you hardware offloading ;)). 5 VLANs with full firewalling and routing between them, native IPv6 with prefix delegation, mDNS proxying between VLANs, OpenVPN handled by the router. I could do a lot of this with OpenWRT on an Archer C7, but the ERPoE is simply miles ahead.

The UI is nice for newcomers, and the CLI is amazing. I fell in love with the CLI on VyOS, and am very happy to see the same in the UBNT products. For $100, they are amazing devices. VyOS is my go-to choice when I need to have a virtual router.

<comment><USER27> are you talking about vyos or ubiquiti. Im not sure what the relationship is between them - could you talk about what's so amazing for a complete first timer?

i currently have pfsense running on a mini quad NIC box ([https://m.aliexpress.com/s/item/32670582442.html](https://m.aliexpress.com/s/item/32670582442.html))

do you think vyos will run on this stuff. in your opinion are pfsense and vyos generally at par?

<comment><USER30> VyOS is just software. So nothing to purchase there. It's what I use when I need either a virtual router, or want to use commodity hardware to act as a router. It's great to throw in ESXi or another hypervisor, or even EC2. It comes with all features you might need (probably), and because it's fairly standard Linux (Debian based), making it do extra things isn't very hard.

The ERL is $100, and comes with Ubiquiti's EdgeOS, which is largely based on VyOS (or something like that), and simply adds a (decent) web UI, and hardware offloading. This means that the ERL which runs on a dual core 700Mhz MIPS CPU can route 1Gbit/s, and not even break 30% CPU utilisation.

Where VyOS shines is when you need to cobble together a bunch of things. If you just need a pure firewall, I would probably stick with pfsense, as that is, after all, what it is good at. VyOS only offers iptables with some lipstick (which is well enough for a Swiss-army knife setting)

I guess VyOS would run on that box. I can't see specs, nor know what network chipset it is rocking, but I don't see why not.

</comment></comment></comment></comment></comment></comment><comment><USER31> It's been a few years since I used pfSense (maybe 7 or 8 years?) - when did they become so "commerical"?

(I'm not saying thats a bad thing, I really have no opinion on that, I'm just curious!)

<comment><USER32> There are over 500,000 pfSense installations in the wild. The creation of a company around pfSense has allowed them to offer real support and hire developers to improve everything from the UI to massive improvements to network stack/firewall and even IPSEC performance. These changes get pushed upstream to FreeBSD, everyone wins.

<comment><USER8> what developers have they hired? besides Neville as a consultant for FreeBSD netstack performance improvements.

<comment><USER7> There are two FreeBSD committers on staff (one second, the other ports), the author of the O'Reiley book on git, the guy who rewrote the GUI, and three others.

Several have really deep telecommunications equipment / router vendor experience.

Plus gnn, whom, as you say is a consultant. If we're going to include him, we should include Patrick Kennedy, who has done work on libuinet for us.

</comment></comment></comment></comment><comment><USER33> You know what's open source and works great as a firewall (also based on pf)?

OpenBSD.

No, seriously. Don't bother picking a third-party repackage of pf, when you can actually get the a secure OS built by people who actually put security above everything else. If you care about security, there's no reason to go elsewhere.

</comment><comment><USER34> A fan of pfSense, I've used/deployed it a number of times to customers, and for some previous employer bits. Current version doesn't have an API, but is fine for what I do with it.

I did see people hating on it here, and while I cannot/will not speak to their specific issues, I look at it as a much better tool than the integrated hardware units you can buy online for ~$100USD, with also integrated back- doors, courtesy of the development effort.

I know perfectly well that I could build what I need using IPtables ... but have you used IPtables? I'm a CLI guy, and heck ... I want a GUI for IP tables ...

I've not yet played with the nftables, and frankly, I am looking for a generally simpler model of putting some of these things together. pfSense does a pretty good job of this.

One note on the php on the stack ... yeah, this is a concern for me as well. So I don't generally expose the admin access to the interwebs. And I lock that aspect down pretty hard (only specific addresses are allowed to even connect to the admin port). This isn't perfect, but its far better than setting up a web port, and suddenly presenting the pfSense gui out (yeah, this sorta happens by default if you don't move the gui to a different port, and do some other config).

This all said, it is pretty good for what it does, and a few of my previous customers have bought the support for it directly from the team.

</comment><comment><USER35> I use pfSense as a vitual machine to firewall/NAT off my vitual environment. It works great. I am running it on KVM/QEMU and handing off the PCI device to the pfSense VM. Great for managing my environment through VPN.

I've also used this in a retail chain in DC/MD/VA. Each location used pfSense for site-site VPN (OpenVPN). We also used the asterisk package to handle VoIP.

Overall, pfSense is a robust UTM.

</comment><comment><USER36> Is this 'pf' like the BSD firewall? Anyone more familiar with the space want to provide some detail?

Edit: yeah it is:

> The pfSense project is a free network firewall distribution, based on the > FreeBSD operating system with a custom kernel and including third party free > software packages for additional functionality.

From [https://pfsense.org/getting-started/](https://pfsense.org/getting- started/) see also [https://doc.pfsense.org/index.php/Installing_pfSense](https://doc.pfsense.org/index.php/Installing_pfSense)

<comment><USER37> Yep, basically a really nice web interface and management system for configuring a pf-driven firewall.

You can click your way to high availability with sub 5-second failovers (even including NAT state synchronization) in a morning starting from no pfsense or bsd knowledge.

</comment></comment><comment><USER38> We use pfSense at a client of mine and it's great. I didn't have any prior experience with it but I only spent a couple of nights setting everything up. We use it to manage firewall rules and as DHCP server for 2 VLANs.

We've used it for about a year now. Had several power outages. The pfSense box is still running like a champ, no problems whatsoever.

Turns out my client actually wanted an email spamfilter though, but our mail is hosted in another country so I had a little trouble explaining why our internal pfSense couldn't help us there. Oh well.

</comment><comment><USER39> I've been using PFSense both at various workplaces and at home for many years now, it's seriously fantastic. Feature rich, rock solid and good 3rd party packages.

</comment><comment><USER40> Yet I use Smallwall, the successor of M0n0wall on an old Soekris 5501-70. It is just a firewall, no bells and whistles and therefor very stable.

</comment><comment><USER41> Unless your needs are extreme in which case you will have networking experts making choices the linux networking subsystem is actually quite good both in terms of tooling and performance.

I experimented with Vyatta which was based on Debian - open source fork now used by Ubiquity networks in their devices, and pfsense a couple of years ago and I found plain linux on its own delivers better performance. The recent series of Ars articles on building your own router confirm this with some benchmarks [1]

[1] [https://arstechnica.com/gadgets/2016/01/numbers-dont-lie- its...](https://arstechnica.com/gadgets/2016/01/numbers-dont-lie-its-time-to- build-your-own-router/)

</comment><comment><USER42> Been using pfsense for a while now, and with CARP and system redundancy, firewalling, and twin ipsec tunnels to AWS, it's been great and hugely reliable.

</comment><comment><USER43> Does there exist an analog to this for switching (particularly an organization that sells hardware)?

</comment><comment><USER44> Having used pfsense for a good few years, we recently switched to Meraki.

Global infrastructure and Meraki APs just made it easier to go with their ecosystem, despite the licensing costs.

<comment><USER45> Ironic. I just did the reverse. Moved from years of Meraki to pfSense (or Palo Alto Networks at another company). The Meraki WAP's are mostly great, their switches are fine, but their "gateway" devices are terrible. The performance is horrible and their internal tests have proven as much. If you need more than 150mbps consistently, Meraki is going to bite you in the ass.

</comment></comment><comment><USER46> I don't have such experience. I tried to configure IPSec and IKEv2 in pfSense following the instructions and it never worked with a Windows client. There are a lot of questions related to this on the forums without a concrete/canonical answer.

I like pfSense but I chose it to easily configure usually complex networking stuff, not a DHCP or DNS. We are trying now to configure IKEv2 on an Ubiquiti device using UniFi with a load balancer and doesn't seem to be trivial.

<comment><USER47> When did you try the IPSec/IKEv2 in pfsense? Prior to, I think, 2.4 you had to go into the registry and do some hack to get around certificate limitations. It's no longer necessary and setup was a breeze for me (and the registry hack worked for me as well). I loosely followed: [https://doc.pfsense.org/index.php/IKEv2_with_EAP- MSCHAPv2](https://doc.pfsense.org/index.php/IKEv2_with_EAP-MSCHAPv2)

<comment><USER7> > Prior to, I think, 2.4

2.3 (which got Strongswan), but yeah.

2.4 isn't released yet.

</comment></comment></comment><comment><USER48> I reviewed pfSense around nov 2016, it failed on many basic security best- practices, and was rejected for our purpose.

<comment><USER7> Yet in the same timeframe US Army Cyber Command selected it to stand in front of their infrastructure.

<comment><USER48> Lol

</comment></comment></comment><comment><USER49> Do they have an API yet? Because I hated using it without an API.

<comment><USER50> Same here.

No API means no automation, no Chef/Puppet/Ansible/Salt or other kind of scripts. Everything in the head of the person who clicked through the web interface.

Are there automation friendly alternatives?

</comment></comment><comment><USER51> I want something like that in docker :)

</comment><comment><USER52> Guys, they started in 2004. Its 2017 today. hackersNEWS ?

</comment><comment><USER53> Usually when people mention they run pfSense it means, "I heard pfSense is good for security so I use it". If I get that impression in an interview, GG. IMO it's an easy litmus test for netsec/secops roles. If you can't write a pf rule, there are probably bigger issues. OpenBSD is the way to go.

I also think the pfSense CEO has a massively inflated ego and pays little homage to the roots of his software. Does pf _really_ need a GUI?

 _edit:_ clarity.

<comment><USER54> Are you saying that people who use pfSense don't know what they are doing?

<comment><USER53> Not quite. But I am saying I've always found better candidates.</comment></comment></comment>


Pharma's Bizarre Pricing Shrug - <AUTHOR> http://www.bloomberg.com/gadfly/articles/2015-11-16/drug-price-pressures-have-only-just-begun <comment><USER2> Worst case scenario:

People will be getting screened earlier and earlier. They will be told they have a horrible disease but there is nothing they can do about it because it is too expensive. The mortality rates from the major killers like heart disease and cancer will drop. This will not be a good sign though. The mortality rates from suicide and poisoning from attempts at self medication will rise. The deaths will just be moved from one to the other category, giving the false appearance of effective and safe treatments.

<comment><USER3> Best-case scenario: Alternate markets will pop up to supply the molecules. There are plenty of such markets out there, I doubt patent-ignorance is beyond them.

</comment></comment><comment><USER4> _Gene therapies may cost hundreds of thousands of dollars, or more than $1 million, for one-time treatments. Companies are pouring resources into developing more such drugs, with no real thought to who will pay for them, or how, and no acknowledgement that the current pricing model can 't expand infinitely._

I wonder if it's reasonable to expect something like Moore's Law for gene therapy?

A 1980s Cray supercomputer cost over $1 million. Today the same amount of computing power is available in the cheapest Android phone you can find.

If the same trajectory applies for gene therapy, it won't be about finding more million-dollar payers. Only those with the most serious chronic diseases will pay for it now, but in 30 years, all of us will have gene therapy for what today would seem like trivial alterations.

<comment><USER5> It's absolutely what will happen (see wind, solar energy or _anything_ that has ever caused market shifts) - in fact, it's pretty incredible that the article doesn't acknowledge this. If the argument was about whether or not prices would drop fast enough, that would have been cogent.

<comment><USER6> you may not be familiar with how healthcare works. There is, generally, almost no price pressure. In fact, consumers of healthcare, because they aren't paying for it, often equate higher price with higher quality so I wouldn't bet on the prices going down

<comment><USER7> but with medical tourism becoming more reliable and trusted, as well as companies hq'd in countries unencumbered by our insistence on patents for biology, it's likely this is where another country takes the "top" spot from the US. China, Brazil, and India all seems like good potentials.

<comment><USER8> Medical tourism doesn't work for chronic disease requiring recurring visits/treatments... unless you _move_ there.

<comment><USER9> _unless you move there_

It's a big opportunity for Mexico, then. Already home of the most cost effective first world (OECD) universal health care system, Mexico has good facilities right on the US border in half a dozen cities and is popular for eye and dental procedures for US visitors already.

</comment></comment></comment></comment></comment></comment><comment><USER10> Nothing in this article mentions that National Institutes of Health public- sector funding does all the work in general research before they give a patent to the private sector so that the public pays twice.

RT on US public research: [https://www.youtube.com/watch?v=kN5_j7Yq9WA](https://www.youtube.com/watch?v=kN5_j7Yq9WA)

(Note I think public funding for science is a good thing, unlike this attack piece by RT, but that is not the point.)

Chomsky also talks about how state-sector created the transistor for example at AT&T Bell Labs.

</comment><comment><USER11> Having "seen the light" on Shkreli's actions, I can't help but wonder whether or not I'm missing something or if people are just intent on driving a false narrative into the ground.

Yes, he jacked the prices up, but only after getting it on a co-pay schedule, which means that like most drugs, you'll pay your insurance co-pay for it, but not the sticker price.

For those without insurance, or who cannot afford it, they've stated (and has been corroborated) that they're happy to give Daraprim away for free.

At the end of the day, the cost of the drug to the insured doesn't really go up by a whole lot, and the cost of the drug to the uninsured (but not 1 percenter) has actually gotten cheaper. In the meantime, Shkreli will be able to funnel Daraprim profits into research for the drug to keep it from becoming irrelevant, as it currently will be if left alone because the disease that it prevents supposedly evolves, and if left alone, would eventually slide from 70% effective to 60%, to 50%, etc.

Meanwhile, for anybody to which that isn't an acceptable solution, these guys have released an alternative for $1 a pill. It may set back drug-parasitic relations in the process, but it's there, it's cheap, and people won't be dying as a result of the price hike.

[http://money.cnn.com/2015/10/23/news/companies/imprimis- dara...](http://money.cnn.com/2015/10/23/news/companies/imprimis-daraprim- turing-martin-shkreli/)

<comment><USER12> Where do you think the balance beyond the co-pay is coming from, though? Magical wish-granting insurance fairies?

Sorry for the sarcastic tone, but your argument, as stated by Shkreli himself, seems to think that people believe that the hundreds (or more) dollars a month they pay in insurance premiums has absolutely nothing to do with this. "But your copay will only be $20 and you won't pay a cent more!"

No, you (or your employer, who could otherwise be paying you that money) will be paying -every last cent- of the price rise. Just largely as an amortized monthly premium, not an out-of-pocket co-pay at the time you pick up your script.

Shkreli seems to believe that people would fall for his argument that somehow the balance of the cost of the drug would be paid by ... I don't know who, exactly, hence those magical fairies ... and not by us.

And in a lot of cases, he's right.

<comment><USER11> Sarcastic tone forgiven, because I was there once too, but it seems like it's mostly liberals and progressives who are upset by this, while conservatives and capitalists more willing to forgive it. That seems backwards to me, as the progressive argument is that costs should be spread throughout society, from the haves to the have nots, and that if this is already the shell game of insurance anyway, it seems silly that Daraprim wasn't already playing it.

Either way, the capitalists had the right of it -- if the price was too high, there's a $1 per pill alternative right now. Assuming that all else holds true, I just don't see the harm here any more than I see the harm in Motorola charging $800 for their top of the line cell phones while Wal-Mart has one for a small fraction of that.

<comment><USER13> You see no difference between a life-saving medication and a _smartphone_? __No __difference? Not even a little bit?</comment></comment></comment></comment>


Consciousness is worth thinking about - <AUTHOR> http://hack.ly/articles/why-consciousness-may-not-come-from-the-brain/ <comment><USER2> To put it kindly, I'd say this is sophomoric philosophy.

The OP suggests that "a more simple and elegant resolution to this paradox is that there is simply one consciousness, and that it alone observes (possibly, decides) these quantum states.".

This raises obvious the question: where does _that_ consciousness come from? The author makes no attempt to address that problem. The answer he gives "the UNIVERSE is like ALL consciousness, man" doesn't really have substance.

There is other crackpottery, such as the claim that the material world is _created by_ consciousness. This is unscientific (and lousy philosophy) because it's a philosophy that explains something without giving us any insight or deeper understanding.

The suggestion that "consciousness _is_ the present moment" is also confused. Brains experience the present moment together because the present moment is part of the _state_ of the individual brains. If two brains don't share _any_ common input then they don't share the present moment either. Or to put it in a different way, we wouldn't share the present moment in a meaningful way either with a brain that lives in the same world as us but runs 1000x faster or 1000x slower.

I could pick this apart further, but I don't see the point. This article really isn't up to HN quality standards.

<comment><USER3> I've discussed this topic of consciousness with others and there is a common visceral reaction (like the one in this comment) that is common when challenging the presumed location of consciousness, especially from programmers, and I'm curious why.

One thought I've had is that programmers (given our profession) tend to fetishize the idea that ultimately we will understand the brain well enough to recreate consciousness in machine and code. It's pretty exciting to believe that as a programmer; much like it was probably exciting to think that we were at the center of a Ptolemaic universe.

I'm okay with someone wanting to ask whether the world is really flat, even if he doesn't address what other shape it could be. I found this article to be a very interesting questioning about some assumptions we have regarding consciousness.

<comment><USER4> I think most of the "argument" comes from the conflation of the "what is it like" with "where does it live" questions.[0]

Most of the "dumb" arguments about "where does it live" are actually "what is it like" questions, most of which are thoroughly disposed of in Dennett's Quining Qualia.[1]

[0] [http://lesswrong.com/lw/no/how_an_algorithm_feels_from_insid...](http://lesswrong.com/lw/no/how_an_algorithm_feels_from_inside/)

[1] [http://ase.tufts.edu/cogstud/papers/quinqual.htm](http://ase.tufts.edu/cogstud/papers/quinqual.htm)

</comment></comment></comment><comment><USER5> I remember an aside in a neuroscience textbook which asked if, one day, a mystery like "where consciousness comes from" might seem as oddly posed as "where life comes from". Once you've broken "life" into its biological and chemical components - cells, proteins, chemical reactions - incredibly complex as they all are, the notion of "life", or of some kind of essential "life force" just kind of disintegrates. Once you get down to that microscopic level, the illusion breaks down.

<comment><USER6> But with life, everything is physically observable. How you would observe conscious experience in something other than yourself? I don't mean the behaviors associated with consciousness, but conscious awareness itself?

People do a lot of handwaving around this issue and claim we've got it cracked just because we sorta know how the brain works, and yet we don't have a way even to detect whether this thing we're talking about exists. Much less do we know how it works, or how it's created. Our supposed scientific explanations are just a lot of mumbo jumbo when we can't even measure the thing we're talking about. We can detect brain activity, but we're just assuming that's the same thing.

I think ultimately this will be resolved experimentally, but we're a long way from accomplishing that.

<comment><USER7> I think the point is that we perhaps should not expect to find a particular mechanism for consciousness, any more than we should expect to find a life- force.

It could be that the "feeling" of consciousness is just something that comes from being a massively-parallel, unsupervised learning machine.

</comment></comment></comment><comment><USER8> Whether David Chalmers believes that consciousness doesn't come from the brain depends on what you mean by "comes from." He believes that physics can completely describe the physical world; he does not believe in souls and interactionist/Cartesian dualism. Instead, he suggests that information may have both physical and mental manifestations.

While I once found this line of reasoning convincing, I'm no longer so sure it matters. While consciousness itself may be non-physical, under the assumption that physical effects have only physical causes, we should be able to explain why we say we are conscious in physical terms. I'm not sure that an explanation of the latter will also explain the former, but in the end, I don't think we will care. I think we will find that the everyday concept of "consciousness" mixes together many different ideas, each of which are simpler to solve on their own than they are when we consider them together.

Roughly a century ago we went through a similar process with the concept of life. People wanted to know what makes a thing alive, and many intelligent scientists were drawn to the idea that there is something innate to a living organism that makes it alive. After decades of biological research, we're still not sure what makes an organism alive, in the sense that the line between living organisms and inert biological material is not well-defined, but we know how living organisms reproduce and grow, and that's really what matters.

<comment><USER9> _After decades of biological research, we 're still not sure what makes an organism alive, in the sense that the line between living organisms and inert biological material is not well-defined, but we know how living organisms reproduce and grow, and that's really what matters._

It might be as simple as "it's alive while it's a functioning machine." A disassembled car is just parts and can't drive/be-alive, but assembled it is a car and can drive/be-alive.

<comment><USER10> I've come to the conclusion that it is yet another useless question. Or perhaps "it's alive if it interests us". Is the great red spot on Jupiter alive? I don't know, but who cares if it is interesting enough to study? Imagine we finally manage to land on an alien planet, and all we find is robots "living" there. Would we go "ah, too bad, we didn't find life"?

<comment><USER9> I don't think the question is useless, but rather very difficult to answer. We simply don't know enough yet to answer it, but might someday.

As for alien life, I expect if there's anything out there, it's probably intelligent, redundant, and efficient. Who knows what form that could take? It might be robots, or computers, a mesh network, or something else entirely. Whatever form it takes, it'll be limited by the constraints of the universe (or multiverse, or whatever "reality" is).

A lot of people's ideas about aliens are molded from television and movies. Historically we've had humans playing those characters, severely limiting how "alien" they can be. While very inspirational and valuable, it has the negative of potentially pigeon-holing peoples minds.

<comment><USER10> The interesting question in my opinion is, why do we find something interesting. For example if we hope to find alien life, what do we hope to find? That is the real question, not some arbitrary definition of life.

</comment></comment></comment></comment></comment><comment><USER11> I am writing this in part directly to gizmo but also to the rest of the HN readers. First of all, I didn't think it was necessary to call this 'crackpottery'. Coming entirely from a scientific perspective one could write this off as completely philosophical and almost non-sensical. I would like to say that I've definitely gained some new insights or nearly a moment of eureka from reading certain words of the article.

Of course, I can't describe exactly what is it that I've felt. But I can sort of provide the environment into which I've felt that feeling to try to find that common denominator which may exist in all of us.

I've been a big fan of Buddism, I can't say I'm a Buddist but I definitely try to take elements from Buddism that I concur with to better define my own experience with the world. Buddism has a notion which is identically described by the author - observation of the world without egos. Buddism suggests that being able to achieve this allows inner zen. I'm here not to advocate nor prove anything related to Buddism, I just want to use it for a setup leading to where I am at.

Through schooling an education, one thing we've learned is to be objective, and unbiased. This means innocent until proven guilty; do not accept any claims without facts; discounting scientific discoveries without proofs etc. That is, we come to be capable of being objective with things that do not 'directly' connect with our consciousness. Now, entering the consciousness, can we still be objective? Can we observe our own failures just like how we observe the failures of others without emotional attachment? Can we connect to what others say to comfort us when we experience a rejection, a breakup? Can we understand that the past cannot be adjusted and therefore NEVER experience the feeling of regret and ONLY gain experience of what could be done better next time if the same were to happen? In general, can we completely deattach ourselves from our emotions and just observe the entities, whether it be you, him, or I, it's all the same.

I can't speak for others, but for a brief moment while reading the article, I've felt a weird out-of-place sensation where I'm just a being, and I am not I. It's almost as if disconnecting my consciousness with my body, it's almost scary.

Just food for thoughts.

</comment><comment><USER6> I think ultimately this will be resolved by experiment.

If progress continues far enough, then eventually people will want to upload their minds to computers, probably using Moravec's method of gradually replacing neurons with hardware.

The prudent way to do this would be to ask the person how it's going as you progress, and try it in various different sequences.

So if, say, you replace the visual cortex, and the person reports that their perception of color and depth has disappeared, but they still know where things are, then you know that the new hardware is correctly reporting information, but for some reason isn't supporting conscious perception of that information.

And then you can try to debug it. Maybe your algorithms are wrong, or maybe consciousness requires some physical effect.

</comment><comment><USER12> It's certainly worth thinking about longer than the author has. I don't want to be mean, but the part about QM, in particular, was just infuriating.

I wish we could send out a memo to the world that says "Please do not draw metaphysical conclusions from mathematics or science unless you are an expert on the field you are drawing conclusions from."

<comment><USER13> I'd tear up the memo. Ignore, demolish or be persuaded by a conclusion by all means but don't define who may or may not contribute it on the basis of a fitness-to-participate filter.

<comment><USER12> I didn't say anything about prohibition. I said I want to send a memo _requesting_ that people not do that. It's for their own dignity as much as anything. Please don't try to make this a "freedom of speech" thing. It's not.

But it's silly to try to generalize to philosophy from science and math that you have only a superficial grasp of. It can be a good way to look deep to people who are similarly ignorant (see Deepak Chopra), I suppose, but it's not a good way to find the truth.

</comment></comment></comment><comment> guard-of-terra Imagine having consciousness having an evolutionary advantage. Imagine the possibility for a complex neural network to "bind" a part of external consciousness to itself. Then you have external but brain-trapped consciousness as an evolutionary possibility.

How to prove: First step is to find some creature with nerves but provably lacking consciousness.

<comment><USER14> > Imagine having consciousness having an evolutionary advantage.

Because consciousness exists among apparently successful species, it's a reasonable working hypothesis that it has survival value. In evolutionary studies, the burden of evidence is properly borne by those who would argue that an existing, seemingly adaptive trait _doesn 't_ have survival value.

> First step is to find some creature with nerves but provably lacking > consciousness.

As to "provably", that can't be done. To prove a lack of consciousness, we would first have to create an objective positive test for consciousness. To do that, we would have to fully define and objectively quantify consciousness. We're nowhere near that stage.

<comment> guard-of-terra We can try to figure out how to create consciousness in something that didn't have it or remove consciousness from some living being, but we can't prove that we have a success before we understand what consciousness is.

By the way, if we were find why consciousness has evolutionary advantage we'll have a subset of what consciousness is. A set of traits for which we can test.

<comment><USER14> > By the way, if we were find why consciousness has evolutionary advantage > we'll have a subset of what consciousness is.

Not necessarily. There are plenty of fitness adaptations we can crudely quantify (group A had adaptation X and was more successful as a result) but can't explain (in a rigorous, falsifiable way). The reason is that nature (natural selection) is "smarter" than we are.

Also, the Turing test -- the idea that a sufficiently advanced computer program might pass as human if accessed at a text-only terminal -- tells us that our idea about what counts as a conscious being is pretty limited.

> A set of traits for which we can test.

If we chose a set of traits that we thought identified a conscious person, we could just submit the set to a computer for blind simulation. My point is that consciousness is more complicated than simple behavior, however complex.

It is said that elephants pass the mirror test, meaning when they look in a mirror, they apparently realize they are the source of the reflection. This test has come to be a crude measure of consciousness and self-awareness. But I could easily program a robot to imitate the external behavior, without any real sense of what it was doing, or anything resembling consciousness.

Consciousness is more complex, and more subtle, than most people realize, and we really haven't even begun sorting it out.

<comment><USER15> elephant have been seeing their reflection when drinking water in lakes/ponds for millenia. Their brains evolved to identify with those patterns. Mirror test just proves if any species evolved enough to identify with that "pattern".

humans are just animals. nothing special. their consciousness is no different than say a crows or fox(cunning) consciousness. I would say one thing though....human brain is probably one of fluidest/flexible/organs ever created by nature. Take two humans...put one human in jail from birth (dont even teach language), and put other human in silicon-valley from birth, send him to stanford. Now, compare the "consciousness" of these two. Or even better, put the former human in jungle with monkeys from birth (dont teach him anything). I am sure there is lot of existing R&D/scientific articles on this.

<comment><USER14> > elephant have been seeing their reflection when drinking water in > lakes/ponds for millenia. Their brains evolved to identify with those > patterns. Mirror test just proves if any species evolved enough to identify > with that "pattern".

Yes, but many animals see their reflections in watering holes -- only a few of them understand that they're seeing their own reflection.

> humans are just animals. nothing special.

That's certainly true.

> Take two humans...put one human in jail from birth (dont even teach > language), and put other human in silicon-valley from birth, send him to > stanford. Now, compare the "consciousness" of these two.

This diminishes the role of inheritance, but over time research, especially twin studies, has produced increasing support for the idea that we're much more shaped by inheritance than environment.

<comment><USER15> > Yes, but many animals see their reflections in watering holes -- only a few > of them understand that they're seeing their own reflection.

its the nature doing its thing. only few animals/species develop certain faculties. And humans just happen to develop "mind" faculty. I wouldn't be surprised if some other species on a different planet developed telepathy or some other advanced faculties.

> This diminishes the role of inheritance, but over time research, especially > twin studies, has produced increasing support for the idea that we're much > more shaped by inheritance than environment.

inheritance only gives you latent abilities ... They will not flower if there is no proper environment for them to be actualized. everything is just manifestation of the nature. we are all just different "expressions" of the ultimate (aka "god" in some religinos)

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Consciousness is just an illusion. It is not a useful concept either. It won't help you to program robots, for example.

I was very surprised to learn that according to Less Wrong, the concept of "Zombies" is accepted by a lot of researchers of consciousness: [http://lesswrong.com/lw/p7/zombies_zombies/](http://lesswrong.com/lw/p7/zombies_zombies/) A zombie here is defined as a person that is exactly like a conscious person, down to every atom, but is not conscious. I think that is complete nonsense.

<comment><USER12> The problem I have with saying "consciousness is an illusion" is sort of similar to saying "God was the first cause". It pushes the question one layer away, because then the next obvious question is "an illusion to what, exactly?" How do you produce the illusion of qualia to something that does not experience qualia?

<comment><USER10> It rather seems to me talking about "qualia" is pushing the question one step away, or creating a circular argument.

If I attach a light sensor to my Arduino and then upload code to the arduino that says "if sensor active, flash light", I'd say the arduino has a "qualia" of light. Perceiving light flips some bit in the arduino. That's all there is to it.

<comment><USER12> Except that non-sensory experiences also produce qualia, and some drugs produce qualia that are never triggered in ordinary experience. The question of whether qualia are real is still very much the subject of debate, and not something you can easily just wave away like that.

<comment><USER10> I don't see the difficulty with that? If I read Wikipedia right qualia basically just means "subjective impressions"? Alright then, compute around for a while on your Arduino, and you get some subjective impressions. For example you could run some simulation that is known to exhibit randomness (like some cellular automatons) and then just pick some state of that.

I think this just boils down to the old and tired argument that "computers can only do what humans told them to do, therefore they can't be conscious", which is just misinformed. If I tell the computer car to turn left every time it sees a duck, I will have no idea where it will end up.

Also building a "drug me" button into an Arduino seems trivial. You could XOR all your data if the button is pressed, or do whatever else you fancy (even trigger a completely different program). I don't find drug experiences puzzling at all. If you want, overclock the Arduino so that it produces some computing errors. Hey presto, your Arduino has a drug experience.

<comment><USER12> The question is not whether computers can have qualia, the question is whether qualia are real. The argument goes that if your Arduino is doing the kind of "computing around" necessary to have subjective impressions, then it _is_ experiencing qualia, and it _is_ in some sense conscious (although not, of course, if philosophical zombies are possible).

<comment><USER10> Well then qualia is just an artificial definition for something that separates me from you. Since they can't be measured I can always claim "you have no qualia" and treat you like a machine.

<comment><USER12> I see no reason to assume that qualia cannot be measured, in principle.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> [http://xkcd.com/1240/](http://xkcd.com/1240/)

that is all

</comment><comment><USER17> Years ago I had a good talk with David Chalmers at a Quantum Mechanics and Consciousness conference. That prompted me to read his book. Roger Penrose and others also have interesting ideas of what is really consciousness.

Most people probably never experience expansive meditation, but for those of us who do that seems like further evidence that consciousness is not all in our physical brains.

<comment><USER18> Frankly, Penrose's thesis that consciousness stems from the quantum effects in microtubules, and the pseudo-"proof" based on a scammy reductio-ad-absurdum showing that consciousness can not be a computable function, are one of the biggest piles of horsesh*t in this whole field. I'm amazing he hasn't lost all credibility from such kind of deceitful thinking.

<comment><USER7> Penrose has credibility because of his numerous other achievements. His views on philosophy of mind are not regarded as serious positions in academic philosophy, neuroscience, or physics.

</comment></comment></comment><comment><USER19> I regularly have a discussion with friends on "consciousness". And a question that regularly comes under discussion is following:

Suppose we are living in a time when medicine has advanced tons. In this time, a friend of yours gets into an accident, and gradually starts to lose different body functions/parts. Each time a body part stops working, it is replaced with an artificial one. There comes a time when everything physical about your friend is replaced, even his brain. Though during brain change (say brain is replaced with a chip), all his memories are shifted from his old brain to the replacement. When this physically totally new friend of yours wakes up after the memory transfer, he claims he is your friend, and can answer any question you throw at him, that would have been answered by your original friend.

Is this physically new friend actually your old friend? Or is he faking it having access to all the memories of your friend? Did a "consciousness transfer" occur as well? Or not?

Any take?

<comment><USER15> when you look at consciousness very thoroughly, you will realize (as did by buddha, and several advanced advaita masters) that there is no "you" "me" "my conciousness" etc.etc. "You" are "everything" == meaning its all in your head. "You" are just a particular manifestation of nature will certain variables/parameters/context/scope. If/When all those ingredients are replicated ...it will be you. The physical body is just a host. "You" are "compute context" operating inside the host. You call it "consciousness" or "my consciousness". You can refer to advanced buddhist or advaita masters, who realized this in nirvana.

Nature is doing its thing. "You" are just one particular manifestation of it, doing its thing (aka "living life"). To end "self" suffering (the core teaching of buddhism) you need to see this, realize this - you are guranteed to see it, as you "it" yourself. And buddha has a program for you. As does several other masters/"paths".

</comment></comment><comment><USER20> I've wondered about this since I was twelve, though I didn't what it was at the time. My personal experiences have led me to conclude that it is actually impossible for consciousness to be biological.

If you look at consciousness from a third-party perspective, it makes sense for consciousness to be biological. Suppose we have a human named Bob; Bob thinks with his brain, and it's a safe bet to assume his brain also creates his consciousness. But now think about your _own_ consciousness. If it's your brain that creates consciousness, why are you in the first-person point of view? Why _is_ there a first-person point of view? Why are "you" not just a brain with its own consciousness? Where do "you" come into the picture?

On a somewhat related note, the only safe bet is to assume you're the only person in the world. You know you exist because you think and therefore are. You don't know, however, if anyone else does.

</comment><comment><USER21> There may have been a TL;DR part of this I'm missing, but it's hard to argue against a thalamic or brainstem stroke wiping out consciousness...

</comment><comment><USER22> My somewhat frustrated response to this comment thread. [http://duncancarroll.tumblr.com/post/57994245946/no- really-c...](http://duncancarroll.tumblr.com/post/57994245946/no-really- consciousness-is-worth-thinking-about)

</comment><comment><USER23> What's the big deal about consciousness anyway??

I don't see the 'magic' about being self-aware. Surely it just a step up the cognitive ladder from existing without awareness.

<comment> guard-of-terra What is "cognitive ladder"? Where does it come from? How many steps does it have? Are we the last one?

<comment><USER23> Probably an evolved gradation.

[http://en.wikipedia.org/wiki/Mirror_test#Reactions_of_other_...](http://en.wikipedia.org/wiki/Mirror_test#Reactions_of_other_animals_to_mirrors)

<comment> guard-of-terra I can imagine a race of aliens rejecting human consciousness on the basis of them not passing Smell Mirror Test.

Let's suppose dogs will qualify which will humiliatingly put humans pretty low on the ladder.

</comment></comment></comment></comment><comment><USER24> I wrote an article [1] on the topic of considering your brain 'the significant other'. On a personal level, I think there are significant productivity advantages to be had if you consider your brain as not your 'self'. [1] [http://humbleware.com/the-runaway-brain/](http://humbleware.com/the-runaway- brain/)

</comment><comment><USER25> Here on HN we've seen some sort of quasicrystal fabric distributing the prime integers and providing a possible entry onto gaining headway proving the Riemann Hypothesis:

HN search:

[http://golem.ph.utexas.edu/category/2013/06/quasicrystals_an...](http://golem.ph.utexas.edu/category/2013/06/quasicrystals_and_the_riemann.html)

[http://fadereu.posterous.com/knk103-the-crystals-of-mt- zeta](http://fadereu.posterous.com/knk103-the-crystals-of-mt-zeta)

So OP ca98am79's suggestion of a common consciousness we -as I vaguely understand it - be as transceivers(?) of/with(?) merits some similar consideration, for those still cycling among these perennial questions.

Rowing to City Dock everyday, a recurring observation of complex wave crest interference's semi-chaotic patterns with discrete natural nos sub-wave-train symmetric `beats', share the same medium of all semi-uniform distributed diversely scaled and chaotically asynchronous impulse sources afloat upon all of Eagle Harbor and beyond.

Thank you ca98am79 to boldly post here.

</comment><comment><AUTHOR> see also: [https://news.ycombinator.com/item?id=6196334](https://news.ycombinator.com/item?id=6196334)</comment>