Alice in Videoland: Designing an interactive HTML5 storybook - <AUTHOR> http://www.adobe.com/inspire/2013/12/interactive-html5-storybook.html

<comment><USER2> The artwork is good--but wow, the animation and execution are pretty underwhelming for something featured on Adobe.

Edit: In the interest of not being a negative prick, this is something by the same developer that I love: [http://codepen.io/rachelnabors/full/lqswg](http://codepen.io/rachelnabors/full/lqswg)

<comment><USER3> Because Adobe itself cannot come up with a good tool,that would make html5 "flash like" projects as easy to develop as flash projects.

I work in an agency and we stopped doing this kind of work. It takes way too much time to come up with something average. Someone will come up with a real solution eventually , just not Adobe.</comment></comment>


Google Wallet - iOS - <AUTHOR> https://itunes.apple.com/us/app/id575923525

<comment><USER2> How can this be used for an in-person merchant transaction without NFC? Does the merchant also use a smartphone application to receive money?

<comment><USER3> looks kinda like what you can do in gmail now, send money right from your email account to another email address?</comment></comment>


Making Startups Pay for Awards - <AUTHOR>

I did a quick blog post about the Technology Association of Georgia asking companies that they selected for their Top 40 to pay after being selected (http://www.sanjayparekh.com/georgia-startup-award/).  I kind of have an issue with this and there has been a furious discussion in the Twitter stream about this (I'm @sanjay, you can find my tweet replies there to some of the comments).<p>I'd like some feedback about this and would love to hear how prevalent this is in other cities/regions.  Do startups get charged money to pay for the event when they win stuff or is this unheard of? <comment><USER2> It is not unheard of (i.e. DEMO is a good example). However, comparing this event to DEMO is like comparing apples and oranges. The visibility of DEMO makes the fee a little less hard to swallow. The visibility of this event is limited primarily to a particular state. They would be better off marketing this as a "conference" or "exhibit" where up to 40 companies can participate and a Top 10 will be selected. To say it is the Top 40 in Georgia though is a little deceiving and false advertising in my opinion. For example, what if I am legitimately selected as one of the top 40 and cannot afford to participate (and assuming I do not qualify for a "scholarship"), does the next company in line take my spot or are only 39 companies exhibiting? If the next company takes my spot, then you really can't say it is the Top 40 in Georgia, it is more like the Top 39 and a company that could afford to pay. Yes, I know it clearly states that I will be charged a fee if selected before I apply, but that in itself destroys the notion of a "Top 40" since obviously the only 40 companies there are going to be ones that can either afford to pay or qualify for a scholarship.

The better option in this case would be to setup something like TechCrunch50 where the top 50 get to present for free, BUT other companies can exhibit for a fee.

The bad part about these events being marketed like as a "Top XXX" competition is that people generally assume, based on the title of the competition, that if you aren't exhibiting then you are not a "Top Company", when in fact you could have been selected but unable to afford the cost of exhibiting.

Sadly when events like this are held and marketed this way I think good companies are often overlooked. My technology may be the next great thing, but will be overlooked because I can't afford the "entry fee" to exhibit and be viewed as a "Top 40" or possibly a "Top 10" in the state.

<comment><AUTHOR> Not to just keep pimping my own things, but this was why I started Startup Riot (<http://www.startupriot.com>) which I just held in Atlanta last week. Presenting companies pay nothing and there are no exhibitors. Other startups can attend and pay the registration fee ($20/person for startups).

That said, you make a good point on what happens if a company drops out because they can't pay. I'm not clear as to what happens. Since it's billed as a Top 40, I'm assuming they fill the slot with someone else.

</comment></comment><comment><AUTHOR> Can't make the above links so here, to make this easy:

<http://www.sanjayparekh.com/georgia-startup-award/>

Sanjay

</comment><comment><USER3> I think the TAG people have a funny definition of "WIN"</comment>


Steve Jobs on privacy (2010) - <AUTHOR> https://www.youtube.com/watch?v=39iKLwlUqBo <comment><AUTHOR> _"Privacy means, people know what they're signing up for, in plain English, and, repeatedly_ "</comment>


Ask HN: Transition to Working Remote with Team - <AUTHOR> We are preparing to work from home with our team. What are pitfalls and best practices to have a smooth transition and keep morale and productivity high? <comment><USER2> I guess others can give you lots of information (especially about tracking tasks, fighting procrastination, etc.), but I found that having regular meetings (weekly) if you're in the same area is great for keeping up morale. That is, if your team aren't really introverted, then they may not need so much social contact.

But I'd say either way that it's important to have a regular face-to-face. I think videoconferincing might work here in a pinch if needed.

</comment><comment><USER3> Holloway is working on a guide on this topic, you might want to read it when it's done. I find their quality of publications quite high so looking forward to this one.

[https://www.holloway.com/g/remote- work/about](https://www.holloway.com/g/remote-work/about)

</comment><comment><AUTHOR> As a starter I found this article useful with best practices for the team, tools and processes. It's from Zapier: [https://zapier.com/learn/remote- work/how-manage-remote-team/](https://zapier.com/learn/remote-work/how-manage- remote-team/)</comment>


Intel ME Manufacturing Mode: obscured dangers and MacBook vulnerability - <AUTHOR> http://blog.ptsecurity.com/2018/10/intel-me-manufacturing-mode-macbook.html <comment><USER2> Does ME Manufacturing mode allow the user to change all the configuration? Does it mean that hackers who incidentally purchased such a machine (but probably not Apple's) with ME Manufacturing mode enabled, can theoretically port coreboot to the machine, then flash their own public key fingerprints into ME, using Boot Guard to protect firmware signed by themselves instead of OEM's?

I remember several bunches of Lenovo laptop series released a few years ago seems to have the same vulnerability, and porting coreboot to those computers with earlier chipsets is a real possibility, only prevented by Boot Guard signature. But finding these unpatched and vulnerable series of machines is a hit-or-miss game with minimum chance of success. If someone really implements tools to do all these things, is it possible that the secondhand vulnerable motherboards would be the gold in the hacker communities and be sold at a high price?

Another fact is that ME is a part of the PCH, which is located on the CPU package. If a hacker has access to a BGA rework technician in a professional repair workshop, it should be possible to desolder the original CPU from the board, and install a new one with unconfigurated ME to "own" the machine.

<comment><USER3> Exactly. Remember Intel ME is a great utility and has some awesome abilities. The issue that people have is not the fact there is a CPU running another CPU that looks after the main one. It's that it's closed source and has remote control capabilities that can not be controlled by the user.

If Intel would just allow an owner to build and flash their own Intel ME version using their own private/public keys then no one would have an issue with that. It's the fact it's a secret closed system that has full control to monitor everything you do, and can not be fully disabled.

<comment><USER4> Is the Intel ME that great? I mean I never heard anyone say that they actually use it. The explanation of its capabilities make it seem like a great tool for fleet management, yet nobody seems to be using it.

With other alternatives available, combined with low usage, I'm not sure that neither Intels ME nor AMDs PSP needs to be embedded in every CPU.

<comment><USER3> I think the specific part you're referring to is Intel AMT (Active Management Technology) which allows the user to remote control into their computer. AMT is a module that runs within the Intel ME operating system.

Intel ME does a lot of things, like the below (we think, no one really knows for sure):

        - Active Management Technology (AMT)
        - Alert Standard Format (ASF)
        - Intel Boot Guard (IBG)
        - Secure Boot
        - Integrated Clock Controller (ICC)
        - Quiet System Technology (QST) / Advanced Fan Speed Control (AFSC)
        - Protected Audio Video Path (used in PlayReady DRM)
        - Intel Security Assist (ISA)
        - Serial over LAN (SOL)
        - Firmware-based Trusted Platform Module (TPM)

Source: [https://en.wikipedia.org/wiki/Intel_Management_Engine](https://en.wikipedia.org/wiki/Intel_Management_Engine)

I think there is also some power management functionality in there too.

</comment></comment></comment></comment><comment><USER5> A couple of small vendors are trying to offer choices with open firmware. They don't yet have the scale for low cost pricing.

1) Purism has been discussed on HN, trying to extend their laptop coreboot success to a phone form factor, [http://puri.sm](http://puri.sm)

2) Librebox is a desktop computer with coreboot, from Portugal, [https://libretrend.com](https://libretrend.com) and [https://youtube.com/watch?&v=mHyJCSqWhFw](https://youtube.com/watch?&v=mHyJCSqWhFw)

For data centers, OpenCompute server owners are also the "OEM" and in control of more keys.

<comment><USER6> Purism is a sham. They are openly trying to abuse the RYF process to get a phone with proprietary firmware blobs certified as "RYF", defeating the entire point of the RYF programme: [https://puri.sm/posts/librem5-solving-the-first- fsf-ryf-hurd...](https://puri.sm/posts/librem5-solving-the-first-fsf-ryf- hurdle/)

They also have a history of selling x86 systems while articulating vague hopes that the blob/owner control situation will improve in the future, despite this being clearly implausible. In one case for example, they claimed they might get Intel to sign a custom ME firmware for them in the future. Anyone who knows anything about the ME knows that Intel would never do this, ever.

<comment><USER7> I am not sure if seeking a "secondary processor" exclusion qualifies as "abuse". I agree that their products are not as "pure" as advocated by some enthusiasts. But the company itself openly says so and for me that is important.

What I do not like is their absolutely ridiculous pricing of additional equipment. For instance, they ask $499 for a 500GB NVMe storage [1], while it can easily be purchased for less than third the price [2]. When I complained about it, their response was: "we are well aware of the problem and will be addressing it within the next few months". That was 4 months ago.

[1] [https://puri.sm/shop/librem-13/](https://puri.sm/shop/librem-13/) [2] [https://www.amazon.com/Samsung-970-EVO-500GB- MZ-V7E500BW/dp/...](https://www.amazon.com/Samsung-970-EVO-500GB- MZ-V7E500BW/dp/B07BN4NJ2J)

<comment><USER6> The secondary processor exception exists for legitimate reasons. If you have some machine with 100% open source boot firmware, Coreboot, etc., that's still worth certifying even if some Ethernet chip turns out to have firmware inside it.

What Purism is doing is moving memory init code away from the CPU on which it would normally and most naturally execute (in terms of engineering design decisions) for the express purpose of moving something they can't actually open out of the scope of RYF. And are then brazenly admitting how they are gaming this in the above blogpost.

Most people would expect "open source firmware" to mean "open source memory initialisation", because we understand that's something the firmware does. Moving this onto a secondary CPU is literally no better than proprietary firmware. It can't be audited, and if it's able to initialise the memory controller, it can be expected to have full access to the system. They're practically carving out an Intel ME-like boot processor here, with much of the same disadvantages and concerns.

<comment><USER8> Isn't it fine as long as the secondary processor hands back once the initialization is done? Before the training the memory is unused, and only the "clean" processor has access to it after training. I can't see the threat.

</comment></comment></comment></comment></comment><comment><USER9> This is bad in a DoS-type of way. BootGuard only loads correctly signed firmware, the root of trust is an Intel RSA keypair and the hash of the pubkey is burned into the CPU during Intel's manufacturing. The PCH (on the same chip in mobile cases) has the ME which also has fuses, and as long as the CPU only accepts signed code form the ME, and the ME has BootGuard fuse blown, the only thing you can really do is disable a system by nuking the SPI (or just flipping one random bit to invalidate the signature).

To fix it, you'd have to re-flash the SPI chip.

As far as I know, manufacturing mode only allows you to add signing keys if those keys are signed by Intel, so adding your own keys won't help. Adding a key from another manufacturer with known exploitable firmware could work, but loading that firmware on incompatible hardware won't let you boot the machine so you still get nothing.

All in all; nice find, yes you can disable machines via software, but other than that, not as interesting as I had hoped it to be. (IBB or ACM exploits would be very very very sweet)

<comment><USER10> It also means that instead of having to compromise Intel's signing key to gain full control, now it's also possible to use any compromised key that's been signed by Intel, which may not be as well guarded as Intel's one.

<comment><USER9> Yes, well, it was always possible (either using direct flashing or HDA_SDO), or by forcing a reboot with the upgrade bit set (which was enabled by default on most platforms I've seen up to 2017. (no real data after that since I no longer have to deal with fleets of random systems).

I suppose the ME MFG mode here adds for an additional path that can be abused silently, which is a real problem.

On the key side of things: I have not yet found a leaked key. That would have made coreboot life so much easier...

</comment></comment></comment><comment><USER11> "The weakness of "security through obscurity" is so well known as to be obvious. Yet major hardware manufacturers, citing the need to protect intellectual property, often require a non-disclosure agreement (NDA) before allowing access to technical documentation. "

I believe the actual reason for "security through obscurity" is that it's a delay tactic used against well-funded adversaries.

There's an inherent problem in security. A company, existing in the private sector, could never hope to overcome the infinite resources of a nation state. It's literally, mathematically, financially impossible.

A nation state could even apply a rule like, if they know a particular technology was developed by roughly 500 engineers at some company, a nation state could employ 5x the number of engineers used; simply as a rule. So in this case, they could employ 2500 security researchers to overcome some security problem.

<comment><USER12> It's also possible to build systems that are correct, such that no adversary with any amount of resources could find a security hole. Many CPUs in the past have been correct. Probably most major commercial ones before 2000 were. So it's not mathematically impossible.

<comment><USER13> >Probably most major commercial ones before 2000 were.

I find that hard to believe. For instance, what makes you think they got speculative execution more correct before 2000 than after? At least it seems impossible to get rid of the timing side-channel since the whole point of the exercise is to change the amount of time it takes to run the program.

Surely you'd have to go back to at least 1980. I suppose one could start a production line of 1970s supercomputers for personal use, and put it on the programmers to figure out how to parallelise everything, but it would be very painful and expensive.

</comment></comment></comment><comment><USER14> Is there a way to enroll your own platform key on the latest UEFI Secure Boot enabled Macs? They do not include the 'Microsoft Corporation UEFI CA' therefore a bootloader signed by Microsoft's UEFI binary signing service (which most popular Linux distros do) cannot be verified. And that means you must disable Secure Boot to boot something other than macOS or Windows. And that means you don't really control, therefore don't really own, your hardware.</comment>


Breaking Hacker News's CSRF Protections - <AUTHOR> http://hankstoever.com/posts/9-Breaking-Hacker-Newss-CSRF-Protections

<comment><USER3> CSRF protection is _not_ about preventing bots from interacting with your site - it's about protecting your site from _other_ sites (hence the name - <USER2> site request forgery).

Without the hidden 'fnid' input, it would be possible for other sites to vote on and post content to Hacker News on your behalf without your consent.

<comment><USER4> More specifically, it's protecting your site from other sites taking advantage of the fact that you're already logged in. For example, in the absence of CSRF, if you're logged into HN, any other site could just embed a form element using the right input IDs, and make submissions on your behalf (clicked on this link? just made a post on your behalf. moved your mouse a little to the left? just upvoted this post).

The "hack" outlined in the article requires knowing the username and password of the person you want to "hack". Of course CSRF tokens don't protect you when your credentials are lost.

</comment></comment><comment><USER5> CSRF tokens are designed to protect users from CSRF attacks from other sites. The example you posted requires the username and password, which renders the token anyways. A cross-domain post to HN from a rogue site will not be able to know the CSRF token since it does not have knowledge of your SID, rendering this attack not viable in practice.

More Info: [https://www.owasp.org/index.php/Cross- Site_Request_Forgery_(...](https://www.owasp.org/index.php/Cross- Site_Request_Forgery_\(CSRF\))

</comment><comment><USER6> You're misunderstanding how CSRF works. Say a user is logged in to the site JoeNotProtectedByCSRF.tld with a session cookie or similar authentication token. SpammySite.tld comes along with a form to POST some change some value on JoeNotProtectedByCSRF.tld such as a password field. Because your browser always sends along the cookies to the end domain, your session cookie will be abused. With a check against a unique-to-the-user CSRF token as a hidden input on the form this doesn't happen.

</comment><comment><USER7> I think you misunderstand what csrf is. Here it is in layman terms [http://crazyviraj.blogspot.com/2009/10/xsrfcsrf-attacks- in-n...](http://crazyviraj.blogspot.com/2009/10/xsrfcsrf-attacks-in-non-geek- speak.html)

</comment><comment><USER8> Hopefully the author is reading this. And please spare the downvotes, I'm trying to help without laying any judgement.

Please fix the spelling in the sidebar.

 _Recieve a digest of my best content every month about software, startups, and life._

"Recieve" should be "Receive"

Since this is in the sidebar of your site, it stands out and puts a negative spin on the rest of what you have to say. Unfair? Maybe, but this is such a basic error that people will judge you based on such a basic mistake, simply because it will be easily caught by any spell-checker.

</comment><comment><AUTHOR> Thanks for pointing out what CSRF protection is meant for and I certainly agree that I should have used better wording. However, aren't the attacks mentioned (upvoting or similar from another site) protected by same-origin and http-only cookies? Otherwise, a malicious site could use the same techniques mentioned in this post to first obtain an fnid token and then make the same requests.

<comment><USER5> Your browser will automatically send any cookies it has for a domain when it is instructed to send a request to that domain HttpOnly cookies included. The thing preventing the malicious site from getting knowledge of your SID or your fnid token is the Same Origin Policy: [https://en.wikipedia.org/wiki/Same_origin_policy](https://en.wikipedia.org/wiki/Same_origin_policy). If it wasn't for the same origin policy, I could just grab your HN sid from any website with plain JS on the malicious domain.

A CSRF attack is the equivalent of blind-firing a gun at a domain, and the browser "helps" you by automatically attaching your cookies to that bullet. Depending on the situation, you usually don't get a response back. Here is a good preso from when CSRF was hot back then which explains the attack scenarios: [https://www.blackhat.com/presentations/bh- dc-08/Willis/Prese...](https://www.blackhat.com/presentations/bh- dc-08/Willis/Presentation/bh-dc-08-willis.pdf)

Throwing CORS into the mix complicates things a bit but that relies on the site that is being attacked to explicitly allow calls from the malicious site or use an Access-Control-Allow-Origin: * which in itself is a security vulnerability. More details on CORS: [https://developer.mozilla.org/en- US/docs/HTTP/Access_control...](https://developer.mozilla.org/en- US/docs/HTTP/Access_control_CORS)

</comment></comment><comment><USER9> You've completely misunderstood what CSRF tokens do.</comment>


Is there a justification as to why Hacker News is without responsive design? - <AUTHOR> Strangely, I've come to like the fact that the site does not resize by device and wondered if this was intentional. <comment><USER2> I wrote a bit about it here: [https://news.ycombinator.com/item?id=7960105](https://news.ycombinator.com/item?id=7960105)

Here's the appropriate excerpt:

"When the new team took over development on HN, we decided that before we implement any new frontend features for the site we needed to update the markup HN uses to make it easier to implement such features in the future (just the markup, not the aesthetics).

Creating a visually identical version of HN with CSS3/HTML5 was easy (we also made it responsive to work on mobile devices)--implementing it was another matter. HN's presentation layer is heavily intertwined with the application/server logic, which meant it was going to be a bit tricky to separate the two. The reason it was tricky is because the entire code base up to a few months ago was optimized to be worked on by one person, pg. For example, we didn't even have docs on how to setup / run the arc code on local / development machines when we first got started.

Eventually we did get a version of HN working that's separated the presentation logic, but we realized that MANY of you out there have built apps that rely on scraping HN's outdated table markup. Because we decided that it would be bad to break all of your apps overnight, we've now started working on an API for HN to launch it in tandem with the new markup changes. We'd then give you all some time to update your projects.

Please try to keep in mind that new features for HN have to be done alongside a lot of other responsibilities. The software team that works on HN is also spending time moderating it and rewriting software that runs YC. Some members like Garry and myself divide our time between developing for HN and our duties as partners helping YC's startups.

This is a long-winded way of saying, please be patient. We are working on many shiny new things for you and can't wait to show you what we've been building behind the scenes."

<comment><USER3> While I see the appeal, every time I have to zoom in, a part of me wishes there was a nicer stylesheet for mobile, HTML-be-damned. I suppose tables really were anti-responsive: before them text naturally flowed, after them, text generally flowed again. Of course... Design could still mess things up ;-)

</comment></comment><comment><USER4> Run a view source. The code isn't what most of us consider to be best practices (table layouts and font tags all over). It could be difficult to add. But the site still works, which says something about the difference between great code and a great product.

Still -- I'm with you. I wish there were a better mobile experience.

<comment><USER5> I wouldn't call Hacker News a great product, as regards the UX and layout (which is probably the worst possible way to implement a nested list in HTML.) I would call it a great community and an acceptable product. It's basically a toy that got popular because it was attached to YCombinator, and remained popular because programmers have a higher tolerance for UX pain than mere mortals.

<comment><USER6> HN's ux is a sweet, painless relief compared to most of the web. It is unpretentious and functional. I would be disappointed if it were "improved".

<comment><USER5> Not every possible 'improvement' needs to slide down the slippery slope of pretentious frippery, though.

Being able to use the site more easily in mobile is would be an actual improvement. I would also argue that collapsible comments would also serve the site without degrading it. Some typographic tweaks, such as increasing the line-height, would make large text boxes easier to read. And I doubt anyone who has lost a post due to a dead link would consider Hacker News entirely painless.

</comment></comment></comment></comment><comment><USER7> I personally figure the answer is something along the lines of, responsive design takes effort to add, and nobody on the development team thought it was valuable enough to go to the trouble.

I'm not a web developer, but to my memory responsive design isn't something that just comes by default.

<comment><AUTHOR> I think you are right that it does take a lot of effort for to do it right, one needs to design a whole new compatible experience. On the other hand, this interface and dataset here is fairly raw already, so a lot of the form would follow naturally.

<comment><USER7> I'm not saying it would be hard. I'm just observing that the default state is not responsive design.

</comment></comment></comment><comment><USER8> Most of us would rather telnet in.

</comment><comment><USER9> Workaround: I added the following bookmarklet and called it hh on Android (on iOS bookmark anything, then edit to insert link)

javascript:document.body.style.width='200px', void 0

To use, enter hh in address, and tap to run.

</comment><comment><USER10> I often use elinks to browse HN, and the comment feed neither is well displayed..

</comment><comment><USER11> HN's keepers aren't trendy

<comment><USER12> To reinforce this idea. The database is a bunch of flat files.

<comment><USER13> The filesystem is the original NoSQL store. We're hip again!</comment></comment></comment>


Intel courts mobile app developers - <AUTHOR> http://www.cio.com/article/2978327/mobile-development/intel-courts-mobile-app-developers.html

<comment><USER2> Intel lets developers reuse Android Java code on iOS — Yes, you read that right the first time. And the iOS Java apps running on iPhones have native Xcode UIs.

To the astonishment of everyone seeing Multi-OS Engine for the first time, iOS apps can be developed on Windows using Android Studio and debugged on Windows using a USB tethered iPhone or the iOS emulator Intel built for Android Studio.

</comment><comment><AUTHOR> Intel lets developers reuse Android Java code on iOS — Yes, you read that right the first time. And the iOS Java apps running on iPhones have native Xcode UIs.

To the astonishment of everyone seeing Multi-OS Engine for the first time, iOS apps can be developed on Windows using Android Studio and debugged on Windows using a USB tethered iPhone or the iOS emulator Intel built for Android Studio.</comment>


Ask HN: I just found out someone signed up with a stolen credit card.  What do I do now? - <AUTHOR>

Should I report them?  If so how do I go about doing that? <comment><USER2> Contact the credit card company and ask to speak to the fraud department. they should be able to advise you on how to proceed.

</comment><comment><USER3> How did you find out?

<comment><AUTHOR> #1 the credit card holder contacted us #2 it was obvious when I looked, the credit card billing address was in the US. Their store contact information was based in the UK (my company Flying Cart allows people to easily build their own online store)</comment></comment>


Www1 vs www2 vs www3 etc - <AUTHOR>

I am trying to familiarize myself about various techniques that are used to scale websites.
I found an excellent resource from Sitepoint (http://www.sitepoint.com/article/affordable-scalable-websites) that introduces the topic to a newbie.
In the article, for one of the solutions, they mention that you can have a www.mysite.com, www2.mysite.com, www3.mysite.com. Users would then connect to any server depending on the load balancing algorithms.
My question is, does one register www.mysite.com, www2.mysite.com, www3.mysite.com? How does one direct users to each of these unique URLs (thereby directing them to a server)? Is this done by the load balancer? <comment><USER2> you don't "register" subdomains, you just make sure that they are in DNS.

You setup your load balancer with the names of all of your hosts and it will direct traffic to the appropriate one.

<comment><AUTHOR> Sorry. This may be a really dumb question....but how do you make sure they are in DNS?</comment></comment>


SystemBSD: Custom D-Bus daemons emulating systemd behavior on OpenBSD [pdf] - vezzy-fnord http://darknedgy.net/files/systembsd.pdf <comment><AUTHOR> As long as it's optional for Gnome only as they say, that's fine. I just hope other DEs like Xfce don't simply rely on this being available like with Consolekit, HAL, D-bus, etc that I now have to run on FreeBSD as well.

I'm perfectly content ignoring Gnome, but if every full desktop environment starts relying on this because it's available, then it's not really so optional anymore. (and of course, if the alternative is guaranteed to be no major DE running on BSD at all without this, then we similarly have our hand forced. It depends on who would flinch first.)

<comment><USER2> Best i can tell, the reason Xfce seems to assume it is there is because the developers are short on time and thus make use of low level Gnome libs to get things out the door.

Essentially Gnome seem able to throw a whole lot more man hours at various topic than can the rest of the DEs, KDE included. This in turn seem to lever Freedesktop towards them (though Freedesktop may have overly favored Gnome from the get-go).

<comment><AUTHOR> Xfce already depends on it? :(

I was under the impression they had FreeBSD users on their dev team, and kept it alive, just with some limited features (like automounting not really working) and only relying on a few Linuxisms like Consolekit.

Still on 4.10 though, so perhaps that's no longer the case on the newer versions.

<comment><USER3> xfce will use systemd if it is available, but it can still be used without it

[http://xfce.org/about/tour](http://xfce.org/about/tour)

the tour was taken using openbsd

</comment></comment></comment></comment><comment><USER4> From the pdf, "the overwhelmingly common use case for these daemons is for running gnome".

There are native BSD desktop projects being worked on that are quite polished and require none of the Linux based SytemD+Gtk+Gnome dependency stack.

Lumina is worth looking at (Qt based) and also runs on Linux.

[https://en.wikipedia.org/wiki/Lumina_Desktop](https://en.wikipedia.org/wiki/Lumina_Desktop)

From what I remember the author started this work before the nuclear meltdown which is commendable. But we are obviously in a post schism age.

</comment><comment><USER5> The systemd folks have been saying all along that it's just a standardized and stable interface and anyone else can implement that interface. I'm glad to see this, because it's testing the claim: if it's true, that means wonderful things for OpenBSD portability, and if it's not true, we should be more cautious about coding to systemd's APIs.

<comment><USER4> The argument that XYZ has a portable interface therefor XYZ is portable is a bit of a head fake argument. OpenGL 4.5 is also a supposedly portable interface, so is the X Server protocol. To implement these takes years of work with large teams of full time engineers. Mesa has over 1.5 million lines of code and has been in constant development for over 10 years.

At last count SystemD has over 40 "Interfaces". These are not publicly versioned standards. So there is no stable interface to even implement and there is no commitment that these "interfaces" will not change at any point in time.

If the project estimate to actually implement XYZ interface takes years of full time engineers and millions of dollars to complete its basically out of the reach of any volunteer open source operating system project.

I just find the argument disingenuous. Everyone making these claims knows that there is practically 0 chance that anyone but RedHat or another big Corporation like Google or Samsung has the resources to Implement something like this.

<comment><USER6> What you are stating here is not true.

Take a look at [https://wiki.freedesktop.org/www/Software/systemd/InterfaceP...](https://wiki.freedesktop.org/www/Software/systemd/InterfacePortabilityAndStabilityChart/) and you'll see that there are indeed a plethora of systemd service apis. But almost all of them are covered by the systemd stability promise ([https://wiki.freedesktop.org/www/Software/systemd/InterfaceS...](https://wiki.freedesktop.org/www/Software/systemd/InterfaceStabilityPromise/)) and almost all of them are documented.

So, there is a commitment that these interfaces will not change.

<comment><USER4> I am aware of the pages you linked to and have on a few occasions tried to look over things. Having read quite a few rather large standers and APIs my impression the "Portable Interfaces" is rather dim. They are disjoint and unversioned notes not presentable portable interface standards. There are also various internal protocols and interfaces which are not documented from what I have gathered.

In short SystemD is an implementation. And as they say in there own documents there implementation is and never will be a portable implementation.

The "Interface Stability Promise" is referring to the unit configuration file format and the command line interface. This is not stability of the implementation c interfaces.

If you want to see a proper portable specification take a look at the Wayland Protocol Specification. There or perhaps POSIX.

<comment><USER7> > The "Interface Stability Promise" is referring to the unit configuration > file format and the command line interface. This is not stability of the > implementation c interfaces.

This is not true.

</comment></comment></comment></comment></comment><comment><USER8> The author mentions using OpenBSD in production. Do any of you also use it in production? I have no doubt that it is used with good results, but I have enjoyed it as a desktop OS and would love if more people could share their experience with it on a job.

<comment><USER9> I work for an ISP. We use it (CARP and relayd) heavily for HTTP and DNS load balancing in an IPv6-laden environment. Performance is better than that we saw a few years ago under Linux.

<comment><USER10> Did you also evaluate FreeBSD? If you did, I'm curious what the pros and cons were that ultimately affected your decision.

<comment><USER9> I did not. I was more familiar with OpenBSD to begin with, and like its slant toward security. Although we do use FreeBSD for a few other servers used as NAS controllers. HAST + ZFS + CARP is great.

<comment><USER10> Fair enough, thanks. I was curious since I've heard that FreeBSD generally has the best performance for network-heavy architectures.

</comment></comment></comment></comment></comment><comment><USER11> It's good to see that [http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/de...](http://homepage.ntlworld.com./jonathan.deboynepollard/FGA/debian- systemd-packaging-hoo-hah.html#systemBSD) agrees with what Ian Sutton himself later reported about the relative difficulties and problems.

</comment><comment><USER12> Proper capitalization goes a long way in making a text readable. I had the impression that this presentation was written by a 10 year old script kiddie. Also: punctuation, consistent font sizing. Add a few colors to highlight the code blocks. Headings. Graphical bullet points. Those would make the presentation mch more trustworthy. If you are going to talk shit about somebody or something (without substantiating the points nonetheless) then at least do it with style.

<comment><USER13> As vezzy-fnord points out in this thread, at [https://news.ycombinator.com/item?id=10176412](https://news.ycombinator.com/item?id=10176412) , the author did not post the slides, nor had final say on the presentation format. Instead, quoting vezzy-fnord:

> They were in MagicPoint format, so I had to convert them to PDF with a > dubious third-party Python script, slightly modifying the MGP manifest in > the process. That's probably why the formatting is so iffy.

You'll also note that the author "reluctantly" gave permission. For all we know, it was precisely because the author knew that people would criticize the paper over superficial format conversion issues than actual substance.

<comment><USER14> I actually looked at the git repo and found the comments are written in a similar style. All lower case and with a slightly rambling feel.

[https://uglyman.kremlin.cc/gitweb/gitweb.cgi?p=systembsd.git...](https://uglyman.kremlin.cc/gitweb/gitweb.cgi?p=systembsd.git;a=blob_plain;f=src/interfaces/hostnamed/hostnamed.c;hb=HEAD)

I find it a little hard to understand too. I am going to chalk this up to me starting to be an old man and complaining about not understanding the youths.

<comment><USER13> I enjoyed the research you did for the followup. I must be another one of those old folks. :)

For what it's worth, I was a horrible writer when I was an undergraduate, and this was a GSOC project, so I'm willing to cut some slack. Might be because I'm a slacker.

</comment></comment></comment></comment><comment><USER15> Is there a recording of the talk that -I assume- was given with these slides?

<comment> vezzy-fnord There is no recording, from what Sutton told me. I saw the talk overview on the CDBUG page, knew his IRC handle and said "Give me the slides and the right to freely redistribute, you asshole." So he reluctantly did.

They were in MagicPoint format, so I had to convert them to PDF with a dubious third-party Python script, slightly modifying the MGP manifest in the process. That's probably why the formatting is so iffy.

For those wondering, the systembsd sources are here: [https://uglyman.kremlin.cc/gitweb/gitweb.cgi?p=systembsd.git...](https://uglyman.kremlin.cc/gitweb/gitweb.cgi?p=systembsd.git;a=summary)</comment></comment>


How researchers learned to stop time (and maybe enable hackers) - <AUTHOR> http://www.thestar.com/business/article/1110639--how-researchers-learned-to-stop-time-and-maybe-enable-hackers

<comment><USER2> I personally find this article a little confusing...it seems to lack technical details.</comment>


Zynga To Remove All In Game Offers - <AUTHOR> http://www.techcrunch.com/2009/11/08/zynga-to-stop-all-in-game-offers/

<comment><USER2> So much for Michael Arrington's assertions being "shit, doubleshit and bullshit"...

I know a lot of people have something against MA, but he does good things like this on occasion which, imho, make up for a lot of the perceived douchebaggery the rest of the time.

<comment><AUTHOR> I agree. For what's its worth, he's an ardent supporter of user rights and you need someone with a loud voice on occasion. It's also quite difficult to inflict change on an industry that seemed entrenched in its practices. Kudos to him for taking the initiative and getting results.

<comment><USER3> Ugh - guys please don't be fooled by this. The guy has no journalistic integrity whatsoever. Remember the last.fm fiasco?

[http://www.itworld.com/business/63085/lastfm-tech-crunch- and...](http://www.itworld.com/business/63085/lastfm-tech-crunch-and-riaa)

He's a very opportunistic person. Ranting against popular business practices produces great publicity. So does posting a very damaging but completely unverified rumor. Arrington has done both, which is why he is hardly the Robin Hood of web2.0.

Yes, occasionally Arrington's flamebaits produce some good. But overall TechCrunch is a mediocre and irresponsible "publication". I think it's a tragedy that the network effect has resulted in a clown running the most important blog about web start-ups. Imagine if the WSJ or NYT was run like TC.

<comment><USER4> Imagine...

[http://www.fakesteve.net/2009/11/why-mainstream-media-is- dyi...](http://www.fakesteve.net/2009/11/why-mainstream-media-is-dying.html)

</comment></comment></comment></comment><comment><USER5> This whole affair makes Zynga look much more shaky as a potential IPO offering, although I have in general been impressed with Pincus' response too the whole thing. Perhaps the strong response was to retain the IPO momentum.

<comment><USER6> I for one am still not convinced about the explanation Pincus gave for how the ads came back for everyone _other_ than Mikey boy.

<comment><USER5> I don't think they would selectively remove ads from critics' pages. That would be monumentally stupid. fyi: not to be nit-picky ;) but Matt Handal, President of DoubleDing gave that explanation. Zynga is an investor in DoubleDing so maybe that is about the same as Pincus giving the explanation- who knows?

</comment></comment></comment><comment><USER7> I don't get it. Zynga controls the ad content as they are free to chose with which offer provider they work and which they don't. Sounds like a lame excuse.

<comment><USER8> Well, they choose the offer provider, who then chooses the offers. Unless you're going to have someone watching the offers 24x7 there's never going to be any fool proof quality guarantee. I would think at Zynga's scale though such a guard would be worth the expense.

<comment><USER7> Yeah, but they knew that their offer provider has chosen scammy offers before.

</comment></comment></comment><comment><USER9> These people are typical of the ethicless parasites that infest everything creative smart people make.</comment>


It's Official: Open Plan Offices Are Now the Dumbest Management Fad of All Time - <AUTHOR> https://www.inc.com/geoffrey-james/its-official-open-plan-offices-are-now-dumbest-management-fad-of-all-time.html <comment><USER2> My vote for dumbest fad would be using business tropes on rank and file employees and, worse, clients.

No rank and file employee wants to be a 'brand ambassador' and clients don't want to rate your 'sense of urgency'.

Keep the jargon with the specialists in the back room.

The trick is to do important things that might be described by cringeworthy jargon without letting on that is what you are doing!

It's like announcing at a singles bar that you are there to get laid when you walk in the door. Everybody knows but its a terrible thing to call direct attention to.

<comment><USER3> It's terribly stupid but it's so omnipresent that even people who think it's stupid choose to do it anyway because "everyone else is doing it."

</comment></comment><comment><USER4> While we're pointing out dumb fads, how about the video player and other pointless crap that popped up on the screen and blocked part of the article. A purposely user-hostile fad in web design.

<comment><USER5> This was one of the slowest to load pages that I've seen in a while (no ad block). I usually use a bookmarklet to kill dumb popups that scroll with you[1], and I actually had to update it[2] for this page, since this page used `position: sticky` instead of `position: fixed` for one thing.

[1]:

      javascript:(function(){(function () {var i, elements = document.querySelectorAll('body *');for (i = 0; i < elements.length; i++) {if (getComputedStyle(elements[i]).position === 'fixed') {elements[i].parentNode.removeChild(elements[i]);}}})()})()

[2]:

      javascript:(function(){(function () {var i, elements = document.querySelectorAll('body *');for (i = 0; i < elements.length; i++) {if (getComputedStyle(elements[i]).position === 'fixed' || getComputedStyle(elements[i]).position === 'sticky') {elements[i].parentNode.removeChild(elements[i]);}}})()})()

</comment></comment><comment><USER6> What teams need are ready access to dedicated collaboration spaces when needed. My experience with open floor plans is developers need uninterrupted "heads-down" time to work through complex tasks and open floor plans make that difficult to obtain. Developers endure interruptions which in turn limit the complexity of the tasks they're able to complete. I believe it's this desire to get uninterrupted time that's causing the paradoxical result that they actually collaborate less.

</comment><comment><USER7> Well, the noise and distractions caused by not being able to isolate yourself for tasks that require concentration for longer periods should be enough to have people dislike open-plan workspaces. For tasks that require concentration, the only way seems to be noise canceling headphones. I wonder if we will get to a point where VR/AR collaborative spaces will provide the next phase of co-working. It certainly would open up options for working from anywhere and for organizations to hire anywhere and still have teams to work in a similar way to being in an office.

[https://uploadvr.com/virtual-office-commute-vr- replacement/](https://uploadvr.com/virtual-office-commute-vr-replacement/)

</comment><comment><USER8> Along with the article, I get a video where "a top designer explains how to plan the perfect open office".

Color me confused.

<comment><USER9> Type open office into their search bar. Nearly every other article contradicts the one adjacent to it.

It's actually pretty funny

</comment></comment><comment><USER10> Open office plans suit small groups of people, maybe 5-6. Even then, I prefer the open office plans where everybody is facing a wall or partition of some sort. Being able to see the person on the other side of the table is terribly distracting!</comment>


The Mighty U.S. Consumer Is Struggling - <AUTHOR> https://www.bloomberg.com/opinion/articles/2019-05-08/the-mighty-u-s-consumer-is-struggling <comment><USER3> In addition to the no-surprise explanation of the "tax cut" not being an actual cut at all for most people and the uptick in household interest payments (likely driven by student loans and increased housing prices in many markets), the key takeaway quote for me is:

"two-thirds of April's new jobs were generated in lower-wage services industries such as administration and support services, health and social services, leisure and hospitality, among others. The flip-side of this dynamic is that high-paying job growth has been nearly halved to 1.6 percent since peaking in 2015."

I've been trying to explain to people for years now that reduction in unemployment does not mean people are getting good jobs, it just means people are getting _a_ job that employs them "full-time" with or without benefits, livable salary, etc. The data here supports that: "good" job growth is far outpaced by low-quality job growth.

<comment><USER4> > In addition to the no-surprise explanation of the "tax cut" not being an > actual cut at all for most people

Justify that statement please. Every single study of the 2017 tax cuts has shown that the vast majority of Americans did in fact get a tax cut. Every. Single. One. Even the New York Times admits as much. Either you haven't really looked in to this at all, or you've bought some policital rally baloney that is completey ungrounded in truth.

[1] [https://www.nytimes.com/2019/04/14/business/economy/income-t...](https://www.nytimes.com/2019/04/14/business/economy/income- tax-cut.html)

<comment><USER5> From your link:

> The middle fifth of earners got about a $780 tax cut last year on average, > according to the Tax Policy Center.

> The top 20 percent of earners received more than 60 percent of the total tax > savings, according to the Tax Policy Center; the top 1 percent received > nearly 17 percent of the total benefit, and got an average tax cut of more > than $30,000. And that's not even factoring in the law's huge cut to > corporate taxes, which disproportionately benefit the wealthy households > that own the most stock.

Hence (rightfully so) pitchforks. The average American taxpayer was bamboozled.

<comment><USER6> But since the top 20% of taxpayers pay 87% of income tax[1] and the top 1% pay 37%[2], this makes total sense.

1: [https://www.wsj.com/articles/top-20-of-americans-will- pay-87...](https://www.wsj.com/articles/top-20-of-americans-will-pay-87-of- income-tax-1523007001) 2: [https://taxfoundation.org/summary-latest-federal- income-tax-...](https://taxfoundation.org/summary-latest-federal-income-tax- data-2018-update/)

<comment><USER5> But it's not how it was sold. The absolute number is not the issue, but the optics. I have seen this first hand with Trump supporters (extended family) who are having an unpleasant tax filing season (owing when they have never owed before) and feel lied to. I have delivered the bad news that their tax burden was already so low, how would they expect their tax cut to be generous? Like I said, optics.

EDIT: _I_ know how tax refunds and liability work, but I am not the general public.

<comment><USER7> If you have to pay more or your refund is lower, that's a good thing. That means you paid less money in taxes.

The government holding onto your money until the end of the year is not a good thing. You'd be better off saving that money and investing it.

</comment></comment></comment></comment></comment></comment><comment><USER8> Real wages are dead flat for decades, everything else costs more so purchasing power is significantly reduced. The middle class is shrinking. For a lot of Americans it's a really bad time.

<comment><USER9> The American middle class is shrinking because the majority are moving into the upper class, while the lower class remains constant. There's plenty of reports on this, check out intragenerational financial mobility.

<comment><USER10> So many reports that you didn't bother linking to one? I'm sorry, but this seems heinously misinformed given that our debt/equity ratio keeps growing.

<comment><USER11> The Fed's figures indicate it's entirely correct. What's actually happening is an increased bifurcation of outcomes in the US based on race and education levels.

Educated Whites, Blacks, Hispanics and Asians have all done well over the last decade.

For example, the median household net worth of a Black household with a four year degree or greater, increased by nearly 90% in just three years with the economic recovery from 2013 to 2016 (stocks and real-estate values). Educated Hispanic households saw a similarly outsized increased in their median net worth.

The median net worth of an educated Black household, is now considerably higher than the median net worth in Germany or Sweden. The same is true for an educated Hispanic household.

However, without that education level, Black households see a drop of ~83% in their median net worth figure. White households without a four year degree or greater, similarly see an ~80% drop in their median net worth.

The average net worth of a White household without an education, was $367,000 as of 2016. With a bachelor's degree or higher, it was $1.8 million. Median was $98k vs $397k.

The gains have mostly gone to educated households. That has produced an economic gain bias in favor of White and Asian households (which tend to have greater / easier access to higher education). That effect has pushed White and Asian households up the class bracket over the last four decades.

This is fundamentally why the US middle class has been spinning its wheels. You're seeing White and Asian households move up and out of the middle class, and Hispanic households move in, while Black households have been stuck with only very modest progress.

[https://www.federalreserve.gov/econres/notes/feds- notes/rece...](https://www.federalreserve.gov/econres/notes/feds-notes/recent- trends-in-wealth-holding-by-race-and-ethnicity-evidence-from-the-survey-of- consumer-finances-20170927.htm)

</comment></comment></comment></comment><comment><USER12> I'm having trouble squaring the claims in this editorial with the following fact from the Personal Spending data;

> _Personal saving was $1.03 trillion in March, and the personal saving rate, > personal saving as a percentage of disposable personal income, was 6.5 > percent._

That seems incredibly robust considering negative personal savings rates of the past.

Increased personal spending is the best sign we have that consumers are _not_ struggling. Up is down?

<comment><USER13> I think the author is cherry-picking numbers to support her thesis. In any case, here are some opposing views:

U.S. consumer spending surged 0.9 percent in March, the biggest gain in nearly a decade, as inflation pressures remain non-existent.

The March gain in US consumer spending was the biggest monthly increase since August 2009, the Commerce Department reported April 29. while inflation rose just 0.2 percent and has risen only 1.5 percent over the past 12 months.

[http://www.alaskajournal.com/2019-05-01/us-consumer- spending...](http://www.alaskajournal.com/2019-05-01/us-consumer-spending- surges-09-percent-march)

Average hourly earnings in April were 3.2 percent higher than a year earlier, the ninth straight month in which growth topped 3 percent, the Labor Department

[https://www.nytimes.com/2019/05/02/business/economy/wage- gro...](https://www.nytimes.com/2019/05/02/business/economy/wage-growth- economy.html)

<comment><USER12> Here's an interesting observation on MarketWatch;

> _Income was subdued. The slight 0.1% gain in March follows a 0.2% gain in > February and a 0.1% fall in January. Year over year, personal income is up > 3.8%, moderate by historical standards. Disposable income was flat in > March._

> _The weakness in income was concentrated in proprietors' income. Wages and > salaries rose 0.4% in March after a 0.3% gain in the prior month._

It makes sense that strong job growth at lower incomes, and low-income wage growth, would squeeze proprietors' profit margins, but if it were merely redistributing income, wouldn't the overall rate stay the same?

EDIT: I think if you look at Table 1 in the full report it gives better context. [1]

[1] - [https://www.bea.gov/system/files/2019-04/pi0319_0.pdf](https://www.bea.gov/system/files/2019-04/pi0319_0.pdf)

</comment></comment></comment><comment><USER11> "As for what's pushing households to tap into their rainy-day funds, Deutsche Bank recently pointed to the 15 percent year-on-year increase in household interest payments. Levels of payments rising at a similar pace preceded the onsets of the last two recessions."

That's a pretty far fetched setup when you examine the actual facts of household debt interest payments.

Given the bearish angle of the article, households must be seeing soaring debt interest payment costs, right? They must, the article is pushing that very claim.

Fact: household debt service payments as a share of disposable income were at 40+ year lows, at 9.88% in 4Q2018. That's according to the Federal Reserve.

Since Nixon was President, US households have not struggled less when it comes to debt service costs.

Let's examine how today's figure compares to the past. It must be quite high and indicating a drowning consumer, surely.

During the roaring 1990s, the lowest that ever got was 11.4% in 1998. It was up to 12% by 4Q2000, far beyond where it's at now.

The best it ever got in the 1980s, was 10.2%, in 4Q1980.

Peak economy prior to the great recession, in 2005 and 2006, it was up at 12.5% +/-. Again, far higher than it is now.

In 1Q2013, it was at 10.2%. In 3Q2016, it was up at 10.07%.

Ok, but wait, households must be loading up on debt, right? They must be in terrible shape.

Nope. Total household debt as a percentage of disposable income, is sitting back at 2003 levels, prior to the insanity of the housing bubble. It has seen no large run-up increase yet (typical of what happens leading up to the time just before a recession). Here's what that looks like:

[https://i.imgur.com/fWGzgYJ.png](https://i.imgur.com/fWGzgYJ.png)

The article is intentionally dropping context.

</comment><comment><USER14> > Deutsche Bank recently pointed to the 15 percent year-on-year increase in > household interest payments. Levels of payments rising at a similar pace > preceded the onsets of the last two recessions.

That's because the Federal Reserve caused the past two recessions. First by allowing an asset bubble to form, then by overreacting and driving the entire economy into recession.

It's strange how Bernanke is lauded as some hero that saved us from the Great Recession. I've heard quite a few smart people, people like James Grant, identify him both the savior from, and a cause of, the Great Recession. Curiously I only hear about their successes in the recovery and not their part in the crash.

</comment><comment> munk-a The outline, for reference: [https://outline.com/3uNMyr](https://outline.com/3uNMyr)

<comment><USER15> Don't take this the wrong way because I'm genuinely asking - how is this useful? All this does is cut out the sidebar/header content along with the graphs. I hate bad web design as much as the next guy especially on text and pictures websites, but I don't get what the site you linked is trying to accomplish.

<comment> munk-a Mostly it's just to make articles (text content) readable as their text content.

I, personally, have little patience for being advertised to or being asked to check out "interesting related content"... someone linked an article they thought was worth reading so I wanted to read it, this makes reading the article as simple and direct as a plain text file.

I linked it here because I know other folks enjoy it and I thought it'd be considerate to minimize the number of times the article needed to be reparsed to strip out the weird bits.

</comment></comment></comment><comment><USER16> Did you know that financing for the lower class can be as expensive as 25% of their monthly budget. Simply borrowing money has an average APR on payday loans of 400%.

People choose these loans because:

1) the simple dollar costs mask the actual APR due to relatively complex calculations. 2) the effective APR of multiple $40 overdrafts is actually higher cost than a 400% payday loan.

Long story short, these people are acting rationally in an irrational system.

Fortunately, I am a former Credit Karma employee and am working on a solution at:

[https://www.piggycreditcard.com](https://www.piggycreditcard.com)

Please sign up and earn 5% on your checking account.

How can I do this? By arbitraging the risk-adjusted loan probability across a portfolio of 28% APR alternative loans to those in need.

Think of it like socially conscious lending and open source banking.

</comment><comment><USER17> Between these indicators and the constant discussion with multiple Fortune 500 companies about the China Tariffs, I'm bearish.

Expecting that debt will domino and cause worldwide Economic depression.

<comment><USER12> Bearish you say? How is that working out for you?

The S&P is up nearly 15% YTD.

<comment><USER17> Yes, and I think those invested in the last year are going to lose big.

I believe in the 7% yearly number we were taught. But I also can see the economy is damaged.

<comment><USER18> Isn't the annualized average return rate ~9% for the S&P 500? If you had money in the game for years a 20-ish% correction is not really a big loss.

<comment><USER19> Maybe inflation adjusted.

</comment></comment></comment></comment></comment><comment><USER20> > Mortgage lenders are reporting similar strains. According to Knight Black's > latest Mortgage Monitor, a typical first quarter sees the national > delinquency rate decline by 15 percent as borrowers use tax refund proceeds > to catch up on their household finances. The first three months of 2019, > however, marked the smallest drop in delinquency rates since 2009.

Zoom out:

[https://fred.stlouisfed.org/series/DRSFRMT100S](https://fred.stlouisfed.org/series/DRSFRMT100S)

There's a nearly unbroken downward trend back to 2010.

Also, it would be nice if the article reported the Q1 2019 drop. The Fed data doesn't appear to show an unusually high drop during any quarter.

</comment><comment><USER21> >As for what's pushing households to tap into their rainy-day funds, Deutsche Bank recently pointed to the 15 percent year-on-year increase in household interest payments. Levels of payments rising at a similar pace preceded the onsets of the last two recessions.

Maybe this isn't what the article is referring to, but assessments have skyrocketed in my city as they have in every other city. That means higher property taxes and a noticeably higher mortgage payment every month.

I can absorb it but wonder how much it can keep going up before something buckles and a lot of people can't keep absorbing the increases.

<comment><USER4> Property tax assessments are not tied to your mortgage payment - if your mortgage payment changes monthly you've got a bad mortgage.

Also, before you assume a local factor is influencing _national_ spending, keep in mind that the way property taxes are assessed isn't universal - <USER2> example in California, your property tax assessment can only go up by 2% /yr - so it's not possible for them to 'skyrocket'.

<comment><USER22> He is probably referring to the fact that most people pay their property taxes out of escrow holdings along with their property insurance. Payment into the escrow account is part of your monthly bill and is rolled up into the "mortgage" payment even if it is not actually part of the mortgage. Most people won't even request these broken out by line. In those situations, you would expect your monthly payment to change year to year based on property tax assessment.

Since it seems that many people can't differentiate between total tax rates and tax refunds, it seems reasonable to assume that people would consider their property tax escrow part of their mortgage payment.

</comment></comment></comment><comment><USER23> I don't know. It seems to me that prices of most consumer goods have crashed so incredibly in my lifetime that it is almost unbelievable. I went into Wal- Mart today, and there is stuff on the shelves that I would have thought incredible luxuries twenty years ago selling for $15.

Combine with an aging population, that has amassed a considerable amount of "stuff" over their lifetimes, we may be getting close to peak household consumption.

</comment><comment><USER14> > Adjusted for inflation, personal income excluding government transfers > peaked in December and has declined at a 3 percent annual rate over the past > three months.

So, it declined 0.25% between December and March? Or like, $40 a month for the median US worker?

Oh wait, they adjusted this figure for _three months_ of inflation, so it's more like... no change at all.

<comment><USER24> Generally, and especially given the tax cuts, one would expect a strong economy to have an increased personal income, wouldn't they? Especially when the GDP is supposed to be INCREASING at a 3% annual rate?

Also, the inflation rate so far for 2019 has been 1.9%, so that's not no change at all.

<comment><USER14> The tax change has been in effect for a year now.

And, yes, that's my point regarding inflation. A 3% annualized change, adjusting for 2% inflation, is a 1% annualized change. While that may be interesting if sustained, over a few months it's not evidence of much of anything at all.

</comment></comment></comment><comment><USER25> I have been noticing food prices in general going up.

Just tonight, I bought a 5 gallon water refill and it was $1 more

</comment><comment><USER26> At some size, somewhere around 100-1000 employees perhaps, corporations lose their humanity, the sociopaths move to the top and the race to the botttom begins, IMHO.

Amongst lower-paying employers, SMEs (small- and medium- enterprises) generally provide better quality jobs. This is because they haven't lost their humanity yet and somebody there actually cares about their employees. They often have more opportunities for advancement and learning, possibly because roles are less well-defined and smaller orgs tend to need more generalists.

If we really want to help the average consumer, we should offer incentives to SME's rather than mega-corp's.

Obviously, this is just in my experience and I have 0 data to back this up.

<comment> cadence- SMEs don't have enough money for effective lobbying. Most laws are constructed in a way that satisfies lobbyists, since they are the ones providing money to politicians. Those are overwhelmingly big rich corps. The most successful politicians are those who can implement what lobbyists want and frame it in a way that makes general populace consider it to be positive.

</comment></comment><comment><USER27> This is why I support Andrew Yang's Freedom Dividend UBI proposal.

Edit: I want to explicate further, but am on my phone. Perhaps the Yang Gang can jump in?

</comment><comment><USER28> This might seem counter intuitive, but think about things like this.

The cost of everything is going up; so many propose raising the minimum wage to compensate. This will provide some additional money to those beneath the minimum wage. However the price of literally everything will grow to consume that additional wage. In essence what raising that wage does is to devalue the dollar, meaning anyone not seeing a wage increase is actually being paid less relatively.

The only winners in raising such a wage are those that seek rent from others. The land owners, the business owners, the 1% and maybe even just the 1% within the 1%.

The actual solution, the way to increase the QUALITY of life, not the numbers on balance sheets, is to increase the size of the market. Remove arbitrary numeric limitations on workers entering a field (E.G. the monopoly on doctor training slots). Consolidate red tape and ensure that if predictable pre- conditions are met housing projects are approved. Also use actual civic planning, zoning, and land-value taxation to encourage high quality, higher density, and strong community development. Probably making more condos and making it easier to buy and sell housing.

<comment><USER29> This is false.

Raising the minimum wage only affects a small % of employers. In industries that pay minimum wage (retail), labour is often a small % of overall expenses.

The impact of bringing a few people out of poverty is fairly minimal.

Also, many expenses are completely independent from minimum wages. Housing is a great example. It's price is determined by access to credit, and macroeconomic trends that have nothing to do with how much a Starbucks barista gets paid. Medical costs are another great one. Nobody in the healthcare industry gets paid minimum wage.

<comment><USER30> TL;DR at bottom

define small, so about twenty percent to labor is small? start inching up from there and many get scared quickly. plus it won't move many out of poverty what it will do is move many who are not employable out of a job. the people you hire at $15 are going to be held to a higher standard than those you would accept at $8, $9, or even $10. Plus you will get people come out of the wood work would never have considered "stooping" to such a job but for $15 an hour its fine then.

So Mr Tattoo who has a bit of an attitude problem but you take him because he is available for $8 isn't someone you will let cross the threshold at $15. Little Ms May who is always late or out sick will be on the other side of the counter. Why, because once you break a mental threshold in pay you get people who would not had considered working there. Now they won't all be seeing a career but they will see a job that is worth their time.

You want to help those in poverty. Then get government off their backs. From expensive government services and fees, to ordinance inspectors who troll poor neighborhoods, to the cops and legal system who prey on the very same. That $20 bucks you paid to update your license could be make or break it for some and that is just the tip of the ice burg. More low paying jobs are in regulated occupations which forces the poor to incur debt just trying to get licensed to work.

TL;DR $15 an hour won't change the attitude of those demanding it, they will feel even more entitled because they are not suited for employment. Won't matter because it will bring out those who are.

<comment><USER28> For reference, I disagree with this logic as well.

Another way of stating my point is that instead of artificially pegging things 'to the unit of currency' they might instead be pegged as fractions of a "minimum wage", as the econ101 curves will predict a given percentage of a base individuals budget goes to X, and if raising their budget then the cost of X follows that raise.

If yesterday W made 2 times minimum wage, X 5 times, Y 10 times, and Z 100 times, then the minimum wage is multiplied by 2: maybe next year or shortly after... W now makes about 1 times minimum wage, X about 2.5, Y about 5, and Z about 100. Z, BTW, makes money by renting things out instead of directly working for someone else.</comment></comment></comment></comment>


Recommended Reading List for Developers [pdf] - <AUTHOR> https://noggin.intel.com/sites/default/files/Intel-Recommended-Reading-List_1H14_0.pdf

<comment><USER2> It reminds me of the blog post: "A Complete Understanding is No Longer Possible" [[http://prog21.dadgum.com/129.html](http://prog21.dadgum.com/129.html)]

<comment><USER3> This is why I still like old Unix systems (early BSD/v7 etc). It is possible to get a complete understanding of the system in a relatively short amount of time and they're still pretty productive.

xv6 reflects this from an educational perspective: [http://pdos.csail.mit.edu/6.828/2012/xv6.html](http://pdos.csail.mit.edu/6.828/2012/xv6.html)

</comment></comment><comment><USER4> A surprisingly low-quality, diluted, conformist list of mostly boring and outdated books. You can't expect much innovation to come from a team reading this. I scanned through the list 3 times looking for something of value, but nothing caught my eye. Disappointed by Intel.

<comment><USER5> Define low-quality, boring and outdated in this context, and provide alternatives.

I am waiting.

<comment><USER6> Well, Java Concurrency in Practice certainly isn't low quality but it is boring and outdated. An alternative would be Clojure For the Brave And True :)

<comment><USER7> Java may be outdated, but "Java Concurrency in Practice" is not outdated if you're one of the millions of Java programmers still working in that language.

<comment><USER6> Well, yeah. My point, made somewhat tongue in cheek, was that you can avoid all of the horror stories of Java concurrency by switching to Clojure.

</comment></comment></comment></comment></comment><comment><USER8> I am slightly disappointed by the list - for example C# threading is a book from 2003 and .NET has evolved a lot since then (Task, async, etc.). There are other, more recent books that represent current state of art in C#. Perhaps the reading list shouldnt state the year for which it is intended for?

<comment><USER9> The more current one is a free web resource [http://www.albahari.com/threading/](http://www.albahari.com/threading/). You maybe come across that already. I like it.

<comment><USER10> Thank you so much for that link! I didn't know this site yet.

</comment></comment></comment><comment><USER11> What's everyone's recommended readings? I'm halfway through thinking forth at the moment and want to keep the ball rolling!

<comment><USER12> _What 's everyone's recommended readings? I'm halfway through thinking forth at the moment and want to keep the ball rolling!_

Not so much hardcore technology stuff, but here's a reading list I put together a while back, aimed at IT executives, CIOs, etc.

[http://fogbeam.blogspot.com/2013/05/10-essential-reads- for-c...](http://fogbeam.blogspot.com/2013/05/10-essential-reads-for-cios- ctos-and-it.html)

[http://fogbeam.blogspot.com/2013/05/essential-reading-for- it...](http://fogbeam.blogspot.com/2013/05/essential-reading-for-it-leaders- part.html)

Not on that list (I had not read it at the time), but one I'd _highly_ recommend is Eric Beinhocker's _The Origin of Wealth_. [http://www.amazon.com/The-Origin-Wealth-Remaking- Economics/d...](http://www.amazon.com/The-Origin-Wealth-Remaking- Economics/dp/1422121038)

<comment><USER11> Very cool. Not a topic I'd usually peruse so I appreciate the suggestions!

</comment></comment></comment><comment><USER13> Looks like C++ got a bit of an upgrade in the canon...

The Programming Language Bjarne Stroustrup

ISBN 9780321563842

<comment><USER14> Besides the update on the official book, Bjarne has written a new one that teaches how to write modern and secure C++, instead of using the unsafe C underpinnings.

A Tour of C++

ISBN-10: 0321958314 ISBN-13: 978-0321958310

[http://www.stroustrup.com/Tour.html](http://www.stroustrup.com/Tour.html)

<comment><USER15> Planning to switch from c to c++; I'm really exited to read this.

@commenter: The word switch doesn't have to rely on relevance between subjects it is referring to. It has more to do with the speed of changing the direction.

<comment><USER16> i suggest you phrase it 'planning to learn c++' \- there's hardly any switching from C if you plan to write modern C++, because there's hardly any C in it.

<comment><USER17> That has been my problem with C++. When I took my classes that used it[1], the ink was still wet on the original standard. After that, I spent years writing real-time C, with the occasional foray into "C with classes" territory. I can't seem to shake that foundation and "learn" C++ again.

[1] I'm an EE/borderline CompE so I only had three.

<comment><USER14> I got into C++ around 1993, after a brief contact with C, comming from Z80, 68000, Turbo Basic/Turbo Pascal.

C++ gave me a stronger type system and the abstraction capabilities to write safe code, namespaces as poor man module system.

Given what I was already used to from former languages, I never liked pure C. Did used it lots of times when requested to do so, though.

</comment></comment></comment></comment></comment></comment><comment><USER18> Are there any other recommended reading lists? (For example for web development/windows programming etc.)

<comment><USER19> I am certain you will find any number of lists, narrow and broad, on Reddit, GoodReads, LibraryThing, O'Reilly (blog posts), Amazon listmania, StackOverflow, HN etc.

[http://www.amazon.com/gp/community-content- search/results/re...](http://www.amazon.com/gp/community-content- search/results/ref=cm_srch_q_col_rpli/?query=programming&search-alias=rp- listmania&x=0&y=0)

[https://duckduckgo.com/?q=reddit+web+programming](https://duckduckgo.com/?q=reddit+web+programming)

Some stackoverflow tags have a really good info tab, e.g. [http://stackoverflow.com/tags/scala/info](http://stackoverflow.com/tags/scala/info)

Others, not so much: [http://stackoverflow.com/tags/web/info](http://stackoverflow.com/tags/web/info)

Hacker News: [https://www.hnsearch.com/search#request/all&q=%22reading+lis...](https://www.hnsearch.com/search#request/all&q=%22reading+list%22&start=0)

</comment></comment><comment><USER20> There are some good books in there for embedded/firmware engineers. "Making Embedded Systems: Design Patterns for Great Software" and "Multi-Core Embedded Systems" look interesting.

</comment><comment><USER21> Hennessy and Patterson is in its 5th edition. That makes me feel old. I can only vouch for earlier editions, but this is a good book.

(I'm only familiar with the 1st and 2nd editions of this book, and of the two, I greatly prefer the 1st. The 2nd has a lot more information (and of course is somewhat more up-to-date), but that only seems to hide the more significant information. More complete is not always better.)

</comment><comment><USER22> On page 4: > The Programming Language, 4th Edition > Bjarne Stroustrup

I guess they love C++ if it's _the_ programming language!

</comment><comment><USER23> Am I to presume that this list carries as much validity as most other "recommended reading" lists?

/which is to say, books which most working in the field didn't read to get into the field, don't read during the actual job, and probably aren't going to read except maybe as a reference chapter here or there?

<comment><USER24> Yes. I looked at the software dev list; I only skimmed it, but none that I saw were books I read, or books I'd care to read, despite being in the field for 4 years now, and being a fairly passionate learner in terms of new techniques, technologies, languages, and methodologies.

EDIT: Correction; I see Code Complete.

<comment><USER25> With only four years' experience I'd expect you to know little about any of the fields on this list. I'm surprised you found nothing of interest, unless you are only focused on web stuff.

</comment></comment></comment><comment><USER24> I assume these are intended specifically for Intel employees (i.e., targeting technologies and areas they have internally), rather than for any positions located elsewhere. And there, possibly meant more as a reference than a teaching tool.

</comment><comment><USER26> No reading on Bluetooth Low Energy?

</comment><comment><USER27> I know people say this all the time, but I nearly did not click the link, because it said scribd.

It turns out it's a pdf served at this address, along with another link to scribd in the brackets:

[https://noggin.intel.com/sites/default/files/Intel- Recommend...](https://noggin.intel.com/sites/default/files/Intel-Recommended- Reading-List_1H14_0.pdf)

"I think the title should read [pdf] and [scribd]"

<comment><USER28> I'll bite - what's wrong with scribd ? (besides the fact you might "stumble" upon documents you're not supposed to read)

<comment><USER29> The last time I've checked, the worst thing was that it demands money once the document is old enough(!) Then, it required from you to have an account just to download the document. Finally, it didn't work without Javascript. For me, instead of adding value, it reduces it, so I decided to avoid it to save my time.

I know Scribd is a Y Combinator's company.

<comment><USER30> Not just Javascript but Javascript from about a dozen different hosts last time I tried it and quite a few of them seemed to be required. I avoid it too.</comment></comment></comment></comment>


Online Advertising - The new Dot Com bubble is here! - <AUTHOR> https://thecorrespondent.com/100/the-new-dot-com-bubble-is-here-its-called-online-advertising <comment><USER2> Previous discussion: [https://news.ycombinator.com/item?id=21465873](https://news.ycombinator.com/item?id=21465873)

</comment><comment><USER3> >In 2018 $273bn was spent on digital ads globally.

$39 in online advertising per year per human on earth doesn't seem too unreasonable as a figure.</comment>


California moves toward permanent daylight saving time - <AUTHOR> https://www.theverge.com/2018/11/7/18071898/california-permanent-daylight-saving-time <comment><USER2> Instead of adopting PDT year-round why wouldn't they adopt PST instead? That way instead of being 3-4 hours behind the East Coast they'd instead be 2-3 hours behind?

<comment><USER3> As mentioned in the previous reply above, mountain standard time (MST) is the same offset from UTC as pacific daylight time (PDT) and one hour ahead of pacific standard time (PST). Sticking with PDT would keep the clocks 1 hour ahead of solar time year round, so solar noon in the astronomical center of the timezone is at 1pm instead.

I'd rather have local standard time year round so noon means solar noon +/\- 30 minutes or so across the whole timezone. I don't care about having my clock display digits consistent with someone far away. We cannot expect people to decouple from solar time no matter what games we play with clock display values. So, coordinating over distance will always involve thinking about time offsets as well as local cultures and conditions.

<comment><USER4> The main purpose for time is to synchronize events.

As the world becomes more global, I'd like to see more systems use UTC time, and people just get used to when solar noon occurs in UTC in their locale.

</comment></comment></comment><comment><USER5> Is this even legal? According to Wikipedia, DST observance is regulated at the Federal level by Department of Transportation. [1]

[1]: [https://en.wikipedia.org/wiki/Time_in_the_United_States](https://en.wikipedia.org/wiki/Time_in_the_United_States)

<comment><USER6> The article says: "In order for this to actually be put in place, California legislature has to now approve it by a two-thirds vote, and then Congress would have to allow the deviation."

<comment><USER7> As of this summer, Florida is in the same boat as well, though one step further (the state legislature hasn't yet voted for it in CA).

[https://www.orlandosentinel.com/news/politics/political- puls...](https://www.orlandosentinel.com/news/politics/political-pulse/os- daylight-saving-law-20180703-story.html)

</comment></comment></comment><comment><USER8> Here's hoping the rest of the country comes to its senses and follows suit.

</comment><comment><USER9> Praise Jesus</comment>


Ask HN: Affordable 3-6 GB mobile internet for a week in France? - <AUTHOR> I'm on holiday there but will need a lot of mobile data; is there an affordable way to get 3-6 GB of mobile data in France? My t-mobile will cost €25/Gb <comment><USER2> I found these (for the record GO means GB in French) :

\- "NRJ Mobile Woot 2h + 3 Go" for 12.99€ (2h voice)

\- "NRJ Mobile Pocket 5 Go" for 14.99€ (but no voice included)

\- "Bouygues Telecom Nomad 10 Go" for 16.99€ (no voice included)

\- "Free Mobile" 19.99€ 50 GB data, unlimited voice

I think you can only register online for NRJ Mobile. You will find Bouygues Telecom shops in any sizeable town (this is why I included them). Free is interesting for a few euros more you have unlimited voice and 50 GB data but I'm not sure if they are practical for just a week, you'll have to see if it's easy to unsubscribe.

They're all fair use. The fair use close mean that after you reach your quota they will throttle your data but you'll still be able to use it albeit more slowly.

Source : [http://www.touslesforfaits.fr/?BudgetUtilMin=0&BudgetUtilMax...](http://www.touslesforfaits.fr/?BudgetUtilMin=0&BudgetUtilMax=180&CommUtilMin=0&CommUtilMax=600&DataUtilMin=3000&DataUtilMax=20000&sansenga=true&BudgetMin=0&BudgetMax=180&DataMin=0&DataMax=20000&CommunicationMin=0&CommunicationMax=600&FairUseMin=0&FairUseMax=50000&prixparmois=1&nbparpage=20&order=tarif&way=asc&page=1)

<comment><AUTHOR> Thanks a lot; I'll try to get a Bouygues one in the shop!</comment></comment>