Apple's Insurmountable Platform Advantage - <AUTHOR> http://stevecheney.com/on-apples-incredible-platform-advantage/ <comment><USER2> Not so much a comment about this particular article but its funny how companies are realizing the advantages of being fully vertical again, and we the consumers get to witness the the pros and cons of this trend.

It goes back to the days where DEC, NCR, IBM etc... came with entire portfolios of competing implementations, none of which interoperated with each other. IBM for example also had the "Insurmountable Platform Advantage", it had the full stack ... literally, from sillion, chip design, operating-systems all the way up to software-services, but the industry lost out due to big blue's big-iron prices and the pc clone-wars began.

I don't see what the pc clone-wars are in this case, android doesn't seem to make much of dent in apple's profits here.

<comment><USER3> True story: DEC was so vertically integrated that it owned a turkey farm, because that was the most cost-effective way to give every employee a turkey for Thanksgiving.

<comment><USER4> Do you have a source for that? It seems far more humorous than probable.

</comment></comment></comment><comment><USER5> This is a ridiculous article. When you talk about a platform's 'advantage', you're talking about features that enable it to dominate its sector.

Apple does no such thing. They make lots of money, but they don't dictate the direction tech is going. They make nice devices for the present, but they offer no additional utility over an Android device.

The fact that Google doesn't make as much money selling phones is a moot point because they're more of a service provider than a hardware manufacturer. They want you to be using Google services, and Android/Nexus products merely enable that.

As for the utility of an iPhone vs. Android, my Android phone (via Google services) keeps track of traffic for my various commutes (work and school), makes appointments for me based on the content of e-mails (reads schedules, meeting times), and does all sorts of other predictive magic. And has been doing this for awhile now. Apparently Apple just started adding these features to iOS 9 (as well as split-screen multitasking, their new Notes app, public transportation on Maps, )? Dunno, based on the feature sheet of iOS 9, seems like Apple is 2-3 years behind Google/Samsung.

<comment><USER6> The article is not about features, but about profits. But to your point about features: Follow the money. How else would Apple be making so much money if not by giving customers the features they want. That is exactly how they make money: features.

In Apple's case the hardware is a feature. Performance is a feature. Build quality is a feature - all of those things come from manufacturing. By controlling the whole process they can ensure quality from both the software and hardware sides.

You are correct that unlike Apple, Google is not a hardware manufacturer, they sell ads - but they are still trying to make money. It's just that they make most of their revenue from ads, and Android is a way for them to ensure they can capture the ads in the mobile space without being shut out by the iPhone.

But, how long will HTC, Huaweii, Nokia, Motorola be around making smartphones for the Android platform if they are not making any money ? Who will make Android phones without turning a profit ?

As for your quote:

> They make lots of money, but they don't dictate the direction tech is going.

I will offer this example: \- touchscreen phones ( find a smartphone that is not like the iphone)

<comment><USER5> Google makes money. Samsung makes money. Xiaomi makes money. I'm sure others do too, even if it's less than Apple.

The fact some companies don't make money is meaningless. Is it Microsoft's fault if an OEM goes out of business?

And the innovation thing goes both ways. Yes Apple popularized a form factor, but remember there still was BlackBerry, Windows Mobile, Maemo, etc..., before iOS.

And every new feature on iOS 9's launch page is more or less taken from Android, some features being several years old.

Thinking about technology that developers use, very little comes from Apple. They contribute, but no one is launching their startup on OSX servers. No one is coding the next search engine in Objective C or Swift. Apple products are a shiny computer that hosts apps.

The point of the article is that Apple has an unassailable position. That's what a lot of people thought about Volkswagen a year ago. What they thought of Microsoft a decade ago. Also what we think of Google today... The point is, Apple does nothing so special that they can't be beaten.

</comment></comment></comment><comment><USER7> This is a fascinating perspective, but I can't help but wonder if it cuts both ways: In the same way that current auto makers may underestimate their dependence on commodity chips in EVs and autonomous cars, the author may be underestimating Apple's potential dependence on commodity mechanical systems.

Of course, there's no reason Apple couldn't suddenly pick up one of Delphi's smaller competitors next week.

<comment><USER8> Author of the piece here. Thanks for the perspective. Note it's interesting that Tesla was able to start out (with a fraction of Apple's resources) by building their first car on the Lotus platform. The mechanical stuff is interestingly not expensive compared to technology R&D at all. Which makes sense when you think about modern manufacturing and materials.

<comment><USER9> _> Tesla was able to start out [...] by building their first car on the Lotus platform._

Well, Tesla Roadster used the Lotus body (shape) but not the engine and drivetrain.

<comment><USER5> Lotus didn't make the engine for the Elise. The 'platform' is the chassis/suspension.

</comment></comment></comment></comment><comment><USER10> To a certain extent , the story of "important and unique manufacturing processes" is a story every luxury brand tells his customers ,and it's an important marketing tool.

As for most iPhone users, who mostly use the iPhone for social media and casual games, i'm not sure it's hardware differentiation is that critical. Maybe it was before, but it's not today(since android has matured). It's certainly not in the top 5 biggest competitive advantages the iPhone has,while more mundane things have much more importance like: control of iMessage, strong status symbol, people being used to the platform ,etc

</comment><comment><USER11> Overoptimistic.

There is no insurmontable platform advantage. Microsoft's Windows and Google's Android are in their best shape yet and one can switch platforms without major inconveniences. Maybe there's the exception of very specialized software applications not available on all platforms, but for most apps, they cost 0.99 because that's what they're worth. Hardwarewise Apple is best in class, but Lumias are fine and I'm guessing there's Android manufacturers that don't suck.

My point is that yes, you probably won't get such a good overall package from anyone else except Apple, but that package does cost a ton of money, and you can get something more than decent for a third of that price. Can't really imagine what an Apple car would do that other cars couldn't, except maybe driving itself, but then I don't see why Apple would beat Google & the others to the punch.

</comment><comment><USER12> Why would custom chips be particularly useful for tomorrow's cars? Commodity chips seem to be good, so far.

Looks like the author stretches the usefullness of Apple' vertical integration too far.

<comment><USER13> I can imagine one asking the same question with regard to the value of custom chips in phones, just prior to the appearance of the M7 through M9.

<comment><USER10> It's all part of the apple bullshit marketing:

"Chipworks found that the M7 most likely is a NXP LPC1800 based microcontroller called LPC18A1. It uses an ARM Cortex-M3 core with a customised packaging and naming scheme indicating that it is for an Apple customized part"

[https://en.wikipedia.org/wiki/Apple_motion_coprocessors](https://en.wikipedia.org/wiki/Apple_motion_coprocessors)

<comment><USER13> That may be true, but for the purposes of the above question, the name of the thing doesn't really matter so much, does it?

</comment></comment></comment></comment><comment><USER14> >radio interface (RF) chips that traditionally were off limits to all but the most advanced chip makers like Qualcomm. These chips rival CPUs in complexity.

This is interesting, I want to know more about why are they so complex?

<comment><USER8> Analog circuitry is the most complex in chip design. It's part art part science. At the end of the day radio waves are traveling through the air and a lot of things can go wrong.

</comment></comment><comment><USER15> Hardware doesn't sell the platform, however. The software ecosystem does. Due to the direction OSX is taking, my MBPr I have now will be the last one I own, I will be replacing it with something that runs Windows, most likely a Surface product.

I use Windows 10 on my desktop. OSX cannot be realistically installed on non- Apple hardware, and I built the equivalent of a $4000-6000 Mac Pro for less than half the cost; OSX also has very poor multi-monitor support, which I need, which is a bit ironic given Classic MacOS did it pretty well.

I'm considering ditching my Nexus 5 for a Lumia 950 for proper cross-device ecosystem usage (since there is no "Google Desktop" no matter how much Google tries to push ChromeOS), and if I buy a Lumia 950, I'm probably going to buy a Band 2 to go with it (which Google and Apple both want to just magically go away, along with Cortana on Android). I do not rely on Google Drive or Google Docs, I use Google Photos just as backup storage for photos, and I use Google Music merely as a front end of my collection and do not buy music through it and rarely use the radio.

Also, I'm seriously considering dropping Evernote for OneNote for my personal notes (I already use it via Office365 for Business, and it is such a superior product), I already use Excel heavily for tasks that don't warrant full scale programming attached to a database, I find Outlook to be a superior email client, and I use OneDrive to sync Office and OneNote files across all of my devices (including OSX and Android). All of these are natively supported on Windows 10 and Windows 10 Mobile.

So, explain to me, what does Apple offer me? Or Google for that matter? I don't care what the hardware in the phone is as long as it works, I don't care what the OS does as long as it works: I use a computer to _do things_ , not to sit around and looking at how shiny the UI chrome looks like.

The most ironic thing in my entire life? I spent a good 15-20 years just bashing Microsoft for sucking (legitimately so, I might add), but somehow, with their new CEO, Satya Nadella, they have managed to double down on their core strengths and make products people want.

The biggest problem with Microsoft was the massive lack of core integration of the OS and the hardware, there was no synergy. Major hardware manufacturers would invent standards that OSes (Windows or not) had trouble dealing with, and any time Microsoft tried to force a standard onto manufacturers, unless they could get Intel to bite, the standard would either fail, or be badly implemented in every possible way.

Windows now has their own core devices that are _designed_ for Windows, by Microsoft, from the ground up. Windows for phones are now a first tier product that _is_ Windows, something more than merely being the iOS to Windows' OSX. And, unlike OSX, I am still free to run Windows on any computer I choose to buy or build (including my MBPr, if I choose to) _while_ still being able to choose tightly integrated product lines like Surface _without_ either being second class citizens.

Microsoft, internally, seems to treat Surface and Lumia like their Pixel and Nexus. Product lines that are top tier and show other manufacturers how to build products worthy of Windows.

Does Apple try to build an ecosystem other people get to belong to, even though they want to? No. Does Google do that? No, for the opposite reasons, you CAN use their APIs, but no one wants to.

Microsoft just wants my money, and makes it as easy as possible for me to give it to them. Apple wants my money, but wants ALL of my money and won't let me realistically integrate it into my existing pile of devices. Google wants my money (I think? Do they? Sometimes I question this), but doesn't have a complete ecosystem that makes sense.

And Linux? I ran that as my primary desktop OS for 15 years. Linux on the desktop is a dead dream to me, Gnome 3, and PA, and SystemD, and CFS/cgroups, and all this other weird shit that no one ever wanted just sort of killed it; and I hoped that at least Wayland would come in and finally unfuck the underlying windowing and rendering system (ie, making all the work poured into Mesa/Gallium/DRI3000/etc worth it) just... didn't happen. I still adore Linux on the server, but, yeah, no, it doesn't belong on my desktop anymore.

<comment><USER16> Just wait until you try a high PPI screen on Windows. You say Linux is a dead dream for you, well high PPI screen on Windows is a dead dream to me. I don't use Metro/Modern UI software, and it seems most software has been stuck at Windows 7 API level for obvious reasons. The result? Ugly ugly ugly. And it will not change any time soon due to 99.9% of Windows (be it XP, 7, 8 or 10) running on cheap hardware with even cheaper TN panels. Even on Microsoft's new hardware, the jarring difference is horrendously apparent even after a quick use. And at this point, if you limit yourself to only the software that is properly PPI aware, you will be much more productive on OS X.</comment></comment>


Bookings at Trump Hotels Plummet - <AUTHOR> http://priceonomics.com/bookings-at-trump-hotels-plummet/ <comment><USER2> This is interesting, but the data is only from Hipmunk, which will filter out certain types of people. It doesn't prove that Trump hotels are doing worse than they did last year (although they probably are).

</comment><comment><USER3> 4 years ago when he tried this the first time I pointed out that most of his larger properties are in 'blue' states and that he should not shit where he eats..</comment>


Papers for software architecture / design - <AUTHOR> I am very much interested about software architecture, Design Patterns, Clean Code, OO concepts. I wanted to ask if there is an ongoing research in this kind of topics or are more or less fixed? Are there any new papers, lets say the last 5 years, that you would suggest to read?<p>In terms of books I have read, the GOF book, Clean Code, Clean Architecture, Pragmatic Programmer and even more, I am looking for fresh ideas. <comment><USER2> Papers we love[0] has a couple of good ones, my favourite being "Out of the Tar Pit"

[0]: [https://github.com/papers-we-love/papers-we- love/tree/master...](https://github.com/papers-we-love/papers-we- love/tree/master/design)

<comment><USER3> Wish I could upvote this more.

In short: Complexity is the biggest killer. And here's a way to view it and tame it.

</comment></comment><comment><USER4> Out of my head, of relevant interest in the distributed systems field are the following books:

Designing Distributed Systems [https://www.oreilly.com/library/view/designing- distributed-s...](https://www.oreilly.com/library/view/designing-distributed- systems/9781491983638/)

Building Evolutionary Architectures [http://shop.oreilly.com/product/0636920080237.do](http://shop.oreilly.com/product/0636920080237.do)

Building Microservices [http://shop.oreilly.com/product/0636920033158.do](http://shop.oreilly.com/product/0636920033158.do)

They encompass most of the topics you've enumerated earlier.

</comment><comment><USER5> The Architecture of Open Source Applications

[http://aosabook.org/en/index.html](http://aosabook.org/en/index.html)

</comment><comment> q-base Are there any one of those books that you would especially recommend? I have considered the Pragmatic Programmer - but is there more to it than what is implied in the title?</comment>


A millionaire couple is threatening to create a magic mushroom monopoly - <AUTHOR> https://qz.com/1454785/a-millionaire-couple-is-threatening-to-create-a-magic-mushroom-monopoly/ <comment><USER2> This stuff is prolific in the startup world of medicine. There is some shady stuff that happens. Glad Quartz did this report. There should be more discussion about these issues.</comment>


How to be paid as a startup consultant - <AUTHOR> I would like to start a business as Startup Consultancy. That would provide feedback, an external point of view, assistance and support for people in order for them to have more chance to succeed in their startup. However startups have no money to start with. So it's hard to make them pay as little as 5oo€/$500 per month for this kind of service.<p>What are the different way to make money for this kind of consultancy in the short or long term ? <comment><USER2> No offense here. But what kind of startup consultant are you that needs to come on Hacker News to ask how to start such a relatively simple business?

If you are having trouble with this question, I can tell you startups deal with similar customer acquisition and how to launch questions, but 10x harder. So I don't follow, are you a technology consultant with experience in specific hardware or software technologies or is this general business consulting you hope to sell?

<comment><USER3> I agree with hxta, I imagine these are the same questions your startups will be wanting you to ask i.e. "how do I sell to X?" "how do I make this venture profitable?" Startups have two things - equity and cash, if its cash you are looking for then you are either going to have to limit your sales to funded startups or write out a performance agreement which means you take on more risk.

</comment></comment><comment><USER4> What are your credentials? What hard-earned experience in this area do you have to offer others?

This is not intended as snark, but there's certain irony in asking others for help with a business model when that is precisely the kind of service you wish to offer.

</comment><comment><USER5> Without any authority or credentials in this space you are going to face a very rough time with sales. The kind of startup willing to hire a random "general startup consultant" without a proven track record is also the kind that will fail and leave you with an even worse reputation.

You should focus on a single area or niche that you can do very well and has direct monetary value to a startup. What that area or set of skills turns out to be is for you to decide. It is better to be loved by a handful of people than try to be "maybe helpful" to every startup.

Personally I have been getting into the business of Pre-Launches for startups and programmers who are still working on finishing their MVP's. These programmers don't want to spend dozens or hundreds of hours learning about cheaply finding their customers online, building landing pages that convert, or growing their email list of future customers. They just want to be able to launch their product and acquire their first batch of users. Taking this headache away from them gives them the validation and encouragement they need to finish their MVPs and the time they saved by not building and marketing their pre-launch landing page can be used to instead finish their core functionality.

Thats just my 2 cents.

</comment><comment><USER6> One idea may be to bundle or "set up their systems" for free - accounting, CRM, credit cards, website, SEM, etc. This would save them probably a few hundred hours of research and configuration. Charge them a nominal monthly fee to manage it all.

Then, when you get known for doing this and have lots of clients, charge the SaaS companies an affiliate marketing fee to be included in your bundle.

<comment><USER7> Totally agree with this idea.

</comment></comment><comment><USER8> There are plenty of startups that have $50k or $500k of funding. Most of them are going to be frugal, but it is very realistic to sell them $2000 to $20,000 worth of something.

</comment><comment><USER9> Offer strategy and design. Most people with ideas and a little bit of funding need this kind of help the most.

</comment><comment><USER10> Its not hard at all to pay 500/month for anything, assuming its got value.

I would PERSONALLY pay you 500/month if you could prove to me that you deliver more than 500/month in value. Your problem is your value prop, not your price.

</comment><comment><USER11> Get a proven track record first. Then setup a retainer with smaller companies. Then move your way up.

</comment><comment><USER12> How can you offer useful advice when you dont have domain expertise in every possible field?

</comment><comment><USER13> Look at YC model. Ask for shares!

</comment><comment><USER14> Short term:

Go to twitter

Find companies you think could benefit from hiring you

Pitch them

Rinse and repeat.

Long term:

Productize whatever solutions you develop during the short term.

</comment><comment><USER15> First figure out if that's what they want in the first place.

</comment><comment><USER16> Seek cash.

You can't eat equity or options.

</comment><comment><USER17> The difficulty is not in getting them to pay but showing your credibility. There is tons of free information on the internet why should a startup pay you?

We are building a platform where people contribute time to help in the building of a company or service. Please visit www.crowdraising.co Pledge time to start

<comment><USER18> Occasionally linking to your own stuff in relevant contexts is fine on HN, but you've been doing it excessively. When you do that, the HN hivemind gets upset and uses unkind words like 'spam', so please don't do that.

<comment><USER17> Thanks.got it.</comment></comment></comment>


David Bonderman Resigns from Uber Board - <AUTHOR> https://mobile.nytimes.com/2017/06/13/business/david-bonderman-resigns-from-uber-board-after-sexist-remark.html <comment><USER2> So Bonderman made an overtly sexist, diminutive comment about a new FEMALE board member at a meeting held SPECIFICALLY to address Uber's inherent culture & sexism issues?

I'm not sure whether watching HBO's Silicon Valley or just pulling up HN has given me more belly laughs at the inanity of the current state of tech over this past 12 months.

</comment><comment><USER3> Really can't make this up. The board has spent months trying to figure out how to deal with their culture issues, and minutes into the all-hands presenting their findings, he says a disparaging offhand comment about women.

<comment><USER4> And interrupts Arianna Huffington to do so, too.

</comment></comment><comment><USER5> I wonder if Uber's investors have an unusual perspective on women's issues:

[https://www.crunchbase.com/funding- round/3561e0558d4fa07f0dc...](https://www.crunchbase.com/funding- round/3561e0558d4fa07f0dc27a9d380fd0ae)

</comment><comment><USER6> On one hand, we live in an age that highlights and elevates any remarks made to a point that there are serious real world repercussions.

On the other hand, the internet offers a layer of perceived anonymity that causes people to say things they never would, or should, in person. Things that they would be ashamed if that had to repeat to peers, in person.

It's a strange time to be alive.

<comment><USER3> This was said in person though?

</comment></comment><comment><USER7> The right thing to do. He needs to be replaced by a woman, and to Ariana's point they need several on the board. Plenty of work required to change the toxic culture at Uber.

<comment><USER8> FTFY: He needs to be replaced by a more qualified individual. It doesn't matter what gender they identify as.

<comment><USER3> A woman with a perspective on the diversity and culture they need to create seems uniquely qualified for the role.

<comment> throwaway-1209 "Diversity hiring" is a double edged sword though. There's a stigma attached to it which is really hard to overcome even if you're good.

<comment><USER3> It's crazy that hiring a woman to be the second woman on a board is considered "diversity hiring" though. It's not a super minority that is being looked for to tout diversity, it's half the population! I'm sure there are women who are both utterly qualified AND can provide a perspective on the more inclusive culture they are trying to create.

<comment> throwaway-1209 Hiring a woman is not crazy in the least. Hiring a woman because she's a woman over a more qualified male candidate (or the other way around) is harmful. There are plenty of women who don't need such "help".

<comment><USER3> Not sure why we immediately need to jump to the trope that a more qualified male candidate would be passed over. You're treating a seat on the board as if were some sort of technical role with hard skills. It's not - it's a role to be a positive and influential voice within a company dealing with a toxic culture. Being a successful woman and having all the experiences and perspectives that come with that is literally part of their qualification for the position.

<comment><USER9> > Not sure why we immediately need to jump to the trope that a more qualified > male candidate would be passed over.

This is the original piece comment we are talking about:

> He needs to be replaced by a woman

It's evident that the objective is to hire a women, not to hire a qualified person, therefore a less qualified person can be hired just because she is a women. A person hired like this would most likely not get too much respect because she had an advantage not because of her skill, but her gender.

> Being a successful woman and having all the experiences and perspectives > that come with that

See my question in another comment.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> All thanks to the leaked audio from the meeting (6:40): [https://finance.yahoo.com/news/inside-ubers-hands-meeting- tr...](https://finance.yahoo.com/news/inside-ubers-hands-meeting- travis-194232221.html)

</comment><comment><USER11> This was the right move.

On another note it's getting harder and harder to separate the news out of Uber from satire. Watching the car accident continue over again at head office feels like I'm sometimes caught reading The Onion.

</comment><comment><USER12> Preparing to be bombarded with downvotes for this, but resigning over such a remark seems like an overreaction. His apology seems sincere, that should be enough.

On the scale of things said about women by men in power this is about a 2/10, there's many much more egregious examples of sexism out there for people to be upset about.

<comment><USER13> You have to look at the remark in the context it was made. They were having a meeting where they presumably tried hard to make the point that they're very serious about fixing their culture. This is the only way to _maybe_ keep this believable, even if you feel that "everyday sexism" should be considered harmless.

</comment></comment><comment><USER14> What do you think of adding Marissa Mayer to Uber's board of directors? She seems to be suited to run companies in Uber's position.

<comment><USER15> that comment is quite sexist.

<comment><USER16> ?

</comment></comment></comment><comment><USER17> I'm not sure I fully understand the point he was trying to make? Was it a dig at Huffington not adding value?

<comment><USER18> Listening to the audio, he's saying it in jest and Huffington laughs along (albeit nervously since it wasn't a funny joke). It's just reinforcing a stereotype that women tend to talk a lot.

<comment><USER17> Interesting, thanks for clarifying. Yeah the quotation on its own was unclear what point it was even trying to make.

</comment></comment></comment><comment><USER19> By now this is starting to be downright hilarious. Fuck all these folks and the Ubers they rode into town in.

<comment><USER20> Hey staticautomatic, I hope you see this. Sorry for the offtopic comment but I couldn't find your email anywhere. Shoot me an email at firstname.lastname@example.com . It's about OCR.

</comment></comment><comment><USER21> It seems like teachable moments have become fireable offenses. I understand the seriousness of the issue and context, but is this really worth the level of outrage it has received?

Edit: Curious at the downvotes for an honest attempt at a reasonable discussion on the issue. Such are the times.

<comment><USER22> Calling this a 'teachable moment' is really letting the person off the hook for observing and learning up before now.

If he hasn't learned by now what is appropriate behaviour, why do you think he'll ever learn?

And if he doesn't learn rapidly and advance with best practices in corporate culture and governance, then he's not capable of the leadership and management responsibilities of a board member.

The 'teachable moments' were at least 3 years ago, if not much earlier. The firing offence is ignoring them.</comment></comment>


Hacking Attempts on Ecuadorians Not Ecuador - <AUTHOR> http://www.liceonaval.mil.ec/webpages/index.php <comment><AUTHOR> From what I understand individuals and groups are, in support of Assange, disrupting the lives of average people. The above link shows not the downed server of a some political organization but that of a high school (and a military high school at that). Please stop this behavior of hacking attempts that affect people's lives and education.</comment>


A Method for Password-Less Authentication - <AUTHOR> http://www.h4ck.guru/passwordless.html <comment><USER3> The dependency list is missing "Smart phone".

Anyone who's spent time in hotels in recent years knows that since switching from mechanical keys to magnetic keys, sometimes the keys break and the guest is locked out of their hotel room, which of course they never discover until trying to open the door. Then they have to go to the front desk, probably stand in line, and request a replacement key.

Using smart phones as authentication devices suffers from this exact same problem. I can't speak for iOS but every android phone I've had has experienced slow operation, crashes, and other kinds of issues at inopportune moments. When I am trying to log into something to perform a 5 minute task I don't want to be delayed for 15 minutes while my phone chugs away at whatever.

I'm just one geek, but I have spent a lot of time thinking about "alternatives to passwords". I have concluded the password is king. We use passwords everywhere, and we will continue to use passwords everywhere, until someone invents something better. In 100s of years nobody has done that yet (Mechanical keys are a kind of password).

Instead of trying to replace passwords which are reliable and simple to use, with complicated authentication systems which are not reliable and not simple, we should focus our efforts on improving password authentication in our existing apps (no more limitations), building great password tools like keepass.info, and encouraging the average user to use password tools and practice good password habits.

<comment><USER4> > Using smart phones as authentication devices suffers from this exact same > problem.

This. 2FA or "tap to login" is all nice until the phone melts down and - <USER2> design - you (normally) don't even have backups, so have to use recovery codes. Which aren't always available.

> I have concluded the password is king.

What about the keypairs?

They are the same as passwords (when done right) - just long "random" strings of data. However, they don't have to be transferred over the wire for everyone to see. And they're more flexible in terms of possibilities on security- convenience spectrum.

There is no SRP standard for web (JS crypto doesn't count), but almost every TLS-aware system (client or server) out there has support for client certificates. The only problem is that browser vendors genuinely hate this (and want to shove users their own inventions), but if someone could somehow persuade them - it would just work.

<comment><USER5> > until the phone melts down

Under what circumstance would that be considered normal, expected, or acceptable?

My phone just doesn't do that, and never has. Sure it crashes maybe once a month or so, but then I'm able to use it again within ~15 seconds.

I think that experience is mirrored by most people.

<comment><USER4> We have different experiences, then.

Monthly crashes are no big deal (in fact, I think, my phone crashes only once in a few months). Slight nuisance at most - e.g. if the crash corrupts Android app cache and system boots awfully long minutes, re-compiling the apps. However, I have three different mobile devices (2 phones and a tablet), from different vendors (Nokia, Acer, Samsung) that had suffered a hardware failure after some (5-8) years of use. Three dead eMMCs.

So, I'm sort of wary. It's exceptional, infrequent but happens quite unexpectedly and is very frustrating when it does. Especially if the recovery keys (which are rarely accessed by design) are lost, inaccessible (you're on the road) or misplaced.

</comment></comment></comment></comment><comment><USER6> In the can-you-really-use-cell-phone-for-trusted-computing department:

I have had support agents come to me and say, "This user was convinced to put his phone into developer mode and attach it to a computer running malware controlled by the attacker." Game over.

Okay, that is colossally stupid behavior. Unbelievable, to most of the audience here. But users will do the damnedest things, and platforms -- whatever their static security failings -- really need to be resilient against coerced or ill-guided user actions as well.

I've worked on platforms that have had very well designed security systems, but they also made very sharp distinctions between what could be done by a developer and a normal user, and for the most part those worlds did not intersect at all.

Android's barrier of "tap seven times here and you're a developer" is very low. It's clever, and good for many reasons, but user security isn't one of them.

<comment><USER7> It is clear that user is the biggest risk in all systems, but that doesn't quite take away from the more important addressable question - specifically - is a password-less method better than what we do today (aka passwords.

I'd take a hunch that the number of users with easily guessable passwords outweighs the number of targeted malware attempts.

But I need not guess, any of the password dump files provides a good statistic showing % of passwords.. what was it something like 0.6% are still 123456? and another 2-4% some similar-looking cousin?

If we go with this logic - we also wind up getting extra wins: better usability, and cheaper to deploy/manage. But that's a whole other topic.

</comment></comment><comment><USER8> It looks a bit like Steve Gibson's SQRL (which uses QR code rather than bluetooth), which I think is an excellent idea. I just wish it was sponsored by someone more consensual/followed by the tech community.

But the idea of saving a private key on a locked down, app whitelisting, disk encrypted device (like an iphone) and to have a protocole that does not rely on a third party (which currently are mostly google and the social networks, the last people on earth I would want to share which sites I login to) is appealing.

<comment><USER9> >It looks a bit like Steve Gibson's SQRL (which uses QR code rather than bluetooth)

or you could combine them: when Bluetooth isn't available then use a QR code

</comment></comment><comment><USER10> The bluetooth dependency looka painful. But I'm also highly skeptical of the behavioural analysis. I feel like a piece of malware could replay recorded behaviour and attack at 2:30am when the user is probably close enough to trigger an automatic authentication.

<comment><AUTHOR> Since agents need to be authenticated once with users, the replay vulnerability should not be a concern. But a malware that sits on a client and potentially can access to agent keys can definitely be used to authenticate when phone is in proximity of infected machine. But that level of vulnerability on clients is pretty serious.

<comment><USER10> Well, if its your home computer and you know a target uses this method, then you _know_ they've authenticated their agent. Maybe someone cleverer than I can come up with an attack vector starting with an unauthenticated agent, but I'll ignore that for now.

And I'm not talking about root access here. Just userspace to record mouse and keystrokes and then replay that. Then, just a couple of clicks and letters changed to some service that uses this authentication. If the replay is done right, those couple of clicks might lower the confidence of the behaviour analysis but not enough to lock it up (that sort of sensitivity would just make it infeasible). Now that it is authenticated, it can stop pretending and quickly move the mouse around and type to do whatever it wants. maybe it downloads your emails and uploads them somewhere.

The point is, your method requires no interaction for the majority of authentications and is potentially always online.

</comment></comment></comment><comment><USER11> This sentence worries me: "any secure computation algorithm that can compare our choice of user behavioral signature without exposing it" because it makes it seem as though there are lots of these just lying around. It seems like this would be very tricky to construct, especially given the inherent fuzziness of a signature/fingerprint based on user behavior. Do zero-knowledge 'proofs of behavior' exist?

EDIT: That said, I do think this is a cute idea.

<comment><AUTHOR> I knew someone will catch that. I was a bit sloppy on that sentence :) I will have to improve it.

1- We only need secure multi-party computation algorithm if we cannot trust the server. In cases that server can be trusted with behavioral fingerprints then we can use server to to do the comparison.

2- One can assume that in some cases the server should not know about the behavioral fingerprint. For example in case that this procedure is implemented as a service, it might not be proper to send client side mouse movement and key presses to the server. Still server can be trusted as a mediator but should not know anything more than fingerprints being almost equal. You are right that behavioral finger prints like mouse movement are fuzzy. Specially since agent and browser are running on two different threads they get different time stamps for each mouse location. In this case you have to introduce some acceptance for fuzziness as you mentioned. Some statistical comparison. This is not as easy as checking equality securely (like Socialist millionaires problem) but you can in theory turn any circuit and make it secure so that the circuit will only expose fuzzy equality and nothing more about the data. See secure multi party computation: [https://en.wikipedia.org/wiki/Secure_multi- party_computation](https://en.wikipedia.org/wiki/Secure_multi- party_computation)

But your concern is valid since in practice the computation involved to do secure multi party computation in this case might be demanding for a browser. I have yet to verify that in practice. Keep in mind that our case is a bit more relaxed than general secure multi party computation problem since we have a server that can be trusted a little bit. Maybe that can help us a bit in devising a secure computation scheme. Any volunteers to work on that? :)

<comment><USER11> Actually the secure comparison protocol is the easy part - even generic SMC techniques are getting really fast these days. Also, they only involve about as much heavyweight crypto as a few TLS handshakes. Extracting a per-user fuzzy fingerprint from mouse and keyboard movements with enough entropy to make brute-force infeasible might be harder.

</comment></comment></comment><comment><USER12> We released a passwordless auth library for iOS about 2 weeks ago. At first glance, it looks much simpler than the process described on this website. We also take advantage of Secure Enclave key storage rather than leave the authenticator somewhere that malware can steal.

[https://blog.trailofbits.com/2016/06/28/start-using-the- secu...](https://blog.trailofbits.com/2016/06/28/start-using-the-secure- enclave-crypto-api/)

[https://github.com/tidas](https://github.com/tidas)

</comment><comment><USER13> Reminds me of the Biometric Open Standard.

Link to draft: official one is behind paywall [https://www.oasis- open.org/committees/download.php/56664/P24...](https://www.oasis- open.org/committees/download.php/56664/P2410d11.pdf)

<comment><USER14> > Open Standard

> behind paywall

</comment></comment><comment><USER15> Everything looks great, except for bluetooth. Can't we use internet instead.?

<comment><USER16> Something like this [https://m.youtube.com/watch?feature=youtu.be&v=YRL0u61dLnM](https://m.youtube.com/watch?feature=youtu.be&v=YRL0u61dLnM)

<comment><USER17> This is what I use when logging in to the state run bookmaker/lottery company in Norway. Works great. I just type in my SSN and I will get a notification on my iPhone. The solution is delivered by Buypass[0].

[0] [https://www.buypass.com/?_ga=1.237154944.1017563517.14669318...](https://www.buypass.com/?_ga=1.237154944.1017563517.1466931834)

<comment><USER18> My bank, Skandiabanken,sends an ordinary SMS message so it works with any mobile phone including dumb phones. To compromise it someone would have to know my personnummer and steal my mobile. Skandiabanken also gives me a scratch card one time pad so that I can log in without the mobile, the web page asks for the n-th number from the card.

</comment></comment></comment></comment><comment><USER19> NFC would mitigate the "close enough to trigger" attacker</comment>


Live upgrading Ubuntu to Debian  - <AUTHOR> http://virtually-a-machine.blogspot.com/2010/09/live-migrating-ubuntu-to-debian-howto.html

<comment><USER2> > Prerequisites:

> \- about 6 hours, excluding download time

Why bother with an in-place upgrade? It should only take a couple of hours to simply blow away the system, install debian from scratch, and then restore config/data/$HOME from a backup.

Having done stuff like this in the past, I can say that it's an interesting science project, but you generally end up with a Frankenstein's-monster sort of system with "interesting quirks" that are always lurking to bite you later.

<comment><USER3> depending how big your backup is, can take a while (copying to or from a 2TB disk takes a long time). With that said, probably easier overall as dont have to babysit it at all.</comment></comment>


Missing Structure in Technical Discussions - <AUTHOR> http://kvark.github.io/tech/arguments/2020/06/30/technical-discussions.html <comment><USER2> For sake of completeness, this field has been processed both by theory and and practical applications before. Formerly, those system were known as Issue- Based Information Systems (IBIS).

The wikipedia article gives some background and references to (mostly abandoned) tools.

[https://en.wikipedia.org/wiki/Issue- based_information_system](https://en.wikipedia.org/wiki/Issue- based_information_system)

<comment><USER3> Now there's a name I've not heard in a long time. As an early career developer poring over Usenet in the late 80's, I thought IBIS would be The Answer to working out requirements in a large team.

</comment></comment><comment><USER4> Ah, I had forgotten that [https://en.arguman.org/](https://en.arguman.org/) even existed, until reading this.

This dates back to 2014 where Turkey was still struggling with the aftermath of widespread civil unrest. The entire nation found itself highly polarized while debates were fueled with mutual anger and disbelief.

This is an "argument analysis platform", as they call it, and it is open source, too, maintained at [https://github.com/arguman/arguman.org](https://github.com/arguman/arguman.org) .

The basic premise is the construction of an argument map, "arguably" a common utility to practice critical thinking.

More info on that at [https://en.wikipedia.org/wiki/Argument_map](https://en.wikipedia.org/wiki/Argument_map) .

<comment><USER5> Arguman is indeed an interesting platform, but I also feel like it is almost impossible to reach any sort of conclusion on it.

For example, [https://en.arguman.org/there-is-no-such-thing-as-global- warm...](https://en.arguman.org/there-is-no-such-thing-as-global-warming). Every argument, good or bad, falls under some sort of fallacy.

<comment><USER6> Arguman's fallacy system is really an anti-feature. It's impossible to separate the claim that a specific argument is a fallacy from a counter- argument. Many people seem to think that you can just take a word describing a kind of a argument, attach "fallacy" to it, and you have refuted it.

<comment><USER4> Ah, I guess I was wrong earlier when saying that this was not a problem with the tool.

Merely allowing fallacies seemingly has an adverse affect on the whole promise.

Thanks for this clarification.

</comment></comment></comment></comment><comment><USER7> This is not limited to software development. Try being involved in Wikipedia and you'll eventually have the displeasure of experiencing the same lack of structure and rigor in arguments. (I'll say, though, that the author mentions GitHub, which does seem particularly bad in comparison to the average Bugzilla instance, say, 10+ years ago, and it's part of why I avoid GitHub, purely for my own sanity and productivity.) It's these experiences that make you appreciate the role of a judge if you've ever sat in court or read through trial transcripts.

What we're all really aching for is a solution to the ratiocination problem. pron put together a nice overview of some of the history of thought in that area a couple years back[1]. There's also the Toulmin model[2].

1\. [https://pron.github.io/computation-logic- algebra](https://pron.github.io/computation-logic-algebra)

2\. [https://en.wikipedia.org/wiki/Stephen_Toulmin#The_Toulmin_Mo...](https://en.wikipedia.org/wiki/Stephen_Toulmin#The_Toulmin_Model_of_Argument)

</comment><comment><USER8> This is fascinating and a very cool concept to be able to clearly respond to specific points in a technical discussion. I agree that sometimes these discussions are hard to follow and sometimes get derailed by minor quibbles. I'm plenty responsible for starting to debate about minutiae in a meeting when it really doesn't advance the conversation meaningfully. (That's more of a synchronous issue, this works at improving asynchronous communication, if I understand it correctly).

One thing that isn't immediately clear to me is how to associate specific individuals to a comment. Sometimes knowing who made an argument is very important. I like to believe that people are a little more careful about forming their reasoning when they are debating with the author or maintainer of a project, for example.

<comment><USER9> Perhaps, not knowing the author of a point is a feature? I'm often engaged in discussions where the authorship hurts more than it helps. Ideas are being referred to as "John's idea", conflating objective ideas with subjective positions. I recall explicitly asking WebGPU group to not consider an idea to be "mine" but rather just discuss it objectively for what it is.

<comment><USER10> Also, I regularly play the advocatus diaboli to ensure we are thinking through a particular position. Not necessarily because I believe it, but because if we can address the relevant concerns we'll have a more robust system. But having the position opposite of your own, be labeled yours, since you happened to bring it up, can be pretty annoying.

</comment></comment></comment><comment><USER11> Combine `argdown` with something similar to `roam research` and you have the makings of a 21st century platform for knowledge production.

When we have conversations in person, there is a natural Clarify -> Challenge -> Refine loop that hopefully ends in some resolution. One of the major issues with long run, asynchronous, online platforms is that they don't enable newcomers to easily contribute novel thoughts to that cycle. As an outsider viewing discussion around async rust that occurred on here and on reddit, by far the most common reply was "not a new thought- already discussed HERE".

But as OP pointed out, those HERE links were hundreds of posts you'd have to read through and reconstruct the clarify -> challenge loop in your head before figuring out whether your question had been addressed.

<comment><USER7> Yesterday in my mad dash to slurp down whatever good stuff I can find in the ACM library while the window is still open, I ran across a paper about using hypertext for "Representing the structure of a legal argument" (haven't been able to give it any real attention yet, though, since the candle is still burning down).

[https://doi.org/10.1145/74014.74031](https://doi.org/10.1145/74014.74031)

<comment><USER12> (Or you could just use Sci-Hub for ACM papers like everyone else.)

</comment></comment></comment><comment><USER13> I would love to see some more rich voting options than just up and down.

Allowing users to vote using tags like "Great Summary", "I agree", "I disagree but strong argument", "Sources check out", etc could really help users filter. People often upvote/downvote based on agreement rather than the quality of the content.

<comment><USER14> Slashdot from the Web 1.0 era had something sort of like this, as well as a sortition process for moderating moderators.

</comment></comment><comment> swagasaurus-rex Still a work in progress which is why I haven't posted it to Show HN, but I have been building this for about a year now:

[https://viz.chat/](https://viz.chat/)

<comment><USER15> Looks very cool, is it open source?

</comment></comment><comment> awinter-py links to kialo & argdown in here are incredibly useful

I could see more rigid logic formats than just 'tree' (and am indeed working on this) but the goals here are right

both for ease of reading and truth-seeking

</comment><comment><USER16> But this still relies on _someone_ to curate, no?

If you have an in-progress discussion that's still finding its way, that's not going to happen. And the curators may or may not have their own agenda.

Perhaps technical discussions are just messy because the problems are messy and don't have obvious solutions.

In the context of Rust, the bigger problem, IMO, is that things that aren't Mozilla/Firefox driven don't get driven to conclusion/completion. The discussion simply peters out with no resolution and then remains open indefinitely (look at how many issues from Rust 1.0 are still open with no conclusion, discussion or resolution.)

<comment><USER17> I'm curious, what kinds of things do you see that are being prioritized for Firefox or Mozilla over things the community wants? I can't think of anything, but I am also extremely biased.

> (look at how many issues from Rust 1.0 are still open with no conclusion, > discussion or resolution.)

Issues for the project are prioritized based on need and ability to complete them, not age.

<comment><USER16> > I'm curious, what kinds of things do you see that are being prioritized for > Firefox or Mozilla over things the community wants?

It's not about prioritizing over--aka "Mozilla wants X and community wants Y and those are in conflict." I don't think I've seen that even though it probably has happened at some point.

It's more about "Mozilla wants X and allocates resources so that goes to completion while community wants Y and languishes because maybe one or two people are actually qualified to work on it and they have full-time jobs."

> Issues for the project are prioritized based on need and ability to complete > them, not age.

Quite a few of the Rust 2019 announced objectives saw very little progress, and yet people wanted to move onto new objectives in 2020. Erm. Why did those 2019 objectives see so little progress when they were important? Why are they now unimportant in 2020? Apparently _Mozilla_ didn't seem to think those objectives were too important as they didn't seem to allocate resources to attack most of them.

However, this isn't a new problem. For example, you transferred a bunch of issues for the 1.0 timeline. Some of them were transferred into things like "This should be a library". Okay.

Someone later wrote that library. It has become a de facto crate solution and people use it. Yet that RFC/Library issue still stands open. The library author may not even be aware that such an RFC/Library issue exists. Whose job is it to close that issue and anoint that library/crate as "The One(tm)"?

Some of these issues have been untouched for 4+ years. No one is fooled that these are "in progress". They're dead and closed even if Github still marks them green. They might as well be closed out anyway as the language is so different from that milestone that many of them aren't even relevant anymore.

None of this is new nor specific to Rust. However, Rust is getting hit with it a bit more strongly because it's in a growing-phase where there is far too much work to do and far too few hands to do it.

(Funny you should pipe up. I'm sorry, I am _certain_ I filed a Github issue on a Rust library issue asking for one such library to get a pronouncement from you, but the issue seems to have simply disappeared down the memory hole. It is a little unnerving that Github can just wipe out something I filed without reference or history.)

<comment><USER17> Thanks, this is helpful. I still disagree with a lot of the characterization here, but it's much more reasonable than what I thought you were saying, and regardless of my opinion on your opinion, I'll try to think about why things may appear that way.

<comment><USER16> Thanks for giving me the slack. This probably sounds harsher than I intend. Putting negative information into text almost always comes off worse than the speaker intended.

"Timeliness in process" is _extremely_ difficult. Python does better than most, but even they have issues with RFCs that never achieve consensus. Also, one of the Python koans is "The standard library is where modules go to die" so Rust pushing things out of stdlib has some advantages (as well as disadvantages).

Part of this is also probably personal frustration on my part. I'm apparently using Rust in a lot of ways that are "off the happy path" and I bump into "Here Be Dragons" sections of the Rust landscape quite a lot.

</comment></comment></comment></comment></comment><comment><USER18> I think a system that supported refactoring arguments would be interesting and useful. Like, turn the tree into a DAG, sort of.

</comment><comment><USER19> I find the HN structure very effective in following discussions and it is really the same structure that the author creates, just spread vertically instead of horizontally.

Has anyone used this for their company internal discussions? I'm keen on giving it a try. I've even grabbed the last published HN source code to give this a try.

</comment><comment><USER6> Surprised that 4chan isn't mentioned here. IMO the linear structure combined with references gives you the best of both worlds. You can follow the discussion linearly, but also jump around to check references.

<comment><USER20> Discourse has this too. The author mentions discounting this due to the primary focus on linear discussion.

</comment></comment><comment><USER21> Is there an RFC for structured summary comments?</comment>


BeagleBone Black Wireless - <AUTHOR> https://beagleboard.org/blog/2016-09-26-meet-beaglebone-black-wireless/ <comment><USER2> The link at the bottom goes to [https://beagleboard.org/wireless](https://beagleboard.org/wireless) which isn't working for me, but [https://beagleboard.org/black- wireless](https://beagleboard.org/black-wireless) works. Mouser lists the price as $68.75 and element14 as $99.25; neither has any stock yet.

There are hardware design source files on [https://github.com/beagleboard/beaglebone-black- wireless](https://github.com/beagleboard/beaglebone-black-wireless), including a PDF schematic: [https://github.com/beagleboard/beaglebone-black- wireless/raw...](https://github.com/beagleboard/beaglebone-black- wireless/raw/master/BeagleBone_Black_Wireless_SCH.pdf) which features a Texas Instruments WL1835MODGBMOCT WiFi/Bluetooth module: [https://store.ti.com/WL1835MODGBMOCT.aspx](https://store.ti.com/WL1835MODGBMOCT.aspx)

<comment><USER3> The board SoC quality is very good. However, it can not compete with e.g. the CHIP SoC board [1], which costs just 9 USD + shipping with similar specs (I have two CHIP running 24/7 without any additional cooling, running rock solid -even in summer, at 35-40º C indoor-).

The only thing that would make me consider buying the BeagleBone Black Wireless is the two built-in microcontrollers ("PRU" processors [2]), for real-time I/O usage.

[1] [https://getchip.com/](https://getchip.com/)

[2] [http://beagleboard.org/pru](http://beagleboard.org/pru)

P.S. I'm not related to CHIP product, just a happy user :-)

<comment><USER4> Unfortunately even though I 'bought' a CHIP some 6 months ago I have yet to actually receive it. It's very easy to source a BBB. Hopefully in the future thy become more available. Though I fear that will come with an increase in price.

<comment><USER5> I think their fulfillment process has been hit-or-miss. I ordered a CHIP in December 2015, received it in January 2016. However, my VGA adapter didn't arrive until late June. Part of the problem is their confusing order process; peripherals like the VGA adapter were being advertised as shipping in February/March, which was when I expected mine, but when I inquired about it via email I was told they had not even started physically building them yet, and I'd get mine "some time this year".

Still, for $20 total outlay I have something that is between the Raspberry Pi B+ and 2 in performance, with arguably better expansion (if you value GPIO over USB), and a few nice extras like a power/reset button and built in support for LiPo batteries. The downside is that it's based on an Allwinner chip, and that company is known for being open-source hostile. Supposedly they are trying to improve, but it does limit the range of operating systems available for the device.

</comment></comment></comment></comment><comment><USER6> See also "A BeagleBone on a Chip" for discussion about the Octavo Systems OSD3358 system-in-package used on this board: [https://news.ycombinator.com/item?id=11697719](https://news.ycombinator.com/item?id=11697719)

</comment><comment><USER7> Used beaglebone since it's out years ago, it's a great piece of hardware and kind of kicked off the open-source-software plus open source 32-bit-CPU DIY hardware movement before everybody else.

Then clone was up everywhere, from RPI to Intel to many small shops in China etc, even Arduino started to add 32-bit CPU boards, price has remained to be low so far.

The only concern is that TI is not as active as before on its ARM-chip business, otherwise Beaglebones could have dominated the market instead of RPI series.

<comment><USER8> Didn't anyone else out there have a PandaBoard?

And TI was probably smart to exit OMAP for phones/tablets when they did. It's too hard to beat Apple/Samsung/Qualcomm in this space now.

(The Sitara/AM335x on Beagle is just an OMAP without the video DSP)

<comment><USER9> There were a not-insignificant number of companies who tried setting up build servers &c on PandaBoard & found the units failed fairly quick under any kind of sustained use. AFAIK BBB, although more limited, best I know remained reliable.

</comment></comment></comment><comment><USER10> Interesting that Texas Instruments Raspberry (you know, TI is to BeagleBoard as Broadcom is to RPi) would use a 3rd party SoC. I guess it still uses a AM335x internally so it's a tossup for them.

Would have wished they had updated the AM335x to one of the beefier Sitaras, they are falling somewhat behind if only in clock rate.

<comment><USER11> it's not really a new SoC ... it's an AM335x die (the real SoC) packaged along with dram, the TI power controller chip along with all the decoupling caps ... what this means is that you can get away with a 4-layer board with components on just one side for a lot of applications and build it at home in a reflow oven

</comment></comment><comment><USER12> See also the BeagleBone Green Wireless: [https://beagleboard.org/green- wireless](https://beagleboard.org/green-wireless)

</comment><comment><USER13> The BeagleBone was great when it first came out. Then the Raspberry Pi came out, and has a bigger community, higher performance, and lower price. Compared to the RPi 3, the BBBW seems like ... too little, too late?

<comment><USER14> Does RPi have PRU co-processors?

<comment><USER4> No, you can't for example control RGBW one-wire LED strings with a Raspi. On the BBB thanks to the PRU you can do so with 0% CPU load.

</comment></comment></comment><comment><USER15> OT, sort of, but a while back I saw one of these... "Pi-like" boards that had two Ethernet ports. It also had significantly more horsepower.

I'm wondering what might be recommended choices at this point for someone looking for an inexpensive, wired MITM / Firewall platform.

P.S. It would be great if it also had decent on-board wireless for e.g. making a portable hardware firewall device.

<comment><USER16> seriously? (seriously seriously)? It depends on if you're okay with the chinese having a backdoor, at the firmware level. (to the tune of '//gotroot!!' in the source code, and dropping to root.)

if you're okay with it, you have a LOT more options than if you aren't. perhaps if we start having dedicated routers and networks for the backdoored insecure stuff they'll start realizing that at the end of the day they're being pretty fucking obvious.

no comment on other governments stuff. if they're there, at least they aren't obvious.

<comment><USER17> I upvoted you in spite of your tone, because your statements are not undue.

The AllWinner stuff is concerning because they weren't exactly transparent about things.

However, the Octavo stuff looks like your bog-standard chips from BeagleBone/TI just all smashed onto the same substrate. You could decap the module and see if that's true.

<comment><USER16> I don't know if the threading makes it less than obvious, but I was simply answering this question:

>OT, sort of, but a while back I saw one of these... "Pi-like" boards that had two Ethernet ports. It also had significantly more horsepower. I'm wondering what might be recommended choices at this point for someone looking for an inexpensive, wired MITM / Firewall platform.

There are a lot of very interesting, very cheap boards!

</comment></comment></comment></comment><comment><USER18> How is the software support for BeagleBone boards? Can I expect to get automatic kernel updates with security patches?

Traditionally a problem with many boards is that you have to choose between running a distro kernel with incomplete hardware support but timely security updates, and running a board specific kernel that can't be safely exposed to internet-connected environment.

<comment><USER19> I had a student try to do an independent study research project using the BBB a couple of years ago. The experience wasn't good. We had a lot of trouble getting the thing to run with anything except the one kernel version that it came with. Porting over features from kernel modules done on earlier minor versions was a huge pain and not at all straightforward.

<comment><USER20> This has definitely changed. I'm using the current mainline kernel and it includes proper configs for the BBB. Works pretty much hassle-free.

<comment><USER21> Yeah this changed a lot in the last 12 months.

Problem was to support capes (addon boards) especially dynamically and at runtime wasn't really supported in mainline. They had special cape manager patches to do it but it wasn't a good solution for upstream.

3 years later or so we finally have good overlay support for this in a mainline happy and now merged way. They paid to have this work done which is great, though sadly took a long time.

I forget the guys name that did it but he is clearly a champion of patience.

</comment></comment></comment></comment><comment><USER22> This is the perfect example of true Open Source Hardware. None of the other boards similarly spec'd development boards have been spinned into so many variants. Not to mention real world consumer products that are based off the Beaglebone Black schematic.

</comment><comment><USER23> As a side note, "DDR3 8Gb 512M*16 1600 MHZ" is now on DRAMeXchange (you have to login to see it). It is hovering around five dollars per chip. I think the BeagleBone Black is one of the embedded systems where it is commonly used.

</comment><comment><USER24> I can't find any info on whether or not the WiFi driver is open source. Anyone know?

<comment><USER25> This? same family atleast: [https://github.com/torvalds/linux/tree/master/drivers/net/wi...](https://github.com/torvalds/linux/tree/master/drivers/net/wireless/ti/wl18xx)

</comment></comment><comment><USER26> What's unclear is how the BeagleBone Black Wireless compares to the SeeedStudio BeagleBone Green Wireless: [https://beagleboard.org/blog/2016-07-07-seeedstudio- beaglebo...](https://beagleboard.org/blog/2016-07-07-seeedstudio-beaglebone- green-wireless/)

It looks like the Green wireless has more USB ports, but aside from that, I'm not sure why you'd choose the BBB Wireless vs BBG Wireless?

<comment><USER27> Probably the HDMI port.

</comment></comment><comment><USER28> anyone know of any good resources, tutorials, books, etc. for putting the PRUs to good use? those seem to be the defining feature that separates the BBB from the other SBCs.

<comment><USER29> I can recommend "Exploring BeagleBone" by Derek Malloy which offers a very gentle introduction to the PRU with some mildly advanced examples. Also, a shameless plug with more PRU code examples in case you are interested to use Rust rather than C for the glue code: [https://github.com/sbarral/prusst](https://github.com/sbarral/prusst)

</comment></comment><comment><USER30> I've been running a tor relay on the original beaglebone black for a couple years now and have been very satisfied. Would have LOVED the wifi model back then.

<comment><USER31> Honestly, with it supporting only 2.4 ghz, its uses are limited.

<comment><USER4> What's wrong with 2.4Ghz?

<comment><USER32> 5GHz performance is vastly better in urban areas. There are 26 networks visible from my apartment (in a small 2-story apartment building), and the 2.4GHz WiFi spectrum effectively has only 3 channels (due to substantial overlap, only channels 1, 6, and 11 are normally used). So you're sharing a _lot_ of bandwidth with your neighbors. 5GHz has much better spacing (so less interference) and more total bandwidth.

<comment><USER33> 5GHz also attenuates significantly through walls, so even if your neighbour is on the same channel you won't be getting as much interference.

</comment></comment></comment></comment></comment><comment><USER34> I like to see this stuff (seems like they should have had this earlier) but to me the real market shifting is less about performance and much more about preformance/watt and unit pricing. If you can push the boundaries on those two areas and still make it easy to hack then I think you have something that could push innovation to a new level. Still it is great to see this!

</comment><comment><USER35> In case you need a library for BeagleBone, I have forked bonescript and written a better one: [https://github.com/theoctal/octalbonescript](https://github.com/theoctal/octalbonescript)

</comment><comment><USER36> I would have absolutely loved this if it were 5 GHz wifi. 2.4 GHz wifi in my apartment is practically useless, with ~40 visible APs from my laptop.

Are dual 5/2 GHz chips that much more expensive?

</comment><comment><USER37> Why not both wifi and ethernet ?

</comment><comment><USER38> How many cores does the CPU have? I can't really figure it out from the stats.

</comment><comment><USER39> While it's awesome, where is Beaglebone Blue?

</comment><comment><USER40> No FPGA onboard? (Stifles yawn)

</comment><comment><USER41> does it now support 1080p ?</comment>


Introduction to Group Theory - <AUTHOR> http://members.tripod.com/~dogschool/

<comment><USER2> I wish I had read this before I started studying abstract algebra. Sure it's incomplete and lacking in details but what a nice introduction.

</comment><comment><USER3> mostly correct but very much incomplete. No discussion of the dihedral groups, hamiltonian groups, stabilizers, kernels, group actions, etc...

The rubics cube solution at the end is interesting though.</comment>


ASUS to provide a bootloader unlocking mechanism for Transformer Prime - <AUTHOR> http://www.slashgear.com/asus-transformer-prime-ics-due-jan-12-plus-warranty-killing-bootloader-unlock-03205655/

<comment><USER2> Conversation on it here as well: <http://news.ycombinator.com/item?id=3420358></comment>


Mark Zuckerberg: We want to get 1B people in virtual reality - <AUTHOR> https://venturebeat.com/2017/10/11/mark-zuckerberg-we-want-to-get-1-billion-people-in-virtual-reality/ <comment><USER2> I think it's a mistake. AR makes more sense.

[https://www.wareable.com/vr/virtual-reality-vs-augmented- rea...](https://www.wareable.com/vr/virtual-reality-vs-augmented-reality- which-is-the-future)

Quote: 'Tim Cook called it a "core technology," saying that he expects it to be a big technology, bigger than VR, in the future. "Virtual reality sort of encloses and immerses the person into an experience that can be really cool," Cook said, "but probably has a lower commercial interest over time. Less people will be interested in that."'

</comment><comment><AUTHOR> The question I ask myself: Is there enough trust left? Just when reading this goal, I experience a high level of aversion against Facebook wanting to be the company doing that. Maybe this sentiment blows over, or it is only me (and presumably some others in the HN community). But somehow I actually do hope that more people will be critical of anything Facebook does from here on. In the end, Zuckerberg, as smart as he is, still is as clueless as anyone else about the impact anything he does has on society, as well as about unintended consequences. Previously I kinda gave him the benefit of the doubt ("Maybe he really knows what he is doing"). Now I am not sure anymore.

</comment><comment><USER3> [https://i.imgur.com/uCHKebT.jpg](https://i.imgur.com/uCHKebT.jpg)</comment>


Myth Debugging: Is the Wii More Demanding to Emulate Than the GameCube? - <AUTHOR> https://dolphin-emu.org/blog/2018/07/21/myth-debugging-wii-more-demanding-emulate-gamecube/ <comment><USER2> I really find articles like this fascinating, and have a great respect for the pure engineering effort that goes into emulating these other devices.

Having been a web dev for 10 years and now Deep Learning / ML, I've never even dabbled in emulators or even read their code, and I find it inspiring that there's entire fields of programming that I know little about and can explore later.

Our field is truly amazing!

<comment><USER3> > Having been a web dev for 10 years and now Deep Learning / ML

As a 15-year web dev- was that transition a natural one? Relatively easy? Profitable?

<comment><USER4> Finding a job or project that involves both web dev and another discipline and slowly sliding into the other discipline is a good way to transition, especially if you are older or with less free time.

I was able to transition from web dev to aerospace software while taking care of a family.

</comment></comment></comment><comment><USER5> > Wii games don't have to do any of this - they have full access to the 64MB > of MEM2. This means that Dolphin doesn't have to worry about MMU emulation > in general. As with any great rule, there are some exceptions, such as games > that are purposefully trying to break Dolphin. Those games will be covered > in another article as they seem to particular target Dolphin's weaknesses > and thus some of their behaviors doesn't actually make sense for the source > hardware.

Boy I want to read that article

<comment><USER6> Where these games actually developed with this purpose? Did doplhin existed back during the game's dev cycle and the developers say "we don't want our game on the dolphin emulator"? Or it just happens that they use an approach that is problematic to begin with?

<comment><USER7> Since Dolphin emulates two generations of console, it definitely was around and well-known for the development cycle of later games. The first version of Dolphin was released in 2003, and the Wii was released in 2006.

</comment></comment></comment><comment><USER8> I'm a simple man, I see a new dolphin-emu.org article, I click it, read it, am fascinated by it and feel slightly smarter afterwards.

</comment><comment><USER9> I would have thought that the GameCube would be the last Nintendo console to use a fixed-function GPU. I was very surprised to see that the Wii used one as well.

<comment><USER10> Not only were they both fixed function; they were in some very real ways the same GPU. Like bug for bug compatible. Like in a lot of the official Nintendo docs, they didn't even bother to sed s/Dolphin/Revolution.

Honestly a Wii really is an upclocked GC with a coprocessor stapled on the side handling new (and a lot of old) I/O.

</comment></comment><comment><USER11> Can we please fix the weird caps in the title? I spent way too much time wondering what a 'Wii More' was.

</comment><comment><USER12> Great read. I wish I had the time to mess with this sort of stuff as a hobby.

</comment><comment><USER13> I wonder why so many exclamations in the article. It's like they want to emphasize too! many! phrases!, a lot of them not really merited!

I guess it's just a byproduct of too much WhatsApp / IM in general, which introduces bad practices for long form writing, and also a lack of editing review.

That's a minor, minuscule annoyance in an otherwise very interesting article :)</comment>


Chrome browser URLs - <AUTHOR>

Works only in chromium browsers: chrome://chrome-urls/
This part is interesting:
For Debug
The following pages are for debugging purposes only. Because they crash or hang the renderer, they're not linked directly; you can type them into the address bar if you need them.
chrome://crash
chrome://kill
chrome://hang
chrome://shorthang
chrome://gpuclean
chrome://gpucrash
chrome://gpuhang
chrome://ppapiflashcrash
chrome://ppapiflashhang
chrome://quit/
chrome://restart/ <comment><USER2> This one's pretty interesting too. chrome://gpu

Gives information about how the GPU is put to use on Chrome. Didn't know it was. Also a performance rating.

Performance Information Graphics7.2 Gaming 7.2 Overall 5.9

<comment><AUTHOR> Yes, you are right. This is pretty neat. I also like that, if there is a problem, it shows a link to the issues. For my windows machine it says:

* Texture Sharing: Unavailable. Hardware acceleration unavailable

Problems Detected

* Texture sharing should be disabled on all Windows machines: 304369[0], 315215[1]

[0] [https://code.google.com/p/chromium/issues/detail?id=304369](https://code.google.com/p/chromium/issues/detail?id=304369)

[1] [https://code.google.com/p/chromium/issues/detail?id=315215](https://code.google.com/p/chromium/issues/detail?id=315215)

</comment></comment><comment><USER3> You can find all the chrome URLs here : chrome://chrome-urls/</comment>


Ancient life, millions of years old and barely alive, found beneath ocean floor - <AUTHOR> http://www.washingtonpost.com/national/health-science/ancient-life-millions-of-years-old-and-barely-alive-found-beneath-ocean-floor/2012/05/17/gIQA3zIRWU_story.html <comment><USER2> From a shrewd entrepreneurial point of view, these critters must have all kinds of interesting enzymes and hardware that allow them to operate at such low metabolic rates.

Dissecting their repair mechanisms might give us insights into regenerative medicine in the near future, and technical knowledge for suspended animation for long distance transport or generation jumping in the not-so-near future.

<comment><USER3> Studying organisms like these would certainly teach us a lot about cellular maintenance and extremely slow patterns of gene regulation.

Relatedly, note that storing information in DNA is the longest lived form of information storage. Harddrives tend to deteriorate in ~10 years or so. Flash Memory has a similar life time. Books can last hundreds to thousands of years, but no more, and stones and rocks and fossils, perhaps a few hundreds of millions of years. But genetic information can be maintained for billions of years--it is a discrete information encoding, is easily copyable, and has noise tolerance and error correction. Not very useful (yet!) to store information and data, but very interesting to think about conceptually: humans have been reconstructing in metal and silicon what nature developed billions of years ago. Sort of cool to think about.

</comment></comment><comment><USER4> "Their strategy for staying alive is to be barely alive at all."

And yet some creatures are believed to be immortal while being "very alive". <http://en.wikipedia.org/wiki/Biological_immortality>

</comment><comment><USER5> Why is the post by easy dead? It looks fine to me....

<comment><USER6> Good question. Is a relatively young (45 days) account with low karma (17) enough to auto-kill posts? None of easy's submissions or comments seem out of line to me. I'm quoting the post here because Rachel Sussman's TED talk on species longevity is spectacular.

 _If you found this interesting you might also enjoy a TED talk by Rachel Sussman entitled "The world's oldest living things":_

[http://www.ted.com/talks/lang/en/rachel_sussman_the_world_s_...](http://www.ted.com/talks/lang/en/rachel_sussman_the_world_s_oldest_living_things.html)

<comment><USER7> Maybe it's "too much too soon" from a new account? I think all the submissions I made so far came from technology review articles I've been reading so perhaps PGs code thinks I'm an account created to spam for a particular domain.

<comment> mkr-hn Probably a few people being overeager with the flag link.

<comment><USER5> That's my best guess. Worst part is, easy probably didn't even know it was dead

<comment><USER8> Why wouldn't easy have known? easy isn't hellbanned AFAIK.

<comment><USER7> As far as I can tell the status of a comment as being dead is not apparent to the user who posted it (unless they're not logged in obviously). This is actually quite an elegant way of dealing with trolls if you think about it; instead of knowing they've been banned and trying to game their way around it they assume they are just being ignored and give up.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> C'thulu?</comment>


Ask HN: What bank do you use for your startup/small business? - <AUTHOR>

To those in the USA:<p>I have been with bank of america for 4 years for my personal accounts and I need to get a business account setup for my small business since I just went from DBA to an LLC. What bank do you currently use, and do you have any suggestions as to which bank is the best for businesses? <comment><USER2> We use Chase - also got the $200 promotion for opening checking account. (google this promotion) No complaints yet! I've heard good reviews from ppl about many of the big banks, though. Choose something convenient for you.

</comment><comment><USER3> TD Bank. Hands down the best bank.

I set up my business account on a Sunday!

</comment><comment><USER4> Navy Federal Credit Union -- if you're eligible, they're amazingly good to their customers. The main draw for me initially was their extended work hours, but aside from that, all the general credit union benefits apply, and their online services are pretty complete.</comment>


Show HN: Nekøyume – Decentralized Fantasy Role-Playing Game - <AUTHOR> https://nekoyu.me/ <comment><USER2> How blockchain helps in decentralization here? Or is it just hype train riding?

<comment><AUTHOR> In this game, I didn't use any centralized server or Oracle to implement MMO game. Every player has every activity information using blockchain. It helps Nekoyume decentralized. If you want to get details, please see the white paper. [https://nekoyu.me/docs/white_paper.pdf](https://nekoyu.me/docs/white_paper.pdf)

<comment><USER2> > Every player has every activity information using blockchain. It helps > Nekoyume decentralized.

It helps _how exactly_? Why nothing else, like distributed hash table or gossip protocol, would work?

<comment><AUTHOR> I think that I don't need to educate what is blockchain. Could you give me another decentralized role-playing game which isn't using blockchain? If you can not, it is explained. Right? :)

<comment><USER2> No. You couldn't justify using expensive document timestamping system, so with the hype around blockchain I can assume that you don't know what you need it for and thus put it into use completely unnecessarily, just because it's hype now.

<comment><AUTHOR> Hey, I think you don't understand what blockchain is. This is the reason why you mentioned distributed hash table. :( Can you explain how can I make trusted mmo lifecycle database if the system requires anyone can participate the node? I think you can't solve. If you can, explain it.

I think that you are feeling good when you scoff something new. It's not productive communication.

<comment><USER2> > Hey, I think you don't understand what blockchain is. This is the reason why > you mentioned distributed hash table. :(

Oh, I understand blockchain quite well. Well enough to see when it's forced into the role of DHT or some other protocol/structure that by itself was cheap and efficient.

> Can you explain how can I make trusted mmo lifecycle database if the system > requires anyone can participate the node? I think you can't solve. If you > can, explain it.

With the vaguene requirements you have used here, just put a digital signature on the data and you're done.

As I said, you haven't described why you need _blockchain in particular_. You try to defend it by saying that _you_ don't see any other way to implement a distributed data store for your game, but it means nothing, especially with the numbers of people blinded by blockchain hype. If you used just about any other distributed protocol, I wouldn't even bat an eye, but with blockchain you don't get the benefit of the doubt.

> I think that you are feeling good when you scoff something new.

No, just when I scoff somebody who uses the wrong thing in the wrong way for the wrong reasons.

<comment><AUTHOR> > With the vaguene requirements you have used here, just put a digital > signature on the data and you're done.

Signatures ensure the integrity of the data, but more consensus is needed to ensure that the data is not deleted and is well maintained on the network. Your answer isn't enough to solve my problem. Although blockchain is not the only correct answer, blockchain is one of the solutions.

I don't say that blockchain is only and the best solution I think. If you think the better solution, let me know. scoffing isn't productive.

<comment><USER2> > Signatures ensure the integrity of the data, but more consensus is needed to > ensure that the data is not deleted and is well maintained on the network.

DHT (with data duplication, obviously), I said already. Or gossip protocol. You don't need consensus, and blockchain doesn't give you one either.

> Your answer isn't enough to solve my problem.

As you have stated the problem? Yes, it is enough.

Maybe there are some requirements that make a timestamping protocol necessary, but you haven't provided any. As I said previously, if you use blockchain, _you have to defend your choice_ , because most of the people who build on top of it don't understand it, use it in stupid ways, and just want something trendy for the sake of being trendy. You need to prove that you aren't one of them and that you are competent with it.

> Although blockchain is not the only correct answer, blockchain is one of the > solutions.

Very expensive solution, applied because you don't understand what it is and why and when would you need one (if you did, you'd explain the necessity for blockchain long time ago).

<comment><AUTHOR> So you are claiming expensive timestamping protocol, right? Yes, maybe I don't need to use proof of work. but my deterministic random consensus requires PoW for some reason. If you can suggest an alternative for that, I'm very happy for that. (The reason why I need to use proof of work is described in the white paper)

<comment><USER2> > [...] my deterministic random consensus [...]

Dude, learn some terminology first. Random is very much the opposite of deterministic. Otherwise you're just spouting garbage.

<comment><AUTHOR> Read white paper.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Deutsche Bank urges rival investment banks to go open source - <AUTHOR> http://www.ft.com/intl/cms/s/0/6ee1921c-f14f-11e1-a553-00144feabdc0.html#axzz268xKyfPt

<comment><USER2> Paywall. :-(</comment>


Ask HN: Employee disclosures and policies - <AUTHOR>

Not sure this fits within the typical HN topics. I'm hoping to get some intelligent insight while maintaining anonymity. It's hard to turn anywhere other than HN for that. I hope you don't mind.
I have a firm offer from a publicly traded, Fortune 100 company. A lot of my friends are surprised that I'm even considering, but my play is to learn about operations at a company of that size, then 2, 3 or 5 years from now jump out. I don't anticipate doing anything directly competitive, but I'm also being adamant about reviewing their employee handbook and policies to check for limiting factors. As I've said to a few people, I'm really interested in dating, but I'm not sure I'm ready to commit to them for a lifetime. I've been scared off by other friends who have made the mistake of not checking and inadvertently surrendering future opportunities.
The company recently replied that they're unable to release the policies and handbook due to proprietary and confidential concerns; only employees are authorized to receive a copy of it. They have offered to answer any specific questions, but I'm not convinced that will resolve my concern. If I don't ask a question precisely the right way, they're not obligated to infer my intent.
Am I getting cold feet or do I have a valid concern? If you're a founder, what are your policies? Do you release this information upon request, or would you become concerned about the candidate? Job seekers, do you ask questions about non compete, confidentiality, and other disclosures prior to accepting an offer? <comment><USER2> If it's a fortune 100 company, and you're in a sales, marketing, or R&D role, expect a very restricting (to the point of being unenforceable in many states) set of agreements that you will be required to sign. You can try the 'ol strike-through trick or just fail to sign them, forget, or whatever, but I wouldn't count on that working at all.

But seriously, you're going to work for a company for up to five years, which is an eternity by the way, and then, once you've gained knowledge about their business, perhaps start something that competes? This happens every day, and the language in the documents you sign will have litte bearing on your chances at success in this yet-to-be-materialized future venture.

[Edit, adding more]

Let's say you work for this company for a couple of years, and think of a way or a technology that can compete with them, and that you're savvy enough to raise money to build and sell it, or otherwise find yourself on the radar screen of your former employeer. This is a huge "if", but if you do, they may come after you.

Why not focus your energies on finding a way to help your employeer in a way that they can't help themselves and then implement a product or service and recruit your former employeer as your first customer? This is a much less confrontational way to go, and actually, you'll find it's easier than competing with them.

Talk to people who have done this -- they're everywhere. You'll likely meet them, as venders, in your new job. Learn how to do what they did.

<comment><AUTHOR> Thanks for the response. Does it seem strange that they're being bullish about letting me review these policies prior to accepting? They've sent me all the benefit information: vacation, medical and dental, stock, etc. I feel like this last piece of information is equally as important when evaluating the offer.

As an analogy, the company I previously worked for did application development. It was their policy to release all source as part of the project, but that did not imply that we would never engage on a similar project in the future. After we priced, scoped, built and deployed a project, a client came back to us and requested we sign a non-compete and decline to work on any projects related to it. We replied that we would have been happy to, but would have significantly impacted the cost of the original project (eg, what is the cost of future revenues that we'd have to miss). The conversation stopped there.

To rephrase my additional question, is it unusual to ask to review policies related to confidentiality, non compete, non disclosure, non solicitation and other employee covenants?

<comment><USER2> You're correct that the policies are an important piece of information, but where you're mistaken is thinking there's a chance in hell they will be favorable to you. You'll find this to be universally true among companies of this size.

If you have pre-existing IP, there will be a method to document it laid out in the policies. If you develop unrelated IP completely in your spare time and using your own resources while employed there, there _may_ be language in their policies that describe an avenue to lay claim to this IP.</comment></comment></comment>