Mozilla and Partners Prepare to Launch First Firefox OS Smartphones - <AUTHOR> https://blog.mozilla.org/press/2013/07/mozilla-and-partners-prepare-to-launch-first-firefox-os-smartphones/

<comment><USER2> I know that Mozilla aren't on the same realm of level of revenue as Apple or Google, and that they can't spend a fortune on marketing.

However, that must've been one of the least inspiring product demo videos I've ever watched. It does nothing on selling me on the virtues of the phone, just running through some extraordinarily anonymous features. I realise it's extremely affordable, but that hardware looks like it does almost nothing well. While I want to develop mobile apps, I don't particularly want to develop for this device, despite the HTML/CSS/JS support fitting neatly in my skillset.

The app store is probably the most curious thing, but that's hidden away and quickly glossed over.

If this starts reaching developing nations, with mobile internet etc, then I could see the benefit, and that's something that I'd love to engage with. At the moment it just seems like a weird brand exercise.

<comment><USER3> Firefox OS is one of the most obviously-wasteful and doomed efforts we've seen in a long time.

There is no compelling reason to use it, or for it to even exist. It offers no tangible benefits that we can't get elsewhere. What it does offer is pretty lousy.

The only two arguments we see used to support its existence are both badly flawed:

1) Devices running it are "affordable". Maybe this is true in some absolute sense, but relative to other mobile OSes and devices this "affordability" comes at a very steep cost in terms of usability and practicality.

Used Android and iOS devices can also be acquired quite cheaply these days (even in poorer nations), but unlike Firefox OS and its devices these used devices are comparatively powerful and much more practical to use.

2) It's "open". This argument is academic at best. We can already use HTML5, CSS, JavaScript and other so-called "open" technologies on Android, iOS, BlackBerry OS, and many other of the less-common mobile OSes. Android and some of the other mobile OSes are already open source software, so it's not like Firefox OS has any advantage in that sense, as well.

The whole reliance on JavaScript makes Firefox OS even less-open, in my opinion. When it comes to using Android or iOS, for instance, at least we have the option of using mature, non-JavaScript languages. No, I don't really consider CoffeeScript, TypeScript or Dart to be anything but JavaScript with a prettier syntax and/or slightly better type checking.

The effort put into Firefox OS would have been much better spent fixing desktop Firefox, or Firefox running on existing mobile devices. Even putting it toward Thunderbird would've been useful. But it has instead been wasted on an eighth-in-line mobile OS with limited capabilities and a severe lack of usability compared to its competitors.

<comment><USER4> This is one of the worst comments I've seen around here lately. It makes lots and lots of assumptions, doesn't back them up, and then jumps to stupid conclusions.

A platform being open is not merely academic. It makes future open source software exponentionally better just like it did in the past decades. In fact, if this gets mainstream it will be the first to be truly open. Android has an open source license, but Google has never been really open about it. [http://www.itwire.com/opinion-and-analysis/open- sauce/55247-...](http://www.itwire.com/opinion-and-analysis/open- sauce/55247-android-not-so-open-open-source)

And why does relying on a publicly specified language with vibrant ecosystem make the platform less open? You argued that by using proprietary languages? Though I completely agree JS needs to mature... a lot.

I trust Mozilla's vision that they're doing the right thing to move the web forward by putting efforts into desktop or mobile or whatever they find worthwhile.

<comment><USER5> There is a shocking amount of anti-hacker sentiment on this forum. There are so many people here that are desperate to make money out of the big new closed ecosystems that they are only too eager to badmouth open alternatives at every turn.

<comment><USER6> Some of it may be dissonance - people (especially in the open source community) have been proclaiming Android as open for so long that anything that challenges that idea must be denied.

<comment><USER7> Though there is no need for dissonance. Openness comes in degrees: Android is pretty open compared to IOS. Firefox OS seems more open than Android. The FSF would point out something like that the Firefox OS devices still use binary blob video drivers.

Without the basic hardware/software ecosystem that android has supported it isn't clear that Firefox OS could (so easily) exist. Modern smartphones have substantially reduced platform openeness and freedom compared to the desktops of old, but the ratchet doesn't only click one way.

<comment><USER6> No disagreement, however the dissonance is that those who have for so long championed Android, would now have to switch to criticizing it.

<comment><USER3> I'd gladly switch to Firefox OS if it were a superior mobile operating system. I'd gladly criticize Android if it couldn't compete with this hypothetical version of Firefox OS that's better. I'm sure many others here are in exactly the same boat.

But we can't do that, because Firefox OS is clearly inferior to Android in so many significant ways. Its performance appears to be a problem. Its functionality is quite limited. Its "openness" is overstated. It provides an awful environment for developers, in terms of language support, compared to other mobile OSes. Basically nobody is actually using it yet, so there's little incentive to target it. It appears comparatively hostile toward anyone wishing to merely recoup the cost of creating an app, never mind make a profit.

Until Firefox OS gets its act together, it will face criticism and negative comparisons with Android. I hope that people like you are capable of seeing what's truly behind this (that is, the inferiority of Firefox OS compared to Android), rather than misattributing it to "dissonance", or "shilling", or some other nonsensical reason like that.

<comment><USER6> If you read my other comments, I have made the similar criticisms - I.e. Firefox OS doesn't bring anything better to the table.

I'm not misattributing anything and putting words like 'shilling' into my mouth is cheap.

The fact that Android was hailed as open by the community clearly diminishes the impact of the major selling point of Firefox OS.

Even if Firefox OS was on par with Android in all aspects of performance, people would still have no reason to use it, and the argument 'because it's open' is no longer persuasive.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> All the previews I've read say that Firefox OS needs high-end hardware to deliver a responsive UI.

"Its unresponsive screen makes typing a laborious process requiring painstaking precision. Every action from swiping to tapping onscreen controls takes a beat until you see results, so using the phone for a prolonged period steals minutes of your time. Lag carries into the camera, which is slow to launch, snap, and reset."[1]

For $90, I would rather have a refurbished iPhone 3GS. A 3GS has 16GB of internal storage vs this phones 512MB and runs Apple's latest iOS 6. With native performance you get a silky smooth experience from the homescreen to apps even on budget hardware.

[1] [http://news.cnet.com/8301-1035_3-57591716-94/firefox-os- phon...](http://news.cnet.com/8301-1035_3-57591716-94/firefox-os-phone- launches-tuesday-in-spain-at-$3-a-month/)

<comment><USER9> _" For $90, I would rather have a refurbished iPhone 3GS."_

You might be surprised (as I was) but Windows 8 is the most responsive mobile OS I've ever seen. Maybe it's even the best mobile OS at the moment.

You can get a new Nokia Lumia 521 for about $150. A very underestimated phone.

<comment><USER10> I can safely say that Windows Phone is the nicest OS I've casually used. It's much more responsive than iOS and Android, and it just feels a lot nicer to use from day-to-day.

My main gripe with Windows Phone isn't the OS, but the phones themselves. They just don't look that nice, and they retain the old-fashioned "brick" feel of old Nokia phones.

I have a Galaxy Nexus now, but if Microsoft were to release their own Nexus- like range of phones that were both high-spec and looked great I'd happily switch.

<comment><USER11> No no no, don't complain about the brick-ness, Nokia may listen. I love being able to constantly drop my phone all over the place.

<comment><USER10> Are the new phones still as sturdy as they were before? I admit that I miss my old Nokia 3310 at times, and being able to throw it around anywhere without a single dent.

<comment><USER11> I've owned both the Nokia 710 and the new 521 and as an excessive phone- dropper have had no problems. I have also dropped both of these phones in water, picked them up, dried them off with a paper towel, and simply moved on with my day.

</comment></comment></comment></comment></comment></comment><comment><USER12> Releasing only low-budget hardware is probably not the best strategy to break into the existing market. That is, phones like these are doomed to be used by people who aren't even aware of what kind of OS the phone uses as long as it's labeled smartphone and comes with a cheap plan and a facebook app.

<comment><USER13> I don't know. It sounds like a good strategy to gain market-share in a post economic-crisis, recession-stricken Europe.

You wont get a generation of still-unemployed-at-30 spaniards to buy your €600 phone when they have trouble getting ends to meet. A €60 smart-phone however, that stands a chance.

<comment><USER14> Also the rest of the developing world, especially Africa, where Firefox OS looks like a very strong replacement for Blackberry and Nokia feature phones.

</comment></comment></comment><comment><USER15> Maybe this is me being delusional, but Geeksphone's models were running much more smoother than this (this being the Alcatel phone in the demo). I think the OS is fine and it'd work nicely on a good hardware, but it just needs time. It's gotta be hard to sell a phone that's cheap and has a good hardware. But I'm hopeful and rooting for Mozilla to pull this off.

</comment><comment><USER16> The war with Tizen only get started. Yet, it's funny how those two OS will end up being almost 100% compatible (at least for webapps), and so in the end, it won't really matter which one you'll be using. Maybe this will start a new trend of "web phones", and will push android towards becoming more of a "chrome os".

<comment><USER3> This "war" you speak of is between two mobile OSes making up literally a small fraction of one percent of all mobile users.

BlackBerry OS and Windows Phone, which are nearly irrelevant compared to Android and iOS, are absolutely huge compared to Firefox OS, Tizen, and the other mobile OSes.

Firefox OS and Tizen will have absolutely no impact on Android.

<comment><USER17> I think Chrome OS will have a big impact on Android, though. It seems like such a silly business model for Google to push web apps on their netbook platform but put forth Java first on mobile. I imagine Android 5 will probably have default-Chrome and at least put its app store next to play and try to push developers that way.

<comment><USER18> Google has enough cash to invest into both native and web platforms, and see which one (if any) prevails. At the end of the day, more platforms is access to more developers and the apps they make, which in turn is more incentive for end users to buy the devices, whatever OS they happen to run.

Mozilla is leveraging a large existing developer base and relying on the brand power and capabilities of Firefox that they have full control over. Their choice of market is interesting too, as it seems to be largely served by low- cost hardware stuck with outdated Android installs with no upgrade paths on the horizon. Meanwhile, Google is distancing itself from Android as a product and instead pushing own devices as "the" Android experience, leaving the low- cost hardware market with stale software.

These seem like thought-out strategic moves Mozilla is capable of pulling. It'll be interesting to see how things play out.

</comment></comment></comment></comment><comment><USER19> >customized phone experience based on your needs

Can you disable Javascript?

<comment><USER20> The whole UI is written in HTML+JS so that would be like bricking your phone I guess.

<comment><USER21> But it might get drastically colder :).

</comment></comment></comment><comment><USER22> I'm surprised by the early launch. I've been using a Geeksphone Peak as my primary phone for a couple of weeks and FirefoxOS is far from ready. There are bugs, missing features, apps that won't do basic things... Here I was thinking FirefoxOS needed an extra year of development and they're already launching devices!

</comment><comment><USER23> There's still room for an alt, "hacker" OS that's seen as not in the pocket of Google: a Linux of the smartphone world. Tizen, being Samsung's beast, doesn't quite fit that description. So between Firefox OS, Ubuntu Mobile, Sailfish OS, Open webOS, (any others?) I'm wondering which one will capture the hearts and minds of the hacker community, if not any relevant marketshare.

<comment><USER24> Cyanogenmod seems to be doing a pretty good job.

</comment></comment><comment><USER25> That demo video made my teeth hurt. Like going back in time to before the first iPhone was released.

<comment><USER12> I think the first iPhone did a better job in smooth scrolling.

</comment></comment><comment><USER26> I'm in the "You-get-what-you-pay-for" school.

Besides being the phone all others are compared against, iPhone is standardized to fit a variety of 3rd party components; lenses, camera mounts, car mounts, etc.

Dependability is another aspect that should not be neglected to save a few $. If it's something you depend upon every day, you don't want to be disappointed when it matters most.

I guess a free Firefox OS phone would be great for homeless or families too poor to afford a decent phone.

<comment><USER13> > I guess a free Firefox OS phone would be great for homeless or families too > poor to afford a decent phone.

Or people who value freedom over eyecandy. Or people with principles and ideals. And maybe even people who can see outside the San Francisco hipster smug.

People with long term visions, like the people who originally created the WWW had. We definitely need more people like that and we need the tech crowd to support them.

Your comment adds nothing of value.

<comment><USER6> Android is also free and is far more capable. What does Firefox OS bring to the table?

<comment><USER13> All Android apps (which most users see) are still closed apps, delivered through a closed app store, using propietary APIs.

Chances are that all the apps you have invested in and the data you have put into them will be lost if you migrate to another phone or eco-system.

Firefox OS, by ensuring that _everything_ is HTML-based and pretty much delivered as web-pages means that you can never have your data and apps locked in the same way you can on Android and iPhone.

Firefox OS delivers freedom in such complete form that no other platform can compete. Firefox OS is in fact so open that if you in the end get fed up with it (for whatever reason), you can still take all your apps, all your data and move on to whatever you want. You will lose nothing.

You have to admit that is something pretty unique.

<comment><USER27> "... you can still take all your apps, all your data and move on to whatever you want ..."

Well, in theory :-)

1) Only to other Firefox OS phones that support the same WebAPIs that your apps require. Mozilla is working hard to push those APIs through W3C and encourage others to implement them. But that is a slow process and it remains to be seen if the other players want to do that.

Until that happens, Firefox OS is just as proprietary as any other platform. Sure, it is technically more open, but you are still locked in to a specific runtime implementation where you can't easily move away from.

2) Only if those applications are completely standalone and do not depend on server side components. Developer goes out of business or loses interest in the app? Good luck reverse engineering minified JavaScript or reimplementing a backend that the app depended on.

Firefox OS is great and it is a long term plan. But to claim it solves all problems we have now with mobile software goes too far in my opinion. Those same problems will just exist on any new platform.

(Yes, yes, the web is the platform. See point 1)

<comment><USER28> > 1) Only to other Firefox OS phones that support the same WebAPIs that your > apps require. Mozilla is working hard to push those APIs through W3C and > encourage others to implement them. But that is a slow process and it > remains to be seen if the other players want to do that.

In theory, it will work anywhere, eventually. But today, almost every single FirefoxOS applications can run unchanged on Android (using Firefox for Android). Most of them can also work on laptop/desktop (using regular Firefox). That's already way better than whatever Android or iOS offer.

> 2) Only if those applications are completely standalone and do not depend on > server side components. Developer goes out of business or loses interest in > the app? Good luck reverse engineering minified JavaScript or reimplementing > a backend that the app depended on.

On this point, I agree with you. The parent post was overpromising.

> Firefox OS is great and it is a long term plan. But to claim it solves all > problems we have now with mobile software goes too far in my opinion. Those > same problems will just exist on any new platform.

I, for one, don't claim that. But I am convinced that Firefox OS is a great step forward, and that's all we can ask, really.

Caveat: I am a Mozillian.

<comment><USER6> This is all true, but it's too late. The open source community (and HN) proclaimed Android as open for years, and frankly shouted down anyone who suggested otherwise as an iOS apologist (which clearly some of them were),

People believe they are getting something free and open when they buy Android.

These fine distinctions aren't going to make a difference in anyone's mind since the Geek vote already went to Android.

<comment><USER29> Really?! The gist was that Android was more like eventually open, because real development lags behind the OSS version?

<comment><USER6> Are you seriously trying to pretend that general consensus on Android wasn't 'it's better than iOS because it's open'?

Now that wolf has been cried, it's too late.

<comment><USER29> I'm not pretending anything. Both of those statements are true. Android is more open than iOS, FxOS is more open than Android.

And in every Android topic there is at least one commenter saying that Android isn't truly open.

<comment><USER6> That one commenter is usually drowned out to the point that the desire for 'open' is believed to be satisfied by Android. Now that a real open alternative comes along, it's too late.

<comment><USER29> We'll see I guess.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER30> I am always confused by the race to the bottom approach in electronics. These are device that people will spent hundreds of hours on, what is $60 dollars of savings stretched over the course of a 2 year contract?

I understand that in developing nations like Ethiopia or India this might be significant but in Spain?

<comment><USER31> 44 percent of all Spaniards under 25 are currently jobless.

<comment><USER30> Certainly, but they aren't living in poverty. For example, [http://en.wikipedia.org/wiki/Unemployment_benefits_in_Spain](http://en.wikipedia.org/wiki/Unemployment_benefits_in_Spain) Person with no children: 497.01 / 1087,21 euro which is $650 for doing nothing.

<comment><USER32> Nevermind the fact that in order to qualify for unemployment benefits you must have worked and contributed in the last few years. As it turns out, most unemployment in Spain, and countries in the same situation, is from fresh out of college students who never had a chance.

Well, you can argue that there is always a choice. And most of them take it, by leaving everything behind and moving to Germany or other central european country. Until they don't want them there anymore.

</comment></comment></comment></comment><comment><USER33> Google doesn't charge you to use Android and Mozilla doesn't charge you to use FF OS. So how will FF OS be able to deliver cheaper phones?

It seems if they are able to bring down prices by introducing this "no- contract cheap phone option" into the market (which may be a good thing), then nothing stops the same exact manufacturer from releasing the same exact hardware running Android for the same exact price sine the OS doesn't play into the cost in either case.

<comment><USER28> I may be wrong, but I seem to remember that Google does charge the companies that build these devices, so that cost is propagated somewhere to the consumer.

However, the real cost saver is the fact that, in my experience, FirefoxOS largely outperforms Android on many tasks, and generally is usable on hardware that is much cheaper than anything Android requires to run these days.

</comment></comment><comment><USER34> Could someone explain me how one can implement offline features like navigation etc for this phone? Is there an API besides HTML+JS?

<comment><USER28> You can find everything here: [https://developer.mozilla.org/en- US/docs/Web/Apps](https://developer.mozilla.org/en-US/docs/Web/Apps)

<comment><USER34> Thanks!

Hmmh, but all I see is WebApp, WebGL, JavaScript, HTML, ... I don't see 'native' -> How would I implement an offline navigation? (which is currently really not possible in JavaScript)

Or is it just not possible to create a resource intensive or tricky application in FireFox OS?

<comment><USER35> "How would I implement an offline navigation? (which is currently really not possible in JavaScript)" \- wow, just wow. Beyond the fact that this is just plain wrong - there are packaged apps that ship all assets on install, as well as great offline JS libraries - you do realize these things (offline, telephony, etc) are _APIs_ right? No _language_ Just Does™ offline or telephony - for instance, C++ is not somehow magically self-aware of internet connectivity, it's simply a language used by developers to code against device hardware/firmware which then provides _APIs_ for these capabilities.

JavaScript is no less capable of supporting these APIs, look at Node.js for instance, it has most of the server _APIs_ you find in other server implementations that use different languages as a base (and the Firefox platform has many of them already, with many more to on the way!)

<comment><USER34> Yes, I was wrong: you can create offline navigation with JS! (sorry, for the incorrectness I really like JS, especially on the server!)

But you cannot - please correct me when I'm wrong - create offline navigation on a FireFox OS when using only the provided APIs. At least I don't see a way how it should scale beyond a smallish city.

<comment><USER28> I'm not sure I understand where you see a limitation that could block you. See my other reply for a more elaborate discussion :)

</comment></comment></comment></comment></comment></comment><comment><USER36> telefonica chile: you work with alcatel; if you released that here on pay-as- you-go then i'd buy one in a heartbeat...

</comment><comment><USER37> Does anyone know how feasible it is to use a Firefox OS phone with no data plan? Using GSM for voice calls and SMS, but forcing it to only do data over wifi?

<comment><USER28> I've been doing that for ~6 months, without problem.

</comment></comment><comment><USER38> Any info on country-wise availability, especially India?

</comment><comment><USER39> if i'm in the US, how do I actually buy one?

</comment><comment><USER40> Following WebOS footsteps...

<comment><USER41> With two big differences:

1\. Knowledge resources available to team and experience of the organization in the subject matter far exceed what the WebOS team had.

2\. Was free/open and somewhat collaborative almost from the beginning. I say "somewhat collaborative" because the priority of the team was to create an operating system for a phone, with other forms (like a computer connected to other devices) taking a far backseat.

However, I agree in that, despite optimizations, it has a long way to go to compete with Android which almost "owns" the market it is after.

Politically, the timing is fairly good this announcement, though. Right after Google's black eye over privacy concerns, people might be slightly more likely to embrace Mozilla products. But, who knows. Competing in Android's turf is going to be a serious uphill battle.

It will succeed if:

1\. They really embrace community input and provide incentives for people to get involved. That is part of being Mozilla. They don't need to be Apple or Google.

2\. They need a charismatic leader with the vision of Jobs, someone with the design talent of Jony Ive, and someone that is capable of recruiting and organizing community talent like _______ (a name doesn't come to mind).

<comment><USER42> There's also four years' worth of hardware advancement that they get to ride on for free. Mobile hardware is a lot more sophisticated now than it was in 2009, so making an HTML+CSS+JS interface that feels performant is easier today than it was then.

<comment><USER40> Let me know when then run at _same_ speed as native apps, otherwise I can use existing mobile OS and their respective browsers.

</comment></comment></comment></comment><comment><USER43> So is this going to be like android where facebook app is compulsory?</comment>


Why iOS - <AUTHOR> https://gist.github.com/anonymous/9f789aabd7e8681dec0cf5781aecf664 <comment><USER2> How about neither? You have the choice of Apple's closed proprietary system, or Google's not-really-open proprietary system.

Google actually has the power to mandate hardware standards. You can't just sell an Android phone. You have to join the Open Handset Alliance (OHA), at which point, you can never make Amazon Fire devices.

You can always release AOSP-based Android phones with no Google services, but good luck finding a market.

Google has no interest in making hardware standard, because if they did, we might see other operating systems actually be able to take over the mobile market, much like Linux and the late 90s/early 2000s in the PC era:

[http://penguindreams.org/blog/android- fragmentation/](http://penguindreams.org/blog/android-fragmentation/)

Microsoft required their devices to have standard UEFI, and are hence more hackable and easy to upgrade, but the bootloaders are locked and fewer people are using them today anyway.

Plasma from KDE only officially supports two phones. ARM isn't a platform, it's a spec that should go die in a fire.</comment>


I'd Rather Not Merge with Robots, Thank You - <AUTHOR> https://www.bloomberg.com/view/articles/2017-05-10/i-d-rather-not-merge-with-robots-thank-you <comment><AUTHOR> This is an opinion piece by a solid writer, and mathematician. This sentence caught my eye: "[obsession with tech] will lead us to become such godlets, augmenting ourselves step by step with technology in a process that will erase our humanity, turning us into machine hybrids that seek only pleasure."

<comment><USER2> We are already machine hybrids. The alphabet is technology.

"I've come up with a set of rules that describe our reactions to technologies: 1\. Anything that is in the world when you're born is normal and ordinary and is just a natural part of the way the world works. 2\. Anything that's invented between when you're fifteen and thirty-five is new and exciting and revolutionary and you can probably get a career in it. 3\. Anything invented after you're thirty-five is against the natural order of things."

― Douglas Adams

<comment><AUTHOR> Nice quote and fair candor. But maybe we similarly trivialized technology in the past and have suffered negative side-effects that could have been avoided with forethought?

I'm not sure it's necessarily regulation but rather education that comes alongside any technology.

It's hard to measure quality of life, particularly when keeping in mind the famous saying "the best things in life are free". But I'd argue that many technological advances have not necessarily improved quality of life.</comment></comment></comment>


Curv: A language for making art using mathematics - <AUTHOR> https://github.com/doug-moen/curv <comment><USER2> I've been meaning to spend some time learn Processing[1] for ages, and would be interested to know how this compares.

[1] [https://processing.org/](https://processing.org/)

<comment><USER3> Processing builds upon a full curly braces programming language (usually Java or JavaScript depending on which version you use) so once you are done prototyping it's pretty straightforward to integrate it elsewhere.

</comment></comment><comment><USER4> This is a neat idea, but if I'm being honest I find the graphics shown in the readme pretty ugly and evokes memories of bad computer graphics from the '90s / early 2000s textbooks

<comment><USER5> I find the lack of anti-aliasing disturbing.

<comment><USER6> oh and without access to the source it's utterly impossible for you to fix this... hey wait a minute.

</comment></comment></comment><comment><USER7> Interesting. Seems a lot like [https://libfive.com/studio/](https://libfive.com/studio/), which lets you implement the shapes in Guile Scheme.

</comment><comment><USER8> That is amazing. Do you have more samples somewhere? Would be nice to see a "gallery" filled with these art work!

<comment><USER9> Seeing the word "gallery" reminded me of another piece of software to make graphics that I tried very many years ago. POV-Ray!

[http://www.povray.org/](http://www.povray.org/)

They have a hall of fame [http://hof.povray.org/](http://hof.povray.org/)

And they even have a "dial-up version" (low bandwidth) of their hall of fame and I think it's just super cute that they have retained the name "dial-up version" for that. [http://hof.povray.org/index- lb.html](http://hof.povray.org/index-lb.html)

Also worth checking out is old versions of their website archived by The Internet Archive. 20 years ago: [https://web.archive.org/web/19990210111443/http://www.povray...](https://web.archive.org/web/19990210111443/http://www.povray.org/) Click "gallery" (they were using frames so I can't link it directly with the navigation intact).

</comment></comment><comment><USER10> >An AMD GPU, using the AMDGPU-PRO (closed source) driver, which is only officially supported on Ubuntu LTS, Red Hat EL (not Fedora), and SUSE. Unfortunately, the open source AMD driver (based on Mesa) is too buggy to work with Curv right now. Your choice of Linux distro is very restricted with AMD.

This is interesting, I use AMDGPU, when I tried PRO I got no greater performance in benchmarks. I'm using one of the unstable ppas (oibaf) and haven't had stability problems. I guess this sort of software perhaps pushes the envelope and reveals instabilities.

Will have to give it a try.

<comment><USER10> Installed and ran fine, appears to perform fine using some basic examples. Obligatory fractals - [https://ibb.co/f40sFdx](https://ibb.co/f40sFdx).

sudo apt install cmake git-core libboost-all-dev libdouble-conversion-dev libopenexr-dev libtbb-dev libglm-dev gedit checkinstall && sudo apt-get install libxcursor-dev libxinerama-dev libxrandr-dev libglu1-mesa-dev libgles2-mesa-dev libgl1-mesa-dev libxi-dev && git clone --recursive [https://github.com/doug-moen/curv;](https://github.com/doug-moen/curv;) cd curv; make; sudo checkinstall -D; sudo dpkg -i ./curv _.deb

Then used this from the examples:

      make_shape {
          dist : everything.dist,
          colour (x,y,_,_) :
              let z = [x,y];
                  color = [0,0,0];
                  done = false;
              in do
                  for (i in 0 ..< 100) (
                      if (!done) (
                          z := csqr(z) + [x,y];
                          if (dot(z,z) > 4)
                              let cr = (i-1)-log(log(dot(z,z))/log 2)/log 2;
                              in (
                                  color := [0.95+.012*cr, 1, .2+.4*(1+sin(.3*cr))];
                                  done := true;
                              )
                      )
                  );
              in sRGB.HSV color,
          bbox : [[-2.5,-2,-2],[1.5,2,2]],
          is_2d : true,
      }

</comment></comment><comment><USER11> Off topic, but for some reason this made me think of a vegetable that I just had for lunch: [https://en.wikipedia.org/wiki/Romanesco_broccoli](https://en.wikipedia.org/wiki/Romanesco_broccoli) Art by nature with mathematical precision.

</comment><comment><USER12> I'd really like to see a bunch of images / live 3d models generated with it before investing time to even try it.

Website: [http://www.curv3d.org/](http://www.curv3d.org/)

</comment><comment><USER13> When contemplating beautiful mathematical inspired digital artistry, it is hard to ignore Jos Leys's exciting pages [0].

[0] [http://www.josleys.com](http://www.josleys.com)

<comment><USER14> These are beautiful. With which language/tools are these images/movies made?

<comment><USER13> Jos Leys mentions UltraFractal [0], what appears to be a project by an indy programmer, Frederik Slijkerman.

[0] [https://www.ultrafractal.com](https://www.ultrafractal.com)

</comment></comment></comment><comment><USER15> To the people who have experience with it, can it be used for solid modelling ? Since it supports export to popular format, it would be nice to use it for solid modelling also.

<comment><USER16> My experience with F-Rep based modeling systems is that once you've used a few transformations, the distance field becomes highly non-cartesian and operations do not have the expected effect. For example, "offset" generally only has the desired effect on a primitive shape. Until someone cracks the problem of "renormalizing" signed distance fields, I fear all such systems will just be toys.

Antimony [1] and its related project AO [2], as well as ImplicitCAD [3], are CAD-oriented F-Rep systems (that suffer from the problem I mention).

[1] [https://www.mattkeeter.com/projects/antimony/3/](https://www.mattkeeter.com/projects/antimony/3/)

[2] [https://www.mattkeeter.com/projects/ao/](https://www.mattkeeter.com/projects/ao/)

[3] [http://www.implicitcad.org](http://www.implicitcad.org)

<comment><USER17> I don't think the problem of "renormalizing" signed distance fields _can_ be cracked, at least not in a generic way that's fast enough for realtime rendering. I would agree this strongly limits the possibilities for making simple modeling tools based on SDFs, because whenever you use interesting transformations, you also need to be hacking away at the correctness of the field. Because of this, it's hard to make simplified tools for modeling and rendering interesting things using SDFs: you can't abstract away the fact that you're effectively writing a distance estimator function, and you'll always want to be able to dig down to the lowest programming level in order to make things work. This is a problem for popularization, but it doesn't prevent the technique from being useful in some domains and applications.

</comment></comment></comment><comment><USER18> It seems to be similar to Context Free Art [1]

[1]: [https://www.contextfreeart.org/](https://www.contextfreeart.org/)

</comment><comment><USER19> > dynamically typed, pure functional programming language

Why dynamically typed!!!

<comment><USER20> It's for math. You'll mostly be using it to store numbers. It also runs in the GPU. What do you want types for?

</comment></comment><comment><USER21> Sounds very cool. On Mac though you should probably migrate to Metal instead of OpenGL at some point.</comment>


Almost Nothing About the 'Apple Harvests Gold from iPhones' Story Is True - <AUTHOR> http://motherboard.vice.com/read/apple-does-not-melt-iphones-into-gold <comment><USER3> What does it say about the world we live in where blogs do more basic journalism than CNN? All that one would have had to do is read the report actually provided.

I don't think I'm being too extreme when I say that, apart from maybe PBS, there is no reputable source of news in America. If you don't believe me, pick a random story, watch it as it gets rewritten a million times through Reuters, then check back on the facts of the story one year later. A news story gets twisted to promote some narrative that will sell papers, and when the facts of the story are finally verified (usually not by the news themselves, but lawyers or courts or whoever), the story is dropped and never reported on again.

Again, if the only thing a reporter had to do was read the report to find the facts of the case to verify what is and isn't true, what the fuck is even the point of a news agency?

<comment><USER4> WSJ has floors of smart, trained, inquisitive journalists who assemble real original data and break real original stories, and who try hard–through single, double, and triple verification–to ensure the accuracy of every single figure and fact they report.

Which is why it's sometimes annoying to see people treat paywalls as though they were moral disgraces.

Source: I help invest for the chairman of the company.

<comment><USER5> I don't see it as a moral disgrace at all, but it really is an inconvenience. I have no way of creating this myself, but why doesn't the "Netflix" of journalism exist? Or why can't I just pay X$ more to my ISP, who has deals with publications such as the WSJ, to offer me access to their articles? I'd rather just browse and read, not manage subscriptions.

EDIT: Apparently I'm replying too fast. Note that I quoted Netflix, implying similarity and not identity. I can also see the potential problems concerning Net Neutrality, but I don't think it has to be a problem. If done properly, no throttling is needed as the news sites can still serve ads to non-paying customers. You're just distributing your money in 1 place instead of 10. It's solely for convenience.

<comment><USER6> ISPs probably wouldn't get enough customer adoption of such a service to make it worth their while. Someone needs to resurrect micropayments and figure out a way to make them work. There are a lot of people who don't necessarily want to subscribe to a news site but would be willing to pay a few pennies to read individual articles.

<comment><USER7> "Resurrect"? I don't recall any time period in which micropayments were successful.

<comment><USER8> Not in the west, but they're very successful in developing nations. Africa being the primary example.

</comment></comment></comment></comment></comment></comment><comment><USER9> These kind of stories are useful to understand to what extent the media has turned into an echo chamber. Everybody has to have (or comment on) the same stories than everybody else has, so fast copying (with or without attribution) has become a de-facto practice in every news outlet out there.

Good for Motherboard to wait and check. Unfortunately this means we will see this article now in all the outlets that published the previous one with a hand-washing disclaimer ("remember that article SOMEONE ELSE wrote that we talked you about last week, well...")

<comment><USER10> I'm not in the US, but if it's anywhere similar to the situation I live in, media outlets will either:

1\. Make a small apology for not sharing the truth that's not going to be very visible on their website.

2\. Just ignore the facts. Their work is done, they're moving on to different stories and pretty much forgetting this one.

Now, if 1st case happens, and it happens very rarely, you can bet that the apology is not going to be read by as large amount of people as the original story was. Therefore, a lie will become a "fact" in the eyes of regular people.

Example: the most popular newspapers in one European country next to mine shared screenshots of a very popular porn actress's video, but claimed that it were porn videos of the (female) president of the country next to it.

Of course, this was a blatant lie, the head of that news outlet made a public apology (over Twitter for sure, not sure if he did it over his news outlet), but if you ask Regular Joe, that story still remains true, because the apology made nowhere near the impact as the original story did (as you can imagine).

</comment></comment><comment><USER11> This hits the nail on the head in calling out news reporting sites who don't fact check or truthfully report a topic. Its incredible how far from the actually story the Apple recycled gold headline deviates and really makes you wonder if citing so called reputable sources is even valid in some cases.

<comment> rm_-rf_slash That's the problem with 24/7 news and the Internet.

1: Someone breaks a story 2: People get interested and share it with their friends 3: Other sources want a piece of that action so they bandwagon and cite the original piece for their own version.

I am often struck at how our modern communications framework, going all the way back to the telegraph, has allowed so much misinformation to be spread.

<comment><USER12> Some of those reporters are contracted to write five or even 10 posts per day. It's not like a NYT or WSJ reporter spending three weeks or three months on one story.

Also, because Google promotes blogspam without any regard for content quality (see the "freshness algorithm"), you lose money by spending longer on a post.

It's the exception rather than the rule that somebody will come along several days later and hit it out of the park, but well done Jason Koebler.

<comment><USER13> > Some of those reporters are contracted to write five or even 10 posts per > day. It's not like a NYT or WSJ reporter spending three weeks or three > months on one story.

Vice doesn't necessarily fall out of that category either. Smack dab in the middle is the statement:

"I still had outstanding questions, which I asked Apple ... The company has not yet responded."

The number of times I've read a developing story that has had that or similar in it is countless. Apple isn't known to have an army of PR representatives waiting for the next question to come down the pipeline, but it begs the question of how long they waited before publishing the story and just hoping they can update the story later while it's still getting pageviews.

<comment><USER14> I wrote this article, I gave Apple 18 hours to respond. The article has now been out for four hours or so, and it's been close to 24 hours since I originally asked them.

Apple RARELY responds to press inquiries and the only time it has reliably spoken to the press was during the recent encryption battle and that's because it desperately needed the public to understand its argument.

I understand what you're getting at, but Apple loses nothing by having the original story misreported—it ends up looking really good. Apple just straight up ignores reporters, all the time.

<comment><USER15> That really doesn't seem like a lot of time for them to respond. Especially given that for 10 or so of those hours, people are probably at home, asleep, or with their families.

<comment><USER14> I see what you're saying—but companies regularly respond to things like this very quickly. At least to say "we're looking into it" or "can you give us some time to respond." Apple and every other major company has people on call for things like this 24 hours a day, they have email on their phone ... the company saw my questions and chose not to respond. They still haven't responded or acknowledged it.

<comment><USER12> Apple's approach is to pick favorites, like Walt Mossberg, and then to play its handful of favorites off against one another. (Time gives you a bad review, Newsweek gets the next exclusive interview; or it's NYT vs WSJ.)

The rest of us are generally ignored, so we have to pick up scraps from the chosen few.

Obviously the big titles get more attention than small ones -- nobody has an infinite supply of time -- but companies like Google, Microsoft and Intel cope with dozens if not hundreds of journalists worldwide. They even deal with journalists that they think view them unfavorably.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> While the article is fine, this does not really follow:

> _So while Apple is nominally responsible for recycling a 90 million pounds > of e-waste, very little of that is actually iPhones, and very little of that > is actually being done by Apple. In Washington State, for example, Apple > products made up just 1.78 percent of the total weight of e-waste recycled > in 2014. In Oregon, Apple products made up 1.65 percent._

The author wants to argue that "very little of that is actually iPhones, and very little of that is actually being done by Apple" but the example he uses for that doesn't really show "very little", but rather a huge percentage of recycled e-waste being Apple stuff.

While the statement that "very little of that [apple products recycling] is actually being done by Apple" is compatible with the example, the example doesn't really prove that "very little of that is actually iPhones" as it's supposed to.

And even the implication that the numbers are small doesn't follow -- 1.65 to 1.8 percent of the total e-waste in a state is nothing to sneer at, considering Apple is just one among tens of thousands of companies making electronics, and compared to things like TVs and such, theirs are tiny and weight little (a fact admitted elsewhere in the article).

<comment><USER17> 1.65 % is not much when Apple makes up such a significant percentage of the phone market.

But even out of that 1.65%, iPhones themselves probably make a small percentage because macs are so much heavier.

The point of this article is that the media has implied that Apple is getting x pounds of gold by recycling iPhones and macs.

In reality Apple is eating about 1.5% of x pounds of gold by recycling iPhones and macs. They are likely getting 98% of x pounds of gold by recycling old CRT TVs and Dells. And only a very minuscule percent of the recycling is done by Apple. He vast majority of it was Apple paying 3rd party recyclers to get credit for the recycling.

<comment><USER16> > _1.65 % is not much when Apple makes up such a significant percentage of the > phone market._

The excerpt is not about phones though -- it's the 1.65 of total consumer electronics waste in the state. And as far as consumer electronics go, phones are hardly the biggest...

> _And only a very minuscule percent of the recycling is done by Apple. He > vast majority of it was Apple paying 3rd party recyclers to get credit for > the recycling._

How is that different than how every company that is not a recycling company does it?

<comment><USER18> I would imagine that more phones and computers get recycled (per product bought) than other consumer electronics. If I've spent $400 on a phone, I won't throw it away - if I can't resell it, I'll find out how to properly recycle it.

On the other hand, most other products probably just get thrown out - <USER2> or working chargers, cables, old telephones, etc.

</comment></comment></comment></comment><comment><USER19> In Apple's defense, I would imagine that most people who are getting rid of old Apple devices don't think about taking the devices to the Apple Store because that's where they buy new products. They typically take their products to an electronic recycling center, or even worse, they just throw it away in the garbage. Apple may be 'cheating the system' by paying these companies to receive credit for some X amount of pounds, but it's not like they're able to force their customers to return old Apple products to their stores.

<comment><USER20> I don't see this as cheating, but we're talking about the company who convinced people "Rose Gold" was cool. If they told their customers it would be super for them to bring old iDevices back to the Apple store for recycling, I'm confident they would succeed.

<comment><USER21> > If they told their customers it would be super for them to bring old > iDevices back to the Apple store for recycling

They do - [http://www.apple.com/recycling/](http://www.apple.com/recycling/)

<comment><USER20> I meant more, "if they ran a marketing campaign."

</comment></comment></comment></comment><comment><USER22> This reminds of a great article from Blake Ross that demonstrates the laziness in journalism today. It also goes into detail about a few simple ways a journalist can investigate a topic: [https://medium.com/@blakeross/don-t- outsource-your-thinking-...](https://medium.com/@blakeross/don-t-outsource- your-thinking-ad825a9b4653)

</comment><comment><USER23> Have other people noticed how many articles go out of their way to compare things in different units, like "30% of people do this, and 1 out of 5 do that"?

It's like they're trying to make it hard to compare things numerically on purpose, so you have to read and believe the conclusion in their verbal narrative.

</comment><comment><USER24> > Amount of material recovered for reuse through take-back initiatives in 2015

> Gold 2204 [lbs] [0]

[0]: [http://images.apple.com/au/environment/pdf/Apple_Environment...](http://images.apple.com/au/environment/pdf/Apple_Environmental_Responsibility_Report_2016.pdf)

So is the Vice story trying to claim that "take back initiatives" aren't run by Apple? This

</comment><comment><USER25> Is Vice any more reliable? A lot of their stories look too outrageous to be true. Like this one: [http://www.vice.com/read/this-guy-has-eaten-nothing-but- raw-...](http://www.vice.com/read/this-guy-has-eaten-nothing-but-raw-meat-for- five-years)

</comment><comment><USER26> I've seen a vice documentary on Sakawa in Ghana and I must admit. These guys are smart and thorough! They actually have me insights on things I see all the time, but failed to see the implications of.

</comment><comment><USER27> Heh, I'm officially dumb. I _knew_ that something was fishy when the news reported more lead being recovered than gold and tin combined but I dismissed this feeling.

Stupid, stupid, stupid and naive :)

</comment><comment><USER28> Who cares about $40MM dollars any more.

</comment><comment><USER29> Summary:

Various media sites claimed apple recycled $40 million worth of gold from iphones, they were dead wrong.

What actually happened is that Apple is under statutury obligation to recycle a certain weight of e-waste depending on it market share or weight of electronics sold (depending on state laws). The e-waste doesn't have to be of the manufacturers own products.

Apple paid third party recyclers to recycle mostly CRT's and PC's (iphone have hardly any gold and are much more valuable refurbished, In fact, phones and tablets often don't count toward the overall recycling requirements in many state laws.) and probably incured a loss rather than a 40 million windfall as claimed in news articles.

Original Article: 1500 words (~8 minute read) Summary: 114 words (less than a minute)

The articles goes in to some more detail and analyzes the mandatory recycling laws deeper as well. There is also some commentary of how many other sites got it very wrong and overview of the e-waste recycling industry. Reading recomended if you want gain more knowledge on this.

If you'd like such summaries for all articles before you read them check out: [https://news.ycombinator.com/item?id=11535695](https://news.ycombinator.com/item?id=11535695)

<comment><USER30> Hey, can you cut it out with the summary advertising crap?

<comment><USER31> It's an ad, but one that's providing a legitimately useful service. Theres no conflict of interest here (the summary isn't any more biased because it's an ad than a regular commenter would be) and if it weren't an ad, it would be generally recognized as a constructive comment.

There's no need to get dogmatic about advertising. If all ads were this high quality and considerate, I would have no problems with ads.

<comment><USER30> Except it's really not very constructive, is it? It's a summary with no context or part in discussing the actual article. I know we all love TL;DRs, but I don't want to see every article that takes >60s to read have promotional summaries. That will make HN rather low quality.

</comment></comment></comment></comment><comment><USER32> Apple misled media. I hope media learns from this.

<comment><USER33> Where is evidence of Apple misleading media? Apple certainly never said they were making money off recycled gold.

<comment><USER34> Apple announced a robotics project last month called "Liam". [https://www.youtube.com/watch?v=AYshVbcEmUc](https://www.youtube.com/watch?v=AYshVbcEmUc) It recovers "cobalt and lithium", "gold and copper", "silver and platinum".

The number "2,204 pounds of gold" comes from page 17 of this PDF [https://www.apple.com/environment/pdf/Apple_Environmental_Re...](https://www.apple.com/environment/pdf/Apple_Environmental_Responsibility_Report_2016.pdf) which prominently displays Liam on the cover page.

<comment><USER33> Mentioning two different facts about their recycling programs on completely different pages of a holistic report about their environmental responsibility now constitutes "misleading the media?"

<comment><USER34> First, it's on the same page. The discussion of Liam starts 3 lines below the number 2204.

Second, the video clearly states that the gold from iPhones is recycled. It would be clearer to say that the phone parts which happen to contain gold are put into refurbished phones. It's not extracting the gold at all, and that's why it's misleading.

<comment><USER33> > First, it's on the same page. The discussion of Liam starts 3 lines below > the number 2204.

And 2 lines above the gold it says 61,357,800lbs of total material, in a figure much more clearly connected than the ostensible paragraph.

When Liam is introduced on that page, Apple explicitly says it is "a line of robots designed to disassemble 1.2 million phones a year." Unless you think the average phone weighs 61 pounds, it's obviously not responsible for the total material recycling chart above.

Nobody could possibly read this report and come away thinking that Liam is recycling millions of dollars of gold.

</comment></comment></comment></comment></comment></comment><comment><USER35> aapl = pretentious

</comment><comment> awinter-py they're after me lucky charms

</comment><comment><USER36> Not that I would confuse CNN as actual journalism with investigative journalists but how many times a day does CNN say "we have not been able to independently verify" about a story, yet doesn't bother with stuff like this?

How can these places claim "freedom of the press" without having to prove they are "press" or what "press" even is?</comment>


Ask HN: would you consider domain names that aren't .com?  - <AUTHOR>

since most good .coms are taken, and new TLDs are coming, we built something to help people more easily find "other" domain names: TLDs like .in, .co.uk, .de, and vertical-specific TLDs like .bike.
more: http://www.panabee.com/domain-name-search/free
we're curious if people are still set on .coms or would consider other types of domains. <comment><USER2> Realistically, most people aren't typing in domains most of the time, with search and social media being so common, but for that 1% of the time that someone types in somecoolapp.com when you only have somecoolapp.me, you could be losing out potential customers to a competitor, or have someone damaging your brand, or just inconveniencing and confusing customers (see [http://nissan.com/](http://nissan.com/)).

</comment><comment><USER3> Currently .io seems to be pretty popular ;)</comment>


Fitbit to Buy Pebble (YC W11) - <AUTHOR> https://www.theinformation.com/fitbit-to-buy-pebble <comment><USER2> Anyone have the text of this? The site is pay to read

<comment><USER3> Another user shared the text here [https://news.ycombinator.com/item?id=13076836](https://news.ycombinator.com/item?id=13076836)

The story is a bit light on details and it seems no sources went on record. Perhaps it'd be better if the title reflected that it's just a rumor at this point.</comment></comment>


Case Study In What Not to Do: GE Goes Down in Flames on Twitter - <AUTHOR> http://www.pehub.com/100009/a-case-study-in-what-not-to-do-americas-biggest-company-goes-down-in-flames-on-twitter/

<comment><USER2> I have an idea: Trickle Down Economics!

No, not the type you are probably thinking of -- here is my modest proposal.

That the tax policies and plans of corporations should be made fully public. That is to say that every tax practice, incentive and process used by corporations to lower their taxes should be made known and available to the public for their own personal enjoyment. Individuals should be able to, as public citizens, join forces and consolidate-to-mitigate tax liability.

I, as a person, should be able to utilize the same tax saving maneuvers as GE or any other company.

Unless of course, we truly are saying that coporations are NOT people, and should be treated wholly different than physical people.

If they are "people" and enjoy the same rights as us -- then we should in turn enjoy the same rights as them. and the fees that we pay should be on respective scale as they do for the same rights.</comment>


Exponential to Linear Complexity using Memoization - <AUTHOR> http://amjith.blogspot.com/2012/02/memoization-decorator.html

<comment><USER2> There is a terminology problem with that article. People do get casual (or sloppy) with these terms, but its worth keeping them distinct:

The note describes memoization as using a "cache". That's a problem because memoization and caching are both useful, but they are different things.

A memo (which it appears is implemented by the Python library you mention) stores the results of earlier computations for re-use -- just as you've described.

A cache does the same thing _except_ that if a cache becomes over-full, some earlier cached results may be recomputed (because they were dropped from the cache).

There are two critical differences:

Minimum space requirement for a memo: O(N x S) where N is the number of unique computations to be performed where S is average size of parameters and results.

Minimum space requirement for a cache: arbitrary, although performance varies with size.

Number of repeated computations with a memo: 0

Number of repeated computations with a cache: at least N where N is the total number of _unique_ computations, and as many as T where T is the total number of computations with duplications.

A cache is useful in contrast to a memo when N*S is uncomfortably large, but "most" of the repeated computations are members of a set of size M where MxS' << NxS where S' is the average size of params and results in the M-set.

A memo is useful where NxS is conveniently small, or where it is unacceptable to repeat any computation for some reason.

<comment><AUTHOR> Thank you for the explanation. I'll update the post.

Is it possible in Python to have a fixed size dictionary? I thought about the repercussions of the size exploding, but I couldn't find anything readily available to restrict the size.</comment></comment>


Hacker News Kansai #17: March 28 in Kobe - <AUTHOR> http://hnkansai.doorkeeper.jp/events/9789

<comment><USER2> Here are the presentations planned for the event:

1\. Mag, new image communication service. (Shota Mizukami)

2\. Real coding framework for WP (Jeff Madsen)

3\. A step-by-step look at building an app with Meteor (Sacha Greif)

4\. Awesome window manager (Sean Colquhoun)</comment>


Wikipedia Chemical Structure Explorer - <AUTHOR> http://www.cheminfo.org/wikipedia/

<comment><AUTHOR> (Caution! it will take about 10-20 seconds to load the data. Even from localhost, it takes about 5 seconds to start up.)

It's an interactive explorer of the chemical structures in Wikipedia. You can sketch a structure in the upper-left, and have it search for structures which contain that as a substructure, or search for structures which are similar to the drawn structure. All of this is done in the browser.

In the middle left you can search by name. In the bottom left it gives an overview of the search results. The right side shows information about the structure, including its Wikipedia pages.

All this is done interactively in the web browser. It requires only static files, plus a connection to Wikipedia. I cloned the repo and started my own server with "python -m SimpleHTTPServer 8000".

I read about this in the paper "Wikipedia Chemical Structure Explorer: substructure and similarity searching of molecules from Wikipedia" at [http://www.jcheminf.com/content/7/1/10](http://www.jcheminf.com/content/7/1/10) .</comment>


Measure the speed of light with a hot dog and your microwave - <AUTHOR> http://www.loopinsight.com/2013/12/27/measure-the-speed-of-light-with-a-hot-dog-sausage-and-your-microwave/ <comment><USER2> This is crazy cool! I love these "science at home" kind of experiments.</comment>


Download.com and Others Bundle Superfish-Style HTTPS Breaking Adware - <AUTHOR> http://www.howtogeek.com/210265/download.com-and-others-bundle-superfish-style-https-breaking-adware/ <comment><USER2> Lets say I ran a well-known business that sold a some sort of physical product.

It could be a toy, a common household tool or appliance, or anything else that is small and inexpensive. It more-or-less works as intended, but it also included a small robot. The packaging and marketing would be designed so you weren't supposed to notice the robot, but the packaging included the necessary fine print and an explanation that this robot was just there to make sure you got the _best experience_ possible for anybody that spotted this "extra feature".

Unrelated to whatever it was that you bought, at night the robot would install a device on your phone that re-routed all your phone calls through my office (a MITM attack). The phone still works ok, except now calls to your favorite pizza deliver restaurant seem seem to be re-routed to the competitor across town. Some time later a neighbor complains that he can sometimes when he checks his voicemail, he gets your phone conversations instead.

After finishing with the phone, the robot does the same thing to your cable TV.

Some days, the robot would go through your (physical) mail and place stickers with new advertisements into your magazines. Occasionally one of those stickers would end up on your electric bill, obscuring important information. The power company has a similar logo to one of the sticker-ads, so the robot probably confused the two logos. Even if the robot didn't have any stickers to place, it would still open your mail and leave it (opened) on the ground near your mailbox for anybody to see.

If I rand a business that did this - possibly as my main (or only) product - _how long would I be able to run this scam before someone threw me jail?_

\--

Intentionally breaking TLS with a MITM attack goes _way_ beyond the usual scam/trojan. This isn't even the usual negligence that we see in the "security" of a lot of products. Creating a certificate that lets you MITM any domain is _very obviously_ a willful act.

<comment><USER3> Why hasnt companies like Download.com and CNET been dragged to court yet beats me. People have had to pay hard cash just to have their systems purged many have lost priced documents and information while attempting resets because of this.

Is this some sort of favorable treat?

<comment><USER4> Or at a more simplistic level, why haven't Google, Firefox et al simply blocked download.com as serving malware? Even something that simple happening far more frequently, might mean sites carrying ads gained some ethics. Maybe some of the ad networks would then be held responsible for the crap they regularly carry.

...and sites whine at the unfairness of the growing number of adblocking users. Right.

<comment><USER5> If you install uBlock Origin at least, it _will_ flag the entire site by default.

It is very easy to add new things to the list too (e.g. right-click an offensive pop-up and "block element").

I even told it to block my ISP's ridiculous typo-redirector.

<comment> squeaky-clean The sort of person who installs uBlock Origin is also generally the kind of person that knows to avoid these websites. However, people like my mother don't know how to install uBlock, and don't know to avoid download.com (I mean, with a domain name like that, it has to be legit!).

This is what uBlock shows me when visiting a page on download.com [0]. It also changes the URL to "chrome-extension://cjpalhdlnbpafiamejdnhcphjbkeiagm/...". If my mother saw this, I'd get a phone call right away that some virus was stopping her from downloading something. It looks scary, and the most visible information is the most obtuse, while the most useful information is grayed out on the page.

If the most prominent text was something like "We've blocked this page, because it matches our list of 'Badware risks'." I'd feel better about installing uBlock for a casual user. As it is now, I only install Adblock Plus because it hides malicious ads and fake download buttons without also presenting scary things to the user.

[0] [http://i.imgur.com/DUdRCSc.png](http://i.imgur.com/DUdRCSc.png)

<comment><USER6> You're right, that's why you should install uBlock Origin for your grandmother

<comment><USER7> and everyone else's grandmother, i suppose

<comment><USER6> One grandmother at a time, we can cure malware

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> If only Microsoft had run with the idea of package management and trusted repos that has existed in open source for decades without restrictions that inspire people NOT to use it. Example to release a debian repo to share your software with your users you have the option to handle hosting/payment if any yourself and keep 100% of the revenue not 70%.

Their position in the market is such that had they started pushing this around the time apt-get started to be a thing they would have had near 100% adoption and users would be used to installing everything that way and would be naturally suspicious of manual installation.

Bad actors could end up on a blacklist that users would opt to enable. You would even have multiple black list sources from people like antivirus vendors etc.

<comment><USER9> Do you really want to live in that world? The world where I have to get past Google's, Apple's (iOS and Mac app store), Debian's and Steam's arbitrary rules about what is and isn't an acceptable app? Where a company/project's current head gets to decide what it is, and isn't, acceptable to install?

One of the reasons Windows flourished was the openness of the platform.

<comment><USER10> Linux is a much more open platform than windows. It's only downside is that most people think it's difficult to use.

I cannot think of any reasons why you'd think windows is open, especially when comparing it to Linux. You were talking about installing, yet fail to realise that pkg managers aren't the only way. I mean most Linux users regularly compile binaries directly from the source. How is that not open? Perhaps you'd like to elaborate.

<comment><USER11> Because part of being open is being accessible.

"It was on display at the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying beware of the leopard."

Linux is difficult to use for the kind of person who is downloading software from Download.com - "compiling binaries directly from the source" might as well be Klingon to them. Frankly as a geek I'm much happier with my Mac and Windows machine than I am with Linux. Even now things like the Linux Standard Base not being utterly standard demonstrate that Linux is still aiming for a different market.

There is a gulf between "my Mom is running Debian, she thinks it is Windows, hehehe" and "able to manage a Linux box even remotely competently".

<comment><USER12> Downloading applications via a package manager is basically the same as downloading applications on your phone via an "App Store" application. (Especially if you are using a package manager with a GUI)

Millions of people use app stores everyday. And I'd say a huge percentage of those people are the ones who would also download a program on their PC from download.com

Which sounds more accessible:

      1) click package-manger program
      2) type the name of the program you want to install
      3) click install

      OR

      1) open web browser
      2) go to http://yahoo.com
      3) type google
      4) click the first link
      5) google "download program_i_want"
      6) click on link leading to "www.download.com/malware/viruses/tracking/program_i_want"
      7) stare at the dozen different DOWNLOAD! buttons, and wonder which one
      8) click the biggest flashiest one
      9) wait for it to finish downloading
        (if it doesn't automatically start and installer)
        a)open File explorer
        b)Go to Downloads folder
        c)wade through the hundreds of other downloads until you find kd457sfjgs_download_app_i_want_setup_INSTALLER.exe.EXE
      10)Once the installer is started click the NEXT button a dozen times, inadvertently installing extra malware each time

<comment><USER13> You're being a bit disingenuous in making the latter seem more complicated than it actually is, though. It's only slightly more tedious than a repo, but it's no less accessible.

<comment><USER4> No, I don't think he is. Not even a bit. Sure, for us techies there's little difference. For your typical non tech user, each of those 10 steps can cause issues. _This does not mean they are a moron, just they don 't grok IT._

So many will download the file again each time they run it, or spam click next 20x to install, reading nothing. Or just click the topmost, or largest download GIF - which I pretty much guarantee is not the one they should use. Or install loads over the course of the PC's life, but uninstall nothing, leading to buying iPad or new PC basically because they have 4 printer drivers (pointlessly huge things these days), software for their last 3 phones, 234 screensaver apps the child thought was fun, several anti virus (none from a truly legit source).

For the truly non-techies nothing has changed since the days of a web full of crap adsense 5 pagers. Click a link, click another. Main thing that's changed in 15 years? The link probably isn't blue, or underlined.

The level of blind trust shown towards the web, and downloads is terrifying. "It's on the internet, it must be true."

<comment><USER14> > The level of blind

Is just as high if not higher for a nontechnical user to use Linux. Sure they can look at the source code, but that doesn't mean they'll be able to make sense of it.

What if they try to solve a problem themselves? Googling it will land them on any number of blogs or forums where people post cryptic instructions or link to bash scripts that might as well be black box binaries from their perspective.

<comment><USER15> >Is just as high if not higher for a nontechnical user to use Linux. Sure they can look at the source code, but that doesn't mean they'll be able to make sense of it.

Except that there is no adware, malware, spyware, or anything else bundled into a Linux repo. The end user may not know what is up, but Debian (and the whole community of package managers) is doing a lot more to protect the end user than CNet, Google or Apple is doing to protect the end user. It is de rigueur that if I install an app from the app store, it will try to spy on me, export my contacts, etc. This is far less likely with a Linux repo.

<comment><USER14> And when Dell ships a laptop running Debian, they've setup their own repos in the package manager which is along the same lines as installing a trusted root cert in Windows by Lenovo.

The trouble is that these systems are not easy to use and end users have to put their trust somewhere to get a system that is functional for them.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> How is this not extremely illegal? People have gone to prison for far less. How is it possible that a company like Lenovo would get involved with this?

I recently found myself wondering if I should consider CNET a reliable source of software. I guess this story answers that.

<comment><USER17> Protip: If a site wants you to download an installer, or has its own installer for the software it provides, don't use it.

<comment><USER18> Almost all software comes with an installer. Might as well just not download software over the internet, which makes it impossible to do anything.

<comment><USER17> Sorry, I meant a site installer, like those random "download.com installer" software. Not the installer of the program itself.

Generally, if the installer is branded with the branding of the third-party you downloaded a program from, stay away.

</comment></comment></comment></comment><comment><USER10> It's amazing watching a normal person install something. Most people I've seen just spam the next button until the window disappears, until the software and all its friends are happily installed. I think the first step is to educate users. Or implement a package manager.

<comment><USER19> We decades down the line. Education users won't work. Regular people just aren't gonna learn.

It's time for us techies to build better software, to get laws passed that stop this sort of thing, to get websites like CNET download.com and manufactors like Lenovo blacklisted.

<comment><USER20> I love it when people tell me they don't want to learn to use a computer because they don't need to. Then they come to me and ask me to solve their inability to read instructions... Sometimes I get mad at them... If they want to use computers they better learn to work with them. Or pay for the maintenance. It seems they don't wish to do either.

<comment><USER21> I can relate. Creating a text document, registering for and installing Spotify, ordering something from Amazon - those are tasks that target a very general audience. Yet there's the reluctancy in some people to deal with any of it since it's computer stuff. On the other hand you're generally expected to be able to operate a car, or a washing machine. Just imagine that you'd tell anyone that, "well, sorry, household chores aren't within my area of expertise" \- that probably won't get your clothes clean.

<comment><USER19> Do you have to read many pages of dense legalise in order wash clothes or drive a car, like you do with installing Spotify? Users are trained to just click "Next" until the computer boxes have gone away.

There are schools and licences for driving a car. There is no EULA for washing clothes.

If we want to train users to not click on "I Agree" to get rid of the legalese then there should be no legalese for installing Spotify or buying from Amazon. I can buy in a shop without needing to sign a 10 page document, so why not the same with Amazon?

We, in tech, have trained users to click on the green buttons to make the computer boxes go away.

<comment><USER21> Regarding the fine print in ecommerce: As a seller of goods in our own store we are actually required to include boilerplate terms and conditions. We don't like it, our customers don't read it and if they do they may not understand. And yet it's quite dangerous to drift away from or simplify the ever growing legalise language since we risk legal and financial consequences from business and so-called customer interest groups that found a way to monetize the search for shops that don't follow the boilerplate terms close enough or miss certain parts.

</comment></comment></comment></comment></comment></comment><comment><USER22> _The bottom line is that you can no longer trust that green lock icon in your browser's address bar. And that's a scary, scary thing._

What's even scarier? Not being able to inspect the traffic your own machine sends or receives because the powers that be have decided that, due to Superfish and all this other unwanted MITM'ing software, to "improve security", certificate stores will be locked down so well that only the "trusted authorities" (i.e., they) can modify them.

As long as users (and by extension, the software they run) can modify the certificate store this "problem" will exist, but as this article shows, it's not hard to add and remove certificates, and thus effectively "choose who you trust". The alternative, to have no choice in who you trust, is far worse. I just hope that the security community realises this, but if things continue moving in the direction they currently are, I'm not so optimistic.

Incidentally, I also use a local MITM proxy, but to _remove_ ads and other crap.

<comment><USER23> There's a tradeoff that seems to be missed in security discussions quite often - the more secure something gets, the less useful it is. At the extreme end, a perfectly secure system is also perfectly useless.

I personally also dislike the direction where things are going. I get that maybe most people don't actually need general-purpose computers, they want glorified web browsers instead. But I'm afraid, given how the market behaves, that this will mean there won't be _any_ non-locked computers available at all, or even if, they won't be able to interoperate with their "dumber" counterparts for general population.

<comment><USER24> > the more secure something gets, the less useful it is. At the extreme end, a > perfectly secure system is also perfectly useless.

That's a pretty profound statement. On the one hand it totally rings true, but on the other, I wonder is there any sort of argumentation or research to back this up? I would love to be able to reuse.

<comment><USER25> I'd say it's true at the extreme end but not really true in the middle. For real-world systems, there are often security improvements which don't impact usefulness, or even improve it. For an example, imagine something like gmail that uses plain HTTP. Upgrade it to HTTPS, did it become less useful? If anything, it became more useful, because you can now use it on public WiFi networks without worrying about being hijacked. If the backend is also secure then you can use it to exchange private information you wouldn't transmit in the open.

The major conflict right now isn't because there's an _inherent_ tradeoff between security and usefulness, it's because _if your users are idiots_ then "secure" becomes problematic. For a smart and knowledgeable user, "secure" can be considered to be roughly synonymous with "do what the user wants, and only that." With idiot users (most of them), security requires protecting them from themselves. For example, with knowledgeable users, protection against malware can be accomplished by signing apps to show who made them and running them in a sandbox where the user controls what permissions the app has. With idiots, none of this does any good, because they'll click Accept when Blofeld's Stealy App requests permission to withdraw money from the user's bank account, if there's a slick gem-matching game attached. And idiots can't be trusted to know that they're idiots (because they're idiots) so having an "advanced mode" doesn't really solve the problem.

So really, the problem is deciding what "security" means. Does it mean your computer can't be subverted by outsiders? Or does it mean your computer can't be subverted by _you?_ Increasing the former kind of security tends to improve usefulness, but increasing the latter kind harms usefulness.

</comment></comment></comment></comment><comment><USER26> The solution to this is Certificate Transparency[0], a distributed public log of certificate timestamps that are submitted by CA's and checked by browsers.

CT has been required for EV certificates in Chrome for a year now[1], and eventually will be required for all certificates otherwise they will error out on connection.

A certificate signed by a root cert that is not the original CA will not validate.

[0] [https://www.certificate-transparency.org/](https://www.certificate- transparency.org/)

[1] [https://blog.digicert.com/certificate-transparency- required-...](https://blog.digicert.com/certificate-transparency-required-ev- certificates-show-green-address-bar-chrome/)

<comment><USER27> Unfortunately, Chrome's current policy is to disable certificate transparency and HPKP when a certificate appears to have been manually installed, to support MITM proxies [1].

Needless to say, this makes HPKP and certificate transparency worthless when the client has been compromised by adware or viruses.

[1] [https://www.chromium.org/Home/chromium-security/security- faq...](https://www.chromium.org/Home/chromium-security/security-faq#TOC-How- does-key-pinning-interact-with-local-proxies-and-filters-)

<comment><USER28> And then you set a Group Policy to ban Chrome and instead enable a browser with more reasonable settings for this case, like Firefox.

<comment><USER29> Firefox accepts local certs over pinned ones by default as well (superfish affected it too).

I believe there is an about:config setting that can be changed to have it reject local certificates in the face of a pinned site, but if malware is putting certificates in Firefox's cert store, they can just as easily flip that setting as well.

</comment></comment></comment></comment><comment><USER30> I work for CBS Corporation, which owns CNET/Downloads.com.

I have sent an email to our security team with this story, and will report back if I hear anything from them.

<comment><USER31> It would be hilarious if the response was that it was banned for use by CBS employees and therefore nothing to worry about.

<comment><USER30> Hilarious for everyone except me - apparently the only person among 35,000 who gives a heck about network security.

The outcome I expected is the outcome I've witnessed thus far - total and complete silence.

</comment></comment></comment><comment><USER32> It is not immediately clear but the article was published in February 2015.

<comment><USER33> And they posted a nice follow-up a month ago: [http://www.howtogeek.com/238765/how-to-check-for- dangerous-r...](http://www.howtogeek.com/238765/how-to-check-for-dangerous- root-certificates-on-your-windows-pc/)

</comment></comment><comment><USER34> I honestly wonder if there should be some sort of signature or approval process on the OS vendor's part before any cert can serve as a root.

I'm not sure what that would look like and I do realize there are some 'walled garden' implications here. But honestly, I don't get how or why a userland application has any right to touch the OS' trusted CA roots. Perhaps some model similar to driver/kext signing would make sense - self signed and/or untrusted could be loaded when the system is booted with some development mode flag, but on a general user system, the only path to get your cert trusted as a root COULD be via update/push from the OS vendor.

<comment><USER35> A lot of big enterprises run their own, internal, CA infrastructure.

[https://technet.microsoft.com/en- us/windowsserver/dd448615.a...](https://technet.microsoft.com/en- us/windowsserver/dd448615.aspx)

In these instances, the fact that you can add a root certificate (your own) is a feature that facilitates security.

<comment><USER36> "feature that facilitates security."

That is debatable. The device/system then doing the MITM is a prime target for attacking/exfiltration of data since everything is de- and re-encrypted there. A huge single point of failure in my opinion.

<comment><USER35> There are plenty of legitimate uses for your own PKI that don't involve MITM'ing your users.

[https://technet.microsoft.com/en- us/library/a8f53a9b-f3f6-4b...](https://technet.microsoft.com/en- us/library/a8f53a9b-f3f6-4b13-8253-dbf183a5aa62.aspx)

> Organizations can use AD CS to enhance security by binding the identity of a > person, device, or service to a corresponding private key. AD CS gives > organizations a cost-effective, efficient, and secure way to manage the > distribution and use of certificates.

> Applications supported by AD CS include Secure/Multipurpose Internet Mail > Extensions (S/MIME), secure wireless networks, virtual private network > (VPN), Internet Protocol security (IPsec), Encrypting File System (EFS), > smart card logon, Secure Socket Layer/Transport Layer Security (SSL/TLS), > and digital signatures.

<comment><USER27> What is there in that list that you couldn't do with a legitimate CA?

<comment><USER35> Issue certificates for free and have complete control over them?

Imagine if you had all your infrastructure authenticating with DigiNotar issued certificates (that you paid for) only for them to be invalidated in one day.

[https://en.m.wikipedia.org/wiki/DigiNotar](https://en.m.wikipedia.org/wiki/DigiNotar)

<comment><USER37> It's much more likely that your IT staff will bungle things managing your own CA. And less likely that you will notice it and successfully manage the revocation process.

There's a lot of fun to be had when someone steals your root CA private keys undetected, and a lot of time & money to be spent ensuring it doesn't happen despite Murphy's law...

</comment></comment></comment></comment></comment></comment></comment><comment><USER38> Hate to say it but I'd rather focus on user education than concentrate more centralized compliance control with Microsoft. I am old enough to remember how Microsoft wielded that type of control in the past. Malwarebytes alone could/should fix 90% of this problem.

<comment><USER39> Perhaps, but for the majority of users, the iOS security model happens to be extraordinarily effective. I'm not saying Microsoft should force this down everyone's throats, but I for one wouldn't see it as a bad thing if something along these lines was the _default_ on retail purchased PCs.

I say this as the "free" family tech support officer.

I've moved about half of my extended family onto iPads and my life is much better.

<comment><USER38> I understand where you're coming from but it's a little like saying that North Korea enjoys a low crime rate.

Do we want one company to have that much control? How do you think personal computing would have evolved if Microsoft had controlled Windows applications the way that Apple controls iOS applications?

One of the best things that ever happened was Windows and the web both flourishing as massive market share, mostly-open development platforms for almost two decades.

<comment><USER39> I don't disagree, but let's not blur the lines here between people who use computers professionally and people who use computers as an appliance.

We could have had an iOS-like security model on Windows for the majority of unassuming retail customers and I don't think it would have made a single jot of difference to wider flourishing.

(In fact, for various reasons, I would wager that we'd have a _more_ mature technology sector. Don't underestimate the damage caused by malware to consumer trust.)

<comment><USER40> Web development as we know it would not exist. Microsoft would have banned competing browser engines (as is the case on iOS) and IE6 would have had 90% market share. The preferred way of doing active content would be ActiveX.

<comment><USER39> I'm only saying it could be a _default_ on retail purchased PCs. Not on self- built PCs and a simple choice on (re)install of Windows.

<comment><USER40> That's still a huge majority of PCs. The self-built PC has always been a bit of a market anomaly; people don't have self-built Macs and self-built cars are a truly tiny number.

And I'm working on the assumption that this would have applied decades ago, when there weren't quite so many viable alternatives to the PC and Microsoft was the terrifying market monopolist.

<comment><USER39> You should also work on the assumption that a majority of people would have disabled this sandbox.

Maybe instead of thinking about it as iOS-like, think about it like a "not logged in as Administrator" mode which actually worked.

<comment><USER40> OK, but if the user disables the sandbox they're vulnerable to malware, and we're back at square 1.

(The goalposts seem to be very mobile here...)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER41> The Badfish page at [https://filippo.io/Badfish/](https://filippo.io/Badfish/) seems to be down. Any other place where I can direct people to check for invalid security certificates?

<comment><USER33> I have not looked for an online tool, but you can download sigcheck [1] and run `sigcheck -tv` which will display "valid certificates not rooted to the Microsoft Certificate Trust List".

[1] [https://technet.microsoft.com/en- us/sysinternals/bb897441](https://technet.microsoft.com/en- us/sysinternals/bb897441)

</comment></comment><comment><USER42> I'm really surprised that CBS hasn't been called out for the behavior of download.com. They're a major news corporation that needs to maintain their reputation. I've never seen any news story questioning senior management as to the disreputable activities of CBS Interactive and it's subsidiaries like CNET and download.com.

</comment><comment><USER43> > Make sure […] your […] anti-virus stays updated

Or don't use them considering how many reports of them actually making your system less safe there are.

</comment><comment> slipstream- I've been investigating PUPs for the last month or so.

These kind of bundlers now drop not only adware (browser extensions, or those that drop MITM proxies that break TLS), but also winlockers and fakealert trojans of Indian origin ("CALL OUR [FAKE] TECH SUPPORT TO RESOLVE THE ISSUE").

</comment><comment><USER44> Probably a silly question here (and I've asked it before), but why exactly do we only have dodgy download sites for Windows programs anyway?

I mean, other platforms have decent stores and download repositories. And games on Windows... well, you've got a lot of good sites and services there. Everything from Steam to Good Old Games to the average game mod or ROM hack download site is moderated and mostly kept free of adware and other crap.

Is there really no one interested in providing a site or service that explicitly disallows bundling and ad supported crap (or that outright removes it from anything submitted to them)? Does no one with any ethics exist in this space?

</comment><comment><USER45> I'd be willing to pay a modest fee to have a repository of common software, always up to date, free of adware, and that can be updated automatically. A sort of commercial chocolatey with more choice and more up to date packages.

<comment><USER46> [https://ninite.com/](https://ninite.com/) is along those lines for MS Windows.

<comment><USER45> Yeah, I looked at it. The problem I have with ninite is their limited number of apps. Even with Chocolatey there are some key apps (to me) missing, like Spybot Anti Beacon.

Ideally you would want something popular enough that developers would be rushing to submit packages for their apps and so even relatively small softwares would be available. If customers are paying (and the cost should be fairly modest anyway), it would be an efficient way for developers to distribute their binaries.

The most popular package on chocolatey has 700,000 downloads right now. A typical user of chocolatey would have multiple machines and must download multiple version so at best you must have 100,000 people using it in the world (most likely far less). That's a negligible fraction of the windows user base.

</comment></comment></comment><comment><USER47> How the fuck is this not illegal? Oh wait, it is and someone should prosecute CNET. They're gaining elevated access to your computer without your permission. For once, can't the CFAA be used for good?

</comment><comment><USER48> I wish Microsoft would crackdown hard on this, perhaps by make non-trusted root certs an Enterprise/Pro feature guarded by a group policy entry.

I can't understand Google's reasoning in disabling Cert pinning for non- enterprise users either! How do common or garden home users of Chrome benefit from this feature?

</comment><comment><USER49> Google Safe Search, please block the entire download.com domain. That would be hilarious!

</comment><comment><USER50> How are they adding a trusted cert without Windows popping up a warning?

<comment><USER51> because eventually, somewhere in the API there must be a way to actually add that cert. The API that's being called from windows internally when you press the "OK" button on the warning that's normally shown.

And even if there was no API or if you do not manage to find its location: At some point, the certificate needs to be stored somewhere. So you just put it there and be done with it.

You can try and fight this using stuff like OSX' new rootless mode, by making a second class of binaries who are more trusted than others, but even then there will always be ways around it and the backlash would be considerable too (there were some very nasty comments about the introduction of the OSX rootless mode, even though it's turnoff-able).

The only way to prevent this from ever happening is to pre-approve every single app you want running on your platform, but, honestly, that's not a platform I would want to use (not that I want to use Windows anyways)

<comment><USER52> The rootless mood was only a huge pain in the ass because everyone was used to pathing usr/local/bin and brew, probably one of the most popular package managers, relies on a rootful env. Brew was definitely playing with fire and even though it was tricky getting shit to work again, I for one am glad they opted to go rootless at the behest of user convenience. Sometimes foul medicine is the best kind.

</comment></comment></comment><comment><USER53> Is there any way of resetting the list of root certificates?

<comment><USER54> Probably System Restore would, if you have an old enough restore point.

</comment></comment><comment><USER55> install this [https://www.malwarebytes.org/antiexploit/](https://www.malwarebytes.org/antiexploit/)

download instead from [http://www.howtogeek.com/201354/ninite-is-the-only- safe-plac...](http://www.howtogeek.com/201354/ninite-is-the-only-safe-place- to-get-windows-freeware/)

</comment><comment><USER56> This article is one year old.</comment>


Brightcove to acquire ad tech firm Unicorn Media for $49M - <AUTHOR> http://www.bizjournals.com/boston/blog/techflash/2014/01/brightcove-once-unicorn-acquisition.html

<comment><AUTHOR> Got missed in the downtime yesterday. Interesting since Unicorn's tech allows ad stitching in RTMP streams and they have some pretty interesting patents around the technology.</comment>