Maximizing Income as a Software Engineer - <AUTHOR> https://ourmoneymentality.com/how-to-maximize-your-income-as-a-software-engineer/ <comment><USER2> I find there is more and more of a focus on making $$$ by working in tech and honestly I find it kind of sad. There are so many YouTube videos that treat dev roles as a gold rush - spend x hours learning DS/A and you'll earn > $100k. Learn Swift to make side projects to retire by 30 etc.

I imagine if you read this comment it doesn't apply to you (you care enough to be on a forum about tech) and I realise you can do both - enjoy tech and want to earn more (which is fair, I do too). But seeing Tai Lopez style adverts on YouTube about learning JavaScript and React is just sad and negatively impacts our field.

As Alan Kay said on another thread, he and his contemporaries worked at Parc because it was "their calling" and only one wanted to make money. Nowadays the focus sadly seems to be comp first and passion second.

Edit: Just went to watch a video and had a recommendation titled "Java, Python, PHP, JavaScript, C++, C#... WHO MAKES MORE MONEY?". Point, I think, made.

<comment><USER3> I feel you bro, the struggle is real, it's a shame not all dev jobs are as inherently interesting as those at Xerox Parc in the good old days. If you enjoy tech, sometimes the best option is to code for the $$$ during the day and enjoy yourself coding at night. Same thing goes if you want to be a marine biologist, you'll first have to be a millionaire and then you can study the asexual reproductive cycle of micro organisms at the bottom of the ocean.

<comment><USER4> Another way to be a marine biologist is to draw cartoons :-p

[https://en.wikipedia.org/wiki/Stephen_Hillenburg#Early_caree...](https://en.wikipedia.org/wiki/Stephen_Hillenburg#Early_career)

</comment></comment></comment><comment><USER5> So there's a "Make Work/Life Balance Key" section with no argument as to how that maximises income and the very next section is "Always Be Working on a Side Hustle". What?

> A side hustle can provide supplemental income while providing you security > if something goes south

What kind of money-making side-hustle can layer on top of a 40-50 hr/week job and _not_ negatively impact work/life balance? Pretty unconvincing.

<comment><USER6> I agree. Depends on the situation: if you are single and by life you mean going out, dating and having some trips then it's one thing. If you are married with children, especially young, I think the side hustle is a no-go.

</comment></comment><comment><USER7> In my experience, the best ways to maximize your income as a software engineer are to job hop, study data structures/algorithms, and learn how to market yourself. Companies rarely reward engineers who stay put.

<comment><USER8> > In my experience, the best ways to maximize your income as a software > engineer are to job hop

Until you find a good situation and stick with it. A good situation shouldn't be discarded on a whim.

<comment><USER9> Sure, but continuing to job hop will still get you more compensation more quickly.

<comment><USER8> When you're in a good situation you're usually around the top of your pay grade.

<comment><USER10> And when you're among the top most respected and authoritative persons in the room, it is usually a sign that you should be moving on to a different room or company to get better experience / skills.

<comment><USER8> And in such a situation, if you're highly compensated because you've job hopped, moving on to get a better experience or skills might mean that you have to take a pay cut. No one's stupid enough to pay a job hopper well above market value.

Edit: Furthermore, there's a well-defined career track for job hoppers, it's called being an independent contractor. You know what you're worth and you set your rate, and it's generally assumed that you know how long you're going to stay in a position when you start, and you only accept positions that are the length you want.

</comment></comment></comment></comment></comment></comment><comment><USER11> Practice negotiating.

The article says it and I fully agree, you need to be able to verbally stand your ground when time comes to discuss your compensation.

As a CTO, I have seen first hand that overconfident amateurs can pass the external HR tests and an interview with my CEO just fine. And then I'm left dumbfounded during the technical interview because our $200k annual engineering candidate cannot explain what threads are, despite claiming 5 years of experience building multithreaded systems.

Also, I did get bitten by the American way of doing business where everything that isn't written in a contract or the companies financial books isn't worth anything. Never do gentlemen's agreements with US companies.

Oh and there's one very easy lever if companies are unwilling to pay your full price: you just work less. Offer them 20 hours a week for their suggested monthly rate and then a month in you can ask if they would like to increase your working hours. At that time, you can then say "I'm sorry I cannot work for less per hour than before"

So basically it's all negotiation. If you are truly skilled, almost nobody will offer you a fair price right away, because all of them have been burned by overconfident amateurs. But imagine how you'd feel if you notice a year in that your incompetent coworker is making twice your salary. Being paid highly will also automatically grant you decision power and respect.

So no matter what else you do, practice negotiating. It's the single most important skill, assuming that you're generally capable at your job.

And good people skills will also spill over to all other aspects of your life, like getting laid.

</comment><comment><USER10> Upon reading this article, I came to the conclusion that there is nothing particularly special about these points except arguably the second to last point - don't these points apply for anyone in any corporate job? For the exception point, many professions simply cannot pursue a side hustle that can really pay off because their day jobs consume them by nature of their profession being such like doctors, so software engineers have some leeway in theory. Sure, many doctors do have side hustles and passions, but they almost always intersect with their profession in some way. Most of my side passions take almost zero knowledge or experience with software, yet people will probably not care unless I explain what I do for a day job with the social proof of competence that brings with it.

<comment><USER12> I don't really agree with the promotion advice. You simply have to assume that the only way to get a promotion in a reasonable timeframe is to leave the company and get the title increase in a new job.

> Negotiate In The Beginning and Never Take A Companies' Word As Payment

More people than you would expect need this advice.

In addition, I have to lecture people that you want to have a higher _starting title_ because that gives you a higher top end to your salary band for raises without needing a promotion.

The _ONLY_ point at which you have leverage over a company is before you take the job. You don't have to rake them over the coals for every single penny, but you should know what you are worth and negotiate for it.

I will also say that if you are working with a smaller company, you might want to apply some creativity to your negotiation. Maybe they can't match your salary numbers, but they could give you twice or thrice the paid vacation (that has value). Or, they may not be able to pay you a cash bonus, but maybe they can provide you with something (services, products, reimbursement for domestic help, foreign travel to conferences, etc.) because it comes from a different budgetary bucket.

But, as always, get it in writing.

</comment></comment><comment><USER13> There is an age old tradition among programmers: once they have a couple of years of experience they decide to start a blog to explain to everyone all this exciting stuff they know. They believe that all you have to is be smart and think about things and it's reasonable to start telling other people how to do it, even while having little to no track record and only having done it themselves for a short time in a single narrowly specific context (or in this case probably never).

This person is an entry level software engineer. There is basically no reason to think they can give any kind of insight into how promotions and raises work, since they've never been in the room making decisions about promotions and raises. The advice in this blog post boils down to "if you want a raise, 1. try to get promoted, 2. negotiate for more money, 3. try to get promoted, 4. work life balance, but then unironically 5. when you aren't at work, always be doing different work and finally 6. if this advice doesn't work for you it's your fault"

It's cute.

<comment><USER14> I'm still happy people are writing about these things and that's making conversations happening. What he described could happen to anyone at any level.

</comment></comment><comment><AUTHOR> Hi all - author of the post here! I'm not 100% sure why the post was flagged, but I did want to drop by and thank everyone who commented - both positively and negatively. I thought it'd be interesting for people to hear my story and get another perspective on a dev career. I do apologize to anyone who felt it didn't live up to their expectations. I think some of the ideas are obvious to some people, but definitely not all (like myself). Like all things, I'll use your feedback to improve my writing and keep on iterating. Have a great day today, everyone :)

<comment><USER15> It shouldn't have been flagged - it's on topic for this forum.

What HN needs is a downvote button for stories, because flagging is extremely misused.

<comment><AUTHOR> Thanks for the feedback. This was my first HN post and I wasn't sure if I had broken some forum rule. That's good to know.

</comment></comment></comment><comment><USER16> I got lucky at a startup and ended up with stock currently worth around $1.3M though could see it doubling the next round. I'm not that motivated career wise though and in some ways having a nest egg that could likely stretch into retirement at a relatively young age is a bit demotivating oddly.

<comment><USER13> The value of a thing is defined as the amount you can sell it for. Valuation based on fundraising rounds is not how much you can sell your stock for.

Your stock may be worth a lot more if/when it is finally liquid, but it is _much_ _much_ more likely that it will be worthless. There are many ways that your shares can end up worthless while the founders (or more likely investors) of the company cash out millions of dollars. Be careful to avoid being dependent on that stock in how you plan your finances.

<comment><USER16> I've already cashed out some in a company sponsored secondary round, so there's definitely a market for it. Again, I got lucky, and the company is actually doing well from what I can tell (haven't worked there for a number of years now)

</comment></comment></comment><comment><USER17> My opinion is that switching jobs is always the strongest way to increase salary.

I don't know why, maybe human nature, but it seems that compensation for new hires is more competitive than internal salary increases.

That said, other compensation like stock and espp can dwarf your salary if you're at a growing company.

<comment><USER18> The reason is fairly straightforward. Companies get more bang for their buck with new hires. They can pay 20k to get a new hire. Or they can pay their entire staff 20k more each to reduce their turnover by one employee.

<comment><USER19> It still doesn't make a lot of sense. There's a lot of risk in a new hire because you can only vet them so well. On the other hand you know how good your current employees are and they have very valuable internal knowledge you couldn't pay for if you wanted to.

<comment><USER18> Sure, improving employee retention is better than improving employee acquisition, but it's not 10x better. Each dollar just goes so much farther towards acquisition than retention. Basically money is a more important to people when they decide which job to take than when they decide whether or not to quit.

</comment></comment></comment></comment><comment><USER20> Is the goal to maximize your income? It seems like if that's the goal and you are playing to win, you might make a lot of questionable choices to get that win

Not speaking about the article, just in general. Eg, there is an article about jp Morgan and climate change on the front page too

<comment><USER21> I find this a little pedantic. If someone talks about maximizing their salary, it doesn't mean literally maximizing it at all cost. If someone tells you that they're interested in maximizing their income, it means that they'd like to take steps to increase their income, not that they've lost all of their morals or any other goal in life to do so.

</comment></comment><comment><USER22> Imho, the best way to be high paid is a social activity. Nowadays most parts of companies try to find someone who has good references somewhere. Taking part in conferences or having a good place in competitions(I am from data science domain), or writing interesting open-source project can give you more money than working hard hours

<comment><USER23> > good place in competitions(I am from data science domain)

Do people actually commonly care about that these days? Good papers / leaderboard positions on shared tasks I get in data science but competitions as in Kaggle et al? My brain defaults to interpreting that as "had time to waste working for free, for whoever put up that competition". Seeing that in an application package has about as much influence for me personally as some random certification.

</comment></comment><comment><USER24> Simply "being promoted" won't work past a certain point. You will get called out in competitive workplaces if you don't have actual skills. Yes, having an aggressive personality can get you promoted. In my opinion the best was to maximize your income is to work hard building real skills and then join a top, high potential company as a highly experienced/expert hire

Also the grind is painful. You're better off minimizing your expenses (low CoL) and living on a modest wage in my opinion

<comment><USER25> The problem is ... where to go once you do this? Let's say you get (very) high wage sorted. Not C-level, so close to $200k, and over a long time it'll go to $350k. You get some side income through the stock market and property (which as it turns out was the right choice: property works better with $ (because mortgages have ridiculous leverage and are very low risk), stock market works a lot better with $$$, and there's a large space in between where property matters only in that owning the place you live in helps a lot). You do the tax optimization (which matters more and more the further you get, and starts being the main factor at a surprisingly "low" wage. I guarantee that anyone making $100k can make more with tax optimization than with a promotion).

But promotion, even in the very best of places, with quite good taxes, has very diminishing returns. A promotion takes new skills, more work, and let's say a 10% bump in salary (higher percentage increases seem to only happen at the low end. I got a 180% wage increase at one point but now that would be ridiculous). I mean I guess there's the executive promotion but I have no idea how people get that. These executives certainly aren't smarter or more effective than I am, so ... There comes a point, surprisingly low (let's say $200k a year), where chasing promotion is just not worth it, as a 10% before tax raise will only get you 2-3% actual more money. And generally speaking even the $350k or so I'll eventually probably get to will only get me $60k or so more income.

I get the impression the only real way up at this point is starting a company, or at least starting to work for a company I have significant ownership in. Plus I fantasize it comes with more independence (although I lead teams now for more than a decade. Any illusions of control you have as a TL or manager didn't really survive). Truth is that I'd be surprisingly strongly affected if I were to get fired, and while I've always been able to find a new higher paying job rapidly (I left a lot of jobs early in my career because I found something better. "A lot" is about 6 btw, over now 17 years, not counting effective job changes while consulting), and I hate the risk this represents. I also don't think that'll happen, but there are certainly circumstances that would cause just this.

So starting a company. Something. But how to do that?

<comment><USER26> Sounds reasonable. Except for the 'more work' part? I don't have any evidence that management works any harder than Engineering.

</comment></comment></comment><comment><USER27> What about becoming an expert at some niche technologies, writing prolific open source software contributions, and getting contracted as a highly paid consultant to guide the implementations in other company's products?

</comment><comment><USER28> Instead of this, how about writing something titled "How to maximize life satisfaction and happiness as a software engineer"?

<comment><USER29> That's much more difficult, because you can't stick a number on those things. I agree they're important, though.

</comment></comment><comment><USER30> The other option is lowering your expenses -- for example, working remotely in a city where your rent is much cheaper.

<comment><USER31> The income penalty you incur when you restrict yourself to remote only jobs generally vastly exceeds the 30k/year or whatever you save on rent by moving somewhere cheap.

Unless your current spending is extremely reckless, cutting expenses typically makes less of an impact than increasing income. If you currently spend 60k, you cannot cut your expenses by more than 60k, but you can definitely increase your income by more than that if you manage your career properly.

<comment><USER14> Generally that high rent is an opportunity cost. Saving 3k/month by living in rural Wyoming instead of NYC when you're in your 20s is not desirable unless you want to be a really sad person with no friends.

</comment></comment></comment><comment><USER32> The takeaway is that you are responsible for your career. Not the company.</comment>


China Concealed Extent of Virus Outbreak, U.S. Intelligence Says - <AUTHOR> https://www.bloomberg.com/news/articles/2020-04-01/china-concealed-extent-of-virus-outbreak-u-s-intelligence-says <comment><USER2> While im extremely skeptical of China's numbers (by default it's safer to assume that all known case counts in any country are well off the real numbers of cases that haven't been counted) China did use far harsher measures to stop spread (the biggest, most total quarantine of hundreds of millions of people, applied in just weeks), while the U.S has so far not done that or anything close to it, and was very slow even to react to the extent that it has so far.

This could thus partly be a case of accusing the other side of lying because you look so bad that blame needs to be spread around even if they did things differently to mitigate their situation better (maybe).

Also, China published the vast majority of major case growth/death figures before they (or anyone else really) knew just how bad things would get in Italy, Spain and other countries, yet their mortality rates more or less match a certain global average (they're in fact a bit worse than average) so why would they have lied in such a specific but also partially statistically realistic way? Why not publish less cases and lower death figures if they were going to lie their asses off anyhow?

I don't think they're telling the truth, especially about total known cases and total deaths, but maybe they didn't conceal quite as badly as claimed, and harsher measures partly explain the differences in numbers between the U.S and China.

Most of all though, it's important to know if whatever concealment they did also distorted: 1. claimed mortality RATE, and 2. if the spread of the virus has been more or less contained finally, as they claim it has. These two are the most important things, more important than actual numbers being off by some margin or another.

<comment><USER3> If they do collect actual numbers but report much lower numbers it should not be too difficult to give realistic ones. Right now the Chinese state media is making a huge effort to paint the virus as a 'foreign' issue, claiming that there are now no new local infections but rather just infections brought in from abroad. This is rather obviously absurd, but it's also obviously an effort to shift blame while claiming a high ground. The Chinese leadership can pretend competence and blame others for any fault - pretending that it wasn't them that started the whole mess to begin with.

India (of all countries) had a severe virus outbreak a few years back - immediately local doctors reported it, containment measures were in place and the case numbers stayed somewhere around two hundred. China had the same, but arrested whistleblowers, officially denied everything and only admitted things when the scale and spread was so bad that it couldn't anymore be denied. Still we don't know the true scale and numbers and never will.

<comment><USER4> How is it "obviously absurd"? We've been the ones lamenting that China's been going full dystopia "welding people inside apartments" all the way back in January.

Also for those who read beyond the title:

"the U.S. intelligence community concluded in a classified report to the White House, according to three U.S. officials.

The officials asked not to be identified because the report is secret, and they declined to detail its contents."

And here I am still waiting for Bloomberg to write the other half of their supermicro chip story.

</comment></comment></comment><comment><USER5> "Let him who is without sin cast the first stone."

It's a little too convenient that the US blew so many weeks of lead time in getting mass testing running. We don't need to suppress information about our virus outbreak when we simply don't have data about it. We literally would've had a better response if the CDC didn't exist at all and individual states weren't impeded from running their own tests. The Seattle Flu Study was explicitly forbidden from testing for coronavirus, and their refusal to obey that order on ethical grounds was probably the reason that they're not suffering New York's fate right now.

Not to absolve China here, but it's a classic sin of nations to hide epidemics (see "Spanish Flu") and they probably aren't even the most egregious sinners today.

<comment><USER3> How come European Union countries, South Korea and Taiwan weren't hiding the issue then? They were unaware of the scale for a while, but even Italy did not try for a minute to hide it. Hiding or denying an epidemic is really something that only dictatorships do.

<comment><USER5> I think the degree to which countries hide their numbers matches the degree to which they're authoritarian (or simply corrupt). North Korea sets the bar, with "zero" cases. Russia has suspiciously low numbers. Japan, surprisingly, is not doing well in this area. I think Japan early on was hell-bent on having their olympics happen regardless of the consequences, and their people are going to suffer for it.

<comment><USER6> > Russia has suspiciously low numbers.

The virus simply freezes and won't infect in Russia /s

<comment> blaser-waffle I'm in Canada and we have surprisngly few cases where we are, relative to the population size (Edmonton). We've had snow and a cold snap, which is definitely keeping people inside.

I don't doubt that Russia is downplaying their cases, but I can absolutely believe that the cold is making people self-isolate, and thus keep infection down.

</comment></comment></comment></comment></comment><comment><USER7> Not even that, but the WHO was forced to give critical information to China and was not allowed to communicate with Taiwan.

Taiwan handled it very well luckily! They never had any information from China and that helped them more than us who had "access" to that information, probably faulty info none the less.

What an absurd situation.

It's becoming more clear that the WHO was misled by the "positive news" from China and based a lot of guidance on that.

While the Western world gets infected, the virus gets real numbers eg. Infection rate, mortality, ...

If it wasn't clear that Taiwan is a seperate country before, it should be now.

</comment><comment><USER8> As a modeler, in a field unrelated to pandemics and epidemiology, my first reaction was that the estimates of CRF, IFR and R0 are going to be wrong. Which in turn is going to produce wrong estimates from all the models.

First, they did not shutdown the wet markets which they should have right after SARs, then they concealed the outbreak for weeks or months and now they are lying about the numbers.

How can the Chinese government keep doing this and think they are going to keep getting away with it? They are willing to invest 100s of billions in One Belt One Road to project power but this takes down their credibility by many notches for vast swathes of people around the globe.

</comment><comment><USER9> "Conceal" implies intent--while I do not believe the Chinese numbers I do not think it's malicious, but rather an overwhelmed system. We are seeing the same thing everywhere the system is getting hit hard enough--patients are dying without ever being tested, and they're only testing the people at the hospital, thus missing most all the mild cases.

The only places I would trust the numbers are South Korea, Taiwan, Singapore and Israel.

<comment><USER3> China is literally claiming zero new infections while reports from the affected regions tell a very different story. How is that not an obvious effort to conceal the issue?

<comment><USER10> What reports?

China reported 36 new cases yesterday, all but one are people returning from overseas caught under quarantine, and whenever there is sporadic local transmission, they tighten control in that area obviously while the country at large has returned to work.

[https://www.scmp.com/news/china/society/article/3078010/chin...](https://www.scmp.com/news/china/society/article/3078010/chinese- county-goes-coronavirus-lockdown-country-tries-get-back)

</comment></comment></comment><comment><USER11> What did the CIA or NSA been doing in the mean time with all that budget ... aren't they supposed to be informed of all things affecting national security around the globe ???.

Did they really expect that an adversarial superpower would admit to the scale of their problem ... the US should have been way better prepared.

<comment><USER12> I am sure they did provide detailed analysis, the issue is we have a president that is not intellectually curious or concerned with information -- instead he believes in his "gut feelings" over all else (and has said as much when talking about how he views intelligence services).

<comment><USER11> Also the political cronies with no clue appointed after the good people with all the experience left because they disagreed.

</comment></comment></comment><comment><USER13> Clearly the west dropped the ball in important ways, but guidance from the WHO was certainly bad and seemingly deferential to China and its reputation. But if there's evidence the data and reporting is "concealed," on top of the clear silencing of doctors (Ai Fen and others), this is egregious.

</comment><comment><USER14> First of all, nobody knew what it was, what it did and what it could do when it first hit. No one said, "oh, this is the coronavirus COVID-19, and this is the test for it." All this had to be discovered as it got worse.

I want to know why this pandemic blew up right after the mysterious vape flu in August last year that has the exact same symptoms as COVID-19 and why this flared up in Wuhan after soldiers from all over the world, about 200 from the US, were in Wuhan for the World Military Games.

Wet markets and exotic meats are all over China. Why did it just start in Wuhan?

</comment><comment><USER15> It is painfully obvious that china concealed the beginnings of the outbreak, no matter your personal political beliefs, or nationality.

To assert anything else, particularly under the guise of (so and so also did this), highlights your comment as insincere. Lets keep the politics out of HN.

<comment><USER16> It's also true that many if not most countries have been reluctant to face up to the scale of the pandemic. It remains to be seen whether the Chinese government's obfuscation will turn out to be more or less damaging to the overall response than the inaction of other governments. We're a long way from the end of this episode.

</comment></comment><comment><USER17> Typical techniques used by "professional" "journalist" to cover up and diverge the real issue, which is the incompetency of the US government.

You see when you fail at something, isn't it easy to blame someone else, rather than looking at yourself?

And REMEMBER these journalists are PAID to write.

And YOU, the reader, are only able to comprehend what you are prepared to hear.

</comment><comment><USER18> Worth pointing out that China's on the ground response was light years ahead of ours in the US. Faster, more coordinated, more robust, calmer..

</comment><comment><USER19> Assuming this is correct, what is the estimated death toll in China due to COVID-19, preferably from a reliable source ?

</comment><comment><USER20> I'm curious what actual infection and death rates are in China- there seems to be no mentioning in the article. Given what is happening in Italy and Spain, its probably horrible. :(

</comment><comment><USER17> How come Korea had it under control so quickly, "given" that China "obviouly" "conceled" the information?

Blame blame blame...more blame

</comment><comment><USER18> US mounting hybrid warfare

</comment><comment><USER21> does anyone take US intelligence seriously any more? seems we have a fairly reliable years-long evidence trail that says it might not be worth it any more.

either they're legitimately incompetent (tons of sabre-rattling about the China "threat" yet no intel operations; likely hasn't been rebuilt after China publicly executed tons of spies [quite an effective deterrent it seems]) and they're saying as much here, or they're just deflecting outrage on an external entity doing typical IC stuff, which is complete noise.</comment>


Google Images API + Google Translate API = World Images - <AUTHOR> http://jamiealexandre.com/worldimages/ Search for something, and it is translated into a variety of languages, then these translated phrases are searched for in Google Images, restricting searches to the TLDs for each target country. <comment><USER2> your work is impressive. can you show the keyword in various language in the countries wrappers? that makes it more instinctive, i guess. and would like to see arrows in each country wrapper allowing me to navi to more pictures. just my two cents

<comment><AUTHOR> Thanks! So, it does show the translated keyword in the title of each wrapper (right after the country name). Maybe it needs to be more obvious -- or did you mean something else?

Yeah, allowing people to view more images would be good. Maybe just make each row of images draggable, and load more as you drag the row to the left?

Thanks for the input!</comment></comment>


Enterprise-class cloud-backed storage systems - <AUTHOR> http://storagemojo.com/2014/04/08/avere-makes-cloud-nfs-fast-safe-for-the-enterprise/

<comment><USER2> Why would one ever put their enterprise storage in the cloud?</comment>


Heap overflow bug in OpenSSL - <AUTHOR> http://lists.grok.org.uk/pipermail/full-disclosure/2012-April/086585.html <comment><USER2> FYI OpenSSH's sshd is not vulnerable, despite using OpenSSL. Back in 2002 and after a different ASN.1 bug, Markus Friedl observed that RSA verification used the OpenSSL's full ASN.1 parser to parse PKCS#1 RSA signatures despite them having an almost entirely fixed format under the parameters used in the SSH protocol.

He wrote a minimal RSA signature verification implementation that we've used ever since. This is the eighth bug that it has saved us from in the last ten years.

Attack surface reduction works.

Note, other parts of OpenSSH are vulnerable - specifically private key loading. So, if you allow untrusted users to supply private keys to ssh, ssh- add or ssh-keygen running in a privileged context, then you should patch this bug ASAP.

<comment><USER3> While having a minimal signature verifier is good, you wouldn't have been hit by this bug in any case. This only affects parsing from a BIO or a FILE, and the OpenSSL RSA code parses the signature from memory.

</comment></comment><comment><USER4> ASN.1 is a ludicrously complicated format for what it does.

Its designers added all sorts of ways to save a few bits here and there by creating optional special cases to be handled in the encoders and decoders.

This makes complicated code with lots of edge cases for bugs to hide in, Cisco SNMP implementations were notoriously savaged by this. Ironically, it also requires lots of branches which slow down modern processors more than just reading the bits.

Fortunately most uses of ASN.1 have died. SNMP and SSL are still using it. It's not 1984 anymore, let it die.

<comment><USER5> Actually, all of the SNMP implementations were savaged by ASN.1/BER implementation bugs: the format is so poorly understood that virtually all of them derived from the same code.

There is a trick to ASN.1/DER encoding that gets it down into the hundreds- of- lines- of- code range (you get the whole document in memory and serialize/unserialize it backwards). I once wrote a program that converted arbitrary ASN.1/DER/BER buffers into a shell script that regenerated the same. It's not as complicated as it looks, but it's idiosyncratic and you have to think about it a specific way.

That said: I agree, it should be scorched off the planet with fire.

<comment><USER6> How do you go backwards? You don't know the length of the last element/position of the last tag unless you work forward from the front, as far as I can see.

BER is complicated, but no more complicated than rfc-822 style headers, which are also poorly parsed by ad-hoc parsers, and were a wide source of vulnerabilities.

</comment></comment></comment><comment><USER7> Mark Dowd found this bug and described it in The Art of Software Security Assessment (TAOSSA) in 2006. lawl.

<https://twitter.com/#!/mdowd/status/192986878138523648>

Here's the actual page: <http://i.imgur.com/vPjOR.jpg>

</comment><comment><USER8> Sample emergency bump for Gentoo:

 __Firstly and most importantly: check[http://sources.gentoo.org/cgi- bin/viewvc.cgi/gentoo-x86/dev-...](http://sources.gentoo.org/cgi- bin/viewvc.cgi/gentoo-x86/dev-libs/openssl/ChangeLog?view=markup) to see whether the Gentoo developers have already bumped OpenSSL in the official repository. If so, ignore everything below! __

    wget -O /usr/portage/distfiles/openssl-1.0.0i.tar.gz http://www.openssl.org/source/openssl-1.0.0i.tar.gz
      chown portage:portage /usr/portage/distfiles/openssl-1.0.0i.tar.gz
      chmod g+w /usr/portage/distfiles/openssl-1.0.0i.tar.gz
      mkdir -p /usr/local/portage/dev-libs/openssl
      cp /usr/portage/dev-libs/openssl/openssl-1.0.0h.ebuild /usr/local/portage/dev-libs/openssl/openssl-1.0.0i.ebuild
      cp -R /usr/portage/dev-libs/openssl/files /usr/local/portage/dev-libs/openssl/
      ebuild /usr/local/portage/dev-libs/openssl/openssl-1.0.0i.ebuild digest
      emerge -1q =dev-libs/openssl-1.0.0i
      shutdown -r -t 0 now

Skip the first 3 commands when mirrors have the latest OpenSSL tarballs.

Preferably skip the last command and manually restart daemons that rely on OpenSSL. I have used the drastic example of restarting the entire server in case someone blindly follows the above commands without thinking it through carefully.

Note that openssl-1.0.1* is currently masked in Gentoo ~amd64. If you have it unmasked, it should be easy to adjust the above commands to use openssl-1.0.1a instead.

</comment><comment><USER3> The OpenSSL advisory contains details of the problematic functions, which are considerably smaller than the full set of ASN.1 functions:

<http://www.openssl.org/news/secadv_20120419.txt>

<comment><USER8> To get an idea of which packages may be affected (try different functions for more results):

[https://github.com/search?q=d2i_X509_bio&type=Code](https://github.com/search?q=d2i_X509_bio&type=Code)

<http://www.koders.com/default.aspx?s=d2i_X509_bio>

Examples of impacted software include Android, Apache HTTPd (mod_ssl)[1] and Ruby. To reiterate what you've already stated elsewhere in this discussion, software shouldn't have a need to call these functions to validate certificates provided by remote clients. Users of email clients making heavy use of S/MIME and administrators managing PKI (signing, revoking, etc) may need to apply caution.

[1] See line 99 at [https://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/...](https://svn.apache.org/viewvc/httpd/httpd/trunk/modules/ssl/ssl_util_ssl.c?view=markup) where Apache tries to load a PEM formatted certificate. If this fails, Apache tries loading the file as a DER+Base64 formatted certificate or as a last resort, just DER (both which use the vulnerable d2i_X509_bio function). Given that the PEM format is the standard that most Apache administrators are using and injection of vulnerable certificates and keys usually requires root permissions, Apache/mod_ssl users can probably treat this vulnerability as a non-issue.

<comment><USER9> What about HTTP SSL Client Certificates; i.e. what if a "browser" (attacker) simply includes a bad SSL Client Certificate in a request?

</comment></comment></comment><comment><USER5> This looks pretty bad. The canonical bit of untrusted ASN.1/DER information most systems deal with: SSL certificates. In particular, all OpenSSL-based SSL client software (Ruby and Python HTTP libraries), and web applications that use client certificates for authentication.

When Tavis Ormandy says "textbook heap overflow", patch fast.

<comment><USER3> Parsing from PEM isn't affected, nor is parsing of SSL certificates in SSL because libssl doesn't use the BIO functions.

It's mostly users of OpenSSL who are calling d2i_XXX_bio or d2i_XXX_fp.

<comment><USER5> Rats, you're right. I should stop commenting 15 minutes after I wake up.

</comment></comment></comment><comment><USER8> Tests against some commonly used software that make use of libssl to load certificates from disk (or perhaps a socket in strange circumstances):

php-5.4.1RC2 (and php-5.4.0): potentially affected _(one match for d2i_PKCS12_bio)_

      tar -xjOf /usr/portage/distfiles/php-5.4.1RC2.tar.bz2 | grep d2i

nginx-1.1.19: probably safe _(1 match for d2i_SSL_SESSION)_

      tar -xzOf /usr/portage/distfiles/nginx-1.1.19.tar.gz | grep d2i

postgresql-9.1.3: probably safe _(no matches)_

      tar -xjOf /usr/portage/distfiles/postgresql-9.1.3.tar.bz2 | grep d2i

postfix-2.9.1: probably safe _(one match for X509_get_ext_d2i and d2i_SSL_SESSION each)_

      tar -xzOf /usr/portage/distfiles/postfix-2.9.1.tar.gz | grep d2i

dovecot-2.1.4: probably safe _(3 matches for d2i_DHparams, 1 match for X509_get_ext_d2i)_

      tar -xzOf /usr/portage/distfiles/dovecot-2.1.4.tar.gz | grep d2i

<comment><USER10> In most cases these packages should be loading libssl as a shared library. Simply updating libssl to a fixed version would solve the problem for all of those instances.

</comment></comment><comment><USER11> The commit is here if you want to see what they did to fix it: <http://cvs.openssl.org/chngview?cn=22447>

</comment><comment><USER12> apparently, this was published in 2006: <https://twitter.com/mdowd/status/192986878138523648>

</comment><comment><USER13> Could this be used maliciously to, say, gain access or control of an affected system, or to subvert certificate checking? Or is crashing the process that's using OpenSSL the worst it could do?

<comment><USER5> If you are using the affected ASN.1 functions and you are feeding them attacker-controlled ASN.1 data (say, SSL certificates during user configuration), it is likely that attackers will be able to run their own code in your programs.

You are _probably_ not using the affected functions.

<comment><USER13> Am I right in thinking that would involve taking advantage of the memory corruption to inject code by using an appropriately constructed cert?

<comment><USER5> Yes, but read 'agl's comments carefully: the systems impacted by this are going to tend to be ones that do special-case configuration of SSL certificates. We're not talking about browsers and (for the most part) web servers here.

A hypothetical future Github feature that allowed users to upload SSL certs in lieu of SSH keys might have to review their code to make sure they weren't using OpenSSL BIOs to read certs from (or just patch).

You should patch anyways. From now on, professional security assessments are going to doc this version of OpenSSL as a vulnerability.

<comment><USER13> Oh, I'm not using OpenSSL professionally - I'm pretty much just a curious amateur when it comes to computer security.

Good to know I've not got anything to worry about personally, though. You've explained it well.

<comment><USER5> Adam Langley's the one who did the real explaining on this thread; thank 'agl. :|

</comment></comment></comment></comment></comment></comment><comment><USER14> 9th vulnerability in 2012.

</comment><comment><USER15> Is this likely to have any implications for users of OpenVPN?

<comment><USER8> Yes.

wget -q -O - [http://swupdate.openvpn.org/community/releases/openvpn-2.2.2...](http://swupdate.openvpn.org/community/releases/openvpn-2.2.2.tar.gz) | tar -xzO | grep d2i

      if ((eku = (EXTENDED_KEY_USAGE *)X509_get_ext_d2i (x509, NID_ext_key_usage, NULL, NULL)) == NULL) {
      if ((ku = (ASN1_BIT_STRING *)X509_get_ext_d2i (x509, NID_key_usage, NULL, NULL)) == NULL) {
      p12 = d2i_PKCS12_bio(b64, NULL);
      p12 = d2i_PKCS12_fp(fp, NULL);
      cert = d2i_X509(NULL, (const unsigned char **) &cd->cert_context->pbCertEncoded,

<comment><USER16> Strictly speaking, yes it is likely to have some implication(s).

I think more importantly is whether it is likely to allow a server to be remotely exploited. The answer to that is "probably not", and "very likely not" if using OpenVPN's tls-auth option. At least as far as I understand the issue.

Also, <http://article.gmane.org/gmane.network.openvpn.devel/6309>

</comment></comment></comment><comment><USER17> I suppose it could not derive to arbitrary code execution, isn't it?

</comment><comment><USER18> Lengths should always be unsigned.

Always.

I'd even say they should always be uintmax_t in C.

<comment><USER2> Please explain how a string length would need more than size_t to represent it.

<comment><USER18> This is largely theoretical but still.

Smart programming languages have bignum integers and seamless promotion between fixnum and bignum versions. Thus they avoid the issue completely, no stupid casts (especially casts which change both signedness and size), no overflows, no nothing, just an integer length.

It's a perfect world and everyone should try to achieve it.

C is not such programming language, with the closest approximation being uintmax_t.

size_t is of course enough in practice.

<comment><USER19> Even for fixnums, integer overflows and underflows of any kind should ideally result in an exception by default. I think it's a pity that C(++) doesn't have support for this. A lot of bugs and weaknesses could have been prevented (for example, CWE 680 <http://cwe.mitre.org/data/definitions/680.html>).

I know this decision (to simply wrap around in the case of an over/underflow) was probably performance-driven, but on the other hand, if the common languages had required it, CPUs would have better support for it...

Edit: Some googling shows that Microsoft has a SafeInt class in common use that reports under/overflow: <http://safeint.codeplex.com/> . Still it feels like a kludge for this to be not part of the main language.

<comment><USER20> (Hint: gcc has a -ftrapv option, which traps on signed integer overflow. Unsigned overflow _is_ defined, so trapping on that would break working code.)

<comment><USER19> I don't think I'd necessarily want to trap on all (signed) integer overflows. As you say, it might break working code. There's just too much C/C++ code around to change that retroactively. And for modular arithmetic and such it is desirable for integers to wrap around.

But a "trap on overflow" signed and unsigned int type would be nice.

<comment><USER20> Recent gcc versions use the fact that signed overflow is undefined to do some unexpected optimizations (in particular, a + b < a will never be true if a, b are ints.) I don't think -ftrapv is going to cause many additional errors, but I haven't actually tried it. (Also, <http://embed.cs.utah.edu/ioc/> looks interesting.)

<comment><USER21> > (in particular, a + b < a will never be true if a, b are ints.)

Code of exactly that form in the patch for this bug made me do a double take. Fortunately, they'd also changed the a & b from plain ints to size_t, so it was ok.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> Cool Debian will have it in 8 years

<comment><USER23> they already released a fix for it, yesterday.</comment></comment>


The Cray Files - <AUTHOR> http://www.modularcircuits.com/blog/articles/the-cray-files/ <comment><USER2> Given what most of those machines were used for, and their scarcity, this has to be the holy grail of data recovery.

</comment><comment><USER3> I sat next to Neil Lincoln while he booted a ETA 10. Kinda sad that people don't know him. Mr Cray was the shit, Neil was pretty close.</comment>


Equity for All? - <AUTHOR> https://medium.com/@emilykramer/equity-for-all-1ae9ac42679e <comment><USER2> How out of touch can you be?

So her company facilitates equity for tech workers, an industry whose goal is to 'disrupt' all other job markets. They justify this by claiming to empower individual workers. Her unique justification is to empower women in tech specifically.

She does not acknowledge that her company will benefit from this decrease in demand for labor, which will also affect women. She does not consider the countless women in legacy jobs that tech has eliminated, who stay at those jobs even after sexual harrassment, never mind filing suit (something that almost no one except serial executives is equipped to do).

Not to mention her completely unfalsifiable claim that the things she was fired for demonstrate sexism following from nothing other than the fact that she is female.

So she posts a hybrid call-for-cancellation and job posting, so she can hopefully get back to work disrupting asap.

</comment><comment><USER3> I feel like we hear this story so often. I'm not sexist! I just happen to develop personal problems with any woman I work with that wants equal treatment! I suspect this is going to be very difficult to prove in a court though - drawing the line between personal issues and personal issues that are the result of (however subtle) sexism is very difficult.

It's going to be enjoyable to watch the company try and continue their woke marketing strategy whilst being sued by their former head of marketing for sexism though.

</comment><comment><USER4> The story was not too compelling. Are some point I wondered if her ultimate aim was marketing or to achieve equity balance. That's an important difference ... Lack of openness will breed mistrust that can present like this. Also asking for a promotion after one year seems optimistic ... Usually you need three solid years to go up a big notch. Still, several woman close to me have been royally screwed by corps. And when HR has management's back, that nut is very very hard to crack.</comment>


Subscribing to GraphQL events in a React client - <AUTHOR> https://medium.com/naresh-bhatia/graphql-concepts-i-wish-someone-explained-to-me-a-year-ago-3b84203fb0b9 <comment><AUTHOR> You guessed it–the last step, described in Part 7 of my GraphQL series, is to subscribe to events in our React client.

Thanks to the GraphQL and Apollo GraphQL teams for creating this awesome platform! I hope this series helps you apply GraphQL in real projects.

If you found the series helpful, please share it with your fellow developers. Until then, happy computing!

Here's a link back to Part 1 in case you missed it: "GraphQL concepts I wish someone explained to me a year ago" [https://medium.com/naresh-bhatia/graphql- concepts-i-wish-som...](https://medium.com/naresh-bhatia/graphql-concepts-i- wish-someone-explained-to-me-a-year-ago-514d5b3c0eab)</comment>


Nissan vs. Nissan (2008) - <AUTHOR> http://www.digest.com/Big_Story.php

<comment><USER3> Fascinating case. The resolution [1]:

"The case continued to a final injunction which allowed Nissan Computer Corporation to maintain control of the domains Nissan.com and Nissan.net so long as it neither advertised nor mentioned/made disparaging comments about Nissan Motor. Nissan Motor then filed a series of appeals that ultimately resulted in the same judgment in favor of Nissan Computer Corporation."

So Mr. Nissan wins and NissanUSA would probably be best burying the information about this case due to the negative publicity (for their otherwise excellent brand) and the fact that Mr. Nissan is eloquent and persuasive about the rights to his own name.

Perhaps this is a lesson in how NOT to pursue a perceived cyber-squatter?

[1] _[http://www.yalelawtech.org/ip-in-the-digital-age/why- nissan-...](http://www.yalelawtech.org/ip-in-the-digital-age/why-nissan-com- isn%E2%80%99t-a-car-website/*)

<comment><USER4> Read the entire article and timeline. That wasn't the final resolution - <USER2> was appealed and he won the right to do as he wishes with those sites/domains.

</comment></comment><comment><USER5> "I've seen people do worse things to you in corporate settings than i see them doing on the street. They take everything from you" \- 50cent (from the "Champs" documentary)

</comment><comment><USER6> Both sides would be fare better off if they came to out of court agreement and sell domain to Nissan Motors.

1\. This is not usual cybersquating, a legitimate, but far less popular business.

2\. Given Nissan Motors financials, paying few mln USD is a drop in the bucket: [https://en.wikipedia.org/wiki/Nissan](https://en.wikipedia.org/wiki/Nissan)

3\. On the other hand that would be a lot of money for Uzi Nissan.

4\. Spending 10+ years in court is counter-productive and probably already cost several times more in opportunity gains. Both sides losses. Business equivalent of prison dilemma: [https://en.wikipedia.org/wiki/Prisoner%27s_dilemma](https://en.wikipedia.org/wiki/Prisoner%27s_dilemma)

5\. Low-cost meditation. Send each party copy of book: [http://www.amazon.com/Getting-Yes-Negotiating-Agreement- With...](http://www.amazon.com/Getting-Yes-Negotiating-Agreement- Without/dp/B001TI3OFA)

Book a weekend trip to some luxurious place, where each party can get comfortable and try to strike a deal.

<comment><USER7> 1\. Of course it wasn't cyber squatting. Cyber squatting is unlawful in the U.S. and would have lead to a different outcome.

2\. Why wasn't there a settlement? I assume either Mr. Nissan didn't want to sell the domains at any price (unlikely but possible) or insisted Nissan pay eleventy bajillion dollars for them, leaving Nissan with court as their best option.

</comment></comment><comment><USER4> I first saw this back over ten years ago and didn't hear of it again until it popped up on here today. I thought it was an interesting case study in corporate overreach at the time and sort of glad to see Mr. Nissan has prevailed to some degree after all these years. Given his $MILLIONS in legal fees, I would assume he has some strong backers out there somewhere.

<comment><USER8> The guy has run multiple successful businesses, so maybe he paid for it himself. If only the US had a sane legal system (i.e. loser pays), then the poor could get justice too, rather than inevitably losing a battle of attrition.

</comment></comment><comment><USER9> I guess Nissan Motors better change their name now.

</comment><comment><USER10> Interesting that its a Japanese company going after a US company for trademark infringements, its normally US companies going after small local companies.

There used to be a Duff micro brewery in Dunedin brewed by a Mr Duff, and opened in the late 80's before the Simpsons mainstream success (at least in NZ).

There are the breweries of the town of Budweiss in the Czech republic espeacially the beer now known as Budvar vs Budweisser. Even in NZ where they don't sell Budweisser beers brewed in the town of Budweiss are known as Budvar.

</comment><comment><USER11> I've met Mr. Nissan and did some contract work for his site years ago. At the time, he was looking for ideas to turn Nissan.com into a destination website of some sort :)

</comment><comment><USER12> I'd feel more sympathetic towards Mr. Nissan if the nissan.com website was actually being primarily used for a business instead of being plastered with ads.

<comment><USER13> It used to be a computer company, this lawsuit really has forced them to put ads to make ends meet to keep fighting this. You can see the history of the website at WBM[1]

[1][https://web.archive.org/web/19961112111421/http://www.nissan...](https://web.archive.org/web/19961112111421/http://www.nissan.com/)

<comment><USER12> Surely there could be something business-related that would bring in more money than just ads, though?

The most financially beneficial thing that comes to mind for me would be a front-page category of car electronics and other vehicle widgets for online ordering - rear-view camera kits, smartphone car finders, USB cigarette adapters, etc.

<comment><USER14> trademarks are granted per industry.. so although Nissan Computers doesn't infringe and gets to keep the name... if he changes his site to a car electronics site (as you suggest), that may allow Nissan Auto to take him back to court and take the name.

After all, that would be Nissan Computer Corp changing industries to benefit from Nissan Auto's trademark... and that change would have definitely occurred after Nissan Auto was in the market (meaning he has no right to "Nissan" in the auto industry).

</comment></comment></comment></comment><comment><USER15> Random, off topic, question @OP just to satisfy my curiosity - did you find this article following research after reading this comment? [https://news.ycombinator.com/item?id=10030906](https://news.ycombinator.com/item?id=10030906)

My 'deja vu' sense went off having seen the same rather obscure thing referenced twice today, now I notice both that comment and this post were submitted around the same time- I wonder if it's one of those remarkable coincidences or if one led to the other? (I'm assuming if the latter that this post would have followed that comment since commenter seems to imply with 'favourite' that they've been aware of it for longer than 5 minutes)

<comment><USER16> Can't speak for dsr12, but I can confirm your assumption, I wrote that comment before seeing this present submission. Another possibility could be dsr12 read PG's essay and submitted this because he or she thought it was topical, without having read the comments on PG's essay.

<comment><USER15> Cheers!

A stupid aside but just had to know ;-)

</comment></comment></comment><comment><USER17> According to Wikipedia:

      In 1934, Aikawa separated the expanded automobile parts division of Tobata
      Casting and incorporated it as a new subsidiary, which he
      named Nissan Motor Co., Ltd.

This guy knew exactly what he was doing in 1994. There are tons of people with the last name McDonald and I'm sure a few of them thought about starting some rinky-dink shell company to get McDonalds.com. Heck, I remember when it was still available and thought about registering it but I'm just not that sleazy.

</comment><comment><USER18> (Last update 2008)</comment>


GTA V – Graphics Study - <AUTHOR> http://www.adriancourreges.com/blog/2015/11/02/gta-v-graphics-study/ <comment><USER2> Really neat to see a big hairy problem broken up into so many small chunks. Multi-pass rendering, level of detail culling, soft-shadow blurring. It reminds me of the Arthur C. Clark quote that "Any sufficiently advanced technology is indistinguishable from magic". There's a phenomenal amount of processing steps happening here, on a frame-by-frame basis. I feel old thinking of how many hours this type of rendering took running 3D Studio Max back in 2002 on a _network_ of Windows NT boxes.

<comment><USER3> Yup, modern game engines are complex systems with many parts.

Getting nearer to photorealistic graphics [1] isn't just about doing "more of the same and faster" (Moore's Law), it's increasingly also about "division of labor" across many subcomponents.

I like this rendering passes breakdown for Battlefield 4 (there are 54 passes):

[http://imgur.com/N4gJkbm](http://imgur.com/N4gJkbm)

(Frostbite engine by DICE, started as Battlefield franchise backbone, now it's becoming _the_ engine for EA, sharing tech across many games - Battlefield, Dragon Age, Mass Effect, Need for Speed, Star Wars: Battlefront, Mirror's Edge)

\-----

[1] See e.g. here how close to photo sources Frostbite engine can get today (latest Need for Speed game):

[http://static1.gamespot.com/uploads/original/1539/15391776/2...](http://static1.gamespot.com/uploads/original/1539/15391776/2909917-2479418915-Qt2s3.jpg)

<comment><USER4> I will say it took me an uncomfortably long time to determine which pictures were real. The pavement is a pretty good giveaway, but incredible nonetheless.

<comment><USER5> Yeah, they got really good. For the rest - two pictures on the left are from the game engine and two pictures on the right are photographs.

</comment></comment></comment></comment><comment><USER6> This is the third game that the author has dissected. The previous two are also very nice :)

[http://www.adriancourreges.com/blog/2015/06/23/supreme- comma...](http://www.adriancourreges.com/blog/2015/06/23/supreme-commander- graphics-study/)

[http://www.adriancourreges.com/blog/2015/03/10/deus-ex- human...](http://www.adriancourreges.com/blog/2015/03/10/deus-ex-human- revolution-graphics-study/)

<comment><USER7> How does he know so much about the engine internals? Reverse-engineering?

<comment><USER8> He used Renderdoc, which lets you pick a frame apart draw call by draw call, inspect shader bytecode, etc.

[https://github.com/baldurk/renderdoc](https://github.com/baldurk/renderdoc)

</comment></comment></comment><comment><USER9> I love computer science and have been attracted to all aspects of it for years. But I still continue to gravitate towards games and this article reminds me of why. Thank you to the author.

Practical application of cutting edge graphics tech to both make a beautiful image and create an immersive world is so compelling to me. I also really like the tight visual/audio iteration loop games provide for day to day work. It's incredibly rewarding to me to conceptualize how to solve a problem and have a playable prototype in the next few hours that a real player can test.

I can imagine myself working in various fields but I'm always drawn back to games for better or worse. While it's just as likely as a developer you'll incite gamer rage with some small mishap there is also the opportunity to make a piece of entertainment people love and remember. That's the goal I keep striving for in my work.

<comment><USER10> It's nice to see an honest, positive post about the game industry on HN.

</comment></comment><comment><USER11> > "I believe this mode is used for meshes very far away or transitioning > between LOD levels, it allows to save on fillrate and shading calculation by > discarding certain pixels."

I think this is a better answer for why they use checkerboarding: [http://gamedev.stackexchange.com/questions/47844/why-are- som...](http://gamedev.stackexchange.com/questions/47844/why-are-some-games- using-some-dithering-pattern-instead-of-traditional-alpha-for)

Summary: Alpha doesn't work in deferred shading, so they use screendoor transparency instead.

<comment><USER3> Yup, Witcher 3 does the same thing (thanks to that GameDev StackExchange link it finally clicked for me why Witcher 3 has that dithered look when moving around).

In case it still isn't clear after reading both descriptions of what's going on: that method and a bit weird look comes from using transparency via dithering/checkerboarding when doing LOD levels transitions in deferred rendering pipeline.

When rendering levels-of-details, you need to render both higher-level and lower-level quality models at the same time and blend between both, not to have sudden visual discontinuities.

In deferred pipeline transparencies are tricky / costly, so doing dithering is a clever workaround, basically piercing holes in a opaque solid models.

This would be quite ugly for regular transparent surfaces like glass / windshield / water, so those are rendered in a different way (usually forward pass).

But for LOD transitions, which are short in duration, it can look quite acceptable (imagine superimposed images of two versions of one tree, one low- poly model, one high-poly model, further away you are from the tree, more pixels of low-poly tree you see).

</comment></comment><comment><USER12> This is a great breakdown even for a novice who doesn't know much about how rendering engines typically function.

It gives me a new appreciation for games, the amount of work and creativity that goes into the final experience for the player.

<comment><USER13> _This is a great breakdown even for a novice who doesn 't know much about how rendering engines typically function._

What would you like to know? I have some time, so if anyone was hoping to learn more about this, ask me.

<comment><USER14> The only graphics programming I've ever done has been with pygame.

What should I read next?

<comment><USER13> This domain is unique in that it's not a good idea to read. The most effective way to navigate this territory seems to be: Think of a simple goal, then force yourself to solve it. Don't look up how to solve it until you're so frustrated that you want to throw your monitor across your room.

Actionable advice: Set up a program such that you have an array of pixels. Say, 512x512. Now write a while loop which randomizes those pixels. Finally, figure out some way to "create a window and put those pixels on the screen."

You now have a game loop. This is roughly how every game works at a basic level.

The next step is to realize that a triangle is the fundamental way to draw shapes quickly. Want to draw a square? That's two triangles. Want to draw a humanoid? Sounds complicated, but artists approximate humanoids with a combination of spheres, cylinders, cubes, etc. And all of those can be divided up into triangles.

So a triangle is therefore the first place to start in understanding graphics in general. What's the goal? "Create a data structure to represent a triangle. Now try to draw a white triangle into your little pixel array."

It's going to be tough. But tough work is good. I remember how difficult it was for me to even get a basic white triangle up on the screen. But the rewards are worthwhile, because at this point a lot of other things will start to click. A "vertex buffer" will no longer be mysterious, for example, because you'll immediately see that your triangle structure (whatever you came up with) was really just "a vertex buffer with three vertices." And then you'll start to wonder why graphics programmers came up with such complicated words to describe such simple concepts...

At this point, you'll have the ability to go in one of two directions: "Notch" or "Carmack." It depends entirely on what you find interesting. If you like the idea of making games, concentrate on creating Pong. (You have everything you need, because you just got a triangle up on the screen, after all.) If you like more along the lines of what the article talks about, then concentrate on creating a software rasterizer. "Software rasterizer" is another one of those terms that turn out to sound scary, but is way easier than you'd expect. It's hard in the same way that learning to ride a bike is hard: it'll take awhile, but you'll never forget it. After that, nothing else you ever do (in graphics) will ever seem even slightly mysterious. I have some thoughts on how to learn the latter, if anyone's interested.

<comment><USER15>
       This domain is unique in that it's not a good idea to read.

crazy talk.

Sure, learn by doing; but there are great resources to help you understand far, far faster than you ever will by experimenting alone. If nothing else, there is good code to read, and classic texts.

<comment><USER13> Mmhm. As with everything, it's a balance. It's important to understand that reading is one of the most effective forms of procrastination that has ever been invented. It's also the prism through which your entire future passes, but everyone already knows that.

For example, Carmack was able to "invent" BSP because he was (as far as I've heard) an avid reader of medical journals. Specifically, journals and papers about the graphics techniques they used at the time. The field of medicine turns out to be very lucrative for an ambitious graphics programmer, because they're often at the frontiers of what's currently possible. So apparently BSP was used in accelerating medical renderings, and Carmack was able to see their potential for realtime graphics. The only reason he was able to do that was by reading pretty much every possible thing.

None of that will help you unless you force yourself to _do_ and not read, though.

<comment><USER15> You stated "This domain is unique in that it's not a good idea to read."

This is just not true in either of its claims. It's not even useful hyperbole, really, it's just wrong.

Graphics programming is _exactly_ like other domains of technical development, you will learn best by a combination of reading good summaries/examples of what is known, doing work on your own (not cutting corners), and talking to people that know more about that you do.

<comment><USER13> And yet, if you proceed as if it were correct, you'll be amazed at what you'll accomplish. The comment I was replying to was essentially asking, "What would've helped you back when you were in my position?" Ten out of ten times, I'd choose to tell myself, "Stop trying to read about how graphics engines work. Figure out how to get triangles up on the screen, without copying someone else."

The best I can say is that my career began from that method. And by asking a lot of questions on IRC.

<comment><USER15> Glad it worked for you, but that doesn't make it good advice. And doesn't change the lack of uniqueness. It's usually a mistake to generalize from your own experience, when thinking about pedagogy. I'd wager that most people would do ok following that advice as if it were true ... But not as well as if they'd read as well.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Great article regardless of your familiarity with computer graphics or draw pipeline.

The supporting media and presentation are as exceptional as the bespoke game engine (RAGE)[0] used in in the GTA series.

[0] [https://en.wikipedia.org/wiki/Rockstar_Advanced_Game_Engine](https://en.wikipedia.org/wiki/Rockstar_Advanced_Game_Engine)

</comment><comment><USER17> GTA V's rendering engine has been fascinating to me since I bought it on the Xbox 360, then the PS4, and now the PC. It manages to improve significantly each time. Truly an incredible technical and artistic accomplishment.

This series of blog posts is excellent.

</comment><comment><USER18> GTA V's performance and graphics quality when driving around on the PS3 was truly amazing given the hardware, neat to see how they achieved that.

</comment><comment><USER19> "Then, to simulate a real-world camera, a lens-distortion is performed on the image by using a small pixel shader. It does not only distorts the image, it also introduces small chromatic aberrations on the edges of the frame, by slightly distorting more the red channel compared to the green and blue ones."

Why would the engine do this? Is it to try and give a 'cinematic' feel to the game? Do our eyes suffer Chromatic aberration?

<comment><USER20> They do, but it's removed in post processing :) I like how movie-like GTA V feels and things like that help to achieve this effect.

</comment></comment><comment><USER21> Astonishing achievement. Now take a look at Batman Arkham Knight on PC and the marvelous technical failure it is.

<comment><USER22> If anything, that article gives an inkling of the infinite multitude of ways to screw it up. It's amazing games work as well as they do.

</comment></comment><comment><USER23> How did the author figure all of that information out?

<comment><USER8> From part 3:

>Links

>The tech that built an empire: how Rockstar created the world of GTA 5 featuring an interview of Aaron Garbut. [http://www.techradar.com/news/gaming/the-tech-that-built- an-...](http://www.techradar.com/news/gaming/the-tech-that-built-an-empire- how-rockstar-created-the-world-of-gta-5-1181281)

>GTA V NVIDIA Performance Guide with details about the different graphics settings. [http://www.geforce.com/whats-new/guides/grand-theft-auto- v-p...](http://www.geforce.com/whats-new/guides/grand-theft-auto-v-pc- graphics-and-performance-guide)

>Renderdoc which made picking into GTA V internals a breeze. [https://github.com/baldurk/renderdoc](https://github.com/baldurk/renderdoc)

</comment></comment><comment><USER24> Not only a great article but also superbly presented. I really liked all the screenshots showing before and after difference.

</comment><comment><USER25> Great article. The author did a fantastic job of making the techniques understandable and bringing them down to earth, without dumbing them down -- people who are experienced in graphics are going to learn a few tricks as well from reading this.

</comment><comment><USER26> This is a great article, really amazed at both the computational power of modern hardware and the skill displayed in getting the most out of it. Too bad the game industry sucks to work in or I'd be a game engine programmer for sure.

</comment><comment><USER27> The interactive cube demonstration is remarkably well done Adrian. Love it!

</comment><comment><USER28> Reading about how optimization is handled in games is extremely interesting.

It really makes me appreciate some of the more well optimized games, it sounds like solving a very difficult puzzle.

</comment><comment><USER29> The "cube map" looks exactly like what Google StreetView does to represent views of the environment from given geographical coordinates.

</comment><comment><USER30> And it all happens in 16ms...

<comment><USER31> 33ms (at best)... There's a max 30fps on consoles. [https://www.youtube.com/watch?v=y_XREfxf4ds](https://www.youtube.com/watch?v=y_XREfxf4ds)

<comment><USER21> On PC it reaches 60 frames quite easily on moderate hardware, and quite beyond as the hardware improves.

</comment></comment></comment><comment><USER32>
      > ... it's a real technical prowess.

That sentence could be re-worded as:

      > ... it's a real display of technical prowess.

or

      > ... it's a real technical achievement.</comment>


Heroku Down Again - <AUTHOR> https://status.heroku.com/

<comment><USER2> Wondering how low their June uptime is going to be. Glad not to have my applications running there, but feel sorry for those that do. It sounds like an awesome system, but with outages being so frequent, I really wouldn't be comfortable using their services.

</comment><comment><USER3> It is especially frustrating because my site is running but I need to push a pretty critical update and the api is shut off.

</comment><comment><USER4> Yes, Heroku is down. They have a status page that lets you know about that sort of thing. It seems like folks like to keep an eye on certain service status pages and post them here real quick for some easy karma or something. This is HN, not the Heroku/AWS/PaaS/SaaS service status page. Those pages are easy to find and now there's one less spot for a really interesting article on the front page.

<comment><USER5> While I to some extent agree with your point, it serves as a reminder to those who say Heroku/AWS/whatever is the one-stop solution to all your uptime, stability and scalability needs.

These things goes down as well, and when they do you are powerless to get your stuff back up if you rely on them to operate.</comment></comment>


Are Pandemics Good for the Environment? - <AUTHOR> https://www.sapiens.org/archaeology/covid-19-environment/ <comment><USER2> short answer: no

longer answer: while there is a short term gain from the pendemic, with less humans driving, flying, cruising, etc. HOWEVER this is not a good thing. This is a small blip in the overall global warming fight, we need to reduce emissions by A LOT over a long period of time. To trully see the benefits we need a deadly pandemic (maybe even more deadly than COVI-19 to scare people enough) to be happening yearly, making tourism and such a thing most people avoid.

If this will permanently destroy the cruise industry, and slow down flights for multiple years, this would be great. But it most likely won't. So while we may have received a momentary pause because factories are shut down, we might see things like china removing emission regulation in an effort to make up for lost manufacturing.

This must not stall the global warming debates and policies.

<comment><USER3> I am not sure if you read the article at all.

(i) The article points out there can be some long term gains as well as has been seen in the past, for example, with self-empowerment of labour class. Currently this is seen, as the author points out, with polls showing governments keep to work together more in future for Green New Deal. Another example would be society as a whole being more supportive of fundamental scientific research; Companies adapting to new ways to work-from-home (Twitter made news recently allowing employess to WFH forever even after the pandemic ends) and so on.

(ii) The author argues against the ecofascism ideology giving examples why it is bad which is against your idea that a deadlier pandemic will help. Why would end of tourism industry be good for the environment? Tourism industry in a lot of cases helps sustain the habitat for wildlife (see sources in the article).

(iii) Was it US or China that pulled out of the Green New Deal earlier this year? We do not know what the future will bring but we can already see which global economic power is currently handling the crisis better.

So short answer: Maybe.

</comment></comment><comment><USER4> Air: Yes Humans: No Water: Yes Animals: Yes Sun: No Stars: No ISS: No</comment>


FEC Complaint Filed on Google, Facebook, and Twitter for Election Interference - <AUTHOR> https://bigleaguepolitics.com/breaking-fec-complaint-filed-against-google-facebook-and-twitter-for-election-interference/ <comment><USER2> Misleading title; suggests FEC filed the complaint.</comment>


Research suggests that more money makes people act less human.  - <AUTHOR> http://nymag.com/news/features/money-brain-2012-7/

<comment><USER2> _But psychology has only recently begun seriously investigating how having money, that major marker of status in the modern world, affects psychosocial behavior in the species Homo sapiens._

No. Two things. First, taking this study and applying it to "money" is very correlative, and a decent leap considering the methods for the study. The real value of this study, if there's any at all, is about someone having huge unfair advantages in a general sense; having freedom to treat someone however you want because they don't have the means to rebel.

And second, the examination of this isn't new at _all_. Heart of Darkness, One Flew Over the Cuckoo's Nest, Apocalypse Now, King Leopold's Ghost, tons and tons of artists have examined what happens when someone has an unfair advantage without consequence; those are just some I plucked quickly, but there are so many.

I'm not saying the point is completely invalid. In a lot of cases, money gives people the exact freedom, privilege, and less-restrained power that leads to this behavior.

But saying "Research suggests more money makes people less human" based on a rigged monopoly game where the other person is severely relatively handicapped is...a bit of a leap, to say the least.

The other studies mentioned in the article don't sound very convincing, either.

 _quizzes, online games, questionnaires, in-lab manipulations, and field studies that living high on the socioeconomic ladder can, colloquially speaking, dehumanize people_

Quizzes/questionnaires are notoriously prone to being bullshit, like the China Study's questionnaires including "Pizza" as meat and the book going on to draw correlations between its definitions of "meat" and diseases like cancer. I'd way rather see more info on the "in-lab manipulations and field studies", it was only touched on briefly, it seemed.

</comment><comment><USER3> How is this valid research? You can only draw a correlation between money and "humanity". It makes more sense that people who have less "humanity" causes them to become more wealthy, not the other way around.

To show convincingly that more money causes you to have less "humanity", you have to have two groups:

1) Control group. Monitor their "humanity" over several years.

2) Test group. Give these people _lots_ of money. Monitor their "humanity" over several years.

This would be quite an expensive study.

<comment><USER4> Did you actually read the article? "Give these people lots of money" and "Monitor their 'humanity'" is exactly what is described in the Monopoly game. The result was that the group given more money "act[s] out social dominance with a special ferociousness, slapping hands, stamping feet, or 'charging back and forth and dragging huge branches'" (oops, I mean "he balloons in size [...,] smacks his playing piece [...,] picks up Glasses's piece [...] and moves it for him").

</comment></comment><comment><USER5> Unfortunately, the article isn't yet open-access ( _PNAS_ has a 6-month- embargo "delayed open access" approach), but the abstract can be found here, which gives a little more detail on what precisely they're claiming: [http://www.pnas.org/content/early/2012/02/21/1118373109.abst...](http://www.pnas.org/content/early/2012/02/21/1118373109.abstract)

</comment><comment><USER6> how do you define "human"?

<comment><USER7> The researchers mentioned in this article were generally measuring empathetic, selfless, or compassionate behaviour, and the effect of wealth (or perceived wealth) on that. So "human" in the sense of "humane".

<comment><USER8> Selflessness and compassion (at least, for that which occurred from wrong behavior) are common among people who are ignorant of the importance of justice (which may be defined as revealing things as they really are) and the danger of compromising with injustice. Also, in order not to lose all of one's money, one needs to be careful not to be deceived (which requires keeping oneself and acting to serve oneself and the world, rather than selflessness). Are you sure the experiment was able to control for those two issues?

<comment><USER9> I wondered the same thing.

The beginning of the article started with the implicit assumption that one can learn anything at all about "rich people" from watching a couple of folks play a rigged game of MONOPOLY.

It didn't get any more academically rigorous, so I attributed its rise in HN to being link-bait and decided I had more important things to do with my day like getting rich so I can become inhumane.

<comment><USER10> If you'd prefer to read something with more rigor: [https://docs.google.com/viewer?a=v&pid=sites&srcid=Z...](https://docs.google.com/viewer?a=v&pid=sites&srcid=ZGVmYXVsdGRvbWFpbnxwYXVscGlmZnxneDoxNzNmMTIwNDk5MTJiMzlj)

</comment></comment></comment></comment></comment><comment><USER11> I find it odd that a site started by a rich guy who decided to put together a for-profit enterprise based on the idea that helping entrepreneurs get their first startup off of the ground would both make him richer, and make them richer, is frequented by so many people who want to believe that the "rich" are "evil" and need to be punished in some sort or another. (and this article is trying to put a scientific gloss on that belief.)

Not only is PG an existence disproof of the belief, but the mechanism by which he is getting richer is very much the same mechanism that other rich people employ, though often with less obvious social benefits. So, PG is not an anomaly that proves the rule. He's a more visible example of the rule that is often obscured with hot air, but that applies in the vast majority of cases. For instance, while I truly despise Bill Gates, I must recognize that Windows made billions of people's lives easier[1] and thus Gates made his money by improving the world.

Some people can get wealthy via pull and theft, for example, many politicians get wealthy essentially by trading pull. I'm sure there are examples of non- politicians that get wealthy this very same way (trading political pull at a net loss to society.)

But the real way to get wealthy is to make other people's lives better-- in fact, this is the startup advice often seen in other contexts as "find a real pain point and solve it."

[1] ...not easier than if those people had a good operating system, but that's not the comparison. The comparison is to those people not having any operating system, or having only MS-DOS if they already had a PC.

<comment><USER12> The scope of your comment is extremely small. It ignores millions of other rich people that made their money by exploiting people. I'm sure you can think of your own examples without much difficulty. No social findings are ever absolute. Humans are exceptional at breaking "rules".

But I would further criticize your comment with your use of the word "evil". Evil evokes images that are irrelevant to actual behavior. Evil insinuates that these people are intently malicious. The findings indicate the opposite- they are unintentionally malicious.

Edit: I've been downvoted without response. Classy.</comment></comment>


Telegram Bot for HN? - <AUTHOR> How about telegram bot for HN ? I searched in telegram didn't find it.. Is HN provides some API's to access Top stories, New etc ?.. I never visit Techcrunch, engadget, reddit sit for updates. All the stories link and Title of the stories I get in telegram only. I click when It's get interesting. <comment><AUTHOR> Cool, I saw there are API's [https://github.com/HackerNews/API](https://github.com/HackerNews/API) .... Anybody implemented ?</comment>


20 Years of LWN - <AUTHOR> https://lwn.net/Articles/744730/ <comment><USER2> I love LWN's content. It includes soooo much detailed technical coverage on many interesting conferences. It's a great way to stay vaguely aware of what's happening in various subindustries.

It's extremely frustrating how many steps it takes to subscribe.

There are so many places to drop out of the signup process (especially when you don't already have an account).

The first time I meant to subscribe, I got distracted by something halfway through and ended up not subscribing for 3 months.

After clicking the call to action , it should basically immediately present a "sign up and subscribe" form, complete with credit card collection.

It would be a massive shame to be at the limit of sustainability because of something like this

<comment><USER3> Your comment motivated me to sign up and subscribe. I didn't find it much different from subscribing to other publications: create an account, login, choose subscription level, pay.

<comment><USER2> Many places unify this flow to prevent people dropping out halfway through

Even the link in the header to subscribe leads to a wall of text where you have to hunt for the right link. The first link several paragraphs in is for group subscriptions?? Why?

My bet is that the people landing on have mostly decided to subscribe, or are interested in more details about the cost. Yet 90% of the page is still about convincing me about the merits. I was already convinced by the single paragraph header on the article!

The page presented is useful for those coming from an FAQ or something, but not well suited for the person coming from that header.

It might sound super nitpicky but there's huge amounts of behavioral science about the benefits of simplifying these kinds of flows. Saying it doesn't matter is going against a lot of documented evidence to the contrary.

<comment><USER3> I believe you. I was just stating it's no worse than other subscriptions (New Yorker, NYT, Economist) I've purchased. That I recall anyway.

</comment></comment></comment></comment><comment><USER4> LWN is a class act. Most subscription services make you jump through hoops to cancel your subscription. Not LWN though. It is the only media subscription that I've seen that doesn't automatically renew when your payment term is up.

This makes me feel like LWN really respects their customers.

</comment><comment><USER5> I never subscribed or even visited LWN on my own, but their content sharing is something that every paid news outlet should take a note of. Your subscribers should be able to share the content they paid for with their friends, colleagues, whatever without copy-pasting it. Limit it by visits or time (or both) if you are worried. Do NOT ask for emails before showing the article to visitors.

<comment><USER6> Yet LWN is struggling to make ends meet.

<comment><USER7> Not really. From TFA:

> The "subscriber link" mechanism, suggested by our readers, has become one of > our most powerful marketing tools. All told, it is not a model that has made > any of us rich, but working for LWN is not an exercise in poverty anymore > either.

<comment><USER6> It's a somewhat recent development. Just a few years ago LWN had to fire Jake Edge. I guess things are looking up and they rehired him. Good to know.

<comment> Tuna-Fish "Things are looking up" was caused by a single change: They raised their prices, especially the cheapest "starving hacker" tier was raised from $1 to $3.5, while prices for other tiers were raised but not by as much.

IIRC, they later commented that this had almost no impact on their subscriber count. They are serving almost everyone who has a major interest in their subject, and the market turned out to be much less price-sensitive than they expected. They could have avoided many years of shoestring budgets just by raising their prices earlier.

<comment><USER6> It's kind of funny, considering that their target demographic probably makes an average of 100k per year after graduating :)

<comment><USER8> Presumably some of their audience lives in a country with much smaller salaries.

<comment><USER9> I deal with this objection a lot.

60% of this market is in the US; 40% or so is elsewhere. (That is not true of the prospective users of this, but it will be broadly true of the payers.) Half of "elsewhere" is in an elsewhere with compares-directly-to-US living standards.

$1 rounds to $7 for US and parity-with-us technologists; both require more bandwidth to make the decision, as a percentage of all available bandwidth, than they occupy a portion of the budget. $7 does not round to $1 for some technologists elsewhere.

You won't get their business at $7; you probably don't have it at $1, either, because they might find it difficult to physically get you a dollar. Subsidize their price down to zero by charging US technologists an appropriate amount.

Many people want to operate tech-facing businesses like charities for ideological reasons or because they have an exaggerated view of the size of the audience that won't/can't pay. That's suboptimal but survivable, if you at least operate like a _competent_ charity. A charity which doesn't have a $250+ a year option cleanly presented to its donors who are in the top 2% of the US income distribution is not a competent charity.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> LWN has an enterprise subscription model (I think). I work for Hewlett Packard and login using corporate account. The enterprise model is not well advertised/known.

Just saying so if someone here wants to get their company to subscribe, then it's win-win for LWN and your employees.

</comment><comment><USER11> I used to be a subscriber for LWN for like 17 years. It was so nice to be able to look only once a week to their site and got all important stuff in a nice format. I let my subscription to expire when they started to move to daily news format with less focus of their high-quality weekly issues. I have found that it brought extra noise distracting from more important issues.

<comment><USER12> I have to disagree with this assessment. The change was to publish the Weekly content as standalone articles throughout the week rather than wait for the Weekly Edition. The Weekly Editions are still there if you prefer to read LWN once a week. I don't think the quality of the content has suffered as a result.

</comment></comment><comment><USER13> wow i'm old</comment>


Why Adobe Flash penetration is more like 50% than 99% - <AUTHOR> http://samj.net/2009/02/why-adobe-flash-penetration-is-more.html

<comment><USER2> "99.0% of Internet-enabled desktops in mature markets as well as a wide range of devices."

Seems pretty clear to me, they separate 'desktops' (which I can buy is close to 99%) from other devices.

<comment><USER3> The copy on the Adobe site is written for a target audience. Those folks ask: "Yeah, but do customers of my clients have installed Flash?", "Uh, they proposed a solution working with Flash, can we do that?" or "Can we use Flash?". And the answer is clear: Yes, you can! Everyone who doesn't live on the other side of the moon uses Flash!

Note to my fellow programmers: normal people read numbers like words. Depending on the context, a number represents a word to them like "Totally!" or "You must!" or "Everyone!" or "Just Now!" and so on. I know, it's irrational, but that's why the advertisers use those numbers. (Use humor in life, it's better that way :-))

</comment></comment><comment><USER4> This is a BS article in my opinion. They say 99% of internet connected desktops. They said nothing about mobile, but his entire argument is mobile. What is the percentage of ppl who use their phones for actual web surfing? Much smaller than he would like you to believe in this article.

Even in their old copy they say internet-enabled PC's. So until adobe says 99% of internet users, then their claim has validity...

More flash hate...

<comment><USER5> I do use my iPhone for actual web surfing, but I use my laptop about 20 times more, so I'd say that equals about 95% Flash coverage.

</comment></comment><comment><USER6> I posted this at the original blog entry, but his Preview and CAPTCHA didn't seem to work correctly in my Firefox 3....

</comment><comment>==

Hi Sam, so, if we changed that old headline to reflect the bodytext's "Internet-enabled desktops", would you be satisfied then?

These consumer audits have been going on for a <a href="[http://web.archive.org/web/*/http://www.macromedia.com/softw...](http://web.archive.org/web/*/http://www.macromedia.com/software/player_census/flashplayer/) long time, and now that North Americans have their first acceptable mobile web device it could well be time to help remove something they might find confusing.

(btw, be careful on "native web application", because you need to break it down with some <a href="[http://a.deveria.com/caniuse/#agents=All&alts=p&cats...](http://a.deveria.com/caniuse/#agents=All&alts=p&cats=All&eras=All&statuses=All&sort=score) granularity to find exactly what that term means.)

jd/adobe

<comment><USER7> Is a desktop a desktop computer[1] or the desktop metaphor[2]? Anyway maybe a real world test of active Internet users (e.g. daily or weekly) would be more interesting than a survey (if less flattering).

You previously claimed[3] that "Sometimes multiple implementations are useful, but the unique value in SWF (and, to a lesser extent, PDF) is in the predictability of its rendering." PDF's far from dead so maybe now's a good time to open up the player side of Flash a bit. Otherwise you may well find an increasingly large percentage of the tens of millions of netbooks built each year shipping without it.

Sam

1\. <http://en.wikipedia.org/wiki/Desktop_computer> 2\. <http://en.wikipedia.org/wiki/Desktop_metaphor> 3\. [http://scobleizer.com/2007/07/06/apple-working-on-adobe- flas...](http://scobleizer.com/2007/07/06/apple-working-on-adobe-flash- support-for-iphone/#comment-729697)

<comment><USER8> Sam, you've got Google Analytics installed on your blog, why not look there for your own survey?

<comment><USER7> I just did and about 5% of my (tech savvy) users don't have Flash, but then again more than half of them use Firefox and less than 15% are on IE so not particularly representative.

</comment></comment></comment></comment><comment><USER9> He also speaks to Flash/RIA being a dying art, but I wonder what would be harder for the user: installing one of the RIA plugins, or upgrading your entire browser to support HTML5? I reckon the latter, and the penetration rates for HTML5 will be solely be dependent on existing Flash/social sites like Youtube, Vimeo, etc making the switch themselves.

<comment><USER7> 35 million netbooks will ship this year, and that's set to rise to 139 million by 2013[1]. Say some of the main models were to ship with Android[2], or even a webkit-based or Firefox 3.1 (coming soon[3]) browser... then imagine that sites like Facebook and YouTube were to start serving up the VIDEO tag to compatible user agents. All of a sudden there is a _lot_ less incentive to fight with binary flash plugins (when everything else is open source).

This could well happen virtually overnight.

Sam

1\. [http://www.abiresearch.com/press/1355-35+Million+Netbook+Shi...](http://www.abiresearch.com/press/1355-35+Million+Netbook+Shipments+Expected+in+2009:+An+Era+Begins) 2\. <http://blog.wired.com/gadgets/2009/02/asus-developing.html> 3\. <https://wiki.mozilla.org/Firefox3.1/Schedule>

</comment></comment><comment><USER7> Everyone likes a good demo so check out my follow up post 'Towards a Flash free YouTube killer...'

Sam

1\. [http://samj.net/2009/02/towards-flash-free-youtube-killer- wa...](http://samj.net/2009/02/towards-flash-free-youtube-killer-was.html)

</comment><comment><USER10> "Internet-enabled devices in mature markets" doesn't include mobile, and as far as I can tell doesn't pretend to. So this article is essentially arguing against a claim Adobe never makes. Seems like sort of a made up gripe to me.

<comment><USER7> For the vast majority of people looking at that claim the message is "Flash content reaches 99.0% of Internet viewers".

Sam

<comment><USER11> The vast majority of people looking at that claim probably wouldn't include mobile devices in Internet viewers anyway. What kind of Flash content producer would say "oh, it's Flash, so it has high penetration among mobile devices, good"? If you want to reach mobile devices, you target them. It's implicit that we're talking about desktops here.

</comment></comment></comment><comment><USER12> Adobe is it's own worst enemy.

Turns out, to install CS3 you have to uninstall Flash. Their own products hate each other.

<comment><USER8> i didn't have to uninstall anything when i installed CS3.

<comment><USER12> That's kind of like saying "I went to Afghanistan and I didn't get my head cut off."

Adobe has _horrible_ installers which break frequently. Just google for "CS3 install problem" and you'll see what I mean.

<comment><USER8> Believe me, I am quite familiar with cs3 install issues :( Their installers are horrible. But the comment I was replying to stated as fact that everyone has to uninstall Flash before installing CS3, which (as my data point shows) is not universally true.

To extend your analogy, the original comment is like saying: "If you go to Afghanistan, you will get your head cut off."

</comment></comment></comment></comment><comment><USER13> well the main target group of flash is the likes of the target group that uses YouTube.

So defacto their numbers are good enough IMHO

</comment><comment><USER14> They do inflate their numbers a bit.</comment>


Why America could miss out big time on India's fintech revolution - <AUTHOR> https://techcrunch.com/2017/12/05/why-america-could-miss-out-big-time-on-indias-fintech-revolution/# <comment><USER2> TL;DR: US investors care only about the affluent and upper middle classes while China has dealt with electronic payment for poor people and is now expanding into India.</comment>


Ask HN: As a foreign student on F1 Visa, can I apply for Y combinator's program - <AUTHOR>

I'm trying to apply for Y combinator's summer program with my startup project right now. But as an international student on F1 student visa, I know there are a bunch of restrictions. I'm wondering if there is someone outside there is familiar with how to get into Y combinator's incubation program with a F1 student visa. Appreciate for any information! <comment><USER2> yes u can</comment>