An example of exploiting two fixed vulnerabilities in Firefox on Windows - <AUTHOR> https://github.com/0vercl0k/CVE-2019-11708 <comment><USER2> Note this is not a 0-day, this is a fully-worked-out example of exploiting two vulnerabilities fixed in May and June of this year. Worth reading for knowledge, but as an end user, just make sure you've restarted your browser at least once since June and haven't turned off auto-update.

<comment><USER3> [https://archive.is/20130414124019/http://ha.ckers.org/blog/2...](https://archive.is/20130414124019/http://ha.ckers.org/blog/20070803/mozilla- says-ten-fucking-days/)

<comment><USER4> That link 404s, here's one that works: [https://web.archive.org/web/20150102232217/ha.ckers.org/blog...](https://web.archive.org/web/20150102232217/ha.ckers.org/blog/20070803/mozilla- says-ten-fucking-days/)

</comment></comment></comment><comment><USER5> Can we add something to the title to clarify that these bugs were fixed months ago? Eg. "(fixed in June)"?

It's still an interesting post, but nowhere near as worrying for Firefox users as it sounds.

<comment><USER6> Ok, added above.

</comment></comment><comment><USER7> Interested readers should check out the author's earlier work exploiting CVE-2019-9810: [https://github.com/0vercl0k/CVE-2019-9810](https://github.com/0vercl0k/CVE-2019-9810)

And their fantastically detailed writeup of a PoC they wrote for that vulnerability: [https://doar-e.github.io/blog/2019/06/17/a-journey-into- ionm...](https://doar-e.github.io/blog/2019/06/17/a-journey-into-ionmonkey- root-causing-cve-2019-9810/)

This exploit is different in that they use the arbitrary read/write primitive gained by CVE-2019-9810 to flip a couple of bits and patch out a few instructions with the effect of removing the security boundary between a normal web page and XPCOM. The interesting difference in this exploitation approach is there's no need for ROP chains and shellcode, as you have all the XPCOM components available to use.

Once they're in that privileged context in the content process, they escape its sandbox by exploiting CVE-2019-11708. This works by sending an particular IPC message to the parent process, that causes a web page of the exploiter's choice to load in that process. In this case, the choice is to exploit CVE-2019-9810 again, then use XPCOM components to drop an executable to disk and run it.

Awesome work, and a real pleasure to read, it's satisfying to see such well- commented and clear exploit code.

</comment><comment><USER8> The thing is, most of these exploits also affect Tor browser, because it's built upon Firefox.

Other than using a VM or a live distro like Tails , is there any other way for OR users to be _safer_ when running the regular Tor browser bundle, such as by utilising third-party sandbox software?

<comment><USER9> Most likely you are _less safe_ using Tor than using a regular Firefox or Chrome with no VPN, because using Tor automatically means nation state attackers are going to target you. So you have to do extra work just to break even. Google EgotisticalGiraffe for details.

<comment><USER8> There's no way this is true. Even if nation state actors _are_ more likely to target you just for using Tor, even if it's for completely regular browsing, Tor provides a _lot_ of additional protection and anonymity.

<comment><AUTHOR> I initially got hung up on the GP assertion that users are _most likely_ better off with Firefox. It depends on the threat model. But after thinking about it for a while, I agree with GP.

Those people thinking about such topics constantly might not be the average user. I would not feel safe installing Tor on my parents computer and telling them it is safer to do all their browsing now with Tor.

Threat models matter otherwise we'll end up applying wrong security tools: *"use Signal. use tor." when the right thing would have been to meet in person wearing a fake mustache, and keep a pebble in your shoe to change your walk.

GP's advise makes sense for anyone who does not know what Tor is (most people). They are off better if we symlink their "Internet Button" from the desktop to Firefox, install uBlock and NanoDefender for them. If they're still adventurous teach them about creating/editing "multitab containers" (though I bet we've lost most of them by now).

<comment><USER10> > GP's advise makes sense for anyone who does not know what Tor is

Whether or not someone knows of Tor doesn't influence her threat model or privacy requirements, and therefore doesn't influence what measures can help. Other than that, I agree that you have to be aware of the threat model and what given tools provide.

</comment></comment></comment></comment></comment><comment><USER11> > It uses CVE-2019-9810 for getting code execution in both the content process > as well as the parent process and CVE-2019-11708 to trick the parent process > into browsing to an arbitrary URL.

I wonder why is the privileged parent process even allowed to execute unsigned Javascript from the network? IIRC it already has eval support turned off. I get that it's hard to get rid of privileged Javascript completely (Servo thankfully made the choice early on to not do that at all), but is there any feature that requires downloading & executing Javascript from the network in the privileged parent process?

<comment><USER12> Signed javascript isn't really a concept that exists anywhere. I'd love it if it did, it's a gaping hole in the internet security model. Mainline FF loads lots of unsigned user-controlled JS as-is (prefs.js, for example) so the closest thing you get is signing on entire extension bundles.

There is the Subresource Integrity mechanism ([https://developer.mozilla.org/en- US/docs/Web/Security/Subres...](https://developer.mozilla.org/en- US/docs/Web/Security/Subresource_Integrity)) as a stopgap for this but it doesn't really provide something useful in this case because the load target has to be known in advance and you can't provide a hash for top-level content in the URL.

<comment><USER11> Add ons must be signed by Mozilla I think. Also, add ons that have privileged access require a special signature that Mozilla only uses for their own add ons. That's what I meant with signed Javascript. Anyway, this wasn't my main point. It's why you load and execute Javascript from the network in the first place in the content process. It feels to me that banning JS loading would have helped here a great deal and would make exploitation of similar bugs much harder.

</comment></comment></comment><comment><USER13> What's so special about this old vulnerability targeting the few people who turn on bigInt support (it's disabled by default, I believe)...?

</comment><comment><USER14> Is it fixed as of what version?

<comment><USER11> CVE-2019-11708 is fixed in Firefox 67.0.4 and CVE-2019-9810 is fixed in Firefox 66.0.1.

[https://www.mozilla.org/en- US/security/advisories/mfsa2019-1...](https://www.mozilla.org/en- US/security/advisories/mfsa2019-19/)

[https://www.mozilla.org/en- US/security/advisories/mfsa2019-0...](https://www.mozilla.org/en- US/security/advisories/mfsa2019-09/)

<comment><USER14> danka danka

</comment></comment></comment><comment><USER15> I get permission denied when trying to view the bug:

[https://bugzilla.mozilla.org/show_bug.cgi?id=1559858](https://bugzilla.mozilla.org/show_bug.cgi?id=1559858)

<comment><USER16> Access to security bugs is usually restricted.

<comment><USER17> Even to bugs that have already been fixed?

<comment><USER18> There's generally (and sensibly) some delay between fixing the bug and opening up the report.

<comment><USER19> It's been six months.</comment></comment></comment></comment></comment>


Sugar's a drug and here's how we're hooked - <AUTHOR> http://www.healthline.com/health-news/addiction-sugar-acts-like-drug-in-the-brain-and-could-lead-to-addiction-091813

<comment><USER2> "Addicted" means that sugar has to be harming other aspects of your life, which I doubt for most people. I think this term is being overused.

<comment><USER3> The consequences of sugar addiction don't manifest themselves in an acute form immediately. They usually happen later in life, in the form of diabetes or some other inflammatory disease. Being harmful doesn't necessarily have to be a property of addiction. It simply means when you have a piece of chocolate, you want another piece of chocolate, then another, etc.

<comment><USER2> >Addiction is the continued repetition of a behavior despite adverse consequences,[1] or a neurological impairment leading to such behaviors.[2] - Wikipedia

Adverse consequences are necessary for it to be called addiction. If the sugar isn't negatively affecting your life, it doesn't count as addiction.</comment></comment></comment>


Show HN: CareerSonar - because friends don't let friends use job boards - <AUTHOR> https://www.careersonar.com/invitation/showhn

<comment><AUTHOR> The most promising career opportunities are those in which you have an inside connection that can help you get your foot in the door (or get your resume to the top of the stack). CareerSonar makes it easy to discover these opportunities in your social and professional networks, without having to manually cross check hundreds of job listings against your contact lists (not to mention your 2nd connections). Those who are employed use CareerSonar to keep on top of the best opportunities out there for them (because everyone is curious). Our ranking algorithm is patent pending, and we like to think that it gives results that are much more relevant than anything else out there.

We just entered private beta and would love to get some feedback. Thanks!

</comment><comment><USER2> As someone who was a job seeker for months, I found most success using LinkedIn. So to have a site that takes the fundamentals behind optimizing your network one step further seems really appealing. The only thing people may have trouble with is mixing business with personal.

<comment><AUTHOR> That's great feedback Chelsea - we're not mixing really since your activity is 100% confidential (no one sees it) - we're just giving you the tools to see which jobs your social connections can help you get (your friends and family are even more likely to recommend you than a random contact).

By the way, we also let you connect with LinkedIn so you can add that layer as well - and we fill the gap between Facebook and LinkedIn - you may be connected to a friend on Facebook that's connected to a potential reference on LinkedIn - we bridge networks to let you uncover those.</comment></comment>


Facebook smartphone with HTC launching soon - <AUTHOR> http://9to5google.com/2013/03/28/facebook-smartphone-with-htc-launching-soon-ad-campaign-in-the-works/ <comment><USER2> Personal disclosure - I'm not interested in a Facebook phone in the slightest (mostly for privacy concerns).

I think this is an interesting concept. Let's assume it is in fact a total fork of Android, in essence, a "Facebook Phone". I really think (as big as Facebook is) they will have a hard time with this. I'm not sure there is space for another type of device - even if it is a massive consumer brand.

I get the sense that a lot of people use Facebook for it's utility... but I think it has lost it's "cool factor" with the general public. I can't see a lot of people thinking "man - I really want deeper integration with Facebook!" Isn't the FB app good enough for most people?

<comment><USER3> Don't forget that Facebook owns Instagram as well. My non-tech friends (most of them) use exactly 2 apps regularly on their phones. Facebook and Instagram. I'm not sure any of them would jump at a Facebook branded phone, but I think a phone with Instagram in mind as the key feature (e.g. an awesome camera, integrated filters, not sure what else) might strike a chord with some of my friends.

EDIT: Almost forgot about Vine. That seemed to blow up in popularity in my demographic recently here in Hawaii. if Facebook owned Vine, they would have the holy trinity of apps.

<comment><USER4> > if Facebook owned Vine, they would have the holy trinity of apps.

Just for the record, Vine belongs to Twitter, so don't count on that happening any time soon :)

<comment><USER5> "don't count on that happening any time soon :)"

If Facebook offered 20B for Twitter, would Dorsey et al sell?

<comment><USER4> Forget it, if there was a time when Facebook could have bought Twitter that might have been 4-5 years ago, but that ship sailed for good.

<comment><USER6> twitter is the more valuable company long term imo

</comment></comment></comment></comment></comment></comment><comment><USER4> Perhaps it's a bit paranoid to say this, but note that we are dangerously close to April 1st.

<comment><USER7> I was thinking this exactly. This actually looks like an April Fool's headline/article.

</comment></comment><comment><USER7> Blech. No privacy concerns here.

This reminds me of a conversation I had with a friend a while back. She called me one day and I noticed that her photo had suddenly begun showing with her contact record on my phone. Thing is, it wasn't a photo from FB or any social networks, or anywhere else obvious that she could recall posting.

Now, we are both pretty tech, so I'm sure if we really wanted to sleuth it out we could have run it down. But, the point was that we are in this online space and it was non-obvious how this photo was being associated with her contact record on my phone.

I can only imagine how many unknown ways FB would get their hooks into someone carrying their phone.

As someone else mentioned, this has to be an early April Fool's joke.

</comment><comment><USER8> I find it flawed logic to think that just because a user loves Facebook they'll love a Facebook phone. Or likewise, because they do not like Facebook, they'll hate a Facebook phone.

The Android phone is not successful because it contained Google search and Google maps. These features existed on other smart phones before Android. Liking products or services made by a company helps introduce consumers faster to a new product line, but it is not a guarantee for success or failure.

</comment><comment><USER9> That's like a Facebook tracking multiplied by carrier tracking? Super big brother %) Who would buy that?

</comment><comment><USER10> Meta and/or OT: I simply don't believe public statements nor PR, any more.

I seem to recall prior FB comments on this (PR or senior executives) being: We're not doing a phone.

So... "strategic" and "protecting our interests" and "must maximize our value" and "timing" and... Lots of arguments for not giving a straight answer prior to this (even if that is "no comment").

However, with all the talk of "corporate personhood" being bandied about, these days, I'm going to choose to treat businesses that do this the same way I'd treat an individual that did so. You lied.

Why, then, should I believe anything else you're telling me?

Again, this is aside from the specific topic of this phone. Nonetheless, I find it pertinent.

<comment> k-mcgrady From this article they still aren't doing a phone. HTC are doing a phone and Facebook is partnering with them to run a forked version of Android on it, which will obviously be integrated nicely with Facebook.

</comment></comment><comment><USER11> I thought Open Handset Alliance partners couldn't sell devices running a true Android fork without losing Google as a partner? How will that come into play here?

<comment><USER12> Facebook has been known to partner with Microsoft. It's possible that the phone will be full of Bing.

On the other hand, Microsoft is trying to promote their own phone OS, and this phone is _clearly_ DOA if it doesn't run Android apps, but I can't see Microsoft liking the idea of promoting the Android ecosystem.

It's kind of funny actually. You could see how it could make sense for Microsoft and Facebook to work together and create some Facebook Phone running WP8, except they each probably think the other is going to fail and don't want to board a sinking ship.

<comment><USER13> >Facebook has been known to partner with Microsoft.

Not very likely, given the fact that Windows Phone has yet to receive an official Facebook app. However, design wise the windows 8 tile architecture would be the perfectly suited for Facebook and Instagram. Its all about how you pull it off, but given how buggy and incomplete my Facebook app on Nexus 7 is, I hardly have any faith in FB.

On the side note, they should have partnered with Nokia instead of HTC.

</comment></comment></comment><comment><USER14> I think we've been here before:

<http://www.youtube.com/watch?v=dwQkU7jLXRY#t=18s>

</comment><comment><USER15> I think facebook already has what it needs for a smartphone.

Voice and Video: Facebook Video Calling

Messaging: Facebook Messenger

Photos: Facebook instagram

Contacts: Facebook friends

Games: Facebook's online games

</comment><comment><USER16> I really wish something like diaspora would replace facebook. Any ideas how to work towards this?

<comment><USER17> get the average person to care?

currently anyone in the world on pretty much ANY device can access, register an account, and connect fast and easy to their nearby friends on Facebook. The FB philosophy is to "make the world more open and connected" , not "help connect relatively wealthy, tech oriented people." Diaspora has a number of <i> significant </i> hurdles it needs to tackle to just be in the conversation:

1) Ease of access from any device -- can some rando in Egypt open up a 'dumb' phone, sign into his account, and enter the political discourse relatively easily? Twitter is getting there on this account, and it's why Twitter is in the conversation.

2) Scale -- currently everyone and their mom (and dad, grandparents, cousins, long-distant alumni friends, etc.) is on Facebook. For a social network to "replace Facebook" in your words, their needs to be a solid value proposition over Facebook that causes huge droves of people to move away or switch. Currently there's little -- maybe privacy controls could be easier to use, but Zuck himself said that users control their data already: "Our philosophy is that people own their information and control who they share it with." Other than that -- why would the average person put in the "activation energy" over inertia to switch, other than "it's shiny and cool?"

In all Diaspora is an interesting project, but it has little differentiating value prop

</comment></comment><comment><USER18> "Come see our new home on Android" to me seems like Facebook is releasing a home screen replacement than an actual phone.

There are a bunch of apps like these such as Nova and Go Launcher.

<comment><USER19> Maybe a combination of both?

<comment><USER18> I just don't see a forked Android mainly because Facebook doesn't have the app ecosystem yet that could replace the default Google apps. These apps will not be available for a forked Android OS.

I think this is the reason why there isn't an Amazon phone yet. For example with Maps, Amazon is still building its Map service.

</comment></comment></comment><comment>

(edit) I guess they could release an Android phone with the Facebook Home Replacement installed by default.

</comment><comment><USER20> A Facebook phone makes no sense. So it seems probable that this is just one or two new apps for Android. Similar to their remake of the iOS apps a while ago.

</comment><comment><USER21> I just hope they stay true to the Android core, we dont really need another mobile OS that is based on Android but isnt compatible.

<comment><USER4> According to TechCrunch the press invitation says "Come see our new home on Android"; if they were to take Amazon's approach I would expect them to omit mentioning Android completely, so I guess this tells something.

</comment></comment><comment><USER22> I was wondering if they were going to build their own OS, to be honest. Maybe they'll fork Android?

<comment><USER23> "This will be a deeper, forked version of Android rather than a Facebook-ified version of Sense."

<comment><USER24> Hmm...this could explain why Zuck started encouraging employees to switch to Android.

</comment></comment></comment><comment><USER24> Woah! I've been waiting on this for years now. Will be interesting to see how Google reacts...

<comment><USER13> >Will be interesting to see how Google reacts...

I hope they don't come up with the dumb idea to create a Google+ phone. People tend make irrational decisions when confronted with uncertainty.

</comment></comment><comment><USER25> John Doe called a friend.

Like · Comment · Share · 2 minutes ago near a Gopher

</comment><comment><USER26> That mockup is fucking ridiculous.

<comment><USER24> how so?

<comment><USER27> It's an iPhone 5 with the touch buttons added.

</comment></comment></comment><comment><USER28> Google's going down.

<comment><USER29> Sure, because when I need information, I think "I'll Facebook it". _rolls eyes_</comment></comment>


Ask HN: What point in my career should I be getting at by now? - <AUTHOR> Hi,
I'm a regular reader of the hacker newsletter and I've been wanting to pose a question to all of you (in the form of a vent) but I haven't gathered myself to do it (until today) because, honestly, I feel embarassed for what I have to show and tell, curriculum speaking, in comparison to what I see here.
I'm a 28 yo working in the Information Visualization industry (or, as LinkedIn like to call it, Business Intelligence). I'm on it for about 3,5 years but I feel I'm not accomplishing anything meaningful, technically speaking.
In terms of stack, I've only come across working with Tableau and Qlik Sense and nothing more. I do throw around a little SQL, but very, very little, and at the end of the day I feel I'm only 'making charts'. Although Qlik (Sense) allows for some ETL, where I can put into action some cleansing and transformation strategies, I'm feeling I'm not learning what I should be learning. I want to get deeper, into more abstract terms.
I suck at optimizing - code, workflows,... I suck at understanding the architecture of things. I have a bachelor degree in computer science but it seems I haven't put that much into practice. I should be devising mental algorithms when working on things and I'm not capable of that. I should have a pipeline when working, like a method to do things, 'use this tool for this, that tool for that', that sort of operating. Instead, my to-do list is a collection of tabs in notepad++. If I need to do a copy & paste, I paste it into notepad++ and it says there forever. There is no structure.
Do you think I have stagnated/should be in an advanced stage of my carreer? Which stack of tools and skills should I have 'mastered' by now? I'm not exactly young... I know I am mixing practical limitations with technical ones, but for me those two aspects are intimely connected. I can't differentiate between having a practical, structured mind and being technically good.
Thanks for any word you might find relevant! <comment><USER2> I think being good with a proprietary technology like Qlik isn't so bad. That is a rare skill and there are jobs.

The question is what you want in life and your job. You are saying you have the feeling you should have learned more but why is that? Do you want more money, fame or freedom?

<comment><AUTHOR> I guess I want to feel I know a variety of things (I was going to write 'shirt', lol) that makes me a good developer (heck, I don't even consider myself a developer - what IS a developer, anyway?!). Right now I don't think I'm good at my job. I don't think I'm leveraging technology. Every profile I look into linkedin that is into this industry (information visualization) is so skillfull in a variety of technologies and topics, and I only have "Qlik Sense" to show, you know. No favorite frameworks (because I don't apply one), no github profile to show, no parallel projects,... I think I wouldn't stand a chance competing against all this people in the market if I were to change jobs.

I have a stable job, with demand for it - projects are coming, there is work to do and value to add, but I don't think I'm developing as I should.

In the end, yes, I want more money and more freedom to do whatever I please at my own pace. I have enrolled in a Data Analyst with Python course (in dataquest) that will put me through a variety of technologies and challenges, and I'm hoping I will reach some clarity on the path I'm following on my current job. Don't know if this makes sense.

<comment><USER2> Most developers also just know certain stacks in-depth (e.g., Python + Django / Angular + Javascript). Yes, these technologies enable someone to solve a bigger variety of problems, but it doesn't mean they are then more worth to the market than you. It always depends on what the market wants.

Github profiles matter less than you think because it is hard to tell what the person did themselves and what is a fork. Recruiters and hiring managers I work with look at an online profile for roughly 10 seconds to see if you use certain technologies, that is it. I elaborate on this at length in "Coderfit: All you need to know for your programming career" [https://gumroad.com/l/cdrft/](https://gumroad.com/l/cdrft/)

<comment><AUTHOR> But isn't the market demanding? At least if I want to have a nice job, with a nice pay... I feel I must raise the ceiling today if I don't want to be in a dead end by the time I reach the 30s (which is just in 2 years).

Thanks for your perspective, sk3nnyy. That newsletter of yours (coderfit) really is some public service. I will definitely be seeing into the ebook.</comment></comment></comment></comment>


Decoding the MetroCard, Part 2: Research and Past Attempts - <AUTHOR> http://blog.woodruffw.us/2016/07/17/Decoding-the-Metrocard-Part-2 <comment><USER2> This post actually puts to rest (and confirms) a theory that my coworker had when I thought I had a truly unlimited metrocard.

Basically, I bought an unlimited monthly pass from a machine. By the third day of using it, I noticed that every day I used it, the expiration date displayed at the turnstile would advance a day. Obviously, I thought I had somehow become the owner of the golden metrocard that would work forever (I was admittedly optimistic, hoping it would be true).

Several days later, when I had confirmed that it wasn't a fluke and shared the story of my fortunate acquisition of the "golden metrocard" my coworker suggested that perhaps the expiration date stored on the card was null, and the default behavior of the turnstile was to always show an expiration date 30 days out.

Sure enough, when thirty days passed, the card stopped working, and I apparently blew the booth attendant's mind when I asked why the card wasn't working (something about a negative balance or some such, she'd never seen such a thing before).

My coworker was absolutely right, the expiration date was cached on the card (as a null or some other invalid value in this case) and it was then checked against a list of actually expired cards over the network.

<comment><USER3> Do you happen to still have that card? I'd love to see a dump of it (and line it up with known fields circa 2006 on tracks 1 and 2).

<comment><USER2> I'm afraid not. I'd intended to hold onto it, but it fell through the cracks during a move.

</comment></comment></comment><comment><USER3> Oh, wow. I just came home and found this on the front page.

I'm a little embarrassed, since that post had been sitting on my drive for over a year. It's not very well written, and it doesn't do the prior research justice.

</comment><comment><USER4> After living in NYC and now living in San Francisco, I wonder why the MTA hasn't switched to contactless cards yet similar to what Boston or SF has. As someone who has missed many a train trying to swipe my metro card, it seems like this would be an easy win for them and less wasteful than a disposable paper card.

<comment><USER5> Expensive.

Expensive expensive expensive.

They would have to replace all of the turnstiles (for some reason I doubt they could retrofit them) which is a _ton_ of turnstiles. The MTA subway is BIG (as far as I know, bigger than SF and Boston, in terms of number of stations).

They would need dedicated central servers to handle everything, unlike they have now, which the article says "complements" the existing system but which is not required for operation.

MetroCard came out over a decade before CharlieCard (Boston) so they have tons of infrastructure that would cost an absurd amount of money to replace. I imagine they figure it isn't worth it, especially when there are so many other subway projects that need money.

<comment><USER6> Central servers are not required for contactless cards. The card itself holds the current balance inside a tamper-proof secure element, and it's updated with every ride.

A central server can be used for things like web-based reloads and auditing, complementing the system... but it's entirely possible for a terminal to remain in offline-mode and just check-in at the end of the day to get any pending messages and upload logs. This is why it takes longer to reload/unblock a SF Clipper card using a reader in a bus (offline mode) as opposed to at a BART turnstile (online mode).

<comment><USER7> > ...tamper-proof secure element...

It doesn't even need to be held in anything secure, you just need to sign the balance when writing and check the signature when it's used.

<comment><USER8> If your turnstiles can't talk to a server, they can't check key revocation lists, and I tend to imagine that in a city the size of New York somebody's going to leak a key every now and again - it's been known to happen with physical keys; why not digital ones, too?

<comment><USER9> But they don't need to have a realtime revocation list -- it's fine if a broken card works until the end of the day, or even the end of the week, as long as it stops working faster than keys are leaked or cracked.

So a bus turnstile can do transactions when it returns to the garage, and turnstiles in locations where it's hard to run data for whatever reason can get a plug-in every so often on a regular maintenance run.

</comment></comment></comment></comment></comment></comment><comment><USER10> I used the same sources a couple years back to develop a MetroCard balance checker for iPhones. It used a cheap headphone jack magnetic stripe reader from China. Never got around to actually doing anything with it though.

<comment><USER3> Interesting! Do you happen to still have your source and/or research? I'd love to add it as a bullet on the post.

</comment></comment><comment><USER11> It's a good system. The fact that the hacker crowd hasn't even figured out the basics yet is amusing.

MetroCards are validated by both the station computer and the central data center. Once a card has been used, it can't be used again for 18 minutes. This makes copies of cards almost useless. There's a lot of mutual mistrust designed into the system. The MTA isn't stupid.

<comment><USER12> > Once a card has been used, it can't be used again for 18 minutes

I'm not sure what you mean. I've used mine twice in quick succession to pay for a friend.

<comment><USER13> That limit does not apply to prepaid MetroCards at the same station. What the OP is referring to is that one cannot clone an unlimited weekly or monthly card while having it be useful. They have a 18 min lock out. Using a prepaid card repeatedly will just drain the value of that card.

<comment><USER14> That's unfortunate. There were definitely times when I lived in NYC (pre- Metrocard) when I took two rides within 18 minutes (take short ride, jump out of station for quick errand, come back in for next part of journey). Are you saying that would not be possible?

<comment><USER15> Nope, that's only for the same station. Assuming you swipe into station A, exit station B, and swipe again at station B, you're fine.

If you swipe into station A, realise you got into the wrong entrance, you can usually just walk to the 24-hour booth and ask them to let you in the gate.

Also you can walk to another station.

</comment></comment></comment></comment></comment><comment><USER16>
         Despite being over a decade old, these slides
         (and accompanying 2600 articles) still represent
         the best publicly-available research on the MetroCard format.

Isn't that an endorsement of Cubic Transportation Systems'[0][1] security by obscurity work quite well in this case?

[0]: [https://youtu.be/YSmqwJmKh2E?t=1833](https://youtu.be/YSmqwJmKh2E?t=1833)

[1]: [https://en.wikipedia.org/wiki/Cubic_Transportation_Systems](https://en.wikipedia.org/wiki/Cubic_Transportation_Systems)

<comment><USER3> I think it's worth keeping in mind that that presentation (and accompanying papers) came out in the spring/summer of 2006. Google Patents didn't appear until December of that year [0], and the USPTO certainly didn't have an online search or API back then (it does now [1]).

The information was always _there_ , but it's only become easily _accessible_ in the past few years. To me, that speaks tremendously towards Battaglia's research.

[0]: [https://en.wikipedia.org/wiki/Google_Patents](https://en.wikipedia.org/wiki/Google_Patents)

[1]: [http://assignment.uspto.gov/](http://assignment.uspto.gov/)

</comment></comment><comment><USER17> Interesting read, but somewhat disappointing. I expected something like a demonstration of a card reader dumping the contents of the card, and an Arduino-controlled magstripe spoofing it. Excellent writeup nonetheless!

<comment><USER3> I actually have dumped MetroCards using a reader, but I'm saving that for a third post ;)

<comment><USER18> I take it that if you figure out you can write a stripe that overflows the scanner firmware in a way that unlocks the gate you won't post it until you're done using it...

<comment><USER3> If you're asking whether I'd exploit it, the answer is a firm no. I'm not the biggest fan of the MTA (nobody who lives in NYC for any substantial amount of time is), but the personal benefit would be minuscule compared to the consequences.

More to the point, making a public display of weaknesses in the MetroCard might finally get the MTA off their ass and onto that modernization project they've been promising for the last 15 years ;)</comment></comment></comment></comment>


Ask HN: Looking to team up on a web project - <AUTHOR>

I am a Java and .NET developer (3 years of programming experience) looking to work with another developer on a web project. I am open to doing the web app in another language as well. I have a day time job as a developer but am looking to gain some entrepreneurial experience on the side. Please contact me at firstname.lastname@example.com if you're interested.<p>Note: I am not looking to pay monetarily for this. It is just a way for both of us to gain experience and of course if the project grows, we would split the profit. <comment><USER2> Can you brief about the project you are talking about?

<comment><AUTHOR> I have an idea for a sports website that caters to casual sports fans discussing sporting events. During football season, this could be fans discussing big games or standout performances from players etc. I think there really isn't a central place for avid sports fans to discuss events. Most fans go to espn, yahoo sports for articles, scores etc but not to give their own feedback on the events.

But really I am looking for a way to expand my skills beyond what I learn at the workplace. If another developer has an idea they want to put into fusion and work with someone else, I am open to other ideas as well.</comment></comment>


Google, It's not search but ads - <AUTHOR> http://yubrew.blogspot.com/2007/06/google-its-not-search-but-ads.html <comment><USER2> Will Google stay focused on it's foundation of a clean design for the user's searching experience? Or, will Google loose sight of the user and become a page of cluttered advertisement? Hmmm...

</comment><comment><USER3> So suggest yubrew how such giant company like Google is, should generate income and provide all its services (very good services imho) for free in the same time.

<comment><AUTHOR> My implication was that nearly all (99%) of their multi-billion dollar revenues and profits come from advertising, and that there is still plenty of room to innovate in the realm of contextual and behavioral advertising.

Google's massive revenues are due to innovations with online advertising, not with providing good web services. And this will most likely not change.

</comment></comment><comment><USER4> wasn't this blindingly obvious? eyeball time matters because people who have stuff to sell need people who wish to buy. search/email/maps... are just ways of making your net-billboard the first one people see. finally people are being 'paid' to receive advertising.</comment>


Makerbot CEO: Let's try that again - <AUTHOR> http://www.makerbot.com/blog/2012/09/24/lets-try-that-again/

<comment><AUTHOR> (Top of page)</comment>


A few reasons to try intercooler.js this year - <AUTHOR> http://intercoolerjs.org/2018/01/04/a-few-reasons-to-try-intercooler-in-2018.html <comment><AUTHOR> I apologize for self posting on HN, but I haven't been doing much PR for intercooler lately and I'm hoping some new people find it an interesting alternative.</comment>


Spaniards prototype ARM-GPU hybrid supercomputer  - <AUTHOR> http://www.theregister.co.uk/2011/11/14/bsc_arm_gpu_hybrid_supercomputer/ <comment><USER2> It looks delicious, I have been hanging on to my core2quad for nearly 4 years. Can't wait to switch over to an ARM box.

<comment><USER3> I'm personally holding onto my Core2Duo until a general-purpose processor with 32 cores is available to consumers. It's completely arbitrary, but 32 cores is for me, psychologically, the point where it feels like a crime not to design a program in a concurrent fashion.

Picking such a buy-threshold also has the added benefit of suppressing any desire that I might have to update to the latest and greatest. I look at something and I think: "Well, that's nice, but it's no 32 core processor."

</comment></comment><comment><USER4> If I could wave my putative magic wand (hazel with ebony trim) I would hope for a small box of these in an arrangement that allowed a flat cable to attach to an existing x86 box. This way I could rehabilitate older (if not wiser) hardware to perform up to new and higher standards.</comment>


Why Coders Are Going Nuts Over Apple's New Programming Language - <AUTHOR> http://www.wired.com/2014/06/apple-swift-language/ <comment><USER2> People at the WWDC showed enthusiasm; I'd hardly call this "coders" as if it encompassed the entire coding ecosystem.

I find it interesting, but a majority of what I'm reading from others indicates:

* It's interesting

* It feels like Go.

* It borrows heavily from Rust

but the biggest thing...

* It's better than Objective-C

But then, this is Wired.

<comment><USER3> >It's better than Objective-C

This is pretty much the only thing we (programmers) at my work were talking about yesterday. The language itself is pretty neat but not really anything groundbreaking. The fact that you can code iOS without using Objective-C or busting down to the C++ level is really great news though.

<comment><USER4> I've been doing this (writing for iOS without using Objective C) for a long time now using Xamarin, so my reaction to the announcement was along the lines of "oh, that's cute."

</comment></comment></comment><comment><USER5> > For both Larson and Pollak, one of Swift's biggest advantages over > Objective-C is that it does what's called "automatic garbage collection." > Basically, this means that it will automatically dispose of unneeded > information that's sitting in a machine's memory, and the result is that > developers won't have to spend a lot of time and energy trying to deal with > memory management on their own. This is the primary reason that Larson > believes Swift can reach a much larger number of developers.

Ummm... Automatic Reference Counting is not new to Swift (nor is it "garbage collection"), and has been part of Objective-C since 2011.

[https://developer.apple.com/library/prerelease/ios/documenta...](https://developer.apple.com/library/prerelease/ios/documentation/Swift/Conceptual/Swift_Programming_Language/AutomaticReferenceCounting.html)

</comment><comment><USER3> > With something that Apple calls an "interactive playground," Swift is even > exploring a highly visual kind of programming that may go beyond other > mainstream languages

I thought the "interactive playground" was just a REPL, is it something more?

<comment><USER6> Yes, it's more than a REPL.

It doesn't work at the level of single expressions. It's more like a script editor that re-runs the script in realtime, as it's edited. It also allows real-time inspection of values, with useful visual representations (e.g. graphs of values over time, colours, paths, images etc.)

It's pretty cool, though I'm not sure how much use it is over a regular debugger for an experienced programmer. Great for playing around with though.

<comment><USER2> So... like a smalltalk environment? Or something like jsfiddle for javascript?</comment></comment></comment>


IE9 vs. Firefox 4 (done in canvas) - <AUTHOR> http://people.mozilla.com/~prouget/ie9/ie9_vs_fx4.html <comment><USER2> I'm still not sure what the point of all this is. Any developer worth their salt already knows that IE9 is more or less a small step forward but still far short of what it needs to be and of what FF/Chrome have accomplished ages ago. Any non-technical user won't be reading this article and won't give a damn about IE vs. FF vs. Chrome, as long as their internets work.

Why keep up the pissing match? Who are they talking to?

<comment><USER3> The point is that Microsoft has been terrible at this since 1999.

They consistently do their own thing instead of going with standards, and they are always behind the curve. They seem to be trying to catch up with standards but have been unable to make any sort of impressive progress. To be honest, if they've put five years into it and are still so far behind, they need to fire some people.

Does anyone actually consider IE to be a valid contender for browsers? Personally, I gave up years ago.

<comment><USER4> > To be honest, if they've put five years into it and are still so far behind, > they need to fire some people.

You are assuming Microsoft wants to adhere to standards. I find it more likely their strategy is to fragment the market because the day web applications become the norm, as opposed to desktop applications, they become OS- independent and Microsoft will have its main advantage (the Windows software ecosystem) negated.

They won't allow that.

<comment><USER5> > the day web applications become the norm,

That will never happen. Web apps have critical issues that can't be solved even by HTML8.

<comment><USER4> Care to explain those issues?

<comment><USER5> The issues are quite noticeable for someone that isn't heavily invested in web apps. Most of HN is - and that's why they prefer to ignore them.

But let's look at the market... Have web apps displaced desktop apps? No. Have they displaced mobile apps (as per HN mantra 90% of iPhone apps could be web apps)? Not even close.

Now why is this? It's because web apps offer a significantly poorer user experience across the board.

* with all the progress that's been made in performance, web apps are slower than native apps and will continue to be. There is only so much that you can offload from JS.

* web-apps don't have access to the platform's entire range of graphics capabilities, including standard widgets, animations and so on.

* web apps don't have access to special platform functionality such as GPS, sensors, camera, etc.

Furthermore, the biggest mobile players have all started to invest in native mobile apps to the detriment of web apps. Including Google. It's in their interest to lock-in users to their platform, even more so since Android became a major player.

These issues can be worked around eventually (maybe).

The core issues with web apps can't be worked around:

1\. Web apps are using a text-transfer protocol with a pile of hacks on top to make it stateful. To this day engineers are still working on solving this problem (web sockets, web sql, etc). They can't solve it.

2\. One does not own web apps, one merely rents them.

<comment><USER6> Irony: using a web app to suggest that web apps haven't displaced any native apps.

<comment><USER5> The fact that three people consider HN to be an application is nothing short of mind-boggling. I guess if this is the case, I've been doing webapps since before HN was even invented. We used to call them web sites back then though...

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This is why Developers hate IE, we have to make code specifically for that browser. I guess if you truly hate Microsoft, you wouldn't code it and just tell the user to download Firefox.

<comment><USER8> > This is why Developers hate IE, we have to make code specifically for that > browser.

Stop using -webkit, -moz, -o first.

<comment><USER9> Red herring. Vendor prefixes are part of the standards process.

Once the standard is finalized, you simply drop -moz and you're done. This is nowhere near the same league as IE CSS/JS fixes.

</comment></comment></comment><comment><USER10> > What's missing in IE9? ... text-shadow ... CSS3 Gradients ... border-image > ...

really? MS wont even support frikken text shadows? ffs ms. don't ship the fucking thing then, just take your time and get it right, please don't break everything again, my life is to short.

what did i do to you to make you hate me so :(

<comment><USER11> The craziest thing about it is they removed the old `filter` hacks for (bad, but hey) text shadows without replacing them with their modern CSS3 equivalent. (I should clarify: I mean in IE9's IE9 mode, naturally.)

<comment><USER12> filter was renamed -ms-filter and the syntax was changed in IE8.

<comment><USER11> I know. But neither works in IE9 standards mode.

</comment></comment></comment></comment><comment><USER13> The funny thing is, while as a web developer I hate with all my guts fighting IE standards(?), I also hate how Firefox (yes even version 4) is a memory hog. It's unbearable to work with it consuming 700mb to 1Gb of memory, with just a few tabs and firebug on.

Chrome(webkit) on the other side, wins both of these two combined any time of day.

Mozilla, you have come a long away, you created history when you came out with Firefox, you destroyed IE user base back in the days, and in Europe you are now the number one top browser. However, please stop comparing yourself to other browsers and work on your own issues.

Point being is, I love FF (although I'm not using it lately), but I'm hating how cocky they are becoming.

<comment><USER14> I understand that people like netbook/nettops etc, but ram is _really_ cheap. At 10$ / Gig range there is little reason to have less than 8GB and 16GB while probably overkill is still fairly inexpensive.

[http://www.newegg.com/Product/Product.aspx?Item=N82E16820231...](http://www.newegg.com/Product/Product.aspx?Item=N82E16820231310&cm_re=DDR3-_-20-231-310-_-Product)

<comment><USER13> "Algorithms are for people who don't know how to buy RAM." - no idea who wrote this

<comment><USER14> "The secret to happiness is running software on a better computer than the dev who created it." -me

<comment><USER13> that just shows how bad developers are out there

</comment></comment></comment></comment></comment><comment><USER15> I just created a user to say to the site's author:

Your site isn't HTML5 compliant, bro.

JUST SAYIN'.

[http://validator.w3.org/check?uri=http%3A%2F%2Fpeople.mozill...](http://validator.w3.org/check?uri=http%3A%2F%2Fpeople.mozilla.com%2F~prouget%2Fie9%2Fie9_vs_fx4.html&charset=%28detect+automatically%29&doctype=Inline&group=0)

</comment><comment><USER16> Kind of reminds me of when Scott McNealy was so obsessed with Microsoft that he didn't seem to notice Sun's real competition sneaking up behind him.

<comment><USER10> it reminds me of the last 10 years of my life wasting countless days/weeks cleaning up after msie 6/7/8.

</comment></comment><comment><USER17> Well, at least IE9 is somewhat up to date. HTML5 is still a working draft that no-one implements fully. Everyone implements a certain subset of it and I don't quite see how one subset is supposed to be superior to another subset as long as their is no one who implements it fully. Gee, at least Microsoft is making an effort!

And by the way, an uncluttered, fast-starting browser that implements a somewhat smaller subset of HTML5 than a messy, slow-as-molasses browser might have something going for it, too. Just sayin'

<comment><USER18> There is a common subset that most browsers have supported for a long time. I think the benefit of supporting that subset is pretty obvious, and I don't see how you can make the argument that a subset of a subset is better than the larger subset.

</comment></comment><comment><USER19> What's the deal with all of this high school bitchfesting going on lately between Google, Microsoft and Mozilla? My opinion of each of them drops every time they involve themselves in this crap.

How about you all stfu, work on your respective software and let your products do the talking?

</comment><comment><USER20> Seems to render well in Chrome. ;)

</comment><comment><USER21> We really need to stop measuring "compatibility" numerically. Its dishonest and encourages engineering decisions to be made instead of policy ones, when the data is purely the result of someone else's policy decision.

Not all things have equal weight; choosing which things to call an element, which ones to merge, which ones to split is always subjective.

Valid discussions are where we fully state our chosen assumptions, not ones where we then make fake data out of them.

</comment><comment><USER22> Does the page render correctly in IE9? :P

<comment><USER23> No, all the graphs are missing and the specified fonts aren't loaded.

<comment><USER24> Because IE is still missing something as fundamental as data uris, and the font is specified that way in the CSS.

</comment></comment></comment><comment><USER25> The horrible flash-of-unstyled-content suggests that this is not a good use of canvas. :P

<comment><USER26> The flash is because the styles are defined at the bottom of the document (not really sure why...)

Canvas is only used for the charts.

<comment><USER25> I placed far too much trust in the title of the story, alas.

</comment></comment></comment><comment><USER27> Ugh. What's with the caps lock? This is incredibly hard to read (for me, at least). It just looks offensive.

This is going to be far less effective than a nice, _polite_ feature comparison would be.

</comment><comment><USER28> Why would I care what platforms are supported if I only use one? Also you could probably the numbers reversed if you asked Microsoft.

</comment><comment><USER29> seeing all this energy wasted trying to convince people firefox 4 is better than ie 9 sort of solidifies my belief that chrome reigns supreme

<comment><USER30> Not sure why their marketing affects the actual merits of Firefox or Chrome, but. I agree that Firefox is trying a bit too hard (though this appears to simply be one user). Additionally, Chrome is still faster and has less ui- chrome that gets in my way. I also find the extensions to be more cleanly implemented still than Firefox 4's.

<comment><USER31> The one thing I dislike about Chrome is that I still find it buggy at times on my mac. Buggy in strange ways and especially with the inspector/debugger. That being said, I still use it as my main browser. Going back to FF annoys me when there are two input boxes (address bar and search) and that the tabs don't close under each other (for really convenient tab closing). Other than that I'm sort of indifferent.

<comment><USER26> I'd love to hear more about those bugs you're getting. Feel free to bug (hah!) me on twitter @paul_irish or report straight to <http://new.crbug.com>

</comment></comment></comment></comment><comment><USER32> all this tells me is that firefox is scared of IE. which I guess is a good thing.

<comment><USER33> They have nothing to worry about. Take this from someone who is going bald at a faster rate because I needed to assist in porting an chrome-only app over to support IE9. FF, Safari, Opera were no problem, money was all spent on IE

</comment></comment><comment><USER34> I really don't get why Mozilla posted this, other then to say to the 'tech' crowd "we're better then IE" but they already know that.

If, Mozilla really want to impress the 'tech' crowd they should show how they compare to Chrome because, mainstream users ONLY care about being able to view the websites they want to visit which is why most of them stick to Internet Explorer which came installed on their PC's (despite new legislation saying Microsoft had to suggest other browsers too) as they 'trust' that it will display the websites they want to see.

<comment><USER18> Microsoft is pitching IE 9 as, basically, "Hey guys, we finally caught up! We now offer an awesome HTML5alicious browsing experience, so y'all can stop switching to Firefox and come back over here!" This is Mozilla's return salvo. It's about keeping their message out there.

<comment><USER34> The way it is appearing is that Mozilla are scared of IE especially when you consider where the product has evolved from IE6.

Additionally, it needs to be said that whilst IE9 may be lacking some HTML5 and CSS3 features that Firefox 4 supports that HTML5 standards won't be completed until 2014, and Mircosoft will have its IE product fully supporting HTML5 by then.

I'm a firefox user but I still believe that Mozilla had no reason to do this, other than that they are realizing that IE has become a decent competitor again and they can't just pump out a slightly better browser to convince the crowd to convert. They've made themselves look a little stupid especially with regards to standards which won't be completed until 2014, and you can probably expect Google Chrome team to release a Chrome Vs. FF4 comparing its standards etc.

<comment><USER18> I think Mozilla _is_ worried that people will accept IE 9. If Microsoft's pitch takes hold in people's minds, the push for Firefox will lose steam.

And all of this "HTML5 standards won't be completed until 2014" talk is kind of a semantic game. That fallacious concept is why Ian Hickson is trying to move away from the unrealistic notion of a "totally finished standard." In practice, most of the stuff Firefox implements is already nailed down. IE is unquestionably lagging.

</comment></comment></comment></comment><comment><USER35> Anyone else find this infographic hard to read?

Chrome 10.

<comment><USER11> Not sure what you are trying to say. I'm in Chrome 9 and it looks pretty great.</comment></comment>


Would your home kitchen pass a health inspection? - <AUTHOR> http://news.yahoo.com/s/ap/20100903/ap_on_he_me/us_med_dirty_kitchens

<comment><USER2> Excerpt (and there is not much more to it, really):

 _What's more, experts don't believe the study is representative of all households, because people who are more interested and conscientious about food safety are more likely to take the quiz.

"You'll miss a big population who don't have home computers or just really don't care" about the cleanliness of their kitchens, said Martin Bucknavage, a food safety specialist with Penn State University's Department of Food Science.

A more comprehensive look would probably find that an even smaller percentage of home kitchens would do well in a restaurant inspection, he suggested._</comment>


The Transistor, Part 2: Out Of The Crucible - <AUTHOR> https://technicshistory.wordpress.com/2018/02/28/the-transistor-part-2-out-of-the-crucible/ <comment><USER2> Great read. For those who want to start at Part 1:

[https://technicshistory.wordpress.com/2018/01/20/the- transis...](https://technicshistory.wordpress.com/2018/01/20/the-transistor- part-1-groping-in-the-dark/)

Related: a modern day teen who makes low transistor count ICs in his garage: [https://interestingengineering.com/this-teen-is-building- diy...](https://interestingengineering.com/this-teen-is-building-diy- integrated-circuits-in-his-garage)

AmpHour Podcast episode on the teen: [https://theamphour.com/390-an-interview- with-sam-zeloof/](https://theamphour.com/390-an-interview-with-sam-zeloof/)

<comment><USER3> What I found super interesting from part I is that they envisioned the FET first (which is closer in analogy to a vacuum tube), ended up building the contact point transistor and then much later the FET idea returned and became extremely important.

This passage:

"Just as Lee De Forest had taken a vacuum tube rectifier and placed an electrified grid between the source and the sink of the current, so did Brattain and Becker imagine inserting a grid into the interface between the copper and copper oxide, where the act of rectification was presumed to occur. However, given the thinness of this layer, it seemed to them impossible to actually do this, and they made no real headway."

Clearly presages the FET.

</comment></comment><comment><USER4> I didn't know Shockley's strange roll and behavior in all of this. A wonderful article.

<comment><USER5> Shockley aspired to take on more executive roles at corporations but was relegated to take up academic roles, for which he was more suitable.

</comment></comment><comment><USER6> Great overview</comment>


Hundreds of Americans Planted 'Chinese Mystery Seeds' - <AUTHOR> https://www.vice.com/en_us/article/akz9qk/hundreds-of-americans-planted-chinese-mystery-seeds <comment> just-juan-post Bet this would work with USB drives too.</comment>


The Big Hack: Statements From Amazon, Apple, Supermicro, Chinese Government - <AUTHOR> https://www.bloomberg.com/news/articles/2018-10-04/the-big-hack-amazon-apple-supermicro-and-beijing-respond <comment><USER4> There's denial and there's vehement to the point complete denial from multiple different companies.

It's either a giant conspiracy by the FBI and multiple mega-corporations to blatantly lie, on public record, about a matter that if happened would most likely come up in the future again. Furthermore if apple and amazon were both notified for comments, there is good reason to suspect that the FBI would hear of the article and try to censor such an article for national security reasons, especially so if they made apple and amazon lie about it.

Or ... Bloomberg didn't do their due diligence and were too eager to be duped by agents who wanted to push an agenda to move manufacturing away from china or something similar.

<comment><USER5> > It's either a giant conspiracy by the FBI and multiple mega-corporations to > blatantly lie, on public record, about a matter

Like, say, the matter of secret surveillance on the mass scale? I mean, the track record here is not exactly pristine.

> Bloomberg didn't do their due diligence and were too eager

That is a distinct possibility too. But I think we are now beyond the point where we could say "major tech companies would never lie together with the US security apparatus on a matter of public importance". They would, if they think it's worth it.

<comment><USER6> _> But I think we are now beyond the point where we could say "major tech companies would never lie together with the US security apparatus on a matter of public importance". They would, if they think it's worth it._

This is just conspiracy theory thinking. You offer no evidence for this incredible assertion. _Some_ companies have previously collaborated with the government, generally without explicitly lying, but we cannot jump to the conclusion that all companies would voluntarily lie in a coverup conspiracy -- which, by the way, opens them up to investor lawsuits and risks destroying their branding, for no good reason. We also do know that the government cannot legally compel companies to lie, only to remain silent.

<comment><USER5> It's not "theory", it's publicly known facts that companies participating in mass surveillance denied it, and US official lied under oath to Congress (and weren't punished for it) to conceal it. There's no "theory" here.

> You offer no evidence for this incredible assertion.

The evidence to the above is publicly available and has been discussed to death. If you somehow managed to miss all of it, start with [https://en.wikipedia.org/wiki/Mass_surveillance_in_the_Unite...](https://en.wikipedia.org/wiki/Mass_surveillance_in_the_United_States) and go on the links from there, it will take you some time.

> Some companies have previously collaborated with the government, generally > without explicitly lying,

Yes, saying "we do not conduct this particular kind of surveillance ordered by this particular person" while knowing they conduct a slightly different kind of surveillance, ordered by different set of persons - is not explicitly lying. Just like saying "we don't have surveillance technology installed by FBI" if it's installed by NSA instead. There are many ways of lying without "explicitly lying".

> but we cannot jump to the conclusion that all companies would voluntarily > lie in a coverup conspiracy

We can not and we do not. We do not know whether any specific company would lie - we just know this option is now very much on the table.

> which, by the way, opens them up to investor lawsuits and risks destroying > their branding, for no good reason.

Being on good terms with somebody as powerful as US federal government is a very, very good reason. And I don't see anybody's branding being destroyed so far by the revelation of mass surveillance. We know about [https://en.wikipedia.org/wiki/Room_641A](https://en.wikipedia.org/wiki/Room_641A) and [https://en.wikipedia.org/wiki/Hemisphere_Project](https://en.wikipedia.org/wiki/Hemisphere_Project) \- has AT&T brand been destroyed? Not in the least. And the government granted them immunity from lawsuits related to this.

<comment><USER7> Your whole post is filled with unsubstantiated conspiracy theories. The only program that named these companies was PRISM, which ingests data from targeted electronic wiretaps conducted by the FBI. None of the companies lied about that.

</comment></comment></comment></comment></comment><comment><USER8> Apple and Amazon probably have a small set of TS/SCI cleared employees who dealt with this mess. It's likely 99.99% of the employees at those firms had no idea what was going on. The switching out of thousands of compromised servers was probably made to look like routine maintenance or upgrades and the whole affair was kept secret. That is, until some high level government employees intentionally leaked it to the media, probably under direction of the White House to garner support for a more aggressive stance on China - <USER2> trade war in particular. Read between the lines.

<comment><USER9> That's a _lot_ of unsubstantiated assumptions. It's also explicitly denied by both Amazon:

>It's untrue that AWS knew about a supply chain compromise

and Apple:

>we have conducted rigorous internal investigations based on their inquiries and each time we have found absolutely no evidence to support any of them.

There's no in "between the lines" or ambiguous wording there, they flat out deny it. Unless this small set of "TS/SCI cleared employees" worked completely on their own without reporting to anybody else in the company this means that they are lying in these statements.

It's possible that they do just that but it's a bit strange to me that they wouldn't find an easier way to deflect the issue without using such a strong and explicit language. Something vague like "we've been working with the authorities and have no reason to believe that any sensitive information has been leaked etc..." would be easier to spin if it turns out that somebody can prove that these attacks took place.

Surely if the scale of the attack was as large as reported by Bloomberg in their article it should be possible to find one of these backdoored boards in the wild? Or at least have testimonies by employees in these company that could testify that batches of motherboards were suddenly replaced for no obvious reasons?

And if trade war is the reason why deny it now? What do they have to gain from that, they're the victims in this story as far as I can tell.

<comment><USER10> I found this wording interesting:

> We did not uncover any unusual vulnerabilities in the servers we purchased > from Super Micro when we updated the firmware and software according to our > standard procedures.

Does that mean they did uncover some "usual" vulnerabilities?

<comment><USER11> Most of the out-of-band management systems (aka IPMI/DRAC/LOM) that server vendors use are built by the same 2-3 companies and rebranded.

These companies churn out some truly horrible software with little consideration for security.

It's often difficult to automate firmware updates, so they tend to stay vulnerable.

It's a similar situation to webcams: [https://youtu.be/B8DjTcANBx0](https://youtu.be/B8DjTcANBx0)

</comment></comment></comment></comment><comment><USER12> "Apple has never found malicious chips, "hardware manipulations" or vulnerabilities purposely planted in any server. Apple never had any contact with the FBI or any other agency about such an incident. We are not aware of any investigation by the FBI, nor are our contacts in law enforcement."

Bloomberg's article and Apple's statement can't both be right.

<comment><USER13> expected given that we're talking about is something that could be the plot of a jason bourne movie.

<comment><USER14> Or if Apple is bound by some kind of non disclosure order.

<comment><USER12> Even if they were bound by a non-disclosure order, this response goes beyond what's necessary to refute the story and conveys material information which would be used against Apple by shareholders if it is later found to be factually inaccurate.

</comment></comment></comment></comment><comment><USER15> A lot of people are unaware of how anonymous sources in a serious news organization work. Here, it means that the multiple high-level intelligence officials described in the article are known to and vetted by Bloomberg. They've looked at their resumes and bona fides, and confirmed their backgrounds. They're just not revealing their names to us.

So which is more likely: that multiple intelligence officials are making this up, or that Apple/Amazon/Supermicro feel obligated to lie because this is an ongoing classified counterintel investigation?

<comment><USER16> Plenty of claims by "senior intelligence officials" have proven to be factually incorrect. Same goes for press statements.

It's simply too early to tell who's telling the truth, who's mistaken, and who's lying here.

</comment></comment><comment><USER17> Best line from an otherwise serious and and important piece of reporting:

"Two of Elemental's biggest early clients were the Mormon church, which used the technology to beam sermons to congregations around the world, and the adult film industry, which did not."

...which did not.

</comment><comment><USER18> These denials remind me of the vehement denials the big tech companies gave when the Snowden leaks came out. Did they turn out to be false?

[https://googleblog.blogspot.com/2013/06/what.html](https://googleblog.blogspot.com/2013/06/what.html)

<comment><USER19> > _These denials remind me of the vehement denials the big tech companies gave > when the Snowden leaks came out. Did they turn out to be false?_

At what point do such denials constitute a deceptive trade practive, enabling the Federal Trade Commission to bring action?

You can't lie in a privacy policy, or a TV commercial. Where is the line?

<comment><USER20> ...

It almost makes you wonder if there is a process for ensuring companies comply with secret investigations and are forced to act publicly and privately as if they have never happened.

[https://en.wikipedia.org/wiki/United_States_Foreign_Intellig...](https://en.wikipedia.org/wiki/United_States_Foreign_Intelligence_Surveillance_Court)

</comment></comment></comment><comment><USER21> To me, this is perhaps the most worrying part of the story.

Did Bloomberg, a widely renowned and distributed news outlet with immense resources, sacrifice hard evidence for sensationalism and clicks?

Or are these companies, all widely renowned with immense resources, bound to silence due to any multitude of shady reasons?

No matter the facts behind the story and these denials, this whole thing reeks of FUD.

</comment><comment><USER22> Regardless about how you feel about the hack, outsourcing the vast majority of our technology to another country just doesn't seem like the smartest idea. Why would we put our most trusted technology into someone else's hands—just because it's going to save a few bucks? Wouldn't it be worth it to just do these things ourselves?

<comment><USER23> Its not just 'a few bucks', it is a considerable amount of money in the long term.

<comment><USER24> You sure that's adequate cost evaluation if the bloomberg accusations are true?

<comment><USER25> I'm sure that companies will start to re-shore production on to friendlier countries or at least require sub-contracting restrictions. From the article it sounds like a sub-sub-sub-contractor (SuperMicro->Main Chinese Contractor->Compromised Chinese Contractor) was the weak link.

</comment></comment></comment></comment><comment><USER26> >China is a resolute defender of cybersecurity

It is missing the word "offender" somewhere.

I think the question simply comes down to this; Can the Chinese Government be trusted?

<comment><USER27> > Can the Chinese Government be trusted?

The US Government can trust the Chinese Government as much as the Chinese Government can trust the US Government. ;)

The spy game has been played for 4,000 years...

</comment></comment><comment><USER28> This is interesting in how vehemently all the companies are denying everything. I am pretty clueless about how the feds work so I'll ask: is it possible they would be violating secrecy laws or leaking classified info if they acknowledge this really happened? Could they already be under NDAs or whatever the equivalent is in the national security world?

Or is it simply a matter of their shareholders having lofty expectations about tapping the biggest market in the world (China) and saying anything that angers China is the worst thing you could possibly do from a PR perspective?

<comment><USER29> I don't think there needs to be a conspiracy for vehement denials to make sense. Security is a hugely important reputational good for both Apple & AWS.

<comment><USER30> That reputation would be sullied substantially if the BusinessWeek article is correct, and the companies' first public statements state otherwise.

</comment></comment></comment><comment><USER31> Well, this explains why all those chipmaker acquisitions failed/were rejected on National Security Grounds.

It would be whole lot harder to find these modifications if this was on the silicon itself.

<comment><USER32> >> It would be whole lot harder to find these modifications if this was on the silicon itself.

Intel ME is well know to be on the chip itself. When you're really good you hide exploits in plain sight.

</comment></comment><comment><USER33> Nothing adds up here. Supermicro boards have "designed in the USA" proudly stamped all over them. This means that either:

(a) the design process was infiltrated, which would have been done US side thus the nationality of the actors is debatable.

(b) the manufacturing process was infiltrated, which SHOULD have been picked up during design validation and production sampling.

(c) this whole thing is a load of rubbish.

Lots of questions here. This is not a tinfoil hat measure as well; genuine questions from someone who HAS worked in the EE side of things.

I wonder if this is a bunch of pre-emptive finger pointing and ass covering for an implant closer to home?

I don't trust either side of the fence if I'm honest.

<comment><USER34> I think the article is implying that the implanted chips might not have been detected due to their low profile design. Given that the bad manufacturers were subcontractors it's likely only a fraction of all the boards manufactured were compromised. It's either that or someone at Supermicro was in on it.

<comment><USER33> See my comment here: [https://news.ycombinator.com/item?id=18139739](https://news.ycombinator.com/item?id=18139739)

I don't find that method feasible.

Infiltration of supermicro IS but then you have to ask the question: who really did it as they are on US soil.

</comment></comment></comment><comment><USER35> I've always wondered if that passive device in the great crest at the US embassy in Moscow had equivalents which got hooked up to consumer devices with high voltage parts (to make people reluctant to play inside)

Remember the furore when Zenith was the last domestic manufacturer of TVs in the USA? We've come a long way since then..

<comment><USER36> It's not that dangerous to open electronics ever since they stopped using electron guns. But, consumer devices don't need to secretly spy on you when consumers buy them literally for the purpose of being spied on.

</comment></comment><comment><USER37> I have not seen anything that indicates how installing this chip would do anything at all without also modifying the trace design and fabrication of the PCB itself.

Also does anyone have information about the "baseboard management controller" mentioned? I would like to understand the complexity required to MiTM a ROM or FLASH memory read by such a controller before concluding the feasibility and number of players in manufacturing chain required for it to work.

<comment><USER38> The BMC is an ARM microcontroller that has complete access to everything, exactly like the Intel Management Engine, but the server vendors prefer a separate chip for the same job. What is described in the article is very easy to do by inserting a microcontroller on the SPI link that connects the BMC with the flash memory containing the BMC programs, which are copied from there to a RAM at boot. However, such a microcontroller would need 8 pins for at least 7 signals: ground, power, SPI clock and 4 SPI data, to and from BMC and flash memory. Nonetheless, 8-pin packages can be very small, e.g. 0.8 mm by 1.35 mm, i.e. only slightly larger than 1 square millimeter. So from a technical point of view, all is easily feasible.

The problem is that it would require compromised people in several places at the subcontractors, because the design files for the PCB must be replaced wherever the PCB is made and in another place, at the PCB assembly, the pick & place document must be replaced and an extra reel with the backdoor component must be mounted on the equipment and that reel must come from somewhere else than from the normal suppliers of the assembly line without raising suspicions.

It can be done, but many accomplices are required. Because most of the time the backdoor component will pass the SPI data signals transparently, it will not be detected at any electrical testing and the usual optical inspections are unlikely to detect such a small change.

I am using many Supermicro motherboards, so I am wondering if this story is true. If it were true, it would not be much of a surprise, because they did not do something really novel but they just matched what USA also did, e.g. in the Cisco case.

<comment><USER37> But also if a modification of the SPI bus can result in exploitation then the manufacturer will just patch the memory in place. Cheaper, easier, less detectable. So... the manufacturer is not the source of attack.

</comment></comment></comment><comment><USER39> Has this story from 2014 ever been discredited [1] ? If not, I don't see how any supply chain is safe from G8 powers

[1] [https://arstechnica.com/tech-policy/2014/05/photos-of-an- nsa...](https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade- factory-show-cisco-router-getting-implant/)

</comment><comment><USER40> Out of curiosity: why do they use the word "untrue" instead of "false"? Are there some legal nuances I am not aware of?

<comment><USER41> PR rep deliberately using newspeak to convey he's ordered to lie?

</comment></comment><comment><USER42> One thing I don't see much about in the article is the supposed chip which allegedly compromised Super Micro servers. The cover image of the piece shows a surface mount component with three solder pads balanced on a finger tip. Looks like a very simple SMD part to me.

On top of that Apple, Amazon and Super Micro are flat out denying this - <USER3> suspect Bloomberg messed up here.

</comment><comment><USER43> The oldest tactic in the book: DENY DENY DENY [https://youtu.be/yN2gU0XU5FU](https://youtu.be/yN2gU0XU5FU)

</comment><comment><USER44> Can someone point me to the exact laws or cases with precedent that would make Apple and Amazon's statements illegal if the Bloomberg article were true? I'm not doubting it, but I can't find much about this online. Pump and dump schemes, ponzi schemes, and insider trading are illegal, and those aspects of securities fraud are well documented online, but this more general "lying to the public" that these companies may or may not be doing has proved trickier to find precedence for. I am not a lawyer, and my only resource here is google, but I think there is an assumption at play that this form of lying is illegal, and I'm honestly not sure that it is.

I could be wayy of base here, but if its not illegal, than it would be pretty obvious what is going on.

</comment><comment><USER45> The cost of manufacture is a very small part of the cost of assembling computers. For the iPhone, for instance, it represents less than $10 out of the $240 or so total cost. Thus shifting production to other another locale with higher costs would not significantly increase the price of the product, and in any case labor costs are going up in China as well.

Thus you wonder why more production isn't being shifted from China to, say, Thailand, Indonesia or India. Steve Jobs once said the industrial capacity to do the work simply isn't available outside of China, in terms of skilled people and supply chains, and that may be a big reason why.

</comment><comment><USER46> Why wouldn't the current US government be shouting this from the rooftops if it was actually true?

<comment><USER47> Because at least half of the people wouldn't believe them and consider this another conspiracy theory. Even when Bloomberg pushed this there are still so many deniers in this thread.

<comment><USER48> Hell, how many conspiracy theory's have come out as true in since 2001.

Remember the "The telephone companies are routing all our calls and internet data to the NSA" conspiracy.

A bunch of people said that was fake, and there was no way this could happen.

Then more evidence came out, and the same people said there was no way that could happen, its too big of conspiracy and it would have leaked way before then.

Then the government gave the telco's retroactive immunity for spying on the public.

</comment></comment></comment><comment><USER49> "In the three years since the briefing in McLean, no commercially viable way to detect attacks like the one on Supermicro's motherboards has emerged—or has looked likely to emerge."

I know a commercially viable way to detect hardware attacks.

Standardized hardware designs, such as the "x86 standard," ARM IP licenses, and more recently, RISC-V, decentralizes manufacturing and drives the cost to commodity levels. I'm specifically proposing that the U.S. Government appropriate the patents on whichever hardware design and declare them a National Security asset, and then guarantee royalty-free licenses to any company that wants to use them.

When it's no longer a big profit center, China is no longer as interested in owning a monopoly on it.

And presto: there's no longer a monopoly on the hardware. Thus it's no longer a guarantee that your hardware is being bent to the will of a single nation- state. Hardware attacks can be detected as variations between the hardware made by one nation vs. the hardware made by another nation.

The downside is that Apple can't have the same profit margins that come from closed, proprietary hardware.

The upside is that manufacturing and process innovation (such as Intel used to do) becomes extremely desirable. It becomes so valuable that we saw Intel reluctant to offshore their best processes.

There: economic solution and political points, to boot!

<comment><USER50> Have you read the article?

Apparently one of the big factors in Supermicro success is that it has over 900 different motherboard designs, and hundreds of hardware specialists which can customize them further to client wishes.

<comment><USER49> Your post is a non-sequitur. I'm not disagreeing that Supermicro makes customized designs.

<comment><USER50> It is a sequitur in the sense that a few open-hardware motherboard designs will not be commercially successful.

<comment><USER49> Your original post states:

       Apparently one of the big factors in Supermicro success is that it has over 900 different motherboard designs, and hundreds of hardware specialists which can customize them further to client wishes.

How is that a sequitur arguing about "a few open-hardware motherboard designs" and the projections of them being "commercially succesful"?

</comment></comment></comment></comment></comment><comment><USER51> Could anyone find a list of the server models that had this compromise? I haven't seen much if any technical info in either of the Bloomberg articles.

<comment><USER52> microblade 6128

<comment><USER53> Source?

<comment><USER52> Just look at the photo, and the motherboard model.

It is only used in 1 server. And given Elemental is mentioned, it must be a blade

So that matches nicely.

</comment></comment></comment></comment><comment><USER54> I think it's now time for Bloomberg to respond. This almost feels like a repeat "Newsweek Reveals Satoshi".

<comment><USER55> This response piece was published one hour after the original report. Bloomberg obviously had both ready. It would have responded already if intend to.

</comment></comment><comment><USER56> This has been posted several times and there are tons of comments:

[1]: [https://news.ycombinator.com/item?id=18146438](https://news.ycombinator.com/item?id=18146438) [2]: [https://news.ycombinator.com/item?id=18138328](https://news.ycombinator.com/item?id=18138328) [3]: [https://news.ycombinator.com/item?id=18145645](https://news.ycombinator.com/item?id=18145645) [4]: [https://news.ycombinator.com/item?id=18138990](https://news.ycombinator.com/item?id=18138990) [5]: [https://news.ycombinator.com/item?id=18141328](https://news.ycombinator.com/item?id=18141328)

</comment><comment><USER57> For what it's worth, this exact article is linked directly from within the original article, and is addressed.

> Read: Statements from Amazon, Apple, Supermicro and Beijing

> The companies' denials are countered by six current and former senior > national security officials, who—in conversations that began during the > Obama administration and continued under the Trump administration—detailed > the discovery of the chips and the government's investigation.

</comment><comment><USER58> The article states:

>"Somewhere in the Linux operating system, which runs in many servers, is code that authorizes a user by verifying a typed password against a stored encrypted one. An implanted chip can alter part of that code so the server won't check for a password—and presto! A secure machine is open to any and all users."

I realize the intended audience for this article is not a technical crowd but can someone walk me through in practical terms how such a chip might subvert the /bin/login binary?

<comment><USER59> [https://jhalderm.com/pub/papers/ipmi- woot13.pdf](https://jhalderm.com/pub/papers/ipmi-woot13.pdf) suggests one (fairly visible) way:

> Another common feature is virtual USB disk media, which can be used to > infiltrate or exfiltrate files or to provide new boot media. The combination > of these capabilities and remote power cycling would allow an attacker to > seize control of most common server configurations. For instance, they could > restart the system and boot from a virtual live CD, then directly copy or > modify data on the host's storage devices

If the IPMI has write access to disc and/or main memory, you can do it more directly - drop a new /bin/login on the disc, or patch it in memory (similar to the LoJax attack: [https://news.ycombinator.com/item?id=18090651](https://news.ycombinator.com/item?id=18090651))

<comment><USER58> Thanks. So presumably these backdoor chips are attached to either the I2C or SMBus. That's the part I was missing. Cheers.

</comment></comment></comment><comment><USER60> It's interesting that the numerous sources all decided to confine in Bloomberg. How did they all know to go to the same paper? And if some of them went to other papers then we should hear about it tomorrow, I guess.

</comment><comment><USER61> Are there facilities anywhere in the US where motherboards can be manufactured?

</comment><comment><USER62> You know, I would watch a movie with a plot like this.

<comment><USER63> two hours of chip decaping and circuit reversing and firmware dumping! :P

<comment><USER64> I would watch a YouTube channel of that

</comment></comment></comment><comment><USER65> This sentence, wow:

> Two of Elemental's biggest early clients were the Mormon church, which used > the technology to beam sermons to congregations around the world, and the > adult film industry, which did not.

<comment><USER66> That sentence is not in this article. Perhaps you meant to post it here: [https://news.ycombinator.com/item?id=18138328](https://news.ycombinator.com/item?id=18138328)

<comment><USER65> Ah you're right!

</comment></comment></comment><comment><USER50> They allege 30 companies were compromised with implanted Supermicro servers.

Surely one of them could show the world/researchers an infected motherboard?

<comment><USER67> This. Where did all the infected motherboards go??</comment></comment>


Git wishlist: aggregate changes across non-contiguous commits (2019) - <AUTHOR> https://blog.plover.com/prog/git-wishlist.html <comment><USER2> 1\. implement the patch category that Pijul uses

2\. compose the patches

3\. either you have a nice diff to show the user, or an explanation of why that is not possible, like "Can't show you the composition of A, X, Q because X depends on C"

Unfortunately they keep rewriting pijul from scratch.

<comment><USER3> I am excited about the current rewrite though since (if it lives up to the hype) it'll bring performance good enough to use Pijul for non-tiny projects.

Not sure if Pijul will be the software to do it, but someday we'll all be using patch-based VCSs and look back at graph-based models like git the same way we look at non-DVCS today.

</comment></comment><comment><USER4> `git log` does this. Filter by --author or --grep to find the task ID or whatever.

If you want to produce a sum-total set of changes... it's a dubious/imprecise desire, as intervening changes may affect the result. But you can still do a potentially-good-enough job by cherry picking commits you're interested in from a common ancestor, and diffing the end result against the ancestor you started from. If the cherry-picks don't apply cleanly, there's no straightforward diff or answer, and then it's of course much more complex.

\---

edit: or I just googled around a little, and if all you want is the sum of all changes in arbitrary commits that you can find with log: `git log -p | diffstat`

if you add -> remove -> restore a line, it'll count that as 2 additions and 1 removal.

</comment><comment><USER5> That list is missing a level zero: "It already does, you just haven't found it yet." (Not applicable here, mind you.)

<comment><USER6> Yes, I recently discovered "git cherry" in exactly that kind of situation.

In general I'm gradually sinking into "the emperor has no clothes" when it comes to git, at least on the subject of squashing vs painstakingly manipulating history vs accepting filthy history... But I also admit the amount of _stuff_ you can do with git is so endless that I'm always surprised to find it has a good solution for a problem I never even considered tackling before it came up.

<comment><USER7> git is really simple it only has like 6 atomic operations. thats what makes it so beautiful. a git rebase to reorder the commits and drop the uninteresting ones would produce the result wanted here. along with a few other approaches.

<comment><USER6> I'm aware of the interactive rebase and the simple rebase, but the amount of stuff we throw at students and juniors, asking them to clean their history in such a hoary old ui seems like a lot to ask.

Plus, I've become painfully aware of what happens when you encourage squashing and rebasing but developers don't carefully delete the source branches. The housekeeping of old branches is nightmarish since they're all _ahead_ of the target, because rebasing means the commits aren't the commits.

And it means allowing force-push on our git server.

<comment><USER8> git rebase is akin to being a wizard but forbidden to use magic. I _know_ it's there. I _know_ it could solve a ton of my problems. But I can't use it because it would break everything from the feature-branch promotion model to my teammate's repos. It's basically useless to me, despite all the power it grants me.

<comment><USER9> We use rebase heavily and it makes our lives so much easier. The main rule is that we never rebase anything in the main repository- only in our forks. And everyone accepts that the forks are unstable.

<comment><USER10> What do you actually get out of it though? Everyone talks about "clean history" but how much do you actually use that history? (except to bisect - and bisect works better without rebasing, IME)

You're definitely missing out on being able to pull each other's branches - that's a huge help for avoiding conflicts ahead of time (if you know your colleague is halfway through a change in a given code area, start from their branch rather than master) or for unblocking development while a quickfix is making its way to master. I could believe that tradeoff could be worthwhile, but I've never found that rebasing offers any real advantages in practice.

<comment><USER5> I use it all the time! I do really messy stuff locally, and then I rebase to organize it into commits that tell a story, which makes it easier for reviewers (and archaeologists, such as me in 5 months) to understand.

Most common pattern: Commit 1 does a preliminary refactoring, commit 2 does the actual feature change.

If you squash them together, the changes are harder to understand. But in the editing process, I often end up doing additional refactoring before I'm done with the feature work, so I use rebase -i to reorder and squash the changes appropriately. (I also run tests at both commits to make sure that my story is true, heh.)

(This way, you can even do things like later revert the feature change without undoing the refactoring work.)

<comment><USER10> > I do really messy stuff locally, and then I rebase to organize it into > commits that tell a story, which makes it easier for reviewers (and > archaeologists, such as me in 5 months) to understand.

So people review commit-by-commit? What review tool are you using for that? Github and Bitbucket very much nudge you towards reviewing the PR's diff as a whole, IME.

And do you find that you actually look at the history in 5 months' time? People worry about this a lot but I find it's pretty rare to actually need more history than what's in the diffs.

> But in the editing process, I often end up doing additional refactoring > before I'm done with the feature work, so I use rebase -i to reorder and > squash the changes appropriately. (I also run tests at both commits to make > sure that my story is true, heh.)

I do that but without the reordering - it just seems like a lot of overhead (and lots of potential for conflicts since the refactoring will almost necessarily be in the same code area as the feature work) plus running the build/tests again etc.

> (This way, you can even do things like later revert the feature change > without undoing the refactoring work.)

You can do that either way, though I guess if all the refactoring commits were before the feature commits then that means fewer conflicts (though you still have to worry about subsequent refactorings in the same area). Is that something that happens often?

<comment><USER9> > Github and Bitbucket very much nudge you towards reviewing the PR's diff as > a whole, IME.

That's if you're using the merge or squash options. There's an enforceable rebase option in GitHub which preserves the original commits.

> And do you find that you actually look at the history in 5 months' time?

I often go back 2-3 years to do archaeology on code written by people who are no longer in the org.

<comment><USER10> > That's if you're using the merge or squash options. There's an enforceable > rebase option in GitHub which preserves the original commits.

A rebase by definition doesn't preserve the original commits (whereas a merge does). But I'm talking about what the workflow for reviewing the PR looks like, before you approve it for merge (in any form) - that's the usual time for review, no?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER11> As the article notes, this is hard to do cleanly, depending on the exact semantics of what you want. And even with a full spec in hand, I don't think git's data model makes it particularly easy to compute this information.

One method for doing this manually is to do an interactive rebase and re-order all the relevant commits to the end. You basically create a new branch that has all the other commits first, and then you can diff between that point and the branch head. With the example commits from the post, you'd order them A B D F G C E H; then git diff G H would show just the changes from C E H.

This is a bit annoying in that it needs to use the working tree to apply all the commits in sequence, and you have to manually resolve any conflicts that arise, which gets more difficult the larger and more-intertwined the commits get. But maybe it's better than nothing...

<comment><USER12> git-revise is what you want here. It's rebase, but without touching the working tree. This makes it _vastly_ faster, avoids changing file mtimes (which is _very_ useful property if you have a build system that operates on mtimes, such as make, or something that is watching for file system changes), and if you do need to resolve conflicts it's easier to confirm that you haven't changed anything in the final result, because that'll produce warnings and a dirty index.

[https://github.com/mystor/git-revise](https://github.com/mystor/git-revise)

Since learning about this, 90% of my rebase usage has switched to revise, and I'm much happier with it all. I also probably revise commits twice as often as I used to because it's so much faster and has no file system modification side-effects.

When there are conflicts, it only gets you a two-way merge, so that _occasionally_ I reach for rebase to help with handling non-trivial conflicts from reorderings.

<comment><USER13> I've been wanting something like this for a long time, thanks!

I like to do a lot of rebasing and splicing together/apart various commits, and I hate that rebase touches the working tree, it means I can't have my IDE open during the process or it starts throwing error messages about invalid project files (due to the conflict markers showing up.) I'll definitely have give this a look.

<comment><USER12> Yes, this is exactly what you want. Even if it's bothersome setting it up (which Python things can be, depending on how you are willing to install it; especially on Windows), you will find it worthwhile.

</comment></comment></comment></comment><comment><USER14> umm... but why can't you just create a new branch, cherry-pick all the relevant commit then diff the result with the "base"?

<comment><USER15> I'd suggest: Because _creating a new branch_ just for a one-off look at some diffs seems kinda heavyweight, and because it requires several separate operations in order to do a single thing.

<comment><USER14> branch in git are not really heavyweight, look at for example at mercurial ones and why the pypy team prefer them [0]

moreover I think this approach could be at least "scriptable", if not aliasable

.. [0]: [https://doc.pypy.org/en/latest/faq.html#why-doesn-t-pypy- use...](https://doc.pypy.org/en/latest/faq.html#why-doesn-t-pypy-use-git-and- move-to-github)

</comment></comment></comment><comment><USER16> My company GitClear has invested some years into this very wish. We came up with "commit groups", described here [https://www.gitclear.com/review_code_faster](https://www.gitclear.com/review_code_faster)

During development phase, our service has been priced at $30 user/month which is too expensive for a diff viewing tool, but we're going to start offering a free version in next couple weeks that will offer access to commit groups.

Here are some other experiments we've been working on to try to reduce cognitive load spent reviewing commits: [https://www.gitclear.com/blog/diff_viewer_updates](https://www.gitclear.com/blog/diff_viewer_updates)

I believe a lot of what makes reviewing code so time-intensive is that traditional diff viewers aren't recognizing moved or find/replace code, so devs still have to waste a lot of cognitive attention parsing what are effectively no-ops.

</comment><comment><USER17> you could use interactive rebase for this

<comment><USER18> Yeah, that was my thought. Sure, I can create artificial scenarios where it wouldn't work, but I'm certain it would work 90% of the time.

<comment><USER7> yup. and the cases it wouldn't would need developer intervention anyways.

</comment></comment></comment><comment><USER19> If your commits are clean and properly ordered, you won't need this.

And if they aren't, then you cannot rely on the diff because semantics may have changed in-between...

<comment><USER20> If your commits are clean and improperly ordered, this may be useful.

A perforce implementation I used in the past supported checking into a development branch and reviewing the set of CLNs that hadn't been merged to mainline. I don't necessarily agree with the workflow, but it was nice to have code complete, but not yet ready to ship things in everyone's working branch.

<comment><USER19> If they are improperly ordered, then the first thing should be reordering them with an interactive rebase and then you are back at my previous post, though.</comment></comment></comment>