Backdooring the Lottery [pdf] - <AUTHOR> https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEFCON-25-Gus-Frischie-and-Evan-Teitelman-Backdooring-the-Lottery.pdf <comment><USER2> Didn't read the pdf but I used to work for a lottery Corp and from what I heard security was nuts. One of the server room IT guys left for Blue Cross and later said Blue Cross was much less strict than the lottery.

I also recall one of the compliance guys telling me about the balls used in one of those bingo ball tumbling machines. He said they had to wash, dry and weigh each ball before every draw. Of course it was fun to yell to him saying on draw day "hey it's Friday did you wash and dry your balls?"

<comment><USER3> When did Blue Cross become the standard bearer for infosec?

<comment><USER4> People who haven't worked in infosec think companies like that would naturally be good at security. In reality they're some of the worst. Breaches are just very rare.

<comment><USER5> Reported breaches

</comment></comment></comment></comment><comment><USER6> As an infosec pro, If I was in charge of a lottery RNG, I would require the use of a recent unmodified Linux or OpenBSD distro and simply use getrandom(2). These custom RNG introduce 100% unnecessary complexity and risks. I am baffled none of them seem to do that and they need thirdparty certification procedures (who miss RNG flaws anyway.)

<comment><USER7> I agree. Customization provides more opportunities for employees to rig the RNGs.

My ideal RNG would be an off-the-shelf computer with a stock image and a < 20 line Python script to display numbers. This could be developed in less than a day and the entire process could be supervised by a third party. There are still trust issues which need to be dealt with (e.g. how are we downloading the image?). These issues could be dealt with with assistance/supervision from a third party or two.

The problem is that lottery RNG vendors are selling a product. Lotteries like to see machines in custom boxes with custom user interfaces. The RNGs have hardcoded game parameters. Some are automated to produce numbers on a schedule without human interaction. Others require an operator to log in and select a game to produce numbers for.

These RNGs contain thousands of lines of code. Some take the form of multiple programs and services. In some cases they even contain multiple machines.

As an example I just ran sloccount on a source directory for one of these RNGs. Here's the (redacted) output:

      62135   XXX         cpp=62135
      20447   XXX     cs=20447
      17642   XXX   cpp=17642
      9308    XXX         cpp=5969,ansic=3339
      4987    XXX     cpp=4987
      2414    XXX    cs=2414
      1926    XXX       cpp=1926
      1744    XXX    cpp=1744
      390     XXX  cpp=390
      150     XXX    cpp=150
      67      XXX      cpp=67
      35      XXX      cpp=35
      32      XXX    cpp=32
      ...

Yeah. This RNG consists of over 120 thousand lines of code.

The systems which this program runs on are set up by a single developer. This setup process is not supervised so even if the developer isn't able to slip something into the source code or the binaries he could in theory place something (e.g. a rootkit or something which simply replaces the RNG program on start) on the system itself.

<comment><USER6> I take it you are in the industry. Interesting :)

</comment></comment></comment><comment><USER8> I wonder why they didn't go for an easy technique to defend against backdoors: use two independent sources for random numbers that don't know of each other and xor their output together. The increase in cost is small and the win for integrity and security is huge.

<comment><USER9> Yes, XOR. But what's also needed is simplicity.

As another poster here said, "simply use getrandom()". Whether or not you agree with that exact function, the idea behind "simply" is exactly that, simplicity. It's a lot easier to audit code that does:

       getrandom()
       read hardware RNG
       XOR those two together
       done!
       btw ... keep a permanent log of these random numbers

But, as the article said, things were much more complicated. Who allowed something into production that had an opportunity to check for Wednesdays and Saturdays?

<comment><USER10>
      >getrandom()
      >read hardware RNG

Not secure against a mallicious hardware RNG. In principle, the hardware RNG could access the memory and corralate its output with that of getrandom.

For that matter, getrandom might be able to do something to muck with the hardware RNG, or with the code following. Or any code not part of your RNG scheme could try and muck with the results.

>Who allowed something into production that had an opportunity to check for Wednesdays and Saturdays?

The code was audited and passed because there was no such check. The machine code that made it onto the machine did not match the source code submitted, but instead had an extra function tacked onto the end. How do you defend against this [0]. What if someone sneaks the backdoor in the firmware of the harddrive, that only provides the backdoored code to the CPU occasionally.

At some point, you need to trust the people making the lottery machines.

[0] Hint, reproducible builds and signed code; but this still devolves into a trusting trust situation.

<comment><USER8> The trusting trust issue is solveable. Also, the deeper you go the more powerful you assume your adversary. If you limit the power of your adversary, you can stop before going fully back to a root of trust you can verify without a computer.

<comment><USER3> Trusting trust is solveable?

<comment><USER8> Maybe let's first specify what we are talking about. With trusting trust I mean a chicken and egg problem: To verify a computer you need another computer you trust. But then, how would you verify the other computer?

How would this be possible to solve? Exactly how you bootstrap building complex CPU's from scratch or a big factory in Factorio. You start from first principles and build a very simple computer you can verify without another computer. This guy is the root of the bootstrapping process. Then you build another computer that is too fast to check manually and make the first one check this one. Now, you already have a verified computer that you can only check with other computers.

The basic idea is clear to me, but the specific steps are not. I guess one would need a simple language for the root of the bootstrap process and write a compiler or interpreter for another more complex language in it. Then, use the second compiler/interpreter to build a compiler/interpreter for a yet more powerful language (maybe that's already C), which we run on the next node. Using this process you can end up with a verified computer that can compile stuff, or what not.

Since we would probably not be able to build a machine sufficiently fast for our needs, we need to use commercial and maybe backdoored computers. How do we protect against these? You get at least two different machines (at least different ISA) from different manufactures from different countries. Note, that it would not be a problem if they are backdoored. You must only ensure that they don't have identical backdoors.

Now you create a verified program for each of the possibly backdoored computers and make sure that they know of each other, they must be unconnected. Their output goes into a simple verifieable machine that does only bit for bit checking. If a backdoor is trigged, then the output of the two machines won't be identical anymore.

In this setuo one would need to generate random numbers on some trusted device and feed the same stream into both machines. Also, the operating system must be completely deterministic in it's behaviour. That is surely possible, but no one I know of is.

Then, you have a verified setup that does exactly what is written in the source and any backdoor in the system itself will be detected.

I'm convinced that the process above is doable for individual developers. But creating and engineering all the steps is a lot of work.

I hope some day the community or maybe even governments will have created a manual "Creating trustable trust" where all the steps are worked out.

<comment><USER3> It seems like you haven't read "Reflections on Trusting Trust"?

[http://www.acm.org/classics/sep95/](http://www.acm.org/classics/sep95/)

</comment></comment></comment></comment></comment></comment></comment><comment><USER11> I remember reading about the MUSL RNG fraud recently (1-2 years ago). Interesting that they are tying state lottery frauds to that malicious insider from as far back as 2005 (or so the slides suggest).

<comment><USER3> For anyone else that reads this and thinks the comment is referring to the musl libc fear not. Apparently MUSL is also the "Multi state Lottery":

</comment></comment><comment><USER12> The idea of a public/random mixing source is always fun. Everybody has a fun pet idea but they all suffer from one issue or another. Here's some of mine:

1\. Move the mouse around

2\. Force someone to dance and read the output from a webcam

3\. Record various RF signals

4\. Speak a joke into a microphone.

The best solution is probably just a plain, non-network computer with an open- hardware TRNG to mix the CSPRNG (I believe BSD is switching to Fortuna). Read from the CSPRNG all day loooong.

</comment><comment><USER7> Hey I'm the guy who gave the talk (Evan Teitelman). Let me know if you have any questions.

</comment><comment><USER13> Anyone getting SSL errors trying to load the slides? Nothing seems to work, including proxying over Tor.

<comment><USER14> I put a copy in IPFS:

[https://ipfs.io/ipfs/QmcgWw89GFo3Z1w9ad1H6Gom4DV4t5VRBu5zhkW...](https://ipfs.io/ipfs/QmcgWw89GFo3Z1w9ad1H6Gom4DV4t5VRBu5zhkW6s96NP2)

</comment></comment><comment><USER15> Is there a video of their talk?

<comment><USER7> The video should be up within a few months.</comment></comment>


Jeff Bezos's Top Leadership Lessons - <AUTHOR> http://www.forbes.com/sites/georgeanders/2012/04/04/bezos-tips/

<comment><USER2> I really don't like Amazon. Why?

They treat marketplace sellers like garbage and they make up 30%+ of their yearly profits.

Customer is king, which means that if they file an A-Z claim (Amazon's dispute system), they win in 99.9% of the time. The customer gets a refund and gets to keep your product.

You are required to have a 30-day return policy (which is perfectly fine), but if a customer wants to return something 6 months after they purchased it, they will win an A-Z claim if they file it.

I know a seller that lost a claim a year after the fact. I can't imagine Best buy accepting a return on a book a year after it was purchased. Amazon doesn't even do this themselves.

They've taken the Google approach and run their entire seller help center using automated responses with nobody actually on the other end.

It's sickening that they can keep this position. They treat their workers and sellers worse than anyone, yet people just don't seem to care.

Ebay, with all of their problems, is actually much better. They are much more fair to their sellers.</comment>


Show HN: Typescript-starter interactive CLI (with a 20 second animated-SVG demo) - <AUTHOR> https://github.com/bitjson/typescript-starter <comment><AUTHOR> Hi all,

I just published `typescript-starter`. It's a minimal boilerplate generator with many of the most popular development tools pre-configured and ready to start hacking. (testing, coverage, typedoc, tslint, prettier, standard- version, etc.)

The CLI lets you get started quickly, just type `npx typescript-starter` to install the latest version and run the interactive generator. (For those who haven't seen it yet, `npx` is a quick-run command which now comes with `npm`. If you have Node.js, you probably have `npx` already.)

The interactive mode lets you quickly select from a number of configuration options, and I plan to keep adding new options which work well together. Are there other packages or tooling options you would like to see added?

Thanks!</comment>


The Wavefunction Collapse Algorithm Explained - <AUTHOR> https://robertheaton.com/2018/12/17/wavefunction-collapse-algorithm/ <comment><USER2> This seems similar to Constraint Satisfaction Problems.

[https://inst.eecs.berkeley.edu/~cs188/fa18/assets/notes/n2.p...](https://inst.eecs.berkeley.edu/~cs188/fa18/assets/notes/n2.pdf)

<comment><USER3> Yes, but in this case the algorithm would need to figure out the constraints from preexisting examples and so would you not need to program complex constraints rules with probabilities by hand?

</comment></comment><comment><USER4> I read this months ago, and the impression I was left with is that this technique is simply a fancily-named variant of any normal tree-based search algorithm. You have constraints which can be represented on your search, and then you attempt to navigate the hyperspace finding a configuration which matches.

I really can't see how this isn't "wavefunction collapse" and is rather just, "search."

But I feel like I must be missing something. If this isn't right, can someone explain to me why it's not right?

</comment><comment><USER5> As I commented on the other thread on this article going right now, this is better known as sampling from Markov random fields. There is a sizeable literature dating back to the 1960's under that name.

</comment><comment><USER6> Somewhat off topic, but one of my absolute favorite YouTube videos is this [https://youtu.be/p7bzE1E5PMY](https://youtu.be/p7bzE1E5PMY) one by Udiprod that shows visualizations of wave function collapse, with bite sized, iterative explanation of all the concepts involved.

<comment><USER7> Wow amazing simulation, that channel is also full of gold.

</comment></comment><comment><USER8> Very nice and clear write up. Looks like I know what I'm going to be programming today. I particularly liked your example of how to sample existing tiles to generate rules.

I've been wanting to work on a 2d game world generated off similar constraint algorithms. But also allow some tiles with high entropy states to be able to occasionally "flip" and propagate around, thus changing the world dynamically as you're walking around.

And I shall name it Wave Function Collapse since it's clearly not controversial.

</comment><comment><USER9> I started an online interactive port of the original in Observable [https://beta.observablehq.com/@tomlarkworthy/wave- function-c...](https://beta.observablehq.com/@tomlarkworthy/wave-function- collapse)

</comment><comment><USER10> Am I being a pedant if I think this algorithm has been misnamed for the purposes of PR? It just looks like constraint satisfaction. What's quantum about this? There's no constructive/destructive interference, which to my mind is the crucial distinction between quantum and classical systems.

<comment><USER11> It's simply named only for the analogy with the Copenhagen Interpretation -- everything is in a 'superposition' (all options possible) until a single 'observation' is made, which causes a reduction in the available possibilities, which propagates across the space/structure. That's as far as the analogy goes.

This sort of loose analogy is a perfectly reasonable way to name things IMHO.

I don't hear anyone complaining that bubble sort doesn't consider buoyancy and surface tension, or that the flood fill algorithm doesn't involve any actual fuid dynamics.

I have my own theory on why people like to complain about this particular analogy, but for the sake of not causing offence I will leave it there ;p

<comment><USER12> I think people are saying that the algorithm isn't cool enough for its name.

Bubbles aren't cool, so bubble sort must be rightly chided. /s

Quantum physics? Now that's cool, regardless of how much one knows about it.

I don't think the reason gets much deeper than that, barring any disagreements that it is just plain misleading.

I guess you could argue to some degree that a name should be usefully informative to an outsider or newbie. But that doesn't really apply to things that have already established their cool factor, like 'deep learning', 'crypto', 'agile', 'serverless', etc..

<comment><USER13> I would object to the name on the basis of it influencing a misleading association. A person's brain will jump from one idea to the next based on familiar recall, and when people can't 'jump' to the correct association because their brain is filled with bad ideas that have nothing to do with the topic, then we all suffer for having to defend against it.

</comment></comment></comment></comment><comment><USER14> For how simple WFC seems to be portrayed, the only reference I can find is for use in other code. Is there any simple, but still code, examples of this? Or is it always quite a bit of work to get going?

<comment><USER15> You might want to try my project DeBroglie ([https://boristhebrave.github.io/DeBroglie/](https://boristhebrave.github.io/DeBroglie/)).

It comes with a console application that runs WFC based on JSON config files, so you can experiment with generation without writing any code.

</comment></comment><comment><USER16> Great explanation.

Think it went over the basics a _bit_ too much. Would've liked to see a bit more in depth. Great write up nonetheless.

</comment><comment><USER17> The algorithm for the first example reads just like an implementation of a SAT solver. Set a variable, propogate clauses, backtrack on conflict (learn new 'rule' from conflict).

</comment><comment><USER18> Neat. I wrote an algorithm very much like this... I mean, sure, it's just a greedy search over a contraint-satisfaction problem... but I love the name and I'm gonna use it.

</comment><comment><USER19> is this even an efficient way to calculate possible arrangements of collapsed quantum systems?

<comment><USER20> The algorithm is not related to quantum mechanics, although is is very cool. Technically, before "collapse" what is there is a probably distribution function, not a wavefunction.

</comment></comment><comment><USER21> I have no idea what this article is explaining</comment>


Show HN: Register to vote via SMS chatbot hello.vote - <AUTHOR> https://hello.vote <comment><AUTHOR> A chatbot I built with FightfortheFuture.org that makes it really easy to register to vote. Takes only 10 text messages to gather information, and then we submit to the state or send you a PDF.

Directly submits to states in CA, MA, VA, IL, GA, CO, AZ. Working on further integrations in PA (where there's an API), and other states with online systems that don't have CAPTCHAs. We'd love to work with other voter registration innovators like Vote.org, VotePlz, NovemberApp, TurboVote and Rock the Vote to improve online voter registration for everyone.

Will be open source after the election. Code is Node.js, Python and Jekyll.

</comment><comment><USER2> This is pretty radical. What happened to poll watchers? To showing up in person? To validating that somebody is actually there? So many ways to abuse this, I can hardly count.

{edit: Hey, disregard my ignorance. This is a low-friction registration app which is a good thing}

<comment><AUTHOR> Hey Joe, the registration process is actually totally distinct from voting, which is all done in-person. Poll watchers are still very necessary to ensure the integrity of everyone's ballot.

I've worked on voter registration tech for the last four years, in the US and in new democracies like Libya. I think SMS is the best way to reach people who don't necessarily have a home computer and printer or a smartphone.

<comment><USER2> Thanks! That's good to know. I didn't follow the process all the way through, so I didn't know where it would end. Figured it was some absentee-ballot thing.

I'm all for automating registration. In sensible countries (Canada) they don't register voters. If you're there and breathing, you vote. Anything to remove friction from the process is good.</comment></comment></comment>


Apple Watch sales fall 55% as consumers mark time on category - <AUTHOR> https://next.ft.com/content/3f7a0054-4f5b-11e6-8172-e39ecd3b86fc <comment><USER2> Pay Wall!!!</comment>


Which Scala Testing Tools Should You Use? - <AUTHOR> http://tech.gilt.com/post/62430610230/which-scala-testing-tools-should-you-use

<comment><USER2> Cucumber-inspired tools suffer from the same problems as cucumber itself, as recently discussed here: at best they repeat what the code already tells you, at worst they encourage business types to micromanage testing. After a bit of experimentation with these tools I went back to traditional JUnit. My tests are now vanilla scala code, which makes them easy to reason about (and debug) when they fail.</comment>


Announcing .NET Core 2.0 Preview 1 - <AUTHOR> https://blogs.msdn.microsoft.com/dotnet/2017/05/10/announcing-net-core-2-0-preview-1/ <comment><AUTHOR> Interestingly the referenced ASP.NET Core 2.0 announcement[0] addresses the .NET Framework incompatibility issue discussed on HN yesterday[1]:

 _> This preview version of ASP.NET Core 2.0 ships with support for the .NET Core 2.0 SDK only. Our goal is to ship ASP.NET Core 2.0 on .NET Standard 2.0 so applications can run on .NET Core, Mono and .NET Framework. As the team was working through the last of their issues before Build, it was uncovered that the preview of ASP.NET Core 2.0 utilized API's that were outside of .NET Standard 2.0, preventing it from running on .NET Framework. Because of this we limited Preview 1 support .NET Core only so it would not break a developer upgrading an ASP.NET Core 1.x application to ASP.NET Core 2 preview on .NET Framework._

[0] [https://blogs.msdn.microsoft.com/webdev/2017/05/10/aspnet-2-...](https://blogs.msdn.microsoft.com/webdev/2017/05/10/aspnet-2-preview-1/)

[1] [https://news.ycombinator.com/item?id=14297974](https://news.ycombinator.com/item?id=14297974)

<comment><USER2> I just read through that as someone who had been semi-following .NET Core up- to the project.json mini-crisis and I am completely lost. How is anyone supposed to just pick up (.NET Core|.NET Standard|.NET Framework) and understand what framework they need to for their app/library to work. I think at one point .NET Standard Apps were even renamed to .NET Core Apps. Are we supposed to open up the Venn diagram until we remember it?

<comment><USER3> There's a diagram floating around in their site and presentations on Youtube which I don't have access to at the moment. I might be wrong but I think one would pick Core to target multiple platforms, including Windows, and Framework only to target Windows. Standard seems to be the API that libraries should target so that they can be used on all the different supported platforms and devices.

<comment><USER4> Yeah, Standard is the intersection of the 3 APIs that MS says will work no matter which you target, without needing BCLs. Core is a bit different, but not _that_ different from Framework API-wise, and it will run anywhere, but has no native UI support. Framework is the original blend, and it is probably going to be mostly used for desktop applications and games going forward.

Core is the future, they tore a ton of the old, obsolete features out, but it means that porting a codebase that relies on those is non-trivial. Significantly, it doesn't support Web Forms, which is great for developers but a hard sell for managers.

<comment><USER5> > without needing BCLs.

Nope, that doesn't even make sense. The BCL is where all the _base classes_ live.

> Significantly, it doesn't support Web Forms, which is great for developers > but a hard sell for managers.

I can't tell if you're trolling or are serious, if you are serious that's pretty sad. WebForms is an abomination. Just because you can use drag and drop controls and "magically" get AJAX working in the background does not mean it's a good thing. I don't even know where the "great for developers but a hard sell for managers" comes from. If by your own admission it's so great, why is it not the other way around with developers hating it and managers pushing for it?

Either way, that scenario doesn't happen. WebForms has for literally years been as dead as the dodo, with only 1) legacy applications using it or 2) developers who don't have a clue and haven't bothered trying to learn anything modern.

ASP.NET MVC or ASP.NET Web API with a TS/JS frontend are the only 2 options you have.

</comment></comment></comment></comment></comment><comment><USER6> Is there any news about CoreRT? That is what I am excited for, and that would make me consider C# instead of Go.

<comment><USER7> They're working on it. If their Github milestones are accurate, they're planning a 2.1.0 release in July: [https://github.com/dotnet/corert/milestones](https://github.com/dotnet/corert/milestones)

I'm a bit curious, what are you planning to use CoreRT for?

<comment><USER6> I am system developer. So go,python,c# neither are my work language (which is C and some C++).

But i dont do everything in those two (that would be insane). I so everything non critical in python. But dynamic typing is killing me. So i am thinking about other language Go and C# and Scala-Native are bterr than others. But i want full AOT experience. I am done with whatever VM, Interpreter , etc. I want simple executable at output.

About corert last news i saw claimed it is completely in alpha stage. Is this true? For example whole reflection subsystem doesn't work yet. Is this true? (It was sometime ago i saw that news)

Wow, i talked so much.

<comment><USER8> You can publish a .NET Core application to bundle the necessary "VM" stuff, if distributing the baggage of a framework is your concern. I know this isn't really the same as native AOT though. I'm targeting many of our applications to EL7 (eg. CentOS 7.x) distributions as standalone RPMs that install on a clean Linux box and work without installing .NET Core. I install the application to /opt/my-widget and symlink the main binary to /usr/bin.

<comment><USER6> Awesome, elaborate a little bit if you can.

<comment><USER7> Basically this:

[https://docs.microsoft.com/en- us/dotnet/articles/core/deploy...](https://docs.microsoft.com/en- us/dotnet/articles/core/deploying/index#self-contained-deployments-scd)

[https://docs.microsoft.com/en- us/dotnet/articles/core/deploy...](https://docs.microsoft.com/en- us/dotnet/articles/core/deploying/deploy-with-cli)

</comment></comment></comment></comment></comment></comment><comment><USER9> Does that mean .Net 2.0 WinForms applications will work on Linux now?

<comment><USER10> WinForms is not part of the .NET Standard API surface. See [https://docs.microsoft.com/en- us/dotnet/api/?view=netstandar...](https://docs.microsoft.com/en- us/dotnet/api/?view=netstandard-2.0)

.NET Core does not include any UI libraries.

Nothing has changed with regard to WinForms on Linux. You can continue to use Mono's old WinForms implementation, but should not expect a perfect experience.</comment></comment>


Time Warner Inc. – American Company - <AUTHOR> https://www.britannica.com/topic/Time-Warner-Inc <comment><AUTHOR> A friend recently told me that Time Warner started at one point as a funeral home. I decided to look up the history of the company and found it pretty fascinating. Turns out there is some truth to what he told me along with a lot of other interesting twists and turns.</comment>


F-Droid Is a Key Source for Academics and Researchers - <AUTHOR> https://f-droid.org/de/2020/03/04/f-droid-is-a-key-source-for-academics-and-researchers.html <comment><USER2> Google Scholar, with it's ~1000 results for the F-Droid, has ~890,000 results for "Google Play Store"...

There's probably more false positives for Google Play though. Like probably more false positives than results for F-Droid.</comment>


Show HN: Gcloud Client for SSH access and SSH to searched machines - <AUTHOR> https://github.com/devdinu/gcloud-client <comment><USER2> There are good reasons the GCloud CLI and Google systems don't implement this, like managed keys (glcoud compute ssh...) and service accounts. You can use the watch command to monitor GCloud output too.

<comment><AUTHOR> Could you share what those would be. This could be done by someone who've gcp editor access. This could be behind auth and can be called via API. We've written bots to give ssh access for anyone in org.

Infact gcloud have the feature its just cumbersome [https://cloud.google.com/compute/docs/instances/adding- remov...](https://cloud.google.com/compute/docs/instances/adding-removing-ssh- keys)

Apart from that the login to multiple machines at same time is something personally i needed to check status on multiple instance of apps, dbs, kafka, cluster etc.</comment></comment>


Time is the one truly limited resource - <AUTHOR> http://www.37signals.com/svn/posts/421-time-is-the-one-truly-limited-resource <comment><USER2> Those guys are pretty set. They can write any old recycled thing, and people fall all over themselves to proclaim their genius...</comment>


20 Hours, $18, and 11M Passwords Cracked - <AUTHOR> https://hackernoon.com/20-hours-18-and-11-million-passwords-cracked-c4513f61fdb1 <comment><USER2> The article notes that many organisations don't offer 2FA. Even dismissing the issues of most 2FA mechanisms -- reliance on mobile or landline acount integrity is exceptionally poor thinking these days, similarly email providers[0] -- the option often simply _is not available_.

A particularly pathological case is banking and financial institutions. After helping an elderly, cognitively-impaired, and frankly combative and denial- tending relative[1] with OS and browser upgrades, including restoring a whole host of privacy and security tools and extensions,[2] we then had to walk through numerous bill-pay and financial sites.

One large brokerage firm actually did offer a Google-esque voice-based numeric one-time-code callbacks, to a voice line, and I give them kudos for this. It's not perfect, but ot exceeds industry norms by a huge factor. The bank, a large national institution, does not, and it took a half-dozen or more rephrasings of the question "do you offer two-factor authentication" to even get a clear "no". I was told, a week ago, that someone would call to follow up.

No one has.

Brian Krebs has an excellent, if depressing, 2018 exploration of banking security, "What Is Your Bank's Security Banking On?".[3] Sadly, the industry is dominated by a small handful of banking platform providers. Four, Fiserv, Jack Henry, FIS, and CSI, serv over 80% of the market. Bank regulators, responding to Krebs, said that "small to mid-sized banks are massively beholden to their platform providers, and many banks simply accept the defaults instead of pushing for stronger alternatives."

This is not a good situation.

Digging further into the matter, I turned up a set of publications by Experian -- the credit rating agency which hasn't been breached ... yet -- on risk and fraud, including credential compromise.[4] One of these mentions in. passing that the _typical_ person has "about 100" service-based accounts.[5] That's not all that far off the count of 700 accounts HN users have reported having.[6]

 _The very notion of account-based services is rapidly becoming untenable, even absent password security._

I mean, yes, let's make passwords obsolete (I'm a fan of very-near-field token devices, such as NFCRing[7]). But centralising services, especially data services, only makes thing worse from an all-the-eggs-in-one-basket perspective. So more importantly, let's kill accounts in favour of both stateless interactions, and reasonablly self-hosted-and-managed -- and yes, that means self-hostable and self-manageable, including by elderly and impaired people -- systems.

That's a high bar, and flies in the face of the past 15 years' surveillance- capitalism business models. But accounting and risk rules changes recognising that data are in fact liability might help get us there.

________________________________

Notes:

0\. See Matthew Miller's SIM swap horror story, [https://www.zdnet.com/article/sim-swap-horror-story-ive- lost...](https://www.zdnet.com/article/sim-swap-horror-story-ive-lost-decades- of-data-and-google-wont-lift-a-finger/) [https://news.ycombinator.com/item?id=20203482](https://news.ycombinator.com/item?id=20203482)

1\. Seeing up close not only the general bewilderment and lack of faculty of ordinary citizens in dealing with technology, but the declines imposed by age and illness, as well as the personal and psychological difficulties of fraught interpersonal and family relationships (also affected by age and illness, both physical and mental), is sobering. This is a large submarine risk brewing.

2\. OpenWRT's AdBlock on the router ([https://openwrt.org/packages/pkgdata/adblock](https://openwrt.org/packages/pkgdata/adblock)), as we'll as OpenWRT's basic firewalling, OSX 10.14, Firefox, latest updates. Extensions are uBlock Origin, uMatrix (which I must specifically tune for specific sites -- it's powerful but fiddly), Self-Destructing Cookies (also requiring per-site configuration), Privacy Badger, and Ghostery.

3\. [https://krebsonsecurity.com/2018/03/what-is-your-banks- secur...](https://krebsonsecurity.com/2018/03/what-is-your-banks-security- banking-on/) ([https://news.ycombinator.com/item?id=16534820](https://news.ycombinator.com/item?id=16534820))

4\. Stealthily hidden around Experian's website, though this search presently lists several of the beter ones: [https://www.experian.com/innovation/thought- leadership/fraud...](https://www.experian.com/innovation/thought- leadership/fraud-prevention-cybersecurity-and-identity-proofing) ([https://web.archive.org/web/*/https://www.experian.com/innov...](https://web.archive.org/web/*/https://www.experian.com/innovation/thought- leadership/fraud-prevention-cybersecurity-and-identity-proofing))

5\. "Upcoming fraud trends and how to combat them: Ebook" [https://www.experian.com/innovation/thought- leadership/upcom...](https://www.experian.com/innovation/thought- leadership/upcoming-fraud-trends-ebook.jsp)

6\. packet_nerd reports that here, though I recall an earlier mention as well: [https://news.ycombinator.com/item?id=19488899](https://news.ycombinator.com/item?id=19488899)

7\. See [https://nfcring.com](https://nfcring.com). For numerous reasons, a non-insertion-based, replaceable, repudiable, physical token strikes me as among the best possible options. YubiKey is a close approximation, but not quite there yet.</comment>


Terrible Apple products - <AUTHOR> http://justinjackson.ca/terrible-apple-products/

<comment><USER2> About Magic Mouse: I haven't had connectivity problems, but after a week of use, my forearm was in pain and my fingers were numb. An absolutely horrendous product.

I'll say one thing for Microsoft, they know how to make a good mouse.

<comment><USER3> I always thought a mouse should be vertical, like a joystick. My hand hurts at the end of the day, mostly thru turning it to grasp the mouse. That's not a resting position.</comment></comment>


Is Social Psychology Biased Against Republicans? - <AUTHOR> http://www.newyorker.com/science/maria-konnikova/social-psychology-biased-republicans <comment><USER3> >The N.Y.U. political psychologist John Jost made the point even more strongly, calling Haidt's remarks "armchair demography." Jost wrote, "Haidt fails to grapple meaningfully with the question of why nearly all of the best minds in science find liberal ideas to be closer to the mark with respect to evolution, human nature, mental health, close relationships, intergroup relations, ethics, social justice, conflict resolution, environmental sustainability, and so on."

A comment meant to combat Haidt's criticism ends up embodying it.

<comment><USER4> There is something to be said for the notion that professors or any public intellectual will bias away from conservatism -- it is the job of a public intellectual in the humanities or social sciences (at least public intellectuals of the past, before non-academics with business degrees took over any and all decision-making in American research institutions) to think critically about and challenge the status quo and the general structure of society, and conservatives almost by definition support the status quo, so it is altogether unsurprising to see fewer conservatives in professorial positions in these disciplines.

However I think here the issue is that the lack of conservatives in social psychology obscures the fact that it is a discipline with almost no real content -- they ask questions and do studies which can provide any result they wish, so the group of people engaged in the science just imprint their own beliefs on it -- getting 'data' and 'studies' that exactly conform with their worldview, not coincidentally. In order to provide basic rigor to the science (and to provide any hope of ending the current replication crisis) there needs to be scientists employing the same methods but who expect radically different (socially conservative) outcomes. Currently the best way to see which method or explanation a psychology study finds evidence for is not to read the study, but rather to read the bio of the first author, and find his or her pet theory. This is the problem at hand. The lack of intellectual diversity in the discipline just allows the intellectual farce to plod along unexposed.

</comment></comment><comment><USER5> > But where were the hard numbers that pointed to bias, be it in the selection > of professionals or the publication process, skeptics asked? ... Maybe it > was the case that liberals simply wanted to become professors more often > than conservatives.

Interesting. I wonder if those same people would explain a lack of gender diversity in tech as "women aren't interested in tech", or an analogous feeling in other fields? I guess I do not have an understanding for how much of that reaction is a general attitude towards diversity versus a reactionary stance in regards to the suggestion of a lack of diversity in one's own domain of work/expertise/culture/experience.

> But the percentages varied. Regarding economic affairs, approximately > nineteen per cent called themselves moderates, and eighteen per cent, > conservative. On foreign policy, just over twenty-one per cent were > moderate, and ten per cent, conservative. It was only on the social-issues > scale that the numbers reflected Haidt's fears: more than ninety per cent > reported themselves to be liberal, and just under four per cent, > conservative.

Certainly the social issues are more extreme, but having a ~70% to 10% ratio of liberal to conservative thinking for foreign policy is still very lopsided. I think all three categories would be considered too lopsided, not just the last one.

<comment><USER6> >Interesting. I wonder if those same people would explain a lack of gender diversity in tech as "women aren't interested in tech"?

Contrary to the declaration of independence, it is not self-evident that all people are equal. We can say that the lack of women in tech is primarily a result of cultural reasons because we have evidence that there is minimal innate, relevent, difference. We have not shown this to be the case with political parties. Furthermore, we have reason to believe that this is not the case, because political parties carry with them values and ideologies.

>Certainly the social issues are more extreme, but having a ~70% to 10% ratio of liberal to conservative thinking for foreign policy is still very lopsided. I think one all three categories would be too lopsided, not just the last one.

Is there a reason that 50%-50% is ideal? Consider the climate change debate; I do not consider it a problem that the scientific community is lopsided on this issue. Simmilarly, it may be the case that an understanding of these fields tends to make people lean liberal.

<comment><USER7> _Is there a reason that 50%-50% is ideal? Consider the climate change debate; I do not consider it a problem that the scientific community is lopsided on this issue. Simmilarly, it may be the case that an understanding of these fields tends to make people lean liberal._

You're confusing political belief with scientific opinion. There is nothing wrong with nearly everyone holding one scientific opinion. I would say there is something wrong with a lack of diversity (political or otherwise).

<comment> lhc- I don't think there's necessarily a big difference. Let's take the political belief "women should be allowed to vote". Do you truly believe that it's valuable to have a diverse set of opinions on that subject?

False equivalence in scientific opinion isn't any different from the political sphere, its just that many political issues are actually more highly debated because of a lack of hard science behind them.

<comment><USER8> Strawman; it is not the "conservative" position of a significant sized group of people that "women should not be allowed to vote". Non-zero, sure, but before you get too excited about that "concession" bear in mind I can find examples of people who think men should not be allowed to vote, _in academia_.

Further, still a flawed argument; part of the _main point_ of science is to consider questions that may be emotionally loaded or painful in a scientific manner. Forbidding certain streams of thought because it could conceivably be used to support a politically unpopular position is unscientific. At the very least you ought to acknowledge that is the case, rather than try to pretend that you have not somehow left science behind, and pretend that you will suffer no consequences from that because of the sheer, self-evident rightness of your beliefs. (And if those last six words don't at least make you pause, you don't have a scientific mind.)

</comment></comment></comment></comment></comment><comment><USER9> One could equally ask the question, "Are Republicans Biased against Social Psychology"?

Social conservatism generally seeks to preserve existing power relationships. Science is about discovering _new_ understanding.

Unless we've already passed the peak of understanding of the human condition and factored that into our politics (which is an implication of conservatism), social psychology will keep challenging conservatives.

Political views are not just different flavors. They have structural implications about what ideas one is willing to entertain. It would be much more disturbing if there was _not_ bias here.

<comment><USER10> > Social conservatism generally seeks to preserve existing power > relationships. Science is about discovering new understanding.

The lack of self awareness on HN is profound. Sure, confirmation bias exists, but that's mostly a problem for other guys, not me.

<comment><USER9> You are going to need to explain. Those statements are definitional. If you are trying to assert that scientists also seek to preserve their own power, this is true. However the point here is that social conservatism is opposed to the project of social psychology, not its biases.

</comment></comment></comment><comment> muuh-gnu Academia _as a whole_ is biased against republicans/libertarians/capitalists and toward the state, i.e. towards leftism, because thats where their paychecks come from. He who pays the piper, calls the tune.

<comment><USER9> What you are saying here implies that Republicans are biased against academia, not the other way around.

<comment> muuh-gnu Not necessarily Republicans, since they are statists too, although somewhat less than Dems.

But for the sake of argument, yes, conservatives tend to be biased against statist academia because they are aware that since academia wouldnt exist without a state it is biased toward the state and against contra-statists.

The notion that conservatives would indeed be biased against an independent, non-statist academia, simply because they are -as is often implied- biased against knowlege itself, is not convincing.

<comment><USER11> I think you're operating from a serious misconception about the Republican party- they advocate and have historically voted for extremely strong State power, just distributed for a greater degree of regional control.

<comment><USER10> I think you're operating from a serious misconception about the Republican Party.

<comment><USER11> Why? What would that be?

</comment></comment></comment></comment></comment></comment><comment><USER12> In the early 19th Century, the Unitarians "took over" Harvard from the Congregationalists. Since a great deal of academia is path dependent, academia has had a sort of Progressive bent, seemingly baked into the cake.

( I got this here; I forget which essay it is [http://home.earthlink.net/~flyingdragongoddess/indexa.html#p...](http://home.earthlink.net/~flyingdragongoddess/indexa.html#peter))

Modern Movement Conservatism isn't very close to the sort of values that academia embraces. It's not even close to what an academic might consider Conservatism ( Burke, Oakeshott ).

A lot of Conservatives come from dealing with regulation and tax codes - that's unlikely to happen to academics.

And I still think Arnold Kling's Three-Axis Model is fantastic. [http://www.amazon.com/Three-Languages-Politics-Arnold- Kling-...](http://www.amazon.com/Three-Languages-Politics-Arnold-Kling- ebook/dp/B00CCGF81Q)

</comment><comment><USER13> Here's an alarming document that shows just how hopelessly bad some of the science is in social psychology.

[http://wjh.harvard.edu/~jmitchel/writing/failed_science.htm](http://wjh.harvard.edu/~jmitchel/writing/failed_science.htm)

There's no hope of spotting or preventing bias if social psychologists are working like that so the fact that many social psychiatrists are "liberal" is going to skew the results of "experiments".

</comment><comment><USER14> Sure, social scientists are pretty open about their discrimination of conservatives. They admitted it in a survey[1].

The bigger problem is that social science has few correction mechanism. Your biases in computer science will usually be quickly and brutally dealt with by an uncaring computer. Physicists have actual, definitive experiments. Social sciences are seemingly helpless in the face of p-hacking and other bullshittery, even outright fabrications.

Ideological bias of course makes it worse (vide Stapel's paper on racism[2]) but it's not the root cause.

[1] [http://www.washingtontimes.com/news/2012/aug/1/liberal- major...](http://www.washingtontimes.com/news/2012/aug/1/liberal-majority-on- campus-yes-were-biased/?page=all)

[2] [http://www.nature.com/news/2011/110407/full/news.2011.217.ht...](http://www.nature.com/news/2011/110407/full/news.2011.217.html)

<comment><USER15> > _Your biases in computer science will usually be quickly and brutally dealt > with by an uncaring computer._

Unless, of course, you have a monopoly on a large desktop market. Then it will take some time.

</comment></comment><comment><USER16> >a lack of political diversity that was every bit as dangerous as a lack of, say, racial or religious or gender diversity.

The lack of young-earth creationists in science is very worrisome.

</comment><comment><USER17> Does anyone find it ironic how many downvotes are in this thread? An article about how a majority with a certain viewpoint is biased against a minority with a different viewpoint, and a comments section that's full of people downvoting others whose opinion they personally disagree with.

</comment><comment><USER18> I don't think this is hard to understand this.

The Republican Party (as of now) is not inclusive. If you are not white, your English is not so great, or your sexual orientation is not heterosexual, or you are traveling and learning about other countries, or you are not born here, or you don't believe in creationism, or your religious views are not Christians then you are out.

And the worst thing is that they don't even notice that. Like ridiculing me about my accent and heritage and then asking "why you are not republican - <USER2> have similar views...". Yeah... I have a Trotsky book to sell you.

So if you are in academia you will be excluded by Republican Party because of the following:

\- you don't believe in creationism

\- your religious views are not Christians

\- you are not born here

\- you are married with somebody who is not born here

\- you are traveling around the world

In short, Republican party is getting defined not by its policy but by its exclusion principle (and it is defined by Fox News - which is not helping Republican party at all).

<comment><USER19> Mitt Romney was not a creationist and he won the Republican nomination in 2012. Based on my understanding you also need to be Christian and born in America to reach the higher positions in either party.

<comment><USER18> "I believe that God designed the universe and created the universe," Mr. Romney said in an interview this week. "And I believe evolution is most likely the process he used to create the human body." [1]

What to say here?

[1] [http://thecaucus.blogs.nytimes.com/2007/05/11/romney- elabora...](http://thecaucus.blogs.nytimes.com/2007/05/11/romney-elaborates- on-evolution/?_r=0)

<comment><USER19> By that definition all christians could be called creationists. I'm not aware of any christian sect who hold the belief that God came into existence after the rest of the universe.

</comment></comment></comment></comment><comment><USER20> My comment (also on Reddit).

The problem with our current crop of rightists and science and scholarship (sometimes perceived as "bias") is the "Fox News effect." Scientists and scholars wish to determine and understand reality---and reality has a well known Liberal bias. (Think climate change, evolution, etc., etc.)

I'm willing to listen to anyone, but I am going to judge them by the standards of science and scholarship. If they are not serious about those standards, they are only worth listening to in order to determine the latest right-wing myths.

Note there are certainly people on the left who are not members of the reality based community, but at this moment those on the right are the biggest threat to science and scholarship (I omit political topics) and, in the case of climate change, our lives

</comment><comment><USER21> "Liberals may be more interested in new ideas, more willing to work for peanuts, or just more intelligent"

Nope - no bias to be found here in our neck of the woods!

Turning this around: perhaps conservatives are "more interested in new ideas" and "more intelligent", so they choose to work in other fields?

</comment><comment><USER22> People interested in furthering human knowledge in the area of social interaction are less inclined to be ideologically inclined to declare that the area of research is a solved problem?

You don't say.

<comment><USER10> You're the problem.

</comment></comment><comment><USER23> Well, there's only one truth. It's perfectly plausible that one set of ideas (conservative ideas) could be less scientific than another set (liberal ideas).

However, ideology can influence us, since we are not perfect at science. Without the strong objective feedback of the hard sciences, social psychology is particularly vulnerable.

The bias alleged in this article actually starts to look more plausible when you consider the history of social psychology and related fields. Back in the 1970s, it was taboo to mention ANY innate qualities of human nature. Gender was purely a social construction. Babies were identical in every way--people were different only because of their upbringing. Prominent biologists like E.O. Wilson who argued genes might play a role were attacked and demonized. Nothing could contradict this doctrine of the blank slate -- that we're born perfectly malleable. I highly recommend Steven Pinker's 2002 book, titled "The Blank Slate" [0] which brilliantly debunks this theory, and lays out the best characterization of human nature I've ever come across. Seriously, read this book, it is a masterpiece.

Anyway, from what I've read recently, it seems many fields like social psychology are still captive to lesser versions of the blank slate fallacy. Human nature is not as malleable as they think. Our instincts are still there (gotta eat, sleep, procreate), and even "higher" areas of the brain for things like language, emotion, and thought seem to be heavily innate (to think at all requires machinery, and there are many ways to craft that machinery). Also, genes really are more important than most seem to realize. The twin and adoption studies show that the majority of variation among people in intelligence and personality is due to genes. How your parents treated you and brought you up has almost no effect by the time you are an adult in important metrics like IQ and personality tests. Smart people are largely born smart.

These sort of "deterministic" ideas fly in the face of traditional liberal values. Topics like gender discrimination and societal inequality are undermined by these ideas, so that provides a reason for a liberal thinker to push back against them.

If the gender gap in computer science is due more to innate differences in interest than to discrimination, and if inequality of income is due more to innate differences in talent than differences in opportunity, then that makes it harder to argue for reform. I believe thinking along these lines is the major cause for bias today.

So yes, I agree social psychology is quite biased. In the future, we will look back with horror at how we let politics and ideology interfere with science.

[0][http://www.amazon.com/The-Blank-Slate-Modern- Denial/dp/01420...](http://www.amazon.com/The-Blank-Slate-Modern- Denial/dp/0142003344/)</comment>


What do YouTube's "Let's Play" Takedowns Mean For Machinima? - <AUTHOR> http://www.strangecompany.org/what-do-the-lets-play-takedowns-mean-for-machinima/

<comment><USER2> There is a reason why all of these people are on YouTube. Because you can actually make money. You can make a nice profit on YouTube and the competitors pale in comparison. I've been making a nice chunk of change on YouTube but luckily I don't do video game videos.

I have a feeling people will put up with this crap because it's the only game in town.

<comment><AUTHOR> Interesting! What's the key differentiator between YouTube and something like Blip.tv, in your experience?

I'm guessing it must be either better monetisation of their ads or better network effects, but I might be wrong?

<comment><USER3> The weight that Adwords pulls in the industry brings in higher dollar campaigns which means better payouts to video creators.

</comment></comment></comment><comment><USER4> Youtube content creators should unite and make some sort of union and reach out to Twitch.tv to see what they can offer and migrate off YouTube.

I feel terrible for a lot of these people because they put out genuinely entertaining videos for free, and make a lot of their income off it.

<comment><USER5> I agree, at the very least Twitch should recognize this as an opportunity to expand their market. If they become the place for all game videos and live streams they really have something big going on.

They already host previous live recordings so I would think they could at least leverage that to offer pre-recorded videos.

<comment><USER6> AND this is the reason why Twitch won't touch this with a ten foot pole. They would lose everything if copyright = seeing someone play a game.

</comment></comment></comment><comment><USER7> I'm confused. Some of the top channels are related to people playing Minecraft. Are these going to be taken down?

<comment><USER5> They shouldn't be, Mojang has given permission for people to make videos using Minecraft content. Although they still might, because videos are being taken down that publishers have given permission for, which is one of the major problems here.

</comment></comment><comment><USER8> A lot of this is nonsense, lots of monetization actions are being reversed with a simple response from the uploader.

Here are some comments from Jon Paula, a creator that has been earning his living via YouTube advertisements since 2009 or earlier (in '09 he convinced me that it was possible for non-top-10 channels to earn a living):

[http://www.reddit.com/r/letsplay/comments/1shutu/rumors_were...](http://www.reddit.com/r/letsplay/comments/1shutu/rumors_were_true_youtube_obviously_adjusted/)

<comment><AUTHOR> That's good news - and a great link, thanks.

Still, it's great to see the games companies lining up to allow Let's Plays, Machinima, and similar uses of their content. Definitely a positive that's come out of the whole affair.

</comment></comment><comment><USER9> It is because both xbox and ps have launched their own in-game screen sharing feature.</comment>


Raspberry Pi laptop lets kids get inside their computer - <AUTHOR> https://www.cnet.com/uk/news/raspberry-pi-laptop-education-pi-top/ <comment><USER2> The Pitop is such a piece of crap though. Put a cheap screen, horrible keyboard, ridiculously weak battery, and a 1990s trackpad in a bulky case and charge Chromebook prices for it.

<comment><AUTHOR> This is not the point. This is an open, hackable, expandable laptop that can be used as an educational tool. Unlike most (all?) current Chromebooks, this has an ARM CPU (which is attractive for some), not much memory (you can probably replace the board with a more powerful Pi-like device - some are x86-based). Their profits subsidize the development/curation of their educational software.

If all you need is a cheap ARM laptop, [https://www.pine64.org/?page_id=3707](https://www.pine64.org/?page_id=3707) is an option.</comment></comment>


Uber driver kills 6 - <AUTHOR> http://www.cnn.com/2016/02/21/us/michigan-kalamazoo-county-shooting-spree/index.html <comment><USER2> What does Uber have to do with the story, other than to demonize the company?

Was the suspect also a "milk drinker", and if so, why not put that into the story as well?

<comment><USER3> According to the article, the suspect may have been picking up fares for Uber while shooting people, so his employer does appear to be relevant to the timeline.

Also, Uber was mentioned in a quote by a law enforcement officer, as being part of the context of the investigation:

        While the company did not address reports that Dalton picked up and dropped off
        customers Saturday night, authorities told CNN that it was "certainly part
        of our investigation."

        "We're looking into his connection to Uber and whether or not he was picking up
        fares in between the shootings," said Public Safety Chief Jeff Hadley.

If the shooter had possibly been delivering pizzas for Pizza Hut in the same context, his employer would have been mentioned as well. Certainly a quote by law enforcement mentioning his employer would have been used. This isn't a hit piece against Uber, this is reporting being done the way reporting is usually done.

<comment><USER4> And if he was campaigning for Hillary between the shootings, that would also be relevant?

EDIT: on the second thought... yes, it would.

</comment></comment></comment><comment><USER5> According to the article, his role as an Uber driver had absolutely nothing to do with this shooting. He didn't shoot his Uber passengers, or utilize the service to find victims. He was a psychopath driving around and shooting people at random places.

This kind of headline is clearly irresponsible. In fact it's so outrageously irresponsible that I wouldn't be surprised if a CNN executive is an investor in a competing service. There is no reason to even mention what he did for a living, especially in the headline, except for fearmongering purposes.

<comment><USER6> How about what he did during the spree, which was work as an Uber driver between slayings.

</comment></comment><comment><USER7> In related news, county public health inspector kills 14.

(Edit: ...and an iPhone owner)

</comment><comment><AUTHOR> Is it me or is Uber being dragged into this the same way craigslist was dragged into somehow being a breeding ground for serial killers who were trolling the "adult services" section, which ultimately resulted incraigslist shutting it down.

<comment><USER8> I think the difference here is that craigslist did not employ the serial killers

<comment><AUTHOR> There aren't much details available, but it seems that the driver appeared to be a pretty "normal" family man. If the criminal background/etc didn't turn anything up, then why would there be a significantly higher bar for Uber compared to a typical cab company.

I'm no über fanboy, but this certainly looks like a piece trying to stick it to Uber and generating negative PR which could scare future users from using uber. Bring out the pitchforks!

<comment><USER8> I don't disagree with anything you said, but I think it is more reasonable to ask questions of Uber than the craigslist scenario that was provided.

</comment></comment></comment></comment><comment><USER8> oh boy...this is going to turn into a well informed, articulate, and unbiased argument on all sides. I am sure of that.

<comment><USER9> Taxi driver kills 12:

[http://www.independent.co.uk/news/uk/crime/gun-rampage- taxi-...](http://www.independent.co.uk/news/uk/crime/gun-rampage-taxi-driver- kills-12-1989456.html)

<comment><USER8> But that doesn't make for good headlines

</comment></comment></comment><comment><USER10> It matters that he was an Uber the same way it matters what political party a politician is in when they break the law, or that a person is a preacher when they break the law. There's a narrative, and journalists more often than not emphasize elements of a story that support the narrative.

Narrative being that despite background checks, Uber will let anyone drive for them regardless of safety concerns. Obviously illogical, but I know I've run into some real freaks when Ubering.

<comment><USER4> There is another narrative - government ran background checks on him as well before selling him a gun. And it let him walk around freely regardless of safety concerns.

</comment></comment><comment><USER11> I agree this is scaremongering at Uber's expense. I'd like them to be transparent about their interview/hire/employ process.

I understand they do a criminal "background check" and they have a formal interview, just the same as any cab company. Do they only do a criminal background check in the country of their employment? Or do they also run it in countries they've just moved from, etc?

</comment><comment> r-w What does this have to do with Uber, other than a careless disregard for one's appearance to others?

</comment><comment><USER12> Another random killing by a gun? Would these happen so often if guns were harder to access in America?

</comment><comment><USER13> Why not "driver kills six"? I'm not an Uber user or fanboy, just curious.

<comment><AUTHOR> That's why I posted it here. I think it's more of an intentional negative piece on Uber.

I was quite dumbfounded when the whole "craigslist killer" suddenly painted craigslist as a shady place for "weird" people online. I suspect the reality was animosity against craigslist for being disruptive to print media.</comment></comment>


Guide to Seed Fund Incubators (Y Combinator Clones)  - <AUTHOR> http://www.readwriteweb.com/archives/guide_to_seed_fund_incubators.php <comment><USER2> I know it is hopeless for me to try to get into Y Combinator (single founder, not ivy league, never worked at a big internet company ala google, already rejected). So I filled out the TechStars application and so far I had a least some followup questions asked of me (that is good).

I probably won't make the cut but the chance at having the influence and instant publicity is too much to pass up to not try.

<comment><USER3> From a cursory glance, it looks as if 4 of the current batch of 21 startups have founders who went to Ivy League colleges. Probably more worked for big Internet cos at some point, but we don't care much about that either.

It's true we're reluctant to fund single founders-- there are only 2 in the current batch-- but that's because it really does make it much harder to succeed. So you should try and find someone you know who will work with you, if you can.

<comment><USER4> How many went to MIT/Stanford?

<comment><USER3> I _think_ 1/2 but I could be wrong.

<comment><USER5> Oxford & Imperial College London count as Ivy?

</comment></comment></comment></comment></comment><comment><USER6> Article makes a fundamental mistake. From <http://ycombinator.com/faq.html>

      Is Y Combinator an incubator?
      No.

:)

</comment><comment><USER7> Thanks for the overview.

Is this really a "large" number of imitators? Would it be a stretch to say that many of these are traditional angel investing with a few small twists?

</comment><comment><USER8> Dude, Boostphase is totally bogus. I tried to reach the dude listed in a previous article about it...totally unresponsive.</comment>


PCI DSS and PA-DSS v3.0 drops SSL in favor of TLS - <AUTHOR> https://www.darasecurity.com/article.php?id=31

<comment><AUTHOR> The "Council's Assessor Newsletter" caused some confusion with their wording. The Internet Storm Center provides some analysis of the article:

[https://isc.sans.edu/forums/diary/Did+PCI+Just+Kill+ECommerc...](https://isc.sans.edu/forums/diary/Did+PCI+Just+Kill+ECommerce+By+Saying+SSL+is+Not+Sufficient+For+Payment+Info+spoiler+TLSSSL/19323/)</comment>


Equifax Certificate Unravelling Security on Windows 10 OS - <AUTHOR> https://leeneubecker.com/equifax-equimelt-vulnerability/ <comment><USER2> I fail to see the security issue here, the Equifax certificate in question (thumbprint: d23209ad23d314232174e40d7f9d62139786633a) has been revoked (on Windows 10 at least) - it is in the system store to protect users by being marked as revoked and thereby marking all child certificates and signatures as invalid.

I strongly suspect all the other listed certificates are also marked as revoked but I couldn't be bothered wasting my time checking.

<comment><USER3> Having checked, 2 out of 4 are currently revoked.

Equifax and Thawte Premium Server CA.

</comment></comment><comment><USER4> Unless I'm misreading this, the "vulnerability" is 4 certs deployed on machines with deprecated hashing algorigthms.

The steps the author takes from that to "this could allow your machine to be compromised" are.... well tenuous at best. The idea that just because a certificate is present, an attacker will easily be able to use that to sign malware and bypass anti-malware protections as a result doesn't appear supported by the evidence presented.

<comment><USER5> Moreover the hash algorithm doesn't matter for the root cert, because the system has a trusted copy of the certificate in its root cert store and doesn't need to check any signatures on the root itself.

</comment></comment><comment><USER6> This is nonsense. The self-signature on a root certificate is irrelevant unless you can easily calculate second pre-images, and that's not true even of MD5, and accepting a root doesn't mean that the validator would accept that hash function on a non-root.

Equifax is only a 1024-bit RSA key, which isn't ideal, but it expires on Aug 22nd this year and the key-size of the root doesn't impact confidentiality.</comment>


A New York Farm Stand's Success: An Eye for the Next Big Thing - <AUTHOR> https://www.nytimes.com/2019/07/30/dining/norwich-meadows-farm-vegetables.html <comment><USER2> Cornell has done a lot of research into High Tunnels. Farmers in NY State often use tunnels I think. [http://blogs.cornell.edu/hightunnels/](http://blogs.cornell.edu/hightunnels/)

</comment><comment><USER3> Can anyone recommend a seed catalog?

"Mr. Kurdieh's love of dining out, his obsession with reading seed catalogs and his ability to talk to chefs about flavors have all helped Norwich Meadows Farm stand out."

<comment><USER4> Johnny's Selected Seed if you pick just one. Wild Garden Seed for a second. Johnnys will lead you to some small breeders without paper catalogs - Row 7 Seeds, Wild Boar Farms, Artisan Seeds. And if you stay intrigued, Market Gardening Success Group on Facebook is a great group to watch.

<comment><USER5> Fun fact: I was featured on cover of Johnny's Selected Seeds in 1996 or 1997 (98 catalog) (with Bright Lights Swiss Chard).

[https://www.pinterest.com/johnnyseeds/johnnys-catalog- covers...](https://www.pinterest.com/johnnyseeds/johnnys-catalog-covers/)

Agree, it's a great source specialty seed.

Peaceful Valley Farm Supply is also pretty good for organic seeds/ supplies. [https://www.groworganic.com/](https://www.groworganic.com/)

(I usually prefer not to reveal myself particularly with image on the net but it was too much to pass up. Besides I'm older and don't look like that now. I haven't grown commercial produce in 20+ years because it's not as romantic as it looks and is a lot of work and not that much profit. But it was really fun for a few years).

<comment><USER5> @dang:

It becomes wearisome when offering a controversial opinion in one thread only to have all recent posts in other threads immediatly downvoted.

Not that it's a huge deal but it sort of is because it discourages participation or any opinion outside of certain orthodoxies.

(or perhaps this post really was awful.. who knows).

</comment></comment></comment></comment><comment><USER6> [http://archive.is/deoU1](http://archive.is/deoU1)

</comment><comment><USER7> Every time I see these 'big things', they remind me the Silicon Valley's raw water issue.

<comment><USER8> It's upstate New York: pretty much "water water everywhere, let's all have a drink".

Especially this year.</comment></comment>


Microsoft makes its 60,000 patents open source to help Linux - <AUTHOR> https://www.theverge.com/2018/10/10/17959978/microsoft-makes-its-60000-patents-open-source-to-help-linux <comment><USER2> The way this is going we may soon see a Microsoft Linux! ;-)</comment>


Ask HN: News.Y Combinator.com wants to use your devices location - <AUTHOR> I'm on here nearly every day and today, for the first time, I received a notification (on mobile) with the site requesting to use my location.
1. Has anybody else started receiving this prompt?
2. Why does this site need my location? <comment><USER2> 1\. No, I've never gotten the prompt.

2\. I don't think it needs it?

What phone do you have and what browser are you using?

<comment><AUTHOR> Samsung galaxy 7, using chrome

<comment><USER3> I'm using Chrome on a GS7 right now and have never seen this. I keep Location Services off anyway. Version 73.0...

</comment></comment></comment><comment><USER4> Answer to the first question - I mostly lurk and have not received this notification from Safari at this time.

However, I would like to know why this website (and many others) need my location data.

<comment><USER5> This website does not ask for your location, OP pretty clearly has malware on their phone. This site uses a measly 150 lines of JS and none of it involves location. Feel free to see for yourself:

[https://news.ycombinator.com/hn.js](https://news.ycombinator.com/hn.js)

</comment></comment><comment><USER6> 1\. No

2\. It doesn't

You may have malware or this is a MITM scenario, perhaps an Internet cafe? Does the site show as secure?

</comment><comment><USER7> You've got a virus.

</comment><comment><USER8> Second time I've read this question on this site today.

What are you guys installing/who builds your ROMs?</comment>


Ask HN: Why aren't there more startups in the art field? - <AUTHOR>

<comment><USER2> Because two large forms of art are locked away using copyright by legacy companies unwilling to innovate. Those legacy companies seem to be trying their hardest to kill off the two "newest" outlets for that media.

And physical art only has worth because of its scarcity.

<comment><USER3> Which two are you thinking of?

<comment><USER4> I'm guessing recorded music and film/TV.

<comment><USER2> Bingo. Music and video. The services being Netflix and Spotify. I don't like their model, I would rather own the content, but that doesn't mean I want to see them run into the ground. The industries seem to want to stunt them.

Video content is split between several services and locked into regions. All of it comes with DRM and as far as I know all of it is streamed.

Music is fairing a little better. Most popular music is sold my most stores. I think all of it is DRM free these days. However music is being pulled off Spotify due to moaning about how little per play the copyright holders recieve. There are some dodgy stories emerging about "back room deals" to try to kill off free content on various services.

</comment></comment></comment></comment><comment><USER5> Why do you think there isn't? [https://angel.co/art](https://angel.co/art)

There's more in fintech, adtech, etc, but there's quite a lot in the art space too.

<comment><AUTHOR> I don't read many article about it, that's why I think there isn't much :) (thanks for the link)

</comment></comment><comment><USER3> On the creating-art side: artistic works are tricky to sell compared to problem-solving goods (try defining the benefits vs features of, say, a print of Wheat Field With Crows), and it's a field where demand is frequently outstripped by supply.

I've worked in movies for 20 years and those are the two biggest problems that keep hitting me.

On the helping-artists side: There's plenty of space within the film world for startups, and plenty of startups or small tech companies. Most of them are hardware-based, though.

</comment><comment><USER6> The big disruption already happened thirty odd years ago with Iris Printers and the widespread production of giclée canvases. It's big business selling canvas prints to hotels and office buildings etc. It's also a nice source of mailbox checks for working professional painters.

[http://en.wikipedia.org/wiki/Gicl%C3%A9e](http://en.wikipedia.org/wiki/Gicl%C3%A9e)

</comment><comment><USER7> There's one I can think of off the top of my head: [https://www.canva.com/](https://www.canva.com/)

</comment><comment><USER8> Please, define "Art" first.

<comment><AUTHOR> Art : relative to art exhibitions, museums, the way people get access to Art (painting, photo, video, etc... the more traditional art support), buy/consume/share Art, etc...</comment></comment>


IOS T&Cs Updated to Allow In-App Subscriptions - <AUTHOR> http://arstechnica.com/apple/news/2011/02/with-the-daily-launch-ios-developers-can-also-offer-subscriptions.ars

<comment><AUTHOR> At this stage, Ars reports that the subscription service is limited to content subscriptions for apps like magazines and newspapers. However, I'm sure this payment model for apps will be lucrative enough to see expansion into other areas within the next year.</comment>


Proof That Uber Adds Economic Value - <AUTHOR> https://www.forbes.com/sites/timworstall/2017/07/15/proof-that-uber-adds-economic-value-nyc-credit-unions-go-bust-over-taxi-medallion-price-slumps/#7e0789162a9b <comment><USER2> Consumer surplus is another way in which Uber adds economic value [0]. $2.9 billion for the four cities studied. Uber today operates in like 600 cities.

[0] [https://www.nber.org/papers/w22627](https://www.nber.org/papers/w22627)

</comment><comment><USER3> s/Proof/Weak evidence/</comment>


Andreessen Horowitz backs San Mateo bike-sharing startup - <AUTHOR> http://www.bizjournals.com/sanjose/news/2017/03/15/andreessen-horowitz-bike-sharing-limebike.html <comment><USER2> It sounds like a really bad idea. These companies aren't charging very much and between ordinary maintenance, hard use by uncaring customers, and flat-out theft, I don't see where big profits are going to come from.</comment>


Peter Shankman's ADHD Superpower Webinar - <AUTHOR> http://shankman.com/here-s-the-recording-of-my-adhd-superpower-webinar/ <comment><USER2> I have ADHD, never did anything about it (was diagnosed as a kid, my parents felt that drugs weren't the solution). About 4 years ago i decided to do something about it and actually went to a psychiatrist.

Since then i've gotten married, tripled my salary, lost a bunch of weight, gave up drinking and smoking, and basically turned my whole life around.

ADHD sucks, especially as an adult. But shit, its 2016. you can do something about it.</comment>


Meet the 2012 MacArthur Fellows - <AUTHOR> http://www.macfound.org/fellows/class/2012/

<comment><USER2> The only person on the list whose work I'm somewhat aware of is Dan Spielman. His works, especially smoothed analysis, is definitely something that HN folks will appreciate.

Smoothed analysis answers the question why many popular algorithms have exponential big-O time but still work so well in practice. Average case complexity also answers that question but computing it requires us to know the probability distribution of the input space in advance. The idea of smoothed complexity is simply to add random perturbation to the input and then measure the worst case. Eg. simplex method has exponential big-O complexity but polynomial smoothed complexity.

</comment><comment><USER3> Chris Thile is the Beethoven of his generation.

[Edit to fix my silly typo]

<comment><USER4> Wow that's going a bit far although I admit he's a pretty great mando player albeit a bit showy. I saw him live with Edgar Meyer and my ears almost fell off.

<comment><USER5> Have you listened to The Blind Leaving The Blind? It's pretty incredible. I don't think it's canonical-piece-of-culture-after-300-years incredible, but still, pretty incredible.

<comment><USER4> No, but I will now. Thanks for the tip.

</comment></comment></comment></comment><comment><USER6> For the computer science entry:

Daniel Spielman, Yale University Professor

<http://www.macfound.org/fellows/877/>

</comment><comment><USER7> Junot Diaz was my writing teacher at MIT. "Brief and Wondrous Life of Oscar Wao." He's really into comic books, the apocalypse, Dominican immigrants, New Jersey.

</comment><comment><USER8> Are any on HN?

<comment><USER9> I very much doubt it. HN's audience is actually really very specific.

<comment><USER10> Literally actually really very specifically specific.

<comment><USER11> Literally, a veritable niche of actual specificity.

<comment><USER12> Is it me or are these Reddit-like joke nests a new phenomenon on HN?</comment></comment></comment></comment></comment>


AMD unveils world's most powerful desktop CPUs - <AUTHOR> https://www.zdnet.com/article/amd-unveils-worlds-most-powerful-desktop-cpus/ <comment><USER3> > AMD has released a salvo by unveiled what are the world's most powerful > desktop processors

Is it too much to ask that tech journalists proof read their articles before hitting publish?

> AMD unveils world's most powerful desktop CPUs

This article contains zero benchmarks or anything other than the core count and TDP to substantiate the claim that these are the "world's most powerful desktop CPUs"

Can we please stop giving ZDNet impressions for this tripe?

The Anandtech article from 4 days ago on the Threadripper announcement at least included AMD's slide deck. [1]

[1] [https://www.anandtech.com/show/15062/amds-2019-fall- update](https://www.anandtech.com/show/15062/amds-2019-fall-update)

<comment><USER4> Discussion of the Anandtech article: [https://news.ycombinator.com/item?id=21473235](https://news.ycombinator.com/item?id=21473235)

</comment></comment><comment><USER5> It's amazing how AMD, which once seemed a company on their knees, now seems to be kicking Intel's butt, and I find myself worrying about Intel now. Why do they seem to be failing on so many projects? Itanium, Larabee, XScale, the Modem Division? Why is one of the world's largest and most successful CPU companies noncompetitive now on pretty much everything, except their mainstay x86 processor, where they seem to be stalling.

Is there something wrong with Intel management/culture that's allowing other firms to run rings around them?

<comment><USER6> > which once seemed a company on their knees

Weren't AMD cpus a good alternative to intel for most consumers ? If I remember correctly athlon, phenom, FX were pretty good for the price. Or are you talking about earlier times ?

edit: "good alternative" perf/price wise, yes intel used to have the advantage in raw performance but their pricing made AMD cpus look very interesting for most consumers.

<comment><USER7> Phenom got soundly beaten by the first few Core i generations (Nehalem, Sandy Bridge) in terms of both peak performance and power efficiency. Bulldozer (The basis for AMD's FX and "A" series CPUs) was mostly a misstep that was doomed to feed the very low end of the market. The only truly successful devices based on it were Xbox One and PS4. (Incidentally, those processors used "Jaguar" cores which evolved from Bulldozer but actually didn't inherit the shared execution units (CMT) that were Bulldozer's headline feature that turned out not to work as well as intended.)

So between about 2010 and the introduction of Ryzen in 2017, there really was no alternative to Intel if you were building a PC that was either fast or energy efficient. In terms of performance, the 1000 & 2000 series Ryzens roughly attained parity with Intel, while the 3000 series now pulls ahead in many multithreaded and some singlethreaded disciplines, and definitely has better performance-per-watt under load.

Ryzen still draws significantly more power than Intel's CPUs when idle though - the PCIe 4.0 transition has counteracted the improvements from the 7nm shrink in this regard, and the APU variants lagging the GPU-less SKUs by almost a year in terms of process and microarchitecture means you also have to power budget for a discrete GPU, which adds a few idle watts.

(The most power efficient at idle Ryzen build I'm aware of is the Asrock DeskMini A300, which uses _no_ chipset, combined with a low end APU - <USER2> draws about 7W when idle. In terms of performance and expandability, this system isn't any better than a NUC, which draws somewhat less power when idle. You can't buy a full size A300/X300 motherboard though, for some reason, even though this would actually be quite an interesting setup.)

<comment><USER8> About the asrock mini, have bios issues been solved?

[https://www.newegg.com/Product/SingleProductReview?item=N82E...](https://www.newegg.com/Product/SingleProductReview?item=N82E16856158064&parentCount=1&TabType=1)

<comment><USER7> That link doesn't work for me (perhaps geo-IP gated?) - what issue are we talking about?

The highly reputable c't Magazine used it in one of their recommended PC builds recently. They tend to be very thorough and fussy about issues, so I suspect they didn't run into whatever issue you're talking about. I believe they did mention that you need to watch out for BIOS support for the 3000 series CPUs (and ask the seller to update it if necessary and you don't have an older AM4 APU handy), as with any motherboards that predate release of a particular CPU you're trying to use.

</comment></comment></comment></comment></comment><comment><USER9> Please promote the guy who came up with the name "threadripper".

<comment><USER10> Sounds like something a true-blue Aussie bloke would come up with.

<comment><USER11> I only give negative feedback

</comment></comment></comment><comment><USER12> 280 Watts TDP! Wow, I think that's a new record for desktop CPUs, although GPUs had reached that a while ago. I wonder how well air coolers work on them, or do they need water cooling for maximum performance? Impressive nonetheless.

<comment><USER13> I think TDP is becoming less and less of a comparable figure. All designs could use far more power in specific worst case corner cases (eg. a very specific instruction stream that causes every functional unit to be in use every cycle, and all data paths to toggle logic state every cycle).

Yet in the typical use case (desktop PC, most cores idle most of the time), power consumption will be far lower.

What really matters is the graph of "how much computation can I get out of this thing in 10ms bursts, 1 second bursts, and 10 minute bursts?", with a specific cooling setup.

<comment><USER14> It's correct that TDP is getting more relative¹, but it's not correct that we're talking of corner cases. Anandtech locked an i9-9900k to 95W, and the loss was considerable (between 8 and 28%)².

¹: it needs to be noted that in the last years, Intel's TDP is getting "much more relative" than AMD's ²: [https://www.anandtech.com/show/13591/the-intel- core-i9-9900k...](https://www.anandtech.com/show/13591/the-intel- core-i9-9900k-at-95w-fixing-the-power-for-sff/9)

<comment><USER15> Intel TDP always had the same meaning: "If your cooler can dissipate TDP, the CPU will run all-core loads at base clock speed, or a single-core loads at boost-clock speed." \- Pretty sure that statement has always been true, within +- 100 MHz depending on the specific workload. The distance between base and boost clocks has just increased over the years.

</comment></comment></comment></comment><comment><USER16> It's finally happened. I don't foresee a time where I need more CPU power in my desktop. I could use more memory, faster (and larger) SSDs, faster GPUs with more TCs (althou I'm actually good for that too mostly), more bulk data storage on platter disks but honestly I'm good for CPU for all my needs. Here's why: Most of the cores on my Ryzen 7 are idle most of the time. There are intense periods where I need to compile stuff where they max out but these are relatively short. Cup-of-coffee short. Any gaming activity seems to use no more than 8 cores max. Should I ever need more CPU I don't need an order of magnitude more, I need orders of magnitude more. Those are easily procured through AWS or Azure or some other cloud provider. Same with GPUs. I might make a training run for a NN on my desktop to hypothesis test something that I would then run for longer hours on cloud hardware. It's never going to be cost-efficient for me to scale up with any sort of ownership of the hardware. Of course I'm going to buy the new monster at some point but it will be due to hardware failure, not due to me needing the new shiny.

<comment><USER17> > _Any gaming activity seems to use no more than 8 cores max_

Large numbers of cores have never been useful for gaming, but overall thread performance has. Right now the major bottleneck for high end gaming is GPUs because display pixel counts have gone through the roof with high frame rate VR and 5k monitors, but keep in mind that the current most powerful graphics card for games (Nvidia 2080 Ti) is over a year old, still costs over $1000, and is not about to be replaced yet because, just like Intel, NVidia hasn't had competition at the top in a long time. If AMD can bring this success to the graphics space, maybe that will change too.

<comment><USER7> AMD's Navi is looking to be competing quite well with NVIDIA in the mid- range/enthusiast space, and shortly in the mid-to-low-end segment with the imminent RX5500.

I suspect it won't be long until the empire strikes back in this case though: NVIDIA also uses TSMC for fabbing its GPUs, so they too will soon be shipping 7nm GPUs, with all the intrinsic advantages of that node. Of course, _pricing_ of those new products will hopefully be strongly influenced by AMD's resurgence. (And, supposedly, Intels re-entry into the GPU market, but I remain skeptical this will make much of a dent for a few years yet.)

</comment></comment></comment><comment><USER18> I've been reading that many of the Ryzen and Threadripper CPUs support ECC ram, but motherboards support is shaky at best. Worst is that some motherboards will boot with ECC but don't actually use it.

Does anyone have any concrete experience?

I wad hoping to build a workstation with ECC memory, but it appears only the EYPC cpus have certified support for ECC.

The Xeon W appears to be the most cost effective for guaranteed ECC memory.

<comment><USER19> I have an ASRock X399 Professional and a TR-1950X.

64GB DDR4-2666 ECC UDIMM runs perfectly on it, and the kernel reports ECC support.

Day-one memory support was very, pathetically, bad with Threadripper, but it has gotten better. It improved even more with Threadripper 2000.

If Ryzen 3000 is any guide, the gaping memory compatibility gulf between Intel and AMD will probably be closed to a slight gap by the time TR 3000 releases.

As far as I'm aware, every X399 motherboard vendor supports and warranties ECC support on the platform, but only if you use memory on their QVL at its rated speeds.

sTRX4 will likely be no different.

As far as cost-effectiveness, a W-3175X ($2,978.80) and Dominus Extreme ($1,868.74) is indeed $552.45 less expensive than a Supermicro MBD-H11SSL-NC with EPYC 7702P ($5399.99), but the the 7702P is about 37% faster multi- threaded, and about 13% faster single-threaded.

</comment></comment><comment><USER20> It seems they have left the xx90X model number unused for now but the 32-core has been accounted for...

<comment><USER21> Not a huge secret that they have a 64-core Threadripper 3990x ready to go.

But also no hurry to release it, as even the 24 core wipes the floor with anything Intel has to offer.

<comment><USER22> > wipes the floor with anything Intel has to offer

* in synthetic benchmarks that uses down to the last core

edit: my bad I mistook this for a technical audience

<comment><USER23> Single-core CPU performance is at a peak. There aren't any revolutionary increases expected there anytime soon.

Milticore performance gets more and more important with time.

<comment><USER22> > Milticore performance gets more and more important with time.

no? above 2-4 core it's just marketing hype like it was ten years ago already and today if you need parallel processing you have vastly powerful resources to tap.

sure this amd cpu might be faster in 3d rendering or video encoding or other task that use 4+ cores and that might be useful if you truly can't move them onto a gpu but truth is at the top end many-cores architectures are getting squeezed out by streaming processors and the workloads that have a hard dependency on many core single node general processor are rarer by the day.

<comment><USER23> Threadripper is proven to do extremely well in parallel compilation benchmarks -- the Linux kernel build process being the chief example. I've seen the numbers on at least 4 sites (Phoronix included).

It's not only about 3D. We're talking everyday programmer productivity, partially achieved by less waiting around when compiling your projects.

<comment><USER22> > everyday programmer productivity

> the Linux kernel build process

<comment><USER24> Yea, what is this BS Linux kernel build process that is a known metric that everyone can test against? I compile projects dozens of times a day at my work and never once I compiled the linux kernel...

<comment><USER23> It's an extreme case to demonstrate if a CPU's multicore performance is clearly better than previous generations.

For what it's worth, I migrated from a consumer-grade i7 CPU to a workstation- grade Xeon and the differences in compile speeds in my everyday projects (less than 400 files) are still significant and very noticeably in favour of the Xeon.

Linux kernel compilation is just a benchmark that multiplies such differences between CPUs. Thus the buyers can -- hopefully -- make a more informed decision.

<comment><USER22> weird, I've a 9000+ files maven monster and intellij incremental build means I've never have to wait for compilation during normal operations, and this is with a meager i7 8550u

<comment><USER23> Well, it's an incremental build. I am talking occasionally changing dependencies in a project written in a dynamic-but-compiled language, which leads to full rebuilds. The difference was big.

It also has tooling for "watching" test directories and auto re-running tests when certain files are changed -- which utilises incremental compilation under the hood and there indeed there is no visible compilation performance difference.</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


RSA denies link with US spying agency - <AUTHOR> http://www.bbc.co.uk/news/technology-25492461

<comment><USER2> It's basically a non-denial, they don't deny that they took money in exchange for using the backdoored algorithm.

If they took the money and didn't know the algo was backdoored both the original allegation and denial could be factually correct.

<comment><USER3> I have admire the careful wording: "We also categorically state that we have never entered into any contract or engaged in any project with the intention of weakening RSA's products, or introducing potential 'backdoors' into our products for anyone's use."

This leaves the door open for a lot of things, including them having weakened their products and added backdoors. They just deny having entered a contract _with the intention_ of doing so.

Though one has to wonder how exactly that deal went down. You wouldn't have to pay RSA anything to implement a _good_ crypto algorithm because they'd do that out of pure business interest. Did the NSA call and ask "Here's a new RNG algorithm, it's slower than others and mathematically dubious. Would you implement it for $10 million?"

<comment><USER4> Most probably they said something like "many of your government agency customers would be very happy if / will require that you implemented this PRNG".

</comment></comment></comment><comment><USER5> I don't really understand why any organization which has even a remote possibility of a conflict of interest would accept money from a spy organization.

<comment><USER6> There were 10 million reasons. If you don't have any moral qualms, it was clearly a good business decision. People kept jobs, got raises, got bonuses, and it took one of the most important leaks in US (and world) history to cause the arrangement to be disclosed.

Now, after all of the individuals at the company claim to have had no knowledge or it, or to be against it after the fact, they will go on to new well-paying jobs.

This is why.

</comment></comment><comment><USER7> EMC owns RSA -- Can we trust EMC?

<comment><USER8> lol, absolutely not. I worked there for a year, and I still have a lot of friends who work there. EMC is absolutely not to be trusted - who do you think is supplying the storage for the NSA datacenters, specifically their 'big boy' out in Utah?

<comment><USER9> Photos of the Utah data center, located 25 miles from Salt Lake City:

[http://www.hangthebankers.com/pictures-of-the- new-2-billion-...](http://www.hangthebankers.com/pictures-of-the- new-2-billion-nsa-spy-center-in-utah/)

<comment><USER10> Rest assured, regardless which if any NSA reforms are enacted, they will never stop collecting the quantity of data needed to justify that data center. If mass collection is retained, but imperceptibly reformed by having the carriers collect and "store" the data, then the Utah center will be made available as a "public service" to implement the physical storage.</comment></comment></comment></comment>


Writing Iterators in Julia 0.7 - <AUTHOR> https://invenia.github.io/blog/2018/07/06/iteratorsinjulia07/ <comment><USER2> Good stuff! While it's nice that the change made things cleaner, it's great to see it laid out in a more "why should I care?" fashion.

</comment><comment><USER3> This change also fixes the Julia issue that bothered me the most personally: if in a comprehension with nested loops any of the non-outermost ones was over an empty sequence, you'd get an error.

</comment><comment><USER4> Exciting times for the Julia community!

</comment><comment><USER5> Someone wake me up when Julia reaches 1.0

<comment><USER6> Wouldn't hold my breath even then. They decided to split a lot of functionality in Julia into a standard library, which they will keep changing indefinitely. There goes my hope of Julia having any API stability.

<comment><USER7> Alternatively, you may see this as a sign that we've thought carefully about which APIs are stable enough to be part of the long term stability guarantees of 1.0, and which APIs are not, making it more likely that we'll able to maintain those guarantees longer.

Also, there nothing really special about code that used to be in base, but is now in stdlib other than historical accident. It so happened that we used to ship a git client as part of the language, but the HTTP client was a separate package, despite the latter probably being a lot more useful to users. Packages can and do have their own stability guarantees. With the language itself maturing, I imagine package authors will start taking advantage of this more.

<comment><USER6> Yes I get your viewpoint about long term stability guarantees and feel it's valid to a certain degree. But I waiting for so many years for Julia 1.0 while expecting the entire language (base + stdlib) to have API stability for at least a few years, and hopefully many many years, like Fortran or at least Matlab.

Also, I wish you guys would have some overarching philosophy w.r.t API stability in the stdlib. From looking at the github, it seems like the core developers are just delegating API change decisions in the standard library to new people who are not as familiar with the code base, without much discussion at all. I just don't think that is the way the stdlib should be managed.

</comment></comment></comment></comment><comment><USER8> Code with a mix of _Y%_ #$ and lower_UPPER_CamelCase looks ugly.

<comment><USER9> Every language looks ugly to someone who doesn't need it ;)

I have learned to ignore the inconsistencies in the languages that I have to use, especially if it's for a paying gig. Otherwise I would go crazy! Every single language has them, I'm not kidding.

<comment> s-shellfish That's a nice practice</comment></comment></comment>


First gas station in America to ditch oil for 100% electric charging opens in MD - <AUTHOR> https://www.cnbc.com/2019/09/26/first-gas-station-to-ditch-oil-for-electric-vehicle-charging-now-open.html <comment><USER2> Gas stations mostly make money from snacks. Presumably if you own a bunch of gas stations, you're just thinking "When does the capex make sense to shift pumps to plugs?" Will people in electric cars stop smoking, drinking pop and eating chips? Presumably their real business will shine and ops wise it will be about juggling pumps and plugs as the fleet turns over.</comment>


Farewell – ETAOIN SHRDLU (1978) - <AUTHOR> https://vimeo.com/127605643 <comment><USER2> What I found interesting about the move from hot type to cold type is just how transferable jobs were. From packing lead together to pasting up paper... many of the same skills are needed to ensure each page is laid out correctly. 14 lines per minute to 1000 lines per minute. Quite a drastic increase and no doubt meant alot less jobs were needed to produce a finished paper.</comment>