Classic NES Series Anti-Emulation Measures - <AUTHOR> https://mgba.io/2014/12/28/classic-nes/ <comment><USER2> From the "Dolphin Progress Report" article ([https://news.ycombinator.com/item?id=13544514](https://news.ycombinator.com/item?id=13544514)): there were two Disney games that wrote garbage data to a region of memory where important data was stored, but not enough to cause the CPU to flush the cache, and then invalidated the cache, causing the writes to never actually happen on real hardware, but on Dolphin (which didn't actually implement a CPU cache in its emulation layer), it caused the writes to actually happen.

<comment><USER3> That's super clever

<comment><USER4> All this effort to claim possession over something. Imagine if all the effort regarding possession and wealth were used to make something actually useful. What a waste.

<comment><USER5> I actually believe the exact opposite.

That so many useful innovations are lost & forgotten, because there was no incentive to market & distribute the innovation.

It is lost on many, that the usefulness of an idea does not guarantee it's popularity. It is very, very hard to get visibility & traction for even the most useful of inventions.

Protections on ownership & wealth create the incentives to invest in creating new innovations, but also to productise, distribute and market those innovations.

It is only a small fraction of products that can exist without the proper incentives to build out the whole chain from idea to r&d, productisation, to distribution & marketing.

<comment><USER6> Run the Jewels just released their latest album entirely for free, and hit #1 in sales anyway, so

<comment><USER7> That a counterexample exists doesn't really impact the claim that "many" (though they imply "most" imo) do not work this way.

<comment><USER8> Indeed: Not everybody is the kind of person who pays for Jonathan Coulton's music instead of downloading it for free.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> It is difficult to take a binary program and establish intent. I'd rather call these "interesting and unusual programming tricks" than "anti-emulation measures" until more evidence is presented.

Mirrored memory is a side effect of unconnected lines on the address bus thus making the content of those bits irrelevant. Code can take advantage of this to run faster or put tag values into addresses.

On a GBA, VRAM is faster than ordinary RAM. Programs can do well to use it for tight inner loops.

Using STM (store multiple) to DMA registers? Again, go faster.

Save type masquerading might be code that helps when running on a development kit, but I admit that I can't think of what use it might have.

Self-modifying code that depends on the pre-fetch queue might be the best place to look for intent. Might be easy to tell if the program is doing it for some larger purpose or simply to fail subtly or overtly if it sees unrealistic processor behavior.

Any why would a program do extra work writing to an audio FIFO than need be?

<comment> david-given Yeah, putting tight loops into fast RAM for extra speed is a very old trick --- I've done it myself. Likewise multiple stores.

Using a non-standard copy of the address --- well, it's an emulator, on a slow system; the ARM requires 32-bit constants to be read from a constant pool. If it can use certain addresses that are cheaper to construct, somehow, that'd be a performance boost. Can't tell without knowing which addresses, though.

My first thought on the save type masquerading and the pre-fetch queue testing is that it's testing for particular hardware. e.g. if it's running on a cart with SRAM, do the SRAM thing, otherwise do the flash thing. Likewise, testing the pipeline size might be trying to figure out what processor there is. That doesn't explain why it just crashes rather than following some other code path --- if the code to do the SRAM thing was there, and the emulator tells the game that there's SRAM, then the emulator should see the game doing the SRAM thing.

It _might_ be something as trivially stupid as that the game contains the code to check for development hardware, but that the run-time support for the development hardware isn't present and instead the game is just crashing. There may not be anything malicious here.

If _I_ wanted some sort of antipiracy or antiemulation feature, I wouldn't put a big obvious crash up front. Instead I'd introduce some sort of random failure elsewhere in the game, so it superficially looks like it's working, but isn't any fun to play...

<comment><USER10> > Instead I'd introduce some sort of random failure elsewhere in the game, so > it superficially looks like it's working, but isn't any fun to play...

Doesn't that defeat the purpose? If people don't realize that they're being punished for pirating, you're just collecting bad review scores and not pushing anyone to buy a legitimate copy.

<comment><USER11> It's actually a not-unheard of trick. Arkham Asylum, for example, would have a failure case about halfway through the game where Batman's cape would fail to open when he jumped down into a deep (plot-required) pit if the game had been pirated. Batman would crash into the ground and die, the users would take to developer forums or the steam forums to complain that they couldn't get past this one section because of a gamebreaking bug, and then the developers would say, "Yes, that's an anti-piracy measure. If you purchase the game, it won't happen".

Another game, Game Developer Tycoon, would run as normal, but as you got further and further along, in-game pirates would pirate all the games you made and your profits would keep on dropping. People came to the developer forums to ask for ways to keep people from pirating their games, because they couldn't make any money because of all of the pirate. The irony was lost on some.

<comment><USER10> I think the Game Developer Tycoon one is the only actual success story, and that's because the story went viral.

For every person who goes out of their way to complain on the forums, there's probably five that just caution their friends not to buy the game.

I also recall (obviously difficult to verify) accounts from people who claimed that the Arkham Asylum (I recalled it was City...?) bug happened to them with legitimate copies. From a development perspective, an "Easter egg" of that sort requires a LOT of QA effort.

</comment></comment></comment></comment></comment><comment><USER12> > I'm not really sure why Nintendo went all out with these games, considering > that these are just ports of NES games.

I've always suspected that Nintendo cares a lot less about PC emulation, than it does about mostly-chip-compatible knock-off hardware.

Think of those consoles you see at Walmart that claim to come with "100 games built in!" Those frequently contain chip-compatible designs of Nintendo's old hardware, and a library of ROMhacks of NES games (or the ROM from a single one of those 100-in-1 NES carts.) They're not emulating Nintendo ROMs; they're just _running_ them, directly.

The manufacturers of these consoles never bothered to clone newer ones after the NES, because all the demand for these knock-offs seems to be some weird combination of nostalgia and clueless-parent value-purchasing (e.g. "oh hey, it has Super Mario Bros on the box! That game was great. My kids would like that!")

But the GBA is just as easy to clone the internals of as the NES is (ARM7 cores are just as easy to find—and cheap—as 6502s), and has a _far_ larger library of games (~17000!) So if these companies could transition to a GBA chip-compatible design and still ship these NES ports, they'd increase value immensely, while still being able to put NES nostalgia on the box.

And so, for these ROMs that might have been just the thing to spark this switch-over, Nintendo went to some extra effort.

It would have been funny, had any of these knock-off manufacturers already finalized a hardware design based on tests with other GBA ROMs and started up their logistics pipeline to assemble consoles, had they flashed one of the NES Classics ROMs onto their new-off-the-line console, and realized that it was far more stringent than other games were about faithfulness to the GBA's architecture. It might be enough to kill a whole company.

\---

Of course, none of this ever materialized, because for _some_ reason, the knock-off manufacturers are _still_ just making consoles that are chip- compatible with NES games, rather than speccing out builds based on what chips have become equally cheap since then. Who knows why.

<comment><USER13> _Of course, none of this ever materialized, because for some reason, the knock-off manufacturers are still just making consoles that are chip- compatible with NES games, rather than speccing out builds based on what chips have become equally cheap since then. Who knows why._

Actually, there are now quite a few Chinese GBA clones on the market, and my understanding is that they do not use emulation but are hardware-compatible reimplementations of the GBA hardware.

Some examples:

[http://www.k1gba.com/](http://www.k1gba.com/)

[http://exeq.ru/produkcija/pristavki/detskie/gamebox.html](http://exeq.ru/produkcija/pristavki/detskie/gamebox.html)

[http://obscurehandhelds.com/2010/08/the-nintendo-game-boy- ad...](http://obscurehandhelds.com/2010/08/the-nintendo-game-boy-advance- clone/)

<comment><USER8> If I could find a good one, I just might buy it, too. My AGS-101 isn't exactly an ideal system. But then, a GBASP might be cheaper...

<comment><USER14> The 101 is the most desirable SP because of the nicer backlit screen, so don't just get rid of it.

<comment><USER8> Wait, did I say AGS-101? Sorry, mistake on my part. I meant my _AGB-001_

</comment></comment></comment></comment></comment><comment><USER15> Part of me wonders if this is just some experienced game dev working on a boring porting project that decided to have a little fun and see how he could cause issues with emulation, not some large sanctioned measure to defeat emulation software. Might explain why this effort went into such a seemingly unlikely game.

<comment><USER16> If I were a game dev, I would want my work to be preserved past the life of the specific hardware it was written for. It's sad that so much culture is lost due to proprietary hardware and software.

<comment><USER17> True.

I recently "bought" Titanfall 2, on DVD. I put "bought" in quotes because I wonder how much I actually own it, if at all.

It wouldn't run at all without first connecting to the internet and downloading multiple gigabytes of updates.

I wonder what would happen in the future when EA decides to shut up shop or change their DRM platform. Will I ever be able to play it again?

This is why I often feel like pirates "own" the content more than legitimate buyers.

<comment><USER8> Yeah. Compare this to the 90s games I've been playing: I can still take a copy of Q3A or UT from '99 and install it on my computer (although why you wouldn't use the IOQ3/UTPG patches is beyond me). Ditto for Doom and Descent (although you need a src port). Thief, Deus Ex, System Shock 2, and Baldur's Gate are a little harder to get running (you have to use wine, and in the case of Deus Ex, figure out how to get the shoddy programming to work with modern hardware), but it's still doable.

Will that be true of FTL, Bastion, Shadow of Mordor, Limbo, or Assassin's Creed?

<comment><USER18> Better yet, the Q3A engine is open-source and is still maintained in the form of ioquake3. Just look at how many architectures it's compiled for on Debian. It's going to stay forever with us without emulation.

[https://packages.debian.org/sid/ioquake3](https://packages.debian.org/sid/ioquake3)

<comment><USER8> I did mention that...

</comment></comment></comment></comment></comment></comment><comment><USER8> I've been reading about the gameboy's architecture and internals (in the hopes of making a game with it), and it's pretty amazing how much specialized hardware there was in earlier generations of consoles, especially compared to the more general modern consoles. And yes, new consoles have GPUs, but those are everywhere.

Your computer has a GPU. It probably doesn't and didn't have scrolling registers or hardware sprites (unless, like the C64, it had a gaming focus).

<comment><USER19> There is an excellent video from 33c3 about Gameboy internals and all the wonderful tricks that can be utilized when writing software for it. [https://media.ccc.de/v/33c3-8029-the_ultimate_game_boy_talk](https://media.ccc.de/v/33c3-8029-the_ultimate_game_boy_talk)

<comment><USER8> C3 never ceases to surprise me. Thanks!

</comment></comment></comment><comment><USER20> Does Legend of Zelda: Minish Cap have something similar? I played that game on a raspberry pi but it always freezes and dies when I enter a certain room in the final boss castle... Not sure if just a bad port or a security feature... I would love to finish it, but don't feel like replaying the rest of the game just for the ending...

<comment><USER21> Which emulator?

<comment><USER20> I want to say it was running Retro Pie? Edit: I don't have it with me, but I think it was the mGBA emulator, sorry.

<comment><USER22> That's not an emulator, it's a frontend. You'd need to know the core, e.g. mGBA or VBA-Next.

</comment></comment></comment></comment><comment><USER23> I wonder if these tricks to defeat emulators have the opposite effects. They give truly interesting chalenges that can motivate talentuous developpers.

<comment><USER12> Yep. See, for example, 4am's cracks of the Apple II software collection ([https://archive.org/details/apple_ii_library_4am](https://archive.org/details/apple_ii_library_4am)), done half for the sake of preserving old games, but also half for the sake of discovering (and documenting!) the many kinds of anti-piracy measures that went into them.

</comment></comment><comment><USER24> Article is from 2014. Suggest adding info to submission title.

<comment><USER22> Indeed, I even posted it back then: [https://news.ycombinator.com/item?id=8808754](https://news.ycombinator.com/item?id=8808754)

</comment></comment><comment><AUTHOR> I find it very interesting to read about these sort of tactics, given that not only does their design require a high degree of expertise with console hardware (which Nintendo's developers obviously have), but also a high degree of familiarity with emulators themselves in order to understand the techniques that are likely to defeat the common optimizations and shortcuts that emulators make in order to make up for the discrepancy in speed.

</comment><comment><USER25> If I remember correctly, Nintendo also implemented tough DRM like this for the GBC Video series. Same light gray cartridges, I think.

(GBA Video was a short-lived series of video content available on GBA carts. I remember having a cart with an episode of The Fairly Odd-Parents on it. The video quality was terrible. Nothing worth protecting.)

</comment><comment><USER26> Why bother? If these are ports of NES games, couldn't they just emulate the NES versions?

<comment><USER26> Welp, I commited the sin of posting before reading. That was the last paragraph of the article.</comment></comment>


I Want The Mutt Of Feed Readers - <AUTHOR> http://www.zedshaw.com/essays/i_want_the_mutt_of_feed_readers.html

<comment><USER2> You'll want the TL;DR because this is needlessly wordy: Use Newsbeuter, using the -i option to import your OPML file.

(Go to www.google.com/takeout to download your Reader subscriptions in OPML format.)</comment>


The Hourly Wage Needed to Afford the Average Two Bedroom Home in Every State - <AUTHOR> http://thesoundingline.com/the-hourly-wage-needed-to-afford-the-average-two-bedroom-home-in-every-state/ <comment><USER2> This would be much more enlightening if broken down by county or voting precinct instead. States like California have very disparate economies county to county.</comment>


Durex rolls out condom app and delivery service - <AUTHOR> http://www.latimes.com/business/technology/la-fi-tn-durex-sos-condoms-20130201,0,1721302.story <comment><USER2> So at first I thought this was a joke, a social commentary on the insane sex laws in Dubai (out of marriage sex = prison and deportation) but then the order process _seems_ to work, it let me as far as the "confirm order" button (didn't click because of fake address) and there seems to be no hint of a joke anywhere _unless_ you're already aware of the sex laws in dubai, which most people aren't?

Put me out of my misery, is this a joke? If it's just marketing ("lol a condom delivery app!") why is the article here reporting it as fact, or are they in on the joke to. I'm so confused.

<comment><USER3> It's probably both. It probably actually works and there is a delivery service to coordinate Dubai deliveries of this, but the city choice, the video and the PR outreach around it definitely feel like a guerrilla marketing effort to me. I'd be interested to see how long the app actually works for. My bet is it's quietly shuttered in Dubai after 3 to 6 months.

It's pretty easy to see a strategy that says after the initial worldwide buzz of a Dubai launch dies down that the app quietly shuts down after 3 to 6 months and then launches in Vegas, Bangkok, UK, etc. to drive local buzz there.

</comment></comment><comment><USER4> Nearly every gay bar in London have a big perspex box on the counter with free condoms. And nice do-gooder types from AIDS prevention charities who wander around giving out condoms.

Given the multitude of health and social problems that not using condoms brings to people gay and straight, I'd suggest it's high time that they start doing this in more (non-gay) bars and nightclubs.

For the cost of a small piece of rubber, society can reduce unwanted pregnancies, expensive abortions (20¢ for a bulk-purchase condom vs. hundreds of dollars for terminations), HIV transmission and all sorts of other sexually transmitted diseases.

As preventative public health measures go, providing condoms free in bars and nightclubs seems like a sensible strategy.

<comment><USER5> If you start just handing out condoms to drunk people 90% of them are going to be used for purposes other than their intended one.

Condoms are available for free at most health clinics.

I would guess that in most cases they are not used because they make sex less fun rather than because they are unavailable.

<comment><USER6> _> If you start just handing out condoms to drunk people 90% of them are going to be used for purposes other than their intended one._

Yes, but they're not that expensive to buy in bulk.

 _> I would guess that in most cases they are not used because they make sex less fun rather than because they are unavailable._

There are times when you just don't have one. My ex was a bit paranoid and would never have sex without a condom, so less fun was a non-issue. You can't safely store a condom next to your body, so keeping one in your pocket is sub- optimal. You can't leave them in your car for the same reasons. You can keep them stocked at home, but sometimes you end up at "her place" and maybe she ran out or you forgot to bring more over. Sometimes you go on a weekend trip and forget to pack them, but only discover this at midnight. Sometimes stuff happens, and in that moment, people will pay a lot to have one.

</comment></comment></comment><comment><USER7> _The company says its couriers are discreet and will show up dressed as either a pizza man, a police officer or a tourist so as to not draw attention from neighbors or passers-by._

Sure, having police officers show up at night won't draw any attention whatsoever.

<comment><USER8> Fantastic! And, if you're in the mood, you can invite the pizza man to join in too, as is usually the case in the movies.

</comment></comment><comment><USER9> Potentially political point: will the service deliver to people under 18? Arguably those are the folks most likely to benefit from this service.

I'm aware that what I'm saying isn't universally accepted, so disclaimer: yes, it is my personal opinion that it's fine for underage kids to have sex as long as they use protection.

<comment><USER10> At least in the US, you don't need to be 18 to buy condoms. A 5 year old could walk in and buy some. This is by design.

</comment></comment><comment><USER11> If this is real, it certainly answers the "how could this app get someone laid" question rather well.

<comment><USER12> If all you had to do to get laid was obtain condoms my high school years would've gone quite differently

<comment><USER13> Just because there are circumstances where presence of a condom makes the difference doesn't mean it does so in every case; the app would still get some people laid (and keep other people safer).

<comment><USER14> "necessary but not sufficient"

<comment><USER13> That's what people's behavior _should_ be, when they are having sex outside a long-term, tested, monogamous relationship... It doesn't translate perfectly into reality.

<comment><USER6> That's the opposite of what rational behavior should be. Always condoms until the 6th month of a relationship, then without only after test results come back.

<comment><USER13> That sounds like what I said, though I didn't spell out specific parameters on what was meant by "long-term, tested, monogamous relationship".

If one is going to be having sex outside of such a relationship (by which I had meant "when one is not in such a relationship" although I suppose it would apply to cheating too), one should be wearing condoms, yes? That's the part I was talking about, and I don't see how it's the opposite of what people should be doing.

<comment><USER6> Sorry, I misread your comment in the opposite sense.

<comment><USER13> Ah, no worries - was just confused :-P

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> I have been to Dubai a total of eight times since 1997. My last stay there was in '09, which lasted nearly 8 months.

It is not a place that is easy to navigate by any measure, regardless of the hour. Durex has their job cut out for them. The streets of Sharadiya, for example, are not a place where I would enjoy to be doing deliveries at 2am. Granted, other cities (London, Vegas, Phuket, Barcelona) will have different behavioral mechanics for this sort of business, but that misses the mark altogether.

The main point is this: a shift in paradigm is what's needed regarding sexual health and protection. Seeing condoms as something that people will wait for (for up to 1 hour, no less) before they engage in sex is a catastrophic bag of fail.

The whole point of prevention is —well— being prepared, ahead of time, on the ready.

A monthly condom delivery service like Mexico's <http://rubberit.co> is something I can see growing on better footing. It's sustainable in that it retains clientele through membership, it is discreet in that it allows the user to place any name as the sender, and it is also socially engaging because for every condom they sell they donate another one to rural and disadvantaged communities.

I mean, good luck to Durex. Their promo is bad ass. But I can see their project folding by mid-year. (Sorry for the long rant.)

</comment><comment><USER16> This is hilarious. The product video is awesome. If only it was actually possible to have a service where police officers brought you condoms.

<comment><USER6> Quadcopter drones are a possibility.

<comment><USER17> <http://www.rubberrotor.com>

<comment><USER16> someone better jump on that domain

<comment><USER18> There was a hoax around delivering burritos (IIRC) by quadrotor a while ago - Was very disappointing, it'd be an awesome business!

<comment><USER6> Condoms are a lot lighter. Seems like such a business could achieve high margins for rush delivery.

</comment></comment></comment></comment></comment></comment><comment><USER19> I know it's only a commercial (maybe for the superbowl even), but tourists walking around at night with a map eh? Even in some very decent neighborhoods I think that screams "mug me" lol.

A great way for the condom delivery guy to approach the customer would be to pretend to be a friend you were hanging out with early that's returning something you forgot at a bar :)

</comment><comment><USER20> A monthly mail delivery would be better, no? I had thought of this and when I researched I think I found something like that i.e. monthly condom delivery already exists and did not think about it any more. Btw, a yearly delivery of new underwear and undershirts for men would be another thing that is needed if it doesn't already exist.

[EDIT: fixed an embarrassing typo]

<comment><USER21> Check out manpacks.com for men's shirts, underwear, and sock packages. I think they also have razors too, but I am fully satisfied with Dollar Shave Club for those.

<comment><USER22> They actually do condoms as well. Great service.

</comment></comment></comment><comment><USER23> They say that they are discreet and appreciate my privacy, but do they take Bitcoin?

</comment><comment><USER24> Not too sure this will be all that convenient, but the commercial was amazingly well done!

</comment><comment><USER25> The only thing PIZZA and SEX have in common is that you want to get to 'em when they're still hot.

<comment><USER6> Sometimes cold pizza can be good. Sometimes cold sex can be too, it's just not as likely.

</comment></comment><comment><USER26> yes, because a police officer knocking at your house is so discreet...</comment>


3D Geometric Reconstruction of the Venus - <AUTHOR> http://www.futureishere.biz/museumofbeauty/

<comment><USER2> Gorgeous.

<comment><USER3> The UX does not do the statue justice. In other words, the UX is terrible.</comment></comment>


Edgecase Non-Profit Grant - <AUTHOR> http://edgecase.com/nonprofit

<comment><USER2> In case the people running this are reading:

My first reaction (feel free to ignore it) is that advertising the number of hours you are willing to donate to a project or an example of how complex of an application you're willing to make would be helpful. I'm a software contractor (not web apps, however) and even I'm not sure what $100K would get me in central Ohio.

(and I do like the concept... I hope to hear how it goes.)

</comment><comment><USER3> What does "local" mean? Does a 501c3 have to be in Ohio to qualify? The Midwest? I'd like to spread the word, but I don't want to target groups that would automatically be out of the running because they're based in the northeast, or Michigan.

<comment><USER4> Sorry for the confusion. We are targeting Ohio 501c3 only. The website has been updated.

Thank you for pointing this out.

<comment><USER3> No worries. Thanks for clarifying!

</comment></comment></comment><comment><USER5> Really interesting. I'm in the process of starting a 501(c)(3) myself and I'd love to know if there are more companies out there that do things like this.

</comment><comment><USER6> This is really great stuff. Kudos to the Edgecase/New Context teams.</comment>


Crypto breakthrough shows Flame was designed by world-class scientists - <AUTHOR> http://arstechnica.com/security/2012/06/flame-crypto-breakthrough/ <comment><USER2> Hmm... if only there was some sort of National Security Agency that employed cryptographers so we'd know about these things first and could protect us from these attacks.

<comment><USER3> Clearly posters aren't getting the sarcasm, so I'll spell it out: the NSA is clearly suspect number one.

What's more interesting to me, though, isn't that they had this technique, it's that they let it out for ... what? It seems like this is a garden variety public worm. One would think that if the NSA had the ability to forge windows code signatures like this, they would have used it more selectively. Some spook is in deep trouble about this.

<comment><USER4> The NSA is not suspect number one. The Russians have had superb cryptographers for decades, heck GCHQ invented public key cryptography years before Diffie Helmann and denied it's very existence within for decades.

Attribution is a bitch. It's not a slam dunk to suggest that a particular agency is at fault without supporting evidence.

<comment><USER3> The NSA is the largest such organization, surely there are others. But just to correct: the GCHQ beat DH by three years and RSA by four, not decades.

<comment><USER4> > the GCHQ beat DH by three years and RSA by four, not decades.

Correct. But they kept the fact that they did secret for decades. That's what I meant, apologies if it was ambiguous (I can't actually edit the comment now to fix it).

</comment></comment></comment></comment></comment><comment><USER5> Intelligence agencies and criminal hackers use the same techniques that white hat security researchers do, so every time I read about an attack like this, I wonder who else discovered it and reverse-engineered it, when, and how they used the knowledge. Imagine the irony (assuming Flame is an American product) if China had discovered Flame first and used its technology to conduct industrial espionage against U.S. companies. In fact, getting first crack at advanced technology is great incentive for rival powers or criminals to cooperate with targeted nations. Our next target might solicit the help of Chinese or Russian hackers, government-affiliated or not, who might be very happy to help so they could reverse-engineer the attack and replicate it themselves.

Even worse -- and this is off-topic so I'll keep it brief -- I don't know if the intelligence gleaned from this operation would produce any benefit at all. Theoretically, if we discovered that Iran's nuclear program wasn't a threat, we could save ourselves a lot of worry. It might save a lot of time and money, and possibly even save lives if it prevented military action. But after Iraq who can be confident that an accurate assessment of the threat from Iran would have any effect on policy? We might be disseminating dangerous knowledge for nothing.

<comment><USER6> I _really_ don't think that the failure of accurate intelligence to drive policy in the past suggests we should give up on trying to have policies driven by facts.

</comment></comment><comment><USER7> Well, MD5 attacks are actually quite old news[1,2,3,4]. There even are some open source projects to help you find them[5]. Would love to hear more details on what was the breakthrough that Flame introduced.

 _Edit:_ The breakthrough that Flame introduced can be read here[8, 9]

SHA-1 is not yet _broken_ , as MD5 is, but fortunately we are having the SHA-3[6] competition (like we had for AES[7]).

[1] <http://www.springerlink.com/content/d7pm142n58853467/?MUD=MP>

[2] [http://www.computer.org/portal/web/csdl/doi/10.1109/CIS.2009...](http://www.computer.org/portal/web/csdl/doi/10.1109/CIS.2009.214)

[3] <http://eprint.iacr.org/2010/643>

[4] [http://stackoverflow.com/questions/1999824/whats-the- shortes...](http://stackoverflow.com/questions/1999824/whats-the-shortest- pair-of-strings-that-causes-an-md5-collision)

[5] <http://code.google.com/p/hashclash/>

[6] <http://en.wikipedia.org/wiki/Sha3>

[7] <http://en.wikipedia.org/wiki/Advanced_Encryption_Standard>

[8] [http://www.cwi.nl/news/2012/cwi-cryptanalist-discovers- new-c...](http://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new- cryptographic-attack-variant-in-flame-spy-malware)

[9] <http://news.ycombinator.com/item?id=4080240>

<comment><USER8> Did you read the article or the mailing list threads? This attack is hardly old news.

</comment></comment><comment><USER9> it's always unsettling seeing a governmental or otherwise undisclosed institution developing such cryptographic breakthroughs in secrecy. this leaves me as a developer with inferior tools to protect my data against any kind of intrusion. it's understandable from a national perspective but unfortunate for the programming community at large. so far we still have bcrypt or scrypt - but who knows, maybe someday we'll have an efficient collision attack there as well...

<comment><USER8> The "programming community's" threat model in cyberspace is no different than anyone's threat model in meatspace. If a well funded government decides you are an enemy of the state they can harm you in meatspace or cyberspace. Are you staying up at night worried about a hellfire missile coming in your window?

<comment><USER10> His fear stems from the fact that most people believe they have a right to the Internet and are essentially anonymous.

To respond to your hellfire missile analogy, if I am in Canada or the US, I'm not worrying about it but if I'm in the middle east, it's a different story.

<comment><USER8> And I am saying that he does not have to worry about NSA, Mossad or The Secret Army of Northern Virginia spending years to develop Flame 2.0 so they can read his email. On the flip side if you are a high level enemy of the state you should still be worried if you are in Topeka or Ottawa; if its not a hellfire coming in the window it will be equally lethal scary rough men dressed in black.

</comment></comment></comment></comment><comment><USER11> "Flame could only have been developed by a wealthy nation-state"

While I do agree that it was indeed developed by one, I'm not sure how it could _only_ have been developed by one. Would it truly take massive levels of money to do or simply some smart, determined people?

<comment><USER12> Smart determined people don't come for cheap, and you don't get world class cryptanalysts and mathematicians working on such a specific endeavor out of "determination".

Plus, we can all guess what wealthy nation-state developed the software and similar things in the past, let's not be hypocritical here...

<comment><USER13> Would _one_ smart, determined person, working in his spare time and for his own satisfaction, be capable of doing it?

I mean, if I had the capability to screw up Iran's nuclear program in my spare time I probably would, because, y'know, fuck Iran.

<comment><USER12> > _I mean, if I had the capability to screw up Iran's nuclear program in my > spare time I probably would, because, y'know, fuck Iran._

Fuck Iran why exactly? Because toppling their democratically elected government and establishing a puppet in the fifties wasn't enough? Or arming Saddam's Iraq to fight them in the eighties?

Or maybe because, say, TX can execute 15 year old "criminals" and ban abortion and/or gay marriage, but Iranians don't get to decide how they want to live? Or maybe because what's OK for Saudi Arabia is not OK for everybody?

Or is it because they haven't harmed anyone in the region, where other nations have already invaded 2 nearby countries?

Or just because, you know, muslims are bad in general? (I don't like the religion myself, but they have the right to do as they damn please in their OWN country).

<comment><USER14> I understand your position here, but, please make contact with some Iranian refugees/dissidents near you for the full picture. Its bad. Worse than I understand Texas to be, by several ball parks.

<comment><USER12> > _I understand your position here, but, please make contact with some Iranian > refugees/dissidents near you for the full picture. Its bad. Worse than I > understand Texas to be, by several ball parks._

Sure, but those are "refugees/dissidents", of course they would think that. It's not like the great Iranian masses are held there by force or hate their culture.

In general, dissidents are also overplayed for political gain by other countries. I mean, even the USSR played upon US political dissidents, the McCarthy era etc. If you are going to judge a whole country better ask the locals, not the dissidents.

<comment><USER15> <http://en.wikipedia.org/wiki/Death_of_Neda_Agha-Soltan>

You are arguing a very weak position.

<comment><USER12> No, you're arguing from isolated facts presented in a sentimental package from mainstream media. Do you know how many deaths there have been in protests in the US? Like, say, the Kent State shootings, were police shot 4 students dead. Or all around the world, for that matter? There have been 2-3 killings by the British police in the last 2 years, they even beat a guy in wheelchair ( <http://www.bbc.co.uk/news/uk-11987395> ). And that's an "advanced western democracy".

Now, put this to perspective. The Kent students were shot doing a mostly harmless protesting, in a country that had sent troops to a third country (Cambodia), and that was in no danger itself. The tension in Iran, on the other hand, is in a country that feels threatened by the US, that has seen 2 other countries invaded in the region, and that foreign powers are known to support vocal dissidents and minorities against the state. In the name of "democracy" of course, and not crude oil. Same foreign powers do nothing for countries having even more extreme muslims, and far less democracy, like, say, Saudi Arabia.

What would the US police do if the US was feeling directly threatened, say like in the WWII? Well, we know what they did at the time: concentration camps for Japanese, for example.

<comment><USER15> > No, you're arguing from isolated facts

Ok, look man, I'm down with anyone who wants to say the US could do better. I could do better. You could do better. But _a_ fact, always beats a strawman, which is what you presented previously. Because the reality is that the Iranian government killed a bunch of its own people and did their level best to suppress that information. Now you've switched from defending Iran to reaching back a generation to find something you can cite to prosecute the United States.

Just to add another fact, Here's a more comprehensive discussion of casualties in the protests where that Iranian lady died

[http://en.wikipedia.org/wiki/2009_Iranian_election_protests#...](http://en.wikipedia.org/wiki/2009_Iranian_election_protests#Casualties)

My point stands: you are arguing from a very weak position. Further weakened by the fact that your thesis keeps moving around. If you're going take on the martyr's quest of defending an outrageous position, you can expect you're going to be expected to present an outragously good argument: all your shit in one bag, sewn up tight. If you're frustrated that people can come along and shoot holes in your argument with a sentence or two, maybe you could consider that as evidence that your argument may not _ever_ hold water.

There's a great passage, I think it's TH White's Once and Future King, where Lancelot has a dream where he sees two armies of knights, white and black fighting. The white side is loosing, so he takes their side. And gets slaughtered. On waking, he is told: know what you're fighting for. Don't fight for the losing side just because they're losing.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> What exactly was the requirement for a "0day" MD5 collision attack here; I thought the Terminal Server Licensing thing at Microsoft spat out good-for- code-signing certificates by itself?

<comment><USER17> They did, but it seems that those certificates had some extensions that made the code-signing attack difficult to carry out on some versions of Windows, so the collisions were used to generate certs without those extensions. (I read this at [http://blog.cryptographyengineering.com/2012/06/flame- certif...](http://blog.cryptographyengineering.com/2012/06/flame-certificates- collisions-oh-my.html))

<comment><USER16> I see; on Vista and above, certain fields in the certificate prevent it from being accepted for code signature. So they did a collision attack to create a slightly twisted certificate where all those fields are tucked away in a useless segment and ignored.

Are there any details on what's new with this particular attack, compared to the known previously published ones? Why wouldn't earlier public research (such as that ps3 fake SSL CA stunt) suffice?

<comment><USER18> I believe the phrase you're searching for is "awesome applied crypto research." :-) <http://www.win.tue.nl/hashclash/rogue-ca/>

We don't yet have details on the differences. I've looked at the evil colliding cert and, AFAICT, the "MD5 Considered Harmful" technique would probably have been sufficient to pull this off.

<comment><USER16> Thanks for the clarification.

The rogue-ca thing is awesome indeed! :)

</comment></comment></comment></comment></comment><comment><USER19> Reading tech news these days is getting too close to reading Jane's Defence Weekly for my liking.

</comment><comment><USER20> "Flame could only have been developed with the backing of a wealthy nation- state"

Further to other people's comments here; Has anyone seen an estimated cost to produce something like Flame or Stuxnet?

</comment><comment><USER21> News from a few days ago made it sounds like MS left their cert wide open to using it to sign code and make it look like it came from Microsoft.

Now this news comes out that they used a pretty powerful crypto attack to essentially create their own trusted root to be able to sign their code to make it look like it came from Microsoft.

Why would you need both vectors? It seemed (yesterday) that the Microsoft bug alone was enough to trick Windows Update into installing your code.

</comment><comment><USER22> I think it makes sense that a well funded government was behind flame, but it makes me wonder, there is nothing that explicitly calls for huge funding. Nothing is very costly other than talent. So just a hypothetical situation here but why can't a hypothetical real life Tony Stark make it? (not rich like Stark but intelligent like Stark) Just a one or two people in a garage on their PC. What makes it impossible for that to be the case?

<comment><USER23> Time? But besides that, I can't really think of anything. Some guy on NPR was talking about how it might be some professional developers who did this in their free time, so that would kind of make sense.

<comment><USER22> If someone is capable of doing stuff that flame is doing, he/she might as well do it in 2 months time. The thing is we are unaware of the exact capabilities of the author of the code, so it can be a very intelligent person doing it in a few weeks or a group of smart people doing in a few years.

But the problem with later is that the more people know about it and the longer it takes to make such malware, the higher are the chances of a pre release leak, or some double agent doing his work. So one or two very intelligent people doing it in very small time make more practical sense for a covert mission.

</comment></comment></comment><comment><USER24> Earlier information linked to from this site suggested that Flame was able to spread by some quirk involving using Terminal Services licenses as signing keys (instead of just licenses) and continuing up a trust chain. Was that information accurate? Is this an additional technique Flame uses for its attack? Or is it the only attack?

</comment><comment><USER25> Wow that's incredible! Ground breaking mathematics and cryptography techniques, sounds so interesting. I would love to understand it all.

</comment><comment><USER15> Hi honey, what did you do today?

Oh, this and that. Let's see what's in the news, shall we?

</comment><comment><USER26> stupid.

"There were mathematicians doing new science to make Flame work."

the government thinks that this is just like normal weapons research.

what they don't realize is that "secure-enough" crypto is far more important to the world economy than their small use in breaking it.

if a government could spend $800B and prove/create a machine that makes asymmetric cryptography impossible - and will be reverse-engineered and known to the world within 3 years of when they start using it, they probably would.

meanwhile, the world loses a lot more than $800B if you can't do anything secure over the public Internet anymore, or have to have previously exchanged a one-time pad to anyone you want a secure connection with.

this isn't just another weapon. mathematics is a public good. Of course, if you can spend $800B on new math and then break it, then in some sense it was "always broken." In another sense, however, that's not true at all. Quit messing it up for everyone.

<comment><USER27> Can't say I don't disagree.

It seems as though the governments of western democracies are spending a lot more effort on digital swords to stab at our enemies than on digital shields to protect their citizens.

<comment><USER28> The NSA says that about 1/3 of their budget is put towards protecting US government systems and data (though there is no way to verify that). It is extremely difficult for them to even attempt to protect non-governmental systems. The NSA was involved in SELinux, and designed the SHA family of hash functions. This, along with their certification of various cryptographic standards as acceptable for government use, seems to me to be about all they could do defensively without requiring them to have access to private systems and data.

</comment></comment></comment><comment><USER29> Cool.

</comment><comment><USER30> Ha! Everybody knows that this virus was hand-written by our Great Leader and Horse Rider King Jong Ill, right before he decided to exchange his earthly existence for another greater one.</comment>


How to – Increase Your Freelance Profitability by 30% – Without Raising Rates - <AUTHOR> http://freelancerplaybook.com/blog/how-to-increase-your-freelance-profitability-by-30-percent-without-raising-rates

<comment><USER2> TL;DR: Set up tons of meetings (two a week or more) with no set agenda and you'll make 30% more because reasons...</comment>


Ask HN: Should I release a SaaS with double license or not? - <AUTHOR>

Hello,
I started a side project for our family business. Now I reckon that it might have value as a SaaS, for others.
I don't know if I should make the project Open Source or not. I'm keen to opt for a solution where there is an open source version, which you could install it on your server and a 'pro' version with additional features which I run on my servers (with API, integrations, etc.).
I would like to have some advice on the matter from people who had to make the same choice before.
Another issue that might arise in case I opt for the double-license is what license should the open source version be released under. I took a look at sidekiq[1] which I think uses this model successfully and uses a proprietary license for 'pro' and LGPL instead of BSD or MIT licenses. I don't know why they went with LGPL over the other two though.
Comments and thoughts are more than welcome, thanks!
[1] http://sidekiq.org <comment><USER2> I made this choice and went with Affero GPL. This theoretically satisfies: (1) other devs building libre software, (2) non-tech-savvy customers who can still buy service, and (3) tech savvy entrepreneurs who want to limit lock-in and also need a compelling reason to spend money (limit licensing liabilities).

Some people are adamantly opposed to AGPL and prefer GPL or BSD. In my view, it's either because they fall into bucket 3 above or they simply prefer freedom to make software non-free. However, my outlook is that AGPL is the only actually free license and it also coincides with my business model (which involves essentially selling extra license rights or SaaS).

<comment><AUTHOR> Thanks I didn't look at AGPL, will do!

</comment></comment><comment><USER3> So here are a few thoughts:

1\. A "pro" for going open-source: It is a comfort to your customers, knowing that if you go out of business, that they can continue using the software - either by hosting it themselves, or paying someone to do so.

2\. If your product is OSS, it is also a near-perfect guarantee against "vendor lock-in" which is a big deal to some people. As the old saying goes "one of the best ways to get people to use your product, is to make it easy for them to stop using your product." IOW, people will be scared to risk investing in using your thing, and getting locked in, when they aren't yet assured of the value it offers. If you make it easier to leave, it's easier for them to make the initial plunge. It sounds paradoxical, but it seems to hold true.

3\. Another "pro" is that you may actually get some contributions from the community, which could help you advance your project faster than you can do it alone.

4\. A "con" is that some customers may elect to host it themselves and not pay you, instead of using your SaaS. My feeling is that those people were never really your customers to begin with, and represent no big loss. People who pay for SaaS aren't really paying for the software, they're paying for the idea that you will take care of making it Just Work, keep the servers running, handle scaling, backups, etc.

5\. Another "con" is that a competitor can use your code and setup a competing service.

All told, I'm a fan of the OSS route, but I'm also an Open Source ideologue, so I'm not exactly unbiased. So take these comments for what they're worth. :-)

<comment><AUTHOR> Hello,

Thanks for sharing your thoughts. I'm more keen to open source, because like you, I love the open source ideology.

Point '4' was all I needed to read actually. I'm not worried about point '5' I don't believe my _idea_ is _that good_ on one hand and I'm not afraid of the competition :-)

Thanks again!</comment></comment>


Hybrids 14x better than electric vehicles at reducing carbon dioxide emissions - <AUTHOR> https://www.emissionsanalytics.com/news/hybrids-are-better <comment><AUTHOR> Related: [https://news.ycombinator.com/item?id=20261457](https://news.ycombinator.com/item?id=20261457) \- electric vehicles are neither as efficient nor as sustainable as hybrid.</comment>


Four Chinese citizens arrested on college-entry cheating charges - <AUTHOR> http://www.universalhub.com/2017/four-chinese-citizens-arrested-college-entry <comment><USER2> I run an English resume editing, LinkedIn Profile creation, interview coaching, and academic document(s) and application(s) final editing service in Shanghai (reach out on my profile if interested). We have been approached to do everything under the sun from forging recommendation letters to writing entire Master's level theses from scratch and everything in between. There is a ton of business if you have no ethics. No way, no how.

</comment><comment><USER3> How often does the arrest and prosecution of visa students for cheating on entry exams happen?

<comment><USER4> I know that this sort of cheating happens quite a bit, and usually people just turn a blind eye to it. According to some of my friends from overseas, some of my their friends (my classmates) hired test takers to get them into the university I attended.

Makes me a bit livid. I studied and worked hard by playing fair.

<comment><USER5> I took SAT in Hong Kong, 2009 and saw this happen in person. There were even hidden ads for hiring test takers. That explained why there were international students with 2200+ SAT score but could barely read/write/speak in English and had trouble catching up with lectures.

I for one absolutely loathe such dishonesty and the fact that some parents even helped hiring test takers for their kids made me sick.

</comment></comment></comment><comment><USER6> If you know even basic english, TOEFL is not really difficult. If you are unable to get a decent score in TOEFL, it is very likely that you would not understand anything that is thought in a lecture that is administered in English.

<comment><USER7> "taught"

</comment></comment><comment><USER8> What kind of a federal crime does this fall under? Mail fraud perhaps? Also, are tests like these actually administered by govt.?

<comment><USER4> Defrauding the student visa program, so illegal immigration.

<comment><USER8> Ah, that makes sense.

</comment></comment></comment><comment><USER9> I'm curious about how they first got admitted and then later got caught.

</comment><comment><USER10> Stuff like that all around developing countries. Those guys shoot themselves in the foot, but most likely that were their parents.

The true story here, I was going through the immigration control in JFK on Moscow -> NYC flight. In front of me was a guy with a family speaking fluent Russian. I thought he was Russian, but then he pulled out a US passport and began telling his "family" to not to speak with immigration or otherwise "they will be revealed". When it was his time to go through the officer, he was visibly super anxious and he barely managed to put a single phrase in English. The immigration guy called somebody, then policemen came and took him and his "family" away.

It amazes me that in this day, there still are naive people who think that they can get their way in the West with bought or fake papers.</comment>


CTRL + ALT + DELETE Resetting America's Military - <AUTHOR> http://www.foreignpolicy.com/articles/2014/05/13/ctrl_alt_delete_how_to_redesign_the_military_from_scratch

<comment><USER2> Reorganizations are nothing new to the military but not at the DoD level. I think we should be looking more toward what Eisenhower envisioned with a single fighting force and a healthy fear of a nation industrialized toward the military. Reorganization would likely retain the stove pipe project of record system.

</comment><comment><USER3> I imagine this would be another attempt to kill the A-10, one of the most successful, dollar-for-dollar, kill-for-kill, aircraft in the last forty years.</comment>


The Next Steve Jobs Isn't Buying an iPhone X - <AUTHOR> https://medium.com/@bryce/the-next-steve-jobs-bd3c54f7cfc4 <comment><AUTHOR> He's probably doing an ICO and bypassing the Valley completely.</comment>


Is the UK government too scared of Google, Amazon and Starbucks? - <AUTHOR> http://www.bbc.co.uk/news/business-20579264

<comment><USER2> Courts in the UK have historically had very narrow interpretations of tax laws. The classic example is a House of Lords case called Commissioners of Inland Revenue v. Duke of Westminster, where one of the judges gave this great judgment:

"Every man is entitled if he can to order his affairs so as that the tax attaching under the appropriate Acts is less than it otherwise would be. If he succeeds in ordering them so as to secure this result, then, however unappreciative the Commissioners of Inland Revenue or his fellow taxpayers may be of his ingenuity, he cannot be compelled to pay an increased tax. This so- called doctrine of "the substance" seems to me to be nothing more than an attempt to make a man pay notwithstanding that he has so ordered his affairs that the amount of tax sought from him is not legally claimable."

The influence of this case is still strongly felt today in courts, and this leaves the British Parliament with little power to make "strong" tax laws that have no "loopholes".

American courts and laws do far more to assert jurisdiction and prevent tax avoidance, but as we know American tax rates are much lower than most countries.

<comment><USER3> The UK tax code is also the most complex on Earth. A much simpler one would be much less likely to have "loopholes".

<comment><USER4> Do you have a source for this? I have never heard this and I very much doubt it is true. If you look at the "Paying Taxes Report" from the world bank + PWC, the UK has a yearly time to comply of 110 hours - versus 175 hours USA, 207 hours Germany, 330 hours Japan... Time to comply isn't a perfect metric of course, but all the classical "easy tax" countries like Switzerland, Luxembourg, Singapore, HongKong, Ireland have even lower numbers than the UK, so there is at least a correlation. (If you control for economically comparable factors)

<comment><USER3> If nothing else, it is the longest tax code [1]. It's possibly not the most complex, but one could argue that it no longer matters at this point.

1\. [http://www.accountingweb.co.uk/topic/tax/uk-now-has- longest-...](http://www.accountingweb.co.uk/topic/tax/uk-now-has-longest-tax- code-world)

</comment></comment></comment></comment><comment><USER5> I don't think it's that difficult to get. The UK government has been partly naive, though many would say typically liberal, about corporate activity. In truth, the only reason this is coming up now is because some elected politicians equate legal tax minimisation with avoidance. This from a group who were discovered to be minimising illegally expenses, and where local offshore tax havens like Jersey have been allowed to continue to operate for a very long time.

It's politically convenient to blame foreigners while the general population has had their personal wealth diminished through multiple runs of the money printing press.

The rationalisation seems to be that because local firms, unless using what would now be seen as avoidance, cannot avoid profits and so corporation tax, then everyone else should jolly well pay it too. Of course, in the days when Britain's large international companies like BP returned taxable profits to the UK, the accumulation of wealth through extra national activities barely mattered ethically. Now of course, the UK is contracting both in real terms and comparatively.

It's odd. These rules were set by the very people complaining about them. And from what I've heard from some if the participants in the committee, some haven't the first idea about the Companies Act and its meaning.

If Starbucks is willing to reallocate an amount from an expense to profit for the purposes of corporation tax, I have to say, even despite any other consideration, that's its tantamount to a gift. A sensible good will payment, but a gift none the less.

<comment><USER6> Another amusing facet of this is that the chairman of the Public Accounts Comittee, Margaret Hodge, is a large shareholder in Stemcor, the Steel Trading company set up by her father and currently run by her brother.

Stemcor paid £163k of tax on £2.1bl of revenue in 2011 [1]

[1] [http://www.telegraph.co.uk/finance/businesslatestnews/966839...](http://www.telegraph.co.uk/finance/businesslatestnews/9668396/Margaret- Hodges-family-company-pays-just-0.01pc-tax-on-2.1bn-of-business-generated-in- the-UK.html)

<comment><USER7> All entirely above board - full tax on operating profit on a company with geniunely high expenses - as refuted by Private Eye. The interesting question is..who 'briefed' the newspapers on this (this wasn't investigative journalism), and who are they being paid by?

<comment><USER6> Why would a steel trading company have such high expenses? Are they manufacturing and storing it as well?

Then there is also the question of the shares put in trust for tax purposes also...

</comment></comment></comment></comment><comment><USER8> \-- _Media companies - television, radio and newspapers - have complained for years that Google takes colossal and growing amounts of net advertising revenues, while investing relatively little in the gathering of news or the making of television and radio._

I don't get this argument at all. Google uses advertising to gather news content via web search. It sounds like, if they started reporting on news, the media would complain about Google paying 3x what everyone else can afford and stealing all the talent.

\-- _Owners of small independent coffee shops are not exactly huge fans of Starbucks._

Studies have shown that Starbucks has actually increased the quantity of viable coffee shops in neighborhoods. Is this something different in England?

The Gov't not getting taxes is strictly the fault of the Gov't for allowing the loopholes to exist and be exploited. I'm sure though, that this article isn't claiming that none of the employees of Starbucks doesn't get taxed.

I think it would behoove the article writer to study and research what has happened on other parts of the world. Of course, Amazon isn't really good for B&M bookstores and that is a legitimate fear, but the rest are non-issues. I really don't get the Google argument at all.

<comment><USER9> >I don't get this argument at all.

The argument, not that I agree with it, is: there is a finite pool of advertising dollars. By taking them and spending them on other stuff, Google is cutting the funding of news/television/radio. It's like pg's suggestion that the invention of the camera may have damaged art by depriving artists of "day job"s painting portraits.

>Studies have shown that Starbucks has actually increased the quantity of viable coffee shops in neighborhoods. Is this something different in England?

I doubt it. But there are still many owners of small coffee shops who hate Starbucks - mostly the ones who can't compete because their coffee is terrible.

>The Gov't not getting taxes is strictly the fault of the Gov't for allowing the loopholes to exist and be exploited.

And now the Gov't is taking action to correct that.

<comment><USER10> Well, if Google's efficiency is the problem they should consider banning all agricultural machinery. There is untapped job potential for up to 90% of the population!

Or we could start building pyramids again - with bare hands!

<comment><USER9> Please, read and think a little before jumping on your strawmen.

The allegation is not that google is being more efficient and thereby reducing employment. The worry is that there will be much less news/television/radio because google has removed its primary source of funding.

(If you believe the purpose of all things is economic optimization then this won't concern you, but many consider news/television/radio to be valuable for their own sakes)

<comment><USER11> I'm not sure I buy the premise. It's not Google (the company), it's the internet as a whole. More competition for news reduces margins. Suppose Google search was a grant-funded nonprofit operation with no ads. How would that improve the condition of news reporters?

<comment><USER9> It's not Google's search so much as adsense. The argument is that companies with ad budgets would no longer be spending them on google ads, so they'd direct a greater amount of money towards buying newspaper ads. So prices for ad space in newspapers would rise, and newspapers would have more money (and there would be more newspapers, as previously unprofitable niches became profitable) and spend that on reporters.

<comment><USER11> Google News doesn't even have ads though, so that can only be referring to search and apps and the like. I mean it seems like they could just as well be arguing "billboards are destroying journalism" because the money companies spend on billboards (or direct mail, or telemarketing, etc.) are marketing dollars that could instead have gone to supporting newspapers if those alternatives didn't exist.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> I have always found it interesting that the tech titans, whose employees seem to overwhelmingly support high-tax blue-state politicians and policies, are also engaged in the most aggressive tax avoidance in the world, and given their wild success, probably the largest in history.

We only need to look at Europe to see how widespread tax avoidance plus high government spending creates an unsustainable path that puts the entire economy and country at risk.

Since silicon valley seems like such a civic minded place, I'm wondering if we will ever get realistic about what we'd really like to see happen: either support lower government spending across the board to complement the aggressive tax avoidance, or demand that leading companies pay taxes according to the state or country where the revenue is received, and not based on wherever a shell company may reside.

</comment><comment><USER13> Something that really annoys me about such debates on taxation is that people often say `tax' when they mean `corporation tax' (in the case of companies) or `income tax' (in the case of individuals).

In the UK, about the same is paid in national insurance + VAT + council tax as is paid in corporation tax + income tax.

</comment><comment><USER6> Laffer curve, anyone? Reduce the Corporate Tax rates and companies wouldn't have spend mony on all these contortions to avoid paying.

<comment><USER14> LOL. You do realize the laffer curve is widely discredited?

All reducing corporate tax rates does is cause a race to the bottom.

<comment><USER6> How can it be discredited if it is actually happening?

I'd prefer a race to the bottom than the current race to the top.

</comment></comment></comment><comment><USER15> In the case of media companies vs Google, and Amazon vs everybody else, I think they deserve for not innovating their businesses, and leaving customers in the cold.

Now for Starbucks vs traditional cafés, just make better coffee. I doubt Starbucks would thrive in Italy for that reason.</comment>


.NET Framework rootkits - backdoors inside your framework  - <AUTHOR> http://www.cgisecurity.net/2008/11/net-framework-r.html

<comment><USER2> All this paper says is that if your framework includes unsigned MSIL binaries, you can (given an exploit that allows you to overwrite arbitrary files) backdoor the binaries. Amazing! Did you know that if you can write access to Python scripts, you can backdoor Django apps too?

<comment><USER3> Yeah, it's stupid. From their presentation: "This is a post exploitation type attack, that requires administrator level privileges." By then you're owned so who cares?

<comment><USER4> I totally agree, this is far from being a major security hall.</comment></comment></comment>


Curious About Consciousness? Ask the Self-Aware Machines - <AUTHOR> https://www.quantamagazine.org/hod-lipson-is-building-self-aware-robots-20190711/ <comment><USER2> Here's the tl;dr and it's awesome:

"A system that can simulate itself is to some degree self-aware... We said, "Let's take all that infrastructure that people have made to help robots learn about the world, and we're going to turn it inside, on itself.""</comment>


World's largest association of pilots boycotts body scanners - <AUTHOR> http://www.bigbrotherwatch.org.uk/home/2010/11/worlds-largest-association-of-pilots-boycotts-body-scanners.html

<comment><USER2> The key is to make the pat-down as time consuming and embarrassing as possible for the TSA staff. Follow these steps:

1) Refuse the body scanner and request a manual pat-down.

2) Ask to have a supervisor, or a second TSA staff, present during the pat- down. Explain that this is to ensure that no sexual harassment occurs.

3) If you are a guy, ask to have a female TSA staff member perform the pat- down. If your request is denied, calmly explain to the TSA guy that you are homosexual and that a pat-down by another guy will turn you on and will make you sexually extremely uncomfortable.

4) During the pat-down, make comments such as "Oh yeah, I like it when you touch me there!", or "Can I get a happy ending?"

<comment><USER3> No need to go that far. The easiest way to protest this is to DDoS the system - if a large enough proportion of the population consistent opts out of the backscatter, the system will collapse on itself.

There is no way TSA can clear a flight full of people using patdowns fast enough. All we need is enough people to refuse - no need to make special requests or other muck up the works.

<comment><USER4> _if a large enough proportion of the population consistent opts out of the backscatter, the system will collapse on itself._

I disagree. Why in the world should the authorities care that the lines for "opt-outs" are incredibly long, and the machines are getting low usage?

<comment><USER5> If enough of the right people complain, people in authority start losing their jobs. That's why the authorities care.

</comment></comment></comment></comment><comment><USER6> Hang on, do we know this is for real? I followed the link to news.com.au, and I can find one or two other blogs that are referring to this, but the APA site itself (<http://public.alliedpilots.org/>) makes no reference to anything like this, including in their "For the Media" section (press releases and such).

<comment><USER7> Here's a copy of the message the APA president sent to pilots: [http://aviationblog.dallasnews.com/archives/2010/11/apa- pres...](http://aviationblog.dallasnews.com/archives/2010/11/apa-president- advises-against.html)

<comment><USER6> Ok, thanks. I notice this doesn't really rise to the level of an APA "boycott", though.

</comment></comment></comment><comment><USER8> There was an interesting opinion piece in New Scientist about radiation safety levels recently (31 July 2010). It looked at health studies from Hiroshima and Nagasaki and studies of chemotherapy patients that suggest that the current recommended radiation limit (1 millisievert per year) is overly cautious. The article went on to suggest that the recommendation be raised to a lifetime total of 5 sieverts at no more than 0.1 sievert per month.

The article is here, unfortunately behind a pay wall: [http://www.newscientist.com/article/mg20727715.800-whos- afra...](http://www.newscientist.com/article/mg20727715.800-whos-afraid-of- radiation.html)

</comment><comment><USER9> Did you know that they had full dose radiation-driven "shoe fitting" devices in over 10,000 shoe stores up until 1970?

They were eventually pulled when reports of burns and stunting of bone and cartilage began to emerge.

It's the little vignettes of history like this that remind me how many grand- experiments there are out there using us all as the unwitting test subjects.

Is the Pilot Union's boycott a kneejerk reaction to the measured warning about potential radiation damage?

Maybe.

But never underestimate how quickly politicos helping to equip our airports with $100 - 200k a pop units will happily ask for forgiveness, not permission.

Citation for shoe stores - <http://www.hemonctoday.com/article.aspx?rid=28218>

<comment><USER10> But this is different - they have done long term studies following the total life health of 1000s of pilots who have been exposed to these scanners 10x a day for their whole careers.

<comment><USER11> Link/source?

<comment><USER10> biblo-ref: Journal of Ironic Internet Postings 1 April 2011

<comment><USER12> There is an apparently dwindling minority of people who would consider this to be sarcasm and not irony. For these few, irony is never merely logical negation. It necessarily involves unintended and opposite consequences flowing from the protagonist's actions. A short internet search suggests I may be the last of this kind.

<comment><USER13> The only problem I have with caveats like this is that on all the hundreds of occasions when I've heard someone say, "Actually, that's not irony," the subsequent explanation of what _does_ qualify as irony has been different every single time.

This is additionally confounded by the fact that British people really _do_ mean "sarcasm" when they say "irony." (At least, most of the British people I've spoken with do.)

<comment><USER12> > This is additionally confounded by the fact that British people really do > mean "sarcasm" when they say "irony."

I've never experienced this in actual conversation with British and/or other non-US English speakers. But the internet definitions I'm finding seem to all include 'sarcastic but somewhat subtle' in the definition of ironic. For me the definitions of sarcasm and irony do not intersect. Sarcasm is intentional whereas irony is at best random or more often a signifier of implied 'fate'.

<comment><USER14> Irony certainly can be random or a signifier of implied fate in the case of literary/dramatic irony.

Verbal irony, which is closely related to but not identical to sarcasm (though there is quite a lot of debate on exactly the relationship among psycholinguists) is most certainly intentional.

        "I don't wear my seat belt because if I'm uncomfortable I'll drive more dangerously."

        "Sounds like you've really thought that one through."

Verbal irony, possibly sarcasm depending on whose definition you buy, but definitely intentional in any case.

<http://en.wikipedia.org/wiki/Irony#Verbal_irony> discusses this further and refers to specific research on this topic.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> It seems that the debate in the comments here is on whether to give the TSA employees a hard time (with suggestions) or to try to pressure the politicians who let this happen (with no concrete suggestions).

I wonder if the pressure really should be applied to the airlines. Obviously they are in a tough spot, but once they start to really lose profits, they would be sure to run to DC screaming. Just a thought.

</comment><comment><USER16> I wonder what happens when a normal person refuses to be scanned by these newfangled scanners?

I'm going to the US soon and I don't like the body scanners.

<comment><USER17> I refused last week. I got pat down pretty invasively. The TSA agent seemed rather embarrassed about it. The protocol says that when they touch private areas, they must point out that they're using the back of the hand, but being groped is being groped.

If everyone refuses, I hope, it will be simply too costly to continue ... but I'm still not sure if allowing myself to be literally manhandled is any less an invasion of my privacy except insofar as there's no photographic evidence that can be stored indefinitely.

<comment><USER10> There is a gay rights group who are planning to protest it by turning up at the airport in costume insisting on a special pat down and pretending (or not) to enjoy it very much.

Sounds like a great day out - especially if you are into uniforms!

<comment><USER18> Sexually harassing someone who makes $10 an hour to make a point to someone who makes $150,000 a year several thousand miles away and who has actual decisionmaking authority does not strike me as a justice-enhancing move.

<comment><USER19> This has already been done to death on HN. 1) "Doing your job" is never an excuse for doing what is wrong. 2) These pat-downs are wrong.

If you agree with the first 2 points, it seems to me that making the wrong- doer personally accountable is a reasonable response. Yes, their boss several thousand miles away also needs to be held to account, but so do the people physically executing the searches.

<comment><USER20> I'm pretty sure that argument should be reserved for possible war crimes and not frisking people.

<comment><USER21> There are plenty of jobs that violate rule #1 above. Spammers, those who take advantage of the economically disadvantaged, et cetera.

If groping someone's genitals doesn't cross a line, what does?</comment></comment></comment></comment></comment></comment></comment>


The Sac State 8008: The First Full-Fledged Microcomputer (2008) - <AUTHOR> http://www.digibarn.com/stories/bill-pentz-story/index.html <comment><USER2> > John and I went to one of the early microcomputer shows in San Francisco. > Steve Jobs was sitting on a wooden peach crate telling all his design in > another box of wires that did not work was the computer of the future. He > said that mass of wires was not working because something was bumped getting > that mess to the show. John, who later became an IBM hardware design > engineer, took pity on Steve and designed the Apple II system board which > was the first version that actually worked no matter what is claimed today.

This comment makes me doubt some of the veracity of the rest of the article and its extraordinary claims. But maybe I'm biased by reading a lot of the accepted history.

<comment><USER3> Yeah, that's kind of weird, really. It basically ignores the existence of the Apple I, and I've never seen anyone talk about Steve Jobs claiming to have designed either the Apple I and II -- that's always been credited, even by Jobs, to Wozniak.

Maybe this is supposed to be a claim about the Apple I and Wozniak, but that still doesn't fully line up.

</comment></comment><comment><USER4> Hah. I never thought I'd see CSUS here on HN. I briefly went there, but wasn't in CS. In the early 2000's, I worked in a large finance company in Sacramento. Our tech lead spent a not insignificant portion of his time interviewing people. He always complained how Sac State grads never knew anything software relevant coming out of that program. They didn't know any web technologies or Java, a little C, but they were all whizzes at hardware, COBOL, and assembly.

Looks like I underestimated that program in the 90's. This article gives me a bit of a hint of where they were focused.

<comment><USER5> Sac State grad here, from 2002-2006! After the turn of the century they started teaching more Java classes, but the most interesting classes were definitely the Assembly and Computer Architecture classes. I never ended up using them in my career, but they were a blast.

</comment></comment><comment><USER6> The article uses wrong terminology. VLSI is just a generic to describe IC with very high degree of integration, like a CPU or a real-time MPEG compressor. What he described is actually an early attempt to produce FPGAs.

</comment><comment><USER7> >"Because IBM dominated the computer market all Sac State computer science students had to learn BAL (Basic Assembly Language) used on the IBM System/360, 370 and later mainframes.

 _Students had to prove their mastery of BAL by writing a working assembler, BASIC interpreter, simple compiler, operating system and data base._

To stop cheating completed student program listings, card decks and outputs were collected and stored in a locked area that faculty members reviewed to ensure students did not copy prior programs."

>"Bill recognized that all he needed was for the Intel 8008 to run the same BAL instructions. Bill had just finished a large graduate student project that created the firmware to make an IBM System 3 minicomputer run on a 4K based VLSI based computer.

 _Bill simply changed that code so BAL also ran on the Intel 8008._

This ability to run BAL let Bill's team pick and choose between the best student programs. They soon had the Sac State 8008 running DOS (Disk Operating System) which allowed loading and starting programs stored on paper tape, cassette tape, cartridge tape, and even their mobile pluggable 3/2 (three megabytes fixed, two removable) hard disk system. They had it running a simple BASIC interpreter. Because the BAL firmware ran so slow, Bill's team also built a BAL assembler which instead of putting out one machine code instruction per human readable instruction put out all the code needed to run in 8008 machine code."

</comment><comment><USER8> If the article is correct and Intel really could have made "a commercial microcomputer with BAL/DOS from Sac State", then it's quite mind boggling to think of how different things could have turned out. For want of a nail and so on.

<comment><USER9> Doubt if an 8008 uC would have been a commercial success. It ran at 125 KHz with instructions taking around 20 clocks. Instruction set was very primitive compared to the 8080 and the address bus was only 14 bits wide. It was best suited for calculators and controllers.

I built an 8008 machine in 1974 with a whopping 256 bytes of memory and toggle switches for program entry in binary machine language. You could watch it execute subroutines in the address bus LEDs!

<comment><USER10> That's around five times slower than a PDP-8/S, which was possibly the slowest mini around at the time - already obsolete by 1970.

So it's doubtful it would have been successful as a computing product, although it might have had some applications at the more undemanding end of process control.

It would have been more interesting to use the skills, techniques, and marketing contacts collected during the 8008 project to jump-start an 8080 project as soon as the new CPU appeared.

But the S100 era happened because the Altair had a standard bus that made the system trivially expandable.

Corporate/industrial/academic systems had expensive and relatively complicated proprietary bus and backplane systems, which limited the market and kept prices high.

So... an alternative 8080 system wouldn't have been a game changer unless it was sold with the same open hardware model. At best it would have been an expensive micromini for a niche academic and industrial market.

</comment></comment></comment><comment><USER11> I remember photos of a robot arm, with fingers and thumb, controlled by an 8008. "CORMAC"? Something like that...

</comment><comment><USER12> Gary Kildall was the Bill Gates we needed.

<comment><USER13> I think he was probably too humble/Scandinavian to stand a chance.

> Gary Kildall was born and grew up in Seattle, Washington, where his family > operated a seamanship school. His father, Joseph Kildall, was a captain of > Norwegian heritage. His mother Emma was of half Swedish descent, as Gary's > grandmother was born in Långbäck, Sweden, in Skellefteå Municipality, but > emigrated to Canada at 23 years of age.

[https://en.wikipedia.org/wiki/Gary_Kildall](https://en.wikipedia.org/wiki/Gary_Kildall)</comment></comment>


Deploying a Rails 3.1 app – gotchas - <AUTHOR> http://merbist.com/2011/08/30/deploying-a-rails-3-1-app-gotchas/ <comment><USER2> Sad to see that Rails is getting more and more complex.</comment>


Show HN: RepoPlay - Instant replay for repo commits (+looking for internship) - <AUTHOR> http://repoplay.com/

<comment><USER2> For anyone living outside The Valley, looking to break in and get a job on the inside, this is how it's done. Show people what you can do - your work is your resume.

Mikito, I'm sure you're sorting through a bunch of potential internships right now. Way to go.

<comment><AUTHOR> Looking at my inbox, I can only say - today will go down as one of those special days when my life changed. My most sincere thanks to everyone, I will get back to you soon (it's 1:30 in the morning here).

<comment><USER3> Inspiring, thanks for being a good example for the rest of us junior- and intern-level devs.

</comment></comment></comment><comment><USER4> The repo visualizer is really clever, as is using it to get companies to notice you. Best of luck!

</comment><comment><USER5> Quick feedback

"Offer me a place at your startup"

I like this better:

"Let me show you how great of a fit I'd be for your team" or something along those lines..

<comment><USER6> yeah agreed. right now the tone of your site looks too gimmicky, like you made this JUST so you could land an internship. even if that was your intention, at least hide it better. ideally i think companies are looking for employees who hack on projects for fun, NOT with the explicit goal of padding their resume or impressing anyone in particular.

best of luck to you, though!

<comment><AUTHOR> Thanks for the feedback - I changed the text. I guess I'm not the guy to ask for copywriting :).

I would speculate that the tone might be in part due to cultural background as well - as Wikipedia says, "The Finnish language has no simple equivalent to the English 'please'." <http://en.wikipedia.org/wiki/Finnish_grammar>

As for the background story, I did start this project for fun (it was an old hackathon idea) but kicked it into higher gear due to this opportunity coming up.

Thanks!

<comment><USER6> cool, best of luck to you! perhaps another idea is to explain this background info on your site in some tasteful way. that way, potential employers will see that you're an earnest hacker with a real interest in this stuff (and you might not have a native english speaker's grasp of tone and word usage), as opposed to someone making a one-off gimmick.

<comment><USER7> For what it's worth, I think "Offer me a place at your startup" is better English, being more clear and less wordy that hajrice's alternative. Rare is the English speaker outside the US or UK who will award you points for speaking in a roundabout manner, and I believe "fit" and "team" are Americanisms.

That's not to say that Silicon Valleyspeak is not the practical choice for this particular situation. But I'd rather not see that become the standard for how native speakers speak.

</comment></comment></comment></comment></comment><comment><USER8> Nice to see this executed in a publicly-accessible way. I built a similar thing a little while ago, but never got around to polishing it up and packaging for consumption.

<http://vimeo.com/18833937>

<https://github.com/burke/jsgithistory>

</comment><comment><USER9> Internship? This is cooler than a lot of "pro" stuff. It's really insightful to see how other projects morph and change over time. Good luck!

</comment><comment><USER10> Very cool! Now I just need a bigger screen to be able to see everything :)

</comment><comment><USER11> I love this. I'm in the process of doing something similar :)

</comment><comment><USER12> Good job Mikito :)</comment>


WWDC 2011 sold out - <AUTHOR>

Didn't even last one full day. Damn! Who says Apple developers are cutting back on T&E! http://developer.apple.com/wwdc <comment><USER2> They made $8 million from ticket sales alone. :O

<comment><USER3> ... minus however much it costs to rent and staff the Moscone center for an entire week, not to mention all of the event dressing (signs, shirts, props), food for the attendees...</comment></comment>


Apple's AirPods Are an Omen - <AUTHOR> https://www.theatlantic.com/technology/archive/2018/06/apples-airpods-are-an-omen/554537/?single_page=true <comment> crooked-v > For one, earbuds will cease to perform any social signaling whatsoever. > Today, having one's earbuds in while talking suggests that you are on a > phone call, for example. Having them in while silent is a sign of inner > focus—a request for privacy. That's why bothering someone with earbuds in is > such a social faux-pas: They act as a do-not-disturb sign for the body. But > if AirPods or similar devices become widespread, those cues will vanish.

...what? Nobody's going to walk around with earbuds in if they're not actually using them for anything at the moment. The wireless part doesn't magically make having something stuck in your ears less of an impediment for normal activities.

This article is really grasping at straws.

<comment><USER2> Well it's possible that AirPods or other earbuds will eventually have capabilities that allow you to hear much better than normally, like a conversation 50 feet away or sounding an alarm when a relatively silent electric car is approaching. In that case there may be a 16/7 use case for them.

<comment><USER3> If that's the case there will be a disproportionate number of elderly users wearing earbuds constantly as a 'discrete' hearing aid. Considering that the price of an iPhone with AirPods is about the same as what one would pay for an FDA approved hearing aid device, seniors everywhere will adopt them en masse. There's elderly Americans everywhere, so the association between the elderly and the iconic and highly visible AirPods should solidify quickly after the release of iOS 12. This is the logical end or death of the AirPod trend as "something cool", and the birth of the AirPod as "something that old people need to function". Apple's moving into AARP & Jitterbug territory.</comment></comment></comment>


GitHub Badge v3 has been released with a cleaner UI and a JSON API - <AUTHOR> http://githubbadge.appspot.com/?v=3

<comment><USER2> I really appreciate this project. I wish they implement something for private stats enabled with api key or oauth authentication.</comment>