Microsoft disables Spectre mitigations as Intel's patches cause instability - <AUTHOR> http://www.securityweek.com/microsoft-disables-spectre-mitigations-due-instability <comment><USER2> These updates most definitely could've been handled better. I was having a busy week with exams and I get a call about around 10 machines not booting (this was before the announcement). Sure enough, last thing everyone reported was updating. I call the supplier and apparently they have reports of at least 2000 machines (at that moment) that had to be reimaged across the city (from what I could tell, all were older AMD PCs) because of this dumb update. I was used to not being to able to trust software, but if I can't trust hardware now either, farming does suddenly appear much more appealing.

<comment><USER3> Trust me, if you don't like the idea of your entire livelihood hinging on weather or not a piece of equipment boots up, farming is NOT the career for you.

<comment><USER4> I like the idea of Internet Weather. Seems probability of rain is currently increasing. And so does anticipation of floods and surges.

<comment><USER5> Do you think there's a market for "Cloud Meteorologists"?

<comment><USER6> Such data lake. Such pastoral, idyllic landscape.

</comment></comment></comment></comment></comment><comment><USER7> I lost many hours over this last week. The system was unable to boot and finally a thread on reddit came to the rescue ( [https://www.reddit.com/r/techsupport/comments/7sbihd/howto_f...](https://www.reddit.com/r/techsupport/comments/7sbihd/howto_fix_inaccessible_boot_device_caused_by/) ).

This actually made the system boot but there are some leftovers being installed on first boot that I've been unable to disable that also causes the system to be unable to boot.

So now, the machine is running but as soon as it is restarted we have to re- image the disk, go through the process of manually removing patches, and then pray that we don't have a power shortage as we'd have to do everything yet again on next boot.

I'm not convinced that this patch will solve the issue either, because if this updates requires a reboot the fix won't be installed if we can't boot. I might try to install this update from the recovery console see if that works.

Quite frustrating.

<comment><USER8> Speaking of which, why do so many things require reboot to update on Windows?

<comment><USER9> There is a very fundamental difference between how Unix and Windows view open files:

On Windows, once the file is open, it is that _filename_ that is open; You can't rename or delete it; Therefore, if you want to replace a DLL (or any other file) that is in use, you have to kill any program that uses it before you can do that; And if it's a fundamental library everything uses (USER32.DLL COMCTL.DLL etc), the only effectively reliable way to do that is reboot.

On Unix, once you have a handle=descriptor of the file, the name is irrelevant; You can delete or rename the file, The descriptor still refers to the file that was opened. Thus, you can just replace any system file; Existing programs will keep using the old one until they close/restart, new programs will get the new file.

What this means is, that even though you don't NEED to restart anything for most upgrades in Unix/Linux, you're still running the old version until you restart the program that uses it. Most upgrade procedures will restart relevant daemons or user programs, or notify that you should, (e.g. Debian and Ubuntu do).

You always need a reboot to upgrade a kernel (kernel-splice and friends not withstanding), but otherwise it is enough in Unixes to restart the affected programs.

<comment><USER10> > On Windows, once the file is open, it is that filename that is open; You > can't rename or delete it;

This is wrong... there's no clear-cut thing like the "file name" or "file stream" that you can specify as "in-use". It depends on the specifics of how the file is opened; often you can rename but not delete files that are open. Some (but AFAIK not all) in-use DLLs are like this. They can be renamed but not deleted. And then there's FILE_SHARE_DELETE which allows deletion, but then the handle starts returning errors when the file is deleted (as opposed to keeping the file "alive").

To make it even more confusing, you can pretty much always even create hardlinks to files that are "in use", but once you do that the new name cannot be deleted unless the old name can also be deleted (i.e. they follow the same rules). This should also make it clear that it's not the "name" that's in use, but the "actual file" (whatever that means... on NTFS I'd suppose it corresponds to the "file record" in the MFT).

The rule that Windows always abides by is that _everything that takes up space on the disk must be reachable via some path_. So you can't delete in-use files entirely because then they would be allocated disk space but unreachable via any path.

> What this means is, that even though you don't NEED to restart anything for > most upgrades in Unix/Linux, you're still running the old version until you > restart the program that uses it.

What I expect it also means is that you'll get inconsistencies when doing inter-process communication, since they'll be using different libraries with potential mismatches. Is this correct? Because it seems to me that the Windows method might be less flexible but is likely to be more stable, since there's a single coherent global view of the file system at any given time.

<comment><USER11> Yes, in principle what you've said about the Unix approach here is correct, if you upgrade one half of a system and not the other half and now they're talking different protocols, that might not work.

But keep in mind that if your system can't cope with this what you've done there is engineer in unreliability, you've made a system that's deliberately not very robust, unless it's very, very tightly integrated (e.g. two sub- routines inside the same running program) the cost savings had better be _enormous_ or what you're doing is just amplifying a problem and giving it to somebody else, like "solving" a city's waste problem by just dumping all the raw sewage into a neighbouring city's rivers.

Now, the "you can't delete things because then the disk space is unreachable" argument makes plenty of sense for, say, FAT, a filesystem from the 1980s.

But (present year argument) this is 2018. Everybody's main file systems are journalled. Sure enough, both systems _can_ write a record to the journal which will cause the blocks to be freed on replay and then remove that journal entry if the blocks actually get freed up before then. The difference is that Windows doesn't bother doing this.

<comment><USER10> Aaaaaand here comes the Linux defending! OK...

> But keep in mind that if your system can't cope with this what you've done > there is engineer in unreliability

It's weird that you're blaming my operating system's problems on _me_. "My system" is something a ton of _other people_ wrote, and this is the case for pretty much every user of every OS. I'm not engineering anything into (or out of) my system so I don't get the "you've made a system that [basically, sucks]" comments.

> [other arguments]

I wasn't trying to go down this rabbit hole of Linux-bashing (I was just trying to present it as as objective of a flexibility-vs.-reliability trade- off as I could), but given the barrage of comments I've been receiving: I don't know about you, but it happens more often than I would like that I update Linux (Ubuntu) and, lo and behold, I can't really use any programs until I reboot. Sometimes the window rendering gets messed up, sometimes I get random error pop-ups, sometimes stuff just doesn't run. I don't get _why_ it happens in every instance, and there might be lots of different reasons in different instances. IPC mismatch is my best guess for a significant fraction of the incidents. All I know is it happens and it's less stable than what you (or I) would hope or expect. Yet from everyone's comments here I'm guessing I must be the only one who encounters this. Sad for me, but I'm happy for you guys I guess.

<comment><USER12> > ...but it happens more often than I would like that I update Linux (Ubuntu) > and, lo and behold, I can't really use any programs until I reboot...

Ubuntu developer here. This doesn't happen to me in practice. Most updates don't cause system instability. I rarely reboot.

Firefox is the most noticeable thing. After updating Firefox (usually it's a security update), Firefox often starts misbehaving until restarted. But I am very rarely forced to restart the login session or the entire system. I should, to get updates to actually take effect, but as a developer I'm usually aware of the specifics, so I can afford to be more selective than the average user.

Are you sure you aren't comparing apples to oranges here, and are actually complaining about the stability of updates while running the development release, which involves ABIs changing and so forth?

<comment><USER10> Development release? Currently I'm on 16.04, and I've never been on a development release of anything on Ubuntu. I'm just describing the behavior I usually see in practice (which it seems someone attributed to "D-BUS" [1]). Obviously the logon session doesn't get messed up if all I'm updating is something irrelevant like Firefox, but if I update stuff that would actually affect system components then there's a good chance I'll have to reboot after the update or I'll start seeing weird behavior. This has generally been my experience ever since... any Ubuntu version, really. It's almost ironic that the most robust thing to update in practice is the OS kernel.

[1] [https://news.ycombinator.com/item?id=16257060](https://news.ycombinator.com/item?id=16257060)

<comment><USER12> All I can say is that, based on everything I know, that's not the current experience of the majority of users, so it doesn't seem fair for you to generalize this to some architectural problem. I don't know if you unknowingly have some edge case setup or what.

<comment><USER10> Also, FYI, update: apparently I'm not the only person in the world experiencing this [1].

But we _are_ the only 2 people in the world experiencing this, so never mind.

[1] [https://news.ycombinator.com/item?id=16257935](https://news.ycombinator.com/item?id=16257935)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> In a related development, there are proposed patches to the Linux kernel (not yet merged) to blacklist the broken microcode updates: [https://www.spinics.net/lists/kernel/msg2707159.html](https://www.spinics.net/lists/kernel/msg2707159.html)

That patch disables the use by the kernel of the new IBPB/IBRS features provided by the updated microcode, when it's of a "known bad" revision. Since Linux prefers the "retpoline" mitigation instead of IBRS, and AFAIK so far the upstream kernel (and most of the backports to stable kernels) doesn't use IBPB yet, that might explain why Linux seems to have been less affected by the microcode update instabilities than Windows.

Also interesting: that patch has a link to an official Intel list of broken microcode versions.

<comment><USER14> > In a related development, there are proposed patches to the Linux kernel > (not yet merged) to blacklist the broken microcode updates

Linus probably won't pull it until it's truly known to be stable, because of his attitude towards having decent quality code and not causing needless system instability.

Without Linus... who knows what would have happened by now.

<comment><USER13> They are on the "tip" tree ([https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/...](https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git/log/?h=x86/pti)), so they'll probably be sent to Linus as soon as the merge window opens (Linux 4.15 has just been released, so the merge window should open soon). I expect these patches to be on 4.16, and also to be backported to the stable releases (4.15.x and others).

But yeah, upstream Linux kernel development is taking it slow. As far as I can see, variant 3 mitigations (PTI) are already in, variant 2 mitigations are partially in (retpoline) and partially not (the microcode dependent ones), and variant 1 mitigations are still under discussion.

<comment><USER15> "But yeah, upstream Linux kernel development is taking it slow."

Taking it slow seems very appropriate to me. This seems to me to have been a case of everybody grossly overestimating the short-term portion of the catastrophe, and underestimating the long term.

In the short term, the only people who were going to be plausibly affected in the next three to six months are people on shared hosting of some sort where you may share a server with somebody else's untrusted code, where an accelerated fix is in order, but also something that can be centrally handled. I'm not that worried in the next three to six months that my personal desktop is somehow going to be compromised by either Meltdown or Spectre, and personally, if I see a noticeable performance issue I may well revert the fixes (I'm on Linux), because first you have to penetrate my defenses to deliver anything anyhow, then you have to be in a situation where you're not going to just use a root exploit, which probably means you're in a sandbox or something which means it's that much more difficult to figure out how to exploit this. For most users, uses, and systems, spectre and meltdown aren't _that_ immediately pressing.

Meanwhile, in the long term this may require basically redesigning CPUs to a very significant degree; there is no software patch that can fix the underlying issues. It is difficult to overstate the long term impact of this class of bugs. IMHO the real problem from the jousting match with Linus and Intel last week isn't that Intel's patches today aren't quality code, but that it makes me concerned that they're just going to sweep this fundamental problem under the rug. As I said in another post on HN, I fully understand that remediating this is going to be years, and I don't expect Intel to have an answer overnight, or a full solution in their next "tock". But if they're not taking this seriously, we have a very large long-term problem. We're only going to see more leaks in the long term.

<comment><USER16> I read somewhere that people have developed POCs of these using JavaScript. At minimum, you'll want to keep your browser up to date as there are mitigations happening there too. Who knew that exposing high precision timers to untrusted JavaScript would be a bad idea?

Apart from browsers, it's fortunately pretty easy to avoid running code you don't trust on your devices.

<comment><USER15> What I've seen that the POCs can actually do is not worth running around with your hair on fire, from what I've seen.

Note I did not say there is _no_ reason to be concerned about Meltdown and Spectre... just that for most users, uses, and systems, it's not _that_ important. In the next three-to-six months, if you care about security at all, unless you are already running a tip-top tight operation, your money and effort is better spent defending against the many already-realistic threats, rather than worrying about the vector that may someday be converted into a realistic threat. Meltdown isn't what is going to drag your business to a halt next week; it's that ransomware that one of your less-savvy employees opened while mapped to the unbacked-up world-writable corporate share that has all the spreadsheets your business runs on. At the moment, the net risk of applying the Meltdown fix comfortably exceeds by several orders of magnitude the risk that Meltdown itself poses.

And my point is precisely that for most users and uses, that panic was not justified. Those for whom that is not true (VM hosting companies) already know they need to be more aggressive. There was no point in pushing out patches that nearly bricked some computers.

<comment><USER16> I agree with your points. In fact, I made the same argument about removing a Heartbleed/Spectre-related patch that caused issues for one of our applications - "the machine doesn't execute any untrusted code, so this patch isn't strictly necessary."

</comment></comment></comment></comment></comment></comment></comment><comment><USER17> >However, Intel does not appear too concerned that the incident will affect its bottom line - the company expects 2018 to be a record year in terms of revenue

There is an interesting paradox in our industry. If you pay enough attention (read: money) to security, you will be late to the market, your costs will be high and you lose profit. If you don't pay enough attention, you take the market, get your profits, but your product (be it hardware or software) and reputation will be screwed later. And worst of all: there's never enough attention to security.

So by simple logic, an optimal strategy is to forge your product quickly, take your profits within a [relatively] short period and vanish from the market. I guess we'll see this strategy executed from IoT vendors when market start to punish them for their bad sec.

For Intel, that "long period" just happened to be REALLY long.

<comment><USER18> Intel is TBTF. Like the banks but in via different mechanism, they appear to have reached consequence-immunity by becoming critical infrastructure.

<comment><USER19> The same could've been said about Microsoft 10-15 years ago. Now, we could probably get by without them.

Intel may be too big for an abrupt failure, but they can absolutely fail in a decade-long slide into obscurity.

</comment></comment></comment><comment><USER20> "Here's a patch" \- "Here's a patch to disable that other patch" \- ...

What's next? Repeat? Sounds like this could turn into a maintainance nightmare quickly. Also because I've introduced things like that myself in the past, and that was for normal applications and not a kernel or OS. Somewhere, someday, there's usually this one exception for which none of your rules hold true and the thing blows up in your face. Anyway, I'd love to see the actual code for this. Not a chance probably?

<comment><USER21> Im really wanding they had more than 6months to do these patches and they did not bother testing on a good number of systems. Its not like MS + Intel dont have enough money to buy a few 1000 testing machines and get some testers on it.

<comment><USER22> I came here to ask the same thing. How did these folks squander six months?

<comment><USER23> I think Spectre may have appeared later, after Meltdown? Remember the investigations into what's possible were proceeding in parallel with the attempted fixes.

Also, CPU design changes take a long time. 6 months may seem a long time from the perspective of HackerNews node.js type hackers, but it's a bit harder to patch decades worth of CPU microcode than a website.

<comment><USER21> Reading over googles project0 page it reads as if they told AMD about the issues on 2017-06-01 why would they do this if it were meltdown only?

also look at the exploit numbering:

Variant 1: bounds check bypass (CVE-2017-5753) Variant 2: branch target injection (CVE-2017-5715) Variant 3: rogue data cache load (CVE-2017-5754)

according to [https://cve.mitre.org/cve/identifiers/](https://cve.mitre.org/cve/identifiers/) this is sequence based so `Variant 2` was recorded to CVE before v1 and v3.

I get it may take a long time (that is fine even if the patches took a few more days), what I don't get is that they released it to production (server) envs seemingly without testing. Surely even rudimentary testing (deploying on a few 1000 different server platforms for a few hours at least should be something that Intel does for all microcode updates, after all they are rather more important than js Node packages as you point out)

<comment><USER23> I haven't heard of microcode updates that hurt stability before. Presumably the collapse of the embargo caused them to do an accelerated release, skipping their usual long testing cycle.

</comment></comment></comment></comment></comment></comment><comment><USER24> I'm amazed on how Intel's stock price still keeps going UP, despite all these problems... just WOW.

<comment><USER25> Do you know someone who is going to stop buying Intel's CPUs?

<comment><USER26> I know in my company this has indeed resulted in a full stop in buying Intel and going AMD instead. There is also an active "project" to replace the Intel servers.

I work in a bank and they are terrified of the possibility of user processes reading privileged memory. Not necessarily out of actual fear but out of the insane amount of paperwork this will require to satisfy the auditors that it is still safe.

Anecdotally, but you asked for "someone" and here is someone :)

<comment><USER27> Wasn't AMD also affected?

<comment><USER26> Not by Meltdown which enabled user processes to read kernel memory. And as we've seen in the aftermath, they have not nearly as much trouble with their patches for Spectre as Intel has had.

</comment></comment></comment></comment></comment><comment><USER28> So much for the embargo period. I guess the bsd people were not so wrong after all. They might as well just had published it as soon as it was found.

<comment><USER14> Intel has had literally months upon months to test and stabilize their microcode and kernel-side patches for Meltdown/Spectre... but it seems like Intel just doesn't give half a shit, if they're having major issues now.

Intel's actions seem to shout that they have cared far more about releasing Kaby/Skylake X and Coffee Lake in short order, as a response to Ryzen/ThreadRipper, than actually really digging into fixing their major security flaws. Their actions speak of them preferring to keep their market and mindshare over actually fixing any security issues.

Intel is still so deeply entrenched that they likely believe that they can get away with their lazy approach. They make millions upon millions, if not billions of dollars ~ why should they give a shit, when their monopoly and half-hearted attempt at a solution will get them by? Intel is being strangled by their shitty management, seemingly...

</comment></comment><comment><USER29> By my reading of the article, Microsoft is disabling some mitigations for Spectre due to instabilities that Intel's microcode update have been causing.

Intel certainly isn't making any friends these days...

<comment><USER21> I would love to see the message log between MS Apple and Intel on this.

</comment></comment><comment><USER30> It is not only Microsoft reverting this patch. HP, Dell or Red Hat are doing that as well.

[https://www.bleepingcomputer.com/news/microsoft/microsoft- is...](https://www.bleepingcomputer.com/news/microsoft/microsoft-issues- windows-out-of-band-update-that-disables-spectre-mitigations/)

</comment><comment><USER31> So what can I do for my next self-built pc? Get some AMD equipment, or is that not enough?

<comment><USER32> I'm eyeing Threadripper for my next build but beyond that I'm going to choose a motherboard vendor based on the level of support they offer in this scenario. Some observations that I'm making:

* How promptly did they address the issue via official channels, i.e. did they leave users in the dark as they appealed to vendors in their forums (hint: most of them seem to have gone down this route) or did they share updates directly on their official sites, social media accounts, etc.

* Did they provide some estimates as to when users could expect patches?

* How much of their product catalogue were they willing to cover with security updates? Since this is a unique security issue with high impact I would have expected them to cover motherboards at least 4-5 years old.

<comment><USER33> For those in the market for an X399/TR4 motherboard, have you come to any conclusions?

<comment><USER32> MSI seems [1] to be fairly proactive right now with patches going back to several X99 motherboards. Asus for example has so far only committed to provide updates for two X99 motherboards.

[1] [https://www.msi.com/news/detail/7yJ7XCklfBXt8mFhG8nkfSurJUz3...](https://www.msi.com/news/detail/7yJ7XCklfBXt8mFhG8nkfSurJUz3q1A6IXPT4QtmCFh1LubZaZoplvysc-5THpt0K3BM1MTYlMvOQ97-Snztbw~~)

</comment></comment></comment></comment><comment><USER34> I've not been impressed with my Windows 10 installations of late. All my machines that don't have the Long Term Servicing Branch have had wild instabilities and performance issues the past few months - crazy things, like the task manager taking minutes to launch, and the whole shell periodically crashing. The Fall Creators Update was so bad I had to wipe and start over on some boxes. It's not engendering a lot of confidence in their competence of late.

<comment><USER35> Creators Updates (1703 / 1709) are the culprits. LTSB (1607) has not been upgraded to Creators Update yet and it runs like butter.

</comment></comment><comment><USER36> Gee, if only they had a Linus Torvalds type around to block irresponsible commits.

<comment><USER37> They did, once upon a time, after a fashion:

[https://www.joelonsoftware.com/2006/06/16/my-first-billg- rev...](https://www.joelonsoftware.com/2006/06/16/my-first-billg-review/)

[https://www.wired.com/2002/01/bill-gates-trustworthy- computi...](https://www.wired.com/2002/01/bill-gates-trustworthy-computing/)

<comment><USER38> I had to read that billg-review thing one more time. It's such a wonderful story.

</comment></comment></comment><comment><USER39> I never got them. The last update in my windows is from Dec 2017. My antivirus is compliant, the registry key correctly set up and yet it refuses to update.

I still haven't had the time to debug it, but I wonder how many people are out there with their OS silently refusing to update.

<comment><USER40> I had huge problems with Win 10. Updates wold fail and install again and again without actually getting installed. Sometimes I would get an opaque error number but web searches revealed nothing for that number, and it was rare that I would be able to find even an error number. I don't do Windows, and just installed it for VR, and didn't spend that much time in Windows, so I would spend 15-30 minutes looking a month, before realizing I had spent more debugging time than VR time that week.

After probably 9 months of this, and with Windows doing ever more intrusive pop overs whenever I launched it for updates that don't take, I wiped all boot sectors everywhere and installed from scratch. That seemed to work, but it was incredibly frustrating that the boot process was so buggy as was error reporting. I've never encountered a situation like it in the past 15 years of heavy Linux use. Problems there are usually solvable with a couple web searches, even for extremely obscure kernel bugs with obscure packages. Windows refused to tell me anything as did the web.

<comment><USER41> I built a Windows machine for 3D work and VR just over a year ago, after being a Mac only user for 15+ years. Honestly my Win 10 experience has been the total opposite, it's been stable, fast, minimum update nagging. Overall I've actually been shocked how stable and hassle free the experience has been.

Maybe I just got lucky with the right combination of hardware.

</comment></comment></comment><comment><USER42> So , Linus was right for cursing at Intel ?

<comment><USER43> UTTER GARBAGE

<comment><USER44> Please don't do this here.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER43> Dont do what [https://hn.algolia.com/?query=UTTER%20GARBAGE&sort=byPopular...](https://hn.algolia.com/?query=UTTER%20GARBAGE&sort=byPopularity&prefix&page=0&dateRange=all&type=all)

?

</comment></comment></comment></comment><comment><USER45> My brother was hit by a recent update to Windows 7 that prevented the machine from booting. He went to Microcenter to buy a hard drive. There were a lot of people doing the same thing for the same reason when he was there.

<comment><USER46> I don't use the windows side of my machine very often, but decided to update it last night. Booted fine (OS on SSD), but one of the HDDs with all of the windows files was corrupted. No go with ntfsfix, chkdsk, partition table destroyed. Reformatted it as ext4 and windows doesn't get to touch it anymore. Haven't tested it too much yet but seems to be working fine.

Remember to use backups!

<comment><USER45> My brother did have major data loss. And no real backup strategy.

</comment></comment></comment><comment><USER47> Amount of fuck-up in this whole issue is mind blowing. I am getting more surprised with every new I get

<comment><USER48> Intel has been called out by Linus Torvalds several days ago for the crappy fixes they delivered for GNU/Linux. I would be very surprised if Intel actually shipped proper fixes for Windows. It's a shame, really.

<comment><USER49> Those were not delivered fixes, that was work in progress that is still work in progress. And the dude who was "called out" works for Amazon.

<comment><USER50> FYI - The "dude" from Amazon worked for Intel for 8 years before joining Amazon UK just over a year ago.

<comment><USER51> The "dude" is also probably working under an insane amount of pressure and being made to feel like he is somehow responsible or at fault for the whole situation. Best not to make it personal from the peanut gallery.

<comment><USER52> > Best not to make it personal from the peanut gallery.

That's a very uncharitable interpretation of your parent comment, which was simply pointing out his connection and history with Intel.

<comment><USER53> Are you sure it is not you that has made the uncharitable interpretation?

I read the peanut gallery comment as an agreement that the guy knows what he's talking about.

<comment><USER50> FWIW - I took it as a somewhat rude reply but hey it's the internet so no big deal.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER54> >Intel, AMD and Apple face class action lawsuits over the Spectre and Meltdown vulnerabilities.

I sure hope Intel will face a class action suit over this botched update. Many professionals have wasted countless hours dealing with this junk.

</comment><comment><USER55> Not what I wanted to wake up to this morning. I suspect we're in for a rough ride for a long time thanks to this mess.

<comment><USER56> Your comment is even more fitting today (politics)

</comment></comment><comment><USER57> Just checked for Updates, but there don't seem to be any?

<comment><USER58> Just in case you, like me, missed the memo where Microsoft said they'd stop supplying security updates if you have no AV / AV incompatible with the patches installed. The fix to the former is creating the registry entry manually.

[https://support.microsoft.com/en- us/help/4072699/january-3-2...](https://support.microsoft.com/en- us/help/4072699/january-3-2018-windows-security-updates-and-antivirus- software)

<comment><USER59> Bizarre.

 _Customers without Antivirus_

 _In cases where customers can't install or run antivirus software, Microsoft recommends manually setting the registry key as described below in order to receive the January 2018 security updates._

<comment><USER60> Sounds like Microsoft can't tell the difference between "has AV installed that will break" and "has no AV installed", which makes sense. It's probably infeasible to reliably fingerprint all existing AV software.

<comment><USER61> > Sounds like Microsoft can't tell the difference between "has AV installed > that will break" and "has no AV installed", which makes sense. It's probably > infeasible to reliably fingerprint all existing AV software.

For something like this, I think best-effort bad-AV detection would have been best. Seems pretty insane to disable security patching because they can't be 100% certain that you have a compatibly AV.

<comment><USER62> Incompatibility here means unbootable state.

<comment><USER61> But it also means that people with perfectly acceptable configurations are left in an _insecure_ state, without an unexpected magic incantation (a registry hack) that most probably will never know about.

Disabling security patches is not acceptable in current year without A LOT of nasty and annoying warnings.

</comment></comment></comment></comment></comment></comment></comment><comment> mm-vorticesoft Linus was right

<comment><USER63> I thought he was angry about the mitigation being disabled by default, not being unstable.

<comment><USER64> Nah, it was more than that: _The patches do things like add the garbage MSR writes to the kernel entry /exit points. That's insane. That says "we're trying to protect the kernel". We already have retpoline there, with less overhead._

<comment><USER65> That was about patches to the linux kernel, not the microcode patches.

<comment><USER64> Yes, but as far as I know Linus has made no comment on the microcode patches, so mm-vorticesoft is probably referring to the Spectre patches in general.

<comment><USER66> The microcode patches are binary blobs against a proprietary and secret ISA, how can anyone comment on their quality?

<comment><USER67> When I read it I believed that Linus was implying that the suggested mitigation was so insane that it seemed like Intel MIGHT be hiding how broken they believed their hardware was with such over-the-top reactions. As well as indirectly asking if they believed the currently accepted mitigation method (retpoline) was considered ineffective.

</comment></comment></comment></comment></comment></comment></comment><comment><USER68> I mean, is this an unmitigated disaster on Intel's part? It's like a train wreck in slow motion.

A part of me feels this stories like this are going to keep getting worse until Spectre is finally used in the wild.

</comment><comment><USER69> What a mess!

The day this blew up we rented our first physical server for the express purpose of running secure critical workloads in unpatched environments. Yes, I know that there is nothing secure, but not everything we do is running a chunk of logic uploaded by an attacker, so we will take our chances.

</comment><comment><USER70> What does the Spectre bug mean for a person planning to buy a new windows computer? Should I buy an AMD CPU based computer instead of an Intel based computer?

</comment><comment><USER71> I'm pretty sure these patches were responsible for my notebook crashing everytime i hooked it up to our Thunderbolt 3 Dockingstations.

</comment><comment><USER72> Anybody know what is the status of FreeBSD? I googled a bit and found nothing except "we wait", is it still the case?

</comment><comment><USER10> Anyone know if people who had disabled the mitigations via FeatureSettingsOverride = 3 were still affected?

</comment><comment><USER73> A more accurate title would be that Microsoft disabled the specter mitigation's due to a flawed Intel update, right? I thought this was all Microsoft's fault until getting half way through the article.

<comment><USER74> It's really telling that even Linus Torvalds was not happy with their "fixes" and now Microsoft. Intel needs to start taking the situation completely seriously cause their actions don't imply they are.

<comment><USER75> Intel doesn't care. What choice do we have?

<comment><USER74> Before Intel Core processors became the standard hot processor I was an AMD guy. I'm heading back towards that route. This means no Macbook or Surfacebook for my next development laptop for me. If anyone wants my money they better build a developer worthy laptop with an AMD processor and a sweet AMD graphics card. Also AMD is working on providing open source GPU Vulkan drivers.

<comment><USER76> This one [1] seems like a good choice in terms of performance, but certainly no MBP in terms of portability.

[1] - [https://www.asus.com/uk/Laptops/ROG-Strix- GL702ZC](https://www.asus.com/uk/Laptops/ROG-Strix-GL702ZC)

<comment><USER74> I already have an ASUS ROG laptop so this sounds like I'm sticking to them! Thank you, was hoping they'd add in AMD.

</comment></comment></comment></comment></comment></comment><comment><USER77> Ugh, is this the cause of the weird bugchecks I've been having this week? Just gave myself 64gb page file and enabled full memory dumps so I could track it down in WinDbg. I always forget something on fresh installs...

</comment><comment><USER78> Meanwhile Intel stock is at 5 year highest</comment>


Would Americans Accept Putting Health Care on a Budget? - <AUTHOR> https://www.nytimes.com/2018/04/16/upshot/would-americans-accept-putting-health-care-on-a-budget.html <comment><USER3> Yes, as it is, Americans see many of the factors in health care are acting as sole source monopolists - i.e. "we have the American public by the balls - <USER2> or die". We have seen a number of examples of this, with 15 cents worth of epinephrine being packs as emergency relief syringes (Epi-Pen)for bee/wasp sting reaction and other allergic peak reactions being sold for close to $1000. Similarly many HIV/AIDS drugs that cost pennies have similar high costs. What is needed is forced competition where several companies are allowed to produce these trademarked or patented drugs under forced licence at a reasonable margin to the rights holder. It is shocking to see the USA and Cuba at the same rank on the longevity lists. Remember, the rich live close to the Japanese, Italian and Swiss rankings. [https://en.wikipedia.org/wiki/List_of_countries_by_life_expe...](https://en.wikipedia.org/wiki/List_of_countries_by_life_expectancy#List_by_the_United_Nations,_for_2010%E2%80%932015)

and in the USA by race:- [https://www.kff.org/other/state-indicator/life- expectancy-by...](https://www.kff.org/other/state-indicator/life-expectancy- by- re/?currentTimeframe=0&sortModel=%7B%22colId%22:%22Location%22,%22sort%22:%22asc%22%7D)

There is no good reason why the African-Americans in the USA should not live as long as African-Americans in Cuba!!!

That is the price we all pay, and it is a huge price. Those in the uninsured/enmedicated tiers lose close to 5 years of their peak earnings - those earnings are lost to the economy as well.

You might say Medicare/Medicaid redresses this - but it does not reverse 65 years of lack of good medical care before the care gets worthy. Often by that time these older tier people are doomed to soon die and cost a lot more.

Assess the salaries of the presidents of Medical Insurers, Hospital Administrators. Also the salaries of doctors and drug company CEOs need to be looked at - they are all guilty of B.O.C. (Bribery of Congress) - sure by lobbyists, with lists of what they give, but what is not listed are the briefcases of $100 bills - it is true.

[https://www.fiercepharma.com/special- report/top-20-highest-p...](https://www.fiercepharma.com/special- report/top-20-highest-paid-biopharma-ceos)

[https://www.healthline.com/health-news/hospital-ceo-pay- rise...](https://www.healthline.com/health-news/hospital-ceo-pay-rises-while- americans-in-medical-debt)

[https://www.theatlantic.com/health/archive/2013/10/why- are-h...](https://www.theatlantic.com/health/archive/2013/10/why-are-hospital- ceos-paid-so-well/280604/)

[https://www.fiercehealthcare.com/payer/health-insurance- ceo-...](https://www.fiercehealthcare.com/payer/health-insurance-ceo-pay-tops- out-at-22m-2016)

All from Google.

Surely we need to get cost feedback into this by harsh budgeting. This is a do or die, either you do it or we all die sooner than we should...</comment>


Ask HN: What are your hobbies? What do you do when you are not programming? - <AUTHOR> <comment><USER2> From the money I saved from programming I have bought an old shop and turning it now into an art gallery and a party space.

In the last few months I learned lot about plaster boards, concrete, garbage disposal, construction law, etc.

Today at evening is the opening. My friend and colleague is a haykyo photographer. He is exhibiting his photos, 40 people will come.

<comment><USER3> Thats cool, where is your shop?

</comment></comment><comment><USER4> Quoting me, from five years ago (since I don't think I could say it any better today):

Rock Climbing, Surfing and Traveling (to do the first two) have always had a higher priority for me than programming computers, which would rank as my 4th hobby that also happens to pay my rent.

I think the fact that most people classify those activities as "hobbies" says a lot about the lives we construct for ourselves: Spend 50 weeks per year doing something unpleasant so that you free up a couple weeks to do something you actually enjoy. If you enjoy your hobby as much as you say, why not find a way to devote at least half your time to it?

</comment><comment><USER5> I foster kittens for the local SPCA until they're old enough to be adopted.

</comment><comment><USER6> I read a lot -- over 100 books in 2014. What can I say? Commuting by train gives me plenty of time... It's also time to think: I've planned and written two novellas, none published. I'm also a shitty writer. :) No full-length novels, yet, but someday... Working on two new ones now, hopefully one will turn into a real novel. We'll see.

In the last few years, I've taken up running and writing. I've run 10 half- marathons. My fiance is a triathlete, so I help her train for her Ironman competitions.

I go to Nerd Nite (sf.nerdnite.com or eastbay.nerdnite.com for you Bay Area readers). Last night's was awesome -- who knew baseball, salami, and dynamite were such interesting topics?

I cook as often as I can. I play guitar (very badly). I'm teaching myself piano (also very badly). I'm planning a wedding and house-hunting at the same time. It's so stressful, but the good kind.

My fiance and I like to hike and go to the SPCA and play with the dogs. We people-watch at the park when the weather is nice. We plan monthly board game nights with a close group of nerdy friends, and weekly happy hours (even though I don't drink) with our more socially-minded friends.

It sounds like I do a lot, but that's because most days, when that clock hits 5:00, 5:30, maybe 6:00, depending on how busy I am at work, I'm out. My philosophy is that work stays at work, and everything can wait until 8am tomorrow morning, except major emergencies, which happens maybe once a year. Work hard, play hard, do both separately. That's my philosophy.

</comment><comment><USER7> I turn a small profit by buying broken dirtbikes and fixing them to sell. Working on a machine with my hands and not a keyboard is therapeutic.

<comment><USER8> Where do you live? I'm in SoCal and it's hard to find a used bike that I can buy, fix, and sell for any profit. I love working on bikes to, I've been parting out my old dirt bike that the motor blew on and it was more profitable to part it out then it was to fix it and sell it as a running bike.

<comment><USER7> I guess that's one plus to living in AR. :)

</comment></comment></comment><comment><USER9> Vodka is my main hobby, but I also dabble in beer and various cheeses.

<comment><USER10> I also enjoy a good cheese, but living in Scotland I stick to Whisky when it comes to spirits.

But my main hobby is photographing cute people.

</comment></comment><comment><USER11> Music consisting of playing lead guitar in a band. Learning Voice, Drums and Piano as well. Have goal of performing live acoustically on guitar and vocals.

</comment><comment><USER12> I write fiction and make experimental music. (This bleeds into programming time, because I also make generative fiction and generative music).

<comment><USER13> I also write and make music, but not the generative kind. I'm interested in the generative fiction, what do you use and how does that work? What kind of stories come out of it?

</comment></comment><comment><USER14> I buy and sell stuff from craigs list to ebay when i am not programming, its so much fun to see people buy stuff for a higher price... also i use dealmoon.com to buy stuff for cheap and sell it for a higher price....

</comment><comment><USER15> I'm in the hospital taking care of patients. And I do design for fun.

</comment><comment><USER8> I ride dirt bikes and race motocross. I also have a KTM Super Duke that I ride and commute with. I'm trying to find a way to make a business that has to do with my hobbies but not actually open a shop. On top of that, I trade stocks, futures, and options but nothing big, a couple grand to play with.

</comment><comment><USER16> I am learning to cook. I also work on bicycles for myself, friends and family (I used to be a bicycle mechanic.)

</comment><comment><USER17> Lately I hike, play some video games, and I've been building bows.

Last summer I rode a motorcycle all the time--but I sold it this winter.

I also mix in pool and poker when I have time for it--I'm a high-level player of both, better than I am at programming (my day job)!

</comment><comment><USER18> I love collecting old video game systems and games trying commodore 64 software on a real commodore 64 Playing with my raspberry py and arduino and Basic stamp exercise. Reading about old technology old computers.

</comment><comment><USER19> I play piano and guitar. I've been trying learn how to paint recently.

</comment><comment><USER20> Brewing and consuming beer.

</comment><comment><USER21> I go mountaineering. It's very challenging and teaches you life skills outside of a computer.

</comment><comment><USER22> I'm playing deep, interesting video games.

Kerbal Space Program is one of my favourite.

Also I walk a lot in Paris and around.

</comment><comment><USER23> Spend time with my kids and wife.

</comment><comment><USER24> Reading, exercising and when weather allows, jumping out of perfectly good airplanes.</comment>


Twitter Is Considering a Deal to Buy SoundCloud - <AUTHOR> http://recode.net/2014/05/19/twitter-is-considering-a-deal-to-buy-soundcloud/ <comment> k-mcgrady As an avid SoundCloud user I hope this doesn't happen. Twitter's past attempts at music have been terrible and I don't see why SoundCloud needs someone to acquire it. They're pretty much the default place for musicians (pro and amateur) to host their music and they have a decent way to monetise users.

<comment><USER2> I agree. Being acquired by Twitter just makes it more likely that SoundCloud will fail, to me - have Twitter actually come up with a decent monetisation strategy yet?

<comment><USER3> Well Twitter made about $665 million last year, with much larger projections for this year. I would say that qualifies as "decent".

<comment><USER4> Twitter lost $645 million in 2013. I'm not sure "spend $2 to make $1" necessarily qualifies as "decent".

<comment><USER3> They didn't lose $645 million in spending, it was a one time recognition of the stock they already allocated.

<comment><USER4> They've still yet to make a profit.

</comment></comment></comment></comment></comment></comment><comment><USER5> Strange. Twitter bought We Are Hunted and turned it into twitter #music and killed that off a couple of months ago.

Now they're thinking about soundcloud? I can't see how it ends well for anyone.

<comment><USER3> They also got rid of the person leading that deal and the Twitter Music app that they shut down. They appear to be taking a new approach that goes beyond what is trending.

</comment></comment><comment><USER6> I like this acquisition compared to alternatives. Google would Google-plus-ify it which would be bad. Facebook would absorb it into the newsfeed and fan pages. Apple would make it even more of a walled garden and part of iTunes.

Twitter's ideal tweeter (in my mind) is someone who publishes things regularly (authors, journalists, artists) and so I think SoundCloud will fit right in. I think it's a lot smarter entry into music for Twitter than say Last.fm or Pandora, because Twitter is gaining access directly to musicians as users.

<comment> k-mcgrady >> "I like this acquisition compared to alternatives. Google would Google- plus-ify it which would be bad. Facebook would absorb it into the newsfeed and fan pages. Apple would make it even more of a walled garden and part of iTunes."

How about they other alternative - not getting acquired? They're one of the few big websites with a decent monetisation strategy other than 'collect personal data and put ads on it'.

</comment></comment><comment><USER7> I'm on my second year with a paid pro unlimited account and would probably reconsider renewing it if they were bought by Twitter. SoundCloud is already moving into a direction that I don't particularly like and this might be the last straw.

<comment><USER8> "SoundCloud is already moving into a direction that I don't particularly like"

What direction is that that you are referring to?

<comment><USER9> The direction where more people start using it.

</comment></comment></comment><comment><USER10> Twitter, Soundcloud and Instagram are about the only networks I actually enjoy using. (YouTube is used out of necessity and FB is well...FB).

I'd like to see twitter pick them up just so Google / FB doesn't do it.

</comment><comment><USER11> Some interesting possibilities - but my first reaction was to vomit. (I use sc to push out my tracks.)

Carefully following and unfollowing sc users makes sense; and music and the sc stream to me is much more fun than the twitter one. I don't like getting all the sc reposts (I'd like that filtered out, whilst providing artists with a way to push out messages (which can be filtered out too))... anyway, the best thing for sc to do is have some sort of bitcoin integration.. tracking plays and allowing tip distributions from a listener's wallet to a producer's (and sc can take a commission and provide stats, and also give artists insight into their most valuable fans.) That'd actually be good for music (but twitter won't have any such vision.) After that, sc should do something with video or tickets. If anyone should buy sc, it should be yt - the other big music discovery platform.

If I were sc, I'd tell twitter to go shove it -- unless there are financial imperatives that make that unfeasible.

</comment><comment><USER12> As long as it's not Yahoo buying them, I'm ok with this. Getting bought by Yahoo seems to be the kiss of death, and by death I mean a long slide into irrelevance.

<comment><USER13> Tumblr seems to be doing well. Their recent mobile app update brings some interestingness to the mobile blogging experience.

<comment><USER14> Thanks :)

<comment><USER15> For what? :)

<comment><USER16> User irace is an engineer at tumblr, apparently.

</comment></comment></comment></comment></comment><comment><USER17> A successful deep integration between these two services would be block buster. If they pull it off, it would be an absolutely amazing pairing.

</comment><comment><USER18> SoundCloud is way too big and embedded across the net for Twitter to shut them down (as some people seem to fear in the comments). This would not go down the way of Posterous or We Are Hunted, the former of which was already not going to continue because they had essentially lost to tumblr and the latter of which was more of an experiment.

<comment><USER19> imeem was pretty big and embedded when it was shut down unceremoniously by myspace. So that is no protection. I don't think Twitter is likely to do that though.

</comment></comment><comment><USER20> I think at this point, in the age of WhatsApp, Instagram, and Tumblr acquisitions, it would be disastrous if Twitter's strategy is anything but let soundcloud continue as a separate entity. The more you leave big and established platforms well enough alone, the better.

<comment><USER21> Heh, it seems like $1B is the required valuation to get to stay independent. Definitely agree though, you don't acquihire at that price so don't screw up a working formula. Interesting that 2/3 of your examples are Facebook acquisitions too, they seem to be handling big acquisitions really well.

<comment><USER20> True, let's add Nest and Waze to the mix!

</comment></comment></comment><comment><USER22> I haven't seen the Google/YouTube comparison on here yet. SoundCloud seems like the default place for audio uploads, similar (but not perfectly analogous) to YouTube for video circa 2006. Youtube has maintained a huge amount of independence from Google, to the point where the Twitch rumors from last week were all titled as, "YouTube to buy Twitch," or something close to that[1]. A similar partnership between Twitter/SoundCloud could work well.

[1] [http://www.gamespot.com/articles/youtube-to-buy-twitch- for-1...](http://www.gamespot.com/articles/youtube-to-buy-twitch- for-1-billion-report/1100-6419720/)

</comment><comment><USER23> This will be interesting if it happens. The big issue with SoundCloud is that, so long as they have been a gutsy startup acting as a promotional platform for music, rights-holders have stood back and let them exist. I would imagine that an acquisition by a company like Twitter would bring down all sorts of legal complexity - as with YouTube's acquisition by Google. If rights holders pushed for a backdated payment against copyright music on SoundCloud it could be hugely expensive, unless they've quietly managed to put something in place to get around this.

</comment><comment><USER24> So they can shut it down like Posterous? F*ck that...

<comment><USER10> Seriously - posterous was awesome.

</comment></comment><comment><USER25> Twitter itself was a a spin-off from Odeo ([http://techcrunch.com/2006/07/15/is-twttr- interesting/](http://techcrunch.com/2006/07/15/is-twttr-interesting/)) which was a podcasting/audio sharing service.

</comment><comment><USER26> Oh no. Poor SoundCloud.

</comment><comment><USER27> I wonder if this leak is aimed at putting pressure on Twitter to buy.

</comment><comment><USER28> No! Please don't.

</comment><comment><USER29> I hope they buy it and write a better UI for it. I love the idea but the UI is a big drawback of using it.</comment>


Ask HN: Why is it that so many people fail fizzbuzz? - <AUTHOR>

<comment><USER2> I am a awful interviewee. Absolutely awful.

I routinely bomb the simplest interview quizzes. Usually the early "weed-out" ones like FizzBuzz. I do fine on the much more advanced questions.

I think part of what makes them more difficult for me is that they _feel_ like a test. The more advanced questions, they feel like engineering problems in need of a solution. But when someone pops up with an out-of-nowhere "do this purpose-less thing!" question, I spend all of my time wondering about what they're actually looking for, and none thinking about the problem at hand. _Is this a trick? Am I missing something? What does he want from me!?_

I also just can't code worth a damn when someone is staring at me. I love interviewers who pose a long, complicated question and then leave the room for 30 minutes so I can work on it. These are always _much_ more difficult problems, and I find them infinitely easier than the little 2-minute quizzes.

</comment><comment><USER3> It's what I call "screening" failure. The wrong person was brought into the interview for the wrong position. When somebody fails fizzbuzz, this is 100% the fault of the hiring company/recruiter. Fizzbuzz is not a test, it's a "Lets get comfortable before the interview starts in earnest" type question. If you are a proficient developer, and you aren't able to nail that in your sleep, then somebody made a huge mistake bringing you in for an interview.

Our company has recently started doing (developer) screening by doing online real time coding, where the candidate get the opportunity to solve some real- time problems in their vertical, with whatever tools/compilers they are comfortable with (Java/Python/C/C++ and MAC Layer, PHY Layer, SQL, UI Frameworks, etc..) before they are brought in for an interview.

Nobody fails fizzbuzz in our interviews, and it means nobody is wasting interviewing time doing screening anymore.

</comment><comment><USER4> I wonder if its because the modulus operator (the obvious way to solve it) isn't something you use all the time for basic CRUD applications?

As an example i'm working on a largish codebase (100,000 lines) right now now and a quick grep shows only 4 uses of it, all of which are in a jQuery plugin.

<comment><USER5> My new interview-screening question will be "solve fizzbuzz without using division or modulus". Because it's still so easy that you don't want to hire anyone who can't do it.

<comment><USER6> Simple Perl Code

      my $i;
      my $fizz = 3;
      my $buzz = 5;
      for ($i = 1; $i <= 100; $i++) {
        if ($i ne $fizz && $i ne $buzz) {
          print "$i\n";
          next;
        }
        if ($i eq $fizz) {
          print "fizz";
          $fizz += 3;
        }
        if ($i eq $buzz) {
          print "buzz";
          $buzz += 5;
        }
        print "\n";
      }

Edit for formatting

<comment><USER7> or in stupidly terse Ruby... f,b=3,5;(1..100).each{|i|s='';(s,f='Fizz',3)if(f-=1)==0;(s,b=s+'Buzz',5)if(b-=1)==0;puts(s==''?i:s)}

</comment></comment></comment></comment><comment><USER8> My postulate is that there are some people who have really really really good soft skills, and they get through the interview by wit and charm alone. The interviewer decides to hire the person before it gets the the fizzbuzz part. Those people get by on the job by taking a really long time to get things done, but have great excuse masking skills, so they keep their job. This is all based on my experiences working with people who couldn't do fizzbuzz. The one things that they all had in common, was that they all had really great people skills.

Note: Thats not to say that that _all_ people with people skills can't do fizzbuzz, just the people with an abundance of it. Why waste time getting good at a hard skill, if you can get by perfectly fine with your great soft skills?

</comment><comment><USER9> It's a failure to understand skill. People who have not done something don't understand that skill matters. Look at any skilled trade. Everyone thinks they can cook as well as a head chef with just a few months practice and a cookbook, but the head chef will beat them because those years matter. Even when thing seem equal, skill still matters. If you give two top experts the same task, one may have specialized skill in the task. This specialized skill not only let's on expert complete the task, it may totally prevent the other expert from completing the task altogether. To they lay person, the reaction is "I don't understand. they are both experts.". Skill matters more than people understand.

</comment><comment><USER10> I had to lookup fizzbuzz as I wasn't familiar with it. I haven't interviewed in 10 years. At first I thought there must be a trick, it's too simple. Way simpler than the tests I've given interviewing (reversing a string). But it is as simple as it sounds.

It's a shame people can't get it. But modulus is an operation I do daily.

</comment><comment><USER11> My question is, what do these people think they are going to do when they get the job? Or do they actually think they can program, and then realize that they can't?

<comment><USER12> I've worked with people who could program in the sense that they knew their language API and knew how to string libraries together in an obvious manner in a way that made the program at least compile. However they where completely lost when they actually had to come up with their own solution to something. If asked to solve FizzBuzz their first step would be to check if the standard library came with a FizzBuzz function, then they'd look around for a third party FizzBuzz library, then they'd use Google to try to find some code on a forum they can blindly copy and paste, and if all that fails they'll make up some excuse as to why they can't work on FizzBuzz right now and hand it off to someone else.

The thing is you can get quite far in programming using that approach.

</comment></comment><comment><USER13> wait, is fizzbuzz really that wide spread as testing technique ?</comment>


Why the Chrome Web Store Sucks - <AUTHOR> http://www.firertc.com/blog/why-the-chrome-web-store-sucks

<comment><USER2> Well said! I have a few apps on the store and completely agree. It's 2015! Why can't the platform email/notify me the moment a user leaves a feedback? I have to constantly login to the developer panel and check each app.

The stats don't make any sense and there's been a constant complaint in the forums about the difference between impressions and installations (don't forget if a user signs into multiple chrome devices/browsers those all count as separate installations).

In short, I agree with everything you've said. It's not enough just to have a place to list your app, having good store tools and user communication tools goes a long way to delivering a good product.

</comment><comment><USER3> I don't think the Chrome web store is something Google is actively moderating and developing.

We added a B2B app on there a few years ago. Generated _lots_ of traffic, most of it crap. About a year or so ago the traffic started to die off.

My guess (although this is completely unsubstantiated) is that Google realised their Chrome Web Store was another free channel app developers could use to promote their products. There's little upside for Google, and they would much rather the developers use paid (Adwords!) channels instead. Just a theory...I could be way off the mark.

</comment><comment><USER4> I agree it is terrible. And I have to manually check the Chrome Web Stores developer panel to actually find out if anyone has left any user feedback which is annoying because if someone uses that to report an issue I won't know about it right away and will look bad as I am not replying fast.

<comment><USER5> 100% this. We sometimes have feedback in there for a week plus. Talk about setting you for failure!

<comment><USER4> Yep I had multiple bits of feedback for my extension that were from a few weeks ago stating the extension was no longer working and that was also causing people to write poor reviews for it as it was not working. It was a simple one line code fix, however it stayed unresolved for almost a month because I had no way of knowing feedback was given unless I manually checked the dashboard.</comment></comment></comment>


Ask HN: Is Meteor.js dead? - <AUTHOR> What is the current state of Meteor in 2018? Is there a framework that most ex-Meteor users are moving to? <comment><USER2> I use meteor.js for all my prototyping and I have it running [https://www.spoiled.tv](https://www.spoiled.tv) (in production; with a React front-end and SSR). I'm not sure why you think it's dead, 1.6.2 has 200 commits waiting to be merged[1] with lively discussion.

[1] [https://github.com/meteor/meteor/pull/9559](https://github.com/meteor/meteor/pull/9559)

</comment><comment><USER3> We're building VulcanJS ([http://vulcanjs.org](http://vulcanjs.org)) on top of Meteor. I wouldn't say it's dead, just that it's evolving into more of an all- in-one development environment (think Next.js or create-react-app, but more powerful) as opposed to a full-fledged full-stack framework (say that 5 times really fast) like it was originally designed to be.

</comment><comment><USER4> meteor-is-not-dead

[https://forums.meteor.com/t/meteor-is-not-dead-in-fact- its-q...](https://forums.meteor.com/t/meteor-is-not-dead-in-fact-its-quite- all-right/42762)</comment>


Homeownership and Wealth Creation - <AUTHOR> http://www.nytimes.com/2014/11/30/opinion/sunday/homeownership-and-wealth-creation.html?smid=fb-nytimes&smtyp=cur&bicmp=AD&bicmlukp=WT.mc_id&bicmst=1409232722000&bicmet=141977352200&_r=0 <comment><USER2> The article makes some very odd conclusions. Of course the wealth of homeowners will generally be higher than renters. The only plausible conclusion to draw from that is people in most of the U.S. Will buy a house once they can afford it (and sometimes when they can't).

The majority of people renting do so because they don't qualify for a loan (or as the article suggests) can't save money for a down payment. They don't own a home because they're less wealthy. They're not more wealthy because they didn't decide to purchase a home.

The article just read like a fluff piece. I think that a home as a mechanism for "forced" savings does make a lot of sense. But it's by no means a first resort. I think people are better off looking at purchasing a home as they do other large ticket items and not as an investment.

</comment><comment><USER3> So close, but so trapped in the "American Dream" delusion.

> It is also difficult to systematically invest each month in stocks, bonds or > other assets without being compelled to do so.

> The analysis does not downplay the risks of homeownership or the devastation > of the housing bust. But the lesson of that debacle is not for individuals > to avoid homeownership or for policy makers to devalue its importance. > Rather, the lesson should be to foster conditions under which middle- and > lower-income Americans can sustain homeownership and avoid the ruin of > foreclosure.

The lesson, for anyone not spellbound by the real estate industry, is: USA needs to make "systematically investing each month in stocks, bonds or other assets" as socially encouraged and as easy as paying a mortgage.</comment>


American death rate from substance abuse and mental disorders triples since 1980 - <AUTHOR> http://sciencebulletin.org/archives/8077.html <comment><USER2> There's a really interesting result buried in this.

"about half of US counties saw increases in suicide and violence"

The separation of perceived and actual violent crime rates is a pretty infamous thing. Violent crime has been declining for decades, but at least since ~2000 perceived rates have failed to track that result. People toss around lots of theories, from "the media scares us" to "bigots are scared" to "perception can only go so low".

This implies that we might be missing a better answer: people give national answers using local assumptions. If your county and all of the ones nearby have steadily rising rates of assault and homicide, it looks an awful lot like violence is on the rise (and for you, it is). This is especially true since you'll hear about every murder in your town, but only a few from NYC regardless of how many happen there (or don't happen).

So violent crime rates have dropped steadily, largely because they're power- law effects and the deadliest regions have gotten much safer. But there are a lot of people looking around at rising violence where they and their families live, and that's getting buried by the data from a handful of cities.

<comment> at-fates-hands >> the deadliest regions have gotten much safer.

Not so sure I agree with that.

\- St. Louis, MO

\- Detroit, MI

\- New Orleans, LA

\- Baltimore, MD

\- Chicago, IL

All have had incredibly high murder rates since 2002. That's over a decade of violent crime that hasn't slowed down at all and continues to remain steady to this day.

<comment><USER3> I'm from St. Louis, so I happen to be familiar with those numbers.

Here are the homicide rates in St. Louis in the early 90s (per 100k people):

        1991	65.0
        1992	57.4
        1993	69.0
        1994	63.5
        1995	54.9

And here's 2002-2014:

        2002	31.4
        2003	21.8
        2004	33.7
        2005	37.9
        2006	37.2
        2007	39.6
        2008	46.9
        2009	40.3
        2010	45.1
        2011	35.3
        2012	35.5
        2014	49.9

Homicides here started falling in the late 1990s and remained (relatively) low throughout the 2000s. The rate did jump in 2014 and has remained higher since, but it's still lower than it was in the early 90s.

Which, I think, is to say that your narrative isn't correct, at least regarding St. Louis. It's much messier than that (and mostly good news (relatively)).

<comment><USER4> Wow. In the mean time, Toronto has a homicide rate of around 2.0 (in 2012 [1]), making it almost 18x lower than St. Louis.

Genuine question, why do you continue to live there? Why wouldn't you move somewhere safer?

[1] [https://en.wikipedia.org/wiki/Crime_in_Toronto](https://en.wikipedia.org/wiki/Crime_in_Toronto)

<comment><USER3> There are (at least) three things to understand about those numbers:

1\. The City of St. Louis occupies a very small portion of what any reasonable person would call "St. Louis." And those numbers include only the City portion. The rest of the area is _much_ safer. St. Louis County, which surrounds St. Louis on three sides and contains three times as many people (over 1 million), had 15 homicides in 2014 for a homicide rate of 1.5 (lower than Toronto) [0]. _Most_ people living in the St. Louis area are living in very safe places.

2\. Not all cities occupy such a small portion of their region. Toronto, to keep your example, is 243.33 sq mi. St. Louis is 66 sq mi. If St. Louis's borders were extended to match Toronto's reach, then it would include a whole bunch of the safe areas in St. Louis County, which would considerably soften the numbers. (Note that nothing on the ground would actually _change_.) This is why reasonable regional comparisons should be done at the level of the MSA. Arbitrary borders are, well, arbitrary and produce misleading comparisons.

3\. Even when looking only at the City of St. Louis, you have to understand that many neighborhoods have 1 or 2 or 0 homicides each year. [1] Most of the violence is concentrated on the city's Northside and in the Southeast. Extreme violence is not a part of the everyday lived experience for most citizens.

The way outsiders talk about crime in places like St. Louis _very sloppy_.

(Bonus #4: Crime and safety and law and order aren't the only metric by which to choose where to live.)

[0] This number is almost certainly too low, because of how crime is reported in the County. I got that number here:

[http://www.kmov.com/story/29948033/homicides-on-the-rise- in-...](http://www.kmov.com/story/29948033/homicides-on-the-rise-in-st-louis- county)

Some other sources suggest it may be around twice that for the entire County, meaning the rate is likely closer to 3.0 per 100,000 (which is still considerably lower than in the City).

[1] [https://nextstl.com/2013/01/understanding-st-louis- homicides...](https://nextstl.com/2013/01/understanding-st-louis- homicides-2005-2012/)

<comment><USER2> This is a very good list, and I'd like to expand on point four: even among city-life-specific dangers, murder generally ranks fairly low.

Where I live, the annual pedestrian and bicyclist death count is is comparable to the St. Louis murder rate. And, of course, far more evenly distributed across neighborhoods. Add in car crashes and I'm probably at far more risk here than I would be in St. Louis.

I'm at more risk from smog and water pollution just by living in a city, and to fight that I should move not to Toronto but to a ritzy suburb. But dense populations mean good emergency response times, which argues for city again!

The list continues - you're absolutely right that safety isn't the only goal, but even on that basis it's not clear that murder is the statistic to observe.

</comment></comment></comment></comment></comment></comment><comment><USER5> It seems that they are unable or unwilling to separate deaths due to mental disorders from substance abuse. Probably due to the thinking that anyone who dies from a substance abuse issue is dealing with a mental disorder. While this may be true some of the time, I'm not sure that it's clear that it is always the case. And even if it was, substance abuse deaths would just be a subset of deaths from mental disorders, still would seem misleading to lump them together.

<comment><USER6> That's a valid point, but the number tripled. Is that really down to statistical methods, or is there actually a huge problem which, admittedly, may not be measured perfectly?

<comment><USER5> How much wider of a net are we casting when we consider what counts as a "death due to mental illness or substance abuse" compared to 25 years ago?

I don't doubt it may have gone up, but I do doubt that these numbers tell us as much as some might think.

</comment></comment></comment><comment><USER7> Nobody seems to address the elephant in the room which is that the death rate from substance abuse and mental disorders was possibly underreported in the past

<comment><USER8> Kinda like how cancer wasn't that big of an issue until we began looking for it.

</comment></comment><comment><USER9> Not mentioned in the article, but I suspect some of this is due to the closing of most state run mental hospitals, which ramped up starting in 1972.

[https://en.wikipedia.org/wiki/Deinstitutionalisation](https://en.wikipedia.org/wiki/Deinstitutionalisation)

Edit: More in-depth article on the topic: [http://www.pbs.org/wgbh/pages/frontline/shows/asylums/specia...](http://www.pbs.org/wgbh/pages/frontline/shows/asylums/special/excerpt.html)

<comment><USER10> probably, but keep in mind that those places are extraordinarily expensive to run. even though we are seeing massive increases in deaths as a result of their closure, it may still have been the right decision. there's a value to everything, including life.

<comment><USER11> It's easy to put a value on someone else's life. How much should we spend on your life before it's ok to consign you to death?

<comment><USER12> The flipside of course, is how much extra are you willing to spend to save every preventable death?

How much are you you willing spend on someone else's life before it's ok for you to consign their death?

</comment></comment></comment></comment><comment><USER13> Here's the interactive version: [http://vizhub.healthdata.org/subnational/usa](http://vizhub.healthdata.org/subnational/usa)

<comment><USER14> Is there any obvious reason for the higher death rate in the "bible belt"?

One thing I could imagine is rural exodus, leaving a higher percentage of old people.

<comment><USER15> Poverty combined with boredom. And from my _personal_ experience, a complete unwillingness to discuss such problems (i.e, "Not _my_ family").

</comment></comment></comment><comment><USER10> Is it reasonable to assume that substance abuse deaths are far greater than mental health disorder deaths?

As for the increase: no shit. Alcohol, one of the most damaging drugs, plays a central role in our contemporary marketing economy that can scientifically manipulate into engaging with alcohol on a massive scale. On the pharma side, we shove extraordinarily dangerous drugs like Oxy, Klonopin, SSRIs and Adderall on under the guise of them being medication. Thanks to the industry surrounding all these things, people don't even know they are engaging in dangerous, life-threatening drugs until it's too late.

<comment><USER5> > Is it reasonable to assume that substance abuse deaths are far greater than > mental health disorder deaths?

I wouldn't assume that, especially not based on this article.

It all depends on how you count up the deaths anyway. For example, considering substance abuse, what counts? Do we only take overdoses? What about accidental poisonings? What if I just smoke cigarettes until I am 85 and then die of heart disease that I was genetically predisposed to anyway? What about eating fatty foods to obesity and then dying from a heart attack?

</comment></comment><comment><USER16> I don't know how US death certificates and coroners work.

But things like death by suicide have tricky stats. In the US a death after self injury with the intent to die is counted as suicide. That intent to die bit is hard to know, so some deaths are going to be counted as something else. (Accidental death, maybe.) And because of the strong stigma and taboo around suicide historical data may undercount it.

Also, in the UK, for a coroner to rule a death as suicide it has to meet a higher burden of proof. The coroner has to be satisfied beyond all reasonable doubt that the death was suicide. For other deaths (but not murder) the burden of proof is the balance of probabilities.

So it's easier (in England) for a coroner to rule something is an accidental death than a death by suicide.

I guess the researchers are aware of all of this, and that they'll have mentioned how the cleaned up the data.

But it's something to be aware of when reading it.

</comment><comment><USER17> By my count around a third of Americans die from drug misuse and drug-related causes:

[http://alexkrupp.typepad.com/sensemaking/2014/05/the-one- sta...](http://alexkrupp.typepad.com/sensemaking/2014/05/the-one-statistic- you-never-hear-about-drugs.html)

And that was written before this study came out, which estimated that there may be an additional 60,000 annual tobacco-related deaths that are not being counted by the CDC:

[http://www.nejm.org/doi/full/10.1056/nejmsa1407211](http://www.nejm.org/doi/full/10.1056/nejmsa1407211)

<comment><USER18> I think given the way people reason about such things you should probably advertise it as 20% of Americans die from tobacco use and then argue that this should be considered together with other drug related causes.

I'm not arguing that tobacco is anything other than a drug, I'm saying that emphasizing it in things like your first paragraph here will reduce the number of people that come to the wrong conclusion.

</comment></comment><comment><USER19> Take a look at what Reagan did to national mental health services in the 80s. Pretty hard not to draw some correlation there.

<comment><USER20> That was part of the problem. The other part is that _" One Who Flew Over the Cuckoo's Nest"_ inspired the left to change laws so that it became hard for Psychs to institutionalize people who need help.

Both parts need to change. The "they aren't hurting anybody so leave them alone" people need to understand that they are hurting themselves and need to have their freedom of choice taken away. There needs to be strong oversight to prevent abuse. There needs to be sufficient funding to humanely take care of the mentally ill and, when possible, make them better. Addiction needs to be treated as a mental illness since, once the individual becomes addicted, it literally is a chemical abnormality in the physical brain mostly beyond the ability of the individual to address without medical help.

<comment><USER21> _it became hard for Psychs to institutionalize people who need help._

The prospect of a society in which any psychologist can, on a whim, circumvent due process and imprison anyone against their will indefinitely, is terrifying.

It's much, much better this way.

<comment><USER16> >> it became hard for Psychs to institutionalize people who need help.

> The prospect of a society in which any psychologist can,

You've mixed up psychologist and psychiatrist.

It's easy to find ways that psychiatrists can detain people against their will, and force them to undergo medical treatment against their will, that don't rely on a single doctor and that have strong protections against abuse.

Something like two doctors - one of which knows the patient, plus an approved MH professional who's role is to protect the legal rights of the patient, plus free advocacy during all stages of detention to protect the legal rights, with powers of a close relative to ask for the detained person to be released; with a default position that people have capacity to make decisions about themselves, and that any limitations of capacity are limited to a single domain (I might not be able to say what happens to my money, but you should not use that to assume my capacity chose my medication is limited); with a recognition from all involved that this is a significant interference with my human rights and that we only tolerate this because it's in my best interests.

<comment><USER22> Same problem with psychiatrists. The psychiatrists associated with large-scale direct intake at hospitals are also extremely overworked and often not particularly sophisticated (psychiatrists who keep up with research and are effective practitioners can make more money outside the hospital system).

In the very worst case, which is unfortunately common, you have chains like UHS operating mental health hospitals in numerous states with what appear to be quotas. You don't have to drive yourself to a UHS hospital to end up in one. Most hospitals, even the very good ones, don't do on-site psych; in many of them, if you show up for _any_ psych reason, you'll be held and then transported to an affiliated mental health hospital.

So, yes, there are very significant due process concerns with acute mental health care.

</comment></comment></comment></comment></comment><comment><USER23> Whenever I see a headline like this, I think "did reality change, or did the reporting methods?"

<comment><USER10> also worth thinking: did X become a bigger killer, or did we impede all the other killers so much that X is now coming into fruition more often.

</comment></comment><comment><USER24> My pet theory is that we are isolated and there are less ways to feel connected to society (suburbs, too much TV) and the over importance of image, wealth, and status. Too many McJobs and lonely suburbs and people start to get depressed and other forms of mental illness. Naturally these people self medicate when their needs are not met anywhere else.

Corporations used to feel more obligated to the society that they were in. Churches used to be more popular. Even if the Catholic church did evil things and controlled people, it did/does provide a place for people to feel like they belonged somewhere.

</comment><comment><USER25> It would be interesting to see how these morbidity rates correlated with losses in wages and job security, since that magical year 1980. Particularly among middle-aged white males -- which are a pretty large group; and for whom stark rises in suicide rates have been observed by others, e.g.:

[http://www.nytimes.com/2015/11/03/insider/more-white-men- die...](http://www.nytimes.com/2015/11/03/insider/more-white-men-die-from- suicide-and-substance-abuse-why.html)

</comment><comment><USER26> Whoah the quantity of subscribe popups, notifications and ads plastered all over the page is a huge turnoff. All this JS interaction seems to have somehow broke the animated gif as well.

Protip for publishers: one prominent entry point into "subscribing" with multiple choices is sufficient. I get that you want me to subscribe, but if I don't want to you're surely getting negative returns by creating such an obnoxious UX.

<comment><USER27> It's ironic that with all that JS, they couldn't be bothered to come up with something better than a gif to display the actual content.

</comment></comment><comment><USER28> I do wonder if they accounted for statistical bias.

Death rate is 3x larger, but US population was ~60% of what is was now. That alone means that the death rate is actually only _1.8x times bigger_.

Additionally, it's been shown that doctors have been bribed and has caused vast over-diagnosis.

Why was this clickbait, masquerading as a study, linked on HN?

</comment><comment><USER29> Regarding Kentucky cancer stats: [https://en.wikipedia.org/wiki/Paducah_Gaseous_Diffusion_Plan...](https://en.wikipedia.org/wiki/Paducah_Gaseous_Diffusion_Plant#Contamination)

</comment><comment><USER30> Regardless of how you feel about legalization, policy, etc, this should prove, at the very least, that we aren't winning the "War on Drugs."

<comment><USER31> Prohibition really has turned out to be a seriously damaging thing to society. Drugs are classified not based on their potential to cause harm or abuse, but instead by some nebulous concept of morality. We, as a society need to embrace a more scientific based approach.

<comment><USER32> The value judgments are inseparable from the 'harm or abuse' measurements; there is no value-neutral way to assess harm and abuse. You can say you want to be scientific and come up with numbers, but the selection of the metrics and the 'critical values' will be political and ethical decisions.

Having said all that, I am in favor of full legalization of every substance, even though I personally find the use of almost all substances 'distasteful'.

<comment><USER31> You can scientifically quantify harm both to individuals and society. For example, potential for abuse, potential for individual harm, and potential for social harm are all factors that could be quantified and considered.

Using those metrics alone, the juxtiposition of the classification of marijuana versus alcohol or nicotine is quite interesting. You could perhaps include many other drugs as well such as cocain, mdma, and perhaps even LSD (though this one does pose some concerns socially given that it can cause manic episodes).

My point is that the current "war on drugs" has no scientific basis. And, as such, where we've ended up has been very destructive in terms of the cost to society (imprisonment, surge in use of more harmful but easier to source substances, etc...).

<comment><USER32> If you are going to do a cost/benefit analysis of drugs, what do you include in the costs? Do you include direct medical care, counselling, crime, and/or insurance? Do you count the financial or emotional costs borne by family members? Do you count lost income? Do you count lost taxes? How do you account for positive outcomes from drug use, such as potential improvements in productivity, or creativity? Do you count benefits to happiness, emotional well being, sense of belonging, or fellow-feeling? How do you count all these? Do you evaluate risks from a straight expected-value or do you use some risk- aversion factor? What is your time preference (i.e. 'interest rate'), and how do you derive it?

I am not aware of any government policy based on science; the ones that reference scientifically derived evidence are mostly justifying intuitive/emotional judgments. It may be a Hume-ian perspective, but I am not aware of any compelling evidence to the contrary.

<comment><USER31> You can use whatever you'd like. It's comparative analysis, so it doesn't matter too much. E.g. Marijuana versus Alcohol versus Oxycodone versus meth.

</comment></comment></comment></comment></comment></comment><comment> rm_-rf_slash Make drugs illegal. Lock up drug users in prison with other drug users who get drugs into prison because it's not as hard as you think. Teach prisoners no employable skills. Dump them back outside with the most damming scarlet letter in American society. Give them no public assistance because of drug conviction. Reduce life options to selling drugs or becoming full-blown addict to escape the painful reality. Observe drug use or sale. Arrest again. Change nothing.

What a surprise.

</comment><comment><USER33> I'd be curious to see these numbers separated. Did they both increase proportionally?

<comment><AUTHOR> Here is the detailed report: [http://ghdx.healthdata.org/us- data](http://ghdx.healthdata.org/us-data)

</comment></comment><comment><USER34> While these subjects are connected for some individuals - it's not wise to pile them up together into the single stat number.

Wrong stats.

Which drugs? Top 5-10?

Which mental disorders? Top 5-10?

<comment><USER16> (I upvoted you.)

For mental disorders it's something like:

1) Anorexia Nervosa (historically had very high death rate, something like 20%)

2) Body Dysmorphic Disorder (most people don't know that this has a high suicide rate)

3) Major depression

4) Psychotic illness (people with psychosis tend to live 20 years less than the general population)

5) ADHD

(I'm not sure of the ordering of the last 3.)

As for drugs, far and away the leading cause of death and harm is going to be alcohol.

<comment><USER35> So, clearly the anorexic people die because they starve themselves, people with depression commit suicide, but what's killing the people with ADHD? I know ADHD is correlated with greater risk taking, greater likelihood to abuse drugs, but is it severe enough to put it in the top 5 or 10?

</comment></comment></comment><comment><USER36> Yes

</comment><comment><USER37> I believe this is connected to stagnant wages (which starts in 1970s for Americans), with a catch.

My hypothesis:

1\. Counterintuitively, bad economic circumstances don't lead to chronic stress. People in countries with objectively terrible economic conditions are not more stressed or unhappier. It is simply: 'life'.

2\. Caveat: Bad economic conditions _do cause_ chronic stress where the media is projecting an illusion of rising success and wealth for the average person. This is because large numbers of people begin to feel left behind, even though most of their 'successful' peers are probably in debt to their eyeballs. Chronic stress is caused by the constant reminders in the form of fraudulent statistics, advertisements and social conditioning by fictional television shows that cause them to compare their circumstances to largely imaginary ideals.

My solution, which sounds drastic but I believe it to be meritorious, is to ban television (but we can keep the Nature channels). I believe a large number of social ills shall mostly disappear once this is accomplished.

Supporting evidence:

[http://news.harvard.edu/gazette/story/2009/03/fijian- girls-s...](http://news.harvard.edu/gazette/story/2009/03/fijian-girls- succumb-to-western-dysmorphia/)</comment>


Being A Digital Nomad - <AUTHOR> http://www.dragosroua.com/being-a-digital-nomad/ <comment><USER3> I would add on public transport. Because I take two roughly 30 minutes bus rides per day I work with my Macbook Air on them for an hour a day.

On the top deck of a London double decker bus turns out to be quite an inspiring work place. There's room for a small laptop like the Air and the view is good from the windows with lots of natural light (even in the winter).

<comment><USER4> I love the views but I could never work on a London bus. At the most I can read something light. How do you deal with the teenagers in the back shouting or playing R&B?

<comment><USER5> I listen to music through noise-reducing headphones. This doesn't work if people are being really obnoxious, or the person next to me is on the phone really loud, but it's fine most of the time; certainly it works for filtering out repeated automated announcements.

</comment></comment></comment><comment><USER6> The important note here is that it's something you can do during your "harvest phase" (after you've established a name for yourself and have job security by skills and reputation) but not when you're starting out. For an average 22-year-old to work from home would be a bad idea. You need to be in an office so you can make connections and become the protege of someone who can teach you and look out for your career (and if you don't find such a person, jump ship every 8-12 months).

If you work in an office, you can generate some affinity and loyalty (sometimes). People might feel personally betrayed if you leave, which is good, because it means they'll look out for your career. If you're working remotely, you're exchanging work for money. This is great if you're established, because you can get a lot done in a fraction of the traditional 40-hour week if you set your own hours. It's bad if you're not well- established, because your likelihood of happening across someone who will protect your career is low.

<comment><USER7> Good point, but couldn't you mitigate lack of connections with explicit networking? One could attend different networking events to find people with common interest and then work with them remotely to establish bond - <USER2> interest should help in that.

I'm not saying it's easy, but if there are practical things you can do increase chance of creating connections it may end up worth it for all the benefits of the nomadship.</comment></comment>


Welcome Michael, Jon, and Ilya - <AUTHOR> http://blog.ycombinator.com/welcome-michael-jon-and-ilya

<comment><USER2> YC seems to have taken on a lot of partners in the last few years. What does this mean? What do partners do?

<comment><AUTHOR> YC partners: 1) recruit startups 2) select startups to fund and 3) advise startups. probably 90% of our time is in the third category.

<comment><USER3> Could you tell us a little more about how they do 1?

<comment><USER4> Also curious, I thought YC pretty much just took on startups that applied.

</comment></comment></comment></comment><comment><USER5> Congrats to Jon, Michael, and Ilya!

Jon has been incredibly helpful, supportive, and kind to us (Hacker School) over the years, and I'm thrilled to see him become a full-time YC partner.

</comment><comment><USER6> Congrats to them all!

I've known Ilya as a friend for a few years now and current/future YC startups are going to be very lucky to have him around. He's an extremely intelligent and humble guy.

</comment><comment><USER7> I thought this post was welcoming me and two other visitors for a cool HN holiday Easter Egg. Don't see many other Ilya's around :)

<comment><USER8> I'll make sure to represent Ilyas well!

<comment><USER7> priclasna

</comment></comment></comment><comment><USER9> Congrats Michael!

Michael has been very kind and always helpful whenever I have reached out to him. YC is lucky to have him!

</comment><comment><USER10> Jon was great to work with when my company was in YC. Happy to see he's a full time partner now.

</comment><comment><USER11> congrats guys.

I can personally attest that jlevy & mwseibel are amazing. both had profound impact on us while going through YC. great ft additions.

</comment><comment><USER12> Jon has been a strong advisor on key issues, psyched to have him as a full time partner!</comment>


And man made life: Artificial life, stuff of dreams and nightmares, has arrived - <AUTHOR> http://www.economist.com/opinion/displaystory.cfm?story_id=16163154&fsrc=rss <comment><USER2> <http://news.ycombinator.com/item?id=1364553>

<comment><USER3> I prefer the Economist coverage myself, but agreed that we only need one on the front page.

<comment><USER2> It's a pretty balanced view, even if it could have done without the 'terrorist' mention, that's just too obvious.</comment></comment></comment>


Who Knew What Poo Could Do? - <AUTHOR> https://www.indiegogo.com/projects/poop-pills-a-90-percent-effective-treatment

<comment> xkcd-sucks This is a perfect example of the sort of thing which _should_ have very stringent oversight.

Team is completely unqualified to do biology research? Product is sold as an ancient miracle cure which big pharma doesn't want you to know about? No technical details? Marketing based on juvenile poop jokes?

I hope this never gets off the ground, because it will actively damage the reputation of actual gut microbe therapies.</comment>


ContextFree.js & Algorithm Ink: Making Art with Javascript - <AUTHOR> http://azarask.in/blog/post/contextfreejs-algorithm-ink-making-art-with-javascript/ <comment><USER2> His geocoding api looks useful too.

<comment><USER3> I just discovered Aza and Jef Raskin's webspaces a little while ago, but they are truly great sources of ideas.

<comment><USER2> Do you have the Raskin link?

<comment><USER4> <http://www.humanized.com/> ?

<comment><USER2> Nice.

<comment><USER3> There's also jef.raskincenter.org

An example: [http://jef.raskincenter.org/humane_interface/summary_of_thi....](http://jef.raskincenter.org/humane_interface/summary_of_thi.html)</comment></comment></comment></comment></comment></comment>