A secured Android phone is safer than an iOS device - <AUTHOR> https://twitter.com/thegrugq/status/1168983377082572803 <comment><USER2> He is selling his custom, secured Android phones by saying unupdated iOS devices are more vulnerable (yes, ofcourse) while tweeting it all from an iPhone.

</comment><comment><USER3> Nearly all of his points are just examples of security through obscurity.

</comment><comment><USER4> Hahahaha. Yea sure.</comment>


Xwayland - <AUTHOR> http://blog.mecheye.net/2014/04/xwayland/

<comment><USER2> I clicked through three levels of reference links and I still have no idea what Xwayland is, except that it is some kind of refactoring of the Linux graphics stack. Could someone please explain why people seem so excited about it?

<comment><USER3> The larger idea this fits into is getting rid of X11 all together. The inevitable replacement is Wayland.* One of the challenges of such a switch will that once you start using wayland, you'll have some older applications that cant talk to wayland, you'd have to start an X server to run that old application.

If you have a wayland session on your computer, you don't want to hit ctrl- alt-8 to switch over to an X session running that single application, and then switch back and forth to wayland to use every other program. It would be nice if there was a X server that worked as a wayland client and could put the X-only application on your wayland desktop. That's Xwayland.

* For a better explanation on ditching X, and what Wayland is: see this talk from one of the X dudes working on Wayland [http://www.youtube.com/watch?v=RIctzAQOe44](http://www.youtube.com/watch?v=RIctzAQOe44)

<comment><USER4> Also, if you've ever run an X11 application inside Mac OS X, you've used something similar: XQuartz.

XQuartz is for running X11 applications inside Quartz (Mac OS X's window server/compositor), XWayland is for running X11 applications inside a window server/compositor that uses the Wayland protocol.

</comment></comment></comment><comment><USER5> I'm shocked at how fast Wayland is coming together. It's inspiring to watch.

<comment><USER6> Could it be that competition is the mother of productivity?

<comment><USER7> Competition with what? Windows, OS X? Xorg?

Edit: Can't seem to reply to child, but Mir isn't really a credible competitor (See: [http://aseigo.blogspot.com/2014/03/more-on-why-display- serve...](http://aseigo.blogspot.com/2014/03/more-on-why-display-server-does- matter.html) . Unfortunately Mir seems to be mostly NIH; everyone else is cooperating on Wayland.)

<comment><USER8> Canonicals Mir</comment></comment></comment></comment>


Goodbye to Eclipse – the end of an era as an Eclipse plugin developer - <AUTHOR> http://pureconcepture.blogspot.com/2017/07/goodbye-to-eclipse-end-of-era-for.html <comment><USER2> Google did not rewrite their Android IDE. IntelliJ IDEA had Android support for years and Google collaborated with Jetbrains to create a dedicated IDE for Android. Jetbrains has a lot of experience in specialized IDE and corresponding plugins for their main IDE IntelliJ. It was the right choice by Google to support and utilize a team of smart developers that already created something superior to Eclipse ADT on their own.

<comment><USER3> IMO Google made IntelliJ's Android support worse. They added a million items to the menus (like Eclipse), somehow made it slower, replaced IntelliJ's fast and simple project system with Gradle, which is slow and breaks all the time. Bit of a shame really.

Still a million times better than Eclipse though.

<comment><USER4> IntelliJ doesn't have a dedicated build system. You can choose from no system, Maven, and Gradle.

No system is often good enough for basic projects, but not Android development. Support libraries, configuration, API versions, NDK support, etc. make Gradle a requirement. Gradle is the official build system of Android for a reason, it's not something that Google just added willy-nilly to Android Studio.

As an Android developer, I LOVE Gradle. I think it's a vastly superior build system. I also use it for complex desktop applications, and applications that run on both desktop and Android, using shared code and OS-dependent code (the module system makes this very easy to organize).

</comment></comment></comment><comment><USER5> To the author, I actually used RustDT for a while and liked it. I gave up on it when I found it was supported by only one person.

I predicted that you would lose interest and move on to something else, and my workflow would have then depend on abandonware. A gentle bit of advice: Team up with someone as enthusiastic about the idea as you. If you can't find anyone interested, that's probably a signal not to work on the thing.

You might want to check out sulong,

[https://github.com/graalvm/sulong](https://github.com/graalvm/sulong)

It sounds like a project you could contribute a lot to. There are a few core committers and it sounds like you're interested in staying on the JVM. Compiling Rust to JVM and having a decent IDE for the language would be really nice too.

Finally, remember one thing about IntelliJ. It's popular because of Google, and as you have witnessed with Eclipse, Google is fickle. Chasing Google's whims seems like a bad idea in the long run.

<comment><USER6> > IntelliJ [is] popular because of Google, ...

IDEA is and was pretty well established in the Java/Scala world. Android Studio is the cherry on top.

</comment></comment><comment><USER7> I think there's opportunity for a new, more modern IDE. Something better then Eclipse and IntelliJ, but that's not built on top of JavaScript. Doubt there's the funding for it though, but there's definitely the need (of devs hungry for it, but not willing to pay anything for it either).

<comment><USER8> > but that's not built on top of JavaScript

I know this is a turn-off for a lot of people, but I still don't see _why_. Why you need an IDE that doesn't use JS?

VSC feels super fast to me. It certainly has better performance than Eclipse ever had, and feels less janky than IntelliJ.

I know some people like the light speed of Sublime, but to me there's a certain threshold where it's _just fast enough_. And that's where VSC is.

<comment><USER5> I have aarch64 and 4GB of memory. Electron apps are not kind to either.

[http://roryok.com/blog/2017/08/electron-memory-usage- compare...](http://roryok.com/blog/2017/08/electron-memory-usage-compared-to- other-cross-platform-frameworks/)

Netbeans nightly and JDK9 is quite nice on this platform.

<comment><USER9> So will a well-written Electron app like VSCode. It's not like Java hasn't had the exact same challenges leveled for decades because people wrote bad code without thinking about resource usage.

<comment><USER5> I don't see an aarch64 or arm linux distribution for VSCode.

[https://code.visualstudio.com/Download](https://code.visualstudio.com/Download)

Java works now. VS Code doesn't. Neither does Atom. Or any other Electron app. ARM is a pretty popular arch these days. They might want to work on that.

<comment><USER9> This thread started with a complaint about building things in a language which wasn't JavaScript. Getting better ARM support is a reasonable thing – and they have open work on GitHub to save you the trouble of building it yourself – but it doesn't have much to do with the language.

</comment></comment></comment></comment></comment></comment><comment><USER10> I was hoping the author would talk more about the underlying technical reasons for the problems, as I would have thought he would have insight into that as a plugin developer. It seems like his reasons are really mostly around it losing mindshare and being a waste of his life and the technical is actually less important (even if it is a cause of the former).

I still use eclipse because I haven't found anything else that embraces true full multi-language development the way Eclipse does. That is, in one IDE I have front end, middle tier and back end code all in different languages, sitting next to each other as first class citizens. I can set a breakpoint in my PHP code and my Java code and my Python code, and I can have the source windows right next to each other and debug them in parallel. I just don't know anything else that does that so well.

I also find Eclipse's incremental compile model invaluable. I was kind of shocked when I tried out IntelliJ and had to wait 15 seconds while it ran Gradle for it to tell me about a compile error.

So I'm definitely in the club of being sad it's losing mindshare.

</comment><comment><USER11> Come, ex-eclipsians, join the weirdo minority who use netbeans! We don't bite, I promise! And there are literally dozens of us across the world!

<comment> your-nanny I like netbeans but was absolutely unusable on my brand new iMac; the lag.

</comment></comment><comment><USER12> Yes, as an eclipse plugin developer myself, I made this to bring as much of the lightweight experience from sublime and vscode to Eclipse.

It is basically a next-gen command palette. Much better than the builtin quick access in Eclipse.

[https://github.com/dakaraphi/eclipse-plugin- commander](https://github.com/dakaraphi/eclipse-plugin-commander)

</comment><comment><USER13> I love eclipse and we used eclipse for over a year until we switched to intellij.

The main reason: Updating intellij just works. Updating eclipse on arch linux meant that i have to readd the marketplace url for the proper version, add the maven plugin again and than it worked.

Yes this small detail sucked and yes it just works better in intellij.

</comment><comment><USER14> I've been using Eclipse for what seems like forever. But it feels like with each new release, Eclipse gets worse. More freezes, more crashes, more _really weird_ behaviour, slower code completion. The fact that I _still_ can't turn off retarded core plugins (like the horrible Git plugin) bugs me to no end. Every time I install a new version, I have to remember to go in and delete the Git plugin jars because it fucks up my workflow.

I'll keep using it, because IntelliJ is almost as bad _and_ has a GUI paradigm I can't get used to. But eventually that balance is going to shift.

If Eclipse is suffering from a lack of man power, they might want to consider making it easier to contribute.

<comment><USER5> >I deleted core jars from the distribution. It freezes and crashes all the time. Wow, Eclipse sucks.

Thanks dude. I just sprayed coffee all over my keyboard. The laugh was worth it though.

</comment></comment><comment> jay-anderson We're a mostly java shop at work and I'm one of the last few hold outs still on eclipse. I'm used to it and it mostly does what I need. I use the excellent vrapper ([http://vrapper.sourceforge.net/home/](http://vrapper.sourceforge.net/home/)), but even that has ceased development it seems. Last I tried intellij the vi plugin was unusable for me. I periodically think it's time to give it a try again. It is too bad the eclipse seems to be falling behind and losing mindshare.

<comment><USER15> Something else you could try is [http://eclim.org/](http://eclim.org/) . It's the only thing I really miss about eclipse.

</comment></comment><comment><USER16> This post makes me very sad. I am often reminded that the best tech rarely wins. I've never had to use Intellij until my current job, but it is more obvious to me than ever than Eclipse, at least for Java development, is superior to Intellij. Was the free model not enough to sustain it, unlike Intellij, which sells its IDE, or is there another major cause for most of the world drifting to the inferior choice?

<comment><USER17> How is Eclipse better than IntelliJ? My experience with IntelliJ has been: * Faster than eclipse. * Works better / crashes less. * Less headaches setting up projects. * Far superior vi keymap support.

<comment><USER5> Eclipse git support is superior as well as the pom editor.

<comment><USER18> Eclipses git support: right click on a file, show history, navigate between classes, notice eclipse hanging every time you switch between classes because it's spending unreasonable amounts of time loading the git history while blocking the main thread every time with no caching whatsoever

Facepalm

I run into thousands of moronic things like that on an average work week

<comment><USER19> I use Eclipse with Subversion as the VCS. With Subversion you can disable to automatic History tab update on selection change (ie unlink from Editor). Can you not do the same with the Git functionality?

</comment></comment></comment></comment></comment><comment><USER20> I don't understand what exactly is the reason people don't like Eclipse. The features and the overall feeling of using the IDE is great, that's why I am still using Eclipse (mostly Java and Scala development), so are many of my colleagues. I guess there are some downsides, like slower leading times and a bit clunky compilation process, but other than that, it's a solid IDE.

<comment><USER10> Everyone complains that it is bloated and slow, but I think a lot of people run it with too little memory. I always change the default settings to give it 2g of memory and it always runs fast. Some people think that's ridiculous, but given I spend 70% of my time in that environment, I'm more than happy to have it use that much memory.

</comment></comment><comment><USER21> I made the switch to jetbrains a while ago, but the one feature i really really miss is the absolute to focus on a set of files and resources and hide all the other unrelated code.

Mylyn alone makes me go back every now and then, but eclipse is just too bloated and unpredictable

<comment> laurence-myers I think you can achieve this by creating a "Scope" and filtering to it in the Project view.

</comment></comment><comment><USER22> Something I didn't know until recently was that PyCharm debugger was a cross- project cooperation between PyDev people and PyCharm people [0]

[0] [https://blog.jetbrains.com/pycharm/2016/05/debugger- intervie...](https://blog.jetbrains.com/pycharm/2016/05/debugger-interview- with-pydev-and-pycharm/)

</comment><comment><USER23> I went to a seminar hosted by FAI to talk about Cypress wireless chips and Murata Modules. Their IDE "WICD" is based on Eclipse. When I saw that I was surprised because I thought Eclipse was not getting much active development.

Their use of it was faster than I remember but just as difficult to navigate.

</comment><comment><USER24> Bye Eclipse, you won't be missed >.<

</comment><comment><USER25> This is from July 2017.</comment>


Large patent holders hate this reform proposal. That's a good sign - <AUTHOR> http://www.washingtonpost.com/blogs/the-switch/wp/2013/09/24/large-patent-holders-hate-this-reform-proposal-thats-a-good-sign/ <comment><USER3> The first thing to fix is the economic incentive: when you lose a trial due to invalid or non-infringed patent, you have to be the one footing the bill.

It probably means that you have to escrow a provision to start such a litigation, to avoid organized bankruptcies of empty shells. If you don't have this money and nobody's willing to lend it to you, it probably means that your case has little merit.

<comment><USER4> " _If you don 't have this money and nobody's willing to lend it to you, it probably means that your case has little merit._"

Or you're a start-up or small business that can't afford the contingent liability of a deep-pocketed infringer's legal team. Uncapped "loser pays" clauses also have an unintended consequence of encouraging the infringer to beef up their legal team to intimidate the patent holder.

<comment><USER3> In France, this is left the the judge's appreciation. "Condamnation aux dépens", literally "penalty of the costs", is a complementary, optional penalty which forces to foot part or all of the winning party's legal costs.

The merits of the case and the proportionality of the winning party's legal expenses are taken into account. In practice, it works, together with a couple of anti-ambulance-chasing provisions (e.g. "no gain no fee" contracts are illegal).

<comment><USER5> Loser-pays and a ban on contingency cases is basically a guarantee that consumers will never be able to sue a large corporation to vindicate their rights. It's basically carte blanche for a big corporation to respond to any litigation by hiring the biggest most expensive legal team, adopting a scorched earth litigation policy, and threatening the plaintiff with the resulting bill.

Now, that doesn't make it a bad policy per se. It works fine in France, where the government is much more willing to enforce consumer rights using regulatory means. It wouldn't work so well in the U.S. where the government leaves a lot of that kind of enforcement to private litigation.

<comment><USER3> Again, in France it's not "_loser pays_". It's "_judge determines who pays, and does so in such a way as to deter financial bullying_".

The very reason why we have judges, rather than only cops, is that mechanically applying rules doesn't work. In most non-trivial cases, we need a human being who defends the sometimes subtle spirit of the law. That's one of those cases.

</comment></comment></comment></comment></comment><comment><USER6> "Doctors HATE this one weird trick for weight loss!"

<comment><USER7> I'm glad I'm not the only one to see that!

OT, but does anyone know if these adverts actually make money?

<comment><USER8> Also related to the ads, does anyone have some marketing distillation of why they always use the words "weird trick"? Weird trick for weight loss, weird trick for language learning, etc.

<comment><USER9> There's an article on Slate about those ads: [http://www.slate.com/articles/business/moneybox/2013/07/how_...](http://www.slate.com/articles/business/moneybox/2013/07/how_one_weird_trick_conquered_the_internet_what_happens_when_you_click_on.single.html)

Basically, the trick is "weird" because it's not too positive, so as not to make it sound false and unbelievable, not negative either, and uncommon enough to attract attention and pique interest. Of course, overuse of the technique desensitizes the viewers and it will eventually fall out of favor.

<comment><USER8> Exactly what I was hoping for. Thanks!

</comment></comment></comment></comment></comment><comment><USER10> Ownership, when it extends beyond individual brute force, is always a social convention.

More than a "right" to such, society inevitably examines and challenges its social conventions. (There are some long term patterns, but even these are not steady-state.)

Society is going to look for what works _for society_. If and as (over-) concentrated "ownership" increasingly holds society back...

In other words, ownership at a societal level is a useful tool, but it is not an absolute.

As just one small example, even within our "ownership" society in the U.S., we increasingly have law enforcement confiscating assets without due process whether upon real or convenient suspicion of wrongdoing (asset "forfeiture").

You own it... as long as society says you own it. One reason to use it to help promote a healthy and reasonably fair society -- it's in your own long-term interest.

</comment><comment><USER11> Microsoft is not seriously expecting the billions they're getting from Android OEM's by charging them for using open source software with trivial and broad patents is going to last forever, is it? If they're basing their mobile business strategy on that, they're doing it wrong.

<comment><USER12> I think MS will make over $3B in 2013 on Android. Even if they have to spend 1/10th of that on legal fees it's worth protecting I guess.

</comment></comment><comment><USER13> Sorry this is unrelated to the article, but I've noticed a sharp increase in sites breaking the "Back" button, including this one. Salon.com is another bad offender. Is it just me or has anyone else noticed it? And is there an extension to prevent it? (Chrome)

<comment><USER14> Yep, it just happened a few days ago. Maybe it's Chrome, that's broken?

</comment></comment><comment><USER15> Considering that 99% of USA politics is driven by lobbying and big business this legislation has a snowballs chance in hell of actually passing without a lot of watering down.

<comment><USER16> This is big business vs. big business.

Dinosaurs: Adobe, IBM, Microsoft, Qualcomm and Xerox.

vs

The New Hot Shit: Google, Facebook, Samsung, Red Hat and Yahoo.

I'm not sure who's holding the most cash, but it's certainly not an easy call.

<comment><USER17> I wouldn't call Yahoo new. It IPO'ed 17 years ago, barely 10 years after Microsoft and Adobe.

Red Hat IPO'ed 14 years ago. Even so, it only has a market cap of less than $9B, less than 1/3 of companies like Yahoo (and 1/30th of Google's). They do some neat things in open source and virtualization, but I wouldn't call them "hot".

<comment><USER16> I would. They're web and Linux companies - technologies that are completely pervasive now, and didn't even exist when Microsoft and Adobe were already big companies.

Innovators vs. Squatters. Isn't that the expected way this argument would shake out? Patents encumber innovation, not royalty checks.

</comment></comment></comment></comment><comment><USER18> Those with lots of resources will use force to defend them. Conflicts of interest need to be declared up front - if we think people with patents need to be taken down a peg or two, we shouldn't take objections/arguments coming only from companies with thousands of patents seriously.

</comment><comment><USER19> The underlying problem with patents is basically that the upside of owning a patent is essentially unlimited, where as the cost is finite (and large for an individual, but peanuts for an established corporation).

What needs to be done is make those two things related: For example, require patent holders to declare the value of a patent on their tax filings (say, in April for the previous year), pay a 1% tax on that value, and limit any infringements damages to that value (per defendant, per year). Perhaps also make a forced "imminent domain" seizure possible by any sued part for 10x of the value.

We do not want anyone to have a patent economically worth $100K or less being able to assert it to stop production of something worth $100M or more -- and yet, the current system facilitates that (see e.g. eolas vs. ms, the xml case against microsoft, creative vs. carmack).

Once you have a "cost of carry" for patents, carrying offensive patents will become expensive enough that patent holders assign value (thus, enforceability) to patents they dim worthy.

(And no, this does not push a "small inventor" or "small patent holder" out of the game. If you have a patent worth $100M but do not have much more than $1M to enforce it, you do NOT have a patent worth $100M - litigation is going to cost you much more than that; They are already out of the patent game - <USER2> let's fix other aspects first)

</comment><comment><USER20> Investors have been given a powerful tool here. A litmus test, if you will. The management of those tech companies that do not expect to innovate and succeed in future, have signed this letter opposing CBM expansion. Those that do expect to do so, have not.

</comment><comment><USER21> Three laws for a fair patent system, would help a lot:

1\. Acquiring a patent must cost $0. -- There should be no distinction between applications, such as expedited service (which we have now). The USPTO is not a business!

2\. A refundable sincerity bond is used to ensure the system is not abused. --The bond is 100% refundable, regardless of outcome. It can only be confiscated if willful negligence or fraud can be proven.

3\. There should be no distinction in time frames. All patents are good for a fixed period of time and no longer. They is no renewal period or fee for such.

<comment><USER22> > Acquiring a patent must cost $0.

Can you elaborate on this? Granting a patent doesn't cost $0.

(I do like the bond idea, but even today's bad patents are generally invalidated on prior art, not on willful negligence or fraud -- I'm not sure a bond would necessarily change anything)

<comment><USER23> The bond could perhaps let you offload some part of the work of locating prior art to the applicants. I think actual fraud should be punished as actual fraud, but "I attest that I am confident there is no relevant prior art" coupled with a quick google search turning up mountains of prior art should cost them the bond, and that might help reduce the number of junk patent applications, allowing us to process non-junk applications better and faster.

</comment></comment></comment><comment><USER24> I hate this "x hates y" template for titles.

<comment><USER25> Not nearly as bad as this template used on ads. It always makes me wonder who is actually dumb enough to click on these..</comment></comment>


How Bad Are Things - <AUTHOR> http://slatestarcodex.com/2015/12/24/how-bad-are-things/ <comment><USER2> Based on the author's figures and assuming complete independence of the conditions listed, only about 30% of the population would be untouched by any of them. At the other end of the spectrum, assuming complete dependence between the probabilities, the overall probability would be no higher than the highest among them, or 20%---meaning that 80% would be unafflicted. Assuming the truth lies somewhere between these two assumptions and splitting the difference, we'd get 55% unafflicted, which doesn't seem all that surprising. After all, no matter how strong our 'misery filter' may be, virtually all of us know someone who is clinically depressed, or an alcoholic, or who has dementia. We all know people who were sexually assaulted, although we may not know it. We know people in wheelchairs, and/or on disability. And these people are represented in our lives in numbers not far off from the proportion given as the rate in the general population.

It's a good reminder of the struggles that many face, often hidden from our daily view even if we are generally aware of them. But as a revelation of the power of our social filter, it seems exaggerated.

</comment><comment><USER3> Skimming the comments on that post, a lot of the people there seemed rather like dicks when talking about other people's unhappiness. I have to wonder how unhappy they themselves are, to what degree they recognize it, what brought them to that state...</comment>


Ask HN: What URLs do you visit frequently? - <AUTHOR> <comment><USER2> dribbble.com to help inspire me for better UI work on my apps I develop.</comment>


Yours: Reddit-Like Site Where Users 'Invest' in Content - <AUTHOR> http://blog.datt.co/articles/2016-02-26-yours/ <comment><USER2> I'm actually looking for an alternative to Reddit-like communities. I understand that upvotes and downvotes encourage good content _theoretically_. But that is only if the guidelines of voting are followed.

The guidelines seem to only be followed when a subreddit community is below a certain amount of participants. When a subreddit gets larger and more popular, the voting system creates a predictable, boring, and fascist echo chamber.

When I think about it, the voting on content (the threads) is a very different thing than the voting on the comments inside the threads. Most of the silencing of dissenters and upvoting of the like-minded happen in the comments sections. The voting on the content is a bit less biased, because usually things get downvoted only if they're lame or don't belong in the subreddit.

Any thoughts on how to solve the fascism problem while also encouraging good behavior and good content?

</comment><comment><USER3> Is there a prototype?</comment>


Ask HN: End-to-end encrypted messaging app that doesn't require a phone number - <AUTHOR> Signal et al. require a phone number which makes it a no-go for anonymity. What do people recommend for communicating with end-to-end encryption and preferably ephemeral/self-destructing messages? <comment><USER2> Matrix protocol is good for this. Easiest entry point is at [https://riot.im/](https://riot.im/)

</comment><comment><USER3> I've been pretty happy using Wire lately

</comment><comment><USER4> Wire.

</comment><comment><USER5> Riot.im</comment>


Microsoft Said To Give Zero Day Exploits To US Government Before It Patches Them - <AUTHOR> http://www.techdirt.com/articles/20130614/02110223467/microsoft-said-to-give-zero-day-exploits-to-us-government-before-it-patches-them.shtml <comment><USER2> FFS people, this is called MAPP and the program has been public and a huge security success for the last few years. Microsoft advises lots of security companies about patches slightly before they are issued. That way, everyone has options on day 1 and people aren't scrambling for additional mitigations every Patch Tuesday.

If you want to be outraged, check out all the Chinese companies on the list of partners!

[https://www.microsoft.com/security/msrc/collaboration/mapp.a...](https://www.microsoft.com/security/msrc/collaboration/mapp.aspx)

<comment><USER3> Funny you mention this, because I don't see _US Government_ , _Department of Defense_ , or the _Natural Security Agency_ on that list (not that I expected to find them there in the first place). Also, last I checked, the purpose of MAPP wasn't to allow MAPP-partners the ability " _to exploit vulnerabilities in software sold to foreign governments_ "... And indeed, that would only compound the problem (have a look at the last question on the MAPP Application Request: "Do you sell or create products used to attack or weaken the security posture of networks or applications?").

> _If you want to be outraged, check out all the Chinese companies on the list > of partners!_

Wow, really? :|

I might be outraged if I saw _Government of China_ on that list, but the majority of Chinese companies on that list are large telecommunications companies (like _Huawei_ ) or Chinese-based antivirus companies. And even then, Chinese-based companies only make up a fraction of the (unsettlingly large) list.

<comment><USER4> its important to note, the government of china has a controlling stake in a large number of those companies.

<comment><USER5> I feel it's equally important to note, we don't know which companies on that list are a front for the CIA.

</comment></comment></comment></comment><comment><USER6> This has been going on for years. It's a program that Microsoft created for passing along 0days to AV Vendors and companies so they could create detection mechanisms for it.

[http://www.microsoft.com/security/msrc/collaboration/mapp.as...](http://www.microsoft.com/security/msrc/collaboration/mapp.aspx#)

<comment><USER7> Nonetheless, it's significance increases in the light of the current NSA revelations.

After all, previously one could justify Microsoft's actions by claiming they were notifying the NSA of flaws in Windows so that the NSA could patch their systems ASAP. Now we would likely infer a more sinister justification.

<comment><USER8> _in the light of the current NSA revelations_

"It fits the narrative, so it must be true." HN is getting into the same Ouroboros that Dan Rather found himself in.

</comment></comment></comment><comment><USER9> Early access to the knowledge of vulnerabilities is just good customer service when you're talking about your biggest customer who is also very security conscious. It allows them to protect themselves. The fact that the same knowledge can facilitate developing of offensive payloads is unfortuneately unavoidable - but that doesn't mean that's the purpose of the program or that it should preclude any early sharing at all.

Most of the time (with other vendors, say cisco) these early warnings include general descriptions of the problem and remediation steps - but not explicit descriptions or code patches. While that can be enough to point someone on the right track and develop an exploit for it (depending on a ton of unknown factors), I'd say that 99% of the time the exploit doesn't actually get written until the author can get their hands on the actual patch, so they can see exactly what code was changed. Many of these vuln disclosures are enormously generic in scope. think "a parsing vulnerability in an xml format" and remediation - don't allow connections to xxx port or turn off major software component y.

It wouldn't surprise me if the us government gets pre-public access to inofrmation that makes it easy to weaponize 0-days (what the hell is the zero day initiative, anyway?) but you'll have to do a hell of a lot more digging and analysis before you could convince me that this is one of them.

<comment><USER10> > Early access to the knowledge of vulnerabilities is just good customer > service

Customers who don't have early access might object, especially if they are foreign governments who might sometimes have competitive issues with the USA - which includes pretty much everyone.

</comment></comment><comment><USER11> I learned a thing or two about this in 2009-2010 when I uncovered a critical SSL/TLS bug CVE-2009-3555. The fix for this bug would require a change to the TLS protocol itself (RFC 5746) which would take months in the best case, so my boss and I set upon a disclosure plan. (This was long before we ended up employed at MS.)

Microsoft, like many other vendors, would need to patch. They were the most responsive, a bit aggressive even, vendors about wanting to get the full details of the bug as soon as possible.

We also disclosed the US Government. We did this as part of the planned disclose process to vendors as well as customers and other stakeholders. I felt it was important that there were customers in the process in order to motivate the vendors a bit and so _we_ weren't the only ones taking heat from the vendors. The US Government probably had more affected systems than anybody and it could even be a nat security issue, so we disclosed them.

I think it worked. Some of the other (non MS) vendors heard about it via their Federal business and were a little annoyed at us. The US Government really wants to keep their own systems patched.

I never did hear of the bug being used in anger (not that I would have), but among the major vendors (Linux distros included), Microsoft was the _first_ to engineer and release a patch and push it down the update channel.

We presented the full story (in our Hardy Boys sweaters) here: [https://www.youtube.com/watch?v=U_L9WGGEUlU](https://www.youtube.com/watch?v=U_L9WGGEUlU)

<comment><USER12> I remember TLS extensions support being backported to XP just to implement this. I wonder if it was backported to Win2000 too for Custom Support customers. It is funny that the patch was released August 2010, just after Win2000 went out of support.

</comment></comment><comment><USER13> While I am completely against PRISM and what has occurred, I might be more against the necro-stories that are surfacing trying to paint the complicit companies in a more harsh light.

Stop muddying the waters and let's focus on fixing today.

</comment><comment><USER14> I can't fault MSFT for this at all.

"Hey your systems have been vulnerable for a week; here's the patch!" just doesn't fly too well with _major_ customers with very real needs for security.

I personally don't mind them being used in real targeted surveillance either. That surveillance is going to happen anyway.

<comment><USER15> > I personally don't mind them being used in real targeted surveillance > either.

You hear this and then, on this website, people get all incensed when China sponsors industrial espionage against US companies. What I'm saying that moral consistency is _required_ , it makes people predictable.

<comment><USER16> Otto!

<comment><USER16> Obviously not a lot of people know Harry Hirsch here. And down vote my expression of joy.

</comment></comment></comment></comment><comment><USER17> This article is just a regurgitation of a part of a bloomberg article[0] that is already on the front page[1].

[0] [http://www.bloomberg.com/news/2013-06-14/u-s-agencies- said-t...](http://www.bloomberg.com/news/2013-06-14/u-s-agencies-said-to-swap- data-with-thousands-of-firms.html)

[1] [https://news.ycombinator.com/item?id=5878365](https://news.ycombinator.com/item?id=5878365)

</comment><comment><USER18> Is this why Microsoft called the Google engineer, who uncovered one of these bugs, "irresponsible"? Because they couldn't give it to NSA anymore? If they are doing this, at least they should shut up, and let the engineers who uncover them help the _public_.

<comment><USER19> There are other researchers too, who disclose bugs to Microsoft without spewing unnecessary vitriol? And he was being irresponsible. Microsoft's security division has been proactive earlier, regarding zero-days [1].

Also at this stage, no company is helping the public. Even Google. Every step of my digital life is mined through US corporations, and Gmail, Google analytics and Facebook have a major chunk of my private life between them. So let's focus on every company, without furthering one single company or defending another.

[1] : [https://www.computerworld.com/s/article/9239064/Microsoft_ru...](https://www.computerworld.com/s/article/9239064/Microsoft_rushes_IE8_zero_day_fix_into_next_week_s_Patch_Tuesday)

</comment></comment><comment><USER20> Exploits or vulnerabilities? If they are handing out fully built exploits, I have a problem with it. If they are just vulns then yeah, it is probably MAPP which isn't news really.

<comment><USER21> If they are handling out exploits, MSFt management is pretty bad incompetent. This would negatively affect their sales to foreign companies and sovereign nations. US government may not hack us companies but there does look like there some evidence they hack foreign countries and governments. And MSFT is handing over keys to the US government.

<comment><USER22> Depend on the timing - if NSA gets info less than a patch tuesday before me it is no big deal. If it is more than it is huge and will hurt them in the long run.

</comment></comment></comment><comment><USER23> And you were wondering how the spooks that targeted the Iranian nuclear facilities were somehow able to get their hands on no less than 4 different zero-day exploits.

<comment><USER8> So MSFT was holding off on the fixes for as long as it took USG to weaponize them?

Those are the _worst_ bugs for USG to weaponize. First, Microsoft is going to patch them soon. Second, there is now a paper trail from Microsoft talking to the US about the bug.

 _LATE EDIT_ : in fact, if the person in charge of Stuxnet also saw the exploit they were already using come across the wire from Microsoft, he would likely order it pulled from Stuxnet. They want total deniability.

</comment></comment><comment><USER24> The government would probably like to avoid having its servers rooted. Seems sensible.

<comment><USER25> Some rules for some, other rules for others.

<comment><USER8> You know you can get the source code to Windows? You have to be a very large customer and have data protection measures in place.

 _Postgres_ worked with Heroku to test one of its security patches before releasing it to the public, and no one blabbed. You can probably find a way to get on Microsoft's early-bird notification program, too, if you are an extremely large customer and can assure them that you won't leak the data out.

<comment><USER26> Having been on the end of 'shared source', you don't get all of it. Certain critical bits are missing.

The closest you can get to them is the leaked NT4 and 2000 source back in the early 00's.

</comment></comment></comment></comment><comment><USER27> I can imagine news like this leads to security researches giving lot less time for companies to fix the vulnerabilities.

As it was reported in Hacker news some time ago, Google decided that seven days should be enough for actively exploited vulnerabilities. [http://googleonlinesecurity.blogspot.ch/2013/05/disclosure-t...](http://googleonlinesecurity.blogspot.ch/2013/05/disclosure- timeline-for-vulnerabilities.html)

</comment><comment><USER28> Wait, so there is a problem with MS helping out our government protect its secrets? I agree, PRISIM was bad an invasion of privacy but people need to realize that government agencies have more secrets and do more then spy on us. I wouldn't want China, Russia or some other foreign country getting its hands on the locations of weapons, R&D, or our defense plans because of a exploit in a MS program.

Hackers will always be faster to take advantage of loopholes then companies or the government are at patching them. Do people really see the problem with MS doing this?

</comment><comment><USER26> Wonderful.

That helps me sell Debian + PostgreSQL over Windows + SQL Server.

<comment><USER29> Have you told them about the SSH key fiasco? I've been running Debian/Ubuntu servers since the late 90s but I wouldn't make those kinds of claims about anything you haven't personally audited – and it's certainly not like it'd be impossible for an attacker with nation-state level resources to compromise an OSS project as well.

<comment><USER26> Oh I agree, but when discovered we don't have to wait for a government to do its dirty work before the mere mortals are allowed the patch. Patched, poked in the repository and job done.

The temporal window of attack is pretty low. Take a look at Microsoft when CVE's are issued versus when the KB article with hotfix is announced and it hits windows update. Not a good story.

Regarding the key fiasco, we used puttygen for key generation.

</comment></comment></comment><comment><USER30> I wonder if they selectively push any 'special updates' through windows update to 'foreign' systems.

</comment><comment><USER31> 100% security is impossible and that's the way they like it

</comment><comment><USER32> This is hyperbole. Most large software companies report vulnerabilities to CERT and DHS so that they can start patching critical infrastructure sooner rather than later.

</comment><comment><USER33> Back in 2001/2002 I argued with friends that Microsoft must have made a deal with the government in its antitrust case [1]

Basically divulging or intentionally leaving holes or backdoors in the system accessible to the government in exchange for practically dropping their antitrust case.

[1]-[https://en.wikipedia.org/wiki/United_States_v._Microsoft_Cor...](https://en.wikipedia.org/wiki/United_States_v._Microsoft_Corporation#Settlement)

<comment><USER34> That's nice. That isn't what the article is about nor has there been any intentional holes or backdoors found in Windows.</comment></comment>


Oscar Award winning video editor goes open-source - <AUTHOR> http://www.editshare.com/index.php?option=com_wrapper&Itemid=208

<comment><USER2> More details here: [http://www.editshare.com/index.php?option=com_content&ta...](http://www.editshare.com/index.php?option=com_content&task=view&id=164&Itemid=146)

Summary: It's not out yet. No mention of the open-source license to be used, or whether they will be pursuing a "MySQL" model of charging commercial users (presumably not -- they already sell video storage hardware). The only mention of monetization is that there will be a "marketplace" for proprietary extensions.

</comment><comment><USER3> I hope it's better than their website...it's completely unusable under Chrome. But good on them, this is one area where OSS has been lacking up to now.

<comment><USER4> I spoke to their web-dev - apparently the menu was built before Chrome was released, hence the compatibility issue. I've been assured that it's near the top of the to-do list.

<comment><USER4> (Chrome menu issue fixed.)

</comment></comment></comment><comment><USER5> This is very interesting to me as we have been relatively happy using Final Cut to produce our films but it seems to lag behind a bit in adopting new technology and I'd like an open-source solution so we have more options available for doing distributed renders, etc.

Exciting...wish there was more information available!

</comment><comment><USER6> At least the "productions" page is impressive. Anyone has experience how usable it is for amateurs/hobbyists?

<comment><USER7> Here is the list of productions edited on Lightworks...

[http://www.editshare.com/index.php?option=com_content&ta...](http://www.editshare.com/index.php?option=com_content&task=view&id=160&Itemid=205)

Departed? Pulp Fiction? Oasis? Led Zeppelin? I'm in. My only question is were these and the others exclusively edited on Lightworks?

</comment></comment><comment><USER8> I can't find sys reqs. Mac? Linux? Windows?

<comment><USER2> Here is the website of the company they bought out, whose products they are presumably open-sourcing: <http://www.geebroadcast.co.uk/LWKS/lwks_product.htm>

The Lightworks Softworks brochure lists Windows XP Pro as a minimum system requirement. Of course, open-source software tends to go cross-platform; for example, Blender was once proprietary and Unix-only.

</comment></comment><comment><USER9> I'm not going to fill out a form just to check out their software.</comment>


Ask HN: Should Founders/CEO's read non-fiction or fiction works? - <AUTHOR> <comment><USER2> If the only way you define yourself is "CEO" or "founder" you are limiting your identity to your job.

But you also have friends, and family, and a society you live in. You have a body that has needs ("should founders eat good food or bad food?" "should founders exercise in the morning or the evening?").

You are not your job. Your job will go away eventually. Your company might fail.

Read whatever makes you happier, or teaches you more, or entertains you. You don't have to spend your whole life being a "founder".

(I wrote a longer variant of this, coincidentally also talking about what books to read, in the context of "what technologies should I learn?" \- [https://codewithoutrules.com/2018/02/01/too-much-to- learn/](https://codewithoutrules.com/2018/02/01/too-much-to-learn/)).</comment>


Congress has added CISA to the federal budget bill - <AUTHOR> http://www.theverge.com/2015/12/16/10288182/cisa-surveillance-cyber-security-budget-proposal <comment><USER2> Why is this not getting massive attention here on Hackernews? Right now a post about a dude hacking together a selv driving car has garnered 5X the amount of votes on this post (not that the other post isn't interesting).

Remember that:

 _Apple, Reddit, Twitter, the Business Software Alliance, the Computer and Communications Industry Association, and other tech firms have all publicly opposed the bill. And a coalition of 55 civil liberties groups and security experts all signed onto an open letter opposing the bill in April. Even the Department of Homeland Security itself has warned in a July letter that the bill could flood the agency with information of "dubious value" at the same time as it "sweep[s] away privacy protections."

[http://www.wired.com/2015/10/cisa-cybersecurity- information-...](http://www.wired.com/2015/10/cisa-cybersecurity-information- sharing-act-passes-senate-vote-with-privacy-flaws/)

_

Isn't this massive news?

I mean the bill in itself is horrible policy making, but the way it's being snuck in is scandalous in its own right.

Have i misunderstood something?

<comment><USER3> Because virtually the same bill passed the Senate with 75% support, and the House passed the (significantly worse) PCNA back in April at approximately the same margin.

This bill was going to become law; the only question was whether the conference committee between the House and Senate would change it --- if it had, _it would have changed it for the worse_ , since the House bill is worse than the Senate bill, which is the one that's going to pass.

There's just not much of a story here.

<comment><USER2> That makes sense.

Although when looked through policy-making perspective this change is further stabilizing the already dystopian trajectory of international tech laws.

The worst of the worst just keeps getting compiled and eventually voted through. And under the guise of "war on terrorism", "war on pedophiles", "war on hackers" etc.

I just don't see this ending anything but horribly.

Either with a monopoly driven "light-net" full of censorship, and no way of entry for the "smaller" businesses, ngo's, dissident groups etc.

Or worse with a global pre-crime dictatorship.

</comment></comment></comment><comment><USER4> 985-222-CISA

If you live in the United States, this phone number connects you with your congresspeople and senators in order to make your voice heard.

Citizens stopped CISA before, we can do it again. Don't lie down.

<comment><USER4> Edit: I've seen a few people calling BS on this because of TechDirt. I found it from the EFF, who gave me this number to call. I feel strongly about surveillance legislation because I don't want myself or my friends to go to prison because [insert corp here] decided I did something illegal with their electronic content, and I don't want my geolocation, etc. perpetually in the hands of anyone with a security clearance.

<comment><USER3> Sec 102.(5)(B):

 _The term cybersecurity threat does not include any action that solely involves a violation of a consumer term of service or a consumer licensing agreement_

<comment><USER5> But according to recently tried cases, something as mundane as incrementing a URL can be construed as a violation of CFAA.

<comment><USER3> So? Your criminal liability for incrementing the URL is totally situational. If you're reading a catalog and you tick the URL to see what the next product is, you aren't going to be liable. If you see a URL used for XHR in the frontend for your bank and you increment it to see other people's bank accounts, you will be.

We don't have a law against "hacking" in the US; we have a law against "unauthorized access", particularly when that access has consequences.

According to _one_ recently tried case, by the way, and one where the sentence was ultimately vacated.

And finally: CISA has almost nothing to do with criminal law (it defines no new offenses does not change CFAA or its sentencing). If you want to have a discussion about how totally broken CFAA's sentencing is, I'm right there with you.

<comment><USER5> All I'm suggesting is that since CFAA has a history of been construed to be applicable in extremely broad-terms by prosecution and (although I have not done a close reading of the entire act it contains provisions such as the following in it's definition of CYBER THREAT INDICATOR):

> (D) a method of causing a user with legitimate access to an information > system or information that is stored on, processed by, or transiting an > information system to unwittingly enable the defeat of a security control or > exploitation of a security vulnerability;

That OP's second concern:

> and I don't want my geolocation, etc. perpetually in the hands of anyone > with a security clearance.

Regarding being under surveillance for what they may consider to be their normal or otherwise professional activities is quite valid.

</comment></comment></comment></comment></comment></comment><comment><USER6> Looks like it is actually worse than CISA...

[https://www.techdirt.com/articles/20151215/06470133083/congr...](https://www.techdirt.com/articles/20151215/06470133083/congress- drops-all-pretense-quietly-turns-cisa-into-full-surveillance-bill.shtml)

<comment><USER3> Someone asked me about this last night. Is there sourcing for this beyond "Techdirt says so"? Because on matters of law, Techdirt is extraordinarily untrustworthy.

I'd love to see the amendments or revisions that are purported to be doing this to the bill.

(I don't support CISA, but if you asked me which I'd rather get rid of, CISA or Techdirt, I'd have to think about it.)

 _update_ :

No. See: [https://news.ycombinator.com/edit?id=10747359](https://news.ycombinator.com/edit?id=10747359)

<comment><USER7> [https://www.techdirt.com/articles/20151216/05514933094/as- pr...](https://www.techdirt.com/articles/20151216/05514933094/as-predicted- congress-turned-cisa-into-clear-surveillance-bill-put-it-into-must-pass-govt- funding-bill.shtml) has an embedded document and a link.

<comment><USER3> Thanks. Here's a sane version of that link, I think:

[http://docs.house.gov/billsthisweek/20151214/CPRT-114-HPRT-R...](http://docs.house.gov/billsthisweek/20151214/CPRT-114-HPRT- RU00-SAHR2029-AMNT1final.pdf)

<comment><USER8> That's 2000 pages! "Sane" isn't a word I'd use to describe it either.

<comment><USER3> I meant "sane" as in "not a web-based PDF viewer".

It's a whole bunch of bills crammed into one document. CISA starts around page 1730.

<comment><USER8> I didn't read the techdirt article but did read the relevant section of the bill.

It sounds on the whole fairly reasonable. Here is my understanding...

Companies can monitor their own systems or the systems of clients for cyberthreats and share this information with the government and with each other. They must redact personal information of non-involved parties. The capabilities and scope of the monitoring system are to be disclosed publicly. All sounds fine. Where it appears to go a bit off the rails is page 1765-1766 (section A). Here the purpose seems to expand beyond "cybersecurity" and deviate into monitoring non-cyber criminal behavior. Preventing threat of death, terrorist attacks, harm to minors (yes.. think of the children), and... _serious economic harm_ (what exactly is that and to who?). So... it is more than a cybersecurity bill but this little bit is buried in a small few lines 40 pages into the section after mentioning "cybersecurity" probably 70 times previously as the purpose of the bill. Seems a little bait and switch.

For the record I don't disagree (in total) with monitoring for these types of serious criminal activities.. I've always assumed it was done and assume it will continue to be done. Just don't call it "cybersecurity" when it is really flat out mass surveillance for non-cyber related threats.

Also, it seems that the bottom line is a committee to talk about a committee in some far off period of time. Typical.

But overall I agree... bureaucratic silliness. Bait and switch dishonesty. Think of the children nonsense. In short, typical Washington DC behavior. But not the end of the free internet.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> Probably a silly question, but is there a reason all these 'additions' are being snuck into bills and what not? Why does the system allow members of congress to add unrelated extras to bills in the first place?

Wouldn't a simple fix for things like this be 'only allow a new law proposal to be about a single topic and nothing else'?

<comment><USER10> > Wouldn't a simple fix for things like this be 'only allow a new law proposal > to be about a single topic and nothing else'?

How do you define "a single topic"? Who gets to decide what is and isn't topical? Who gets to enforce it? Can you see how this definition might be abused for political gain?

Myself, I see it only making things worse.

<comment><USER11> > How do you define "a single topic"? Who gets to decide what is and isn't > topical?

Easy. If 1/3 of Congress votes for something to be split, then it's split. (Kind of the opposite of the 2/3 super majority rule.)

As simple as that. Let the people actually voting decide if something is a single topic.

Yes, this could lead to nonsense where people split things to insane levels just to disrupt things, but I suspect it would not come to that because they would be ridiculed, and it would be just a waste of time for them since splitting something doesn't mean it doesn't get voted on in the end.

<comment><USER10> I hate to break it to you, but you have a bunch of people in Congress right now gaining politically by being disruptive. So your failure scenario is occurring _now_ without your mechanism.

<comment><USER12> If the failure mode of this proposal (excessive splitting of bills) is less disruptive than the current situation (attaching bill-killing, shutdown- threatening riders), then it seems to me we would still be better off with this implemented than without.

In addition, as long as the votes for this are public, it seems like it would be harder to defend capricious action for political gain, since anyone could see that _this_ group of senators all voted to split legislation that clearly should not have been split and then take them to task for it. It could even be mandatory that a proposal to split a bill must be accompanied by an explanation (also publicly available) of why it should be split that way. It's one thing in my opinion to put something controversial into an unrelated bill --there will always be people who are in favor of that, so it is politically defensible and can score points--but it is another thing entirely to try to (literally) rationalize the frivolous division of a cohesive bill.

It actually strikes me as quite an elegant solution to the problem of riders and sprawling legislation.

<comment><USER10> You believe that by increasing transparency and granularity, voters will punish or reward Congresscritters more effectively and efficiently.

I disagree strongly. I submit that most voters do not follow the legislative process very closely and vote accordingly. Rather, I submit that most voters make decisions emotionally using far less than the totality of the relevant information currently available to them. At this very moment, we have a batch of Congresscritters who gain the support of their constituents by obstructing their opposition by any means possible. Questions of frivolousness or caprice are not considered. This is the situation here, today, and now.

I think your notion fails because it adds extra information that voters will disregard. Because this information will be disregarded, it will not significantly impact the behavior of voters. The net result is likely to be an increased legislative overhead, more procedural tools to be wielded as partisan weapons, and voter behavior not shifting significantly. As a result, the failure mode of this proposal is everything wrong with the current (attaching bill-killing, shutdown-threatening riders) PLUS excessive bill- splitting for the sake of obstruction.

Might I suggest that your solutions should not hinge on sudden and dramatic shifts of voter behavior at a scale of many millions?

</comment></comment></comment></comment></comment></comment><comment><USER13> This is interesting too

TEMPORARY H-1B VISA FEE INCREASE.—Not- withstanding section 281 of the Immigration and Nation-ality Act (8 U.S.C. 1351) or any other provision of law, during the period beginning on the date of the enactment of this section and ending on September 30, 2025, the combined filing fee and fraud prevention and detection fee required to be submitted with an application for admission as a nonimmigrant under section 101(a)(15)(H)(i)(b) of the Immigration and Nationality Act (8 U.S.C. 1101(a)(15)(H)(i)(b)), including an application for an extension of such status, shall be increased by $4,000 for applicants that employ 50 or more employees in the United States if more than 50 percent of the applicant's employees are nonimmigrants described in section 101(a)(15)(L) of such Act.

<comment><USER14> I'd be really interested to know what businesses in the United States have more than half of its employees here on H-1B visas.

<comment><USER15> Companies like Infosys, Tata Consultancy Services, and Wipro who provide our country with tens of thousands of the world's greatest minds to maintain enterprise applications for about $70,000 a year.

</comment></comment></comment><comment><USER16> Welcome to the rest of the world. We're being eavesdropped legally by your congress for ages. :-)

</comment><comment><USER17> it would be great if we could have all these bill changes in a git repo with commits from the representatives that added them. open source gov.

<comment><USER18> But then they could be held accountable for their shitty actions, and if there's one thing they _don 't_ want, it's that!

<comment><USER19> There should be an automatic ban against anyone who attempts to shirk responsibility.

</comment></comment></comment><comment><USER20> As I understand it, by slipping it in on an Omnibus budget bill, leaders get to add in bullshit that nobody in their right mind could defend on the floor and then expect an up-down, yes-no vote on the entire budget, including the add-in, by the membership.

In addition, because it's a budget bill, regular conference committee rules don't apply. The idea was that having conference committees dicker over each line item would be a great way to prevent both houses from agreeing. So the "fix" they made for money bills can be used for cyber-surveillance bills too.

I may have missed the details. Apologies if that's the case. If this was added to the Omnibus, the reason why was obscurity. My misunderstanding of the details is a prime example of voters not being able to track who's responsible. That's the point.

</comment><comment><USER21> Any specifics on which congress-people are responsible for this?

<comment><USER22> In the larger sense, aren't all the representatives responsible? Certainly the ones who voted for it. I know it is controversial, but they should be reading the bills before passing legislation. And the ones who didn't vote? What are we paying you for, if you aren't even showing up for your job? And even those who may have voted no seen to bear some responsibility, why didn't you raise an alarm? You should still be reading bills that have a high likely hodd of passing, even if your intention is to vote no.

<comment><USER23> Of course, but some representative made the motion to include the text of the CISA bill part of the Omnibus bill, that should be on the record somewhere.

<comment><USER24> Anyone have more clarity on this? I think since this is just a single bill, figuring out who included which part of the final text is a non-trivial task. However, since senior leadership of both parties are mostly responsible for getting this bill through, I think they ultimately are responsible for allowing the CISA portion to be included.

</comment></comment></comment></comment><comment><USER25> So now they're legally allowed to do what they've already been doing without oversight anyways, which they were legally never allowed to do in the first place and still aren't legally allowed to do due to Constitutional restraints.

I don't like to sound defeatist, but honestly what does this change?

</comment><comment><USER3> Since it's linked upthread: Techdirt is one of the least trustworthy sources on the Internet for information about Internet law.

 _(Here 's a summary of CISA I wrote a few months ago on HN: [https://news.ycombinator.com/item?id=10454172](https://news.ycombinator.com/item?id=10454172) )_

Today (and yesterday), Techdirt claims the following changes to CISA:

1\. _Removes the prohibition on information being shared with the NSA, allowing it to be shared directly with NSA (and DOD), rather than first having to go through DHS._

2\. _Directly removes the restrictions on using this information for "surveillance" activities._

3\. _Removes limitations that government can only use this information for cybersecurity purposes and allows it to be used to go after any other criminal activity as well._

4\. _Removes the requirement to "scrub" personal information unrelated to a cybersecurity threat before sharing that information._

'yuhong helpfully posted a link to the revised bill attached to the budget bill.[1] I compared it clause for clause to the version that passed the house. That is 10 minutes of my life I will never get back. Unsurprisingly, only one of Techdirt's claims is true (but worded misleadingly). The other three are simply false.

Here's the breakdown:

<strike>1\. The "CERTIFICATION OF CAPABILITY AND PROCESS" part of Section 107 now allows the President, after CISA has been started by DHS, and after publicly notifying Congress, to delegate to any federal agency, including NSA, the authority to run the process described by the rest of the bill. The previous version required DHS to run the entire process. Techdirt isn't wrong about that change. Techdirt is wrong to be confused about why NSA would be a designated coordinator for threat indicators under CISA (NSA houses virtually all of the USG's threat intelligence capability; no other department has comparable expertise coordinating vulnerability information).</strike>

 _I was wrong about this; the new bill_ specifically disallows DoD or NSA _from running the CISA portal._

2\. The bill doesn't change the authorized usage of cyber threat indicators at all (nor does it change any of the definitions of threat indicators, vulnerabilities, and so on). The few places I found changes at all actually improved the bill (for instance: Section 105 5(A) no longer allows threat indicators to be shared to investigate "foreign adversaries").

3\. CISA has _always_ allowed the USG to use cyber threat information in law enforcement pertaining to a specific list of crimes --- that is one of the ways CISA is significantly worse than CISPA. But Techdirt suggests that CISA can be used by the DEA to investigate drug crimes. _You cannot have read the bill and believe that to be an illustrative example_ , because drug crimes aren't among the listed crimes: fraud/identity theft, espionage, and protection of trade secrets. It should not surprise you that the list of applicable crimes has not changed in the budget bill version.

4\. The new CISA act retains all the "specific person" and "technical capability configured to remove any information" language regarding personally identifiable information in "cyber threat indicators". The "scrub", by the way, _has always applied to private entities_ (Techdirt may have tripped over themselves to write this bullet point, because the new bill clarifies "entity", "federal entity", and "non-federal entity", and so the scrubbing language now reads "non-Federal entity" \--- but the original bill defined "entity" as "private entity"!)

[1]: [http://docs.house.gov/billsthisweek/20151214/CPRT-114-HPRT-R...](http://docs.house.gov/billsthisweek/20151214/CPRT-114-HPRT- RU00-SAHR2029-AMNT1final.pdf)

<comment><USER26> Note that Techdirt didn't have the final text of the bill (and couldn't have) since it wasn't finalized at the time. They were commenting on the proposed changes, which they acknowledge didn't all make it in to the bill[0].

So you may be commenting on old information (note that I don't see those 4 items on their current article[1]), and they specifically acknowledge the changes from yesterday's proposal to today's complete text.

They could still be wrong in their analysis, but it would be more helpful to do a breakdown of their current stance on the final bill, rather than doing a breakdown on their analysis of proposed changes with data you have from the final bill text that they didn't have access to.

[0] - [https://www.techdirt.com/articles/20151216/05514933094/as- pr...](https://www.techdirt.com/articles/20151216/05514933094/as-predicted- congress-turned-cisa-into-clear-surveillance-bill-put-it-into-must-pass-govt- funding-bill.shtml)

[1] - "a few of the absolutely worst ideas didn't make it into the final bill,"

<comment><USER3> Nope. Not even a deeply cynical misreading of the bill gets you there. Here's Techdirt's current claims:

 _While the reports yesterday indicated that the bill would directly allow its use in "surveillance," the list of approved uses was changed slightly to effectively hide this fact. Specifically it says that the information via CISA can be used to investigate a variety of crimes -- and doesn't say "surveillance." But, obviously, surveillance isn't a "crime" that the government will be investigating. It's just the method that the government will use to investigate crimes... which is now allowed under CISA._

Every version of CISA has included this language, and the "variety of crimes" hasn't changed and remains microscopic. The list of approved uses wasn't "changed slightly to effectively hide this fact"; in fact, the only change in the approved list of uses is _the removal of an approved use_.

 _Also, yesterday we noted that the proposed change would "remove" the privacy scrub requirements. The final bill didn't completely do that, but basically changed the standard to pretend that it's in there. Rather than demanding a full privacy scrub, the bill lets the Attorney General determine if DHS is doing a reasonable job with its privacy scrub._

"Privacy scrub" is language that Techdirt is using, but the bill never has. The CISA requirements to remove personally identifying information --- which have always applied to private entities --- is unchanged.

</comment></comment></comment><comment><USER4> News flash, privacy is going to (keep) getting worse before it grts better. This is why the instant someone invents a totally secure and private way for me to exist online, I'm going to dump a truckload of money down their coffers.

<comment><USER27> > _This is why the instant someone invents a totally secure and private way > for me to exist online_

isn't that impossible due to all the backdoors in software, hardware, and even in the encryption?

<comment><USER28> Are you watching the watchers? What if they didn't implement _the_ backdoors?

<comment><USER29> Unless the software-firmware-hardware stack is totally secure then someone, and it needn't be a government, will implement backdoors where there is value in doing so.

</comment></comment></comment></comment><comment><USER30> I don't know the origin of the word "scumbags" but it seems to fit perfectly here.

Can you imagine sitting across from someone you are negotiating with and you are about to sign and they slip a sheet of paper inbetween the document, making you agree to it?

Of course not. But what you'd never do to a fellow american in person, congress is more than okay with doing to you without you being there or realizing what is going on.

Lowest of the low.

<comment><USER31> In addition to it's modern usage, which I agree appropriately describes these congresspeople, the word "scumbag" refers to condoms.

<comment><USER32> More specifically, to used ones.

</comment></comment></comment><comment><USER33> P.S., the reason you don't see as much wrangling or dramatic threats to shut down the government over this budget bill is _because a bunch of stuff like this was loaded into it._ Because Congress is under enormous pressure by law enforcement and intelligence agencies to undermine computer security in the name of "safety", but they can't be _seen_ doing it because it's extremely unpopular.

What will be interesting is if all the riders on this budget bill are so unpopular that the voting public _demands_ a government shutdown.

Personally, I think everyone here is better off spending time writing software to make surveillance less practical. Even if the U.S. government is nominally constrained by laws (they aren't in practice), there are plenty of other actors in the world that aren't governed by any constraints and will monitor all electronic communications up to their technical capacity to do so.

If you care about privacy and information security you need to be working on tools to make it impossible for surveillance to occur, not petitioning a Congress that is dead-set on screwing you.

</comment><comment><USER34> So can someone please help explain to me how this is permissible?

Taking this to extremes, why would politicians not sneak every crazy wild idea that they have onto this bill if it's a must-pass bill?

<comment><USER35> > Taking this to extremes, why would politicians not sneak every crazy wild > idea that they have onto this bill if it's a must-pass bill?

They try; there are various constraints:

(1) Individual members can't just stick a rider onto a bill, riders are amendments, and are voted on.

(2) Riders are, in effect, a strong-arm negotiation tactic between one house of Congress and the other, or between Congress and the executive -- a gamble that the _other_ side sees the other provisions of the bill as "must pass" enough to accept the added conditions. But those gambles can be wrong, resulting in neither the main bill or the added provision getting passed. So, the biggest incentive to add non-germane riders is to a bill you are _less_ concerned with passing than those you are trying to get to accept the rider as a precondition for the rest of the bill, where them rejecting the rider is more unattractive to them that it is to you. If you _really_ think its a "must pass" bill (rather than just wanting _others_ to think that so that they'll accept the rider), you won't want to risk causing it to fail somewhere in the process because the rider you attached was unacceptable.

<comment><USER36> Unless you want the political fodder to say the other party is also willing to shut the government down. If you don't care about shutting everything down you can put horrible things in a must pass bill.

<comment><USER35> If you don't care about shutting everything down, there is no such thing as a "must-pass" bill; at least, the fact that not passing a bill would lead to a shutdown doesn't make it must-pass if you don't care about shutting everything down.

But I think you are agreeing with what I said, that its more attractive to attach riders to something you think your _counterparty_ sees as "must pass", but you do not.

</comment></comment></comment></comment><comment><USER37> and the people that did that will go largely unpunished in any way and continue to receive the same votes as always.

</comment><comment><USER38> Rolling in a little late here, I am actually wondering what substantive rationale exists here. There _are_ super competent people in the government, and they do percolate information out to Congress. So I don't think it's fully appropriate to call the Congress-critters chumps (although it's a national pastime), and I do also wonder what the effective means of altering policy are(No, I don't think the EFF is being effective).

</comment><comment><USER39> So if I delete my YikYak account today will I still be employable in the future?

<comment><USER40> I don't understand the connection here. Could you elaborate for me?

<comment><USER39> The article says "The bill would make it easier for private sector companies to share user information with ... other companies". Taking this at face value, any potential employer could conceivably access everything I've ever said on YikYak, just, to you know, compare with their own notes and make sure I'm not a criminal. This wasn't really supposed to be that serious of a comment, as haven't said anything too horrible.

</comment></comment></comment><comment><USER41> :( ugh not again

</comment><comment><USER42> There have been close to a dozen posts about this. We merged the threads that had comments.

If another article is significantly more substantive, let us know and we can change the URL.

</comment><comment><USER43> "So this is how liberty dies...with thunderous applause."

</comment><comment><USER44> Don't you get it, America? _Your masters want this._ Why can't you have the good grace to let yourselves be observed and controlled without raising such a ruckus?

/s</comment>


Most decorated war dog of World War I - <AUTHOR> http://en.wikipedia.org/wiki/Sergeant_Stubby

<comment><USER2> Wow! Stubby's story would make for a brilliant movie!</comment>


Pure JavaScript WiFi QR Code Generator - <AUTHOR> https://qifi.org/ <comment><USER2> On the topic of generating QR codes with JavaScript, I have a project that requires generating QR codes and the various libraries I could find all seemed to be rather... poor. A lot of them were simply made for another era of JavaScript, where the only way to generate the image was to set up a table, or even implement its own png encoder(?). There were a few more modern ones, with active development, but the changelogs weren't terrible re-assuring as they were mostly fixing bugs that really shouldn't happen in a standards compliant code generator.

In the end I settled on Project Nayuki's QR code library[0]. The JavaScript is targeting ECMAScript 5, but is commented really well so it's not too difficult to refactor it into ES6+. I'm hoping to publish my efforts soon, but it still needs some more work.

[0] [https://www.nayuki.io/page/qr-code-generator- library](https://www.nayuki.io/page/qr-code-generator-library)

<comment><USER3> Thanks for the compliments! So actually, the ES5 targeting is my conscious choice for supporting Internet Explorer 11.

Otherwise, you can see the use of the latest and greatest features in the TypeScript version: [https://github.com/nayuki/QR-Code- generator/blob/master/type...](https://github.com/nayuki/QR-Code- generator/blob/master/typescript/qrcodegen.ts?ts=4)

I began this project in 2016 because I got disappointed by code quality when browsing online for C/C++ QR libs. The JavaScript versions were even worse, especially ones that ported C code poorly and verbosely. On my web page, the bottom section titled "Compared to competitors" contains a detailed commentary.

On a related note, here you can learn about how QR Codes work at a low level: [https://www.nayuki.io/page/creating-a-qr-code-step-by- step](https://www.nayuki.io/page/creating-a-qr-code-step-by-step)

<comment><USER4> Just wanted to compliment you, this is a seriously impressive amount of work.

I deal with QR codes at work (we use them for stock tracking) and the libraries previous Dev used aren't a patch on yours :).

</comment></comment></comment><comment><USER5> Anyone from Google know what the deal is with barcode scanners on Android, zxing is in "maintenance mode" we have recently added QR scanning to our app and the experience on iOS is far superior (integrated, faster etc). Or do you have to mothball zxing for a period of time before launching a new "scanner product" to get that team promoted before abandoning it as part of the Google SDLC (Build, Promote, Abandon)

<comment><USER6> ZXing isn't an official Google product, although it was created by an ex- Googler (perhaps still at Google at the time).

Google itself has a "Barcode API", but they seem to recommend "ML Kit" these days.

<comment><USER7> Yeah that API was a no-go for me, as I don't really want to share all that data with Google. So I was stuck with ZXing.

<comment><USER8> ML Kit runs on-device if sending to Cloud is your worry.

</comment></comment></comment></comment><comment><USER9> Coincidentally, as of this week, Plasma (KDE) adds a feature to see the QR code of a network "for easy sharing with others"

\- [https://pointieststick.com/2019/07/21/kde-usability- producti...](https://pointieststick.com/2019/07/21/kde-usability-productivity- week-80/)

\- [https://phabricator.kde.org/D22457](https://phabricator.kde.org/D22457)

Also, I really like KDE clipboard's manager feature that turns what you copied into a QR code, making it easy to pass data from the computer to a phone. KDE Connect goes further by allowing sharing the clipboard between a phone and a computer but:

\- at times, KDE connect is unavailable without tweaking because you are on a WiFi connection that does not allow communication between devices

\- you might not want to share the clipboard between the computer and the phone for privacy reasons

\- you may want to share something to somebody else's phone

</comment><comment><USER10> Neat!

You could update/simplify your Android instructions: the stock camera app will detect QR codes and present a button to connect to the network in the link (tested using Pixel 3 running Android Pie)

edit: per the below comment, this is the app, which may or may not be installable on your phone: [https://play.google.com/store/apps/details?id=com.google.and...](https://play.google.com/store/apps/details?id=com.google.android.GoogleCamera&hl=en_US)

<comment><USER11> Oh this is great. I first tried it with Google Lens, which supports normal QR codes, but unfortunately didn't do anything at all with these.

</comment></comment><comment><USER12> I love that this is supported on iOS. I was curious to know about more supported shortcuts, and found this list:

[https://9to5mac.com/2017/06/12/top-10-qr-codes-supported- by-...](https://9to5mac.com/2017/06/12/top-10-qr-codes-supported-by-ios-11/)

<comment><USER13> Its been so nice since iOS has had a QR code reader natively in the camera for a few years

Mobile devices having this natively was a dream back in the beginning of the decade

Android OS doesnt have this natively so the devices dont reliably have that still

Reason 25 to just stay away since there a fundamental limitations to android getting better that have nothing to do with overpowered hardware and customization

<comment><USER14> How is this 2019 and Android doesn't natively scab QR codes?

<comment><USER13> Could be a variety of factors ranging from apathy to intellectual property, very unlikely to be the OEM hardware or software variances, but it also could be

At this point just bet on winners

<comment><USER14> Last I checked, the Pixel phones did this with the Camera app, but the One Plus did not.

Why can't Google add this to the "Android certification" to force everyone to read QR codes on the default Camera application

</comment></comment></comment></comment></comment><comment><USER15> Inspite of captive portal being everywhere this is a very good tool for SME's/hotels which doesn't afford to have portal. Good job mate.

<comment><USER16> I've got a wifi QR code printed and hung on the wall of my apartment. It's nice to be able to tell guests to just scan the QR code instead of giving them my very long wifi password.

</comment></comment><comment><USER17> I can crash Settings on my up to date Galaxy Note 9 by entering enough 'a's as SSID and password. Wonder if it's more than a crash?

<comment><USER18> That's Samsung in general. I have a TV that can't handle long passwords.

</comment></comment><comment><USER19> This is fantastic. I'm going to 3d print the code and make a placard for the guest WiFi at my place :)

<comment><USER19> Ok, so someone already did this...

[https://www.thingiverse.com/thing:3181601](https://www.thingiverse.com/thing:3181601)

<comment><USER7> Is that thing even scannable? Or do they paint the embossed parts for extra contrast?

<comment><USER20> From the description on the page:

> You need to print this with a light color on the bottom and a darker color > on the top layers, otherwise it will not scan correctly.

</comment></comment></comment></comment><comment><USER21> Here is one based on jquery-qrcode [1]. [http://qrtrack.com/](http://qrtrack.com/)

[1] [https://larsjung.de/jquery-qrcode/](https://larsjung.de/jquery-qrcode/)

</comment><comment><USER22> Looks like Android Q has support for reading WiFi QR codes.

To scan a code, tap the button on the far right of the "Add network" line in the WiFi settings.

[https://www.androidpolice.com/2019/03/13/android-q-lets- you-...](https://www.androidpolice.com/2019/03/13/android-q-lets-you-share- and-connect-to-wifi-networks-with-qr-codes/)

</comment><comment><USER23> Does anyone know why none of the popular banking and alt-banking apps support SEPA payments vi QR code?

<comment><USER7> Banks are some of the most conservative institutions on earth. They also have a lot to lose if they do it wrong, so progress is usually slow. There are some who go against the grain, though, like for instance Revolut.

<comment><USER23> Neither Revolut nor Monese do that. Not sure Revolut supports SEPA payments at all.

</comment></comment></comment><comment><USER24> Im not really familiar with how qr codes actually work, ive wondered before if its possible to add multiple networks/passowrds from a single qr code, or does it not work that way?

<comment><USER25> If I remember correctly, no. The encoded string has a format like `WIFI:T:WPA;S:mynetwork;P:mypass;;` (see [https://cweiske.de/tagebuch/wifi- config-qrcode.htm](https://cweiske.de/tagebuch/wifi-config-qrcode.htm)).

It's up to the qr code scanner to share the string with the appropriate app.

</comment></comment><comment><USER26> On a similar note, I created a very small and convenient service for client- side generation of QR codes

[http://qrgen.xyz/](http://qrgen.xyz/)

</comment><comment><USER27> >Maemo

Oh the memories! Makes me wonder how Neo900 is doing...

</comment><comment><USER28> Do regular people (outside the tech bubble) even use QR codes anymore?

Using them involves installing a reader app, and even when embedded in phone camera apps, the functionality is hidden or implicit.

QR codes look cool and feel like the future, but they seem like something that never really materialized in becoming widespread to the general populace.

Not arguing against this product per se, but QR codes in general...

<comment><USER2> I feel like both Google and Apple has just want QR codes to go away. Some of their apps use QR codes for very specific purposes, like setups, but neither of them provide a generic QR code scanning app.

The Twitter app on Android actually has a built in generic QR scanner for whatever reason, but for most purposes I use ZXing team's Barcode Scanner app. I've been looking towards using a QR code keyboard to semi-safely let me input complex passwords in apps.

[EDIT] Another reply notes that the Apple camera app actually does scan QR codes out of the box. I haven't used an iPhone / iPod in years so made an incorrect guess.

[EDIT] Apparently some Google made Android phones do actually have some QR code support in the default camera app, but the Nexus 6P (Huawei, but under the now defunct Nexus program) certainly doesn't.

<comment><USER29> The Google Assistant/Lens stuff on Android phones has QR scanning integrated.

</comment></comment></comment><comment><USER30> Argh, no support for WPA Enterprise??? We're literally stuck with open unencrypted networks with captive portal sign on because the configuration process for WPA Enterprise is so convoluted. This would have been far more helpful if it supported the networks that actually have a bunch of configuration data rather than just an SSID and a password.

<comment><USER7> Perhaps you could offer some help with the project? :)</comment></comment>


SIMD in Rust - <AUTHOR> http://huonw.github.io/blog/2015/08/simd-in-rust/

<comment><USER2> On the last paragraph, for runtime selection of SIMD implementations, would that use something like STT_GNU_IFUNC? Perhaps exactly that on Linux, since it's compiling to ELF, after all.

I would have liked to see benchmarks compared to non-simd rust too. Thankfully this is in the source code. Here's what I get from cargo bench, fwiw:

             Running target/release/mandelbrot-aefed80dbc3f2841

        running 2 tests
        test mandel_naive ... bench:     802,072 ns/iter (+/- 25,106)
        test mandel_simd4 ... bench:     235,853 ns/iter (+/- 6,374)

        test result: ok. 0 passed; 0 failed; 0 ignored; 2 measured

             Running target/release/matrix-58de8ccd4bd58dcd

        running 6 tests
        test inverse_naive   ... bench:       4,967 ns/iter (+/- 251)
        test inverse_simd4   ... bench:       1,984 ns/iter (+/- 94)
        test multiply_naive  ... bench:       2,226 ns/iter (+/- 26)
        test multiply_simd4  ... bench:         897 ns/iter (+/- 32)
        test transpose_naive ... bench:         627 ns/iter (+/- 16)
        test transpose_simd4 ... bench:         361 ns/iter (+/- 7)

        test result: ok. 0 passed; 0 failed; 0 ignored; 6 measured

<comment><AUTHOR> Yeah, the runtime selection could indeed leverage ifunc when available (the actual dispatch isn't so interesting, since a simple branch on CPUID is perfectly workable in many cases: usually the dispatch is done when calling an expensive, long-running function, so a little bit of O(1) setup is in the noise). The really hard bit is getting dependencies compiled in multiple modes using different features, which will be especially important if/when Rust gets an ecosystem of libraries with SIMD utilities/functions. I hope we do get a wide variety of such things (rather than everyone just using the intrinsics directly, as in C/C++).

BTW, the benchmarks are comparing to non-SIMD rust: the graphs are of how many times faster the SIMD Rust code is than scalar Rust code (i.e. if they were plotted, the scalar bars would all be at 1.0).

<comment><USER2> Aha, the y-axis is "times faster than scalar", I totally missed that.

</comment></comment></comment><comment><USER3> To anyone interested, we have a rust port of our general purpose CUDA and OpenCL library: [https://github.com/arrayfire/arrayfire- rust](https://github.com/arrayfire/arrayfire-rust)

This is in extreme alpha stages and is written by people who are still coming to grips with rust. If anyone wants to chat about it or has some feedback, please drop by over here: [https://gitter.im/arrayfire/arrayfire- rust](https://gitter.im/arrayfire/arrayfire-rust)

<comment><AUTHOR> Nice! I dream of the days when Rust will be the best language for data parallelism, with an amazing ecosystem of libraries for threading, SIMD and GPU programming.

<comment><USER4> how much longer until I get to use it in something on my desktop that runs 3x faster?

<comment><USER5> Grab and build Servo? To quote [https://lwn.net/Articles/647969/](https://lwn.net/Articles/647969/) :

 _But the results are already impressive; the team said that Servo provides a 2x speed increase when rendering the CNN homepage and a 3x speed-up on Reddit._

</comment></comment></comment></comment><comment><USER6> This is _not_ a post about auto-vectorization in Rust (which would have been a lot more interesting!). The provided Mandelbrot Set example is algorithmically similar to loop unrolling with a 4x unroll factor. The strategy works well in this case because neighboring locations in the Mandelbrot Set tend to require similar numbers of iterations to compute.

<comment><AUTHOR> I'm sorry you didn't find the blog post as interesting as you hoped. :) As others have pointed out, I talk a bit about how rustc gets autovectorisation by leaning on LLVM in the "Explicit SIMD in the Compiler" section.

In any case, I agree the Mandelbrot example isn't so interesting: I included it because it is relatively simple, well-known and gives a pretty picture (i.e. good for a blog post where a single example isn't mean to be the focus). In fact, manual unrolling catering to autovectorisation is how Rust is currently top of the mandelbrot benchmark game[1], and explains the equal performance of the explicit-SIMD and scalar versions of spectral-norm on AArch64 (although the fact they aren't equal on x86 hints at the lack of guarantees around autovectorisation).

I find the examples like matrix inversion, nbody and fannkuch-redux are more compelling because the vectorised version is far less similar to the scalar one ("strange" shuffles, approximation of floating point ops and dynamic byte shuffles with precomputed values, respectively).

[1]: [http://benchmarksgame.alioth.debian.org/u64/performance.php?...](http://benchmarksgame.alioth.debian.org/u64/performance.php?test=mandelbrot)

<comment><USER7> This article could use some disassembly (and LLVM IR) from compiled code to see what a piece of Rust SIMD code looks like when compiled for different architectures. No doubt you've done this when debugging, but it would also be useful for the rest of us.

How well does it work in general? When you write SIMD code, can the compiler keep the values in vector registers or is there spilling going on?

<comment><AUTHOR> As you can see from the benchmarks, it works basically as well as industrial C/C++ compilers like Clang (if not slightly better) and GCC (although GCC's older and more optimised backend leaps ahead of the LLVM-based compilers in some cases).

I'm planning follow up posts which may involve more assembly/IR, but this is designed to be an introduction/high-level post, and the graphs are meant to serve as a summary/replacement for digging through reems of assembly.

</comment></comment></comment></comment><comment><USER8> This is cool! A lot of use of SIMD is working on a large array. How does the bounds checking not make this prohibitively expensive? Also, how are the alignment requirements managed?

<comment><AUTHOR> There is the `load` method on SIMD types, e.g. [1]. This does an unaligned load from any place within an array, with bounds checks, i.e. the safest always-works method.

The bounds checking isn't _that_ bad in and of itself, e.g. for f32x4 it is one bounds check for 4 elements and that bounds check is just a comparison and an extremely well-predicted branch. However, it definitely can be noticable and can inhibit other optimisations.

There's various routes this can be improved for sure, e.g.

\- `unsafe` versions of the `load` that don't bounds-check and/or do aligned loads,

\- functions that convert a `&[f32]` into a `&[f32x4]` (possibly with prefix and suffix &[f32]'s for unaligned left-overs),

\- tweaking the set of optimisation passes the compiler runs to handle the patterns that occur in Rust better (I believe rustc just runs the default set of LLVM passes, which are likely more tuned to C/C++ than Rust, e.g. the IRCE pass[2] should help eliminate more bounds checks but isn't enabled by default because presumably C/C++ don't use bounds checks enough for it to be worth it)

\- higher-level combinators/"algorithms" that avoid the need to do the loading/memory-management manually

[1]: [http://huonw.github.io/simd/simd/struct.f32x4.html#method.lo...](http://huonw.github.io/simd/simd/struct.f32x4.html#method.load)

[2]: [https://github.com/rust-lang/rust/issues/22987](https://github.com/rust- lang/rust/issues/22987)

</comment></comment><comment><USER9> Are there any preliminary attempts to integrate this into Servo yet? I'm curious to know the results, if so.

<comment><AUTHOR> I've done some experimental work, yes. However, I haven't found many places where it will obviously help a lot: it's very easy to use it for 3D transforms (which does a pile of 4D matrix ops, exactly what the matrix benchmarks in the post measure), but other things are less nice.

</comment></comment><comment><USER10> Weird question, where is the restrict keyword in Rust?

<comment><USER11> If I understand the keyword correctly, it's not really needed in Rust. The Rust compiler keeps very close track of who has a reference (many immutable or one mutable) to a value. There isn't really "accidental" aliasing.

<comment><USER12> That's awesome. It feels like this alone could, at least theoretically, make rust faster than C on average. Most C programmers are not even aware that the restrict keyword exists and don't use it in places where they could greatly benefit from it.

</comment></comment></comment><comment><USER13> My opinion, ensuring zero overhead and zero boilerplate code for calling external libraries will solve the SIMD problem. Anything worth vectorizing will be written in C/assembly.

<comment><USER14> Rust has inline assembly these days. Between that and approaches like this, I certainly hope using FFI for performance won't always be necessary.

<comment><USER13> I don't think inline assembly solves the problem. If I optimize any worthwhile problem, I would be smart to do it in a way that is accessible from every modern language.

<comment><USER15> Rust, being able to expose a C ABI and having roughly the same amount of runtime, is accessible from every modern language.</comment></comment></comment></comment>


May be a better way to read HN - <AUTHOR> https://googledrive.com/host/0B4xVwonJgym0QlBYRHN1VWtXUUU/hackernews.html

<comment><USER2> Have you tried feedly?

</comment><comment><USER3> Why is it better...?

<comment><AUTHOR> First, because I made it on my own.(not important)

Second, if you examine the algorithm of [http://www.hckrnews.com/](http://www.hckrnews.com/), you will see that, the "TOP 10" only shows 10 news per day, "TOP 20" only shows 20 news per day. "Homepage" means those news currently on the homepage. "All" means to show all the historical news (mixed the good with the bad).

Is that what users what? No.

I, a user, want to read all those top 30 news which used to be on the front page over the last 12 hours while I was not able to access the Internet. You may notice that HN uses a new rank algorithm, the front page changes frequently. Some excellent news cannot stay long. I don't want to miss them. So, the cron can help me to preserve those items. Remove duplicates, list out the latest 100 news (or even 1000 news). You can add cookie to show the "last read" <hr> line.

I am also curious about what are the best ranks of those news. Then, I added that feature.

My code meets all my needs, the user's needs. Therefore, It is better.

<comment><USER4> Well, I can see the point.</comment></comment></comment>