Android security in 2016 is a mess - <AUTHOR> https://cpbotha.net/2016/11/27/android-security-in-2016-is-a-mess/ <comment><USER2> One of the major major major issues is the hardware itself.

Let's jump back to the late 90s. You want to try Linux. You might partition your disk, or build a different machine and get a KVM or use an old laptop or add a second hard drive. In all cases, you can just install a Linux distro and see if it works. Maybe Ethernet or sound or something doesn't work. You could try a different distro with a newer kernel, maybe compile your own kernel with the modules you need, etc. But no matter what, it would at least boot (usually).

Intel x86/64 is a standard architecture. EFI makes the booting process even easier (although some motherboards still fuck this up; but for the most part fiddling with efibootmgr and turning off TPM will work. If not you can always turn on legacy BIOS and use the MBR). ARM is not a standard architecture. It's a spec that is sold to companies who all make their own SoC templates. There are things like Device Tree Config that make some of this more standard, but it's still far from x86/64\. Just read Torvalds rants on ARM to learn more.

Even if you make some standard Android builds with all the drivers for all phones in a massive 20MB initrd, a lot of kernels are fundamentally different with the way bus connections are defined. Manufactures take forever to release their kernel code, often under threats by people for GPL violations, and even then they are filled with tons of binary blobs and shims that connect their .o files so kernel calls.

Stuff like Plasma looks amazing. It only has like two phones it supports. If you look at any android rom project, you see totally different builds for every single device. If Intel had been like this, Linux would have died off in the 90s, for both servers and desktops.

Device manufactures depend on you buying new phones. They cannot support phones after two years or else it kills their profit margins. Planned obsolescence like this leads to waste (don't kid yourself, e-waste recycling gets shipping to Africa where kids remove components. A small percentage of phones actually get recycled).

TL;DR Mobile phones are based on unmaintainable and non-standard hardware (intentionally). I wrote a post on this a while back:

[http://penguindreams.org/blog/android- fragmentation/](http://penguindreams.org/blog/android-fragmentation/)

<comment><USER3> >Device manufactures depend on you buying new phones. They cannot support phones after two years or else it kills their profit margins.

This is the reason after using Nexus devices for 5 year, I will buy an iPhone and I will never ever look at Android again. My girlfriend switched from Galaxy note 4 to iPhone last year, and she is amazed how much iPhone experience is better than high-end Android experience.

2 year only update? Give me a fucking break, this total rip off. If I remember correctly even iPhone 5 does get update(and remember iPhone 5 is 5 year old phone, which will get new version of OS, not just security update, this alone is more than lifespan of Nexus or pixel device). Let alone the fact phone processors passed the threshold, phone produced after 2015 are almost as powerful as desktop from ~2005. My point is , if you don't play intensive games or any specific use case, an above ordinary phone would run browser,mail client, chat apps for more than 4 year without any issue. But companies trying to minimize lifespan just because of their own profit.

And my answer to them would be my middle finger.

They are totally screwing up customers.

<comment><USER4> "..remember iPhone 5 is 5 year old phone, which will get new version of OS, not just security update"

Yes, and remember that Apple intentionally writes OS updates that will run slower on their older devices, thus achieving almost the same thing but slightly less blatantly.

<comment><USER5> It maybe the case that OS updates run slower on older devices but I think it's a pretty strong statement to claim that this is "intentional", at least in the sense that you seem to be implying.

Do you have some strong evidence of this? Amusingly it's actually being tested in court (see the class action referred to in the link below):

[http://www.cbronline.com/news/mobility/devices/apple- accused...](http://www.cbronline.com/news/mobility/devices/apple-accused-of- sabotaging-old-iphones-with-upgrades-but-how-can-users-protect-them-4944274)

<comment><USER6> Some updates actually make older devices go faster, anecdotally.

</comment></comment></comment></comment></comment><comment><USER7> The IT industry's lack of attention to security (including confidentiality and system integrity) has enabled mass surveillance, by both businesses and government, and that problem now combines with the political situation to create a serious risk to people's rights.

Google has a very serious responsibility to implement effective security for Android, and it needs to be done urgently. They've known about it for years and put it off. The EFF has some basic specs here:

[https://www.eff.org/deeplinks/2016/11/tech-companies-fix- the...](https://www.eff.org/deeplinks/2016/11/tech-companies-fix-these- technical-issues-its-too-late)

<comment><USER8> Irritatingly, as much as Android security sucks, it's effective enough that it's hard to root most phones.

<comment><USER7> Secure against, but not for, end-users.

</comment></comment></comment><comment><USER9> So, as others have mentioned, the ARM chips out there don't really follow any common set of standards.

Some IP blocks, like USB controllers, can operate using a standard driver, but that's about it. Even for the bits that are migrating from PC land like PCIe and SATA, they aren't uniformly available or have standard driver interfaces across vendors.

And it gets worse. There's not even a standard means of discovering what all of the hardware is on the ARM System-on-Chip (SoC). You've just got to learn that this GPIO register is at this physical memory address from the reference manual.

And it gets even worse. There's no standard for hooking up the hardware peripherals either. You could have two phones with the same (for example Qualcomm Snapdragon 820 SoC) but they might have chosen to connect up different sets of peripherals, to different sets of ports. There might be three display output ports, which one did vendor X use?

And don't even get me started about power management. ARM Ltd doesn't do this, so every chip vendor has their own. Which is completely different. There is nothing close to what is available in laptop land.

What we need is a widely accepted standard for describing the on-chip peripherals, which can be read by the software. And we need a separate description for how the hardware is connected. And even all that isn't nearly enough.

This situation will not get better any time soon, IMHO.

<comment><USER10> Device tree is actually a reasonably flexible and precise way to describe all of that, the problem is that many vendors just don't use it.

</comment></comment><comment><USER11> What's frustrating is that People/Google keeps on blaming the OS nature of Android.

What they forget is that to put Android on a phone, practically you need Google's permission.

If Google cared, they could have made it part of the terms and conditions that it has to have security updates for five years.

They obviously don't

<comment><USER12> > They obviously don't

All my disdain for Google aside, I wouldn't as well, in a sense you are implying. I develop a product, I care about its quality, I allow you to use its code on your devices. Should I care how badly will you fuck up your own proprietary version of the product I granted you to use? Not the slightest, IMO.

<comment><USER13> The problem with this mentality is the idea that people using phones with their Google accounts with apps bought from the Google Play Store with email via (Google)mail which reports their location and other sensitive data to Google are not Google's customers and that Google has no responsibility to them.

<comment><USER14> This is the Microsoft problem, right? People bought tons of computers with Windows and they were loaded to hell with crapware.

It wasn't MS's fault any more than it was Intel's. They just sold a component to the company (Dell, HP, NoNameBrand, whatever) that put all the crud on the computer.

But it was a _WINDOWS_ computer so people blamed Microsoft and said "Why can't you fix this"?

They're trying, but because their product was so central to what was being purchased, as well as so obvious and in your face, that people associated them and they got blame they didn't deserve.

Same thing can (is?) happening to Android.

<comment><USER10> I would say that the problem here is the difficulty in <re>installing windows due to liscencing and the pile of drivers you need.

<comment><USER14> I don't think that's germane to the point I was making. How easy it is to reinstall Windows doesn't really factor in to how 3rd parties are able to change your reputation for you.

</comment></comment></comment></comment></comment></comment><comment><USER15> My 1st gen Moto G stopped receiving updates a while ago, but Cyanogenmod is still putting out new ROMs. It takes some level of understanding to put Cyanogenmod on a device, but nothing too challenging for the HN crowd.

If your phone has stopped receiving updates and you're not ready to buy a replacement yet, you can check if it's supported. It's a great thing that this project exists.

<comment><USER16> I was considering buying a new phone but I installed CM on my 2nd gen Moto E and that solved most of performance issues (so far, remains to be seen if it holds up.)

CyanogenMod has less bloat, and more actually useful core functionality, which means I need fewer apps. (For example, no need for something like Twilight since it has adaptive brightness/hue built-in.)

<comment><USER17> And runs default root so essentially is a security nightmare waiting to happen.

<comment><USER18> Their stock configuration doesn't even have root available unless you enable it in the hidden developer settings menu. Even then it works like SuperSU and such, non-root by default and popups to prompt for root access when an app requests it.

</comment></comment></comment></comment><comment><USER19> This article also linked to a post about Android disk encryption [0] that I found pretty interesting.

It goes through Apple vs Android encryption implementations, and talks about per-file vs full-disk. Android has only just now implemented per-file, but haven't made it granular enough to handle some very valid use cases and thus it has some pretty big holes. The worst part is fixing it means breaking 3rd party apps.

[0] [https://blog.cryptographyengineering.com/2016/11/24/android-...](https://blog.cryptographyengineering.com/2016/11/24/android- n-encryption/)

<comment><USER20> There was some discussion about this on HN [1].

Pretty interesting that it only got 183 votes. Usually when people talk about Apple's security holes, it generates much more discussion (criticism) and votes.

[1] [https://news.ycombinator.com/item?id=13031012](https://news.ycombinator.com/item?id=13031012)

<comment><USER6> Pointing out that Android is insecure is about as newsworthy as pointing out that the sun will rise tomorrow.

</comment></comment></comment><comment><USER21> Google decided to take on IOS by loosening the quality controls that help make the ecosystem secure. Google could easily require code signing and auditing for all non-google OS components, but it chooses not to because doing so would hinder phone sales.

The vulnerability in BLU phones was due to third party code packaged in the Android build for BLU phones. This was discovered because it sent texts back to china. Imagine if a slightly more sophisticated attack were included, how easy would it be to spot?

I'd estimate that there may be over 20 stuxnet level malwares lurking in the Android ecosystem, leveraging it to spread opportunistically deeper into infrastructure and onto higher value targets, etc.

And this doesn't even consider hardware level malware which could be included in bulk via alternative ASIC designs that end up on millions of phones.

</comment><comment><USER22> I brought this up in r/ProjectFi (a google/android subreddit) and was wholly ridiculed and dismissed "for not knowing anything". It seems brand loyalty has become similar to American politics with little-to-no middle ground or room for unbiased opinion.

I'm glad to see a realistic approach to mobile security. We need more scrutiny in this area.

<comment><USER23> ProjectFi only works with Nexus (and Pixel) devices, which aren't impacted by this.

So posting complaints about manufacturers which aren't Fi compatible on the Fi subreddit seems unusual and may have resulted in some of the negative feedback you received.

<comment><USER24> That may not be true. Fi works with (and was marketed with) the Nexus 6 which is EOL as of this month (Oct 2016). That means the OS version will be halted at Android 7, as I understand it. They may still receive security updates, but I don't believe Google has said how long they'll be doing that for.

<comment><USER25> It will get no more version upgrades, but it still has at least a year of security updates (depending on when it went out of the play store). I'm not saying new versions wouldn't be nice but personally that seems like a minor advantage.

</comment></comment></comment></comment><comment><USER26> Apple does have an iPhone in the traditional Nexus pricing zone. For $400 you get the iPhone SE - [https://www.apple.com/iphone- se/](https://www.apple.com/iphone-se/) \- which could be acceptable.

<comment><USER27> > the traditional Nexus pricing zone

There's an iPhone selling for 200-250$ right now?

<comment><USER26> I refer you to this chart - [http://www.droid-life.com/wp- content/uploads/2014/10/nexus-p...](http://www.droid-life.com/wp- content/uploads/2014/10/nexus-phone-pricing-history.png) \- from this article - [http://www.droid-life.com/2014/10/16/nexus-6-price/](http://www.droid- life.com/2014/10/16/nexus-6-price/)

$400 is very much traditional Nexus pricing zone.

<comment><USER27> The Nexus is sold at 400€ on day 1 of being available.

But we're not exactly talking about a new phone here – we're talking about phones released almost a year ago.

A fair comparison would be the cost of Nexus phones one year after being introduced.

Which is between 200€ and 250€ – as I can attest, as I just bought a Nexus 5X for that.

</comment></comment></comment></comment><comment><USER28> My 2c: After 3+ years of android (moto g w/ cyanogenmod, then project fi), I finally made the switch back to iOS. I'm beyond happy so far, and have the benefit of google not tracking my every step and key press. It is good when the manufacturer of a product you __pay __for has interests in line with your own.

<comment><USER29> I am happy for you, but please stop spreading FUD about Google/Android. I would like you to point out a single practical example of tracking in Android that you can't opt out of.

<comment><USER13> The problem isn't that you can't opt out of it. The problem is that Google cripples your phone if you opt out of it. Because Google's software is not designed to function properly without tracking. (For instance, your _local_ Google Maps install won't even remember where you live or your last location search if you turn search history off in the cloud.) Not having basic local- only functionality is silly, unless you're specifically trying to push people to stay in your tracking system.

<comment><USER30> Are iPhones significantly more functional without cloud connectivity?

<comment><USER6> Yes. Apple emphasizes data processing on the device itself to enhance privacy.

Additionally the tracking that does take place is generally less invasive, since Apple cares a great deal less about correlating your buying habits with your life history to sell you ads.

</comment></comment></comment></comment></comment><comment><USER31> I'm still using my over two years old OnePlus One with the Cyanogen that came pre-installed and I've been installing all the ota updates, being in security patch September now and QuadRooter showed no vulnerabilities. Pretty near for such a cheap phone.

What stops me from using iPhone is my opus music collection I want to carry with me, Rocket player and my pure hate towards iTunes.

</comment><comment><USER32> >What can we do? Buy an iPhone. No really.

I was looking to switch to Android, but even after briefly reading up on security/privacy on Android, I came to the same conclusion. It's too bad iPhones are pricey and/or despised among a subset of customers. I'm sure more users would vote with their wallets if they were aware of this.

<comment><USER33> I'd consider switching to an iPhone, but lots of my music is just MP3 files and I'd hate to lose the ability to play them on my phone. Using iTunes is not an option.

<comment><USER32> Yeah iTunes makes transfering libraries or switching PCs unnecessarily tedious. I've had a lot of problems with it. I also think Apple's product decisions (hard- and software-wise) are becoming more dubious, which is why I was looking to switch. Privacy and security still outweigh it by a wide margin which is why I won't switch for now.

As for the MP3 problem: There are 3rd party apps, where you can simply drag the files into the iTunes window and they'll sync without hassling much with iTunes.

<comment><USER33> I'm a Linux user. iTunes is not an option.

</comment></comment></comment></comment><comment><USER34> Actually Xiaomi (a Chinese vendor) has one of the best update models I have seen. They update MIUI weekly, every Thursday a new update with small changes/security fixes. If only more companies would adopt such a model we'd have a different situation.

<comment><USER35> Small problem with this model, if you want your devices to be Google certified. Google requires that every official software needs to be certified with Google (CTS and GTS verification need to be passed at a Google certified lab).

This might not be a big problem once you are rolling after your first certification, but it does create some overhead every time you need to release a software.

I don't think MIUI is Google certified.

<comment><USER36> Practically, what good is Google certification, if a majority of the devices in the wild are months or even years behind on security updates?

<comment><USER35> Well, if you are not certified, you are not allowed to pre install the whole suite of Google binaries and Google Market along with Google Pay and probably other services are not going to work on your device (at least you wont be able to make purchases).

<comment><USER37> Xiaomi phones come with the full google ecosystem of apps, so they are certified.

<comment><USER35> Oh okay, I didn't know that. Thanks.

</comment></comment></comment></comment></comment></comment><comment><USER38> I think this article is spot on. We should vote with our feet. Since Samsung do not wish to keep my phone secure, and so far they are averaging one update per year, my next phone is likely to be a pixel.

</comment><comment><USER39> "Vendors (LG, Samsung, Xiaomi, etc.), after selling you their phone, have no incentive to keep your phone's software up to date with Google's fixes" \- that means that they have no concept of long-term (long term = more than a month) customer satisfaction. If that is the case (and that very well might be), the future is very bright for Apple.

<comment><USER40> However, people will endure much pain and problems to save a few dollars. Reminds me a bit of the "inexpensive footwear" Dilbert cartoon: [http://dilbert.com/strip/2007-05-01](http://dilbert.com/strip/2007-05-01)

<comment><USER39> Fair point!

</comment></comment></comment><comment><USER41> Has anyone here given a shot to NoPhone?

[https://www.thenophone.com/](https://www.thenophone.com/)

[https://www.thenophone.com/products/the- nophone](https://www.thenophone.com/products/the-nophone)

</comment><comment><USER7> Can anyone comment on the Blackberry Priv? The article mentioned it, and I know their security goes down to hardware level and what they claim is a secure manufacturing process, but all I know is what they claim ...

<comment><USER42> I purchased one used, mostly to see what it is like but also to have as a backup phone Just In Case. The hardware is a mixed bag: the screen is gorgeous, the keyboard is a bit narrow but allows for very accurate typing, the back of the case is flimsy, and the CPU is underwhelming. The software is great though! You get a very up to date (second only to Google brand phones w.r.t. security updates) OS and the Blackberry software (like Hub) is an actual improvement over the stock Android experience.

Basically, if you want a secure Android phone and wouldn't mind trading older hardware for a physical keyboard, it is the phone for you. Otherwise, you might want to look at a Pixel device.

As to security at the hardware level, I'm not aware of the PRIV featuring anything special outside of the TrustZone TEE stuff that most recent Android phones have.

<comment><USER7> I found some notes from when I was looking into the Priv at the end of last year. They lack detail, but maybe are a good starting point for someone.

* Root of trust: unique crypto keys at the hardware level: Somehow implemented in way that guarantees Blackberry through supply chain, they claim. Maybe Blackerry supplies own chipset, w/ key included?

* Verified Boot and Secure Bootchain: Verifies integrity of all layers, from hardware to software. Uses hashes, crypto signatures

* hardened Linux kernel with numerous patches and configuration changes to improve security

* FIPS 140-2 compliant full disk encryption for data and applications

* Monthly updates through the Google Play store (only?)

* DTEK: "a single dashboard to monitor and control application access to your microphone, camera, location and personal information."

* Can customize each app's privacy settings, like in Android 6

Also of potential interest, from a competitor:

* [http://www.tomshardware.com/news/copperhead-nexus-more-secur...](http://www.tomshardware.com/news/copperhead-nexus-more-secure-priv,30565.html)

\----

Sources:

* [http://blogs.blackberry.com/2015/10/priv-is-for-private-how-...](http://blogs.blackberry.com/2015/10/priv-is-for-private-how-blackberry-secures-the-android-platform/)

* [http://www.zdnet.com/article/the-many-ways-blackberry-beefs-...](http://www.zdnet.com/article/the-many-ways-blackberry-beefs-up-android-security-on-the-priv/)

</comment></comment></comment><comment><USER43> Could this be one of the reason why Google is working on Fuchsia, their new OS with a micro-kernel (Magenta)?

<comment><USER13> It's hard to tell. There's indications it's meant to work on any form factor, but at least initially their focus seemed to be on desktop-esque hardware like the Intel NUC, an Acer slate tablet that runs x64, etc. and then with the Raspberry Pi for ARM support. There hasn't yet been a clear indication that they're working on phone support for it, or when that would be.

It's still super early for Fuchsia though, so it's anyone's guess.

<comment><USER43> I agree, it's still early and there's not much info at the moment. Still, in the maxwell repo, there's mentions of "GPS acquirers" and in the SysUI repo, there's icons for battery, airplane mode, screen rotation and cellular signal.

Nothing really specific for phones since these things can be found in some tablets and laptops, but apps in Fuchsia are made with Flutter, so it's interesting since it was made to make cross-platform mobile dev easier on Android/iOS.

</comment></comment></comment><comment><USER44> Simple, don't buy this crap.

</comment><comment><USER45> I'm in the market for a new android these days. Looking at the too tightly with Google coupled Pixel, the Samsungs S6/S7 (Samsung led me down without updates once), the Fairfone 2 (thick and ugly) and others.

It's a mess.</comment>


San Diego Hacker News Meetup 39 (Fri 3/29) - <AUTHOR> http://anyvite.com/2leckgtiss <comment><USER2> It'd be nice if one of these happened in the southern US occasionally. I vote Atlanta, Nashville, or Charlotte.

<comment><AUTHOR> It would be nice if there were a site dedicated to Hacker News meetups. It would be a lot easier to organize meetups when there were a place to go look for them and chat about them.

</comment></comment><comment><USER3> I'm too shy for these things!!! :)

<comment><USER4> I am wondering if people actually come at 7:30? I might cheat and go to the bar first and then show up around 8 or maybe 9, already buzzed. At that point I will have no problem talking to people. Heh.

I actually think the whole thing might be backwards. Like maybe it would be better to spend most of the time in the bar, then go across the street to get a coffee before you have to drive home.

<comment><AUTHOR> Most people tend to show up for part 1 at the bakery, but there's usually a couple people that show up late or only show up for part 2 at O'Brien's. Feel free to show up whenever you'd like. See you Friday!</comment></comment></comment>


Complex numbers in JavaScript - <AUTHOR> https://beta.observablehq.com/@mateogianolio/complex-numbers-in-javascript <comment><USER2> Thinking for some time about refactoring Quantum Game ([https://github.com/stared/quantum-game](https://github.com/stared/quantum- game)), including its complex tensor operation part (plus some "boring but important" like jspm.io -> webpack, actually using Vue or React vs the no- framework mess, etc). If anyone interested in collaboration, I am happy to talk!

<comment> s-macke You might as well use WebAssembly for the task. C and C++ have good native complex number support.

<comment><USER3> They don't really, they tried to glue IEEE semantics onto their complex numbers, so they're largely broken in the modern era of auto-vectorizing compilers.

<comment> s-macke Interesting. Under what circumstances are they broken?. Inf, NaN?

<comment><USER3> Here's an article on it that was posted awhile back: [https://medium.com/@smcallis_71148/complex-arithmetic-is- com...](https://medium.com/@smcallis_71148/complex-arithmetic-is- complicated-873ec0c69fc5)

The gist is that you can get Nan+jNan for some operations where you wanted "infinity", so to do things their way, you have to insert a NaN check after multiplication for example. This isn't too bad by itself (it's just a bit mask), but it completely borks the vectorizer.

</comment></comment></comment></comment></comment><comment><USER4> I like how you moved to Complex16Array for reduced memory overhead and improving CPU cache performance. I'd probably take a close look at your get method's "return new Complex16(...)" call and see if those object instantiations are consuming a lot of CPU time and memory churn on their own.

We use quite a bit of complex numbers in Javascript under the hood within CircuitLab for doing frequency-domain circuit analysis of electronic circuits like filters and amplifiers. In that mode, a circuit simulator is essentially solving a system of complex-valued equations using a sparse matrix solver that accepts complex numbers, so the complex arithmetic routines are some of the potential performance hot spots. You'd want to unroll a lot of the intermediate manipulation without creating a lot of new objects in the middle! I've written a short complex numbers tutorial here: [https://www.circuitlab.com/textbook/complex- numbers/](https://www.circuitlab.com/textbook/complex-numbers/)

<comment><AUTHOR> Yes, I decided to add the instantiations for readability. It would be more efficient in a production setting to do the operations directly on the raw data.

Thank you for the link!

</comment></comment><comment><USER5> Cool!

I once wrote a much hackier version of complex arithmetic in JavaScript [0]. It was to support a visualization of the complex derivative [1].

I found it useful to think of a complex number as a point in R^2 that operates under some different rules. I used Mathematica's `ComplexExpand` to translate from traditional notation for complex numbers [2].

[0]: [https://github.com/chnn/multivariable-derivative- viz/blob/ma...](https://github.com/chnn/multivariable-derivative- viz/blob/master/app/utils/complex-numbers.js)

[1]: [http://people.reed.edu/~ormsbyk/projectproject/assets/posts/...](http://people.reed.edu/~ormsbyk/projectproject/assets/posts/multivariable- derivative/multivariable-derivative-viz/)

[2]: [https://reference.wolfram.com/language/ref/ComplexExpand.htm...](https://reference.wolfram.com/language/ref/ComplexExpand.html)

</comment><comment><USER6> Not much to say about the complex implementation itself; seems pretty good, and it's as 'bare-metal' as you can get in browser javascript. It's not a great abstraction, and very little error checking.

However, I _really_ like this literate programming style. You've got live editing, and legible output, in the form of little TeX blocks. It's a really nice way to define, describe, and teach little libraries like this. Well done.

</comment><comment><USER7> Why Complex _16_? What does 16 mean here?

<comment><AUTHOR> 16 bytes of memory for one complex number! I could've called it Complex128, but that's a mouthful.</comment></comment>


Tech's Two Philosophies - <AUTHOR> https://stratechery.com/2018/techs-two-philosophies/ <comment><USER3> This article is making strategies out of tactics.

For example, Gmail's new autocomplete apparently helps people write email faster. It doesn't write the email for you. Why isn't that a bicycle for the mind? It's partially helping you do something you could do anyway, but faster. (And maybe better, if you're still learning English?)

Maybe someday, for some emails, Gmail will be able to ghostwrite the entire body of an email for you? But that's just a matter of technical competence, not a change in strategy. Tech companies will change tactics based on what's feasible.

But maybe the big change is when you let the machine take full, mostly- unattended responsibility where safety is on the line (real driverless cars).

<comment><USER4> Yeah, automation vs. amplification is a perennial issue, not sure it maps that well to companies.

The difference is control, whether the task is sufficiently predictable and well-understood. Similar to how much of a task can be hidden behind an API - the specific usage determines acceptable performance metrics.

autocomplete/suggest is a T9/Clippy offspring, the latter by MS, and closer to automation.

BTW: to be fair, when Steve Jobs demoed the iPhone, he used it to prank a cafe for 2000 lattes. Whereas Google pranked a business automatically.

<comment><USER5> > _automation vs. amplification is a perennial issue_

How is that even a difference? Amplification is done by automating subcomponents of what you're trying to do. If you automate away the entire task, it means you amplify the human working one level up.

</comment></comment></comment><comment><USER6> _The business model follows from these fundamental differences: a platform provider has no room for ads, because the primary function of a platform is provide a stage for the applications that users actually need to shine._

Please tell Microsoft this. Windows 10 and Skype are both littered with ads. But I guess this is what happens when operating systems become commoditized. All of the other major operating systems are either free for anyone to install (Linux) or freely avallable to OEMs (Android/ChromeOS) or bundled with hardware (Apple's operating systems).

<comment><USER7> > Windows 10 and Skype are both littered with ads.

I keep reading this on HN, from a Windows 10 box with no ads. And I've searched! Where are the ads?

Either I accidentally installed Windows 10 No Ads Edition, or you're spreading baseless FUD.

<comment><USER6> They are constantly trying to sell subscriptions to O365 and One Drive.

They also sell third party ads in Skype - their included messaging app. Can you imagine Apple selling ads in iMessage?

<comment><USER8> > They are constantly trying to sell subscriptions to O365 and One Drive.

There is exactly the same argument against Apple trying to sell iCloud.

WRT ads in MacOS Skype. I can't seem to find them (I am not a seasoned Skype user though). Is it Windows+Skype specific?

<comment><USER6> Straight from Microsoft....

[https://support.skype.com/en/faq/fa10942/why-are-there- adver...](https://support.skype.com/en/faq/fa10942/why-are-there- advertisements-for-other-companies-in-skype)

 _Occasionally, you may see advertisements for other companies in Skype (if you 're using the free version of Skype). Advertisements help keep Skype free for millions of users, and these advertisements will not disrupt your Skype experience in any way._

Skype is bundled with Windows as _the_ default messaging platform just like iMessage for the Mac.

</comment></comment></comment></comment></comment><comment><USER9> The attempt to create a dichotomy between the two philosophies is a bit thin when you frame the question around products instead of "computers"

All four companies care deeply about creating compelling and useful products for users. That gets spread across many different domains for all of those companies.

Someone can love and find value in a piece of software just as easily as they can a piece of hardware.

</comment><comment><USER10> Interesting that the author didn't mention Intelligence Augmentation/amplification[1] in the article. IA is often contrasted to AI that it makes humans more able to do their job.

[1] [https://en.wikipedia.org/wiki/Intelligence_amplification](https://en.wikipedia.org/wiki/Intelligence_amplification)

<comment><USER11> I think that's the Apple/Microsoft philosophy.

<comment><USER5> I don't think so. IMO, Apple and Microsoft are just less aggressive in taking all the agency away from their users. They do that too, but they don't put as much focus on it as Google does.

</comment></comment></comment><comment><USER12> Those who have watched Halt and Catch Fire might be reminded of the competition between Rover & Comet, which are two companies with different philosophies in a similar space.

</comment><comment><USER13> So, on the one hand one approach is to replace the mind (take it out of the loop and "let the robots take over". The other is to "augment the mind and enable it to do more". One sounds better then the other.

The robotic choice unfortunately has a very authoritarian or centralist vibe. That is, it's taking over for the person with but with central tutelage. The other the tutelage is in the person using the augmenting tech.

Obs it remains to be seen how things pan out.

<comment><USER5> Both approaches are really equivalent on the technical level. Augmenting the mind is done by automating and abstracting away lower-level stuff - taking the mind out of the loop and letting the robots take the details over.

And the problem with _all_ those companies is agency. It seems they all try to minimize user's agency, by making it purposefully impossible to control or dig into underlying automation. They differ by the effort put into taking control away from the user, with Google being the leader in blatantly dumbing down and isolating everything.

<comment><USER13> Thanks for framing the issue more succinctly. Yes the issue is removing agency from people coated in the sweet nectar of convenience.

</comment></comment></comment><comment><USER14> An interesting and thoughtful exploration. I'd like to add Jack M. Balkin an Jonathan Zittrain's notion of information fiduciary to the pot:

[https://www.theatlantic.com/technology/archive/2016/10/infor...](https://www.theatlantic.com/technology/archive/2016/10/information- fiduciary/502346/)

Also very interested in Hans Jonas and his work. Any recommended readings?

</comment><comment><USER15> This appears to be saying that some companies want to be your framework (and so own the problem); other companies just want to be your library.

<comment> real-hacker Nice analogy. We want tech to help us only when we need them, not to tell us how to live our lives.

</comment></comment><comment><USER16> > _In Google's view, computers help you get things done — and save you time — > by doing things for you. Duplex was the most impressive example — a computer > talking on the phone for you_

But who is "you"? Obviously, "Duplex" talks on the phone on behalf of people needing an appointment, ie, not everyone. And specifically, not the people tasked with answering the phone, who are duped into thinking they're having a human interaction when in fact they're talking to a machine. It's even worse than that. We're used to telling machines to do things for us. But the people answering Duplex calls are being told what to do, by a machine.

When GPS became popular I had a friend who absolutely refused to get one because, she said, she "wouldn't take instructions from a machine".

At the time, I thought that was the silliest thing ever.

Now I completely get her point.

<comment><USER5> It is a silly example, because GPS (or rather, GPS-based nav systems) really, 99% of the time, is better than you at navigating. Also, the technology itself is pretty much purely informative - a map with a path displayed. Voice instructions are optional and something implicitly understood as friendly directions, not orders.

I think most examples of machines telling people what to do still happen in context of paid work, and even there, quite often there's a good reason for that.

Personally, my worry with Duplex is all the abuse - er, growth hacking - <USER2> will happen.

<comment><USER17> There are good, honest use-cases for this technology though: for example a food ordering platform that needs to gather holiday openings hours for hundreds of thousands og restaurants globally. These restaurants are not tech- savvy: so the only alternative is using people to call them.

<comment><USER5> I don't disagree. I'm not condemning the whole product right now. I have only two primary worries:

1/ Huge increase in amount of robocall spam.

2/ Given the discussion on the Duplex HN thread, I'm starting to seriously worry people will try and do machine-to-machine communication through Duplex, which is something completely idiotic and wasteful, but might also become easier than doing the right thing (agreeing on an API).

</comment></comment></comment></comment><comment><USER18> The "bicycle of the mind" platform vs aggregator argument is a bit contrived: the author is conflating features built on top of platforms with the platform itself. Most of the examples listed (Google Photos auto-edit, Maps suggestions, Gmail compose) are typically features built on top of platforms that can be (and are) used without these features.

Instead, I would think of these tools as an electric bicycle of the mind (to borrow from the article): the purpose of the motor is to help you on steeper hills. It is inherently still a bicycle.

Maybe stop trying to shoe-horn multi-decade companies with thousands of employees into ill-fitting philosophical silos? I'm all for arguments for/against companies but retro-fitting them into narratives and then proclaiming A is better than B is disingenuous.

</comment><comment><USER19> "Civilization advances by extending the number of important operations which we can perform without thinking of them. "

Quite sure that automation is closer to this than bicycling.

<comment><USER20> That's an especially apt quote from 1911 by Alfred North Whitehead.

[https://en.m.wikiquote.org/wiki/Alfred_North_Whitehead](https://en.m.wikiquote.org/wiki/Alfred_North_Whitehead)

</comment></comment><comment><USER21> Is there a third philosophy of decentralisation which has different incentives and new constraints that are more to our liking in avoiding a dystopian future.

</comment><comment><USER22> > I believe that we need to design technology to help bring people closer > together. And I believe that that's not going to happen on it's own. So to > do that, part of the solution, just part of it, is that one day more of our > technology is going to need to focus on people and our relationships. ...

If Landmark Education (or one of its many descendants) focused on software technology, that would arguably be a key message. I wonder if that's just a coincidence.

<comment><USER23> Off-topic, but:

Do you know if Landmark is a cult? Is it something to be worried about? A close friend has recently gotten super involved with it and has done all three courses and is evangelizing it pretty hard, he's normally not someone who gets sucked into this kind of thing easily though.

He also doesn't seem "brainwashed". I've googled about the organization and have my reservations, but I'm not sure if it's legitimately helpful with some bad marketing strategies or Scientology/Waco/Jonestown

<comment><USER22> No, they're not a cult. And unlike Scientology, their courses aren't insanely progressively expensive.

On the other hand, the organization's mission is transforming the world. Just as their website says. And a key aspect of that is hard-core evangelism.

Just as Zuckerberg said in that quote :)

</comment></comment></comment><comment><USER24> facetiously, ff a computer does things for you it frees up your time to watch more ads on the computer, if a computer helps you to do the things you need to do more efficiently it frees up your time to get off the computer.

</comment><comment> mark-r The ratio of articles to ads in that illustration is completely backwards.

<comment><USER25> A large percentage of the articles are ads.

</comment></comment><comment><USER26> > collective action... the best form of which is bounded by the popular will

This notion is dangerous. Popular will brings fascism, authoritarianism, discrimination, instability, and uncertainty. Popular will is not and never has been a sustainable form of authority.

Political economists have a term, 'institutions' to describe sustainable forms of authority, like laws, morality, family structure, culture, language, literacy, technical education, career stability, and pedagogy.

Institutions like "don't be evil", and "we will never sell your data", are the entire reason why the current batch of tech earned enough trust to exist at all. "Do the right thing", and "bring people together", however nice they sound, appear to be easily manipulated by popular will, which will be either their downfall, or ours.

<comment><USER27> Can you elaborate how popular will brings authoritarianism? Seems like a complete non-sequitur.

<comment><USER28> > Can you elaborate how popular will brings authoritarianism? Seems like a > complete non-sequitur.

Someone once said, 'Democracy must be more than two wolves and a sheep voting on what's for dinner'. Democracy, in its purest form, is arguably mob rule.

That's why constitutional democracy - democracy with limited government and the rule of law, including human rights - is the ideal and the foundation of modern government. The majority, the popular will, can't vote to take away your free speech and other rights, no matter how unpopular you are. Remember the foundation of the U.S. is the assertion that 'all men' have "inalienable rights", and that governments exist to protect those rights.

<comment><USER29> It's not proven that " constitutional democracy" is the ideal. The "foundation of modern government" says that a Black person as no rights, but counts as 3/5ths of a person for their master's voting rights.

<comment><USER28> > It's not proven that " constitutional democracy" is the ideal. The > "foundation of modern government" says that a Black person as no rights, but > counts as 3/5ths of a person for their master's voting rights.

Great point; I agree that I shouldn't have used the word "ideal", because it's not at all ideal. Constitutional democracy sucks; it's just much better than any alternative. (I think Churchill said that.)

<comment><USER30> >...Constitutional democracy sucks; it's just much better than any alternative. (I think Churchill said that.)

He said something like that, but he didn't say he originated the thought. In the house of Commons, he once said:

"...Indeed it has been said that democracy is the worst form of Government except for all those other forms that have been tried from time to time."

[https://richardlangworth.com/worst-form-of- government](https://richardlangworth.com/worst-form-of-government)

</comment></comment></comment></comment></comment></comment><comment><USER31> >Zuckerberg, as so often seems to be the case with Facebook, comes across as a somewhat more fervent and definitely more creepy version of Google

At this point I think the difference between what FB and Google are doing is superficial marketing. The abuse potential of their technologies grows with every new peephole that they drill into your life.

While people become increasingly dependent on said technology for a growing proportion of life's activities, FB and google have repeatedly demonstrated that they do not have our best interests in mind, and serve primarily to exploit overreaches in privacy and trust.

Not to be melodramatic, but it's like some weird kind of slavery.</comment>


Ask HN: Hacks for buying a home - <AUTHOR>

Next week I'm moving to an apartment in the Boston area with a six month lease with intent to find and buy a place before my lease is up.<p>I'm a first time home buyer and while I've read a bit on the subject, I'm worried I'll make costly mistakes due to my inexperience. Any tips, tricks, or hacks you'd recommend to help me and other home buyers make good decisions? <comment><USER2> Note, not a hack, just a friendly piece of advice... Unless you plan to live in the same place for at least 5 years, do not buy, keep renting/leasing. A few years ago, you could buy and sell multiple times and each time not lose money because of rising property values. That time is gone, it may come back, but it may not. In a more normal market, closing costs and Realtor fees take up most appreciation of a place and it may take 5+ years of paying your mortgage (and thus reducing your principle) to sell the place without taking a loss when you include those fees at selling time. This is important if you are still young and have that itch to move around and find a place to call "home".

Yes there are a ton of other reasons why to buy a house and how to do it minimizing costs (which I am sure others will chime in with), but that one above is my favorite reason NOT to buy a house that I think everyone should think about.

</comment><comment><USER3> You got 6 months... get a real estate license. Seriously. The requirements vary by state, but they're not hard to get, and you get to save 3% on the final price of whatever you are buying. Also access to the MLS system (the only thing that's really worth it). You can use the data to become better educated about what and where you are buying and maximize your purchase.</comment>


Show HN: WhoWorks.At - Professional Heads Up Display - <AUTHOR>

Protip: http://whoworks.at/download to skip the sign up process
This weekend I built a simple Google Chrome extension at Startup Weekend NYC. The idea was to create a professional heads-up-display that you can use to see your connections all over the web. I ended up having to hack my own company search feature for LinkedIn since they don't have an API method for that available yet. I ended up using their internal autocomplete API.
I've been in touch with some developers there and from what I hear a Company Search is a very frequent request and they plan on offering in the future.
Let me know what you think, feature requests and bug reports welcome. <comment><USER2> Clickable: <http://whoworks.at/download>

This is dope. Using this now...

</comment><comment><USER3> Looks great! Reminds me of [https://chrome.google.com/webstore/detail/golfffpdocdndgkahj...](https://chrome.google.com/webstore/detail/golfffpdocdndgkahjdgofkbcoiefdmo)

<comment><AUTHOR> Someone pointed that one out to me after I started. I really like being able to see faces, sometimes I recognize people without remembering names.

</comment></comment><comment><USER4> Nice extension. Couple of small suggestions

\- When the extension icon is clicked, a blank screen appears for a few seconds while the api is fetching the data i assume. A loading or some kind of notification would be nice.

\- I am not sure if the ability to right click on profile links and opening in a new tab is disabled. Without that opening multiple profiles is pretty hard.

<comment><AUTHOR> Thanks for the feedback, loading message is on my todo list now.

</comment></comment><comment><USER5> Via Twitter, whoworks.at just let me know that they also plan to provide Firefox and Safari extensions, as well as a bookmarklet version: <https://twitter.com/#!/whoworksat/status/59728620968615936>

<comment><AUTHOR> Definitely plan to provide more ways to access WhoWorks.At, any other ways you want to use it?

Two other feature ideas:

1\. Alerts you of your network when you check in to a venue on foursquare.

2\. Allow note-taking on contacts and companies and possibly provide an integration with Rapportive data.

</comment></comment><comment><USER6> I tried it on www.yahoo.com (as a former Yahoo! employee) and it said that Yahoo Shine wasn't in my network. Something odd there, maybe someone listed Yahoo Shine's address as yahoo.com or something.

<comment><AUTHOR> That's because the search I'm doing "yahoo" doesn't return Yahoo! as the most relevant result, it's a shame but a limitation of not having an API for company search at LinkedIn. Other ideas for searching are welcome.

I started a feature request thread on LinkedIn's developer forum: <http://developer.linkedin.com/thread/2993>

</comment></comment><comment><USER7> I'm in the Navy. The vast majority of people I know are in the Navy. When I visit navy.mil, whoworks.at tells me that 1,566 people on linkedin work at Navy Federal Credit Union, and confirms that I don't know any of them.

</comment><comment><USER8> Minor nitpick, it's "Head Up Display".

</comment><comment><USER9> awesome job john!</comment>


Verizon: "Chrome and Firefox Have Limited Internet Capabilities, Unlike IE" - <AUTHOR> http://imgur.com/VG3Ov

<comment><USER2> That's from a chat support employee, not a web developer. They aren't hired for their stunning technical knowledge.

<comment><AUTHOR> true, but their recommendations do come from above somewhere. this is the second conversation I've had with them where I was told Chrome and Firefox are lackluster. Who knew IE was the way of the future?

</comment></comment><comment><USER3> hahaha... very nice.</comment>


M44 (Cyanide Device) - <AUTHOR> https://en.wikipedia.org/wiki/M44_(cyanide_device) <comment> drew-y I live in Idaho. A couple years ago a boy and his dog where walking in the foothills near their house and ran into one. It killed the dog and nearly killed the kid. These are a terrible idea. They should especially never be placed so close to a city like it was in this case.

<comment><USER2> Let's also ban bug bombs. Maybe canned raid too. Ever get that stuff in your face? Hooo boy. Cant have that now can we

<comment><USER3> Do you often find raid attacking people in the wild?

</comment></comment></comment><comment><USER4> I highly recommend the book Coyote America: A Natural and Supernatural History by Dan Flores. I had no idea of what coyotes went through in the recent history in America.

<comment><USER5> Thank you! Flores is excellent, I loved Caprock Canyonlands, but I'd never heard of this book.

</comment></comment><comment><USER6> This is presumably here because the Trump Administration just reauthorized their use: [https://www.ktvq.com/news/national-news/trump- administration...](https://www.ktvq.com/news/national-news/trump- administration-reauthorizes-use-of-cyanide-bombs-to-kill-wild-animals)

<comment><USER7> (Editing, I wrote from memory and wasn't quite right.)

There's evidence that suggests[1] that efforts to control Coyote populations by killing them off are less effective than we thought - as the Coyote population drops in one area it creates a vacuum filled by coyotes from another area + increased reproduction, resulting in areas that underwent "coyote control" having spent a lot of time/money/effort and being back where they started at the end of it.

I can't verify a word of this, but I found the possibility interesting.

(I'm generally against any indiscriminate traps like these. I'm fine with hunting coyotes, but a device like this is too much of a risk to non-coyotes - as other commenters have already pointed out.)

1\. [https://www.npr.org/2019/06/14/730056855/killing-coyotes- is-...](https://www.npr.org/2019/06/14/730056855/killing-coyotes-is-not-as- effective-as-once-thought-researchers-say)

<comment><USER8> Why shouldn't someone be able to place these on their own property? Sure it creates a coyote vacuum but by definition said vacuum has less coyotes in it than the surrounding area. You then only have to deal with the ones that show up rather than an entire population. These seem useful for people who raise chickens and other small livestock that would be very attractive to coyotes. Obviously they need to be used carefully, like anything else that's designed specifically to be poisonous but these seem safer and more targeted than leaving out a dead varmint that's been laced with poison.

<comment><USER9> _Why shouldn 't someone be able to place these on their own property?_

For the same reason I'm not allowed to duct-tape a shotgun to a chair and tie the trigger to my doorknob.

<comment><USER10> That's what the law calls a "mantrap" if anyone wants to do more homework.

</comment></comment></comment></comment></comment><comment><USER11> Similar devices and approaches to species specific killing are highly important in environments like NZ and parts of Australia where introduced invasive predators are killing vulnerable native species.

</comment><comment><USER12> Sounds like a very bad idea.</comment>


Ask HN: Recommended reads for an electronics beginner? - <AUTHOR> I've seen the influx of small single board computers (e.g. Raspberry Pi, Vocore, Orange Pi) and have a bunch of ideas for projects for these that I'd like to try. But the majority require some modifications to the board.
For example, I'd want to add a second ethernet port to the Vocore2, but I know it's not as simple as soldering an ethernet port to the appropriate pins on the SOC (e.g. some magnetics are required). Ultimately I'd like to be able to design my own board.
I've got a strong CS, Linux, networking background, and understand the basics of electronics, but don't know where to begin when it comes to electrical engineering.
Any book/tutorial recommendations or advice gratefully received! <comment><USER2> [https://www.amazon.com/Make-Electronics-Discovery-Charles- Pl...](https://www.amazon.com/Make-Electronics-Discovery-Charles- Platt/dp/0596153740)

[https://www.amazon.com/Make-Electronics-Journey- Amplifiers-R...](https://www.amazon.com/Make-Electronics-Journey-Amplifiers- Randomicity/dp/1449344046/ref=pd_sbs_14_t_1?_encoding=UTF8&psc=1&refRID=T2QJ0MQRN1750KEBAEYX)

[https://www.amazon.com/Art-Electronics-Paul- Horowitz/dp/0521...](https://www.amazon.com/Art-Electronics-Paul- Horowitz/dp/0521809266/ref=sr_1_1?s=books&ie=UTF8&qid=1481618045&sr=1-1&keywords=art+of+electronics)

[https://www.amazon.com/Learning-Art-Electronics-Hands- Course...](https://www.amazon.com/Learning-Art-Electronics-Hands- Course/dp/0521177235/ref=sr_1_3?s=books&ie=UTF8&qid=1481618045&sr=1-3&keywords=art+of+electronics)

[https://www.amazon.com/Practical-Electronics-Inventors- Fourt...](https://www.amazon.com/Practical-Electronics-Inventors-Fourth- Scherz/dp/1259587541/ref=sr_1_6?s=books&ie=UTF8&qid=1481618045&sr=1-6&keywords=art+of+electronics)</comment>


"I Am Adam Lanza's Psychiatrist": A Response from the Mental Health Trenches - <AUTHOR> http://www.xojane.com/issues/a-response-to-i-am-adam-lanzas-mother-from-a-doctor-in-the-trenches-i-am-adam-lanzas-psychiatrist

<comment><USER2> For starters, psychiatrists in the US could show a little more compassion that what I have heard countless times: the patient is fit into a limited diagnosis of illness, given pills, and told to come back in two weeks.

Psychiatry and psychology are not practiced that way in most of the Western world. There's a much stronger emphasis on psychotherapy and talk therapy and an understanding that it can take a damn long time to help a patient in distress.</comment>


Ask HN: What do guys think about the Chrome web store? - <AUTHOR>

I am just curious what people here think about the upcoming release of Chrome webstore. In particular, do you think it will give someone who does not have much of a prior portfolio to be able to leverage the platform to distribute web apps to the masses, just as the iphone ecosystem has proven itself to be? <comment><USER2> I think it's going to be awesome. Between Google's store, Mozilla's, and projects like PhoneGap which allow web apps in native app stores, the Web is far from dead; I personally believe it's becoming the defacto development platform.</comment>


Lazy Loading Assets - <AUTHOR> http://blog.mightyspring.com/post/91287181277/stop-what-youre-doing-and-lazy-load-your-assets

<comment><USER2> Browsers have optimized for "eager" loading. Link your images, CSS, and JS just like you did when you first learned HTML, then configure your server's caching headers. For JS, there's the async attribute.

</comment><comment><USER3> Article presents incorrect information as truth.

Optimize for cache hits, then no requests happen!

<comment><AUTHOR> That may work for a high-traffic site like Google, but what about sites that aren't in the Alexa top 10 (or even 1000)? ;)

<comment><USER3> if your user goes to your site twice, he has your assets in cache.

<comment><USER4> It's not good practice to rely on a user's cache. If they visit your site twice in a span of a day, they may have already cleared their cache or pushed your files out with other sites' files.

This article demonstrates a pretty good method to reduce unnecessary byte transfer which will ultimately speed up page loading.

<comment><USER2> Caching is still a good idea, because if a user decides to browse to another page on the same site in the same visit (or refresh/post a comment), a significant fraction of the data required for it has already been loaded. If a user does come back, there's always a chance that your stuff will still be in the cache.

</comment></comment></comment></comment></comment><comment><USER5> Lazy loading leads to more requests, which leads to more latency, slower apps. Better to handle this stuff as a build step with RequireJS or browserify.

<comment><AUTHOR> It leads to more requests, but after page load, and only when you need the code. Why load code your app isn't necessarily going to use?

<comment><USER6> Because you're making dubious gains saving a couple KB of bandwidth by sacrificing the responsiveness of your app when you introduce an additional round trip for each new piece of code. It may look fine for you, but there are plenty of people that don't have super-low latency, high bandwidth internet connections.

<comment><USER7> It's important to understand that there are tradeoffs with lazy loading. There's a spectrum, right?

On one end, you could serve all of your js bundled with browserify on the first page load, which, for SPA's will frequently block rendering until the entire bundle is downloaded, parsed, and executed. If your bundle is small, who cares? Once your app grows to a large enough size, that initial delay might no longer be worth it.

On the other end, you could serve almost no assets with the initial page load, and request what you need when you need it. Your initial render will be blazingly fast but any first interaction might be slowed by the latency involved in going to get the relevant assets needed to execute the interaction.

Somewhere in the middle you may find a solution involving sending half of your assets initially and requesting the other half when you need them.

It's not helpful to write off various methods of asset loading because of assumptions about latency, bundle size, or DOMContentLoaded event delay. The important part of this article is that it speaks to the various approaches to this problem. I'm guessing the author took the time to weigh the pros and cons of these approaches, chose this one which particularly works for him, and wrote about it to share his findings.

This isn't a trivial problem with one solution. Dig into the performance of your apps while wearing multiple hats and take what works best for your situation ;)

<comment><USER6> Well put. My (and, I think others) concern with the article is that it advocates splitting all your code into separate files (great for maintainability and managing your code base), but then loading each of them individually on demand (probably a bad idea for all the reasons everyone's mentioned). I'm a lead dev on a fairly large JavaScript app, and we've taken that middle route - we use build process with Grunt and RequireJS to compile our 300+ individual script files into a handful of concatenated files divvied up by page/component. Our application is large enough that loading everything at once (even concatenated/minified/gzipped) doesn't make sense, but RequireJS/the r.js optimizer made it really easy to both figure out our usage pattern and consolidate our core set of modules. The process we use creates a different version of our app script for each entry page, and then each page has its own separate module that can be loaded on navigation.

<comment><USER7> Definitely, and I think your concerns are valid, but if you found that loading each file on demand yielded the optimal performance for your app, wouldn't you go with it? Additionally, I think the method the author is presenting can be very well suited to both partial bundles and individual files. For what it's worth, you and I are in similar positions and it sounds like we have very similar approaches with our own apps. As long as readers understand that this is one possible solution to a nontrivial problem, I'm happy with it.</comment></comment></comment></comment></comment></comment>


Covid Trend Tool: Compare regions and past rates - <AUTHOR> https://nextlevelcoder.com/covidash <comment><USER2> any visualization that compares totals rather than normalized data with regard to population or testing is useless, if not misleading</comment>


Spotify is removing music from politically controversial bands - <AUTHOR> http://weev.livejournal.com/414647.html <comment><USER2> An example of why I like to own my things.

Also this this _the_ weev?

<comment><USER3> Yes, it is me.

Also, there is no place left I can buy that band's music. Their CDs are all out of print. Spotify was literally the only way I could give them revenue besides going to their shows, and they are on a different continent now.</comment></comment>


Bitcoin Network Capacity Analysis – Part 1: Macro Block Trends - <AUTHOR> https://tradeblock.com/blog/bitcoin-network-capacity-analysis-part-1-macro-block-trends

<comment><USER2> The block size debate is very active among the Bitcoin community right now. There are strong opinions for and against raising it.

Here is a good podcast episode with opinions representing both sides (Gavin Andresen and Peter Todd):

[https://letstalkbitcoin.com/blog/post/lets-talk- bitcoin-217-...](https://letstalkbitcoin.com/blog/post/lets-talk- bitcoin-217-the-bitcoin-block-size-discussion)

</comment><comment><USER3> why wouldn't every miner optimize to accept up to the hard 1mb cap so they can get more fees?

<comment><USER4> The reward for solving a block is 25 bitcoins, but the fees, which are added to that, are usually less than 1 bitcoin. Fees are only a few percent of miners' income, and the miners have several factors to weigh up when they decide how many transactions to put in a block

\- The risk of making orphan blocks. A larger block may take slightly longer to propagate across the network, and that slightly increases the chance that another miner will generate a valid block during that delay and propagate it faster. When that happens, the first miner misses out on the block reward and fees, about $5500 today

\- A miner could put no transactions in a block, and still get the 25 bitcoin block reward, but if they do that, they are hurting confidence in the bitcoin network, and devaluing their investment into hardware and skills and the value of bitcoins they own. If you drag the chart left to see the history at [https://tradeblock.com/blockchain](https://tradeblock.com/blockchain) then you may see some miners who put zero transactions in a block or very few transactions, but it is not so common

Orphan blocks are an important issue in the debate about block size increases which the article linked to is discussing. Increasing the block size is likely to increase the rate of orphaned blocks, though there are proposals that might mitigate that risk.

The ratio of fees to block reward is likely to change in future, influenced by many factors including block size, and there are many competing theories about what will happen as that ratio changes, which run the gamut from doom to success. The block reward is automatically cut in half every 4 years, and the long term plan for bitcoin seems to be based on the fees increasing in value to eventually replace the block reward

<comment><USER5> > A miner could put no transactions in a block, and still get the 25 bitcoin > block reward, but if they do that, they are hurting confidence in the > bitcoin network

I don't think that's true at all. Even if some would not clear any transactions people would still be okay with that for as long as the rest does. And there are definitely some zero transaction blocks being minted.

<comment><USER4> _And there are definitely some zero transaction blocks being minted._

Yes, there definitely are. As I said, if you read my comment.

</comment></comment></comment></comment><comment><USER6> While the number of Bitcoin block chain transactions is increasing, their total value is not.[1] Volume in US dollars has declined slightly over the last year. We may be past "peak Bitcoin".

If blocks fill up, transactions with higher fees get through first. So the free market will solve this problem when necessary. It's in the interest of miners that fees go up, and the big miners control the block size, so a block size increase is unlikely.

Bitcoin's block reward halves next year, which instantly halves mining income. Bitcoin was designed so that when it became large enough, fees would support mining. Next year, fees become more important, and pressure for higher fees will increase. The system is functioning as designed.

[1] [https://blockchain.info/charts/estimated-transaction- volume-...](https://blockchain.info/charts/estimated-transaction-volume-usd)

<comment><USER7> This is a red herring to the issue of the current block size, which currently limits the network to only be able to perform 2.7 transactions a second.[1]

This means that if the country of Greece (11m) were to use Bitcoin, each person would only be able to make 1 transactions every 48 days.

That's also assuming no competition with the fees. The "Free Market" design that prioritizes blocks with larger fees would mean that some blocks stay in the queue for much longer than 48 days. Just for the country of Greece.

[1] [https://bitcointalk.org/index.php?topic=941331.msg10360199#m...](https://bitcointalk.org/index.php?topic=941331.msg10360199#msg10360199)

</comment></comment><comment><USER7> This block-size hurdle isn't new and is one of the ongoing examples of how Bitcoin is suffering from _Tragedy of the Commons_.

The offshore miners control Bitcoin, and they are independently and rationally aligned with their own self-interest and profit (as they should be). When it comes to forking changes that are not directly beneficial to the miners (block size), it's nearly impossible to get a consensus, even if it means making Bitcoin a better currency.

When you consider a change that makes it more difficult for a miner or cuts into a miner's profits, like increasing the supply to counteract deflation and hoarding, then you start to realize why Bitcoin is still having these issues.

<comment><USER8> You're inaccurately oversimplifying the mining market.

The most important thing that refutes any notion of "miners control the network" is that, if some miners adopt a ruleset unfavourable to users, users will simply stop accepting whatever that miner is mining as Bitcoins, and their profits will go to zero (because they're mining some Bitcoin-Like but not really Bitcoin currency). If users start using a different ruleset than miners, the miners have to switch over or they will have no one to sell their coins to.

<comment><USER7> Nope. It's neither inaccurate or oversimplified to say the miners have control, when the forked fix to the issue in the article requires a 51% consensus amongst the miners.

To say that the entire bitcoin userbase will band together to form a concensus to avoid miners is to turn the same blind eye to rational human behavior and _tragedy of the commons_. It's just as much wishful thinking and hand waving as thinking the miners will act solely out of benevolence for Bitcoin.

<comment><USER9> It's not a tragedy of the commons. Whether we grow the blocks or keep them the same, the network continues to function just fine. It's a matter of values and how to grow the network. If the miners do nothing, Lightning Network and off- chain networks will route most transactions outside of the blocks. Some in the network want Bitcoin only to be used for settlement, instead of for every payment. We've actually had larger blocks in the past (32 MiB I believe) and it was reduced to combat spam.

<comment><USER7> That's not a counter-argument to _tragedy of the commons_.

You just described off-chain transactions which aren't considered Bitcoin, and if anything are only a temporary fix to the block-size problem.

Tragedy of the commons exists because _any_ of the solutions to a number of problems in the Bitcoin implementation need to be directly profitable for the miners in order to happen. For block-size and supply, they are the opposite of profitable for the miners.</comment></comment></comment></comment></comment>


Show HN: Windria – Local wind/wave forecasts for sailors visualized in a heatmap - <AUTHOR> https://windria.net/map <comment><USER2> I've long pondered about accurate hyperlocal (200m?) terrain/wind/tidal models for inshore yacht racing - including measuring the frequency & direction of shift, and combining forecasting/modelling with live readings from local weather stations.

Most harbours have fairly accurate bathymetry data, and accurate terrain data is available. Wind data, and the wind & tide flow modelling is the complicated part -- afaik most data is only accurate to 10-20km?

</comment><comment><USER3> Wave heights are missing. The text is problematic when it mentions the "NAM RAP" model. There isn't such a model, there's the NAM which runs every 6 hours out to 84 hours, and there's the RAP which runs every hour for 18 hours.

</comment><comment><USER4> This would actually be useful to me in the center of the continental US. I haul big sheds down the highway, and being able to travel on a day with the wind behind me allows me to go 20mph faster.

</comment><comment><USER5> [https://www.windyty.com/](https://www.windyty.com/) has similar functionality, but in my point of view a much nicer UI

</comment><comment><USER6> Much nicer visualization than current sites. Will share with my sailing friends.

</comment><comment><USER7> Amazing work ! May I ask where do you get the data source ?

<comment><USER8> The same source as any other forecast-related websites. For wind, temperature, waves, etc there is just THE ONE: [https://en.wikipedia.org/wiki/Global_Forecast_System](https://en.wikipedia.org/wiki/Global_Forecast_System)

There is a very big industry build on it. All are happy this data is complex, but very complete and very free :-)

</comment></comment><comment><USER9> Wow, looking neat.</comment>


Looks like those IBM layoffs have started - <AUTHOR> https://gigaom.com/2015/01/28/looks-like-those-ibm-layoffs-have-started/

<comment><USER2> Good luck getting anyone to admit that Cringley was right.</comment>


Ask HN: Subpixel font rendering disabled on macOS Catalina? - <AUTHOR> Is anyone else experiencing this? Fonts look markedly worse on my external monitor after upgrading to Catalina. For example, here is a screenshot from Finder showing a clear lack of subpixel (RGB) anti-aliasing:
https://imgur.com/Hq5Txm0.png
Subpixel rendering is still 'enabled' in the defaults system:

  ~ % defaults read -g CGFontRenderingFontSmoothingDisabled
  0
 <comment><USER2> Same behavior here with CGFontRenderingFontSmoothingDisabled set to 0 as well. Tried the old AppleFontSmoothing defaults hacks too, but those just make things look worse.

Perhaps there is some new defaults string in Catalina that can be set? It seems like CGFontRenderingFontSmoothingDisabled set to 0 still has some effect on Catalina, but it's not subjectively the same result as was the case on Mojave.

<comment><USER2> Honestly things look subjectively better with CGFontRenderingFontSmoothingDisabled set to the default value of 1 on Catalina. Others seem to agree:

[https://forums.macrumors.com/threads/the-subpixel-aa- debacle...](https://forums.macrumors.com/threads/the-subpixel-aa-debacle-and- font-rendering.2184484/post-27859216)</comment></comment>


The connection between modern slavery and ecological disaster - <AUTHOR> http://blog.longreads.com/2016/03/08/your-phone-was-made-by-slaves-a-primer-on-the-secret-economy/ <comment><USER4> The Congo probably has the most depressing history of any country on earth. First their was the horrific Belgian colonization. Then, more recently, the Congo war in the late 90s was the most violent conflict since World War II with an estimated 2.7 Million to 5.4 Million dead [1] and hardly anybody knows about it. It's even referred to as Africa's World War. There was one documentary about it: Kisangani Diary[2]. It's about the bleakest film I've ever seen.

The war came about after the dictator Mobutu died and the chaos and aftermath of the Rwanda genocide spilled over the border. All the surrounding countries saw enormous natural resource wealth to be claimed and started funding and equipping their own proxy militias to seize power. The whole thing was a huge chaotic mess that destroyed what little infrastructure there was in the country.

[1] [https://en.wikipedia.org/wiki/Second_Congo_War](https://en.wikipedia.org/wiki/Second_Congo_War)

[2] [https://www.youtube.com/watch?v=mbD76cWdBHc&list=PLDD34C9812...](https://www.youtube.com/watch?v=mbD76cWdBHc&list=PLDD34C9812AF2DB09)

<comment><USER5> I've never even heard of this, and I definitely pay attention to the news. This is basically WWIII in terms of overall combined casualties and... I'm just speechless... I have never even heard of it. Absolutely incredible.

<comment><USER6> I'm not saying that it isn't a tragedy but it's an order of magnitude less than WWII[1], or am I missing something?

[1] [https://en.wikipedia.org/wiki/World_War_II](https://en.wikipedia.org/wiki/World_War_II)

<comment><USER7> It's the largest single armed conflict since World War II, and yet it has less visibility than the Korean War (2,859,574 casualties [1]), Vietnam War (1,450,000 casualties [2]), or the Iraq War (654,965 casualties [3]). It's even worse known that the deaths through famines induced during the Cultural Revolution in China (400,000, rough estimate [4]).

[1] [http://www.cnn.com/2013/06/28/world/asia/korean-war-fast- fac...](http://www.cnn.com/2013/06/28/world/asia/korean-war-fast-facts/)

[2] [https://en.wikipedia.org/wiki/Vietnam_War_casualties](https://en.wikipedia.org/wiki/Vietnam_War_casualties)

[3] [http://web.mit.edu/CIS/pdf/Human_Cost_of_War.pdf](http://web.mit.edu/CIS/pdf/Human_Cost_of_War.pdf)

[4] [https://books.google.com/books?id=YpV7vbvclfgC&pg=PA354#v=on...](https://books.google.com/books?id=YpV7vbvclfgC&pg=PA354#v=onepage&q&f=false)

<comment><USER8> It has less visibility than those because there were no western nations (and hence western media) involved with boots on the ground. Or planes in the air, for that matter. The other thing is that the bulk of deaths were knock-on deaths from things like famine and disease rather than military violence.

However, it is still a good indication of just how little attention we pay to Africa here in the west, that people in general don't even know that it existed.

<comment><USER9> Also when British Empire and similar were in Africa stopping the wars and the like it was considered racist so now the done thing is to leave the Africans to it.

<comment><USER8> 'stopping the wars' wasn't considered the racist part. 'taking all their stuff and not giving much back' was.

And for the Congo in particular, their experience under Belgian (well, Leopold II) rule was so horrific that other colonial powers exerted pressure on Leopold to give it up. The death toll in the Congo at that time was about the same as for the recent Second Congo War (plus the war's aftermath). Given the population of the day, it's estimated that the Belgian rule in the Congo halved the population, whereas the recent war 'only' claimed a bit less than 10%. The Belgian rule also left a lot of people maimed without hands, since there were bounties on hands, and the payors weren't too fussy about where they came from. Leopold II is one of history's lesser-known evil kingpins. After Leopold was forced to hand it over for management elsewhere, it became a more regular colonial story of exploitation for little in return.

In short, for Congo in particular, the modern day is better than it's experience in colonial times, even with the recent war.

</comment></comment></comment></comment></comment></comment></comment><comment><USER10> Ethical supply chains will become a badge of honor in the future for the upper class who can afford it... but the masses consuming the majority of the products driving the price down to slave-labor proportions will require a cultural change.

There is something deep in human nature that sees something it wants and narrows our thoughts to just getting that item. Maybe its a holdover from our Hunter/Gatherer instincts. But we seem to be using it to hack our minds to ignore the damage we do to our fellow humans in the process of acquiring.

We may need to aspouse minimalist ideology at a mass scale (something I see in fellow Gen Yers.)

<comment><USER11> Around half of all eggs laid in the UK come from free range hens (1) - <USER2> believe this increasing proportion is partly due to a sticker requirement to mark eggs with 'Eggs from caged hens'.

I wonder what effect there would be on the electronics industry if all iPhones in the EU had to be sold with a prominent sticker 'Produced with slave labour' ? I honestly think that regulations can nudge the behaviour and expectations of 'the masses' through this kind of labelling.

(1) [http://www.rspca.org.uk/adviceandwelfare/farm/layinghens/far...](http://www.rspca.org.uk/adviceandwelfare/farm/layinghens/farming)

<comment><USER12> The problem is that "free range" is easy to define.

Which criteria should we label for that are meaningful in other countries across the world?

Made by workers:

Receiving Minimum wage (which one)?

Receiving Free healthcare?

Working a maximum of 8 hours / day?

Over the age of 16? 18?

Don't get me wrong, I'm all for it, but defining what is acceptable is not easy. Don't forget that in most western countries no access to free healthcare would be defined as unacceptable. Also in some poor countries 14 year old "kids" have fought against anti-child labour laws because they were the only provider for their family and there is no help from the government regardless of your condition.

<comment><USER13> "Free range" actually isn't so easily defined, and most "free range" eggs, come from hens living in conditions that most reasonable people would still consider absolutely appalling.

<comment><USER14> Yea, now I aim for pasture raised which is essentially the gold standard here in the USA and implies the hens lived primarily outdoors and ate what they wanted.

Lots of time "free range" is the same as caged, just... without the cages. The hens are too fat to go anywhere anyways.

</comment></comment></comment></comment></comment><comment><USER15> >"Slavery in granite quarries is a family affair enforced by a tricky scheme based on debt. When a poor family comes looking for work, the quarry bosses are ready to help with an "advance" on wages to help the family settle in. The rice and beans they eat, the scrap stones they use to build a hut on the side of the quarry, the hammers and crowbars they need to do their work, all of it is provided by the boss and added to the family's debt. Just when the family feels they may have finally found some security, they are being locked into hereditary slavery. This debt bondage is illegal, but illiterate workers don't know this, and the bosses are keen to play on their sense of obligation, not alert them to the scam that's sucking them under."

This is very much _not_ slavery. It's terrible, it's fraud, and it's arguably some form of servitude, but it's not slavery. Calling it slavery is an insult to people who are owned and chained.

 _Edit: much, much later at the very end of the article there is a more in depth accounting of what 's happening. It seems to be mostly fraud tied with corruption, but there are accounts of straight servitude and some of the men say they were not able to leave. If this testimony is accurate, i'd say it's slavery._

<comment><USER16> What's the material difference between being forced to work to pay off an unpayable debt and being forced to work because of a legal fiction of ownership of another human being?

There isn't one. This article is about slavery as a real, physical condition, not a legal condition.

<comment><USER15> You can leave. You can get up and walk away and deal with the law, and possibly go to jail. In this case, it'll 'free' them because they are being defrauded according to the author. A slave cannot leave. A slave will not be jailed, a slave will be returned to their master and forced to work again.

It's fucked up, but it's not slavery.

<comment><USER17> The right to choose is only ever as good as your BATNA, it does not confer power in and of itself. Also, are you sure they're aware of their ability to leave without government-enforced intervention?

<comment><USER15> It's not an issue of whether they are aware or not. By the author's own admission, they are only staying because of their own sense of duty, that the debt is illegal, that they are being defrauded.

It's one thing to say, workers are being shorted, cheated, etc, but if your headline is "your iphone is being built by slaves" then you should be referring to, at least, people who are being held against their will. Not simply people who are confused about the law and are working for free because of this confusion.

<comment><USER18> So you're saying they are confused about their legal rights? As in, they are threatened with violent arrest, imprisonment, loss of their children, and torturous prison conditions. You don't see the powerful coercion to perform bonded labor here?

Never mind that the slavemongers are generally incredibly abusive on their own because their victims believe they will have no recourse from the government.

It's slavery.

</comment></comment></comment></comment></comment></comment><comment><USER19> Sometimes I wonder how much, if anything, has really changed since this fellow ruled the day:

[https://en.wikipedia.org/wiki/Leopold_II_of_Belgium](https://en.wikipedia.org/wiki/Leopold_II_of_Belgium)

Other than that machinery for exploitation has been geographically dispersed and greatly optimized, such that these days, our slaves don't drop like flies quite so often, but instead are kept around in a state of minimal sustenance -- so that their skills can be most efficiently extracted without all the, you know, rotting corpses, piles of severed limbs & ensuing bad PR.

<comment><USER20> For those interested in Leopold's rule: "The crime of the Congo" by Sir Arthur Conan Doyle [https://archive.org/details/crimeofcongo00doyliala](https://archive.org/details/crimeofcongo00doyliala)

<comment><USER21> "King Leopold's Ghost" is also very good

</comment></comment></comment><comment><USER9> Well, your phone probably wasn't actually built by slaves. However it probably uses the element tantalum some of which come from ore mined in Congo and some of that is probably mined by slaves.

The reason slavery goes on there is armed thugs from neighbouring counties (Rwanda and Zaire) have invaded and are forcing the locals to hand over the ore which is not a good thing. Though the solution is not to feel guilty about using phones, it's to kick the thugs out.

<comment><USER19> _The reason slavery goes on there is armed thugs from neighbouring counties (Rwanda and Zaire) have invaded and are forcing the locals to hand over the ore which is not a good thing._

I disagree with you, there.

The reason slavery goes on there is because we _choose_ to permit it. It may be a passive choice, rooted in (willful) ignorance for some, or a sense of powerlessness ("I can't help those people, what do my own decisions matter?") for others. But if we really wanted to, we could just stop buying (at least discretionary) products which, by this point, everyone knows to be sourced from conflict zones, and human suffering that are inseparable from them.

<comment><USER9> Well, it goes on because no one stops it. The obvious people to stop it would be the government of the country but they are not very effective. Failing that maybe some international body could help, the UN perhaps. I've also got a start up idea along those lines...

</comment></comment></comment><comment><USER22> Obligatory mention of Fairphone: [http://fairphone.com/](http://fairphone.com/) who try to get rid of slavery in as much of their supply chain as possible (and detail exactly how far they get there transparently in their blog).

</comment><comment><USER23> I won't cut and paste my comment[1] from the last time the cobalt-from-the- Congo issue made the front page, but I do want to repeat that I think it's a mistake to generalize from a single horrible situation.

Imagine we found a rich vein of cobalt ore in Tim Cook's backyard: The Congo would still be in an unimaginably terrible state, but at least that part of our phones would be humanely supplied. What's next on the list? My guess is that it would be substantially less upsetting, and probably much easier to address.

[1] [https://news.ycombinator.com/item?id=10930445](https://news.ycombinator.com/item?id=10930445)

</comment><comment><USER24> This is the fundamental problem with the "but we can't price externalities because growth solves poverty" argument. [https://news.ycombinator.com/item?id=11228262](https://news.ycombinator.com/item?id=11228262)

Many times what _appears_ to be growth is really just inefficient forms of wealth transfer where we're seeing only one side, causing more poverty than it solves.

The word "externalities" don't mean that no one pays. It means that powerless third parties pay (who are unable to consent) -- poor children and the elderly breathing diesel fumes because their family can't afford to live far from the dump, or the indigenous people displaced/exterminated to raise cattle in slashed-and-burned rainforests, or the slave laborer, or our grandchildren who will have to deal with the effects of climate change and species extinction. Externalities aren't on a ledger somewhere, but it makes them no less real.

Environmental protection is actually just humanity's enlightened self- interest, a fact the human/"environment" distinction serves only to mask.

</comment><comment><USER25> > "It's hard to understand this much chaos, but imagine a city where the > police and government have simply run away and five or six mafia gangs are > running everything, each based in a different neighborhood. The thugs have > total control and can do whatever they please, so just crossing from one > part of town to another means paying a tax or risking attack or even > enslavement. It's a kind of feudalism, but these feudal lords have no sense > of responsibility toward the people on their turf and there is no overlord > king to keep order. For the thugs the townspeople are more like stolen > cattle; there's no investment beyond the effort of capture and little reason > to keep them alive. Now imagine that when the government sends in the > National Guard to confront the mafia, the Guard just carves out its own > territory, settles in, and becomes another mafia. That's the Eastern Congo."

I genuinely don't understand this.

Inasmuch as while the history of humankind seems to be one rife with violent domination of one group of people by another there is usually some overriding order enforced. Or if not an overarching order then at the very least some general mindfulness to a larger picture.

Even when comparing to organized crime in the States...there are rules and a set of "laws" that are generally followed. Not exactly and not without violation, but there is a group enforcement of a base set of standards that provides the stability required to find growth and development.

But in so much of Africa is seems that there is nothing but senseless savagery and violence.

The wealthier nations absolutely feed it...but if I'm recalling my history of the continent correctly there was plenty of violence and savagery long before the first European colonists invaded and exploited the indigenous peoples.

<comment><USER9> It was pretty much the human condition until the invention of laws, writing and so on. Europe used to be pretty bad a few centuries back. Progress is just taking a little longer to reach central Africa but it probably will with the spread of the internet.

</comment></comment><comment><USER26> One common solution to this problem is "close your eyes and pretend it doesn't happen".

It's very effective.

<comment><USER27> it also has a long and proven track record of success

</comment></comment><comment><USER28> Lots of discussion but no simple solutions. If somebody really wanted to help, there is an elegant way to correct this problem - airdrop AK47s and ammunition and let democracy take its course. Something similar to what the brits did over France in WW2 with small crude pistols.

</comment><comment><USER29> Correlation between slavery and lack of care for environment laws is obviously correlated — but why does the author link them together as if one happens when and only when there is another? They just have the same cause (willingness to break the law/ethics for profits) and I assume that there's a LOT of businessmen acting outside of the law in terms of ecology who are not slavers.

</comment><comment><USER30> The author probably does not know that 97% of rare metals necessary to produce phones is controlled by China, and China export quotas. And Chinese workers are by no means slaves. They are proud members of their society and enjoy benefits of it.

</comment><comment><USER31> We replaced the baity title with the part of the subtitle that seems representative of the article. If someone can suggest a better (more accurate and neutral) title, we can change it again.

Submitters: the HN guidelines ask you not to use the original title when it is misleading or linkbait.

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

<comment><USER32> This isn't so much an article as it is an excerpt from a book that is linked at the bottom. If you are looking for a pithy expose on the link between slavery, iPhones and environmentalism, you won't find it here, but the book does seem like a good read on the subjects it brings up.

</comment></comment><comment><USER33> Replace "advance on wages" with $200+K of educational loan in US Higher Ed system.

Or Replace "advance on wages" with "Free Higher Ed system" EU but 50%-70% tax for life.

Are we all slaves, one way or the others? :-)

Minus a few 1% who become the masters with luck, family connections or intelligent.

<comment><USER34> No, we aren't all slaves despite how many edgy kids like to think. We can choose our job or not to work. We can decide not to pay our debts. I guarantee you if these people chose to run away or not pay they would be beaten.

<comment><USER35> You can't really choose not to work though. Ask anyone to honestly answer if they would work if they didn't have to and the answer is obvious: No one wants to work, not really. In America there are basically two choices for the majority: work or suicide

</comment></comment></comment><comment><USER30> Technically, robots are slaves. But is that wrong? Phones production is made by robots snd only assisted by humans.

<comment><USER36> Robot actually means "slave" in Czech language.

<comment><USER37> And hey, the english word "slave" comes from the ethnic group that gave us the Czechs, but I don't think that says much about modern Czechs or modern slaves.

<comment><USER38> Amazingly, also cognate with "ciao" (via Italian "schiavo").

[https://en.wiktionary.org/wiki/ciao#Etymology_3](https://en.wiktionary.org/wiki/ciao#Etymology_3)

[https://en.wikipedia.org/wiki/Ciao#Etymology](https://en.wikipedia.org/wiki/Ciao#Etymology)

</comment></comment></comment></comment><comment><USER39> For anyone who happens to actually be doing this or something like this, that is keeping back wages to enforce slavery, its worth noting that the rust of your wealth will burn like fire against you. Torture and torment await you without repentance and turning to Jesus Christ. For everyone pleading the cause of the poor and needy: God delights in you're doing that - <USER3> reward.</comment>


Software and craftsmanship - <AUTHOR> http://moishelettvin.blogspot.com/2006/12/software-and-craftsmanship_05.html <comment><USER2> I could use something which cost about 1/10th what this knife did to the same end. But it's handmade...

Amazon has those knives at 55 dollars. Maybe he's using a different model, but you aren't going to get a handcrafted knife for 55 dollars. It would take at least a day to make from raw materials, and that's not much of a salary in France.</comment>


BSD libc contains a buffer overflow vulnerability - <AUTHOR> https://www.kb.cert.org/vuls/id/548487 <comment><USER2> The flaw appears in the oldest version of the source on GitHub, circa 1994; "BSD 4.4 Lite Lib Sources." Who knows how far back it really goes.

It's really basic; get the kernel to cough up a bad sockaddr and bcopy will scribble on your memory. That may seem far fetched but then you remember LKM and maybe not. Incidentally OpenBSD dropped LKM support in 2014 [1], presumably for hardening purposes.

[1] [https://news.ycombinator.com/item?id=8554003](https://news.ycombinator.com/item?id=8554003)

<comment><USER3> 4.3BSD-Reno, basically unchanged since 1990 until yesterday.

[http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD- Reno/src...](http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD- Reno/src/lib/libc/net/linkaddr.c)

Personally I'm more worried about the function returning obuf, a pointer to a stack variable in link_ntoa.

<comment><USER4> That's not on the stack.

<comment><USER3> Oh indeed. Static it is...

</comment></comment></comment></comment><comment><USER5> Unrelated: In responsible disclosure, is it standard to notify the biggest vendor first? I noticed apple was notified on Oct 10th, quite some time prior to the other vendors.

<comment><USER6> Perhaps it was discovered by an individual on OS X, reported (by the individual) to Apple, reported (by either the individual or Apple) to CERT, then CERT looked at it, found the other affected operating systems, and reported it to them?

There's a number of ways this particular "ordering" could have occurred.

<comment><USER7> It's possible it was reported to Apple because they have a vulnerability bounty program, so they individual who reported it could get a reward. That might create an incentive to report it to larger targets who may run larger bounty programs.

</comment></comment></comment><comment><USER8> It'll be interesting to know if OpenBSD is affected. They don't seem to have responded yet.

<comment><USER9> tedu wrote a post about it: [http://www.tedunangst.com/flak/post/who-even- calls-link-ntoa](http://www.tedunangst.com/flak/post/who-even-calls-link-ntoa)

</comment></comment><comment><USER10> Top-Right corner shows this is Sponsored by the Department of Homeland Security...nice to hear that agency is doing something good for regular people's security.

from [http://www.dhs.gov/office-cybersecurity-and- communications](http://www.dhs.gov/office-cybersecurity-and-communications) "The Office of Cybersecurity and Communications (CS&C), within the National Protection and Programs Directorate, is responsible for enhancing the security, resilience, and reliability of the Nation's cyber and communications infrastructure."

<comment><USER11> _" The Office of Cybersecurity and Communications (CS&C), within the National Protection and Programs Directorate, is responsible for enhancing the security, resilience, and reliability of the Nation's cyber and communications infrastructure."_

That used to be part of the NSA's charter, more or less, before they decided that playing offense was more fun.</comment></comment>