When Lightning Strikes Thrice: Breaking Thunderbolt 3 Security - <AUTHOR> https://thunderspy.io/ <comment><USER2> I skimmed the paper and while the research looks solid, just in terms of the digging they did and the documentation they're providing, this website _really_ buries its lede: if you've got a Macbook running macOS, the Macbook IOMMU breaks the DMA attack, which is the thing you're actually worried about here.

Additionally, regardless of the OS you run, Macbooks aren't affected by the Security Level/SPI flash hacks they came up with to disable Thunderbolt security.

<comment><USER3> Last time Tunderbolt was broken (Thunderclap [1]), it was found that the Linux driver didn't activate the IOMMU. I assume that's since been fixed.

[1] [https://lwn.net/Articles/782381/](https://lwn.net/Articles/782381/)

<comment><USER4> It seems to do that now:

[https://christian.kellner.me/2019/07/09/bolt-0-8-with- suppor...](https://christian.kellner.me/2019/07/09/bolt-0-8-with-support-for- iommu-protection/)

<comment><USER5> What's the relationship of the "bolt" project with the default driver support in Linux?

</comment></comment></comment></comment><comment><USER6> > there is no malicious piece of hardware that the attacker tricks you into > using

> All the attacker needs is 5 minutes alone with the computer, a screwdriver, > and some easily portable hardware.

Just started reading, but the comparison is already a little bizarre. It almost seems like the digital version of "This murderer is on the loose and you're in danger! He doesn't need to inject poison into your food. All he needs is just 5 minutes in front of you with a knife!"

<comment><USER7> As a general rule, anyone with physical access to your machine already owns it. Physical security matters, a lot.

That being said, malicious hardware is a problem. A hacked phone charging terminal at the airport could certainly be a serious problem if there are enough vulnerabilities in the USB stack.

<comment><USER8> > As a general rule, anyone with physical access to your machine already owns > it.

People frequently say this, but never really explain it. As far as I can tell, it translates to "Nobody cares about physical security" \- except it's clear that people /do/. Things like Boot Guard are only really relevant to physical attacks. DMA protection in firmware is only really relevant to physical attacks. It's extremely obvious that the industry is attempting to avoid short term physical access to a device being sufficient to compromise it, and research that demonstrates that it's still possible is valuable.

<comment><USER9> Physical access is just such a rich attack surface that keeping your computer away from malicious actors is the right and proper solution.

An extreme example a pentester imparted to me once was, if someone could spend sufficient time alone with my laptop, they could remove my hard drive and insert it into an identical laptop with a hardware or firmware backdoor preinstalled. We were discussing nation-state adversaries, but the general principle applies.

Another example is attacks on encrypted drives (so-called "evil maid" attacks). If a computer is booted and the drive is decrypted, an attacker with physical access could open the computer, remove the RAM, and download it's contents, thereby stealing the encryption key. If the computer is powered down, it's still vulnerable to other attacks; enrypted drives necessarily have cleartext code for accepting the password & decrypting the drive. You could modify this code to log the decryption key, or broadcast it over your device's radios.

There's also the classic Windows "sticky key" exploit, where you replace the sticky key binary with a program that gives you administrator access, reboot the computer, and then activate sticky keys.

You could install a keystroke logger. You could install a device to record monitor output. You could log network traffic.

I've yet to find a kiosk environment that I couldn't break out of. Once I was able to break out of a scanning kiosk environment, and into a Windows desktop, by turning the quality settings all the way up and crashing the kiosk. That was one of the more difficult examples; most of the time all you need is to find a way to right-click. (I had the proper authority to investigate these kiosks.)

The point is that the list goes on.

It is true, as you say, that there has been progress in implementing mitigations, and that there are people who care deeply about these issues. A counterexample might be SIM cards, TPMs, and other HSMs. These systems are able to provide better guarantees by encapsulating their peripherals and being willing to self destruct. But that could describe a cell phone, tablet a laptop, too.

Maybe in the future this "law" won't be so hard and fast.

<comment><USER8> > Physical access is just such a rich attack surface that keeping your > computer away from malicious actors is the right and proper solution.

Keeping attackers away from your computer is certainly the best solution, just as keeping your computer off the network is the simplest answer to avoiding network security issues. But that's not always an option, so we still need to care about it.

> An extreme example a pentester imparted to me once was, if someone could > spend sufficient time alone with my laptop, they could remove my hard drive > and insert it into an identical laptop with a hardware or firmware backdoor > preinstalled.

That'll be detected with any properly implemented remote attestation solution (switching the machine will change the endorsement key, so attestation will fail)

> If a computer is booted and the drive is decrypted, an attacker with > physical access could open the computer, remove the RAM, and download it's > contents, thereby stealing the encryption key.

Removing soldered-on RAM from a motherboard fast enough to maintain the contents is not a straightforward attack. Not theoretically impossible, but you're not going to have a good time of it.

> If the computer is powered down, it's still vulnerable to other attacks; > enrypted drives necessarily have cleartext code for accepting the password & > decrypting the drive. You could modify this code to log the decryption key, > or broadcast it over your device's radios.

Will be detected via remote attestation.

> There's also the classic Windows "sticky key" exploit, where you replace the > sticky key binary with a program that gives you administrator access, reboot > the computer, and then activate sticky keys.

How do you do that with an encrypted drive? Look, yes, it's not _easy_ to guard against physical attacks. But some organisations that genuinely _do_ have to deal with state level attackers care about physical security and care about mitigating it, and we have moved well beyond the "physical access means you've lost" state of affairs. Finding new cases that allow attackers with physical access to subvert our understanding of the security boundaries of a machine is of significant interest.

<comment><USER9> You raise some interesting points, and have force me to question my assumptions that this is simply a lost cause.

</comment></comment></comment></comment></comment></comment><comment><USER10> Looks like most of these require physical access to the SPI flash and not just the thunderbolt port unless I'm reading the disclosure wrong.

</comment><comment><USER11> This is the kind of garbage that the infosec community often memes about. A marketing website, a domain name, a cute logo for a vanity project masquerading as security research. Basically every one of the "seven" vulnerabilities boils down to "if someone can flash the SPI of the thunderbolt controller then xxx" but if they can flash the TB SPI, then they can also flash the BIOS SPI which has a lot of the same "vulnerabilities" but arguably is more impactful. The reason they only mentioned TB is because the BIOS stuff is well known and you can't put your name on it.

Let's break down each of the "vulnerability".

1\. "However, we have found authenticity is not verified at boot time, upon connecting the device, or at any later point." This is actually false. Like, the author either didn't experiment properly or is lying/purposely misleading you. The firmware IS verified at boot for Alpine Ridge and Titan Ridge (Intel's TB3 controllers). They aren't for older controllers which does NOT support TB3. When verification fails, the controller falls back into a "safe mode" which does NOT run the firmware code for any of the ARC processors in the Ridge controller (there are a handful of processors where the firmware contains compressed code for). I'm willing to bet the author did not manage to reverse engineer the proprietary Huffman compression the firmware uses and therefore couldn't have loaded their own firmware. Because if they did, it wouldn't have worked. Now the RSA signature verification scheme they use to verify the firmware does suffer from some weaknesses but afaik doesn't lead to arbitrary code execution (on any of the Ridge ARC processors). I would love to be proven wrong here with real evidence though ;)

2\. Basically the string identifiers inside the firmware isn't signed/verified. This has no security implications beyond you can spoof identifiers and make the string "pwned" appear in system details when you plug the device in and authenticate it. Basically if you've ever developed custom USB devices you can see how silly this is as a "vulnerability."

3\. This is literally the same as #2.

4\. Yes, TB2 is vulnerable to many DMA attacks as demonstrated in the past. Yes, TB3 has a TB2 compatibility mode. Yes, that means the same vulnerabilities exist in compatibility mode which is why you can disable it.

5\. This one is technically true. If you open the case up, and flash the SPI chip containing the TB3 firmware, you can patch the security level set in BIOS and do stuff like re-enable TB2 if the user disabled it. But if I were the attacker, I would instead look at the SPI chip right next to it containing the UEFI firmware and NVRAM variables (most of which aren't signed/encryption in any modern PC).

6\. SPI chips have interfaces for writing, erasing, and locking. If you have direct access to the chip you can abuse these pins to permanently brick the device. Here's another way: take your screwdriver and jam it into the computer.

7\. Apple does not enable TB3 security features on Boot Camp. I guess this one is vaguely the only real "vulnerability" although it's well known and Apple doesn't care much about Windows security anyways (they don't enable Intel Boot Guard or BIOS Guard or TPM or any other Intel/Microsoft security feature).

Not that it matters but my personal experience with TB3 is that I've done significant reverse engineering of the Ridge controllers for the Hackintosh community.

<comment><USER8> > they can also flash the BIOS SPI

Boot Guard makes that impractical in most cases. The point here is that on machines that don't implement kernel DMA protection, you're able to drop the Thunderbolt config to the lowest security level and then write-protect the Thunderbolt SPI so the system firmware can't re-enable it, making it easier to perform a DMA attack over Thunderbolt and sidestep the Boot Guard protections.

This isn't a world-ending vulnerability, but it's of interest to anyone who has physical attacks as part of their threat model.

<comment><USER11> Boot Guard is not implemented on most (all?) self built machines and a lot of pre-builts as well. But even if it is enabled, UEFI variables are not protected at all. You can disable Secure Boot just by overwriting UEFI variables and then boot any arbitrary code from USB.

<comment><USER8> Which will change the measurements in PCR7, which is a detectable event that will break Bitlocker unsealing.

</comment></comment></comment></comment><comment><USER12> What would it take to have a Thunderbolt/USB C condom? You know, like those standard USB adapter that just drops the data leads on a usb charger to make attacks like this impossible. Maybe we would have to implement a hardware switch on the device itself?

I'm not going to feel safe charging with a public use charger until I find some way to insure only power and not data is making it to my device. Even POE feels like it's safer than modern peripheral standards right now.

(I admit this might not be perfectly linked to the article, it's just a need I've felt for a while but I can't seem to buy a solution for.)

<comment><USER13> How about a SSH-like "trust on first use" prompt for all data connections? Each USB/TB device has its own pub/private keypair.

If you ever plug in a charging cable and get the prompt, you know something is wrong.

<comment><USER14> That is exactly what TB has. The problem is that the device private key (in many(/all?) devices) sits in the flash memory completely unprotected so anyone can clone it.

<comment><USER15> It is not like ssh at all. It is a problem that secrets are kept in the flash and it is also a problem that those secrets are sent over the untrusted channel.

<comment><USER14> The key is transferred only on the initial connection, after that a challenge/response mechanism is used. So from UX point of view it achieves similar TOFU, even if the technical details vary a bit. Sure, its bit worse but it is still very much trust on first use.

<comment><USER15> After the device is connected, use looks like a key consistency aware system like an ssh client. It is as you note very different in the first protocol run.

To extract the device secret value, an attacker needs to connect the target device to an attacker device. As you note, the thunderbolt device leaks the secret value over the untrusted channel. Impersonation of that device after that moment is trivial as a result.

The entire cryptographic protocol is broken from the start.

<comment><USER14> > To extract the device secret value, an attacker needs to connect the target > device to an attacker device. As you note, the thunderbolt device leaks the > secret value over the untrusted channel.

If victin device is connected to attacker host, then only responses to challenges are potentially leaked. That might allow active mitm, but not cloning the key. That's the whole reason TFA needed to go poking around in flash to get the keys.

Not saying that TB is the best security protocol in the universe, but as far as I can tell the vulnerabilities exposed here are mostly implementation flaws rather than protocol level issues.

<comment><USER15> ssh uses asymmetric keys and the cache on the client has a three tuple (host,ip,public key) which allows a client to notice a difference in any of the three elements. By comparison, Thunderbolt leaks the entire secret as the first step and subsequent steps use derived values. ssh is secure if the key doesn't change and isn't compromised through other means. Thunderbolt is not secure and it fails under a passive surveillance adversary, it also fails for active adversaries.

I take your point that subsequent secret use in the n+1 protocol run isn't as bad as the very first run, and as you note, that probably doesn't matter in the face of an active attacker.

If Thunderbolt had used asymmetric cryptography, I would probably agree with you that the protocol has the same semantics as ssh. The reason that I disagree is that it appears to have the same semantics for the user interface but the underlying protocol differences are what make the protocol unsuitable for use. It's at least part of why Intel has now retired Security Levels and is leaning so strongly on kDMA. Security Levels as a protocol is simply not cryptographically secure for any meaningful definition of secure as the first step exposes the base secret value.

Note: the attack doesn't require the use of a flash clip, that's just a simple way to demonstrate device specific state extraction.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> I wonder if that could be used by used sellers of MacBooks to get into the computers.

[https://www.vice.com/en_us/article/akw558/apples-t2-security...](https://www.vice.com/en_us/article/akw558/apples-t2-security- chip-has-created-a-nightmare-for-macbook-refurbishers)

I guess MacBook resellers sometimes get computers where the password has been set and they can't get into the computers. I imagine they would be motivated to find anyway they can to unlock the computers.

<comment><USER2> No; for Macbooks, this work reduces to BadUSB.

</comment></comment><comment><USER17> There is a nice write-up about this on attackerkb. If you're not familiar with it it's a community to provide assessments of vulnerabilities and point out which are worth stopping everything to patch and which are mostly harmless. It's currently in open beta. Main site: [https://attackerkb.com/](https://attackerkb.com/) Thunderspy assessment: [https://attackerkb.com/topics/mPaHZgsUvk/thunderspy](https://attackerkb.com/topics/mPaHZgsUvk/thunderspy)

</comment><comment><USER18> There were news sometime ago that Microsoft did not include thunderbolt in their surface 3 because it was insecure. I wonder if that's related to this and whether Microsoft knew about this for a while.

</comment><comment><USER19> > Contrary to USB, Thunderbolt is a proprietary connectivity standard. Device > vendors are required to apply for Intel's Thunderbolt developer program, in > order to obtain access to protocol specifications and the Thunderbolt > hardware supply chain. In addition, devices are subject to certification > procedures before being admitted to the Thunderbolt ecosystem.

I thought that this had changed with USB-C?!

</comment><comment><AUTHOR> Easy read on the Wired magazine: [https://www.wired.com/story/thunderspy- thunderbolt-evil-maid...](https://www.wired.com/story/thunderspy-thunderbolt- evil-maid-hacking/)

</comment><comment><AUTHOR> This video shows the POC demo: [https://www.youtube.com/watch?v=7uvSZA1F9os](https://www.youtube.com/watch?v=7uvSZA1F9os)

</comment><comment><USER20> Really though, if an attacker has unencumbered access to one's device, all security goes flying out the window.

The website is highly self-promoting.

<comment><USER21> _> if an attacker has unencumbered access to one's device, all security goes flying out the window_

This is rapidly starting to become less true - full disk encryption is everywhere, backed by hardware TPMs; the Lockdown LSM prevents root from owing the boot chain; devices with soldered RAM are functionally immune to cold boot attacks.

There are still things an attacker can do - put a hardware keylogger on the keyboard wires, a skimmer on the fingerprint reader - but that requires future input from the victim. It is feasible today to defend against a physical attacker if you have the right hardware upfront and don't use it after the attack.

<comment><USER22> _This is rapidly starting to become less true_

Unfortunately, both for right-to-repair and actually owning the hardware you bought.

<comment><USER23> TPMs don't impede your ability to repair anything. Soldered ram is a hassle, but it's not any more malicious than soldered CPUs. It's a design choice, and tradeoffs had to be made.

<comment><USER21> _> TPMs don't impede your ability to repair anything_

There are some stories like this: [https://www.vice.com/en_us/article/akw558/apples-t2-security...](https://www.vice.com/en_us/article/akw558/apples-t2-security- chip-has-created-a-nightmare-for-macbook-refurbishers)

It's suggested that many such devices might be stolen. But there will also be devices where the user forgot to wipe their data (or didn't know how); or devices that are only just damaged enough that you can't wipe the user data.

Probably an official Apple store can refurbish them somehow, but that is the NOBUS / EARN IT argument.

<comment><USER24> Well, that's more an explicit T2 issue that goes beyond what is known as "industry standard" TPM. Apple just hates you a (big) bit extra.</comment></comment></comment></comment></comment></comment>


Uber Tests Taking Even More from Its Drivers with 30% Commission - <AUTHOR> http://www.forbes.com/sites/ellenhuet/2015/05/18/uber-new-uberx-tiered-commission-30-percent/

<comment><USER2> You think you work for Uber when you're a driver?

When Uber goes public for a trillion dollars, are you going to get anything out of it?

No you're going to get a few bucks for toting passengers around in a car you had to finance yourself.</comment>


Show HN: Redesign of www.muusical.com - <AUTHOR> http://www.muusical.com/blog/new_look

<comment><AUTHOR> Muusical is basically a product hunt for music with a nice playlist feature, where you can add songs from different sites like youtube, vimeo and soundcloud. We've been working on this for the last few months. This is a nights and weekends project so far. I'm the developer and my buddy Toms is the designer. We'd love to hear what you think of our work.</comment>


OwnCloud CTO leaves Company - <AUTHOR> http://karlitschek.de/2016/04/big-changes-i-am-leaving-owncloud-inc-today/ <comment><USER2> What a sad news while we are all appreciative of his work but more importantly wish a brighter prospect for the project.</comment>


Ehang's passenger-carrying drones look insanely impressive in first test flights - <AUTHOR> https://www.theverge.com/2018/2/5/16974310/ehang-passenger-carrying-drone-first-test-flight <comment><USER2> Can it safely autorotate to the ground in the case of a motor failure?

</comment><comment><USER3> I would love to know how the energy cost compares to driving. How bad would traffic have to be before it saved you not just time, but money?

</comment><comment><USER4> This craft will need some (stubby) lift surfaces to keep up with the competition.</comment>


A freelance fashion designer took on a global footwear company, and both lost - <AUTHOR> http://qz.com/525536/a-freelance-fashion-designer-took-on-a-global-footwear-company-and-they-both-lost/ <comment><USER2> Some fashion designers are quite paranoid about their designs being copied by bigger brands. I've been challenged by designers while doing reportage-style photography of the exhibition at London Fashion Week, asking me who I was and who I worked for. Apparently, mass-market fashion manufacturers and retailers make use of the services provided by companies like WGSN to get "inspiration" for their own ranges.

Examples include Primark allegedly copying Mary Katrantzou's designs - [http://www.independent.co.uk/life-style/fashion/news/how- to-...](http://www.independent.co.uk/life-style/fashion/news/how-to-look-good- for-less-primark-in-copycat-row-6953019.html) \- and Nasty Gal copying Alexander Wang - [http://fashionista.com/2015/05/nasty-gal-alexander-wang- dres...](http://fashionista.com/2015/05/nasty-gal-alexander-wang-dress-copy)

</comment><comment><USER3> Thankfully there is no broad copyright protection of fashion designs, otherwise we might see numerous cases like this brought to court and bogging down the industry.

It's unfortunate that this designer feels he was 'stolen' from, but his designs are incredibly similar to older designs anyway.

</comment><comment><USER4> It's kind of awesome that you can't lock down a style under legal means. It forces everyone to keep moving. It's probably also freeing to know that when you design something, you aren't going to be ripped apart because you were also inspired by some past design.

That said, it sucks for the designers who actually start the trend. What would be cool is if you, as a designer, could register your design just for the credit. That way, when the indie designer is looking for investment or a job, they can definitively say "I was the one who ... "

Dribbble/Linked in for fashion designers :)

</comment><comment><USER5> >But his experience does contain one lesson for other designers: Even when you've run out of other options, calling someone a "thief" in public may not be the wisest option.

Good takeaway, I think. Resorting to public name calling is pretty petty.

</comment><comment><USER6> both lost? I would argue both are winners in this case. The company isn't exactly LV or Hermes of shoes. This type of publicity does more good than harm. As for the designer, it looks like he has done ok for himself too. There is no denying that he has a talent.</comment>


An Indie AppStore Section - <AUTHOR> http://news.selectstartstudios.com/the-indie-appstore-section-an-open-letter-to-apple/

<comment><USER2> I think this is a very naive proposition. Such an "indie section" would be the dream dwelling place of spammers, scammers, IP thieves and friends and the general filth that can be found on the bottom of the App Store.

<comment><USER3> ...and indie developers that can't compete with large app studios that dominate the top 25 (EA, Activision, Gameloft, etc.). Some indie titles make it to the top but only those ready for mass consumption. It'd be nice to see some variety.

Edit: I agree that there would be a fair amount of filth showing up there, but tons of filth hits the regular appstore already.

</comment></comment><comment><USER4> That's not the solution. It's not just developers having the problem - it's also consumers. As a consumer, after I buy the commercial titles and I'm done with them, how do I find other good apps?

Instead of whining about what Apple should do, developers can just create their own discovery mechanisms that help the users discover more apps they would like.</comment>


Writing an OS in Rust: Accessing and Modifying Page Tables - <AUTHOR> http://os.phil-opp.com/modifying-page-tables.html <comment> phil-opp Note that this post continues the _Writing an OS in Rust_ series [1] and assumes some familiarity with the existing system and Rust.

[1]: [http://os.phil-opp.com](http://os.phil-opp.com)</comment>


The Perfect Mobile Phone Is (Nearly) Here - <AUTHOR> http://www.pcmag.com/article2/0,2817,2348745,00.asp

<comment><USER2> Considering size and especially battery life limitations, some of those requests seem a little bit pie-in-the-sky, though I'd love to be proven wrong.</comment>


Colonel kicked out of war for hating PowerPoint - <AUTHOR> http://www.salon.com/news/politics/war_room/index.html?story=/politics/war_room/2010/08/27/afghanistan_powerpoint_hater_fired&source=newsletter&utm_source=contactology&utm_medium=email&utm_campaign=Salon_Daily%20Newsletter%20%28Not%20Premium%29_7_30_110 <comment><USER2> As many commentators note, this is wrong, for he was "kicked out" for gross insubordination:

" _For headquarters staff, war consists largely of the endless tinkering with PowerPoint slides to conform with the idiosyncrasies of cognitively challenged generals in order to spoon-feed them information. Even one tiny flaw in a slide can halt a general's thought processes as abruptly as a computer system's blue screen of death._ "

You just can't say that sort of thing and expect to be retained in an organization. Even if it's true.

For that matter, it's not that he hates PowerPoint but that he perceives it is part of pointless process.</comment>


DisRedis: Python Redis client with Automated Sharding and Failover - <AUTHOR> http://engineering.custommade.com/introducing-disredis-an-open-source-redis-client-to-automate-sharding-and-failover/

<comment><USER2> It looks like you're using SHA1 as your hash algorithm which isn't a great choice for sharding. Look into using a consistent hashring algorithm. Basically you want to minimize the number of keys you need to redistribute if you add/remove nodes. [https://pypi.python.org/pypi/hash_ring/](https://pypi.python.org/pypi/hash_ring/)

What would be cooler than this would be to port the CRUSH algorithm to python. CRUSH is what Ceph (distributed file system) uses to map data to storage servers. This allows you to define a 'map' of how you want data distributed - i.e by rack, row, or datacenter and it can handle replicas, failures, and overloaded systems as well. Whitepaper: [http://ceph.com/papers/weil-crush- sc06.pdf](http://ceph.com/papers/weil-crush-sc06.pdf)

</comment><comment><USER3> I'm one of the developers of DisRedis and the devops engineer running the servers. Let me know if you have any questions.</comment>


Humanities or STEM? Students need both to succeed. - <AUTHOR> http://www.washingtonpost.com/opinions/lessons-from-the-humanities-and-social-sciences/2013/11/14/7441f9b6-4655-11e3-a196-3544a03c2351_story.html

<comment><USER2> > our country risks marginalizing the humanities and social sciences. We > cannot allow that to happen...

Ok then lower the price of humanity degrees, i'm sure more people would sign up then.</comment>


Nearly one in 10 Americans have deleted their Facebook accounts, survey says - <AUTHOR> https://www.techradar.com/news/nearly-one-in-10-us-facebook-users-have-deleted-their-accounts-survey-says <comment><USER2> Survey done by [https://creativestrategies.com/](https://creativestrategies.com/)

>They ran a study across 1000 Americans who are "representative of the US population in gender and age."

>"Privacy matters to our panelists. Thirty-six percent said they are very concerned about it and another 41% saying they are somewhat concerned.

Their behavior on Facebook has somewhat changed due to their privacy concerns. Seventeen percent deleted their Facebook app from their phone, 11% deleted from other devices, and 9% deleted their account altogether. These numbers might not worry Facebook too much, but there are less drastic steps users are taking that should be worrying as they directly impact Facebook's business model"

</comment><comment><USER3> I´m not surprised by this if it´s really true. Zuckerberg's focus should be on his users and not the advertisers and organizations. I think he wants to compare Facebook with Google in collecting data. And there are many other Social Networks which we can use. If Facebook doesn´t change his plans than it might go down. Not at the moment but steadily year after year.

</comment><comment><USER4> I have a hard time believing this. But, the real damage could be time spent on Facebook and what information people would share on Facebook in the future.

I for one keep my account because it became a social ID. But it practically has no meaningful personal data other than my name & contacts.

It is a matter of slow death...

</comment><comment><USER5> I think they're lying when they say that they haven't seen a noticeable impact in usage. Plenty of people I know can see through their BS and want to delete their FB or already have.

Society probably shouldn't use social media at all. Facebook has every intent on making its use a social norm.

</comment><comment><USER6> I struggle to believe this.

I had 300 Facebook friends before I deleted my account a couple of days ago, and I didn't see that number decrease. Neither did I hear anything from the decent number of infosec friends who you would expect to be the first to delete their accounts.

Of course that's anecdotal, but 10% seems very high.

</comment><comment><USER7> The sad part about all this is that Google probably has more data on Americans through searches and Android than Facebook.

<comment><USER8> True. But it's also important to know what they do with the data. We all knew that FB had our data. What we didn't know is that it was being used to do unethical stuff by companies like Cambridge Analytica.</comment></comment>


From idea to AppStore in 2 weeks - <AUTHOR> http://www.alasdairmonk.com/journal/from-idea-to-appstore-in-2-weeks/

<comment><USER2> A year or two back three of us (one only very part-time, and two of us inexperienced) developed an iOS app that did two way translation (speech - text - text - speech) using two three different services from two different vendors, from scratch in less than a week. In Objective-C. (It didn't get submitted to the App Store, it was demoed to potential investors and then disappeared, presumably owing to the existence of similar apps.)

Not a terribly ambitious app, but no less ambitious than the app described.

Ruby Motion looks interesting, but I don't really see how it would make a big difference to shipping something like this in a very short time frame.

</comment><comment><USER3> Hi, great looking app, well done! I'm wondering if you ended up caching the Tube status information on your own web server, or if you are directly accessing Transport for London's site?

</comment><comment><USER4> Incidentally my first iOS app is also a London tube statuses app. But i never made any money out of it, (i deemed it unworthy of 1$).

Although i was learning Obj C for some time, i developed my tube map app in 2 weeks of starting with cocoa framework.

Its time to start looking at marketing 101 lessons :).

</comment><comment><USER5> I'm curious if the author was able to earn the initial investment in the tools: _200$_ __RubyMotion __+ _100$_ __iOS Developer __.

<comment><USER6> Yes – as of writing I've sold enough units to pay for the costs a few times over as well as server costs for the custom API I built. Some profits will be reserved for London based charities.

<comment><USER7> What stack are you using for the API server? Any chance of a quick article on that?

<comment><USER8> Ruby would be my guess.

</comment></comment></comment></comment><comment><USER5> If you know and enjoy coding in Ruby, you intend to target only iOS, and you don't know Objective-C, C or C++ than RubyMotion is a good investment.

On the other hand, if you want to target iOS and Android you'd better learn Objective-C and Java. An interesting alternative is to use HTML5 and JavaScript if you already have a good background as a web developer.

<comment><USER9> Or, if we disregard costs, C# and use Xamarin's (<http://xamarin.com/>) products.

<comment><USER5> Same goes for C# and Xamarin, if you already know C# and enjoy coding in C# ...

If you don't know C# I see little reason to buy a Xamarin license (I know you can get started for free which is great).

<comment><USER9> Code sharing between platforms could make it a worthwhile investment of time and money. But it's quite costly if you are just starting out.

</comment></comment></comment></comment><comment><USER10> This is great. I spent much, much longer on my first iOS app and it isn't half as successful. Very well thought up and executed.

</comment><comment><USER11> Maybe it's just me, but I feel like because iOS is such a hot platform right now everyone is trying to hop on the bandwagon without learning anything new. Write iOS apps in ObjC. It's not hard, it's not that different, it's just something you don't know yet.

</comment><comment><USER12> Might just be the fonts, but this looks like a Windows 8 app.

Congrats on the launch!

<comment><USER13> The font, called Johnston, is from the London Underground design style and the colours are those of the lines

<http://en.wikipedia.org/wiki/Johnston_(typeface)>

<comment> adam-a It's a great font!

I've recently been working on a game and I wanted to include this font in it. I've been a bit worried though because of the vague and scary sounding license that seems to come with all fonts, including Johnston. Did you consider the legal aspects? And did you do anything to make it "legit"? Like pre-rendering your text assets to images or anything? Or did you just include a .ttf in your app bundle?

Nice looking app btw!

</comment></comment></comment><comment><USER14> > earning me enough pennies to buy some Dominos pizza.

To a large extent this has been the real problem in the iOS app domain for a while. Apps are far more likely to make you enough to buy a small pizza than even approach earning you a reasonable salary.

Part of it, I think, are the mechanics of the App Store itself. Search has been broken for years. When compared to searching on the 'net the difference is stark. This is unfortunate because developers who do a little financial math will, without a doubt, walk away. You are far more likely to make money with a good website than on the App Store. That's why people hesitate to spend $200 on Ruby Motion...you simply won't get your money back unless you use it to write apps for others and earn money for your work rather than from your apps.

<comment><USER15> Three years ago my friend published his first app in the App Store. He taught himself Objetive-C and had never programmed a day in his life before. He first app made a few bucks a day so you know what he did? He build another app. And another. And another. You know what he is doing today? House hunting in San Francisco and taking frequent vacations to Hawaii. By the way he did this working four days a week. So the problem is not really the App store it's that peoples initial exception don't intersect with their willingness to put in the time needed to build a business.

<comment><USER16> I think a lot of us are curious if this is still possible (or whether it is only true if you built apps 3 years ago) and would like to hear from anyone with knowledge as to whether this is still possible simply by playing the numbers game with a 1-man shop.

For example, "met" a guy on Reddit who claimed to have built a bootload of Google Gadgets and made 1/2 mil in the process. I've been in the same market during that same time-frame, so I'm generally aware of what is feasible... and I believe I can vouch for the fact that this may still be possible, but probably 150x harder now.

<comment><USER15> Once he got to 100-250k installs things started to take off but that did not happen until two years in so this success is not that long ago. He also started to build more polished apps at that time and stopped consulting to pay the bills and worked on his own stuff "full time."

</comment></comment></comment></comment><comment><USER17> Great post - I love reading about this rapid fast releases, even better when the writer had to learn a new language.

I was curious about ruby motion beforehand but now I can't wait to get stuck in.

Oh, and congrats! :D

</comment><comment><USER18> Congrats. I still can't get by the initial cost of RubyMotion. I know, it will pay for itself, but that's a lot of initial buy-in going on faith. I wish they had a demo version available to try before buying.

<comment><USER17> They offer a 30 day money back guarantee:

<http://sites.fastspring.com/hipbyte/product/rubymotion>

</comment></comment><comment><USER19> I'm really curious about that.

There are about half dozen similar applications on the Appstore, for free.

I tried a few, and most of them did the job they were suppose to do fairly well.

How did you convince people to choose yours as opposed to the other ones that already existed ?

Clearly the Metro article is what pushed people (that possibly didn't know that those apps existed) to actually get and download your app.

Congrats and kudos.

<comment><USER6> Thanks!

I knew that there were a lot of similar apps on the AppStore but I went with my conviction that less is more. Nearly all the apps are multifunctional and include journey planners, maps, alerts etc etc.

As a Londoner, I know my way around, the only thing I want to know is if the tube is even working – this is how Lines was born. I've tried to make the app's simplicity it's main selling point and hope I've achieved this to some degree.

<comment><USER20> Actually, it is a very useful function. It has usefulness and simplicity. Would you mind to give ROI analysis for your project? This will be helpful to the audience here.

<comment><USER6> Thanks. As of writing Lines has sold a few thousand copies, so it's made a good ROI. After costs have been paid (servers, iOS dev license etc) I'll be giving some profits to chairty.

</comment></comment></comment></comment><comment><USER21> I'm also pushing out a rubymotion app in the next week. Its hard to estimate how much time it saved me but it definitely made building the app a much more enjoyable experience.

</comment><comment><USER22> This looks like a sales pitch for Ruby Motion to me.

<comment><USER23> Its a good one. RubyMotion is a delight to work with, my absolute favorite coding environment.

</comment></comment><comment><USER24> "BUT, and it's a big butt" - deliberate misspelling?

</comment><comment><USER25> 4 days for approval? That's pretty fast.

<comment><USER26> From my experience it's a hit or miss. I just got an approval for an app I submitted on March 1st. That's the shortest time (6 days) I had to wait for an approval.</comment></comment>


Please review the alpha of our startup:  LifeThunder.com - <AUTHOR> http://lifethunder.com/

<comment><USER2> It _really_ needs some design. I'd suggest going somewhere like <http://themeforest.net/> and picking out a cheap template at the very least.

I also never sign up for a site without seeing what I'm signing up for, so I'm afraid I haven't checked out anything further than what I could see while logged out.

<comment><AUTHOR> Thanks for the suggestion about themeforest; I'm browsing that now.

As to the not being willing to sign up without seeing it, this is an issue that we've been struggling with. By the nature of the site, we need to have an identity attached to the information we store. If you have a good suggestion on how we could safely do a demo version without compromising people's security, there's an excellent chance that we'd do it.

<comment><USER2> Screenshots or video make for an acceptable demo; it doesn't have to be interactive.

</comment></comment></comment><comment><USER3> None of the interior pages loads - just getting a blank white page.

That being said, what kind of security protocols do you employ to ensure that users' account details, usernames, emails, and passwords, etc. are safe from compromise? (e.g. some kind of PCI-type compliance?)

<comment><AUTHOR> I'm looking at it right now and it's working. Can you tell me what browser / OS / URL you're using?

<comment><USER4> I'm on Safari 4 on Mac OS X. Same issue. View Source says I received all the content, but it's showing a blank white page.

<comment><USER3> same here, safari, ff, webkit, chrome, camino on mac os x.

</comment></comment></comment></comment><comment><USER5> The only type of web site where I would consider the name acceptable would be some kind of storm chaser community (where are thunderstorms happening right now, that kind of thing).

Also the FAQ seems really silly (is it save? Yes, bla bla) - You think scammers are incapable of writing "100% secure" on their scam pages?

</comment><comment><USER6> I'd like to concur on the design element. You're asking me to trust you, but your site looks like it was designed by an amateur?

Secondly, I would change the presentation of your "is it safe" FAQ. Yes, I am comfortable with Amazon or Gmail storing my information, putting it on the web. But why should I trust YOU? It may be abstractly safe, but what reassurance do I have that YOU won't rip me off?

And, finally, how will you do this? Are you writing adapters that call each of the relative services' API to update information? What about my local credit union without an API? Will you tell my grandma that I moved?

As a possible solution to the above, you might want to seriously consider tying in with something like PostalMethods' API (<http://www.postalmethods.com/postal-api>). There's an addt'l revenue source opportunity as well; have people enter the info of everyone they want notified, and you can send snail mail to those w/o an API.

</comment><comment><USER7> I'm very hesitant to give any one website that much personal information. On a side note, will you be storing passwords / otherwise how would you be updating these sites with information. I think you need to work more on how you plan on securing this information and consumer trust.

</comment><comment><USER8> So they always say when creating a startup find some "pain" and find a solution. You've identified this well.

My concern is whether you see this as a real "startup" or a side project that can bring in a few bucks. How are you intending to bring in revenues? Monthly/Annual fees? Ads? The problem I have with both of these models is that when I look back over the past year, only once would I need to use your service, when I left my job to start a company. Looking forward outside of an occasional title/profile or a rare move I'd use this very infrequently. Not enough by far to do a membership or drive significant ad revenues.

<comment><AUTHOR> > So they always say when creating a startup find some "pain" and find a > solution. You've identified this well.

Thanks. :>

> [how do we plan to make money]

You're right that people won't need this every day, but even if you only need it once every 2-3 months, it's likely to be worth it--consider how much time is required to notify all your service providers of new information, then multiply that by your hourly rate. Needing it every 2-4 months is also not implausible: the individual changes (credit card expiration, email address, postal address, job title, etc) are infrequent, but when you stack them up they become relatively common.

Add in the fact that we provide a better interface than many of the services we are updating (e.g. PayPal and Yahoo, which disperse your information across multiple pages and show different versions of it in different places; e.g. some pages show title (Mr), some show suffix (Jr), some show middle name/initial, etc), and suddenly a modest fee starts to seem ok.

Our plan is to have a "one day" plan for very cheap--probably about $2--that is useful for a one-time use. When you're done, you can either have us delete all your data or archive it so that there is no charge until the next time you need it...but there will be a moderate charge to reactivate it. Alternatively, you can pay a small monthly or annual fee. In the long-term, we would prefer to negotiate contracts with the service providers and have them pay us to provide this service so it could be free to the users, but we will need a significant user base before we can make that happen.

</comment></comment><comment><AUTHOR> LifeThunder is a central point of management for your personal information; when your address / credit card expiration / preferred contact email / etc change, we update all of your service providers (e.g. NetFlix, newspapers, Amazon, utilities, PayPal, etc) at once so that you don't have to notify them individually.

The service is in alpha; the interface is still rough, and we are looking for suggestion on what the most important parts are to improve. NOTE: At the moment we only support PayPal, Yahoo, and LiveJournal.

<comment><USER9> Bold.

</comment></comment><comment><USER10> I am not sure here but none of the screens except index and forums works for me. It just renders blank. I used both Safari and Chrome. Renders fine in Firefox. Even for Alpha, it's just basic navigation. Should fix that, I nearly gave up after it didn't work in two browsers.

Anyway, I like the idea but I am not sure I would trust anyone with all my personal information. Some people might. Security is key point here and it should be stressed out why people should trust you.

</comment><comment><USER11> This is a really fantastic idea... I love it. I didn't sign up though, first the site doesn't give me any confidence that my information would be safe with you, and It doesn't tell me how I can be sure you updated my information. I think a better design, and some more up front info on how it works would really improve it. Once again though, lots of potential with the idea.

<comment><AUTHOR> Can you tell us what you would need to see in order to feel confident in the site?

<comment><USER3> Enumerate all of the methods/protocols/whatever that you employ in keeping our information secure. Most (all?) of the site seems to be behind https, so that's a decent start. Are you PCI compliant? How to you store and encrypt our data? Obviously, you don't have to divulge the secret sauce here, but something more than what the FAQ outlines would be a good start. 37s has a decent go at a security page: <http://37signals.com/security>

</comment></comment></comment><comment><USER12> Facebook. The B isn't capitalized.</comment>


Why the default WSL terminal is so fast and other commentary about low-level API - <AUTHOR> https://github.com/Microsoft/console/issues/327 <comment><USER2> The question I'm more interested in is, why is everything else drastically slow? Contentious opinions on Windows as an operating system are common, but as a user I've been able to feel the impact of the kernel itself becoming a crufty horror show.

When upgrading from Windows 7 to Windows 8 on release, I didn't notice too much of a difference. There was outrage at the time (no more start button!) but my only real issues with it were philosophical, the edging towards the 'walled garden'. Then some time later Windows 8.1 came out and the experience, for me, was __dreadful__. Everything was so much slower. The icons on my desktop suddenly couldn't even load in time at login, temporarily being replaced by placeholder white squares. Every click, every keystroke had noticeable latency. Was it just me? Initially I thought it was just a bad installation from the upgrade process. I did a few fresh installs across the years and it still was still so slow it hurt. Windows 8.1 became praised as the saviour of Windows 8, but that wasn't my experience.

These days I maintain a Windows 7 installation at home. Making heavy use of Cygwin, I find the experience to be fine. At work we're on Windows 10 and it's __horrifying__. Cygwin's speed will never be a fair representation of how a program should run because of all the hoops it has to jump through, but to see the difference between running it on Windows 7 is __staggering__. The Windows 7 experience is akin to a native terminal on Linux, the Windows 10 experience is like a remote desktop.

I feel the same experience in other programs, especially Visual Studio, which is a large portion of my day. Nobody else I talk to shares my frustrations. Am I just super picky? Maybe everyone else is now acclimated to everything being innately slow? That seems like a stretch. But using Windows 10 isn't something I would do out of anything other than necessity because dealing with its speed is like pulling teeth.

<comment><USER3> They definitely worked on this at Microsoft. I am running the latest insider build at home and compared to my works PC which is 2 official releases behind its way snappier. Start menu pops up instantly, search finally works, the button hover effects don't seem to miss frames anymore.

</comment></comment><comment><USER4> All this complaining about the latency and slowness of terminal applications seems to be a relatively recent phenomenon. Strangely enough I have yet to experience this slowness, even though the newest piece of 'user-facing' hardware I use is a 2004 ThinkPad T42p - not exactly a speed demon by modern standards. Both the bare console as well as the multitude of terminal windows are more than fast and responsive enough, had I not read about them supposedly being sluggish I'd never have given it any thought. They still do not feel sluggish to me so I wonder why others seem to experience them as being so. My systems nearly all run some form of Linux with Xmonad and some parts of Mate, _mate-terminal_ (i.e. Yet Another libvte terminal application) amongst them. I regularly have about 30 terminal windows active spread over three workspaces which I switch between without problems or lag. While terminal applications might not be much faster than they were in '92 when I first started using Linux and in that sense have gotten heavier and 'slower' they do seem to perform well enough for me to use them without qualms.

</comment><comment><USER5> _> Of course this also means that we have trade offs. We don't support fully international text like pretty much every other application will. RTL? No go zone right now. Surrogate pairs and emoji? We're getting there but not there yet. Indic scripts? Nope._

These seem like pretty major things to trade away, especially for something that's as widely used around the world as Windows.

<comment><USER6> This is a Linux terminal. I'd guess it see 99.99% ASCII. I think they have bigger fish to fry.

<comment><USER7> This is a very incorrect assumption. Everybody wants to be able to use native language for program output and input, view and edit texts in native language using less, sed, vim.

</comment></comment></comment><comment><USER8> Never had 200ms lag on stock Windows. I'd suspect 3rd party antivirus or data loss prevention software to slow down everything except WSL console. Many AVs/DLPs still can't look into WSL. They are all piece of crap rendering even powerful PCs completely unusable, eating lots of processor cycles and disk throughput in kernel, thus not visible to Task Manager.

</comment><comment><USER9> Windows PowerShell is also smooth as butter. After using it for a bit going back to macos or linux terminals feels sluggish.

<comment><USER10> It should be, it is also conhost based. The effect mentioned is a conhost thing, not WSL, powershell or any other thing that uses conhost. ubuntu.exe is not a seperate terminal in that sense.</comment></comment>


Ask HN: Why is Bitcoin's price growing so quickly? - <AUTHOR> Bitcoin's price almost doubled in a month. Why is this happening? Are there events that are causing this surge? <comment><USER2> Years long debate has reached resolution and technology is being upgraded. LN is on feature freeze for 1.0 release. Increased institutional investment

</comment><comment><USER3> Either Bitcoin has finally found a use or this is a pump'n dump scheme of epic proportions...

</comment><comment><USER4> Speculation, speculation and speculation.</comment>


Embark (YC S11) wins "Best transit app" award - <AUTHOR> http://thenextweb.com/apps/2012/02/08/the-embark-app-wins-mta-award-for-best-new-transit-app-helping-users-plan-2-million-trips-per-month/?awesm=tnw.to_1DH5K&utm_campaign=social%20media&utm_medium=share%20button&utm_source=Twitter&utm_content=The%20Embark%20app%20wins%20MTA%20award%20for%20best%20new%20transit%20app,%20helping%20users%20plan%202%20million%20trips%20per%20month

<comment><USER2> Congrats on the award!

Is there money to be made in this space? Ads? Exit to Google? I find it to be a small market for ycombinator to invest in, but maybe I am missing something.

</comment><comment><USER3> For Windows Phone users in Chicago, I can't recommend CTAWatch highly enough. I haven't tried Embark yet, but CTAWatch has become my favorite public transit app across iOS, Android & WP7:

<http://www.triton-tek.com/solutions/mobile/apps/cta-watch>

Disclaimer: I have no ties to the developer or company selling the app - I'm just a very happy user.

</comment><comment><USER4> I feel a little sorry for other entrants in the MTA competition- it came across as being a competition for independent developers making apps in their spare time. Certainly, it seems like 90% of the entries were exactly that.

Impossible to compete with a Y-Combinator backed startup, really.

<comment><AUTHOR> untog, we hear you there. Though there are three things we should note to put this in better context.

1\. The MTA's goal ultimately was to get apps to help their riders as much as possible, regardless of where the apps came from.

2\. We're recently YC funded and this began as a side project for us during college.

3\. Had this competition occurred earlier in our life as a company, we still would have jumped at it, even knowing a more mature company could come in and take first. Having looked at the rankings and downloads of all the apps involved before and after the contest, we can say that this was more of a net win for this category of Apps than it was for Embark in particular.

</comment></comment><comment><USER5> I wish someone would build an integrated BART+MUNI+CalTrain app. When I evaluated transit apps over a year ago, I liked the UI of iBART the best but ultimately went with iCommute because it had MUNI+BART in 1. Still had to get a separate app for CalTrain and then another separate app for San Jose Transit for when I was down there.

<comment><USER6> In case you (or others) aren't aware of it, the built-in maps app does give directions using all of these forms if you ask it to show mass transit instead of driving or walking directions.

Also in the Bay Area, 511.org is another way to get these directions (but I don't think the mobile experience is as good as the maps app.)

<comment><AUTHOR> True. Though the built-in maps app definitely leaves something to be desired. One big benefit it does have is its coverage.

What Maps is missing is a decent list of stuff though... offline routing, real-time arrivals, alerts and system maps.

Maps on iOS is really more of a driving app than a transit app. As a result, transit is a buried and minimized feature in Maps.

</comment></comment></comment><comment><USER6> Some features I've wanted to see in mass transit apps:

* Notify the user when they are about to reach their destination (so that you know to get off). I think there are ways to do this now but it isn't integrated into the maps app.

* Give me mass transit directions to a destination knowing that I am already on a train/bus.

<comment><USER4> Unfortunately that isn't possible in a lot of cities because the mass transit is underground- if you can't get a GPS lock, you don't know where the user is.

<comment><USER7> You could prompt the user to explicitly say when they board the train and then use the approximate time to destination stop to alert the user. It might not be optimal, but it would be a great...right?

</comment></comment></comment><comment><USER8> What's the business model?</comment>


ORMs and Declarative Schemas - <AUTHOR> http://blog.brandonbloom.name/2009/10/orms-and-declarative-schemas.html

<comment><USER2> Holy crap, it's so weird to read something that articulates feelings I've had about ORM systems for years.</comment>


Ask HN: Lightweight Email Client For Mac? - <AUTHOR>

<comment><USER2> Sparrow. It's abandoned and no longer supported now that Google bought it out, but it's still great for the time being.

<comment><USER3> Airmail is maintained still, and very sparrow-like.</comment></comment>


Facebook launches Fb.gg gaming video hub to compete with Twitch - <AUTHOR> https://techcrunch.com/2018/06/07/facebook-launches-fb-gg-gaming-video-hub-to-compete-with-twitch/ <comment><USER2> This will fail so hard I'm even laughing at their attempt.

<comment><USER3> Lol, saw the crazy view numbers, clicked on pubg and got:

Sorry, something went wrong. We're working on getting this fixed as soon as we can.

Go Back

Facebook © 2018 · Help</comment></comment>


Assembly's Perspective of C - <AUTHOR> https://blog.stephenmarz.com/2020/05/20/assemblys-perspective/ <comment><USER2> > If you haven't been living under a rock quarantined against COVID-19, you've > probably heard about C becoming assembly 2.0, or the new assembly, or YES > THIS.

What's this referring to? Has something been proposed recently?

> Now, many compilers have done some work with this using what are known as > intrinsics. However, these do not allow us to fully exploit what we can in > assembly. Most of the intrinsic instructions follow the C calling > conventions, so they are required to load from RAM, do something with it, > then store back into RAM.

> Since we store the intermediate values, we're exercising the memory > controller for every intrinsic. For our assembly, we load at the beginning > and store at the very end. Nothing is in between.

I don't understand this claim. It seems demonstrably false to me. Intrinsics don't have to follow the C calling convention. And they in practice don't follow it. You can try it for yourself. It definitely doesn't store intermediate results to memory for his example code.

In fact, isn't what clang generates roughly the same assembly as the hand- written assembly in the article?

[https://godbolt.org/z/rfmFB5](https://godbolt.org/z/rfmFB5)

The author looks like an expert so I guess I'm missing something.

<comment><AUTHOR> Hello,

The introduction was meant to be tongue-and-cheek. There was a talk back in January which made headlines due to its claims. [https://www.youtube.com/watch?v=8SoJR3sCaR4](https://www.youtube.com/watch?v=8SoJR3sCaR4)

When I started learning the Nim programming language, the claims were that what you can do in C is what you can do in assembly... In other words, there was no more reason to learn or write assembly, unless you were making a C compiler yourself. I don't think they were ever taken seriously, but neither was my introduction supposed to be taken seriously. The point being that instead of having your brand new language compile to assembly, why not compile to C?

Regarding the intrinsics, you are correct if you optimize. Using your same link, you can turn off the optimizer and see that it follows C ABI conventions --mainly so the debugger can follow each step.

The point here is that we're still writing assembly, with a C marinade on top. _mm_haddps is wrapping an assembly instruction directly. However, to see what this is actually doing, we need to know a bit of assembly. In other words, we're writing C in syntax only.

Perhaps I can reword that part better. Thanks for the comment!

<comment><USER3> > There was a talk back in January which made headlines due to its claims. > [https://www.youtube.com/watch?v=8SoJR3sCaR4](https://www.youtube.com/watch?v=8SoJR3sCaR4)

That talk has 3194 views at the moment. That's pretty obscure.

> Using your same link, you can turn off the optimizer and see that it follows > C calling conventions--mainly so the debugger can follow each step.

If you change -O0 to -O3 you will see a lot of stack traffic, that's true. This has nothing to do with calling conventions -- _there are no calls generated for the intrinsics_. Rather, you just see stack traffic because GCC doesn't try to do proper register allocation at -O0. Nothing to do with intrinsics.

<comment><USER4> > That talk has 3194 views at the moment. That's pretty obscure.

I guess it depends on the intended audience of this post?

I might also find it hard to understand some of the context of a post poking fun as some trend in some knitting mailing list, if I wasn't a member of that list.

I think by "made headlines" they might mean "made a stir in some of the communities I frequent". Given the idea of bloggers as news people, a "headline" is a blog post that gains traction in circles you care about...

<comment><USER3> Yes, the video was probably passed around in a the Nim community. The featured article isn't directed at the Nim community, though. The author just misjudged the video's reach outside of their knitting mailing list.

</comment></comment></comment></comment></comment><comment><USER5> I wrote very similar article long back. [http://www.avabodh.com/cin/cin.html](http://www.avabodh.com/cin/cin.html)

</comment><comment><USER6> > All in all, the compiler, when emitting its assembly code, must make these > decisions. One data type of note is char. The standard does not 100% state > whether we should sign extend or zero extend a char. In fact, I noticed a > difference between GNU's RISC-V toolchain vs GNU's Intel/AMD toolchain. The > former will sign extend, whereas the former zero extends.

The C standard states that an unqualified "char" type (without the "signed" or "unsigned" keywords) is implementation-defined to be either signed or unsigned.

[https://en.cppreference.com/w/cpp/language/types#Character_t...](https://en.cppreference.com/w/cpp/language/types#Character_types)

> char - type for character representation which can be most efficiently > processed on the target system (has the same representation and alignment as > either signed char or unsigned char, but is always a distinct type). > Multibyte characters strings use this type to represent code units. The > character types are large enough to represent any UTF-8 eight-bit code unit > (since C++14). The signedness of char depends on the compiler and the target > platform: the defaults for ARM and PowerPC are typically unsigned, the > defaults for x86 and x64 are typically signed.

</comment><comment><USER7> Would assembly consider c a declarative language?

<comment><USER8> "it's so simple, you just describe that you want `x` to become equal to `y+1`, and the compiler figures out the implementation" ;)

</comment></comment><comment> daniel-thompson > "Another reason we use assembly over a high-level language is to use > instructions that C or C++ cannot really use. For example, the advanced > vector extensions (AVX) for an Intel processor don't have a 1-to-1 > conversion from C."

This might be beyond the scope of the article, but it may be worth noting [https://ispc.github.io/](https://ispc.github.io/), which is a C language extension and accompanying (LLVM-frontend) compiler. ISPC exposes an SPMD programming model that efficiently maps to the CPU's vector lanes (think CUDA kernels, but running on those vector lanes instead of a GPU). Except for a few new keywords and some library functions, it is almost identical to C and has C linkage.

</comment><comment><USER9> The thing I adore about computer science is that it is quite tractable to understand absolutely everything from theories of data and computation, programming languages and operating systems, and hardware.

This article is a fantastic look at the lower parts of the stack, and it's really made me look forward to the next time I'll be teaching this topic in my own classes.

RISC looks much easier to learn than the code I've been using: clang generated asm in macOS.

I was actually thinking of moving to using assembler in DOSBox (1) for nostalgia reasons and (2) because it could be a lot simpler and less crufty.

What's an equivalent platform / set of tools with which I could do some real world RISC? Is my macOS assembler RISC already, but just not as elegant as this author's examples?

<comment><USER3> > RISC

RISC ([https://en.m.wikipedia.org/wiki/Reduced_instruction_set_comp...](https://en.m.wikipedia.org/wiki/Reduced_instruction_set_computer)) is a class of computer architectures. RISC-V ([https://en.m.wikipedia.org/wiki/RISC-V](https://en.m.wikipedia.org/wiki/RISC-V)) is an architecture in this family.

> I was actually thinking of moving to using assembler in DOSBox

That would mean using cumbersome tools in a cumbersome environment to target the same cumbersome x86 architecture. It's a horrible idea. Please don't inflict your nostalgia on students. Your past context means nothing to them, and it would not teach them anything useful.

> What's an equivalent platform / set of tools with which I could do some real > world RISC?

If your Clang/LLVM is compiled appropriately, it includes a RISC-V backend. You can pass something like --target=riscv64 to get code generated. You will need a cross-libc installed if you want to be able to call anything but syscalls. Then use an instruction set simulator to execute the binary. There is a simulator called Spike for RISC-V, or you could use Qemu. The answer here sketches these steps: [https://stackoverflow.com/questions/54670887/how-can-i- compi...](https://stackoverflow.com/questions/54670887/how-can-i-compile-with- llvm-clang-to-risc-v-target)

Alternatively, set up a whole RISC-V Linux system inside Qemu.

</comment></comment><comment><AUTHOR> I write OSes most of the time, but seeing how languages end up boiling down is a very good exercise in learning the architecture.

</comment><comment><USER10> The nice thing about assembly code isn't the lack of abstractions, but the fact that the image of compilation (the assembly process) is bigger than most languages' compilers: just about any output you want has a corresponding input.

People always confuse these things, and it's important that we don't to continue striving for better programming languages.</comment>


A Course on Automata Theory - <AUTHOR> https://www.coursera.org/course/automata <comment><USER2> When I was an undergrad at Université de Montréal, the theory of computation class which dealt with automata was called "Informatique Théorique"; literally, "theoretical computer science". "Why do theoretical computer science," I'd ask, "let's do practical computer science instead!" However, thanks to the enthusiasm of my professor and his teaching assistant and the very interesting nature of the subject, it became the class that I enjoyed the most of my whole undergrad! And to this day, some of the lessons I learned remain important in my day to day work for some of the reasons mentioned by prof Ullman in the video: I now know that some problems can't be solved, some take too long to solve, and some problems require less powerful mechanisms to solve. And knowing this, I'm able to recognize when they are applicable or at least have an intuition that maybe they could be applicable and thus I have a clearer idea of how to solve certain problems.

I highly encourage you to learn about this stuff, it's a lot of fun and is actually practical!

<comment><USER3> Regular expressions are probably one of the most practical and immediately obviously useful things to come out of automata theory.

<comment><USER4> I'm interested to hear you say this. I teach this course, to students who mostly go on to do Java coding. I have several times run into an old student who told me that they never once used regexes after my class, either in school or in work.

<comment> iso8859-1 One reason may be that practical regexes have so many extensions that you can't many of the usual tricks on them.

[http://stackoverflow.com/questions/6363397/how-to-tell-if- on...](http://stackoverflow.com/questions/6363397/how-to-tell-if-one-regular- expression-matches-a-subset-of-another-regular-expres)

<comment><AUTHOR> I find it helpful to distinguish between "regular expressions" as something mathematical and "regexes" as nebulous more-than an NFA and less than a Turing complete grammar...DFA regex engines being the Platypus that proves the rule.

As soon as you have backtracking and capture groups it's not a regular expression in the mathematical sense. These features make regexes more useful in many simple cases at the cost of making them harder to reason about in more difficult cases.

</comment></comment></comment></comment></comment><comment><USER5> I took this on Coursera a couple of years ago and it was the automata theory class I never managed to take in college but always wanted to.

As you might expect from a course by Ullman, it's heavy on theory and detail.

People are right to say that this is a core topic in computer science, and I'd recommend it to people who like CS conceptually and are curious about the parts beyond programming. Automata come up everywhere!

<comment><USER6> Agreed; I took this the first time around and had a great time. Highly recommended! :)

For what it's worth, Sipser's _Introduction to the Theory of Computation_ helped me get through some of the gnarlier spots (and in turn, the lectures through some of the harder parts of the book). I picked up a used copy of the 2nd edition cheap off Amazon (it was sub-$20 iirc).

</comment></comment><comment><USER7> A few user written reviews for those interested in the course: [https://www.class-central.com/mooc/376/coursera- automata#rev...](https://www.class-central.com/mooc/376/coursera- automata#reviews)

</comment><comment><USER8> Out of all the theory I learned in school, learning a FSA in compilers class has probably been the most helpful. Whether I'm teaching kids 'if' statements for implementing a vending machine or sitting down with a client and trying to document their workflow, automata theory has been incredibly useful for me.

</comment><comment><USER9> I am an EE who has previously tried to take this course and found it incredibly hard because of theory, formal proofs etc.. Can anyone recommend a book, lecture notes to accompany this course to make life easy?

<comment><USER10> I am not sure what the course is like, so I am not sure if this would help, but Stephen Wolfram's book about automata is pretty good.

</comment></comment><comment><USER11> For those who want to dive further in automata theory, transducers and the non-commutative algebraic view of the theory, the following one by J. Sakarovitch is a fantastic book : [http://www.cambridge.org/uk/catalogue/catalogue.asp?isbn=978...](http://www.cambridge.org/uk/catalogue/catalogue.asp?isbn=9780521844253)

</comment><comment><USER12> I'm probably going to check this out. I've taken several Coursera courses in the past and they've been great.

</comment><comment><USER13> I was lucky to have an excellent professor for a similar course in college (it was called Computation Theory). It completely changed the way I think about programming. Specifically, it changed how I think about program state and software bugs. Also, knowing about finite state machines really helps with requirement analysis.

So, highly recommended.

</comment><comment><USER14> The book by Peter Linz for Theory of Computation ([https://books.google.co.in/books/about/An_Introduction_to_Fo...](https://books.google.co.in/books/about/An_Introduction_to_Formal_Languages_and.html?id=Cgooanwdo9AC)) is also a good text.

</comment><comment><USER15> I am taking this course as it is a prerequisite to the subjects of compilers and computational complexity theory.

Has anyone used Sipser's text with this course? I found Sipser's textbook a great introduction to this field and thinking of complementing this course with the book.

</comment><comment><USER16> I've had a few similar courses at university, but they've always been limited to NP-completeness, does anyone know how I can expand on this? That is, learn beyond NP-completeness (Books / Online courses etc)?

<comment> grumpy-buffalo If you're interested in computational complexity theory, I recommend "Computational Complexity" by Christos Papadimitriou. It's a classic, though it's a bit dated.

</comment></comment><comment><USER17> Do you have to use your full name to enroll, in the field asking for it? I've probably become excessively paranoid about giving personal info on the web - Stanford is probably OK...

<comment><USER18> Judging from my account, no you don't. Maybe if you are planning on being certified but just to take a course, no.</comment></comment>


How my country annoyed me today - <AUTHOR> https://codin.ro/how-my-country-annoyed-me-today/ <comment><AUTHOR> TL;DR - Romanian Constitutional Court is hosting a PDF file of a book, thus infringing copyright. Furthermore, a travel portal made with state money has a feedback form that wasn't ever supposed to function.</comment>


Guests refuse to leave Airbnb host's house - <AUTHOR> http://edition.cnn.com/2014/07/23/travel/airbnb-squatters/ <comment><USER2> It's really disappointing that Airbnb didn't offer any help until _after_ the story got picked up by the media.</comment>


Technology in Education House Committee (1995) - <AUTHOR> https://www.youtube.com/watch?v=hwsQn1Rs-4A <comment><AUTHOR> panel of witnesses featuring Seymour Papert & Alan Kay starts at 8m:20s</comment>


HelloFax (YC W11) Launches HelloSign to Take On Electronic Signature Industry - <AUTHOR> http://betakit.com/2012/08/01/hellofax-launches-hellosign-to-take-on-electronic-signature-industry <comment><USER2> I find this to be a fascinating example of the Y-Combinator effect. SignNow has been doing this for six months now, on mobile and the web, with the top ranked signing iOS app. Then they launched Online Notarization, after fighting years to get it legalized and rolled out. Despite all this, they've gotten barely a mention on TechCrunch, and PG shut down their Online Notarization post. SignNow & others can absolutely be fabulously successful, but Y-combinator in my mind really makes your life easier in a lot of ways.

<comment><USER3> Not everyone who works with electronic signatures reads HN or TechCrunch, though.

<comment><USER2> Agreed. It's just an interesting advantage. I don't think it makes you successful, clearly most Y-Combinator companies still fail.

</comment></comment></comment><comment><USER4> This is awesome. I've recommended HelloFax dozens of times in the past year and a half or so for the awesome collaborative signing flow, and only a handful of time for the fax - though it's a lifesaver when I need to fax things.

The more widespread adoption electronic signatures get, the more convenient life will be in general. And more secure too - we've obviously understood secure digital signatures for awhile, but the cultural shift has just taken _forever_ to move online.

I'd be curious to hear from the founders if there are plans around expanding the scope/security of signatures, and some of the worries around mutually- compatible implementations?

</comment><comment><USER5> Nobody has mentioned RightSignature yet. They've been around for a while, and I've used their services for a long time as well (...and, helped bootstrap the codebase).

That said, I like the simple UI of Hello Sign thus far... but, I got a never- ending spinner when I tried to draw and submit a signature... and, when I tried to upload a document (it hung at "Converting...").

The price is definitely right, that's for sure. I'm very curious to see what the paid features are going to be... and how long things are going to be free. Running clusters of high powered document converting machines is not cheap!

<comment><USER6> We had some load balancer issues. This should be fixed now but if you're still seeing any issues try logging out and logging back in.

-Paul, HF Dev

</comment></comment><comment><USER7> This is fantastic - I just sent a prospect a proposal to execute. I had thought about EchoSign but I just didn't want to deal with what looked to be an enterprise-y solution. I just emailed HelloSign support asking if it was possible to copy and paste a link to a document that needs signing so that I can paste that link into my Basecamp messages to my prospects. For now I prepare my Basecamp message and prepare the document for signature and ensure I post the BC message a few seconds ahead of sending the proposal via HelloSign.

<comment><USER8> Hi, we actually have a reusable link feature, so if you have an NDA or onboarding docs that you need on a regular basis, you can upload the file and share the link.

Could be used on a one-time basis as well. Check the "reusable docs" tab on the left hand nav.

</comment></comment><comment><USER9> I've been secretly hoping HelloFax would make this move for a while.

100% of the time I use HelloFax, I'm using it to sign things. This is a step in exactly the right direction.

</comment><comment><USER10> We just fully onboarded a new employee without a single piece of physical paper thanks to HelloSign (HelloFax). It's awesome and saves us hours a week.

</comment><comment><USER11> Makes a lot of sense from use case and branding perspective. Always used their product just to sign docs, and never to send or receive faxes.

</comment><comment><USER12> Like someone else mentioned, the YCombinator effect makes the startup's life easier than the rest.In the long run, whoever innovates faster and listen to customer's needs better will win the race, it might be one company or more than one company similar to how enterprise esignature market has been dominated by top 2-3 companies so far. SignEasy App has been enabling mobile esignatures since July, 2010 and in fact, it was one of the first in bringing the novelty of esignatures using an iPhone/iPad and consistently ranked in top 50 business apps worldwide.

At the end, all of the new startups are all trying to make digital signature universally accessible to everyone and trying to innovate better as compared to the status-quo.

Thanks, Sunil Patro

Disclaimer: I am the founder of SignEasy App (Formerly EasySignMobile).

</comment><comment><USER13> Finally!! I've been hoping HelloFax would do this for months now. This is exactly the right move and a good lesson for other companies that are faced with a similar two use-case problem.

</comment><comment><USER14> Isn't there some commonly accepted cryptographic digital signature standard in the US, as it's the case in many European countries (where the user's keys are basically certified by a government agency)? Using simple pictures as "digital signatures" seems like multiple steps backwards to me.

<comment><USER8> Hi,

Our signatures are compliant with all US and EU digital signature laws:

2000 U.S. Electronic Signature in Global and National Commerce Act (ESIGN) Uniform Electronic Transactions Act (UETA) European Directive (EC/1999/93)

More info can be found here: <http://www.hellosign.com/info/legal>

-Joel from HelloSign

</comment></comment><comment><USER15> lol. ui rip much? classy

<comment><USER16> Who did they rip?</comment></comment>


In the U.S., an Angioplasty Costs $32,000. Elsewhere? Maybe $6,400 - <AUTHOR> https://www.nytimes.com/2019/12/27/upshot/expensive-health-care-world-comparison.html <comment><USER2> My insurance paid about 60k for an angioplasty + 4 days of ICU in Mexico for a pulmonary embolism from a DVT. Granted this was in a private top of the line hospital with a US trained doctor, but still, good medicine is expensive everywhere.</comment>