Stop Calling It "Military-Grade Encryption" - timothy-quinn https://blog.signata.net/military-grade-encryption/ <comment><AUTHOR> Yeah, this part rings totally true:

> _I actually do a double-take when a company says "Military-Grade", as I > start to question how well they know cryptography, and if they may have > picked an inferior algorithm thinking it's safe._

"Military grade" might sound good to marketing people, but to everyone that's actually involved in digital security, it sounds like it's made by people who have no idea what they're doing.

Another phrase like that is "patented technology" or "patent-pending". Maybe it sounds good to some people, but to to engineers it's a big red flag.

<comment><USER2> My worst red flag is "proprietary". It gives me an instant head ache because it makes me think of bad quality, terrible documentation and just over all pain.

<comment><USER3> I've noticed this even with fast food commercials which say things like "our proprietary blend of spices" in a tone implying you should be excited about it.

<comment><USER4> I'm fine with proprietary spice blends. At worst, it doesn't taste the way I want. But with encryption, "proprietary" means "untested", and that's a really bad idea.

</comment></comment></comment></comment><comment><USER5> The salesmen at the company I work with at the moment (industrial/commercial IoT) have adopted "banking-grade" for laymen, and have learned to recite the algorithms and/or protocols for anyone who expresses further interest.

Stereotype incoming: This might be a cultural thing too. Military grade sounds like something that would play well to the American ear, whereas these guys are British.

<comment><USER4> When I hear some Americans about their banks, I'm not sure "banking grade" will leave a positive impression there.

</comment></comment><comment><USER6> "Military-Grade" encryption. In my experience, this involves writing passwords on daily orders and on the big white board in the ops room, giving them out over the phone to anyone with a suitably clipped voice, and laminated guides to zipping files with a password - from which everyone then copies the example password they can see in the laminated picture - physically tied to "the encrypting PC" so that nobody can wander off with the guide.

<comment><USER7> It's this comment that should be laminated...

<comment><USER8> Seconded.

</comment></comment></comment><comment><USER9> To me, military-grade means that you run it over a physically separated network and post armed guards who will shoot all intruders.

<comment><USER4> I will remember that for the next time someone calls something "military grade".

"So you've got armed guards ready to shoot anyone who messed with it?"

</comment></comment><comment><USER10> As seen in the Crypto Snake Oil FAQ from the 90s: [http://www.interhack.net/people/cmcurtin/snake-oil- faq.html#...](http://www.interhack.net/people/cmcurtin/snake-oil- faq.html#SECTION000511000000000000000) If the first 20-30 years of "please don't" didn't work, I am reluctant to think this post will help...

<comment><USER11> Military Grade iirc referred to the encryption schemes defined in the Rainbow Series in the 80's and 90's today it is a buzz word but I'm not sure it was always that undefined.

</comment></comment><comment><USER12> I never really took it as a factual statement on how amazing the used encryption is. I always understood it as just another marketing term for the sales process. It probably sounds very good for a non technical decision maker and everyone who's technical enough to understand encryption will look at the more detailed information anyway.

</comment><comment><USER13> Military = Safety. There is a reason they didn't choose "Terrorist-Grade encryption"

<comment><USER14> Although that would probably need to be higher grade to work. Technically it would be the better name.

<comment><USER15> The best advertisement for me was that terrorists use Telegram and Russia wants to ban it.

</comment></comment></comment><comment><USER16> Yeah... This is a purely marketing reason. You're not going to convince people to change that with technical arguments and everyone who cares also knows that the term means zilch.

</comment><comment><USER17> While we're at it, can products stop using the phrase "aircraft grade aluminium" to sell trivial items such as forks, wallets and, I kid you not, Post-It note holders.

Yes, there are differences in quality possible with aluminium, as there are with most materials, but to make "aircraft grade" a main selling point for your sunglasses case is snake oil marketing nonsense.

<comment><USER18> Never know when you'll need to whittle yourself a new aircraft component with you're genuine hand forged pocket whittler after you've crashed your handmade single seater in the Tasmanian highlands.

</comment></comment><comment><USER19> This is just selling snake oil. I am not sure but this term is coined by people who are in marketing, who does not really understand the real strength and weakness of a encryption. Like a snake oil salesman they want to use a jargon to create an image in people's mind that they are extremely secure.

But in reality as the article points out AES, RSA and others are all used in military and all are military grade, but all have one or the other drawback if not used carefully. This kind of advertising is generally misleading.

Hopefully if someone challenge such claims in court will be nice. But I believe it will be hard to prove if the statement itself is untrue, its just that it is created with a spirit to deceive or conflate the meaning.

</comment><comment><USER20> By calling it Military Grade, it's easier to Ban it...

<comment><USER21> Actually, that's what already happened. And now they're trying to do it again.

[https://www.schneier.com/blog/archives/2019/07/attorney_gene...](https://www.schneier.com/blog/archives/2019/07/attorney_genera_1.html)

Posted on July 24, 2019 by Bruce Schneier on Security> Yesterday, Attorney General William Barr gave a major speech on encryption policy -- what is commonly known as "going dark." Speaking at Fordham University in New York, he admitted that adding backdoors decreases security but that it is worth it.

[https://news.ycombinator.com/item?id=19916938](https://news.ycombinator.com/item?id=19916938)

In 1998, the EFF and John Gilmore published the book about "Deep Crack" called "Cracking DES: Secrets of Encryption Research, Wiretap Politics, and Chip Design". But at the time, it would have been illegal to publish the code on a web site, or include a CDROM with the book publishing the "Deep Crack" DES cracker source code and VHDL in digital form.

[https://en.wikipedia.org/wiki/EFF_DES_cracker](https://en.wikipedia.org/wiki/EFF_DES_cracker)

[https://www.foo.be/docs/eff-des- cracker/book/crackingdessecr...](https://www.foo.be/docs/eff-des- cracker/book/crackingdessecre00elec.pdf)

>"We would like to publish this book in the same form, but we can't yet, until our court case succeeds in having this research censorship law overturned. Publishing a paper book's exact same information electronically is seriously illegal in the United States, if it contains cryptographic software. Even communicating it privately to a friend or colleague, who happens to not live in the United States, is considered by the government to be illegal in electronic form."

So to get around the export control laws that prohibited international distribution of DES source code on digital media like CDROMS, but not in written books (thanks to the First Amendment and the Paper Publishing Exception), they developed a system for printing the code and data on paper with checksums, with scripts for scanning, calibrating, validating and correcting the text.

[...]

The exposition about US export control policies and the solution for working around them that they developed for the book was quite interesting -- I love John Gilmore's attitude, which still rings true today: "All too often, convincing Congress to violate the Constitution is like convincing a cat to follow a squeaking can opener, but that doesn't excuse the agencies for doing it."

[https://dl.packetstormsecurity.net/cracked/des/cracking- des....](https://dl.packetstormsecurity.net/cracked/des/cracking-des.htm)

[...]

The US Department of Commerce has officially stated that publishing a World Wide Web page containing links to foreign locations which contain cryptographic software "is not an export that is subject to the Export Administration Regulations (EAR)."* This makes sense to us--a quick reductio ad absurdum shows that to make a ban on links effective, they would also have to ban the mere mention of foreign Universal Resource Locators. URLs are simple strings of characters, like [http://www.eff.org;](http://www.eff.org;) it's unlikely that any American court would uphold a ban on the mere naming of a location where some piece of information can be found.

Therefore, the Electronic Frontier Foundation is free to publish links to where electronic copies of this book might exist in free countries. If we ever find out about such an overseas electronic version, we will publish such a link to it from the page at [http://www.eff.org/pub/Privacy/Crypto_misc/DESCracker/](http://www.eff.org/pub/Privacy/Crypto_misc/DESCracker/) .

* In the letter at [http://samsara.law.cwru.edu/comp_law/jvd/pdj-bxa-gjs070397.h...](http://samsara.law.cwru.edu/comp_law/jvd/pdj-bxa-gjs070397.htm) , which is part of Professor Peter Junger's First Amendment lawsuit over the crypto export control regulations.

</comment></comment><comment><USER21> "Military-Grade Deception" is a legitimate term.

</comment><comment><USER22> > I actually do a double-take when a company says "Military-Grade", as I start > to question how well they know cryptography, and if they may have picked an > inferior algorithm thinking it's safe.

While I despise the term as well, this seems like an exaggeration. It's simply marketing, nothing else. Developers implementing security aren't also making sales decks.

<comment><AUTHOR> The thing is, real cryptographers and computer security experts never use language like this. You'll never here Daniel Bernstein (or whoever) call ciphers "military grade". Moxie Marlinspike never calls Signal "military grade", even though it's probably superior to most actual military systems. They know better.

<comment><USER22> Like I said, these real cryptographers aren't the ones going out and selling the software. Marketers use whatever terms their audience likes to hear.

<comment><AUTHOR> If it's a three person SaaS start-up or whatever, there's no guarantee there's a dedicated marketing team. And even if there is, the engineers/managers don't know better than to tell their marketers "hey don't use that kind of language". And the marketers selling a security product don't know better?

Sure, it's entirely possible that the product itself is absolutely solid. It would be a bit silly to rule a product out on this basis alone. But when evaluating a product, it's fair to "do a double-take" when seeing language like this.

</comment></comment></comment></comment><comment><USER23> Obviously it is all depends on the classification level of the platform in subject.

Military projects I've worked on, none of the known algorithms were in use. However, those are not available for commercial use whatsoever.

The author is right about one thing though, since if it is available in the commercial world, it is better off be called as "Industry Standard Encryption".

<comment><USER24> > Military projects I've worked on, none of the known algorithms were in use.

What do they use? I expected that us military would be 99% FIPS. (Other military could be GOST, I guess)

</comment></comment><comment><USER25> In a conversation I would interpret a mention of military grade encryption as meant to defend against nation state actor adversaries who have theoretically unlimited resources to mount an attack.

In that sense, I would expect it to be much more stronger than financial grade or consumer grade encryption system where adversaries are less stronger.

Certain attacks like supply chain attacks (factory, transport etc of hardware components) or special access attacks (Certificate authorities, BGP, DNS, ISPs etc) or social attacks (patsy or spy with MICE/RASCLS) that nation state actors can pull off which others cannot (without prohibitively significant effort or negative consequences).

So, usually if someone says military grade, I would look at it as being resistant to even these threats.

Of course, it is always about the system holistically and not just the AES, RSA, SHA-2 etc algorithms.

</comment><comment><USER26> I've seen a lot of people refer to their practices as "Industry Standard" when they know what they're doing, and a lot of marketing teams use "Military- Grade".

I don't think this particular hill is one to die on - the public have a perception that the military are amazing at using the latest and greatest technology, so the marketing teams will always continue to use it. Fighting it will be about as effective as fighting clickbait.

Instead, let it guide your own choices. Any sign like this that shows the marketing team wrote the Security Policy page is one where you should absolutely start questioning if they know what they're doing.

</comment><comment><USER27> To be fair to the marketing zombies, I kind of see why it would be easier to sell "Military-grade" rather than "Standard".

To our definition of "Standard" this means up to scratch and implemented correctly to specification - to the normal folk this is probably interpreted as "regular" or "basic-tier".

I'm a very important and aspirational small shipping/accountancy/dog-walking firm. I don't want that potato-tier regular encryption - I deserve super-duper fabtastic encryption like the banks have.

Maybe we _should_ call it Fabtastic Encryption 12.0 (people like numbers after their software).

<comment><USER28> Double ROT-13 is for the plebs who can't afford better encryption. We do QUADRUPLE ROT-13! Take that, crackers!

<comment><USER29> Those are puny numbers. Don't talk to me until you're using ROT-26, or better yet, ROT-52.

</comment></comment></comment><comment><USER30> Probably it is because I'm not a native speaker but I'm not seeing any difference between Military-Grade or Industry Standard Encryption. Can anyone please clarify what the benefit is? Are these well defined terms and does Industry Standard Encryption imply that it's continually updated?

> _MD5 is thoroughly useless as a hashing algorithm[...] but it was used by > the military and banks in the past, so it 's technically "Military-Grade"_

If it was used by the Industry in the past wouldn't the same hold true for Industry Standard Encryption?

Edit: quote formatting

<comment><USER31> They're all just marketing terms and have no technical meaning. The author just wants the marketing terminology to better reflect the technical reality of all applications using the same technologies at any given time.

</comment></comment><comment><USER32> Most of the software either claim it military grade encryption or bank level encryption, which is literally AES256.

Out of topic, my phone case - Spigen provide military grade protection too. :)

</comment><comment><USER33> Am I the only one that gets a NET::ERR_CERT_AUTHORITY_INVALID when I visit the page in Chromium? Quite ironic, considering the title of this item.

<comment><USER34> You can use add-ons like Certainly Something (I don't know the name of an equivalent for Chromium but I bet there is one) to show you exactly what's in these certificates.

By far the most likely cause of an error like this (in which the browser clearly connected but didn't like the offered certificates) is that an intercepting proxy aka a MITM or middlebox is between your browser and the remote site and it fucked up.

Things that are intercepting proxies (some of which you might have classified wrongly as something else)

* Most 3rd party AV "solutions" or "endpoint protection" on your machine itself

* WAFs

* Any kind of "Next generation firewall"

* Government or ISP "filters"

All these products are pretty bad, and most are worse than useless. Recommendations to get one or more of them for "security" are probably this era's "Rotate passwords every 30 days" in terms of the actual security behaviour that results as distinct from what the policy proponent imagines will happen.

</comment></comment><comment><USER35> The EU has strict food labelling laws[1]. They stop companies making stupid claims like "100% asbestos free!", or claiming to be a health food when a major indicator is way out of line with guidelines.

I think marketing in general could learn something from that. Screen out ridiculous claims that have no basis on the viability on the product, and force people to focus on product and deviances from industry "standard".

For example, your transport layer might be using the same ciphers and key length as a military installation, but if Maureen in accounts can log in from home with the username and password she's used on every site since 2002 and access 400,000 customer details, and download them to an unencrypted file on a personal computer... You're not meeting GDPR obligations, let alone military or banking standards.

... And by tangential extension, I think non-developers might be surprised just how many companies still have absolutely zero _effective_ access control to data. No storage encryption. No plans to warehouse or delete old data. Just records in a database (or shared spreadsheet) where a username and password, and sometimes just network access, will give you PII for every customer in the last 20 years.

[1]: [https://ec.europa.eu/food/safety/labelling_nutrition/claims/...](https://ec.europa.eu/food/safety/labelling_nutrition/claims/nutrition_claims_en)

</comment><comment><USER36> "Military Grade" fails to clarify which military or from when, the enigma code was military grade but it wouldnt stand up to much now

<comment><USER37> The Caesar cipher was the best encryption available, once upon a time.

</comment></comment><comment><USER38> Isn't it just an expression by now though? Like how "weapons-grade" is used for many things that aren't nuclear material.

</comment><comment><USER39> Anyone else getting a "Untrusted SSL Server Certificate" on the page?

<comment> timothy-quinn OP here. What browser/OS do you use? Our blog is run on Ghost so we don't actually control the TLS cert used, but we can try to find the cause of why it's not trusted and fix it.

<comment><USER40> Hi! John from Ghost here, had a quick look and can't see any issues on this side with the cert. It's a relatively new certificate, though, so there could be an old cache on an edge node somewhere which just hasn't fully updated yet.

I suspect this is a one-off, but please do reach out to us if you still have issues, I've already passed this along to the team to fast-track support if you do send us an email.

</comment></comment></comment><comment><USER41> First guns then nmap.

</comment><comment><USER42> Ok, I don't often comment on web design, but why is there the effect of shining an extremely dim torch at a dark page? I'm finding it very hard to read.</comment>


Uncommitted - <AUTHOR> https://github.com/brandon-rhodes/uncommitted <comment><USER2> This is really interesting. It would be amazing if it could be run from the repository side rather than from a single local machine only. ie Instead of running on my personal dev machine over all of my local repositories looking for changes that I forgot to commit or stash, it could be run from github to all machines that had copies of the repo. Result: a prompt reminder to commit (on the github server machine) of all remote machines work. The use case is that of a project manager looking for uncommitted work from software dev teams.

A further application of this tool would be to create automated backups of every branch of a repo on every development machine. The use case is again from project management: periodic backups for safety or a backup of everything if there is a contract dispute or one consulting team's contract is ending and a new one is starting. This is a ton of value for all companies that do software to have this tool expanded to cover both of these use cases. You could definitely found a startup to sell this service to any company that develops software.</comment>


Id GPLs Wolfenstein: Enemy Territory and Return To Castle Wolfenstein engines - <AUTHOR> http://www.phoronix.com/scan.php?page=news_item&px=ODUwNA

<comment><USER2> Just like nailers now dead comment stated, this is still id Tech 3 and the games are from 2001 and 2003 respectively. While probably a little bit better than Quake 3 it's still old. For age reference, the original "Call of Duty" was based on id Tech 3 and released in 2003. (Wolfenstein: Enemy Territory != Enemy Territory: Quake Wars)

</comment><comment><USER3> This is huge. They open sourced quake ages ago and that spawned a billion games _and_ game engines. Can't wait to see what people do with this one.</comment>


Applying machine learning and deep learning methods to audio analysis - <AUTHOR> https://www.comet.ml/blog/?p=916 <comment><USER2> As an introduction introduction I guess this is OK. However there are two major limitations:

1: The feature extraction ends with mean-summarizing across the entire audio clip - leaving no temporal information. This only works well for simple tasks. At least mentioning something about analysis windows and temporal modelling would be good, as the natural next step. Be it LSTM/GRU on the MFCC, or CNN on mel-spectrogram.

2: The folds of the Urbansound8k dataset are not respected in the evaluation. In Urbansound8k different folds contains clips extracted from the same original audio files, usually very close in time. So mixing the folds for the testset means it is no longer entirely "unseen data". The model very likely exploits this data leakage, as the reported accuracy is above SOTA (for no data-augmentation) - unreasonable given the low fidelity feature representation. At least mentioning this limitation and that the performance number they give cannot be compared with other methods, would be prudent.

When I commented similarly on r/machinelearning the authors acknowledged these weaknesses, but did not update the article to reflect it.

<comment><AUTHOR> we're working on another version fixing the folds issue on Urbansound8k and will update the article asap.

<comment><USER2> Nice!

<comment><AUTHOR> just to clarify - are you referring to this experiment? [https://www.comet.ml/demo/urbansound8k/be09e32700cd435fb6b55...](https://www.comet.ml/demo/urbansound8k/be09e32700cd435fb6b554befb01fc4c)

<comment><USER2> Sure, that demonstrates the issue. Problem is with using train_test_split(X, yy, test_size=0.2..) - this assumes independent samples, which is violated for this dataset (because some come from same source audio files). The easiest (and completely acceptable) is to use one fold as the validation data, one fold for the test set, and the remaining folds as training.

This problem is unfortunately quite common even in academic papers using this dataset, even though the authors warn about it.

EDIT: There is one more issue with Urbansound8k folds, and that is that the difficulty of the various folds is quite different. So one should ideally report the performance across all folds (mean/std or boxplot). But this is a minor issue compared to data leakage.

PS: Nice use of Comet.ml platform this, collaborating online on improving the experimental setup :)

<comment><USER3> Hey jononor — we've updated the post to split the training and test sets based on the folds. Good catch and thanks again for reporting this. Some of the experiments in the project will still have the old code, but the blog post will reflect this new train/test split.

<comment><USER2> Nice. Did you update the reported results also? I think they will change quite a bit

</comment></comment></comment></comment></comment></comment></comment><comment><USER2> Warning: shameless-self-promotion. For those that wish to go a bit beyond this article, I gave a presentation on the topic at EuroPython. [https://www.youtube.com/watch?v=uCGROOUO_wY](https://www.youtube.com/watch?v=uCGROOUO_wY) It explains how to build models that can make use of temporal variations and learn the feature representations based on the (Mel) spectrogram. Especially suited if you are already familiar with image-classification using Convolutional Neural Networks.

</comment><comment><USER4> As one of the long-suffering Comet.ml customers, I wish they'd spend more time working on their site's performance and less on writing blog posts. It takes multiple seconds for graphs to render, and leaving any part of Comet.ml UI open in the browser leads to spinning fans and quick battery drain when working from a laptop. The logging component will sometimes hang without a warning and hang your training session as well. Bizarrely, there's no way to show min/max metric values for ongoing and completed runs (AKA the only thing a researcher actually cares about): you have to log them separately in order to display them.

This is a weird field: these are not difficult problems to solve, yet as far as I can tell, all of the popular choices available so far each suck in their own unique way and there's no option that I know of that actually offers convenience and high performance. FOSS options are barely existent, as well, and they also suck.

For the things where Comet.ml would be too onerous to deal with, I still use pen and paper.

<comment><USER5> We're actually very happy with Comet and have been using it on v large projects (>50 researchers, 10k models). You can reduce the refresh interval and the amount of data points reported if things feel slow

<comment><USER4> I don't log that many points as it is: about 4K data points per run in total (windowed average loss and LR every 25-30 batches, eval metrics every epoch), for all metrics combined. I also log the same data to TensorBoard, which renders everything pretty much instantaneously with no issues at all, even though I tell it to not downsample beyond 5K samples per graph.

<comment><AUTHOR> M0zg do you mind sending me an email with your project? Happy to look into it. gideon _a t_ comet.ml

<comment><AUTHOR> Also keep in mind that unlike tensorboard we keep your full data series available in the API and only downsample the charts to 15k points.

</comment></comment></comment></comment></comment><comment><USER6> Is there a method to detect a specific word and tell me the timestamp throughout an audio sample easily? I've been trying to implement something like this but wasn't sure how to approach it.

<comment><USER7> If you already have the transcript without timestamps (e.g. for an audiobook where you know the source text), you could use [https://github.com/readbeyond/aeneas](https://github.com/readbeyond/aeneas) , which infers the timestamps by aligning text-to-speech output with the audio using dynamic time warping.

If you don't have the transcript, you'd use a transcription service that also gives you timestamps. E.g. there was a frontpage submission yesterday where someone used AWS Transcription to count the number of words in each minute of a talk: [https://news.ycombinator.com/item?id=21635939](https://news.ycombinator.com/item?id=21635939)</comment></comment>


Visiting a Kerr black hole - <AUTHOR> http://www.youtube.com/watch?v=T_TU6T4-0LU

<comment><AUTHOR> Here is the corresponding blog post on David Madore's blog: [http://www.madore.org/~david/weblog/2011-03.html#d.2011-03-0...](http://www.madore.org/~david/weblog/2011-03.html#d.2011-03-06.1855) (sorry it's in french).</comment>


Ask YC: Free / Open Source Solution for online meetings - <AUTHOR>

While I worked at BigCo, we used a really nice tool (http://en.wikipedia.org/wiki/Adobe_Acrobat_Connect) to have our online meetings - sharing the screen, with a small chat window, etc. I am trying to find something similar to this, but open source (preferably GPL'ed or under some more liberal license). The best I was able to find up to now was http://webhuddle.sourceforge.net - anyone has any recommendations? <comment><USER2> Open Meetings, hosted at Google Code: <http://code.google.com/p/openmeetings/>

It's ugly but it works, and it's free.

</comment><comment><USER3> To be clear, did you specifically need the code so you could self-host/tweak or did you need a free service variant?

If you need services, one such free meeting service is dimdim.com.

For open source stuff I had heard of the old JWebPresenter (e.g. <http://zhao.sourceforge.net/#introduction> ), but I'm not sure what else is out there nowadays.

<comment><AUTHOR> I want something I can self-host - both because of cost, and because I want to be able to tweak things as needed. I haven't looked at JWebPresenter before - thanks!

</comment></comment><comment><USER4> Ditto @thorax - check out Dimdim: <http://www.dimdim.com>

It's an Open Source virtual conferencing app comparable to Acrobat Connect (which we used to use as well). We make a JumpBox for it available here: <http://jumpbox.com/app/dimdim>

<comment><AUTHOR> Nice. I discarded it because from the source forge page it looks like dead (no update since 2008 or so, according to the comments in <http://sourceforge.net/projects/dimdim/> ).

I will re-consider it..

</comment></comment><comment><USER5> <https://help.ubuntu.com/community/VNC> I've used this successfully with <whatever mac thing name is></comment>


Tunnel your Android traffic over ssh - <AUTHOR> http://lifehacker.com/5799888/ssh-tunnel-is-the-easiest-way-to-tunnel-on-your-android-device

<comment><USER2> The article mentions skipping around the Great Firewall, or accessing services only available in certain countries. To me the benefit would be that the phone company or whatever local wifi I am using couldn't log my traffic. You may lose out on some services using geoip for your location, but the tradeoff is acceptable to me.

</comment><comment><USER3> Doesn't this presume that the app vendor can be trusted not to be intercepting your traffic?

<comment><USER4> You could build it yourself from the source? <http://code.google.com/p/sshtunnel/>

At some point you gotta trust someone though.

<comment><USER5> Well, if you can't trust Ken Thompson, who can you trust?

<http://cm.bell-labs.com/who/ken/trust.html>

</comment></comment></comment><comment><USER6> Anyone else trying to read lifehacker without JS?</comment>


Apple - Supplier Responsibility - <AUTHOR> http://www.apple.com/supplierresponsibility/ <comment><USER2> long time coming, and glad to see it.</comment>


Who Fatally Wounded Microsoft? It Was Bill Gates. - <AUTHOR> http://ipadtest.wordpress.com/2010/03/11/who-fatally-wounded-microsoft-it-was-bill-gates/ <comment><USER2> > How is it that Apple is set to revolutionize all of computing within a few > weeks with its iPad?

Can we cut down on the hype a bit, please?

Whether the ipad is fad, fashion or revolutionary remains to be seen.

Apples track record of late is very impressive but this is extrapolation without any basis in fact.

<comment><USER3> A lot of the general notions about computing embodied in the iPad are revolutionary. The only question is whether Apple will succeed. Microsoft already tried this same revolutionary move with tablet computing and failed. (Because they were trying to drag along Windows. I can see this as I Write this reply on a Windows slate PC.)

From the comments:

 _The idea of shackling an old business to a new business rings true in so many industries right now.

Watching media companies try to get the web to pay for operating a printing press, for example._

Apple is in danger of falling into this same trap as advancing tech enables form factors that change how people use computers. Their closed strategy could be a serious anchor as such new form factors blossom into a "Cambrian explosion" of unexpected new uses.

The difference between a Jailbroken iPhone and a shackled one is _stark_. (I can have say app in the background. I use this to make Google Voice calls over Skype on Bluetooth. My normal cell calls are 10¢ a minute Prepaid.) Someone smart could leverage a more open platform correctly and seriously wound Apple. Lucky for Apple, the telecoms are 10x more shackled than they. But that will only save them in the short term.

<comment><USER4> > _A lot of the general notions about computing embodied in the iPad are > revolutionary_

Name 2.

<comment><USER5> 1) sandboxed apps. Concept isn't new, but consumer PCs have never had sandboxes. A game or word processor you install shouldn't have access to your tax returns. With the iPad nasty apps can't do much damage.

2) backup app installations, settings and documents by syncing with iTunes. iPad breaks or gets stolen? Buy a new one and plug it back in and you're back in business.

3) App Store. Now only used for "gimmick" software on the iPhone, but the potential is enormous. Only apt-get comes close, but apt-get doesn't have an easy payment model. And it has this dependecy-hell and installing updates can wreck havoc.

4) computer with built-in GPS & accelerometer and 3G internet. How many laptops have that?

5) locked-down and DRMed, even for developers. That's certainly revolutionary for a consumer PC.

6) No tree based filesystem. No /home/[user]/Documents, no c:\Users\\[user]\AppData. Your files are just "there".

<comment><USER2> > 1) sandboxed apps. Concept isn't new, but consumer PCs have never had > sandboxes. A game or word processor you install shouldn't have access to > your tax returns. With the iPad nasty apps can't do much damage.

Sandboxes as a concept aren't new, and so are not revolutionary. Consumer PC's have had sandboxes every since you've been able to run a java programs within a browser.

> 2) backup app installations, settings and documents by syncing with iTunes. > iPad breaks or gets stolen? Buy a new one and plug it back in and you're > back in business.

That's a neat feature, but not a 'make-or-break' thing. Nice to have, not revolutionary.

> 3) App Store. Now only used for "gimmick" software on the iPhone, but the > potential is enormous. Only apt-get comes close, but apt-get doesn't have an > easy payment model. And it has this dependecy-hell and installing updates > can wreck havoc.

Apt-gets strength is that there is no payment model, access to lots of high quality software for the sum of $0. That's not a weakness, that's a strength. Iphone apps in general are trivial, with the occasional exception. There is an enormous body of real world, non-trivial software in the apt-get (and yum) repositories.

The potential is there to re-ignite a new closed source era, and that's definitely not revolutionary.

> 4) computer with built-in GPS & accelerometer and 3G internet. How many > laptops have that?

My netbook has all those except for the accelerometer, it runs Ubuntu notebook remix and works pretty good. It also has access to the above mentioned apt-get repositories.

> 5) locked-down and DRMed, even for developers. That's certainly > revolutionary for a consumer PC.

That's a complete loss, not revolutionary. Trusted computing through the backdoor. If microsoft were to do something like this there would be shrunken heads on stakes. We definitely wouldn't call it revolutionary.

> 6) No tree based filesystem. No /home/[user]/Documents, no > c:\Users\\[user]\AppData. Your files are just "there".

I can see how that would be useful if you only have a relatively small number of files. But here on my collective drives there are literally 10's of millions of files. Just being worried about namespace collisions as well as forgetting what a file is named, I usually can find it because my directory structure is organized. I can see how tagging would go a long way towards mitigating that, but the 'tree' based file system works quite well because that happens to be how we normally organize documents.

If the lack of something is revolutionary then I invite you to store all your files in the root directory of your harddrive.

<comment><USER3> _Sandboxes as a concept aren't new, and so are not revolutionary._

You have a huge misconception here. Revolutionary tech takes _decades_ to be fully absorbed by the culture. Or was the Internet not revolutionary because Minitel Videotext terminals were in front of the general public years before it was?

<comment><USER2> There is a bit of a split I think. The moment when some technology is invented vs the moment when as the result of that technology some revolution happens are not the same, but we can speak about a 'revolutionary invention' as well as the actual revolution without getting mixed up.

So, Minitel, which in turn was a turnkey terminal version of the videotex standard was revolutionary in the sense that it allowed a whole country (France) to use online services.

But the real revolution came when the world wide web allowed _everybody_ to publish and consume content. The videotex services made a big thing out of being an 'information provider' and a 'consumer', which of course suited the telcos that deployed these devices just perfect.

It never crossed their minds that the unwashed masses would want to publish their own content.

The internet pre-dates the minitel system by about a decade by the way.

But the world-wide-web, a relatively simple layer on top of the internet is about as revolutionary a change as we've had since the electronics revolution and the advent of personal computing.

<comment><USER3> _The internet pre-dates the minitel system by about a decade by the way._

I'm aware of that. I'm a bit older than most suspect.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER6> Was Kodesh new to Microsoft at the time? The culture there is a "prove it works first, ask for approval once you've worked everything through in detail and need a Big Change" one. I would have expected any reasonable manager to just spin up a small team to fully mock up a few devices in concert with a couple of clients and present those up the chain.

I personally would have nixed him on this as well. It's quite easy to say, "we should scrap this and build something else" and another entirely to provide sufficient evidence that you're capable of doing so. If, for example, this guy wasn't able to deliver but was given a charter based on his random memo, Microsoft wouldn't be in third right now. They would be completely out of the game.

Even readers of this site who hate Microsoft have probably experienced it: most bad managers step into a new position and immediately talk about how the old thing needs to be thrown out and a new one built, naturally at great time and expense (and hiring a few of his old "Architect" buddies) but with amazing benefits down the line. How does that story usually end when you say "ok"?

<comment><USER7> According to his LinkedIn profile, Kodesh started working at MS in 1990. An MS press release says Kodesh was promoted to "vice president of consumer appliances" in august 1998 and he wrote his memo in september 1999.

</comment></comment><comment><USER8> Well, to be fair, It's not clear that Microsoft would have come up with the Zune interface on their own without a number of companies such as Apple, showing how successful such a platform can be.

It's easy to say "Create a simple, consumer oriented, touchscreen device" - it's entirely a different thing to implement. I've been using, and hating, the Windows Touch Screen Kiosks for over 10 years, frequently at Movie Theaters. Someone has taken a Desktop OS, and just ported it to a touch screen, rather than starting over from scratch, and saying "What should a touch screen OS look like" (Hint, it doesn't have a mouse pointer)

Also, note that Microsoft _did_ try and start over with a "simple, icon oriented, technology free" user environment - Microsoft Bob was that technology attempt. It was just a failure.

Perhaps the lesson to be learned about Bob, was that it's important to fail more quickly, so you can tack and take on a new approach. The goal was admirable (eliminate the technology interfering with the user doing their job) - Just didn't have the right team/processing/hardware at the time.

This may be contentious to a less informed audience, but in Many ways, the goals embodied in Microsoft Bob are represented in the iPad.

<comment><AUTHOR> Your reference to BOB sent me researching:

<http://en.wikipedia.org/wiki/General_Magic> <http://en.wikipedia.org/wiki/Microsoft_Bob>

</comment></comment><comment><USER9> Very telling:

> Gates rejected the suggestions. "It's very disappointing you feel that way," > he told Kodesh. "We don't have time to start from scratch."

1\. "I'm disappointed you feel this way:" This is a direct criticism of Kodesh's personal feelings and an attack on his loyalty of the party line. This would have been so much better had Gates written "I can understand your enthusiasm for starting over, however..."

2\. The old, old story: "If you don't have time to do it right, where will you find the time to do it over?" And indeed they did end up doing it over with Zune, having frittered years away with CE.

<comment><USER10> 1\. Better for whom? Kodesh's feelings? WGAS? The guy was probably making 6, maybe 7 figures. He can handle the truth.

<comment><USER9> His salary is irrelevant. The point is that Gates criticized Kodesh for having ideas that Gates didn't like. That is a very different matter from criticizing Kodesh's ideas themselves. The message is clear: Think what we tell you to think or leave.

Now you ask, better for whom? And I suggest, _Better for Microsoft_. It's possible to encourage people to explore different directions without pursuing them all. Gates could have ixnayed the message without ixnaying the messenger, and I hope that I am able to do that when it's my turn to deal with someone suggesting I scrap everything I've worked hard to build.

</comment></comment></comment><comment><USER11> If 255 billion is fatally wounded, someone please shoot me.

I understand they have their problems. Windows 7 is doing well. Bing has been growing. Mobile they're actually doing something with now. XBox division is wiping the floor with PS3.

I think it's the long term stuff that worries me about MSFT. ie- windows and office will one day disappear. what are their plans for then? Maybe they'll just evolve?

<comment><USER12> I think the most major issue is managerial - the Xbox division from what I've heard has managed to conquer many of the serious management issues that plague the rest of MS (particularly the "main" teams, Windows and Office). MS is infamous for having a thick, thick layer of middle management that has proven to be detrimental to innovation and productivity.

I think MS's long-term success hinges on being able to determine the managerial how and why of the successful, innovative teams at MS (Bing, Xbox, etc) and transferring that to the rest of the company.

<comment><USER11> Too much middle management. Like 7 layers worth. Microsoft needs to cut fat.

<comment><USER13> Downmodded why? I. M. Wright's "Hard Code" (published by Microsoft no less) pretty much makes this claim. Apparently they used to laugh at GM's layers of management, and now they have a similar number.

<comment><USER12> I work in Seattle, and know a number of Microsofties, and this is a pretty reliable consensus too even for people who are still there. The org tree is very, very deep and this causes a lot of problems - especially as a company ages and people go from enthusiastic risk takers to CYA corporate types.

</comment></comment></comment></comment></comment><comment><USER14> Meh... I think this is part of the story but not the real reason.

If I remember correctly, most handset makers resisted Windows CE out of fear of becoming "just another bunch of box makers" for Microsoft. I think that's why you saw such an embrace of Symbian (or pretty much anything that wasn't Windows).

It may be hard to believe now but there was a time when everyone was terrified of Microsoft.

<comment><USER15> I actually thought it was that CE required more expensive chips to do the same thing.

</comment></comment><comment><USER16> I don't know that I would call this a fatal wound. In hindsight it may prove to have been a costly mistake but last I looked Microsoft was still around.

<comment><USER17> Not fatal but it opened the door for everyone else. If everyone was happy with the new Windows Mobile proposed in this article and it had widespread adoption, would Apple have developed the iPhone? They might have, but it wouldn't have been such a slam dunk.

<comment><USER4> They can still do a slam dunk ... the mobile market is big-enough for everyone to fit in.

Anyway, why in the world would anyone use Windows CE when there isn't a market for third-party apps on WinCE? What incentive does it offer for mobile manufacturers? Pocket Word?

That's what Apple (and also Palm and Nokia) did right ... delivered their own software, their own hardware, created a market for third-parties, delivered a decent design (personally I don't think it's revolutionary. it irritates me actually).

Hopefully Google/Microsoft learns from this. More competition is better for everybody.

<comment><USER10> Absolutely. They "almost missed the web" but then went on to have the dominant browser for over a decade. The history of Microsoft has been to let other people innovate. They did not invent the PC, the GUI, email, the web, the browser, spreadsheets, word processing or anything else that they now dominate the market in.

<comment><USER3> _They "almost missed the web" but then went on to have the dominant browser for over a decade_

Leveraging the desktop OS monopoly to do so. Do you think they can pull an analogous move again?

</comment></comment></comment></comment></comment><comment><USER17> So this is what happens when you decide to hold the line, rather than scrapping something that's not working for the next iteration. 11 years and counting on this one...

</comment><comment><USER18> _"To Kodesh, Microsoft's initiatives were driven by the dictates of the company's technology, rather than the wishes of consumers."_

That's the simplest summary, really. The bureaucracy problems feed into this, but you don't need much more.

When you're designing to please people who won't be using the system, _at the expense of those who will_ , nothing else is going to matter. You will fail.

</comment><comment><USER19> I wouldn't call Apple's process of developing the iphone and ipad "starting over" software wise though. As far as I know, the OS of both of these devices is based on OS X which of course can be traced back to Nextstep. I believe Microsoft did exactly the same thing with win NT; I've seen "embedded" systems running it. I would say what held back Microsoft's mobile devices in the past was UI and usability, which Apple seems to have well under control.

</comment><comment><USER20> Bill Gates' original vision was "a computer on every desk, running Microsoft software". Once he more or less reached this goal, around the mid-90's, _of course_ Microsoft stagnated.

I'd say that Bill's real failure was to not accept this fact and return as dividends or stock buybacks the tremendous amount of money that Microsoft was generating.

</comment><comment><USER21> I'm getting a bit tired of all this revisionist history from several years ago (this anecdote seems to be 13 years old). Especially on places which don't understand how the inside of MSFT works (and has evolved over time).

Also, I'm willing to bet that BillG had a lot more to say than just those 2 sentences.

</comment><comment><USER22> 10 years ago mobile phones where just microcontrollers with LCDs and Symbian OS on it. Users couldn't even install J2ME software on it. In terms of openness Google Android and Nokia Maemo are now the best mobile operating systems (albeit still not fully open yet). Talking about fataly wounded: iPhone is maybe the last phone which cannot run Java software in our days.

</comment><comment><USER23> _Why has Microsoft found itself in third place, behind Apple and now Google, in the mobile segment of computing?_

Because it's not an area they've ever been interested in.

Just because Mobile is the latest and greatest area of tech development doesn't mean everyone will stop using PC's tomorrow (and more importantly - that corporates will stop using PC's tomorrow)

So Microsoft got serious about "mobile" later than Apple - but it's always been a half hearted attempt. It seems as lot like MS wanting a finger in all the markets - "just in case".

<comment><USER24>
      So Microsoft scrabbled to jump on the mobile bandwagon
      much later

Uhm. MS released Pocket PC in 2000, Windows mobile in 2003. Apple announced iPhone in 2007. Google aquired Anodroid, Inc. in 2005, Open Handset Alliance was announced also in 2007. So no matter how you count MS jumped mobile bandwagon earlier.

<comment><USER23> Well I was sort of jumping on the same theory as the blog post. i.e. Windows Mobile was a passing thought - and it is only recently their trying to make more serious inroads.

(I clarified my original comment)

<comment><USER25> That didn't really seem to be what the article was getting at. Windows Mobile was a serious push to try and establish itself in that area. It just turned out to be a flawed one, and the main thrust of the article was that at least some people recognized it at the time but were shot down by the head of the company.

<comment><USER23> I disagree it was a serious attempt. Or at least a heartfelt one. Mobile was somewhere for windows to expand into.</comment></comment></comment></comment></comment>


An Unfinished Idea: Open Source Code Review As A Social Game - <AUTHOR> http://al3x.net/2010/01/01/code-review-as-a-social-game.html

<comment><USER2> Check out the Productivity Games section here: <http://42projects.org/> \- Ross Smith at Microsoft has been using game dynamics to test Windows 7 language quality, etc. <http://www.42projects.org/docs/GTAC_LQG.PDF>

I'm vaguely remembering that they were experimenting with code review at some point as well.

btw - my company provides game mechanics as a service that can be integrated into any app/website: <http://www.bunchball.com/products/nitroworks.shtml>

</comment><comment><USER3> We're certainly familiar with the lengths people will go to achieve accolades on the internet. Don't be surprised if you see more incentives on the site to encourage open source contribution.

</comment><comment><USER4> Somewhat related is <http://refactormycode.com/> that lets users paste snippets of their code and let others refactor.. no open source component to it though.</comment>


Hacker News gives "Unknown or expired link" Often when I click "More" - <AUTHOR>

<comment><USER2> I've been noticing it more frequently as well. It has changed the way I use HN. Now, I quickly scan the first page and open interesting stories in tabs. Then I quickly click More and do the same. Wash, rinse, repeat two or three times depending on how busy I am.

Another related issue: the expired page is remarkably stark and unfinished in comparison with the rest of the site. A minor nit, but since it shows up so often, it doesn't look great to the uninitiated.

<comment><USER3> I've often resorted to doing the same thing, but one problem with that is having to go back to the HN site to find the story to vote on it or comment. If a large number of people are pushing stories out to new tabs and ultimately ignoring the HN site after that, might it begin to affect the voting / ranking ?

<comment><USER4> And so, I have resorted to opening both the article and the discuss link, as you can still vote from there.

</comment></comment></comment><comment><USER5> From what I recall, this is because the 'More' link is implemented using closures, which get garbage collected after a while. So if you take too long and a GC has happened in the meanwhile, the link will be broken.

<comment><USER6> Seriously? Having 'paging' tied to the GC in this way, or any way at all for that matter, does not sound like a good idea to me.

</comment></comment><comment><USER7> <http://news.ycombinator.com/item?id=163755>

It's been an known issue for years.

<comment><USER8> It has been a known issue for years, yes, but it is getting worse. Presumably an increase in HN users is making it hit whatever threshold triggers the closure flush much more quickly than it used to.

These days the links often expire for me within a couple of minutes (YMMV depending upon how close to 'prime time' you read Hacker News).

</comment></comment><comment><USER9> Same here. Making my noon reading of HN pretty annoying. (Read front page, hit more, get expired, go back, reload, hit more ...)

</comment><comment><USER10> I was just commenting to a co-worker this morning that I have been receiving a lot of expired link errors lately and that HN's session expiration time must be short.

What language is HN written in?

I leave HN open in two tabs all day: one for the newest articles and one for the top articles. Article links to other sites don't expire because they're direct links to an external page. However, most internal links do expire if I haven't refreshed the page in an hour or so.

<comment><USER11> HN is written in Arc - a Lisp dialect coded by PG. You can see it here: <http://arclanguage.org/>

</comment></comment><comment><USER12> It's annoying, but overalI don't mind it.

What I will kill for though is a simple "return to homepage" link...or better yet a timed redirect...on the expired page.

I often browse with my laptop on the coffee-table and a wireless mouse in my hand and it's a pain to have to reach forward and hit the backspace button (or go all the way up to the back button) AND click the link at the top again.

Seriously, this is something that gets me EVERY DAY, and it's frustrating.

</comment><comment><USER13> I'm curious about this too. Why not fix such an obvious issue? Even if the workaround isn't perfect, a more graceful failure mode would be preferable.

</comment><comment><USER14> I find this extremely irritating too.

The way I overcome it is by using "Read It Later" (<http://www.readitlaterlist.com>) to bookmark the interesting ones during my initial early morning scan.

</comment><comment><USER15> Happens to me all of the time - it's pretty annoying. It would be great if HN used pretty URLs (e.g. <http://news.ycombinator.com/news/2>), or at least URLs that didn't expire.

<comment><USER16> The problem is, "what is page 2"? Ok, so it's "items 31 through 60." But that changes, very frequently. So when you hit the main page (results 1-30), HN has to remember what 31-60 is at that particular point in time, so when you later hit the More link, it can give you 31-60 for a time in the past.

Obviously it can't remember an infinite number of these, there's a limit, and how quickly you hit that limit probably depends on a combination of how many people are hitting the home page, and how often the order of items in the list is changing.

When HN was younger, you wouldn't see the expired link message that often, as fewer people were hitting the site, and the item order changed less frequently.

At least that's my theory.

<comment><USER17> > The problem is, "what is page 2"?

Sure, most solutions to this problem will involve compromises and won't be perfect, but just about anything would be an improvement over the current situation.

<comment><USER16> Yeah, good point. Considering that I have to go back to the front page and I lose the "older" page 2 results anyway, it'd be far preferable to just send me to a newer page 2. Could likely pretty easily implement that with a fallback query param, so the link could be something like "?fnid=foo&startitem=31" or whatever. If the fnid is no longer valid, fall back to the startitem param.

</comment></comment></comment></comment><comment><USER18> Yes, I've noticed this too -- it seems like it happens when I "take too long" looking at a New page. Since it doesn't seem to happen to me much on the home page, so maybe tied to the number of items posted since landing on a page?

</comment><comment><USER19> I think this alternative, HN styled, Techcrunch site got paging right: <http://tcfast.com/>

Maybe HN should follow the lead.

</comment><comment><USER20> I've only been using HN a short while, and even though this issue is terribly annoying, I will stay for the interesting articles.

</comment><comment><USER21> I have noticed this too. It is annoying. I just refresh the page and it works fine.

</comment><comment><USER22> There should be a link to this article at the top of the page.

</comment><comment><USER23> Who's the programmer?

</comment><comment><USER24> Can we fix it?

<comment><USER25> Agreed! We're a bunch of hackers; publish on github and let us do our thing!

<comment><USER16> <https://github.com/nex3/arc></comment></comment></comment>


Bill Gates sides with FBI over iPhone access issue - tefo-mohapi http://www.engadget.com/2016/02/23/bill-gates-sides-with-fbi/ <comment><AUTHOR> Bill Gates isn't that naive. He is siding with the FBI because he doesn't want to side with Apple.

<comment> tefo-mohapi I disagree. This is a criminal case</comment></comment>


Tech giants say black lives matter. But will they fix their diversity problem? - <AUTHOR> http://www.vox.com/2016/7/13/12171488/facebook-black-lives-matter-diversity <comment><USER2> You mean they will stop hiring Asians?</comment>


Show HN: Wizgig.com, community driven quick tips - <AUTHOR> https://www.wizgig.com

<comment><USER2> I like it. It will work. Limiting the tip size to 150 chars is a good idea. As is, not using loud, distracting adverts. Will you be collecting info on what a user looked at and then emailing them updates or tips on topics of their interest? Although email is getting out of hand and I think ppl will ultimately simply start deleting the email and finally unsubscribe. But what other way to keep them from forgetting about wizgig and keep them coming back?

Why do I check YCombinator everyday? I guess because I work with technology and would like to start my own business one day. YCombinator concentrates on these things. So I don't fail to check.

I am trying to think how it could become a place people like to go and checkout often. Give them a badge they can share on Twitter if their tip collects certain number of points?

</comment><comment><USER3> This is one terrific site.

</comment><comment><USER4> Browsing on work computer using IE7. Not supported by your site which is fine. The only comment I can make is that your favicon looks almost like Wordpress'.</comment>


Rumor Claims Apple Entering TV Business - For Real, Yo | The Mac Observer - <AUTHOR> http://www.macobserver.com/tmo/article/rumor_claims_Apple_entering_tv_business_-_for_real_yo/ <comment><USER2> Yeah they need to with the Apple TV vs Google TV situation to remain competitive.</comment>


Show HN: 9front (plan9) gopher server - <AUTHOR> My gopher server is running on different thin clients since march 2016. Serving a wide range of plan9 related content and other stuff, like a local weather meteogram. Best viewed with the LYNX text browser. So give it a visit, and mail me what else do you want to see about plan9. There's also a webserver running on it. Have fun! <comment><USER2> I didn't know Lynx can handle the Gopher protocol -- thanks.

Unless I forgot installing it, or it came along for the ride with something else, it's already in/on the default Ubuntu 16.04 desktop image.

</comment><comment><USER3> a link?

<comment><AUTHOR> oh sorry, missed the useful part. [http://kamalatta.ddnss.de](http://kamalatta.ddnss.de) or gopher://kamalatta.ddnss.de

<comment><USER3> thanks! just taking a look, now.</comment></comment></comment>


Daily Aspirin Linked to Steep Drop in Cancer Risk - <AUTHOR> http://www.businessweek.com/lifestyle/content/healthday/647054.html

<comment><USER2> I wonder if this may be related to Aspirin's effect on inflammation.

Long term inflammation is supposed to be "bad thing". Taking low doses of Aspirin for long time may help with silent inflammations throughout the body.

This should be testable by comparing effects of Aspirin with other anti- inflammatory drugs (taken in similar regime).

<comment><USER3> I don't think so, low dose aspirin has little effect on inflammation.

Aspirin (ASA)is special WRT NSAID, in that it inhibits the Cyclo-oxygenase (COX) enzymes irreversibly.

COX are a family of enzymes that transform arachidonic acid to various inflamatory mediators called the prostaoids (comprising prostaglandins, prostacyclin and thromboxanes). There are two subtypes, present in different tissues, but since ASA inhibits both kinds.

Platelets contain COX and uses it produce Thromoxane A2, a potent vasoconstrictor and platelet activator. Since platelets don't have a nucleus, the effect inhibitory effect is permanent in them. New platelets have to be produced in order to restore a normal clotting activity. Since the platelet have an half life of more than a week, the effect is long lasting.

Other cells can synthesize COX as needed. Low dose aspirin has thus little effect on them. You need a much higher dose to get a clinically noticeable anti-inflamatory response.

In blood vessels, activated platelets use COX to synthesize Thromoxane A2 (TXA). TXA further promotes vasoconstriction, platelet activation and aggregation, leading to the formation of a blood clot [1].

On the other hand, endothelial cells (the inner layer of blood vessels) use COX to synthesize a prostaglandin (PGI2), which antagonizes TXA (vasodilatation, platelet inhibition).

ASA disrupts the TXA2/PGI2 equilibrium in favor of PGI2, inhibiting platelet activation.

Other NSAID also have an anti-aggregation activity, but it is far more short lived, and requires anti-inflammatory doses to do so.

That said, I can't prove that a chronic, subclinical anti-inflammatory effect isn't at play here too.

EDIT:

A Google scholar search confirms that TXA2 is involved in carcinogenesis [2-3].

\--

[1] Such a clot is fragile. It is then stabilized by the coagulation process: the irreversible binding of fibrinogen into a fibrine mesh.

[2] [http://scholar.google.be/scholar?hl=nl&q=pgi2+neoplasm&#...](http://scholar.google.be/scholar?hl=nl&q=pgi2+neoplasm&btnG=Zoeken&lr=&as_ylo=&as_vis=1)

[3] [http://scholar.google.be/scholar?hl=nl&q=txa2+neoplasm&#...</a>

</comment></comment><comment><USER4> To be precise, it apparently cuts the risk of _death_ by 60% for colorectal cancers, and 21% overall for cancers.

It is still quite significant, but it does not actually prevent the cancers, just reduces their fatality rate.

<comment><USER5> Well, if you're one of the people who gets to live an extra 30 years because your colorectal cancer didn't kill you, i'd say that's a pretty damn big difference.

<comment><USER4> I am not sure where I disagreed.

<comment><USER5> I don't think you disagreed either. Not sure why you got downvoted there... I upvoted you back.

<comment><USER6> The downvoting on Hacker News has become erratic.

</comment></comment></comment></comment></comment><comment><USER7> Interesting finding, but I wonder: did they allow those patients to opt-in to the aspirin regimen?

If so, it could potentially be related to other confounding variables -- eating healthier or avoiding certain chemicals or some such. Basically, allowing opt-ins suggests that people who do so could already be more vigilant about their health.

If not, given the previous indication of benefits from an aspirin regimen, I wonder if there was an ethical concern in not giving it to all patients.

</comment><comment><USER5> Is the statistical analysis behind this sound or does it suffer from the problems outlined in [http://www.sciencenews.org/view/feature/id/57091/title/Odds_...](http://www.sciencenews.org/view/feature/id/57091/title/Odds_Are,_Its_Wrong)

Also, are there any side-effects to eating an aspirin every day?

<comment><USER8> It can cause bleeding.

<comment><USER9> A low dosage of 75 milligrams is still a problem?

<comment><USER3> It's actually the dose used in cardiovascular prophylaxis to prevent clotting...

You need a much higher dose to get an NSAID effect.

</comment></comment></comment></comment><comment><USER10> And on the other hand, it may and mostly does increase the chance of stomach bleed. Isn't that the case and a good reason to not pop it like mints ?

<comment><USER11> I think we can do better than "a good reason to not pop it like mints".

Aspirin Myocardial Infarction Study

"Doses of 1,000 mg per day of aspirin caused gastrointestinal symptoms and bleeding that, in some cases, were clinically significant. In the largest postinfarction study (the Aspirin Myocardial Infarction Study (AMIS) with 4,500 people), the percentage of incidences of gastrointestinal symptoms for the aspirin (1,000 mg of a standard, solid-tablet formulation) and placebo- treated subjects, respectively, were stomach pain (14.5%, 4.4%), heartburn (11.9%, 4.8%), nausea and/or vomiting (7.6%, 2.1%), hospitalization for GI disorder (4.9%, 3.5%). In the A.I. and other trials, aspirin-treated patients had increased rates of gross gastrointestinal bleeding. Symptoms and signs of gastrointestinal irritation were not significantly increased in subjects treated for unstable angina with buffered aspirin in solution. "

</comment></comment><comment><USER12> see the actual chance of dying from cancer here: [http://www.cancer.org/Cancer/CancerBasics/lifetime- probabili...](http://www.cancer.org/Cancer/CancerBasics/lifetime-probability- of-developing-or-dying-from-cancer)

So for men the lifetime risk of dying from some kind of cancer goes from about 23% to around 19% based on the 21% reduction in overall cancer deaths found in the study.

Specfically for 'death due to gastrointestinal cancers' dropping 54%. Assuming that statistic would be paired with the chance of death from stomach cancer at the above site, happy to be corrected if more of the cancers described there should be included. However if is just that then your chance of dying from that specific cancer goes from 0.53% to about 0.25%.

</comment><comment><USER13> Now if only Aspirin wasn't so damn expensive in Germany (and other European nations): [http://andrewhammel.typepad.com/german_joys/2007/09/prescrip...](http://andrewhammel.typepad.com/german_joys/2007/09/prescription- dr.html)

<comment><USER14> In France, a box of 20x1g pills is around 3 euros, so you can get 1g per day at 4.5€ per month (~0,15€ per day).

I find this rather cheap personally.

<comment><USER13> Most will be able to pay it but it is still obscenely expensive compared to what you pay elsewhere for completely stupid reasons.

<comment><USER14> I understand your point about the difference between places etc.

But locally, calling 4.5€ per month "obscenely expensive" is really far- stretched. One baguette cost 1€ here (~ 30€ per month).

</comment></comment></comment></comment><comment><USER15> How about real prevention:

<http://en.wikipedia.org/wiki/Colorectal_cancer#Risk_factors>

<comment><USER16> Your tone is a bit suspect (what is not "real" about aspirin after all) but I liked your link. Especially "Physical inactivity: People who are physically active are at lower risk of developing colorectal cancer."

<comment><USER17> Unfortunately, that means we hackers with desk jobs had better be taking our aspirin (or getting a lot of colorectal activity, I suppose--refuse the scanner next time you fly).

<comment><USER15> That's not necessarily true. Eat healthier, take a bike, run or walk on your commute. With just that your chances improve significantly.

<comment><USER17> Sadly, exercise does not overcome the effects of prolonged sitting: [http://www.sciencedaily.com/releases/2010/07/100722102039.ht...](http://www.sciencedaily.com/releases/2010/07/100722102039.htm)</comment></comment></comment></comment></comment>


New features coming to Pixel 4 - <AUTHOR> https://blog.google/products/pixel/new-features-pixel4/ <comment><USER2> With all the political bias and privacy problems that Google had I'm now deciding to make a switch to Apple after so many years. Also, Pixel phones were always so expensive in comparison and the lifetime of every product never exceeed 2 years. All my pixel phones died.</comment>


China Says Sino-British Joint Declaration on Hong Kong No Longer Binding (2017) - <AUTHOR> https://www.reuters.com/article/us-hongkong-anniversary-china-idUSKBN19L1J1 <comment><USER2> If UK wants to stay involved and be responsible, they should grant British passport to every HK citizen who was citizen when before handover and their descendants.

They should have done that before the handover.

<comment><USER3> The Britain that post Brexit will be in desperate need of a trade deal, will be offered a really really bad one by the US that will never be accepted by those that actually voted for Brexit, so those same people will go shopping around for anyone that can possibly replace the EU and US, at the very least if only to give them leverage against the US?

I don't think Britain can afford to be pissing off China right now.

<comment><USER4> Roughly half of the UK did not want Brexit at all though and wouldn't be that swell to hear that they have to appease a dictatorship now.

I doubt Boris Johnson could pull that off with such a razor thin majority in parliament.

However, I do agree that China is _an_ option even though it's an unrealistic one and its reception domestically, if the UK has to do major concessions to get it in place quickly, is probably not going to be warm. But, the UK can't afford to have _no_ options on the table.

<comment><USER3> "Roughly half of the UK did not want Brexit at all though and wouldn't be that swell to hear that they have to appease a dictatorship now"

Id count myself in that half, that isnt the half motivated by ideals of sovereignty and control of their own destiny at the expense of all else, plus that half isnt currently in the drivers seat so I kept that half out of the discussion.

</comment></comment></comment></comment><comment><USER5> A thought experiment..

What if a country would say to every Hong Kong person.. come to our country, build a new Hong Kong in our country, tranplant the whole there, and be free, bringing all the culture and business with you

<comment><USER6> Nobody will say that. Plus, it was a very specific set of conditions and circumstances that led to Hong Kong being what it is, leading to the present days. You can't just transplant it.

<comment><USER7> To be fair, the set of conditions and circumstances cropped up in Singapore as well. One could be forgiven for thinking that if the circusmtances could be engineered then, they could be engineered now.

<comment><USER8> One of the main circumstances is a common border with the mainland with proximity to Shenzhen. How do you engineer that?

</comment></comment></comment></comment><comment><USER9> The China can end the "two systems" policy to Hong Kong, in maybe 28 years or so, and the world would treat Hong Kong as a mainland city, not a free trading city, and Hong Kong passport should be the same as PRC passport. That is fair.

<comment><USER10> One suspects many Hong Kong residents would see that differently.

There's been an outbreak of tensions between Chinese and Hong Kong students here in Australia. Suspect it's only going to get worse, as the University governing bodies and indeed the government itself seems paralysed. The Chinese education dollar is huge here, which means everyone is very wary of causing any offence, even when fights break out as happened a few weeks ago. Nothing compared to what's going on in HK itself, but an interesting microcosm.</comment></comment>


Intel CEO: Patches will come to 90% of chips in the next week - <AUTHOR> https://techcrunch.com/2018/01/08/intel-ces/ <comment><USER2> This is _only_ Spectre, not Meltdown. Meltdown requires KPTI, which depends on your OS. For OSs that did not enjoy months of advanced disclosure (which is: any OS that isn't Windows, MacOS or mainline Linux), that work is ongoing and will depend on the OS. (Speaking for SmartOS/illumos, that work is reasonably far along and making promising progress -- but we don't yet have a functional prototype.)

As for Spectre, these are just the microcode updates that have the additional MSRs that allow system software to mitigate certain variants of Spectre attack against the system software itself. They are necessary, but emphatically not sufficient -- and it would disingenuous for Intel to pretend that this in any way means that 90% of systems are protected from Meltdown and Spectre.

<comment><USER3> FYI, Ubuntu released updates today for Meltdown:

Ubuntu 16.04 LTS: [https://usn.ubuntu.com/usn/usn-3522-1/](https://usn.ubuntu.com/usn/usn-3522-1/)

Ubuntu 14.04 LTS: [https://usn.ubuntu.com/usn/usn-3522-2/](https://usn.ubuntu.com/usn/usn-3522-2/)

Ubuntu 17.10: [https://usn.ubuntu.com/usn/usn-3523-1/](https://usn.ubuntu.com/usn/usn-3523-1/)

<comment><USER4> Would you know if the patches are or will be included in the mainline kernels which are at 4.4.14 and 4.4.15?

</comment></comment></comment><comment><USER5> How does one patch a CPU?

Does the update come in the form of a BIOS update? If so, then the patch still has to travel through the PC manufacturers, like when Google patches Android. Or can it be somehow applied directly?

Edit: Apparently the OS can update the CPU's microcode. No need for BIOS updates. It was even done in the past. For instance, an unrelated Windows Vista update that updates microcode: [https://support.microsoft.com/en- us/help/936357/a-microcode-...](https://support.microsoft.com/en- us/help/936357/a-microcode-reliability-update-is-available-that-improves-the- reliabil)

<comment><USER6> Intel's not patching anything. They're relying on Windows, Linux and macOS patches to work around the vulnerability. Presumably that's how the 90% claim can be made. Very disingenuous of Intel tho.

EDIT: There are microcode updates included in the OS updates: [https://access.redhat.com/articles/3311301](https://access.redhat.com/articles/3311301)

<comment><USER7> > _Very disingenuous of Intel tho_

This crisis has taken Intel, in my mind, from an American behemoth at the vanguard of technology to a sclerotic overgrown mess. Bugs happen, crises happen. When you're a $200 billion company, those mistakes scale deafeningly. The bugs are unfortunate, but not unreasonable.

Intel's communication, however, from the first press release to crap like this, has been disingenuous to the point that it arouses suspicion. Why are they being dishonest? Is there something more to be discovered? What else have they lied about?

Textbook case of PR and IR incompetence.

<comment><USER8> As much as I hate to say it, I think the Intel PR machine is working stunningly.

Every geek I speak to will tell you the world's on fire. Every non-geek I speak to responds with "oh, really? if it's such a big problem how come no-one has heard about it? Oh, ok, well there might have been that one headline..."

I am infuriated by Intel's response no end, however I'm also somewhat impressed. They seem to have completely avoided a PR disaster and their stock price is largely unaffected.

<comment><USER9> Is that really good PR? Or just news that hasn't hit the mainstream because they don't understand it or doesn't affect them much.

<comment><USER10> It's good PR. If a mainstream media outlet looks into it they are predisposed to "hear" two views and weigh them equally. They'll get one from the OS/Security community saying "this is really bad" and one from Intel (via their spokespeople) saying "don't worry about it, we got it". Then their journalistic tendency will be to give more weight to what Intel say over what a bunch of "nerds" say, and the resulting headline will be "Intel fixing chip bug some say is puts the cloud at risk" or some such nonsense.

<comment><USER11> I thinks it's more a case of bad "marketing" from project zero. Had the stuck with a single name "spectre" (with 3 variants) then the media would have had a story that's much easier to understand and repeat/sell. When it's a case of "x affects a" and "y affects a, b and c" then the story gets to confusing for them and their readers.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> What I'm worried about is that it will be hard to avoid these security patches when you don't need them. Say you have a non-virtualized, non-shared server that only runs your own trusted code. I don't want to be forced to pay the performance penalty but it might be unavoidable without resorting to maintaining your own linux fork.

<comment><USER13> Do you trust all of the userland?

Is your machine internet connected?

Do you have _any_ open ports?

Do you run everything as root?

If your answers are yes, no, no, and yes than it likely will make no difference. Otherwise (and the last one is just for fun to attempt to show you this is probably not a wise decision) you probably would do better to take this serious.

<comment><USER14> How do open ports factor in? And what if you're internet connected but have JS disabled?

<comment><USER15> Open ports mean there is a service listening. A service listening means that there is code on your box interfacing with the internet. That means there is the possibility that an exploit in that code could lead to remote code execution. The meltdown vulnerability means that _any_ remote code execution vulnerability can be escalated to the highest levels.

Exploiting meltdown means you can read all of kernel memory, that destroys any additional layers of protection you might fantasize you had. It means that in memory passwords and encryption keys can be copied. It means that IO between other processes can be spied on. It means that all of the juicy locations to exploit for "return oriented programming" in order to gain local root will be laid bare. And so on.

That's why it's called meltdown. Imagine someone who had hand crafted the equivalent of a modern OS with all of the best practices in place for an internet server. You have kernel address randomization. You have each service running as its own non-privileged user and also in a chroot jail. You have your filesystem permissions locked down tight. And so on. All of that is gone out the window with meltdown, it doesn't matter, because even code running at the lowest possible privilege level can gain access to the contents of any part of kernel memory.

As for "workstation" systems. If you are behind a firewall, you never run untrusted code, and you have JS disabled then potentially you are safe.

<comment><USER14> But on my home server, I don't have layers protection and I don't need them. If there is RCE that gets you into my RDP session, or my email, etc., you've got everything in the machine that's worth having.

</comment></comment></comment></comment></comment><comment><USER11> According to last weeks press release, they mean 90% of recent chips, which is far less than 90% of intel CPU's out in the wild: [https://newsroom.intel.com/news-releases/intel-issues- update...](https://newsroom.intel.com/news-releases/intel-issues-updates- protect-systems-security-exploits/)

> Intel has already issued updates for the majority of processor products > introduced within the past five years. By the end of next week, Intel > expects to have issued updates for more than 90 percent of processor > products introduced within the past five years

It's also unclear what they mean by "introduced within" Does it mean when the product was first developed? First on sale? If I bought a new computer 3 years ago what is the likely-hood that it's CPU was "introduced" much earlier?

<comment><USER16> Presumably the launch date, Intel lists launch dates for all of their processors on ark.intel.com [1]

5 years is Haswell, so Haswell and newer should get the microcode fix. A 3 year old computer is likely to have a CPU no more than 4 years old, but you can look it up to verify. (Both Windows and Linux can show the CPU model, and Intel's Ark site gives the release date.)

[1] [https://ark.intel.com/products/series/75023/4th- Generation-I...](https://ark.intel.com/products/series/75023/4th-Generation- Intel-Core-i7-Processors)

<comment><USER11> Thanks. My work computer is in the legacy section (release Q4'11), so it looks like I might be getting a new one. A shame really, it's still mostly adequate, the only thing making it age are the continued bloat from Visual Studio.

</comment></comment></comment><comment><USER17> I wonder what will the next big security hole.

I'm becoming very pessimistic about how I can trust computers.

Computers can do amazing thing, but software seems fragile, unreliable and untrustworthy.

I have been keeping notes on paper for years now, and it doesn't look like it's going to change.

<comment><USER18> Internet-connected computers are more secure now than they ever have been. Just take the standard precautions: update your OS and don't install untrusted apps.

<comment><USER13> And do not visit untrusted webpages with javascript enabled? And how do you know which pages you can trust?

<comment><USER11> Even trusted webpages pull in crap from all sorts of places that I don't trust, the way the web is structured is a disaster. My public news provider for instance ([http://www.abc.net.au/news/](http://www.abc.net.au/news/)) has all sorts of shit broken when you run ublock or noscript. There "live breaking news feeds" that are rather important may as well be a blank page because it just reposts twitter messages. And they're one of the better sites with no advertising.

</comment></comment></comment></comment><comment><USER19> Surely he is talking about the Win/Mac/Linux kernel patches? Would seem bizarre for all the work to go on the kernels when Intel had some firmware patches up their sleeve? Also I thought Spectre is something that is unlikely to be patched in the near future.

<comment><USER20> I believe there are microcode patches that help make spectre harder. I also have a vague recollection of the fix for meltdown on the newest CPUs requiring a microcode patch for complete protection.

</comment></comment><comment><USER21> If Intel knew about the issues on June 1, why are the patches only appearing now? I thought the point of an embargo was to let the fixes come first.

<comment><USER19> It was meant to be embargoed til today, but the news came out earlier than expected. Sounds like people have been working round the clock since the discovery to patch this.

</comment></comment><comment><USER22> So when will chips with a fix in silicon be available?

<comment><USER23> Just buy an AMD chip right now.

<comment><USER24> > Just buy an AMD chip right now.

AMD chips are reportedly susceptible to Spectre, so that's not going to help. From [https://meltdownattack.com](https://meltdownattack.com):

 _Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, all modern processors capable of keeping many instructions in flight are potentially vulnerable. In particular, we have verified Spectre on Intel, AMD, and ARM processors._

<comment><USER25> Meltdown, however, is the one that results in nontrivial performance degradation in order to patch.

And Meltdown specifically only affects Intel processors.

<comment><USER26> Meltdown affects some ARM prcessors as well.

[https://developer.arm.com/support/security- update](https://developer.arm.com/support/security-update)

<comment><USER25> My response was in the context of privong stating that Intel and AMD were equivalently affected, when it is specifically Intel that suffers performance degradation in patching due to their unsafe usage of speculative execution.

<comment><USER24> I only said they were both affected by Spectre. But it wasn't clear if the OP was worried about performance issues or security issues, so it isn't clear on what basis they were suggesting that buying AMD is a solution.

</comment></comment></comment></comment></comment></comment></comment><comment><USER27> Keep in mind, they did NOT say patches with no cost. Mostly they are adding ways to disable speculation on indirect branches. This has a cost.

</comment><comment><USER28> I half thought he was going to talk about using ME to push updates to Intel- based machines. Thank god they have a backdoor to fix security issues! ;-)

</comment><comment><USER6> [https://support.apple.com/en-us/HT208394](https://support.apple.com/en- us/HT208394)

</comment><comment><USER29> 10% equals how many billions of chips?

</comment><comment><USER5> Any guesses as to which vulnerabilities they're going to patch? Some of them? All of them?

<comment><USER30> Just the indirect branch bug. That's "half" of Spectre. IMO the harder to exploit half.

</comment></comment><comment><USER31> How do you patch a CPU remotely? Are the instructions programmable?

<comment><USER15> CPUs have code that runs code, essentially. Think of a modern CPU as like a collection of micro-controllers. You have micro-controllers which reads a stream of machine code instructions for a particular instruction set (e.g. x86-64) translates that code into "micro-ops" (RISC-like fine grained instructions) that are then re-ordered and so forth and fired off into the CPU core(s) proper. That whole process relies on a ton of code that exists as essentially "firmware" (microcode) within the processor. Things like translation tables for architecture level instructions (x86-64) to micro-ops as well as code for the scheduler, the branch predictor, and various other micro-architectural parts of the CPU.

Some of these elements are hardwired into the silicon, some are controlled via decode tables, and some are controlled via flags and perhaps even instructions running on different components of the CPU, all of that together is grouped under the heading "microcode". A modern CPU is not infinitely programmable because a lot of functionality is hardwired (for example, what each micro-op does) but there's still a great deal of flexibility in how things work (such as exactly how the branch predictor and scheduler work, the translation of instructions to micro-ops, etc.)

</comment></comment><comment><USER32> Have there been any reports of exploits using Meltdown/Spectre in the wild yet?

<comment><USER33> [https://meltdownattack.com/](https://meltdownattack.com/) > FAQ > Has Meltdown or Spectre been abused in the wild?

> We don't know.

So probably no reports ;)

</comment></comment><comment><USER34> At what performance cost?

</comment><comment><USER35> I thought they already provided a microcode update?

<comment><USER36> Latest version on downloadcenter.intel.com is 20171117; no microcode update has been published since Spectre/Meltdown have been disclosed.

edit: see below, not true; they haven't published it on their own site but have pushed microcode updates to redhat.

<comment><USER37> There's a partial update package debian: [https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=886367#22](https://bugs.debian.org/cgi- bin/bugreport.cgi?bug=886367#22)

Seems to be taken from redhat updates. It's floating around unseriously in debian unstable instead of being a security update, I guess Debian's FOSS imperative doesn't mix so well with non-free (intel-microcode) updates.

> Anyway, uploading a partial, unofficial set of updates to unstable to close > the bug. Several processors are still missing. I expect an official release > from Intel soon, hopefully with updates for everything.

> Implements IBRS and IBPB support via new MSR (Spectre variant 2 mitigation, > indirect branches). Support is exposed through cpuid(7).EDX.

> LFENCE terminates all previous instructions (Spectre variant 2 mitigation, > conditional branches).

</comment></comment></comment><comment><USER38> This is how this terrible CEO tells us about microcode fixes, at a CES speech? Or is he even talking about a microcode update, or about the patches everybody else has been losing their lives working on? What a crap response to such a huge and existential issue.

Make a web page on the Intel site with concise, real information on what's going on and what to do. We're a week into disclosure and there's still no patch for most people's servers. A patch that takes up to a 30% performance hit but may not be necessary if there's going to be a microcode fix?

I know this is just a cute speech and debate practice session for the Intel execs, but I have servers that will have to get trashed because of the slowdown patch, they will be too slow to function in their current role and will need to be replaced. This is seriously affecting my life, my work schedule and my wallet. _Please have real engineers provide real information here._

<comment><USER39> Let me break down what the article really says (it's pretty short):

      > He also said that Intel expects to issue updates
      > to its processors soon. More than 90 percent will be
      > getting them within the week, and the rest by the end
      > of January.

Intel expects 90 percent will "get an update."

90 percent of what?

It should be self-evident that Intel means 90 percent in whichever way gives them the largest percentage. I expect this means Intel discounts "older CPUs" that are "probably not in use." In other words, 90 percent of CPUs sold in the last N years for whatever N makes the percentage largest (5 years [1])

"The rest by the end of January" can be taken with a huge grain of salt. Intel is documenting and exposing an MSR to flush the [ed] branch predictor, but only for recent CPUs, and admits they aren't able to do so in a timely manner, or they would have said "100 percent."

[1] [https://newsroom.intel.com/news-releases/intel-issues- update...](https://newsroom.intel.com/news-releases/intel-issues-updates- protect-systems-security-exploits/)

"Intel has already issued updates for the majority of processor products introduced within the past five years. By the end of next week, Intel expects to have issued updates for more than 90 percent of processor products introduced within the past five years"

Edit: I incorrectly stated the MSR was for the TLB, it is not. It is for the branch predictor.

<comment><USER40> ...or maybe the other 10% are in-order non-speculative designs which are intrinsically immune; they still have a few:

[https://en.wikipedia.org/wiki/Intel_Quark](https://en.wikipedia.org/wiki/Intel_Quark) (basically a die-shrink of a 486!)

[https://en.wikipedia.org/wiki/Bonnell_(microarchitecture)](https://en.wikipedia.org/wiki/Bonnell_\(microarchitecture\))

<comment><USER41> Just read the Wikipedia, looks like you are trading one hardware bug for another on the Quark. At least you know when a segfault happens I guess.

"Intel Quark SoC X1000 contains a bug #71538[11] that "under specific circumstances" results in crash, known in the industry as a segfault. The workaround implemented by Intel is to omit LOCK instructions in the compiled code.[12] While Yocto Project based embedded systems incorporate this workaround, general purpose Linux distributions such as Debian are deeply affected by the bug. Such a workaround is not easy to implement on multithreading systems as they require LOCK instruction to function properly."</comment></comment></comment></comment>


Was Leisure Suit Larry an Accomplice in Early Banking Cyberattacks? - <AUTHOR> https://www.vice.com/en_us/article/epg9be/did-sierra-create-leisure-suit-larry-virus-stop-piracy <comment><USER2> "Any headline that ends in a question mark can be answered by the word no"

[https://en.m.wikipedia.org/wiki/Betteridge%27s_law_of_headli...](https://en.m.wikipedia.org/wiki/Betteridge%27s_law_of_headlines)</comment>