From Two Guys Building Their own Browser - dominik-space https://medium.com/spacebrowser/from-two-guys-building-their-own-browser-3aa56787982f <comment><AUTHOR> IMO: Get to the point early! establish what's different / special / unique about your browser. All you need is 1-2 paragraphs early in your story.

I made it to "Rebranding and the early days of Space Browser" and stopped reading. Why? The article is autobiographical without establishing enough context to keep me interested in you. (In other cases, if you or your product was well known, something autobiographical without establishing context is okay.)

BTW: It's worth trying to disambiguate, early on, if you're building your own HTML rendering engine, or just reusing something else.

</comment><comment><USER2> It's just a little bit disingenuous to describe it as "building your own browser".

Because a browser has so many features at this point that it basically contains an operating system. So to duplicate that its just necessary to start with some existing browser and tweak it.

Out of the thousands of features that enable me to browse across diverse websites, what percentage of those features did you implement in your "new" browser?

What does it actually do that is different from WebKit?

<comment><USER3> I don't see how it's disingenuous. They made a browser the same way google chrome started (from WebKit), or WebKit started (khtml), or the way opera and Vivaldi currently are (chrome).

</comment></comment><comment><USER4> Had a quick look. None of this looks like features for power users. How are "spaces" different than having multiple open windows?

<comment> dominik-space They do not need the same amount of memory than different windows would need, since we use an intelligente caching system.

<comment><USER5> Can you elaborate more on this? My understanding is that on modern browsers, most of the memory usage comes from the tab's contents (pages), or extensions. In both cases they don't scale up with the number of windows.

<comment><USER6> A lot of browser memory consumption comes with overheads from their multi- process models.

However, that aside, it makes no difference whether you have a window, tab, or "space".

<comment><USER7> The multi process model was an improvement. In days past browsers were single process, and suffered from:

\- JavaScript on one page dragging down all tabs

\- Memory leaks

\- JavaScript exploits that crossed tabs

And so on.

Multi process browsing is fantastic.

<comment><USER6> We still have all but the first issue, and that one has nothing to do with multi- _process_ browsing, just multi-threaded processing.

So all we really won was performance regressions (the IPC is expensive) and significantly increased resource consumption.

</comment></comment></comment></comment></comment></comment><comment><USER8> > _Usually the tabs just lay there and cost you a lot of memory. And forget to > find this one tab you were looking for. It's impossible. The time has come > for a change._

I use bookmarks.

</comment><comment><USER9> I understand why you're going for mobile, but I think the market would be way bigger if you would go for desktop. Nice concept though.

<comment><USER10> I'm thinking along the same lines, because I would never attempt to navigate the Tab Sea of Doom on a tablet, with a standard browser like Safari or Chrome.

I'm going to give this a try anyway. Maybe the utility of having reference materials on a third screen, that I can glance at without obfuscating my editor behind a browser window will net some productivity gain. When I need copy/paste and codepen-type solutions, I'll fire the link over to my MBP.

<comment> dominik-space Sounds good. Let me know how we are doing!

</comment></comment></comment><comment><USER11> I can't test it, but maybe it's already there... :)

But if I need to add websites to spaces by hand it's not for me as a power user. Make something that will know what websites I often visit and place them automatically in certain spaces. You don't need to stop here! You can go further with this, so if I open 30 tabs of PornHub it will create Adult space for me so I don't need to worry. ;)

</comment><comment><USER12> > Will our project ever reach a critical number of people?

To me UI improvements are quite low on the totem pole of "things I wish my browser did/didn't do"

For one, we still don't have sufficient privacy on any major browser. Even Chromium, FireFox, and Brave don't cut it.

> Power Users

Second, scriptability, headless, and Unix-like pipeline integrations without having to use headless chrome and puppeteer. With Phantom gone, it seems we have no choice.

iOS-only WebKit with a neat tab interface doesn't strike me as a "power user" browser.

<comment><AUTHOR> > iOS-only WebKit with a neat tab interface doesn't strike me as a "power > user" browser.

But it's a great way to experiment with different UIs.

</comment></comment><comment><USER13> Great blog post! Like it! When is your browser launching?

<comment> dominik-space We are live on Product Hunt today! Check it out here: [https://www.producthunt.com/posts/space- browser](https://www.producthunt.com/posts/space-browser).

</comment></comment><comment><USER14> Remember Flock? These never work out - its hard to make any money and people will often revert to the defaults.

<comment><USER15> The list of discontinued and abandoned browsers is longer than the list of active browsers...I'm not sure why someone would want to develop a new one in this day and age when the market for them as settled.

<comment><USER16> The list of discontinued and abandoned businesses is longer than the list of active businesses...I'm not sure why someone would want to develop a new one in this day and age when the market for them as settled.

</comment></comment></comment><comment><USER17> Was expecting them to actually be writing a web browser engine though with the current web standards you would need huge team of seasoned devs a several years if not decades of work to do this, missleading title. Basically they are wrapping webkit in a new UI. Boring...

<comment><USER18> It is not the critic who counts; not the man who points out how the strong man stumbles, or where the doer of deeds could have done them better. The credit belongs to the man who is actually in the arena, whose face is marred by dust and sweat and blood - Theodore Roosevelt

</comment></comment><comment><USER19> Looks spiffy ! Too bad I can't try it out, what with being a linux user and all. I like the time traveling aspect and the visualization of it all. Kudos on the launch. Wish you guys the best.

</comment><comment><USER2> Is this an indication that mobile browsers need support for extensions?

Maybe if companies won't add that then it's a symptom that we need to combat their browser monopolies somehow.

<comment><USER20> Maybe by using Firefox for Android?

</comment></comment><comment><USER21> > we unsuccessfully tried to approach bars with a Netflix like subscription > for drinks.

... wow. Glad you dodged a MoviePass-style bullet on this one.

</comment><comment><USER22> @dominik-space just reached out to you on twitter.

<comment> dominik-space Thanks! Saw it :)

</comment></comment><comment><USER23> if you don't use Chromium, what's the back engine then? Gecko? WebKit?

<comment><USER3> Since it is an ios app, it has to use safari (webkit).

<comment> dominik-space Exactly, we build on top of WKWebview.

</comment></comment></comment><comment><USER24> Why is their age something to mention?

<comment><USER25> Asymmetric advantage in their favor

If it sucks "they're just 20" If it's interesting, they're precocious

imho if you're using age as downside protection you've already lost

<comment><USER26> Seems like a bold move to me regardless if the engineers are 20 or 50 or 90.

<comment><USER25> Being really young is a good story – except that by 20, it invites comparisons to Stripe's 19-year-old founder.

Being really old is a good story – everyone likes to see someone 60+ still fighting[developing], especially because there is a pervasive fear of age discrimination here.

–––––––––––––––––––––––––––––––––––––

EDIT: I 100% guarantee that even if this project is not successful, if these fellows continue plugging away in the industry, they are going to ship something really awesome.

</comment></comment></comment></comment><comment><USER27> Any plans for an Android version?

</comment><comment><USER10> @dominik-space there's a typo in the link to spacebroswser.io at the end of your article. A trailing . is in the href attribute and it doesn't open on my iPad unless I edit the link.

<comment> dominik-space Oh, thanks for reaching out! Just fixed it!</comment></comment>


Do Pageviews Matter Anymore?  - <AUTHOR> http://www.msnbc.msn.com/id/17070073/ <comment><USER2> There's definitely got to be a market for a company with better data on the value of a given site to advertisers, you just have to figure out how to get the data.

What about some sort of third party google analytics that specifically targeted whatever metrics make advertising more profitable? If you could prove your metrics were worthwhile maybe you could convince sites to embed your stuff to get a good rating and you could sell ratings to whomever is selling or buying the ads. There's sort of a cart before the horse problem there. Ideas?

</comment><comment><USER2> I like that they mention in Nielsen's comment "that many news sites force visitors to click multiple times to read longer stories in sections" and then they make you do that.</comment>


Apple and Facebook Reportedly Negotiated Over Ping for At Least 18 Months - <AUTHOR> http://www.macrumors.com/2010/09/21/apple-and-facebook-reportedly-negotiated-over-ping-for-at-least-18-months/

<comment><AUTHOR> Apple and Twitter have both now launched new features integrating with Facebook only to have them disabled within hours.</comment>


Ask HN: Alternatives to Adsense - <AUTHOR>

Hi,
what decent alternatives to Adsense exist for a personal development/life opinions blog ?
Thanks <comment><USER2> The Usual Recommended Suspects for alternative ad networks:

\- Media.net . Good customer service. They just teamed up with Yahoo to offer contextual ads - this one could be very interesting.

\- Lijit. Run by the people behind Federated Media, they're, again, friendly and reasonably easy to work with.

\- Skimlinks / Infolinks. Inserts contextual links into your pages. Many people hate this idea, but it does monetise reasonably well.

Of all of these, Media.net is the only one I've heard of equalling Adsense's payouts.

Other options that are a bit more work, but can generate substantially more than Adsense on some sites (advertising and copywriting know-how is kinda vital, though):

\- Clickbank: affiliate sales of ebooks. Often sleazy-feeling, but can generate good revenue.

\- ShareASale: Affiliate programs for physical products. There are some good, well-respected names running affiliate programs with these guys.

\- CPA networks: now we're getting hardcore. Generate cash by feeding leads to MMORPGs, colleges, dating sites, and so on. Well outside the scope of a short comment - mail me if you're interested in this stuff and I can point you to some good resources.

</comment><comment><USER3> Another alternative is to have an agency sell spots for you.

You tell them how much you need for a spot, and they'll do their darnest to get the listing out.

If you contact me (email in profile), I'll put you in touch with a few people I know.

Ofcourse, you'll need to (a) have a site operation and (b) have at least more than 5000 visitors per day.

</comment><comment><USER4> Selling your stuff(books, videos, seminars etc) beats any kind of advertising hands down. Selling your advertisement spots yourself is the second best, if you can pull it. Affiliate programs seem to do well for some bloggers.

If you are after an ad network, there's no one that can beat Adsense, I am afraid.

</comment><comment><USER5> Hey, had an awesome experience working with Media.net guys. Would definitely recommend giving a try. I had worked earlier with several other, but had the best experience with them.

</comment><comment><USER6> <http://buyads.com></comment>


Ask HN: How do you get in your "productive" mode? - <AUTHOR> I'm struggling with getting in my productive mode. For some reason, I can work for 10 straight hours if I'm at school, with my peers(I attend high school). Though, when home, I find it very hard to work at least 1h.<p>Suggestions? Thanks. <comment><USER2> I've found that there are no tricks. It's mostly just sit down and start working. It'll take about 5-10 minutes of steady concentration and suddenly I'll drop into the zone. There is no substitute for "just do it" as far as my personal makeup goes. I used to try all the various hack your mind stuff that comes out every few years. But when it came down to it there was no substitute for just sheer concentration on the task at hand.

<comment><USER3> The Chain Reaction Method. A little bit of work is enough to trigger a snowball effect. The only "trick" I use is to start by working on something that's extremely easy/fun first. Once I'm knee deep it's not difficult to take on more challenging things.

I still have no solution for the larger multi-week productivity swings that seem to occur...

<comment><USER4> Emphasis on "easy": even if it's just typo-fixing in your code or doing problems from week 1 of class, mundane/brainless tasks fine kindling for getting your brain chugging along for the bigger problems.

<comment><USER5> This triggers it for me easily, I go a few dozen lines above and read through. I find it helps snap me back into the 'work' mode, which allows me to continue on. On some projects this has got to the point that it becomes like how putting on sweat pants makes you behave differently than wearing a suit.

</comment></comment></comment></comment><comment><USER6> You might want to consider that your brain has limits:

<http://scienceblogs.com/cortex/2009/12/willpower.php>

I don't want to say "you can't do it" but I remember from my school days hitting the wall and there was nothing I could do about it until I'd had time to rest and recharge.

Here are some interesting links about gumption I've collected over the past few months (mostly from HN):

<http://www.alistapart.com/articles/burnout/> <http://sivers.org/dont-fight- it> <http://www.futurepundit.com/archives/006569.html>

In short, 10 hours of mental work might be your limit. I know that if I can squeeze in 10 solid hours of good creative mental work, I've had an _extremely_ good day. Most good days I'll eek out 6 hours. Average days are probably around 4.

You might look at options to reduce that 10 hours somehow. Some people drop out of school, some just skip a class a day, some drop a class from the schedule altogether, etc.

You also don't talk about what your 11th hour is. Finding something interesting to you, especially if you're out of gumption, will be critical.

When you're full of mental energy, you can do anything; when you're out mental energy, your choices of what you can do are limited to easy things that are interesting.

Good luck!

</comment><comment><USER7> Establishing a rhythm helps. Make a cup of tea every time you sit down to work. Light a candle. Turn on a certain style of music.

Me I like juggling as a warm up.

<comment><USER8> Nitpick: did you mean "ritual"?

</comment></comment><comment><USER9> If it seems that you can't get some task done and you aren't making any progress this means that either (a) it lies beyond your present abilities, and/or (b) your heart isn't in it.

>I can work for 10 straight hours if I'm at school

This is part of the problem IMO. Schools are inherently coercive and this messes up one's approach to instrinsically motivated learning.

It is the _task itself_ that provides the reward. If the work is noble and interesting and if it lies within your abilities then you will find sufficient vitality is available to perform it.

OTOH, forcing yourself to do stuff (as if you were still at school) causes the mind to slowly shut down (starting with loss of creativity).

>I find it very hard to work at least 1h

If you weren't doing the 'work', what would you be doing instead during that hour? Start with that, and do it better.

</comment><comment><USER10> I think the trick that almost everybody uses, even if they don't realize it, is to determine what the simplest (read: least time consuming) possible task to move their project forward is. Even if you spend time thinking about this and "not getting anything done", you're really getting planning done. When you've figured out what that task is it's easy to knock it out, and you'll probably do it pretty quickly because you've been thinking the problem through.

And don't read Hacker News :)

</comment><comment><USER11> Explore and try things. I have found listening to my favorite music is a hindrance, for example. I instead have found that listening to drum'n'bass or jazz helps a lot. I normally wouldn't listen to them, but they are more nondescript and fill the background space nicely, allowing me to concentrate.

I'm there to work, not enjoy my music, so I am perfectly OK with this change.

</comment><comment><USER12> Are you trying to work for 1h _on top of_ the 10h you've already worked in school? If so, that may be your problem.

Almost nobody can work for 10h straight. I'd guess that you're taking breaks for lunch and between classes, and to hang out with friends. It could just be that you've run out of juice by the time you get home.

I've found that I get about 3-4h of good, productive, cognitively demanding work done a day. My friends in grad school say this is fairly typical of them too. If there's an exciting project with a deadline, I might be able to go up to 7-8 hours in bursts, but that's paid for by a week or so of complete unproductivity afterwards.

The good news is that this is enough. Those people you hear about who've built world-changing inventions? They didn't do it through working _more_ , they did it through working _more effectively_. That means paying attention to what's important, doing it, and letting the busywork slide.

</comment><comment><USER13> One thing that works for me is thinking out aloud. I don't really understand why, and frequently, the spoken words turn into some foreign tongue no one really understands (especially if the train of thought goes faster), but somehow this helps with keeping the train of thought going against all kinds of obstacles and distractions.

</comment><comment><USER14> _Use coffee and a special environment like Pavlov's Dog to trigger you to work._

Put together a customized workspace for yourself. It doesn't have to be big, just outside the regular house living space somewhere. Somewhere like the garage or basement (even a big closet). Somewhere you can be alone and not bothered by anyone but is not a bedroom.

Set yourself up with a desk/table and proper office chair like you can get from Office Depot. Hook up the internet for yourself and a put in a good light source, also buy a small 1-man coffee maker from Walmart or somewhere cheap and buy some strong coffee. Keep the coffee maker and coffee in your workspace and drink coffee when you are there while focusing on getting down to work. Don't play games there or do anything but work in there and drink coffee.

Since you are in high school here are a couple of links about Pavlov's dog in case you don't know about him. (ps. teachers always seem to like reports about things like Pavlov's dog for extra credit.)

[http://nobelprize.org/educational_games/medicine/pavlov/read...](http://nobelprize.org/educational_games/medicine/pavlov/readmore.html)

<http://en.wikipedia.org/wiki/Ivan_Pavlov>

</comment><comment><USER15> I like to complete one small task to break the ice and remind myself there is a little intellectual reward waiting at the end of every completed task. If you string together a few small successes you can build some momentum. It's important to be realistic about how much time you spend working in a day to avoid burn out. Personally I think 10-12 hours is probably a natural limitation most people face. You can't neglect other parts of your life and stay productive. Gotta find the right balance or you'll burn out.

If I really have trouble getting motivated about a project I will try to find a better or easier solution. I can't really grind away at something I'm not interested in. I need to figure out a way to get into the project. One of the things that helps me is making diagrams. I will spend a lot of time making sure all the fonts are right, good colors, good spacing, etc. It's silly but, in the end, I have this really nice diagram and I'm somehow more motivated to make it a reality. The other trick is to find people who are interested in what you're doing. Their excitement and interest can be infectious. It really helps to feel like what you're working on isn't a waste of time.

</comment><comment><USER16> Work in a public place (cafe, library).

Alternatively, here's my trick: I have a "work" Pandora station. I turn it on when it's time to work, and I never turn it on unless I'm working. While it's on, it's time to work.

When it pauses after an hour, I can choose either to take a short break -- with the music off -- or I can immediately re-start it and continue to work for the next hour.

It's been a handy bit of mental conditioning.

</comment><comment><USER17> I can't think straight without my headphones and some decent music or white noise.

I use awesomewm, which, like ratpoison and ion, works hard to maximize every window and minimize distractions.

It's also good to designate one part of your room as the spot where you get your work done, and sit there if and only if you're going to do work, so that you pair sitting at your desk with getting work done. If you can't get into hack mode after about fifteen minutes of sitting in front of your work, get up and do something like solve a Rubik's cube, play Tetris until you lose, or just go get something to drink, but then sit down and try again.

</comment><comment><USER18> I need to make a to-do list (on paper, preferably) of the specific things that I need to get done

Then, I do them in order. Doing them in order is important- otherwise, I'll waste time procrastinate by trying to figure out what I should do next. If I do them in order, disregarding importance or difficulty, I don't spend half my time debating over whats next.

</comment><comment><USER19> I think none of the above understood your problem. I have the same problem and my solution was to keep in the university library and study with my peers. Today life is distracting (emails, facebook, TV...) so you won't resist it.

Another solution is to sell your mobile, tv, laptop, xbox... you'll find your productive mode.

<comment><USER8> "None of _the above_ "? The comments get resorted based on popularity, you know. Also, people may add comments 'above' by replying to existing threads.

</comment></comment><comment><USER20> Check out the "pomodoro technique"- I've used it when I feel like I need to build up work momentum and after a while it gets me back in the groove... <http://www.pomodorotechnique.com/>

</comment><comment><USER21> Something that often helps me: split into smaller tasks, but also prioritize. What is the most _important_ thing I could do to get my work a step forward?

And by "forward" I mean "more usable" or "more releasable" rather than "cooler". That's important :-)

</comment><comment><USER22> I agree with onewland: split your big task into small ones and solve them one by one.

My experience tells me that it works great, each completed task motivates me to next one and so on.

<comment><USER23> Yep, I think this was just on HN recently: [http://www.brepettis.com/blog/2009/3/3/the-cult-of-done- mani...](http://www.brepettis.com/blog/2009/3/3/the-cult-of-done- manifesto.html)

I hadn't realized how accurately that describes my productive/unproductive periods.

</comment></comment><comment><USER24> I can't force it, but sometimes I can trick myself.

<http://en.wikipedia.org/wiki/Getting_Things_Done>

</comment><comment><USER25> Headphones and a clear schedule in front of me. A cup of tea or coffee can help.

As far as music goes, have an album that you can put on infinite loop.

</comment><comment><USER26> <http://en.wikipedia.org/wiki/Student_syndrome>

</comment><comment><USER27> Do a ritual before you start working.

</comment><comment><USER28> Adderall.

<comment><USER29> Focus Factor works well enough for me. 8 pills a day/$40 per week for a bottle, and it's probably masking some underlying condition, but it works.

</comment></comment><comment><USER30> Exercise.

</comment><comment><USER31> 1.) reduce distractions - this includes a clean workspace etc

2.) appropriate music - I cannot work without headphones, and appropriate music on, its more of a tool to drown out the rest of the world.

3.) caffine, cold - at work i drink coffee... its just not as effective. I used to drink a lot of red bull, but my heart started to feel funny so I switched to coke.

4.) Interest - I need to get myself interested in what i'm working on, this is incredibly difficult to do with job work. I'm still working on solving this one.

<comment><USER32> _caffine, cold - at work i drink coffee... its just not as effective_

I think it's a function of sugar. Really sweet coffee tastes terrible. Properly sweetened coffee does not give your brain that glucose rush that super-sweet soda does. (Soda can be super-sweet without tasting bad, apparently.)

(I drink a lot of coffee and tea, and it's nice, but sugary energy drinks are something my brain really enjoys the effect of. Not so good for the rest of your body, however.)

<comment><USER33> Diet Mountain Dew. Zero calories, all the speedy goodness. Nice and cold.

It makes some of the mundane line items or defect work seem like the next Google sometimes.

That, and going into the work thinking "this is the last code I will ever write" does the trick. Make your source code a work of art.

<comment><USER32> Diet soda, or rather, caffeine without sugar, just makes me mad. I drink it, feel awake, and then feel angry.

I think if you go through my HN history, you can see what days I was trying to cut down on sugar :)

</comment></comment></comment></comment><comment><USER34> I am doing Getting Things Done (GTD). One part of it is the so-called "Processing" step. That means you gather all your notes, scraps of paper and so on and work it into your GTD-system. I do this at the beginning of the workday and it helps to focus my mind on what is going on in my world. Because I have to think about my notes (What does that mean? Is it actionable?) I have to load the current "frontier" of problems into RAM. On most days this leads to automatically starting to work directly on the problem at hand and getting into the zone.</comment>


Intel VISA Exploit Gives Access to Computer's Entire Data, Researchers Show - <AUTHOR> https://gadgets.ndtv.com/laptops/news/intel-visa-sa-00086-exploit-researchers-computer-data-access-2014854 <comment><USER2> This doesn't discuss when the attack matters. I see at least three ways:

1\. If you can do the attack entirely over USB, then you can completely take over a machine via USB and possibly add a very powerful firmware rootkit. The JTAG password seems relevant here.

2\. If you get root code execution, you may be able to install a better rootkit. This might be able to extract supposedly hardware-secured crypto keys.

3\. The "deterministic RNG" and/or inspection of RNG signals mode might be an interesting attack against SGX — SGX enclaves expect RDRAND to be secure. (If you can take over the ME, I think you can break some of SGX's platform features, but I don't think you break the core security guarantees.)

I think the JTAG password is the nastiest bit here.

<comment><USER3> I'm driving, but don't want to forget this later... do you think you could help me with a 30 second run down on Intel JTAG?

I assume not all chips have the same JTAG password. I assume JTAG can be accessed via software running on the processor itself and not require explicit physical access. I assume there is a hack that allows someone to obtain their processor JTAG password, how that works is what I'm most interested in I suppose.

<comment><USER4> JTAG requires physical access.

<comment><USER5> How so? Hack a net-connected USB device that the target is using.

<comment><USER6> The net-connected device would need to be connected with a USB 3.0 debugging cable. Also DCI would need to be enabled on the computer.

<comment><USER5> Can it be done via DbC?

[https://www2.lauterbach.com/pdf/dci_intel_user.pdf](https://www2.lauterbach.com/pdf/dci_intel_user.pdf)

<comment><USER6> Yes, as I said, if DCI is already enabled and the device is connected via. a USB 3.0 debug cable.

It can be made like this:

[https://github.com/ptresearch/IntelTXE-PoC#preparing-the- usb...](https://github.com/ptresearch/IntelTXE-PoC#preparing-the-usb-debug- cable)

Or you can buy one from Intel.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> The Core 2 series on LGA775 is the last Intel chipset where the ME can be entirely disabled.

This VISA exploit relies in some way on SA-00086, which is a flaw in the ME that cannot be removed in later versions.

The me_cleaner script has been able to purge these older chipsets since October of last year. I cleaned two different HP desktops at that time, and uploaded the modified BIOS here:

[https://github.com/corna/me_cleaner/issues/233](https://github.com/corna/me_cleaner/issues/233)

These still suffer from Meltdown and the remediation does exact a performance penalty, but Core 2 is starting to appear as the most manageable risk of all their products.

<comment><USER8> Curious what your threat model is.

<comment><USER7> The Intel ME can be accessed over the connected ethernet even when the PC is shut down, as long as the power supply is attached.

SA-00086 as an exploit is available through the ME.

VISA is available for access by the (compromised) ME.

This seems threatening enough to me.

<comment><USER9> I am always confused about this part. Are systems that don't support vPro/AMT/MEBX also accessible over the motherboard's Ethernet connection?

<comment><USER7> As far as I know, yes.

If you run the Linux ME reporting tool and it is identified, then ME is awaiting provisioning and commands.

Every chipset has the CPU that serves the ME, separate from the CPU.

<comment><USER10> All Intel systems contain ME hardware and firmware, but most consumer systems are not configured to support remote administration via the integrated ethernet port.

<comment><USER11> On older Intel chips it's possible to remove the ME and have a functional CPU. These Intel systems running Libreboot lack functional ME firmware/hardware.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> The scariest line to me:

> Intel doesn't publicly disclose the existence of Intel VISA and is extremely > secretive about it

So all of my data and everything I do on my computer is flowing through this every day, and nobody knows what it is or what it does....

<comment><USER13> You never heard of intel IME or amd PSP?

It's a mips microprocessor inside your cpu, completely undocumented and has access to the memory, peripherals, network interface etc.

<comment><USER14> "completely undocumented and has access to the memory, peripherals, network interface etc. "

They were documented in the sense Intel publicly advertised them for years under AMT and vPro as enterprise features. That's why all the discussions on HN about whether Intel had backdoors or weakened randomness were funny. While people were "countering misinformation" here, Intel was publicly advertising backdoors in their chips to ease the management burden. I mean, I guess you could call them front doors with the publicity.

The sneaky part was how they started including them in all chips without a way to (a) buy chips without them or (b) know for sure you could turn them off. I immediately suspected NSA paying them off given most of this started in Trusted Computing Group activities which included classified sessions with NSA. They were always a stakeholder in that stuff. AMD did it, too.

Our only hope for x86 now is the Chinese company that's sharing AMD's chips. They might make a chip with no U.S. backdoors: only Chinese backdoors. If you're worried about local government but not I.P. theft, then the Chinese backdoors won't be any threat to you. Problem solved if the computers get here with no interdiction. Gotta do shell games.

<comment><USER15> I am not surprised that their inclusion was sneaky. I recall when Intel attempted to market TPM for the first time. The reaction was swift and very negative. Slashdot was not in favor of 'security' through including security holes and relying upon obscurity of the information on how to exploit the holes being the single point of failure. It was closer to when the government was trying to mandate key escrow and Clipper chips than now and back then they had to walk it back and not release it with a high profile. Back then the most common worry focused on was that this would be used for hardware-based DRM in service of the entertainment industry.

<comment><USER4> _I recall when Intel attempted to market TPM for the first time. The reaction was swift and very negative._

Are you sure you didn't confuse that with the processor serial number (that Intel actually reversed their decision on)? [https://news.ycombinator.com/item?id=10106870](https://news.ycombinator.com/item?id=10106870)

TPM was (unfortunately?) far more positively received, likely because it was marketed as a security instead of DRM feature --- and the same goes for a lot of other antiuser features today... the manufacturers have gotten smart about it.

<comment><USER16> The TPM got almost universally negative negative coverage outside of the enterprise IT space because there wasn't an obvious benefit to anyone else and many concerns that it would prevent alternative operating system installs, lead to unbreakable DRM, etc.

This was unfortunate as it largely evaporated the middle ground who recognized that without some trusted base you also can't recover from malware or have robust anti-theft measures. I wish the politics had been such that we ended up with a robust open-source implementation before so much shoddy, unreviewed code had shipped so widely.

</comment></comment></comment></comment></comment></comment><comment><USER17> [https://www.blackhat.com/asia-19/briefings/schedule/#intel-v...](https://www.blackhat.com/asia-19/briefings/schedule/#intel- visa-through-the-rabbit-hole-13513) has link to presentation slides

Other articles: [https://www.zdnet.com/article/researchers-discover-and- abuse...](https://www.zdnet.com/article/researchers-discover-and-abuse-new- undocumented-feature-in-intel-chipsets/)

[https://www.theregister.co.uk/2019/03/29/intel_visa_hack/](https://www.theregister.co.uk/2019/03/29/intel_visa_hack/)

<comment><USER18> Three videos here also: [https://github.com/ptresearch/IntelVISA- BH2019](https://github.com/ptresearch/IntelVISA-BH2019)

<comment><USER19> And the proper paper esp.

</comment></comment></comment><comment><USER4> _Intel underplayed the exploit and told ZDNet that the VISA issue requires physical access to the machines and the Intel-SA-00086 vulnerabilities have already been mitigated._

Am I the only one here who thinks "threat model" and isn't all too worried? Physical access = full control, I've long held that belief and am not happy that this freedom is continually being eroded in the name of ever-increasing ridiculous "security" (a lot of it _against_ the user, for things like DRM, as mentioned in one of the other comments here.)

Debugging/"test mode" features are basically present in all modern CPUs. I would not bet that Intel is the only one.

Edit: such features have been present in CPUs dating back to the late 70s, so perhaps "modern" isn't needed: see [http://forum.6502.org/viewtopic.php?f=8&t=3366](http://forum.6502.org/viewtopic.php?f=8&t=3366) and [http://e4aws.silverdr.com/hacks/6500_1/](http://e4aws.silverdr.com/hacks/6500_1/)

<comment><USER20> The main thing is "Why undocumented?", not threat model and physical or remote exploit.

<comment><USER21> > The main thing is "Why undocumented?", not threat model and physical or > remote exploit.

No, the main thing is if VISA is for qualifying chips on the production line, why don't they burn a fuse permanently disabling it on chips that pass QA?

<comment><USER22> VISA isn't for qualifying chips as much as it is for debugging chips including customer returns. Long ago access to limited versions of the signals was given to some customers under NDA and customers had the ability to set customer fuses which would prevent Intel from unlocking the debug features. There's also an unsupressable "debug enabled" bit hardwire to a lot of these functions if I remember so the parent system can always see if somebody turned on the debug functions. Turning on debug functions also usually had the effect of disabling/corrupting important key material.

This said, its basically a giant signal mux system run into a main block, you'd be pretty limited on what preselected signals are available at a time. People were also reasonably careful not to give entire busses of signals at once.

</comment></comment></comment></comment><comment><USER20> Undocumented? a bug? No, a backdoor. big brother (NSA, FSB, ...) inside[1]?? There isn't any datasheet/docs about "Intel Visualization of Internal Signals Architecture" on Google! even documented technologies/features like Intel ME and AMT or speculative execution (Spectre/Meltdown) are (were) backdoors, not bugs! We need open (free) source hardwares (PCH, CPU, GPU, ...) with a complete documentation.

[1] [https://github.com/CHEF- KOCH/NSABlocklist/issues/31](https://github.com/CHEF- KOCH/NSABlocklist/issues/31)

[2] [https://software.intel.com/sites/default/files/managed/d3/3c...](https://software.intel.com/sites/default/files/managed/d3/3c/intel- th-developer-manual.pdf)

</comment><comment><USER23> The name VISA makes all of this extremely confusing, as there are two other major overloaded meanings for the word

<comment><USER18> _" Intel doesn't publicly disclose the existence of Intel VISA"_

An internal-only name leaked... _" Visualization of Internal Signals Architecture"_

<comment><USER23> Yeah, I figured that out eventually, but for the first while I was mentally following multiple possible narratives

</comment></comment></comment><comment><USER24> >VISA's documentation is subject to a non-disclosure agreement, and not available to the general public.

\- [https://www.zdnet.com/article/researchers-discover-and- abuse...](https://www.zdnet.com/article/researchers-discover-and-abuse-new- undocumented-feature-in-intel-chipsets/)

Back in the 80s, such policies were dismissed as "security through obscurity". So much change, so little progress ...

</comment><comment><USER25> Clickbait article. Ignore it and read the slides instead:

[https://i.blackhat.com/asia-19/Thu-March-28/bh-asia- Goryachy...](https://i.blackhat.com/asia-19/Thu-March-28/bh-asia-Goryachy- Ermolov-Intel-Visa-Through-the-Rabbit-Hole.pdf)

</comment><comment><USER26> Intel's recent string of "what the fuck" failures are what happens when a monopolist emerges and goes unchallenged for a long enough period to become lazy.

May the market penalize them in kind.

<comment><USER12> The tech industry in general undervalues security (at least in my opinion). I agree part of the reason Intel does is about being a monopolist, but I see this as a bigger trend of fancy/shiny/innovative at the expense of solid/secure/stable.

<comment><USER26> But Intel has stalled out pretty hard on fancy/shiny/innovative. They hit a brick wall with 7nm.

<comment><USER27> But you can still speed things up with shiny tricks like speculative execution...

<comment><USER28> Speculative execution (Branch Prediction) is hardly flashy. It's been present in Intel chips (Pentium) (and just about everyone else) since the early 90s (a quarter of a century ago). This was back when die resolution was 600 nm.

<comment><USER27> Right, my point was that they're doing more than just reducing the nm.

</comment></comment></comment></comment></comment></comment><comment><USER29> Out of interest: What would one consider as the most secure, commercially available computer architecture?

Are there any open, vetted computer system out there?

How do projects such as the _Raspberry Pi_ fare in terms of security?

<comment><USER30> > Out of interest: What would one consider as the most secure, commercially > available computer architecture?

Define your limits.

For the everyday, you won't get far. Intel, AMD and others have all been shown to have problems like this, or at least things they specify for government agencies.

However, tiny computer architectures like MIPS, AVR and the like probably don't, simply because they tend to be too small. They don't have the memory for advanced backdoor techniques... But are trivial to access their memory if you have physical access.

Straight-up RISC-V is too new to truly trust security, but looks fairly great... Until you realise that almost everyone is going to add their own proprietary extensions to it, and those extensions may well include things like VISA.

\---

The Raspberry Pi uses a Broadcom ARM chip. (Which model you get does have different models of the particular SoC, and the two main chips are vastly different).

I don't have enough details about the particular chip to tell, but ARM does have it's own remote management system. It may or may not be part of what Broadcom offers, and may or may not have undisclosed abilities to offer to clandestine agencies.

<comment><USER31> > Straight-up RISC-V is too new to truly trust security, but looks fairly > great...

Bad analogy because Risc-V is an instruction set, not a physical microarchitecture. Back doors and side channel attacks could still be possible when implementing risc-v as a uarch.

The same applies for any ISA be it MIPS, x86-64, Power, Arm, Spark, PA Risc, Alpha, etc. They're just different programming languages implemented in hardware. And like software, hardware can have bugs too, though patching is much harder or impossible.

<comment><USER18> Your quote cut off the parent right before they made roughly the same observation.

<comment><USER32> Not really - it was talking about proprietary extensions to the instruction set, but the real problem is on implementation level. You can implement most everything strictly to the spec, and still have vulnerable side channels.

</comment></comment></comment></comment></comment><comment><USER33> > "Security researchers have discovered a previously unknown feature in the > Intel chipsets, which could allow an attacker to intercept data from the > computer memory. The feature called Intel Visualization of Internal Signals > Architecture (Intel VISA) is said to be a utility that is bundled by the > chipmaker for testing on the manufacturing lines. Although Intel doesn't > publicly disclose the existence of Intel VISA and is extremely secretive > about it, the researchers were able to find several ways to enable the > feature on the Intel chipsets and capture the data from the CPU."

Am I the only one reading this and thinking - tho' not surprised - "there's a backdoor baked into Intel chips"?

</comment><comment><USER34> Don't trust the hardware RNG, they said. And people pointed fingers and called them paranoid while laughing.

</comment><comment><USER35> For some odd reason Twitter does not permit that I share the link to the security disclosure page.

I can post youtube videos, cat pictures but the link to this page gets refused. Here is a video of what happens: [https://media.giphy.com/media/kiB8T8qeTHCVdUM2oZ/giphy.gif](https://media.giphy.com/media/kiB8T8qeTHCVdUM2oZ/giphy.gif)

Are we in China yet?

<comment><USER36> Just delete Twitter account and create a Mastodon account :)

<comment><USER35> True.

On the other side: stepping out of twitter will isolate those who call attention to these things and just helps them to further block the population from knowing what is happening..

</comment></comment></comment><comment><USER37> I hope this Intel VISA Exploit will shed some light upon inner workings of Intel Management Engine, its memory states, software modules, their undocumented features etc.

<comment><USER38> The slides mention that they are able to unlocked JTAG for IME cores, so I suspect we should be finally be able to do research into it.

Personally I'm curious what doors this will open for understanding microcode.

</comment></comment><comment><USER39> This article appears to be blog spam after an interview ZDNet had with the researchers, which seems to include a lot more info on this.

Appears Intel is trying too underpin this as unexploitable (shocker!!!), citing a patch from last year. Researchers say that there are multiple ways to turn this debug mode on besides those.

<comment><AUTHOR> Oops, didn't notice that. The article I posted has two links other than the zdnet link, but they're also contained in the zdnet article. Totally support the admins repointing to this if they want:

[https://www.zdnet.com/article/researchers-discover-and- abuse...](https://www.zdnet.com/article/researchers-discover-and-abuse-new- undocumented-feature-in-intel-chipsets/)

</comment></comment><comment><USER40> Given the scale of some of the recent x86 exploits that went totally unnoticed by massive chipmakers like Intel (thinking mainly Spectre/Meltdown but this is pretty bad too), is it even possible to build a secure x86 processor?

Can anyone really say, given the insane pit of complexity that x86 has become?

<comment><USER32> This one is more like a deliberate backdoor that was left not fully secured. It doesn't seem to have anything to do with x86-the-instruction-set.

And stuff like Spectre and Meltdown is all about _how_ they chose to implement it - specifically, optimizations. It is very possible to have an x86 CPU that doesn't try to be "smart" at all, and just implements the x86 spec in the most straightforward way possible... so long as you're willing to pay the perf penalty. It looks like we don't.

</comment></comment><comment><USER41> [https://www.blackhat.com/asia-19/briefings/schedule/index.ht...](https://www.blackhat.com/asia-19/briefings/schedule/index.html#intel- visa-through-the-rabbit-hole-13513)

Excerpt: "The complexity of x86-based systems has become so great that not even specialists can know everything."

We need a new CPU manufacturer. One that is built from the ground up on transparency, auditability, accountability, and Einstein's "as simple as possible but no simpler" maxim.

Such an entity cannot, CANNOT be a corporation.

The reason why such an entity cannot be a corporation is because a corporation is legally bound to the legal structure in the country in which it operates, and that legal structure may create, one way or another, a door for secret agreements / secret hardware modifications between that company and the host government.

In other words, transparent, ethical engineers with NO conflicts of interest -- are no longer running the show... Corporate lawyers and Government lawyers are.

That has to change in the future...

<comment><USER3> >Such an entity cannot, CANNOT be a corporation.

How would that work? You want a government designed secure processor... why wouldn't you figure that the reasons they are insecure now is because of gov involvement?

If you want an open source processor... that's cool, and corporations can/are already do that.

Now... with any solution proposed, verify to me that the silicon as designed is really the silicon made, esp when talking about 7nm.

<comment><USER42> Can I enter your factory and inspect the dies as they come off the line before they are sealed? If yes, then you could indeed verify the silicon is as designed. Probably just as you could take a chip that does not work and diagnose the problem, this functionality would seem to be necessary to successfully build a chip/chip factory in the first place. How would you troubleshoot the manufacturing process if you couldn't audit the product for quality/accuracy?

<comment><USER41> Completely random inspections of product in any stage of the manufacturing process by third parties is a good idea.

I don't know the practical reality of any company permitting that, but it's a good idea. Some future chip manufacturing group will hopefully do that.

Audits of any form at any time by any party should be permitted, rather than denied.

</comment></comment></comment></comment><comment><USER43> I was re-reading the 2017 AMT story, it is so strange. How is this even possible?

[https://www.tenable.com/blog/rediscovering-the-intel-amt- vul...](https://www.tenable.com/blog/rediscovering-the-intel-amt- vulnerability)

</comment><comment><USER42> If this is truly for assembly line diagnostics they should add a hardware self destruct to the interlink with those circuits, after VISA serves the intended purpose fry it. Is that a reasonable and technically feasible option?

</comment><comment><USER15> What exactly is 'Orange Mystery'? From the context of the article they make it sound like it is another known vulnerability, but I went looking and can't find anything related with that name.

<comment><USER6> Orange Mystery (their made up name) is an intended way to get JTAG access to TXE if the CPU is in manufacturing mode. Something that only happens if an OEM forgets to turn it off before shipping. This was the case with Intel Macbooks, before it was fixed. Haven't heard of other manufactures making the same mistake.

<comment><USER44> IIRC CS(TXE/ME) are implemented in the pch, not the cpu. It's also pretty common for consumer gaming motherboard manufacturers to leave it on. I know at least MSI and Gigabyte do

<comment><USER6> It's common for gaming motherboards to leave manufacturing mode on? Got any info on that, can't find anything on google about this.

</comment></comment></comment></comment><comment><USER45> How do I find out if this debug mode is enabled?

</comment><comment><USER41> "VISA... it's everywhere you don't want to be..." <g>

</comment><comment><USER46> I mean you could look at it as a 20 channel logic analyzer for free...

</comment><comment><USER47> Getting real tired of hearing about how our monopolistic glorious chip-maker leaks data like a sieve, almost as if there's some sort of monetary benefit to doing so...

</comment><comment><USER48> This is why we must all move to end-to-end encryption. We should limit "concentrations of information" just like "Concentrations of power".</comment>


Apple's Fastest Growing Product Category - <AUTHOR> https://twitter.com/dbreunig/status/792034409788518401 <comment><USER2> Joke aside, I'd like to know how much of their revenue is from accessories. I'm sure it'll be a tiny percentage, but even 1% would be a massive amount of money. And we all know the margin is way bigger than in any other hardware product they make.

</comment><comment><USER3> This is absolutely brilliant :)</comment>


Swamped bankruptcy courts threaten US recovery - <AUTHOR> https://www.ft.com/content/14b07c0e-95e3-11ea-af4b-499244625ac4 <comment><USER2> My wife has also been seeing an increase in strategic defaults. These are cases where the company could easily make its loan payments, could in fact pay off the loan entirely with the cash it has in the bank - but chooses not to. The court systems are overloaded and oftentimes closed right now, the lawyers all have to work over Zoom, so what's the lender gonna do? The company views it as more important to hold cash in the bank right now than to service existing loan obligations that its creditors can't enforce anyway.

The entrepreneur in me is saying that the biggest start-up opportunity in America right now is a government. We're on the verge of a cascading failure in the legal and political system, and few people realize how much of civilization rests on having a functioning legal system.

<comment><USER3> Naive/uninformed question, is this something that shouldn't be allowed? Do business loan contracts not have provisions/penalties in the case of missed payments that apply outside of a court? Why shouldn't the business take the penalty if cash on hand is more valuable to them?

The courts aren't going to be tied up forever, your borrowers have the money to meet their obligations, and presumably they'll eventually make payments. Outside of the pain of having to ride out the storm is there any real risk?

Like it doesn't sound super weird to me that a family will "strategically default" on their mortgage despite technically literally having the cash to pay it because they're scared of not being able to buy food in a month.

<comment><USER4> >> in the case of missed payments that apply outside of a court?

When someone owes you money you have two choices: The courts, or rounding up some people with guns and taking the money yourself. It is either the courts or anarchy. Businesses know this. When they don't pay their debts they know the options for creditors are very limited. Getting money out of a business that really doesn't want to pay takes many trips to the courthouse. Eventually you end up foreclosing on some asset, a process that takes many months.

Banks don't just hand over their client's cash because a court says they own money. Banks require court orders naming specific accounts. A business trying to avoid creditors can easily move money around faster than the creditor can get court orders.

<comment><USER5> But, if we consider this discussion to be purely businesses which have enough cash on hand to pay, I'd guess:

If the loan contract says "for each missed or late payment, a fee of 25% applies", then the lender can chase it up at their leisure, and overall will likely come out ahead.

I suspect the issue is some loans didn't have the "25% fee" written into the contract, and in that case, a court will likely only assign costs plus a nominal interest. If the court queue is years long, then effectively they can pay a few years late, and the costs can't be all that much if no court appearance has happened.

<comment><USER2> The loans in question actually did have very strict collateral clauses - basically if the borrower defaults the lender can take possession of assets that basically put the borrower out of business.

There are three possible explanations for why I think the businesses in question are doing this:

1.) The lenders in question are philanthropic organizations, and would take a PR hit if there's a protacted court battle that puts the borrower out of businesses. They may be betting that the lenders won't enforce their contracts (turning out to be a poor bet in retrospect, but many businesses see philanthropic capital as dumb money).

2.) The court systems are closed. It's going to be many months, possibly years, before they can actually take possession of the capital.

3.) The business may not believe that they'll be in business in the long term. If by not paying back a loan, you end up out of business in a year, but by paying it back you end up out of business in 3 months, you actually do have a fiduciary duty to not pay it back.

</comment></comment></comment></comment></comment><comment><USER6> During the 2008-9 crisis I learned that the failures and responses could be understood in the context of mass computational problems.

Before a crisis, the system moves along w/o having to fully process everything; this is because a low-fidelity understanding of value and status of securities and agreements is sufficient for participants to operate. However once the crisis has begun, new dire weaknesses and new structures require much higher fidelity to guarantee safety. The participants find that there is much more to compute than can be computed in any reasonable timeframe.

This is why the monster-sized purchasing programs by lenders of last resort are somewhat effective; the are enabling everyone to function by delaying the difficult financial computations.

<comment><USER7> The problem was uncertainty about the inputs, not insufficient computational power to crunch those inputs. If computational power were the bottleneck there would have been a mass spike in server purchases and a run on compute capacity, but clearly there wan't.

</comment></comment><comment><AUTHOR> > What happened next was odd — and symbolic. In the last two months, courts > have repeatedly frozen Modell's bankruptcy process, citing the pandemic. The > company is now a zombie, neither dead nor alive. Its status could soon > proliferate across corporate America, further confusing the economic > outlook.

Is there a database on companies that are zombies?

</comment><comment><USER8> The article talks about how few companies have filed for bankruptcy so far. I have heard it predicted that companies will wait until businesses are open so they can liquidate. And, at the same time there would be a race then because companies would want to be at the start of the liquidation wave.

When I heard this they didn't talk about the difficulty in overwhelming the courts, which is another interesting factor.

<comment><USER9> There is probably some sort of consideration about If you want to get it done quick or drag it out. If you think you can restructure and bounce back you want the quick option if you think your want to drag it out you wait till the last possible moment.

Really though last possible moment is best because it maximizes pain on the creditor and therefore increases settlement value

</comment></comment><comment><USER10> This looks like it's paywalled, does someone need to provide a non-paywalled version for it to stay?

<comment><USER11> Googling the url of the story is typically a god way around most paywalls, in this case the story seems available over amp:

[https://www.google.com/amp/s/amp.ft.com/content/14b07c0e-95e...](https://www.google.com/amp/s/amp.ft.com/content/14b07c0e-95e3-11ea- af4b-499244625ac4)

<comment><USER12> No need to use something as cancerous as AMP: [http://archive.is/Da3iS](http://archive.is/Da3iS)

<comment><USER13> CAPTCHA is less cancerous?

</comment></comment></comment></comment><comment><USER14> Link is paywalled, and should be removed.

</comment><comment><USER15> Stock markets: Down just 15% from ATH.

<comment><USER16> What is ATH?

<comment><USER17> All Time High</comment></comment></comment>


Termux and Android 10 - <AUTHOR> https://github.com/termux/termux-packages/wiki/Termux-and-Android-10 <comment><USER2> I really hope they figure out a good solution for this problem. One way I distinguish between a "real" computer and a toy or appliance is whether you can use the device to write software for it. With Termux, you can write Linux- style programs on the Android device itself or even build full Android apks.

One of the other awesome things about Termux is that you can use it to setup a pretty complete ARM Linux environment on an Android device in a few steps: [https://wiki.termux.com/wiki/PRoot](https://wiki.termux.com/wiki/PRoot)

You can even get a GUI running if you have an XServer: [https://wiki.termux.com/wiki/Graphical_Environment](https://wiki.termux.com/wiki/Graphical_Environment) & [https://github.com/adi1090x/termux- desktop](https://github.com/adi1090x/termux-desktop)

I've used this in the past to get a pseudo-Linux dev environment running on an Oculus Quest: [https://www.reddit.com/r/cyberDeck/comments/fc5sfr/oculus_qu...](https://www.reddit.com/r/cyberDeck/comments/fc5sfr/oculus_quest_termux_selfcontained_hmd_cyberdeck/)

<comment><USER3> The only "real" solution is to get an actual Linux phone, such as the PinePhone[1] or Librem 5[2].

1 - [https://www.pine64.org/pinephone](https://www.pine64.org/pinephone)

2 - [https://puri.sm/products/librem-5](https://puri.sm/products/librem-5)

<comment><USER4> But you pay 750$ for a 3GB quad core phone; I've got these specs on a 300€ OnePlus One five (six?) years ago.

Sure, replaceable battery and open hardware are a _very_ good thing, but the value/$ of these phones are horrendous. That's not to defend OnePlus or any other manufacturer, but when I can get a high end Samsung or Xiaomi device with 4 times the specs at every corner for the same price or less and simply install Lineage on it.

I definitely support the effort and I love that they finally got the design modern, but those prices are hard to swallow, even for someone pretty privacy- focused.

<comment><USER3> These phones are primarily about user-freedom, privacy and my ability to do whatever I want with a device that I've purchased, without restrictions imposed by the OEM.

Also, honest question; What do you actually 'use' the latest specs for? These Android/iOS phones are basically all about media consumption, something that has been sufficiently performant for years. You have great hardware, but no software to take real advantage of it.

On the other hand, the Linux phones can do so much more on the software side that if they do become successful enough for a second/third... generation with more powerful hardware, it would be much more noticeable than a paper spec bump.

<comment><USER5> Basically I'm using Firefox, K9 for email, WhatsApp and Telegram to chat with friends, OSMAnd to plan and record bicycle tracks. Phone and camera. Plus mandatory banking apps or I won't be able to do home banking.

If I buy a Linux phone I'd have to keep using my Android phone probably as my primary device. And I've been using Ubuntu laptops as my only working devices since 2009 so I'd love to use an Ubuntu phone. Unfortunately it lacks at least half of the apps I need.

<comment><USER6> Does your bank have a web interface?

<comment><USER5> I have more than one bank. Work and personal and separation of risk. Of course they have a web interface but almost all of them also need their app for two factor authentication and authorization. The EU directive of about one year ago.

Only one of them lets me still use a hardware key but they won't replace it when it will run out of battery.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> I'm really starting to despise most OS's for having such an overbearing security policy. I think it's really why I've stuck with Windows for so long. For sure Windows is not as user-stupid as something like macOS, iOS, Android, etc... but for me as a power user it's just about as powerful as I need to be.

I'm not even considering *nix distros here because honestly the market for every day users for something like Ubuntu or Mint is really small, and those are possibly the most end-user friendly.

I hate that macOS is starting to go the iOS route of only letting me run applications that are Apple certified. No, I do not want to open system preferences every time I want to launch something. I am a power user. Put it behind some shell command or something... but have it easily documented and marketed towards people like me.

At least we can still sideload with Android. Some changes to the API like this those are just so annoying. Yeah there's going to be some apps that just need pretty much unlimited access to my device. But that's OK. I've accepted that.

<comment><USER8> As someone who has been on Linux a long time, but still has to support family members using Windows, here's my perspective:

1) Linux is usually easier in the "happy case", where everything works as it should, and it supports everything that the user needs.

2) Linux is way way way less likely to just change something and break the whole system while the user is sleeping. (This was REAL fun with my grandparents-in-law when their Dell All-in-One PC decided to upgrade itself from Windows 8.1 to Win10 despite Dell not having drivers for Win10 on their fancy custom monitor. I have to fix it for them every 6 months now.)

3) Searching the web for Windows solutions to your issues without being a computer expert feels like it has a >80% of infecting your computer with malware or getting you on the phone with a scammer. As a computer expert it's like 20% (not even zero!).

4) Fixing a Linux problem can be _painful_ , but is often "copy and paste these config lines into this config". Arcane.

5) Fixing a Windows problem can involve having to go into the registry, which can't be copy/pasted and is extremely difficult AND dangerous. (There probably IS a way to copy/paste it, but I don't know it).

6) That said, it's easier to fall off the "happy path" and into real trouble in Linux. Fixing the issue by randomly clicking stuff is more likely to work in Windows than Linux.

7) It's way easier to find someone you know to help you on Windows than Linux, for now.

8) Gaming is still so much better on Windows, unfortunately, but the gap is closing.

9) The few times I've gotten family members to try Linux, they called me LESS often for support. Even on laptops!

10) Windows is becoming increasingly user hostile in every way. Ads, forced updates, forced settings changes, privacy issues, etc.

<comment><USER9> > _9) The few times I 've gotten family members to try Linux, they called me > LESS often for support. Even on laptops!_

This is so true.

All my family members are on Ubuntu, and it just works without any support. For many many years. Sometimes when I visit them I click on update to the next LTS. By the time I have to leave it is updated and runs again for 2 more years.

<comment><USER10> Where supporting Ubuntu falls over is when I try and support "power users".

There's like an uncanny valley of competence, between completely naive users who just let things run and experienced users who know where the red lines are when using sudo.

So far I've seen the following breakages:

\- completely fuck up apt somehow such that it refuses to update or fix itself

\- overwrite packages with their own compiled versions

\- mess with the system installed scripting environments

\- try and install a new kernel or graphics drivers (usually not even to get something working but because it's "new") and consequently break the boot somehow.

<comment><USER9> yes, true. But what alternative do we have? If such a power user breaks windows registry in a _really_ bad way, the fastest solution, by far, is to just reinstall anything. And, again, if you are smart about having your /home folders on a separate partition, reinstalling Ubuntu is way faster. So even in this worst case scenario Windows loses.

<comment><USER11> Pop!_OS has a recovery partition with a "reset installation", which keeps the home directory (I believe) but reinstalls everything else

</comment></comment></comment></comment></comment></comment><comment><USER12> This title is misleading for a few reasons:

\- Android 10 is not killing anything. Targeting API level 29, the native API level of Android 10, prevents the mechanism Termux uses, but you can target a lower API level and run just fine on Android 10, and in fact Termux _does_ run just fine on Android 10.

\- API level 29 blocks a specific mechanism that Termux happens to use to run arbitrary code. There are other ways to do anywhere from most to all of what Termux wants to do, with some tradeoffs. It's not as good as the old way, but it's hardly "killing".

<comment><USER13> Right now apps on Google Play are required to target at least API level 28. This will most probably be raised to level 29 in the near future, essentially blocking distribution of Termux, at least in its current form.

<comment><USER14> You will always be able to download Termux from outside Play. I actually have no idea how Termux could even work within Play policy seeing as it's essentially a 3rd-party repo not unlike F-Droid. You wouldn't expect to find F-Droid on the Play store, surely? You have to sideload it, and then it just works.

<comment><USER15> But that doesn't mean much when the SELinux hammer drops and no app can exec no matter where it's installed from.

</comment></comment></comment></comment><comment><USER16> As a heavy Termux user and one who describes Termux as "the killer app for Android" this makes me sad and angry. I was very irritated when they broke ability to send SMS from the termux CLI (in fact I forked and currently build my own version with that patch reverted).

If I wanted a paternalistic platform I would be an iOS user (I don't mean that as a slam, iOS obviously has its place, but it's not for me).

<comment><USER17> Why would you want to send sms from cli? Using the on screen keyboard with quotes and escaping special characters and all?

<comment><USER16> Thanks for asking. My use case is programmatic. I wrote a couple of ruby and bash scripts that automate a few different things. One is a poor-mans SMS scheduler that allows me to have it fire off at a set time. Another parses incoming messages and alert me differently based on content (matches against a set of regexes), and in some cases will auto-reply. Another, I had a case where I need to individually send out the same SMS to a couple dozen people. With termux (and ruby) it was trivial for me to script it up.

The possibilities are (or were) endless, which is what I love about a platform. I've always hated the UX of SMS, but people insist on using it anyway. At least this way I use it on my own terms.

<comment><USER16> It looks like the comment requesting a link to the fork was deleted.

I haven't kept the fork up to date with the latest patches as I haven't need anything yet, but it's here: [https://github.com/FreedomBen/termux- api](https://github.com/FreedomBen/termux-api)

You have to both `termux` the app and `termux-api` to get SMS functionality. I build both at the same version so there aren't any compatibility issues. Then make sure you don't have automatic updates turned on otherwise the Play store will "update" you to a non-sideloaded one that does not have the SMS ability.

<comment><USER17> I was going to say there must be apps that do this but it looks like Play store would ban those as well because they don't want apps doing that?

I think Google should subject power user apps to more scrutiny than banning them outright. If Android doesn't support things like these then it's no better than iphones.

</comment></comment></comment></comment></comment><comment><USER18> I ordered a PinePhone the other day and I'm going to do as much as I can to try and make it my daily driver.

I really can't be arsed with this stuff any more.

Why are the developers at Google acting in such boneheaded ways? Is it literally just "I get paid loads of money, lol"? Do people not grow out of that eventually when they have enough?

Like, you're literally a developer. Why would you make something you wouldn't want to use? Is the company just wholly made up of people who actually don't care about computing?

<comment><USER19> > Why are the developers at Google acting in such boneheaded ways?

(I'm a developer at Google, but I'm not on the Android team and am definitely not providing any sort of official response here - this is personal opinion and may be inaccurate)

If apps can download arbitrary code and then execute it, they can bypass the validation that's done as part of the Play Protect program. My understanding is that there's plenty of evidence of malware in the wild that presents as a harmless app and then downloads the actual payload after being installed on the user's device.

<comment><USER20> Okay, can I just get a big popup on the Play Store saying "this app requires the following functionality that could harm your device:

\- Run and use other applications without your consent

Unless you know precisely that this behavior is necessary for this application's main functionality, we recommend you do not proceed". And use some design pattern to make "Cancel" the "go-to" action for the user.

Or even more palatable for whoever's behind Play Protect: Forbid these apps from the Play Store, and force it be done through a 3rd party store or manually, and this can be combined with the big popup.

We know it's important to protect grandma from malware, but it's also important to give the advanced user the _option_ to ignore this, specially for a platform like Android that has gained the favor of many technical users through providing some reasonable degree of control over their phones.

<comment><USER21> It's also important to protect non Grandma from malware.

Rugged Individualists can run TempleOS

</comment></comment></comment></comment><comment><USER22> Impact of Android 10 on Termux usability is already old news.

What worries me more is behaviour of Termux developers. They make dubious claims and effectively sabotage their own application (more on that below).

The solution to Android 10 problems — a software wrapper called "proot" [1] — has already been found. That solution would allow to keep all of Termux functionality and preserve existing package managers (such as apt). Proot allows Android user to compile C code in Termux (which they currently can do) and does not require major changes to Termux itself.

Termux developers refused to adopt proot as solution and even removed it's mention from their wiki on Github. Instead they are insisting that all Termux packages should be distributed in Android apk files, published on Google Play. That "solution" has major usability issues, does not scale (it uses shoddy Android PackageManager to track all Termux packages) and would prevent users from using Gcc and other compilers in Termux. The only claimed upside of using apk files is that it would better comply with Google's policies.

Termux developers justify their actions by following arguments:

1\. Termux packages require a lot of bandwidth to host, and Termux does not have money to pay for their mirrors; hosting packages in Google Play would be preferable. That statement is nonsense — even fringe Linux distributions like Artix can find FREE mirrors, willing to host their packages. This is usually done by contacting curators of existing servers, that host Linux packages, and asking them for support. Termux is more popular than some of Linux distributions, but it does not look like Termux devs even TRY to do that — they apparently just sit on their hands, occasionally begging their sole mirror provider (JFrog) for more bandwidth.

2\. Termux currently does not comply with Google's policy and it's developers are afraid, that this will result in removal from Google Play. They are technically right, but they are making mistake by downgrading experience of their app in attempt to pacify Google Play censors. They are making even bigger mistake by displaying guilt about that — Termux does nothing wrong, and the display of guilt is a better excuse to punish them than their actions.

1: despite it's name, proot does not require root access

<comment><USER23> There are _already_ several "Linux-like environments" on Android that use proot. GNUroot, UserLAnd, Linux Deploy, AnLinux, Androlinux, etc.

Some of them _literally_ just package existing Linux distros such as Debian (e.g. GNUroot) in a way thatis much more compatible and easier to mantain than something ad-hoc such as Termux.

Termux became popular _precisely_ because _they did NOT use proot_. Proot is great in theory -- using ptrace and hooks in order to simulate a more Linux- like environment, ala Cygwin. In practice, it is just goddamn slow, and ptrace just introduce MORE compatibility issues than the native Android does.

Termux had a shitton of disadvantages compared to the proot-based distributions, such as for example the fact that every package had to be patched in order to use the non-standard Android directory structure, making compatibility with native Linux binaries utright difficult (not even ld is where it should be) and reusing Linux distro scripts impossible. But _still_ it became the most popular because proot is just worse.

No wonder they completely ignore all requests to use proot.

If you want to use proot, _there is no point at all for Termux to exist_ (or at least, for Termux the distro; the terminal emulator itself may still be interesting, your mileage may vary). There's little point remaining for patching packages for Termux; you can use Debian packages, so just go and use Debian.

And to to top it off, what if a future Android breaks proot, which looks likely?

</comment></comment><comment><USER24> As part of my work, I occasionally need to deal with a wireless comms setup that moves data from a roof-mounted RF antenna down into the network. Instead of having to carry my laptop up to the roof with me (sounds simple, but oddly enough dealing with the laptop up there is actually kind of a pain) or call someone downstairs to run the ping to make sure the network configs line up right, I use Termux with a scripted command to do that myself right from my phone. It's been a major boon to my workflow, and it's going to be frustrating to lose it.

Like a few others on this thread, I've got a PinePhone on order, and now I'm even more stoked to have access to a terminal through it now that Termux isn't going to be an option on my Android.

</comment><comment><USER25> I installed Termux on my Chromebook a few years ago to try and create a local development environment per this article[0]. It seemed to work okay, but I never liked how janky and unsupported the whole thing felt. I couldn't bring myself to try and build a workflow around it long-term.

And here I guess that's vindicated. Whether now or in a few years, the whole concept of Termux is not long for this world. I guess these types of restrictions are essentially required to keep insecure and abusive apps off of the majority of users' devices.

[https://blog.lessonslearned.org/building-a-more-secure- devel...](https://blog.lessonslearned.org/building-a-more-secure-development- chromebook/)

<comment><AUTHOR> When we need to quickly diagnose and fix some sudden server issue from anywhere, Termux is indispensable. I even bought a tiny Bluetooth USB keyboard because of it.

<comment><USER26> Agreed, I had been using JuiceSSH[1] but then it seemed to no longer be supported (though I see it just got an update) so I then switched to Termux to be able to ssh from my phone (which is running Android 10, I guess I haven't run into these problems since I don't generally do much with the local filesystem).

1: [https://play.google.com/store/apps/details?id=com.sonelli.ju...](https://play.google.com/store/apps/details?id=com.sonelli.juicessh)

<comment><AUTHOR> I migrated from JuiceSSH to Termux because it allows you to run remote diagnostic locally, ping, traceroute, schedule crons and even vibrate your phone and display notifications to alert you. It also allows you to port forward ssh, whereas in JuiceSSH you have to pay for that.

</comment></comment></comment></comment><comment><USER27> I mean it's sad that this change will affect Termux, but at the same time I can see why Google wants to enforce W^X on apps home dirs.

This is currently a big backdoor for apps to sneak unvetted code in at runtime, bypasses Google's review policy. Sure Termux was using this for good, but I guarantee that Google has examples of apps doing this to sneak hostile code onto user devices.

Development tools often need higher security permissions on Desktop, maybe Android just needs a "development" class of app that is more privileged? They'd just need to enforce the limitation to development focused apps really strongly in the review process.

<comment><USER28> If they were actually vetting the code, they could tell that an application contained a suspicious "download and execute".

In actual fact the Play Store is full of perfectly "vetted" malware, as it stands. What this _actually_ does is prevent the _user_ from coding on the device.

</comment></comment><comment><USER29> I get why Android is doing this, even if they're not openly writing it: they want to get in control of malvertising which downloads untrusted binary code that is not in the APK and thus scannable for the Play Store security scanners.

What I don't get: why aren't they creating a separate entitlement for runtime code execution that requires manual approval in the Play Store?

<comment><USER14> Hopefully that entitlement would require manual _user_ approval, too. I might not want any old free-to-play game from the Play Store to be enabled to run unapproved code on-device, but I definitely want it for Termux.

</comment></comment><comment><USER30> There are a couple solutions, with tradeoffs of course. It's important to remember that this isn't merely a technical problem. Some choices can be judged by human reviewers to be violating policy.

The obvious solution is to use isolatedProcess, the isolated_app SELinux domain, just as web browsers do. The restriction on executable code "does not apply to code that runs in a virtual machine and has limited access to Android APIs". Of course everything depends on what "limited access" means. Filtering out paths that start with "/../this-is-a-limitation/../" probably isn't enough.

Another solution is to ship all of the executable bytes. Turn an entire Linux distribution into something like busybox. It would be possible to exclude the non-executable pages of memory, shipping those separately as code-free ELF files. Installing programs would work the normal way, except that the .text sections would be empty holes in the files. As long as the mremap system call works, a loader should be easy to implement.

</comment><comment><USER31> I'm having a hard time already in Android 6. I used to be able to do things like use Termux to move videos I'd downloaded in NewPipe into subdirectories and delete them; apparently with Android 6 I can't do that any more.

What alternatives to Android are people using? I'm already not using the Play Store, just F-Droid and a couple of third-party apks.

<comment><USER14> If you're not using Play, why not root your device? You could ultimately bypass all of these restrictions.

<comment><USER31> Well, I don't know how to tell a safe root from a malware root (or find one that will work for my device), and I'm ignorant enough about Android to wonder if rooting the device means I'm running everything as root and consequently have no protection at all from malware? I mean, it's embarrassing, but that's the truth.

<comment><USER32> The most popular root solution for Android is Magisk. It's FOSS and doesn't affect the device's system partition.

[https://topjohnwu.github.io/Magisk/](https://topjohnwu.github.io/Magisk/)

[https://github.com/topjohnwu/Magisk](https://github.com/topjohnwu/Magisk)

[https://forum.xda-developers.com/apps/magisk/official- magisk...](https://forum.xda-developers.com/apps/magisk/official- magisk-v7-universal-systemless-t3473445)

<comment><USER31> Thank you!

</comment></comment></comment></comment></comment><comment><USER33> It also kills the entire Wardriving community as well as amateur network coverage work by putting a continually-increasing delay on how often an app can scan for wifi signals.

</comment><comment><USER34> Disclaimer: I'm not really an Android developer. I was considering implementing a service I'm working on for Android and after many hours of research determined it's not a suitable operating system for my purposes.

Personally I no longer consider Android a viable computing platform. As a developer you simply don't have the tools available to give your users control over their data and experience. With the changes to storage security the last couple years, they've essentially dumbed it down to the level of a web browser, and in the process pretty much deprecated running native (C, C++, Rust, Golang, etc) applications.

I'm not opposed to improving security, but when you can't even run software like syncthing or a file explorer without getting special Play store approval, something is wrong.

I've been meaning to write a blog post summarizing what I learned.

This official video is actually a pretty good summary of some the changes made and what the goal is:

[https://youtu.be/UnJ3amzJM94](https://youtu.be/UnJ3amzJM94)

</comment><comment><USER35> Android 5/6 support dropped by Termux devs this year.

Android 10 is killing Termux terminal app.

Hope, Termux devs would now drop back support for Android 5/6.

<comment><USER36> That part hurt me. One of the points of things like Termux is to make use of old devices, so killing support really isn't helping.

</comment></comment><comment><USER37> The linked page on Android.com does not contain the quoted text about exec(), or the linked section header. Was it removed?

Edit: seems to have moved here: [https://developer.android.com/about/versions/10/behavior- cha...](https://developer.android.com/about/versions/10/behavior-changes-10)

</comment><comment><USER38> Yeah, apparently many still haven't got the message that Linux on Android is only implementation detail and the NDK's main purpose is for writing Java and Kotlin native methods.

The way forward is to create Termux like apps in Java/Kotlin.

POSIX is anyway not part of official stable APIs.

</comment><comment><USER39> Time to order my Pinephone.

</comment><comment><USER40> Well that's annoying... I'm not a heavy termux user, but it's been extremely useful in some situations - ssh proxy over abd in very restricted networks mainly.

</comment><comment><USER41> >Issues

>Android 10 does not allow free access to /sdcard (at least file system based).

Yeah that is kind of an issue, with plenty more apps than termux I'm guessing.

<comment><USER42> Yup. For me it's particularly painful that Syncthing will stop working[0, 1]. Though it seems there might be hope in Android 11[2]?

[2] [https://github.com/syncthing/syncthing- android/issues/29](https://github.com/syncthing/syncthing-android/issues/29)

[1] [https://github.com/Catfriend1/syncthing- android/issues/457](https://github.com/Catfriend1/syncthing- android/issues/457)

[2] [https://forum.syncthing.net/t/android-11-all-files-access- fo...](https://forum.syncthing.net/t/android-11-all-files-access-for-the- syncthing-app/14651/13)

</comment></comment><comment><USER43> What's the actual restriction? If it's literally just exec on apps outside the app directory, why not shim the dynamic linker and rewrite calls to exec to use that instead? Are there additional W^X protections that prevent mapping executables outside the app directory PROT_EXEC? (Note I have no idea how Android works so I may be missing something very basic).

<comment><USER14> Part of the problem is precisely that no one knows how these restrictions might evolve in the future. There's no such thing as forward compatibility when it comes to Android API levels.

<comment><USER44> Sure, but this is about API level 29, not 30+. We can speculate that API 30 will disallow non-Google-written code by default but that's not the discussion at hand.

</comment></comment></comment><comment><USER45> I turned-off automatic downloading of upgrades on my Oneplus once I found this out. Termux is very important for me since it allows me to install the typical tools like SSH/Nginx etc that help me connect to my phone, view my wiki (synced between my PC and phone using Syncthing) among other things. It is a very useful piece of software.

</comment><comment><USER46> I depend heavily on Termux when travelling without my laptop (i.e., vacation). With my smartphone, a bluetooth keyboard, Termux, an impressively full-fledged emacs, a well-crafted ssh config, and my 2FA card, I can solve most or all emergency work-related problems remotely. Hopefully there will be a solution here.

</comment><comment><USER47> Just the ability to run TOR along with a node server made this incredibly useful. This way it was possible to register an onion domain and set up e.g a chat server with just a phone.

</comment><comment><USER48> android 10 has been pretty bad for rooting etc. i think they would do well to release something that us techies can tinker with though. Call it android 10 unsafe edition :) , i gotta say im pretty happy that its still possible to disable annoying bloatware like 'settings' and 'play store' via the android debug shell. the moment that changes im going to have to drop android altogether, because i still dont believe in using a phone like a computer.

</comment><comment><USER49> Termux is the only reason I use Android. If it doesn't work in the future I will most likely switch to IOS. Long term software support is much better anyway.

</comment><comment><USER50> I love Termux. They must introduce a mode where a user can whitelist certain applications for this, get the permission policy inside the application.

</comment><comment><USER51> pretty annoying to read that issue thread ( [https://github.com/termux/termux- app/issues/1072](https://github.com/termux/termux-app/issues/1072) ) and read that instead of changing their app behavior, they just want to drop out of the play store :/

They had 2 years to react to this.

<comment><USER14> Dropping out of Play is arguably the best solution because the whole point of Termux is to run code that's been obtained from outside Play, and that kind of thing has been contrary to Play policy for a long time. It's a custom repository of sorts, much like F-Droid. That goes besides this whole W^X issue, it's more general than that.

</comment></comment><comment><USER52> Would it be possible to work around this issue by reading the executable file into a memfd and then exec() on that instead?

</comment><comment><USER53> Projects like these were doomed from the beginning. Buy a real Linux phone, like the PinePhone or the Librem 5 + a backup phone (I'm on Apple for that) for the proprietary nonsense. Simple, straight-forward and clean. It's time to stop hacking on existing non-free platforms and time to use libre hardware. You have nothing to loose but your chains!

</comment><comment><USER54> Wellp... what has two thumbs and plans to get a Pinephone? This guy.

</comment><comment><USER55> Honestly had my mouth gapped open for a few seconds. Sad news.

</comment><comment><USER56> I almost wonder if WebAssembly might be sufficient here? I suppose that'd break support for third-party binaries, but you don't need exec() to load a wasm blob /shrug

<comment><USER14> WASM w/ WASI is still in its early stages and cannot even support existing applications seamlessly, let alone a full operating environment. For now, it would be better to run a riscv64 system VM, since that architecture will both run with comparative efficiency under an interpreter or JIT, and be well- supported at a system level.

</comment></comment><comment><USER57> Could this be forked out by LineageOS?

<comment><USER23> This is one of the reasons that "open source" by itself is not enough for "user liberation" as it is usually painted.

What point there is to forking a platform where the upstream is as big as a mammoth as Google, changing millions of lines per release and actively breaking API compatibility?

Your fork will stay stuck in an API version that in a couple years will have almost no programs written for it. Who would use that?

Your only choice is to try to match the manpower from Google and try to keep your "fork" up-to-date. But that is also guaranteed to eventually fail as someday Google will change something that you literally _lack_ the manpower to revert.

Which is why I can't recommend an "open source" _Android_ phone. I don't feel promoting Android at all, even if open source, encourages my user freedom.

</comment></comment><comment><USER58> godammit i just actually found this this weekend.

</comment><comment><USER59> This seems fairly trivial to fix by writing an ELF loader.

</comment><comment><USER60> nvm

<comment><USER61> How is it evil?

</comment></comment><comment><USER62> Please refrain from using titles that are more alarmist than the original title. If linking to something with an alarmist title (not the case here!), use a more neutral headline for your submission.

<comment><USER63> I don't think it's very alarmist or an overstatement though. An android 10 app is no longer allowed to do what termux does.

I guess with more reading they are saying they need to declare themselves as targeting android 9 or lower until they find a solution. At some point, I imagine, that will not be an option.

To some degree it should also be on Google to ensure that tightening security (or perceived tightening of security) doesn't break valid use cases.

edit: Ok, for some reason I can't reply, but I see the workaround is to write to another directory.

<comment><USER64> I'm confused, because I use termux on android-10 (on a pixel2) without any problem.

I have a cron running on it that mails my notifications to me, a ssh server which my laptop use to send my backups on my phone, a go http server running a local app that I use in the mobile's browser, I'll often take screenshots on the phone, then scp them on the laptop, etc.

Am I missing something?

EDIT: I won't reply to each of you to not be floody, thanks everyone for the clarifications :)

<comment><USER65> > I have a cron running on it that mails my notifications to me.

Off-topic, but that's awesome! How do you get access to your notifications from Termux?

<comment><USER64> Termux exposes an api as binaries, putting them in `$PATH`, so you can then call them in a any script/program: [https://wiki.termux.com/wiki/Termux:API](https://wiki.termux.com/wiki/Termux:API)

It basically give access to most permissions an app can get. The cool thing is that you allow the permission for termux, and then all you scripts can use them.

But yeah indeed, the notif2mail was quite a game changer, for me :) I had a big problem of spam calls/sms at some point, and this allowed me to get my notifications through my spam filter and remove the spam. I also use it to trigger desktop notification when my phone battery is low or full.

EDIT: oh, actually, it's not termux itself, but the addon Termux:API (which is a second app, from Play Store point of view). Also, the command to list notifications is `termux-notification-list`, but it doesn't appear in this documentation page, for some reason. All api executable start with `termux-`, so it's quite easy to list them from the shell.

To start cron when booting the phone, I had also to use an other addon, Termux:Boot : [https://wiki.termux.com/wiki/Termux:Boot](https://wiki.termux.com/wiki/Termux:Boot)</comment></comment></comment></comment></comment>


On Blockchain, Intermediaries, and Hype - <AUTHOR> http://www.zkorman.com/blockchain.html <comment><USER2> I appreciate this article for its smart and cordial criticism, but as I've pointed out before, the decentralization of currency enables the separation of state from wealth, which will, for example, allow people in Venezuela or India to exit their national currency and take control back from their oppressive leaders. The world is already moving to digital cash (see India). The question is whether we want this digital cash to be completely controlled by a central bank or and oppressive leader and traceable by the government, or whether we want this digital cash to be global and decentralized, shared by people of all states.

If a person becomes a refugee, they can memorize their brain wallet and cross the border, keeping their digital gold and wealth intact. This is an example of a problem a centralized database cannot solve.

(these ideas originate from Andreas Antonopoulos)

<comment><USER3> That's all great sounding in theory, but how exactly would someone in Venezuela go about acquiring bitcoin?

<comment><USER2> localbitcoins

They trade it person-to-person. Sure, it's hard and maybe risky, but it's also risky to keep your wealth in Bolivars when inflation is double or triple-digit percentages.

"Some use bitcoins to buy Amazon gift cards, then order goods and food on the online store in the US and other countries, which can then be delivered by courier to Venezuela – where supermarket shelves are frequently empty."[1]

[1][https://www.theguardian.com/technology/2016/dec/16/venezuela...](https://www.theguardian.com/technology/2016/dec/16/venezuela- bitcoin-economy-digital-currency-bolivars)

</comment></comment></comment><comment><USER4> The word "blockchain" can be used anarthrously [1] (without an article) as this piece does, or with an article. I find that those who don't use the article are marketing types and are less technical. Those who use an article ("the Ethereum blockchain") are typically technical, and are referring to a specific blockchain. These 'arthrous' techies are less likely to be either overboard with positive or overboard with negative comments about blockchain technology. They recognize the technical flaws in particular blockchains and the tech in general.

tldr; my inclination was to disregard Korman's post as soon as I saw "Blockchain" without an article.

[1] [http://www.thefreedictionary.com/anarthrous](http://www.thefreedictionary.com/anarthrous)

</comment><comment><USER5> I think this is a tonic in contrast to the current hype, if a bit over-bitter. The larger problem that blockchain addresses, though, is, as quantdev alludes, is a way for actors outside of a firm to collaborate at scales previously only available to governments and (for some value of large) large firms.

In the parking car example, for instance, it is true that implementing a system to do that requires only RFID and servers. This means that at one time it was only plausible for Interstate System to use them, with the technology cheapening to the point that parking garage operators install them. Blockchain steps this down the next level allowing everyone using the system to also own the system.

</comment><comment><USER6> "In my view,... and it isn't going to bring about the end of intermediaries".

It already has for some or competes with others. If you pretend its not so you are probably just another (paid) troll.

</comment><comment><USER7> Blockchain technology goes far beyond "currency" replacement. Most of the new ICO's are using it for varied applications that benefit from its distributed and verifying nature.

<comment><USER8> Did you read the article? It didn't talk about currency replacement, and it's about vacuous statements like the one you just made.</comment></comment>