Equifax CIO Put '2 and 2 Together' Then Sold Stock, SEC Says - <AUTHOR> https://www.bloomberg.com/news/articles/2018-03-14/sec-says-former-equifax-executive-engaged-in-insider-trading <comment><USER2> Dupe of [https://news.ycombinator.com/item?id=16584980](https://news.ycombinator.com/item?id=16584980)

</comment><comment><USER3> "Three Equifax Inc. senior executives -- Chief Financial Officer John Gamble, and unit presidents Joseph Loughran and Rodolfo Ploder -- sold shares worth almost $1.8 million in the days after the company discovered the breach. Equifax has said those three executives had not been informed of the incident when they initiated the sales."

While I'm not sympathetic to the U.S. CIO named in this article, I find it somewhat dubious that none of the above executives knew anything. In any event, I wouldn't take Equifax's word for it. The finance dudes get a clean bill of health, and the tech guy gets thrown to the feds. Again, not that Ying deserves my sympathy either, but...

<comment><USER4> > The finance dudes get a clean bill of health, and the tech guy gets thrown > to the feds.

Maybe the finance dudes are not so retarded to sell their stock immediately after one of the biggest data leaks in history with no ahead of time sell plan, and after googling what was the impact on the stock price of another data leak.

Pretty bad op-sec for a tech guy. Or maybe he's just financially clueless, and doesn't know the the reason this doesn't happen more often (executives selling after really bad news) is exactly because the SEC it's doing a good job policing it and finance guys know that you need a SEC-proof alibi for any sell.

The reason that many stocks drop sharply 5-10% after some company news releases after being relatively flat is exactly because executives are scared shit-less of selling or leaking the info before that news is public.

<comment><USER5> Maybe the finance guy noticed the CIO putting in a huge sell option and figured "he might know something, better join in" and this caused the others to follow suit.

<comment><USER6> That would still constitute insider trading.

</comment></comment></comment></comment><comment><USER7> If you guessed that your employer may be in trouble and then sold stock, is that considered insider trading?

Let's say, you are in charge of security. The CEO is never interested in your work. One day, you got an invitation to meet with the CEO. You sold all your stock before you go to the meeting (based on a guess that something bad might have happened). Is that illegal? Is the meeting invite considered material non public information?

<comment><USER8> The SEC has rules for what constitutes legal and illegal insider trading: [https://www.sec.gov/fast- answers/answersinsiderhtm.html](https://www.sec.gov/fast- answers/answersinsiderhtm.html)

Generally though, the rules don't disallow average employees from guessing about the future stock price. It becomes illegal insider trading if somehow you had obtained material non-public information to make the decision.

</comment></comment><comment><USER9> Appalling. One would have thought that a C-level officer in a listed company would know enough about insider trading as to not do it...

<comment><USER10> The company was intentionally keeping him in the dark about the matters, and he put things together. Is that really insider trading?

<comment><USER11> Insider trading requires inside _knowledge_. Deducing it oneself is not a defense. Just like classified information, it doesn't matter how you got it, it matters what you do with it.

<comment><USER10> At what point does the deducing it yourself become allowable(if ever)? If I work at Amazon, and see Bezos in a conference room banging his hands on a desk and raging(which is not his normal behavior at all), I sell AMZN based on that, and then it turns out they had a massive data breach that tanks the stock price, is that insider trading?

</comment></comment></comment></comment><comment><USER12> > Ying was invited to a mandatory conference call. While he didn't initially > join the call, one of his direct reports did, the SEC said.

He was trying to sell his stock and didn't wait an official trail of him knowing about it. It would be hard to deny knowing about it once he joined the conference call. Did I read that right? Because that's what it sounds like to me.

> "VERY large breach opportunity"

"opportunity" what does that even mean? Were they celebrating and planning on monetizing it? That kind of makes sense I guess. Since they get to charge people to freeze their credit, their stock has recovered and executive retired happily to Bahamas or wherever. It was an opportunity after all!

<comment><USER13> Per the complaint, with my notes in brackets:

Project Sparta [breach tooling team] was kept separate from Project Sierra [breach action team] to limit the number of people who knew that Equifax itself had been breached. Those Equifax employees who were only part of Project Sparta were not told that Equifax had been breached, but were instead told that they were working for an unnamed client that had experienced a large data breach [...]

[https://www.sec.gov/litigation/complaints/2018/comp- pr2018-4...](https://www.sec.gov/litigation/complaints/2018/comp- pr2018-40.pdf)

<comment><USER10> I suppose the firewalls between Project Sparta, Sierra, and the rest of the company explain why the 'equifaxsecurity2017.com' or whatever it was called website was a completely separate thing and not part of equifax.com

<comment><USER14> No, that was public relations 101. Equifax the company and their domain can move past the beach without dragging along the baggage that's attached to that quasi-random, only ever so slightly connected domain. Mitigation playbook page 1, baby!

</comment></comment></comment></comment><comment><USER15> "Prosecutors say he searched on the internet for what might happen to Equifax stock when the news of the attack broke"

1) CIO should probably know the answer w/o searching. 2) CIO should probably know how to search w/o leaving evidence trail (incognito mode in a coffee shop on personal laptop for starters).

</comment><comment><USER16> If insider trading laws didn't exist, would we have known that something was wrong more quickly? Are high-volume trades from executives public? It seems to me that insider trading laws mean people take every step to keep bad things about a company secret, which is not good for consumers.

<comment><USER10> It's not about keeping bad things about a company secret - it is about letting the world of investors know at the same time important information.

<comment><USER17> That's not the point of insider trading laws. The point is to prevent misappropriation of insider knowledge that you acquire as a course of fulfilling your job responsibilities.

If you have material information about a company that others don't, you're more than welcome to trade based on it. The profit incentivizes accurately pricing securities. If you know that some other company is concealing massive fraud, feel free to short the daylights out of it and write an exposé.

</comment></comment></comment><comment><USER18> I wonder if this is a step on the way to going after the CEO too.

<comment><USER19> According to this article, apparently, the other executives hadn't been "informed of the breach" when they sold their stocks.

My bullshit detector is going off the charts.

<comment><USER14> No kidding. He wasn't told either, but easily figured it out. The rest of the executives should by charged with insider trading if they knew, or fired for incompetence if they were unable to figure it out.

</comment></comment></comment><comment><USER20> What would've happened if this guy just bought some puts in a regular brokerage account?

<comment><USER21> That's just more crimes added to the one he already committed. Failure to disclose, conspiracy etc.

</comment></comment><comment><USER22> Equifax is still around? :-(

</comment><comment><USER23> Not having clicked thru the link, that doesn't sound good for his insider trading case

<comment><USER24> The article is about the insider trading charges that were filed against him today, so yeah.</comment></comment>


Facebook's New Certificate Transparency Monitoring Tool - <AUTHOR> https://www.facebook.com/notes/protect-the-graph/introducing-our-certificate-transparency-monitoring-tool/1811919779048165 <comment><AUTHOR> I put in ycombinator into the actual tool, and got some very interesting results:

      Domains:
      ycombinator.com
      *.optionking.com
      optionking.com
      *.movie-blog.org
      ssl4679.cloudflare.com
      *.ycombinator.com
      movie-blog.org

      Valid From: Apr 15, 2014 - Oct 22, 2018

Is this just due to shared certs on Cloudflare?

<comment><USER2> Yes.</comment></comment>


2D programming via composed code-generating widgets - <AUTHOR> http://ilaksh.wordpress.com/2009/04/19/2d-programming-via-composed-code-generating-widgets/#comments

<comment><USER2> I like this idea.. I might even try to make something like this too, but in Flash.</comment>


Fuck the foundries - <AUTHOR> http://diveintomark.org/archives/2009/04/21/fuck-the-foundries <comment><USER2> I frequent typophile.com, which is _the_ online community of font designers, and the topic of online font distribution and "alternative licensing" surfaces every single month.

My takeaway from these conversations that the designers are (a) technically clueless (b) conservative (c) and, pardon my French, scared sh*tless of losing control over their fonts.

Latter is especially ironic, because they have no control to begin with. So the general sentiments are exactly what is described in that quoted interview - they expect someone to develop a magic bit and a DRM to enforce it and then suddenly things will get much better.

Also just to illustrate the level of conservatism - someone who decides to offer 1 font from a family of 10 for free is viewed as a revolutionary dude with the balls of steel. Everyone enthusiastically cheers for him, but noone follows.

In the end, it is really sad to see them burying their heads in the sand next to the music industry.

<comment><USER3> This is absurd. I also frequent typophile and these are not the sentiments or the characteristics I've seen.

Technically clueless? The entire disciple is technical by nature. People use and create their own tools as a matter of course, Python being the more popular language because of the RoboFab library.

No one has a problem with "losing control" of the work they created, they just want to be compensated for it like a reasonable human being.

<comment><USER4> _No one has a problem with "losing control" of the work they created, they just want to be compensated for it like a reasonable human being._

This would seem to be contradicting itself. If you accept that control will be lost, then how can you accept that you'll be able to control that people will compensate you?

And I'd venture to say that if you're unable to recognize that piracy is a social problem that does not have a technical solution, then you may qualify for being technically clueless in the context huhtenberg is talking about.

There needs to be "Final Ultimate Solution to the Spam Problem Response" document for DRM implementation attempts.

<comment><USER5> You're way outside the debate here. Commercial typeface vendors are going to get compensated one way or the other. There's no DRM on a JPG from Getty or Corbis, but you'd be made of stupid to steal a commercial stock photo for your promotional material.

<comment><USER4> Yes, and commercial vendors get compensated one way or another because they use social tools, the law, to enforce their law-provided control over their product. Typeface vendors are welcome to do that too, using the law and not putting their trust in DRM, which is breakable, to enforce their control.

However, complaining that people who make their own product freely available, for whatever reason (be it for demo, ideological, political, etc purposes), is taking away compensation from those who don't make their product freely available doesn't help the cause to get people to pay for things, or their equivalents, they can otherwise get for free. Adobe charges high prices for their tools because they can, and people will pay because it is considered there are no better tools, free or otherwise. People pay for stock photos because it's actually easier and often cheaper to do so rather than risk having to deal with being caught not paying. Trying to convince the engineers who control the format to add DRM bits, which is what the OP was responding to, is exactly the wrong way to go about maintaining control and is a losing battle.

<comment><AUTHOR> > Typeface vendors are welcome to do that too, using the law

That's almost completely impractical. How would you find out when someone steals your typeface?

Image libraries and photo agencies face a similar problem (I used to work for one.)

<comment><USER6> How are you going to hide a @fontface call in your CSS file?

<comment><USER5> It's just a filename. It can be anything.

<comment><USER7> .. but it'll still be the same file. With checksums and binary diffs, not a big problem. There's even a business opportunity there!

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> I recently gained the same sentiment for different reasons. I decided to do (what I thought was) the right thing and buy a font directly from ITC. I chose the Mac option, being that I'm on a Mac.

Much to my surprise, the download arrives compressed as a Stuffit Expander file. SERIOUSLY? Looking at the FAQ they say they Stuffit Expander is the default compression format for Macs and is distributed with every Mac browser. When was the last time they bothered to check that? I can barely remember the last time I had Stuffit installed on my Mac and I've worked closely with 6 machines since 1999 (I seem to remember having it with 10.2 around 2003, but that may be wrong).

So, yes, fuck 'em. When Mark said, "They still think they're in the business of shuffling little bits of metal around", it rang true for me.

</comment><comment><USER9> the permission table he is talking about sounds like the copy-prevention bit in PDFs. it's up to the reader software to enforce it, and since PDF is mostly an "open" specification, many free readers simply ignore it or allow the user to override it.

but how are fonts any different than stock images? a designer/photographer creates a work, then licenses it to end users that are entitled to use it. if you have a license to a stock image, you can use it on your website. i can copy it and use it on my site, but that would be illegal. how is this different than fonts? if you have a license to use a font, use it. i can copy it and use it on my site, but that would be illegal.

sites using stock images illegally are often sued or fined and there are a number of companies that offer services to find these illegally used images, even ones that have been resized or altered.

with fonts it seems like it would be even easier to automate the process of crawling websites looking for a particular font file and checking the licensing of it, especially since the font files wouldn't be altered.

<comment><USER10> It's doubly tricky with fonts because typefaces have a complicated legal status. Typeface designs cannot be copyrighted, though individual implementations (i.e. ttf files) can be. <http://en.wikipedia.org/wiki/Typeface#Legal_aspects>

<comment><USER11> Yeah, maybe if we fixed the law to make typefaces explicitly copyrightable the designers would turn their paranoia down a little.

<comment><USER12> I'm not convinced that this is something that needs "fixing."

<comment><USER11> Why? Do you believe that fonts are not creative works? Would copyrightability of fonts hurt anyone?

<comment><USER13> The question you want to be asking is if it will help anyone. The response to yours is yes, thousands of people. Google for anti-copyright for readings.

<comment><USER11> I'm familiar with the anti-copyright arguments, but my point was that it seems inconsistent to have copyright on so many types of creative works except typefaces.

<comment><USER14> So what happens when some big corporation has managed to lawyer their way to copyright over pretty much all basic font designs, and anything remotely sensible is close enough to be considered a derivative work? Now no-one can use _writing_ to communicate. There is no sane universe in which a tax on writing is in the interests of society.

Font files, as in the programs that describe the shape of a font in vector or bitmap terms, are already copyrightable, but I think the US gets this one absolutely right by specifically excluding font designs from being monopolised.

<comment><USER11> If you're so cynical that you think someone could successfully claim copyright over stuff that's hundreds of years old, I think it's pointless to argue with you.

<comment><USER14> There are musical works that have been under copyright for longer than the average human lifetime. In most places, singing "Happy Birthday" to a child in the street is an infringement of copyright. Amazon successfully patented "one click". Other people have patented inventions that contradict the laws of physics as we know them. Mike Rowe got harassed by one of the largest and most recognisable brands in the world for making a joke out of the similarity between his name and theirs.

If you're so deluded as to think that common sense always works in the area of intellectual property law, I think it's pointless to argue with you.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> This is at least partially a reaction to the Linux community's tricks to get fonts. Some people in the Linux community wrote a program to automatically download and install Microsoft's TrueType Font Collection fonts after installation. That way, Linux can use all the fonts that Microsoft spent millions of dollars designing, Linux itself isn't affected by the fonts' license, nobody in the Linux community has to spend resources to design decent fonts, and the user isn't hassled much.

All the font foundries saw that and said "we will never allow that to happen again"--especially since the intersection between their customers and Linux users is nearly the empty set. Their proposed solution is to allow embedding only if the font files on the servers are covered by the DMCA. That is why there is a trivial obsfucation of the font information in the EOT specification. If somebody distributes a program to scrape a bunch of fonts of the web and install them onto a person's computer, they can use the DMCA to take the program down (just as the movie industry did with DeCSS). It isn't 100% effective, but it _does_ help prevent casual piracy. The copy-protection bits of EOT are a lost cause in the long run. But, they will be somewhat effective in the short run. That is just like DeCSS--the first couple of years, it was difficult for an inexperienced user to find a trustworthy DeCSS program with a usable interface.

I support EOT because Microsoft already made it the de-facto standard in 1997, and Microsoft already said they won't implement TTF linking in IE. That means that if other browsers don't implement EOT, we will always have the hassle of having separate font files for IE and other browsers. That is silly. It is the other browsers' fault that they have been so lethargic to implement font linking. Now, 12 years later they finally implement it, but in an incompatible way. Then they turn around and blame Microsoft for having a 12-year-old implementation that is incompatible with their nubile mechanism. Who wins at that game? Only people who value smugness over productivity.

<comment><USER16> > This is at least partially a reaction to the Linux community's tricks to get > fonts. Some people in the Linux community wrote a program to automatically > download and install Microsoft's TrueType Font Collection fonts after > installation.

This is true, but perhaps misleading since it misses an important point.

The font downloader is legal according to the licensing terms:

[http://http://en.wikipedia.org/wiki/Core_fonts_for_the_Web#c...](http://http://en.wikipedia.org/wiki/Core_fonts_for_the_Web#cite_note-1)

Even if there were super-effective bits embedded in the font which magically enforced the licensing terms it would still have been allowed.

<comment><USER15> Correct. I'm not saying the Linux people did anything illegal or wrong since Microsoft donated those fonts to the web community.

</comment></comment></comment><comment><USER17> I hadn't heard of the Open Font Library[1] before. It looks extremely interesting, especially using dynamic font linking with @font-face[2].

[1]<http://openfontlibrary.fontly.org/>

[2][http://openfontlibrary.org/wiki/Web_font_linking_with_@font-...](http://openfontlibrary.org/wiki/Web_font_linking_with_@font- face?ccm=/wiki/Web_font_linking_with_@font-face)

<comment><USER18> Their purpose is undermined by the fact that they don't even use @font-face on their own site. The could have and should have, given that the first specified face in the stylesheet is "Nimbus Sans", a free font.

What I actually see on visiting Open Font Library is the headline "Typefaces we can all share" in Helvetica Neue, a typeface that in fact we cannot all share.

</comment></comment><comment><USER3> 1\. Typefaces take a long time to develop - design, create, package. The process can take years.

2\. Typefaces have a value. If they didn't people would be content just using Arial.

3\. People that do this work should be compensated.

4\. Trying to figure out a solution to this problem, both from a customers and creators view is more beneficial than the "fuck this, fuck that" rhetoric in the blog post.

<comment><USER19> 1\. Operating Systems take a long time to develop. The process can take years.

2\. Operating Systems have a value. If they didn't people would be content just using punch cards.

3\. People that do this work should be compensated.

4\. Trying to figure out a solution to this problem, both from a customers and creators view is more beneficial than the "fuck this, fuck that" rhetoric among linux nerds.

I apologize for the snark. My point is that there's a striking similarity here. There are some arguments that Windows is superior to Linux, and once upon a time, those arguments might've been valid. They're not any more. It's crazy these days to plunk down $300 for Vista when Ubuntu is better, and free in every way.

Quantity leads to quality—even if the average free font is much worse than the average proprietary font, a few of them will be very good, and will gain a lot of usage.

There may still be a place for proprietary fonts. But the web will embrace the more open option. If the foundries want a piece of that action, they're going to have to change the way they do things.

<comment><USER5> In the contest between Windows and Ubuntu, _almost everybody_ chooses Windows (a small minority chooses Windows non-free competitor OS X). This fact is inconvenient to your argument.

<comment><USER20> Is the worldwide deployment of Vista comparable to the aggregate of the top 10 desktop Linux distributions?

I don't know those numbers, but I think that's the important question (rather than just Windows vs. Ubuntu).

<comment><USER14> I would imagine that the total worldwide number of desktop Linux installations is statistically insignificant. Vista has never really taken hold, and XP is still the dominant OS by some way, but I've never seen a study that put desktop Linux even on the same order of magnitude as OS X.

<comment><USER21> If you look at the links posted above, the w3schools.com numbers, 4% and 6%, are not even a _binary_ order of magnitude apart, never mind the usually meant decimal (10x spread).

The w3counter.com numbers are 2% and 5%. Both single digits (hint).

There are whole companies out there doing engineering work on Linux, except for a few odd laptops. Actually, site http proxies may cause Unix web undercount (i.e. stats are dominated by home access, presumably with lower Unix use).

<comment><USER14> Do you seriously believe that the visitors to a site like w3schools.com are even close to representative of the population as a whole?

There are indeed whole companies out there doing engineering work on Linux; I've worked with some of them. But they are a tiny fraction of all companies, and the desktops in most companies run Windows. Of those that don't, I'm sure Linux has had a few big successes, but Apple sells all those computers to someone. As I said, I've never seen a study that puts Linux even close. If you've got more up-to-date information that is actually representative, go ahead and share it, but please don't pretend that the server log from a random web site is a real study.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Maybe someone should take a tip from the scientists and game developers behind Fold It!, the protein folding "game," and create a simple Flash web game that lets players hint and kern open fonts a letter at a time.

<comment><USER22> <http://vimeo.com/3177481>

something similar to this iphone app, perchance?

<comment><USER6> Ah, I forgot about that. Cute, but we of course need a slightly less gamey, more contemplative play experience for this problem.

</comment></comment></comment><comment><USER5> Open source fonts won't be crappy for long once they're easily usable by everyone's browser.

<comment><USER15> That's basically the same as the "this is the year of Linux on the desktop" argument. I won't hold my breath. Open source end-user products always seem to improve at a snails pace.

<comment><USER23> The difference is that it takes one good typographer to create a font. It takes a whole high school to keep Gnome screwed up.

<comment><USER24> Whereas it only takes a single class of scandanavian middle-schoolers to keep KDE thoroughly mediocre!

<comment><USER25> Is this the level of discourse to which Hacker News has now sunk? I expected better.

</comment></comment></comment></comment></comment><comment><USER26> Mark

====

wow. What an overreaction from Mark Pilgrim[1]. While sound & fury may grab eyeballs, he is ignoring solutions already in front of his face[2].

 _The Solution_

</comment><comment></comment><comment>==

I worked with fonts and licensing all the time in a previous job, generating automated artwork. The big thing missing in Open Source [his 'usable'] fonts is kerning and hinting.

There is nothing stopping someone setting up a Kern-or-Not? website where web people vote on which kerning values look best, and incorporating that data set into an OSS font foundry[3].

I already did some of this myself to kern HTML using spans with negative margins. To get excellent results you only need a few key characters [in English]. I used Web fonts, but made up the kerning offsets by trial and error. There is nothing stopping other people doing the same [see 2].

'T', 'W' are the big offenders. You can get excellent results concentrating on these and all the vowels.

T e , T o , T y , T i , T e, W * etc. This is not exhaustive.

\</comment><comment></comment><comment></comment><comment></comment><comment>-

[1] I came across his emails all the time when I was working on the OSS Greasemonkey in the early days of its development. He threatened the lead dev with 'forking the project and working on it until the day I die' if the project did not take a direction he wanted. I believe it was another of one of the fequent LGPL/GPL arguments that whirlwind in many OSS projects. The mailing list greasemonkey-[user|dev] doesn't seem to include such old emails [c 2005], so no link, sorry.

[2] Mark seems to prefer that other people fix the problems under his guidance.

[3] May I suggest Public Domain for the dataset to avoid horrendous license choice debates?

<comment><USER27> He said he'd fork greasemonkey & maintain it if the official greasemonkey started informing websites of its presence(which would presumably allow them to target different content at greasemonkey users, or try to circumvent it, etc.). I hardly think that's an unreasonable position.

<comment><USER26> I haven't been around other projects when someone threatened to fork it 'until the day I die', so I don't know how the tone comes across then.

The context was general discussion of architectural / license issues. It seemed at the time like Mark went for the Nuclear [fork] option very, very early on in the discussion. I can only imagine what it felt like for the lead devs, but it cannot have been good. Unreasonable - borderline; rude, counterproductive - yes.

This is all from my memory in 2005, without list logs to refresh.

</comment></comment></comment><comment><USER28> the cursive font on diveintomark is virtually unreadable to me without magnifying it a whole bunch. :(

edit: not cursive. narrow letter spacing. bold, too? gah my eyes.

<comment><USER5> That's Gill Sans, one of the all-time greatest italic sans faces. See? He's right. The foundries are doomed. =)

<comment><USER15> It might be great in print but it is horrible on-screen. Generally italic faces should be avoided on the web whenever possible. Failing that, it is much better to use one that was designed specifically for on-screen use, like one of the Microsoft C* fonts.

</comment></comment></comment><comment><USER29> Personally, I think it'd be awesome to have something like Yahoo Pipes, but for MetaFont.

</comment><comment><USER30> I had no idea such an industry existed. I thought fonts were either handed down by God, or invented by Martha Stewart in her spare time.

Does anyone really give a crap about this?

</comment><comment><USER31> Professional Fonts for 99cts coming soon!

Only at the AppStore

<comment><USER14> I realise that was meant to be a joke, but that's exactly the sort of dramatic shift in sales and marketing tactics that might keep the major foundries relevant.

Look at how many people have their own blog, or MySpace page, or otherwise have created a little world of their own design on the Web.

Look at how successful iTunes and the like have been in selling music conveniently, reliably, and at a price that doesn't make someone who wants that music think twice and look for a free but illegal copy elsewhere.

I don't think selling fonts very cheaply via these sorts of channels and/or partnering deals with the major social networking/blog services is such a crazy idea. Different, yes. Unknown, sure. But not crazy.</comment></comment>


Arduino TRE - <AUTHOR> http://arduino.cc/en/Main/ArduinoBoardTre <comment><USER3> I'm not sure if arduino is a good platform to spend time on, see[1].

One the other hand, the mbed:

"With all the investments ARM is putting into the mbed and the mbed-os(and it's huge amount of internet of things features) ,with features like automatic selection of sleep modes via easy to use sleep api's[1] , the better though out API(things like FastPWM, FastIO, SIMPLEDMA and others) , the community being more professional so it probably means better code, and the better license enabling easy use in production , and the large amount of ARM microcontrollers availble for it, isn't this the better time investment for the future ?" [2].

[1][http://forum.arduino.cc/index.php?topic=253582.0](http://forum.arduino.cc/index.php?topic=253582.0)

[2][http://www.eetimes.com/messages.asp?piddl_msgthreadid=47423&...](http://www.eetimes.com/messages.asp?piddl_msgthreadid=47423&piddl_msgpage=1#msgs)

<comment><USER4> I've got one of the NXP mbed boards, and it's an interesting piece of hardware, however, the current mbed toolchain is kind of ridiculous. In order to use the more interesting features, you're pretty much required to use their web-based IDE, and forego a lot of the nice features of, say, eclipse. Also, I have issues with certain decisions they've made, like having floating point only libraries for PWM, which means you have to waste a lot of clocks, and code, just to make the lights work.

Then again, with AVRs, I'm using Atmel Studio a lot these days for similar reasons instead of the Arduino environment. The abstraction layers don't quite mesh with what I'm trying, which means writing I'm writing around the Arduino a lot more than I'm writing for the Arduino. Perhaps it's just time for getting back to basics with the lower level libraries.

<comment><USER3> With regards to PWM issues you've mentioned , have you looked at alternative libraries ? a rough search brough me this[1](and there might be others), an it claims to solve most of the floating point problem.

>> In order to use the more interesting features, you're pretty much required to use their web-based IDE,

What features are those ?

[1][http://developer.mbed.org/users/jocis/code/HighPWM/docs/923b...](http://developer.mbed.org/users/jocis/code/HighPWM/docs/923b54e7c2c1/classHighPWM.html)

<comment><USER4> I looked a bit at some of the alternative libraries, but was frustrated with the environment due to the slowdowns in trying to use it during peak hours. Perhaps with more digging I could find one that works well, but it would mean having to create a project, import the library in, and then exporting the bundle into Eclipse for processing.

The biggest interesting feature is how third party libraries are easily integrated into software you're writing. It's trivial to publish and retrieve the libraries other people have written, which is something I'd really enjoy being able to use.

</comment></comment></comment></comment><comment><USER5> The AM355x already has 2 x 32bit Programmable Realtime Units (PRU) [1] so the AVR seems a bit redundant (other than compatibility with existing shields and ease of programming)

[1] [http://elinux.org/BeagleBone_PRU_Notes](http://elinux.org/BeagleBone_PRU_Notes)

<comment><USER6> Compatiblity with existing libraries and example code for other Arduinos is the key here. I find it surprising too, but there are people who do not really want to know all the low-level details but get the result quickly :)

</comment></comment><comment><USER7> Discussion of the ESP286 here on Hacker news seems limited. Looks like a great alternative for low-cost use. It's a $5 microcontroller board with WIFI which now can be programmed with the Arduino development environment:

[http://makezine.com/2015/04/01/esp8266-5-microcontroller- wi-...](http://makezine.com/2015/04/01/esp8266-5-microcontroller-wi-fi-now- arduino-compatible/)

</comment><comment><USER8> "Arduino TRE, the first Arduino board manufactured in the U.S." As italian I feel a little bit sad about Arduino today being american hardware fully assembled in America. I wonder if they still print Italy and the italian flag on the PCB...

<comment><USER9> [https://makezine.com/2015/03/19/massimo-banzi-fighting- for-a...](https://makezine.com/2015/03/19/massimo-banzi-fighting-for-arduino/)

tl;dr "if people bought an Arduino board made in Italy in the last year thinking they were supporting the project they should know that we didn't receive any money for it despite the fact that we designed, documented, maintained and supported those products" – Massimo Banzi

</comment></comment><comment><USER10> Please correct me, but doesn't the GPU of Texas Instrument's Sitara AM3359AZCZ100 require a closed firmware blob - in other words the Arduino TRE will be a partly closed hardware (not in Arduino's open hardware spirit)?

<comment><USER11> The rule of thumb is if the GPU is not from Intel, then it requires a binary blob.

<comment><USER10> Is it at least possible to write an own OS (by using the firmware blob) or is the blob married to (GNU/)Linux?

<comment><USER11> It looks like it has a PowerVR GPU, which would make it the later. If you want a board where you can write your own OS and still make use of the GPU, the Raspberry Pi is your best bet.

<comment><USER12> Note that I think this is only an issue if you want 3D acceleration - <USER2> believe that unlike on the Pi, modesetting is open source and possibly even documented, so you should be able to turn on the display output and set up a framebuffer you can write to without touching any of the proprietary bits.

<comment><USER11> The Pi works differently from other computers I've seen, in that the GPU is responsible for booting the system, and so it always needs the binary blob to start. Think of it as the equivalent of the BIOS on a PC, except it runs on the GPU instead of the CPU, and it's stored on an SD card instead of ROM. But as far as your own OS is concerned, how you communicate with it if fully documented. So you can do modesetting, and you can do hardware acceleration and whatnot. I believe the only thing you can't do on non-linux OSes is video decoding, but I'm not exactly sure.

<comment><USER13> > The Pi works differently from other computers I've seen, in that the GPU is > responsible for booting the system, and soit always needs the binary blob to > start.

This is common in the ARM world, where there isn't a standard like the "PC standard" on x86 world. Many ARM SoC's have a "bootstrap" core, which is a low power ARM core. All ARM computers boot differently.

</comment></comment></comment></comment></comment></comment></comment><comment><USER14> There are so many Arduinos. It was daunting for me when I was starting out. Following guides helped me to get started:

\- [https://learn.sparkfun.com/tutorials/arduino-comparison- guid...](https://learn.sparkfun.com/tutorials/arduino-comparison-guide)

\- [https://www.sparkfun.com/arduino_guide](https://www.sparkfun.com/arduino_guide)

Do you know any more noob friendly comparison sites/articles?

<comment><USER15> I'm afraid I don't. I think it ultimately comes down to what you want to do with it.

Personally, I'd recommend the Uno: it is a great basic Arduino platform which can handle most projects which utilize a micro controller. Once you've prototyped your project with the Uno and identified if you need more IO pins, or more speed, or a smaller unit, then you can look into replacing the Uno with one of the more specialized versions, and use the Uno to prototype your next project.

</comment></comment><comment><USER16> There's already the Arduino DUE, which has the Arduino form factor and pinout, with a very lightly configured ARM processor. It's supported by the Arduino toolchain, and you get more memory and a CPU with floating point hardware. It's far too small a machine to run Linux, but it's the next step up when an ARM CPU is just too wimpy.

How do the two CPUs of the TRE talk to each other? Shared memory? I2C? USB?

<comment><USER17> Probably UART, the same way the FTDI chip in new UNOs talks to the AVR. In any case, the reason having an ARM cpu w/ an AVR is beneficial is because you get the linux environment but real-time hardware GPIO access. This is far better than the software scheduling that bogs down RPis and makes it very difficult to do timing intensive tasks.

<comment><USER12> Except that the SoC they're using already has two PRU coprocessors designed for realtime IO support, and they have the advantage of being able to DMA to and from main memory rather than being limited to a slow serial link to the main CPU.

<comment><USER18> Arduino's appeal is that doing simple tasks is simple. The PRU is not easy. TI introduced a C compiler for the PRU last year, but until then it has been an assembly only affair. (I haven't tried the compiler, I just discovered it while fact checking the first draft of this comment.)

</comment></comment></comment></comment><comment><USER19> So... Essentially an UDOO, but less powerful and (or so it seems from the picture) a different pin layout, making it incompatible with existing shields..?

<comment><USER20> Agree. It's time to leave AVR uC's behind. There are many ARM chips on the market which are both faster and cheaper than AVR.

<comment><USER21> Fast and cheap are not the only criteria. What ARM chips have the same peripherals as an AVR?

<comment><USER22> About a billion Cortex-M based MCUs from Atmel, ST, TI, NXP, etc. They typically have: GPIO with PWM, UART, SPI, I2C, I2S, Ethernet, USB (host, device, OTG), CAN, RS-423, SDIO...

What peripherals do you think might be missing?

<comment><USER21> Look at it from a different perspective. I agree that an argument centered on peripheral availability is no longer as applicable as it was just a couple of years ago.

\- No chip that needs an OS can truly replace an AVR.

\- No chip that takes more than two seconds to boot up can truly replace an AVR.

\- No chip with a 2,000-page data sheet can truly replace an AVR.

\- No chip that requires binary blobs to do anything interesting can truly replace an AVR.

\- No chip that's available only in a BGA or other leadless package can truly replace an AVR.

\- No chip that requires a 1-gigabyte toolchain installation (or, Woz forbid, a "cloud"-based toolchain) can truly replace an AVR.

In general, no chip that wasn't _explicitly_ designed to be easy to use by nonexperts can truly replace an AVR. Even lack of 5-volt compatibility has proven a handicap for some suitable candidates like the Cortex-M3 part used in the Arduino Due.

Nobody in the hobbyist market cares if the chip costs $0.50 or $5.00. Their time is worth more than that. An 8-bit AVR can run 32-bit C code all day long without requiring the user to become a Linux sysadmin or wade through a bewildering selection of thousands of RTOSes, none of which are perfect for any one job. That is a _huge_ deal.

<comment><USER22> You asked what ARM could replace an AVR. I said there were lots of ARM Cortex-M based microcontrollers that could. Your response makes no sense.

> No chip that needs an OS can truly replace an AVR

They don't need an OS.

> No chip that takes more than two seconds to boot up can truly replace an AVR

No boot up time. They start running your code right away.

> No chip with a 2,000-page data sheet can truly replace an AVR.

Maybe more like a few hundred. Just like an AVR datasheet.

> No chip that requires binary blobs to do anything interesting can truly > replace an AVR.

They don't. They don't even have GPUs.

> No chip that's available only in a BGA or other leadless package can truly > replace an AVR.

There available in hand-solderable TQFP packages. There are even a couple of DIP ones (8-pin and 28-pin).

> No chip that requires a 1-gigabyte toolchain installation

I'm pretty sure GCC isn't anywhere near a gigabyte, but it's also the same toolchain used with AVRs.

> (or, Woz forbid, a "cloud"-based toolchain) can truly replace an AVR.

While they exist, they're not in the slightest bit necessary.

> no chip that wasn't explicitly designed to be easy to use by nonexperts in a > hardware project can truly replace an AVR.

AVRs were also not designed for non-experts. Try reading a datasheet sometime and try to tell me that's written for non-experts.

> Even lack of 5-volt compatibility has proven a handicap

Lack of 5-volt "compatibility" is an interesting spin on what is essentially a legacy. One could just as easily argue "lack of 3.3V compatibility".

Sounds like you need to educate yourself a bit. There's more to microcontrollers than Arduino.

<comment><USER21> _Sounds like you need to educate yourself a bit. There 's more to microcontrollers than Arduino._

I was using AVRs long before the Arduino platform popularized them (does that make me an MCU hipster?) Even ten years ago there were far better chips. Somehow AVR not only outcompeted those chips, but came to utterly dominate its market niche. Why do you suppose that is?

Your position is reminiscent of those who expressed incredulity at the success of iOS when it didn't do anything that wasn't already being done at the time it was introduced. There's something you Just Don't Get. If I were you, I'd wonder what that might be.

<comment><USER22> > Why do you suppose that is?

Marketing and the Arduino IDE.

<comment><USER21> (I edited my comment to point out that the AVR chips predate the Arduino platform by several years, and that there were technically superior parts on the market even then.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> Cool! Has anyone heard of the price yet?

</comment><comment><USER24> so a BeagleBone Black with adruino on its head goes to the doctors office. Doctor asks 'what seems to be the problem?'. Arduino replies "I've got something stuck to my ass!".

but now at 1.5 times the price of individual components! BB is $55, minis are $3. This thing will be what, ~$70? Arduino abomination glued to the AR9331 is ~$80 (Yun), while bare atheros chips are $5 in china, whole routers ~$15. I dont see the point of this new one either. Even if they somehow got the best deal ever out of TI it will not be economical compared to BBB.

</comment><comment><USER25> What is the advantage of this over a Raspberry Pi?

<comment><USER26> There are several advantages:

\- both 5V and 3.3V logic, meaning you can use pretty much any part without level shifters

\- analog inputs (which are really lacking on Raspberry Pi if you want to use sensors)

\- 4 USB host ports (only the Pi 2 has as much)

\- the simplicity of Arduino for electronics, coupled with a Linux for other tasks

On the other hand, I expect it to be more expensive, and probably less powerfull than a Raspberry Pi. It is definitely aimed to big electronics project that requires both a lot of GPIO and a full-fledged OS, for which you would formerly use a board running Linux + an Arduino

<comment><USER27> also: 7 hardware PWM outputs (the Pi has one)

<comment><USER28> You can sort-of do analog input-output via the audio ports on the pi, right?

<comment><USER13> PWM is useful because that can be used to drive servo motors and brushless DC motor controllers and other gadgets. It can't be easily replaced with analog output, e.g. from audio ports. OTOH, audio ports are a lot more useful if you need actual analog output.

<comment><USER4> PWM could be done with an op amp, a triangle wave generator, and a handful of discrete components. It's how the front-end of a Class D amp works. Would definitely be more of a pain in the butt than having pwm ports directly, though.

</comment></comment></comment></comment></comment></comment><comment><USER29> Wasn't this board announced a while back?

<comment><USER30> Yes, ages ago.

</comment></comment><comment><USER31> Huh, there's an errant "Clock Speed: 16 MHz" there.

<comment><USER32> It isn't errant, there are just two processors handling different tasks.

This is basically a BeagleBone Black with an integrated Arduino (for low-level compatibility with the Arduino shield ecosystem) that the more full-featured (but less real-time friendly) Linux-running part of the board can drive.

The Atmel ATmega32u4 (the Arduino bit) is 16MHz, the more full-featured Linux/ARM part runs on a 1GHz Sitara AM3359AZCZ100 (ARM Cortex-A8) just like the BeagleBone Black.</comment></comment>


Syllabus – Digital History, graduate level - <AUTHOR> http://sciencespiesandhistory.blogspot.com/2015/12/syllabus-digital-history-graduate-level.html <comment><USER2> I'll throw my hat in the ring here and mention a project I did in 2014, redesigning a history documentary about civil rights in the 50s and 60s in the US called Eyes on the Prize: [http://glench.com/EyesOnThePrize/](http://glench.com/EyesOnThePrize/)

<comment><USER3> It looks interesting! I loved the TV series--but was sad about all of the copyright issues it faced.

</comment></comment><comment><USER4> Thanks for posting this. Very useful overview and much of the reading was new to me.

Anyone interested in this syllabus might also want to check out Palladio, a Stanford digital history tool which grew out of the "Mapping the Republic of Letters" project mentioned in the syllabus. The basic idea is to allow researchers to easily turn their spreadsheets of historical/archival data into visualizations:

[http://palladio.designhumanities.org](http://palladio.designhumanities.org)

They're still working out the kinks but I think it's a very promising idea. I do wish it was less focused on mapping networks of individuals as opposed to other types of historical data, though.</comment>


Harvard and M.I.T. Scientists Win Gene-Editing Patent Fight - <AUTHOR> https://www.nytimes.com/2017/02/15/science/broad-institute-harvard-mit-gene-editing-patent.html <comment><USER2> UC Berkeley's Doudna should be livid.

She worked on this technology for years, developing it from it's infancy to in vitro proof. MIT scientists swooped in and within 2 months applied it in-vivo and patented it.

I guess to be rewarded in science you have to be a master in your field and intensely concerned with IP deadlines.

It's really a shame that Berkeley loses licensing on a tech that was 95% developed at Berkeley.

<comment><USER3> I'm one of those who wonder if these things should be patented. That being said:

"Swoop in and patented it" is not exactly how it goes. There is a long back story to this with a lot of people discoing stuff to make this possible.[1]

CRISPR-CAS9 will probably be supplanted by something else. They're already working on it (hopefully with fewer off target effects). [http://www.nature.com/news/alternative-crispr-system- could-i...](http://www.nature.com/news/alternative-crispr-system-could- improve-genome-editing-1.18432)

You can watch a video by Zheng (the patent holder) on how CRISPR works if you are curious[2]

I doubt she's livid, they won a lot of research prize money from their research [2] and she's probably collect money from patents from the company she started with the patent holder "Editas Medicine. Co-founded by the Broad's Zhang (and also by Doudna, in more collegial days)"[2]

as with most patent disputes the lawyers are the real winners: "The Broad's legal costs, paid by Editas, topped $15 million last summer. UC's, paid by Caribou, have passed $5 million. Neither party has said what they have spent since then."[2]

[1][http://www.cell.com/cell/fulltext/S0092-8674(15)01705-5](http://www.cell.com/cell/fulltext/S0092-8674\(15\)01705-5)

[2][https://www.statnews.com/2017/02/15/crispr-patent- ruling/](https://www.statnews.com/2017/02/15/crispr-patent-ruling/)

<comment><USER2> I would definitely take that cell review with a grain of salt seeing as it was written by MIT/Broad institute.

<comment><USER3> Why? It has a lot of interesting history of the discovery of CRISPR which is really interesting..

<comment><USER4> The article, written by Eric Lander of the Broad Institute, was widely criticized[1][2][...] at its publication for being a veiled attempt to reframe history to support the Broad Institute's patent claims. Note a number of their framing decisions - choosing to group Doudna et. al.'s contributions as #4 in a long list and setting Zheng's contribution by itself in a different color. Seems innocuous when skimming over it, but the choice of what to emphasize and categorize is not objectively deterministic, and this particular framing and coloring was no doubt chosen deliberately. Many think there was purposeful deception behind that deliberate choice.

[1] [http://genotopia.scienceblog.com/573/a-whig-history-of- crisp...](http://genotopia.scienceblog.com/573/a-whig-history-of-crispr/)

[2] [http://www.michaeleisen.org/blog/?p=1825](http://www.michaeleisen.org/blog/?p=1825)

<comment><USER3> interesting.

I don't really have a horse in this race, but I am new to working in the Biology field. I will say that biology seems to depend on the work of many people and is kind of incremental. Its weird that some are getting rich and lots of credit, while a lot of the researchers work in obscurity. That was my take away from the Cell article.

Your first article was a good critique of the Cell article.

The second one was a little hard to take seriously first[1] (plus written by someone from the other side of the dispute), though he does come around to my original point in my original post: "And, as I have long argued, I believe that neither Berkeley nor MIT should have patents on CRISPR, since it is a disservice to science and the public for academic scientists to ever claim intellectual property in their work."

[1]"Lander's recent essay in Cell entitled "The Heroes of CRISPR" is his masterwork, at once so evil and yet so brilliant that I find it hard not to stand in awe even as I picture him cackling loudly in his Kendall Square lair, giant laser weapon behind him poised to destroy Berkeley if we don't hand over our patents."

<comment><USER5> "The work of many people" is literally the title of a paper by Edward Teller that in some opinions had the same kind of aim as we're talking about here for the Lander paper -- minimizing Ulam's contribution to the Ulam-Teller mechanism behind the H-bomb. (I can't tell if that's fair, not least because only the first page is accessible: [http://science.sciencemag.org/content/121/3139/267](http://science.sciencemag.org/content/121/3139/267) Background: [https://en.wikipedia.org/wiki/History_of_the_Teller%E2%80%93...](https://en.wikipedia.org/wiki/History_of_the_Teller%E2%80%93Ulam_design#Ulam.27s_and_Teller.27s_contributions))

I was reminded of it when Lander's article came out, not just now.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Sigh, it's the PCR patent story all over again [1]. As always, government and charity funded researchers are spending government and charity funds on fighting each other for the right to make a fortune from the fruits of government and charity funded research. 20 years later the patents expire, and all that's happened is you've slowed down medical progress. What a great legacy for Eric Lander and the Broad. Punks.

[1] [http://www.economist.com/node/3839765](http://www.economist.com/node/3839765)

<comment><USER7> Does it really slow down medical progress?

One argument is that getting a patent ensures exclusivity to use the technology. In turn, that drastically improves the likelihood of getting a return on any investment dollars. And finally, that attracts a lot more capital than a non-profit or gov't funded agency could typically get.

<comment><USER6> see the link in my comment.

Like PCR, CRISPR is a relatively simple technology. It doesn't require billions of dollars of R&D to make it useful. Less useful gene editing tech (Zinc fingers, TALENS) have already been used in clinical trials. So just like PCR or that blood Myriad Genetics gene patent on BRCA1, patents hinder progress, make research more expensive, and impair new companies from getting started.

</comment></comment></comment><comment><USER8> Apparently the following (humble and honest) statement made by Doudna to a UC system magazine[1] hurt their case[2]:

>Says Doudna, "Our 2012 paper was a big success, but there was a problem. We weren't sure if CRISPR/Cas9 would work in eukaryotes-plant and animal cells." Unlike bacteria, plant and animal cells have a cell nucleus, and inside, DNA is stored in a tightly wound form, bound in a structure called chromatin.

[1] [https://berkeley.app.box.com/v/catalyst-9-1](https://berkeley.app.box.com/v/catalyst-9-1) [2] [https://twitter.com/antonioregalado/status/83200343447163289...](https://twitter.com/antonioregalado/status/832003434471632897)

</comment><comment><USER9> Maybe universities shouldn't be businesses, and what might be a prevailing way to edit genes for quite some time shouldn't be controlled. Perhaps this should be in the commonwealth. I've been to university talks where the presenters declined to answer certain questions because they'd violate the business interests of the school. In other words, the other researchers could not learn about the presenter's discovery and innovation. I think universities should be about advancing and sharing knowledge.

<comment><USER10> Is "sharing" equivalent to "giving for free the hard work to the private industry"?

Most of the time the system works as intended. The researchers do their research on public money, most of what they do becomes public knowledge through papers, if something noteworthy is found, it's patented and licensed and the university gets its cut. The system kind of fails sometimes at giving the researchers (in plural, not just the tenured rockstar) its due, but many times are the scientists the ones that open an enterprise to work it out.

In this case, it's not that system that has failed, it's that different universities are fighting over who has the right to license it. I have no horse in this race, but this it's probably going to become even more common, as improvements on existing technology become smaller and it's harder to tell who deserves the full credit.

<comment><USER11> This is 100% paid work, nobody is working for 'free'.

MIT is well known for the second form of patient troll where you look for years of very promising research done by someone else, make minimal change using government funds, and then get to lock things up for 20 years.

Worse there is now a huge incentive to find some other trivial change to get around this patent thus costing the field 100's of times more than their initial 'effort'.

</comment></comment></comment><comment><USER12> The patent system remains absurd.

I have mixed feeling about biotechnology, though. On one hand I'm a big fan of human genetic engineering for increased IQ which is looking extremely possible in the near future (hopefully something that will be available here in Singapore before I have kids), on the other hand as these techniques get cheaper and easier to use we may get to the point where any madman with an IQ over 145 could kill hundreds of millions. Nick Bostrom asks this question in his book: if building a nuclear bomb turned out to be trivial, like putting sand in a microwave, would human civilization have survived? We will find out if synthetic biology keeps advancing. Or maybe this is my nightmare and the patent system will slow down progress enough to save humanity.

<comment><USER13> > slow down progress enough to save humanity

The future is the same no matter how long it takes. Advancing slowly doesn't prevent the results of advancement. It just increases the likelihood that something else is advancing faster than you. We should rather humanity destroy itself than lose a fight to a more advanced civilization.

<comment><USER12> It may give our institutions time to figure our how to cope.

</comment></comment></comment><comment><USER14> The article doesn't mention Eric Lander's controversial article a few months back, but this outcome certainly seems like what he might have been working toward. Is it considered to have given any weight to their case?

*Edit: I guess time is flying, that was more than a year ago. Previous discussions: [https://news.ycombinator.com/item?id=10934149](https://news.ycombinator.com/item?id=10934149) [https://news.ycombinator.com/item?id=10917391](https://news.ycombinator.com/item?id=10917391)

<comment><USER15> It wasn't a letter. It was an article in Cell.

<comment><USER14> You are absolutely right. But, since I called it an article, and linked to the article in Cell (via HN), I'm a bit lost as to what you're trying to tell me. Sorry, is the premise of my question weird or something?

I don't know the whole backstory of Crispr or all the people involved, I just know it sounded amazing when I first heard about it on Radiolab, and then it got mired in this fight over credit and rights. I'm wondering if Lander's piece was influential in this first victory, and whether this outcome was part of his intent in writing it.

</comment></comment></comment><comment><USER16> You take public money to do research, any fruits from that money belong to the public. You don't get to start companies and patent the end result and get rich off of our money. If you purely take private money you work in some startup you can do stuff like this. Even then I would argue that understanding or discovering some biological entity should not be patentable.

<comment><USER17> _> You take public money to do research, any fruits from that money belong to the public_

TBF we did try this in the US, and this is exactly how things worked for decades. That rule was eventually shot down for a whole host of reasons.

 _> If you purely take private money you work in some startup you can do stuff like this_

How about this scenario:

Person A invents something using public money.

Person B creates a start-up using Person A's invention.

Person C needs said invention, and can only get it from Person B, who charges them for it.

In other words, if the fruits of the labor are going to be extracted by _someone_ , shouldn't that someone be the person who made the actual discovery (assuming they're willing to do the business side as well)?

</comment></comment><comment><USER18> Interesting, especially because I think most people in the field expect the Nobel prize to contrast this decision and go to Doudna+ and not Zhang

<comment><USER19> Money's on Doudna, Charpentier and Zhang as the 3.

</comment></comment><comment><USER20> Unfortunate. Clearly everyone involved had a part to play in the discovery but I guess there is no such thing as a joint patent.

<comment><USER21> In fact, the patent system comes close. If what you contributed was inventive and new, you get a patent on that slice of what you invented. For someone to commercialize the whole thing, they may need to pay both parties (essentially both parties who had a part to play in the "discovery" will be paid for their work). In many cases like this, the parties have to cross-license each other (pay each other or license each other for their respective patents).

That is actually what the article says.

"An appeals board of the patent office ruled that the gene-editing inventions claimed by the two institutions were separate and do not overlap."

"Ultimately, companies wanting to apply Crispr for use in medicine, agriculture or other fields might need licenses from both the Broad Institute and the University of California, a lawyer for the university said. ..."

<comment><USER22> The usual result is that no creative applications of the new technology are legal until both patents run out in 20 years.

Or that a foreign nation that didn't accept the patents becomes the only center of innovation and the nation that paid for it becomes a backwater.

One or both of those happened with steam engines, sewing machines, and aeroplanes. Humanity was not better off.

It was narrowly averted in photography, automobiles, and computer software by governments invalidating the pioneer patents in the field for the benefit of mankind.

<comment><USER23> I hear ya, especially on aeroplanes (it turns out the Wright brothers were kinda jerks). It's such a shame that, due to the current nature of political discourse, it seems that the only two plausible options are (a) artificial and stifling patent monopolies or (b) expropriation by the state.

There seems to be a very sensible, but verboten, middle ground here: government funding of socially beneficial research and, if a significant public benefit can be demonstrated, compulsory state acquisition under the condition that just compensation is given.

</comment></comment></comment></comment><comment><USER24> The traditional explanation for the economic usefulness of patents is that it incentivizes public disclosure of discoveries, and prevents trade secrets from dominating the innovation economy. (Imagine if the cure to cancer was kept as secret as the recipe for Coca Cola!)

The odd part of this case is that it might cause researchers to hold back from publishing their discoveries until they're sure their own institution can 'squeeze out all the juice' and best monetize the novel finding.

On the other hand, perhaps it incentivizes more classical research institutions to employ top teams of researchers who can prototype the 'medicine' part of a biomedicine discovery as quickly as possible. In truth, there are a lot of amazing discoveries at the ground level of molecular biology, which _plausibly could_ revolutionize human health, but are still waiting decades later to be shown to be practical.

</comment><comment><USER25> I believe the government should apply eminent domain to key technologies that promise wide-scale advancement for society. Technologies like CRISPR are far too powerful and have far too much potential to be confined to control by a single entity.

</comment><comment><USER26> I would imagine that this would go on to appeal and be in the courts for years if it decades. Especially once the parents actually produce royalties. No?

</comment><comment><USER27> This has nothing to do with Harvard nor MIT. it is now a company of its own right, but the name still persists

</comment><comment><USER28> Rode $EDIT from $30/share to $15/share, here we go (designer) baby

<comment><USER29> what??</comment></comment>


Spsc - A Small Positive Supercompiler in Scala, Haskell, Python & Ruby - <AUTHOR> http://code.google.com/p/spsc/ <comment><USER2> Can someone explain the use case for this?

<comment><USER3> The "simplifications" in the program that can be achieved by a supercompiler

Redundant code elimination. Performing operations on data that are known at the time of supercompilation. Removing intermediate data structures. Transforming multi-pass algorithms to one-pass algorithms.

[http://sites.google.com/site/keldyshscp/Home/supercompilerco...](http://sites.google.com/site/keldyshscp/Home/supercompilerconcept)

<comment><USER2> So basically, complicated optimizations that will often be opaque to a human (not trying to be adversarial, just understand it)?

<comment><USER4> Quite the opposite, if I understand the concept. It's more trying to apply the kinds of optimizations that a human would make when reasoning about how a program actually runs. When we read code, we often think "Oh, I get it - it's just trying to do _X_." A good supercompiler would just emit the code to do _X_.

I can see this coming up when you, say, make library calls in certain ways that don't need the full functionality of the algorithms. Maybe one paramater is fixed, or the sequence of the calls is really to achieve something else.

The original paper is freely available off of citeseer, "The Concept of a Supercompiler": [http://citeseer.ist.psu.edu/viewdoc/download;jsessionid=B373...](http://citeseer.ist.psu.edu/viewdoc/download;jsessionid=B3735067C269499893CDA1F61B98F942?doi=10.1.1.128.6414&rep=rep1&type=pdf)

I'm currently reading through it. I find it useful to forget the term "supercompiler," since that implies to me a "meta-compiler," which I don't think is an accurate way of describing the technique. This could be incorporated into a regular compiler, you'd just want this as the first optimization phase. (I think.)

<comment><USER2> Thanks for going through it; I'd honestly like a less researchery article than that one to read. That wasn't my field when I was a researcher, and I'm not particularly interested in wading through articles written for a academic audience which may or may not allow me to draw the correct conclusions from trying to read through it.

"Yet another optimizer phase" is what I'm readying here.

<comment><USER4> Except I've only made it through the introduction, and I'm still not clear on whether or not their technique implies a compile, execute, profile, re-compile cycle.

One major difficulty with academic articles is that they have to "sell" their contribution in order to get the paper accepted. This entails taking the approach to its logical extension, and talking up the impact it can potentially have. Otherwise, reviewers may reject it for not being novel enough. But, this sort of approach is often detrimental to understand what, exactly, the researchers actually did. I know that when I read a research paper, there's often an "aha" moment when I realize "Oh, they just took XYZ and did ABC to it" which can either be followed up with "that's lame" or "that's neat!"

<comment><USER5> I'm pretty certain its role is that of a transformer from programs in an intermediate language to optimized programs in that same intermediate language. Hence, a pipeline internal to a compiler.

The use of the word "traces" may be the source of your confusion in light the rise of tracing JITs (there that actually execute a program). I think a better word would be "abstract interpretation".

<comment><USER4> These are the passages from the intro that made me say that:

"So a supercompiler does not transform the program by steps; it controls and observes (SUPERvises) the running of the machine that is represented by the program; let us call this machine M,. In observing the operation of M1, the supercompiler COMPILES a program which describes the activities of M1, but it makes shortcuts and whatever clever tricks it knows in order to produce the same effect as M1, but faster."

"A supercompiler would run M, in a general form, with unknown values of variables, and create a graph of states and transitions between possible configurations of the computing system. However, this process (called driving) can usually go on infinitely."

This implies, to me, a compile, execute, profile, re-compile cycle. But, that conflicts with the understanding of the technique that I described above. If that does _not_ describe a compile, execute, profile, re-compile cycle, then I'd like to know both what, exactly, the author meant by the above, and why he chose to phrase it as such.

<comment><USER5> Keep in mind the date (and origin) of the paper -- expect some vocabulary mismatches.

In particular: "run M, in a general form, with unknown values of variables" would _probably_ be called abstract interpretation today.

(I'm only fudging because I haven't read the rest yet myself. :)

Edit to add something I forgot to mention, but should: There's a(t least one) useful PDF of slides in the repository from the originally linked project.

I did go through that, in something of a hurry -- it walked through the rewriting of a naive function to append 3 lists [ app3(a,b,c) = app2(app2(a,b),c) ]into one that executes with a single pass.</comment></comment></comment></comment></comment></comment></comment></comment></comment>


ChatSecure iOS v3.2 – Decentralized Interoperable Push Support - mike-cardwell https://chatsecure.org/blog/chatsecure-v32-push/ <comment> mike-cardwell "Originally we wanted to integrate Axolotl/OMEMO but we haven't been able to acquire a license from Open Whisper Systems."

WTF?

<comment><AUTHOR> "Soon we will be implementing OMEMO Encryption in ChatSecure iOS, and immediately contributing our OMEMO XEP code upstream to XMPPFramework so that other apps can benefit. We plan to utilize the pre-existing Objective-C library AxolotlKit, written by Frederic Jacobs, that has been used in production since the release of Open Whisper System's Signal v2.0 for iOS. Unfortunately AxolotlKit is still currently GPL (and therefore not redistributable to the App Store) so this work is on hold until we can negotiate a change to an App Store-comptible copyleft license like LGPLv2 or MPL 2.0 from Fred and Moxie."

Written by Chris Ballinger — OCTOBER 02, 2015</comment></comment>


The 2006 High-School Science Fair Origins of Social Distancing and Lockdown - <AUTHOR> https://www.aier.org/article/the-2006-origins-of-the-lockdown-idea/ <comment><USER2> I encountered this essay in someone's random reply comment on twitter yesterday.

Knowing the origins of Chicken-Littleism is important for the post-pandemic failure analysis. Humanity's current SARS-CoV-2 predicament results from a perfect storm: change a few variables and the SARS-CoV-2 pandemic probably would have fizzled out with many fewer casualties. Treating this otherwise- wimpy virus as a super-virus is surely a primary cause of many of the non-old- person deaths.

Alex Berenson, a former New York Times reporter, has a twitter feed that I appreciate (likely the source of the reply comment where I first saw this link). Here's a quote from a recent thread about his theories of why his former colleagues in the news media seem to despise him:

> 11/ The third reason is the most obvious: _the hysterics have been wrong._ > They know it, whether they admit it or not. Except for the most at-risk > populations - who should be the focus of our protective efforts - #COVID > looks to be a minor risk. And with every day that goes by...

> 12/ Every state and country that reopen without catastrophe, the lockdowns > appear more insane. [...]

\- [https://twitter.com/AlexBerenson/status/1262223339726213121](https://twitter.com/AlexBerenson/status/1262223339726213121) (italics added)</comment>


Ask HN: Internet-scale fax service w/ API? - <AUTHOR>

My business partner & I are building a web application to drag the construction industry into the 21st century.  They'll come, kicking and screaming, but not without their fax machine.  I've found a couple fax services that provide an API, but they all seem to aim their pricing model towards companies building an internal app that will send fax pages on the order of 100s, not 1000s a month.<p>Are there any service providers out there that get it, or is this something we'll have to build for ourselves? <comment><USER2> > _"a web application to drag the construction industry into the 21st > century"_

Given the effects of the current economic cycle on construction, I'm somewhat dubious regarding the marketability of SaaS because it is a recurring overhead expense...and minimizing overhead is one reason faxes are so popular (the others are traditions of craft, computerphobia, and the ability of office staff to triage faxes more easily than emails).

In my experience in the US, businesses in the construction industry are as invested in technology as other companies of comparable size in other industries (IT excluded). Those firms with high volumes of faxes often have hardware capable of document management and many firms utilize it.

I'm not sure that I see a clear market segment for a web app because tech savvy contractors already have tools and methods, and the others aren't because they can't or won't spend time and money to obtain digital tools and learn them.

For construction companies, the key issues are book keeping and scheduling. In my opinion, faxing is not a 1.0 requirement.

Good Luck.

<comment><AUTHOR> Construction in the commercial space has picked back up - not as much new structures as improvements on existing properties. Residential is still at a standstill.

Our target user isn't the company owner, it's the GC Project Manager working at a small-midsize GC company. My cofounder has been doing this work for years, developed a v0.1 himself, and asked me to see if I could bring it large.

We'll see! Thanks for the input.

<comment><USER2> As GC's get larger, they tend to have the leverage to require their subs to use email...when they get really large, they often have the leverage to require the use products like Buzzsaw.

</comment></comment></comment><comment><USER3> A while back there was a startup with this exact idea from the HN community. (<http://news.ycombinator.com/item?id=1294079>) I love the idea, and said so then.

I talked with the developers a few times and learned recently that they had shelved the product. There are some existing enterprise solutions for electronic faxing. While building a service for smaller companies (and individuals that have the need to fax now and then) seemed to be a very difficult market to penetrate.

I'm not suggesting that their decision to shelve the product indicates it's not possible for you to succeed, but I do know they gave it a good shot and couldn't make money at it.

Perhaps going after a single industry, as you're suggesting, and vetting the idea (and price point) with them ahead of time, could get you closer to understanding if this is sustainable or not.

</comment><comment><USER4> You could integrate the Internet fax service into your web interface and manage it as you like. There are no sending limits, more information is available on: <http://www.popfax.com/index.php?action=partners_new>

</comment><comment><USER5> Not familiar with it, but I believe drop.io offers some form of fax ability.

EDIT: Guess that won't do much good as I just read that drop.io was acquired by Facebook and they are discontinuing the service. Oh well.

</comment><comment><USER6> This should work: <http://www.programmableweb.com/api/ringcentral-fax>

</comment><comment><USER7> I recently read about one(Chandigarh, India) about one which lets you send a fax through an email, but I am not sure if it provides an API or not.</comment>


In Battle, Hunches Prove to Be Valuable Assets - <AUTHOR> http://www.nytimes.com/2009/07/28/health/research/28brain.html?hp=&pagewanted=all <comment><USER4> "In the Army study of I.E.D. detection, researchers found that troops who were good at spotting bombs in simulations tended to think of themselves as predators, not prey. That frame of mind by itself may work to reduce anxiety, experts say."

This was interesting -- I wonder if it's translatable to complex workplaces, rife with politics & unpredictable threats to the success of one's project.

The article also brings to mind this New Yorker article on trackers: [http://www.newyorker.com/archive/2004/11/29/041129fa_fact_ti...](http://www.newyorker.com/archive/2004/11/29/041129fa_fact_tietz)

</comment><comment><USER5> God damn. They used two little kids as bait. Fucking monsters.

<comment><USER6> All's fair in love and war.

Better yet, ask yourself what made them so desperate as to disregard the principle you imply.

<comment><USER5> Can you clarify your remark?

<comment><USER6> The rules of war have changed drastically in the course of history, in the sense that despised heresies become orthodoxy. Think about the pike, longbox, crossbox and musket - these are just a few examples that come to mind - <USER2> were despised as they allowed peasant footmen to take down aristocratic knights with impunity, and the last two, without much training. As such, they were regarded as heinous and unjust weapons that threatened the social order. Of course, pragmatism won, as it always does, and they became part of the traditional arsenal - and changed the social order. Who needs knights when they cannot win a battle ?

It could be that what we today call terrorism will become part of orthodox warfare in several generation. Military theorist already call it 4th generation warfare. Basicaly, it's just a strategy, very similar to guerilla, that allows a poor unequiped militia to keep in check what we traditionally perceive as the strongest best equipped army.

<comment><USER5> There is a distinction though, isn't there? All of the heresies you listed were technological innovations that changed the dynamics of warfare. The thing I find deplorable is that unmistakable innocents were used as bait to attempt to lure in an enemy that was trying to give aid. It doesn't prey upon the structural disadvantages or technological disadvantages of the superior force, it preys upon their basic empathy for people that are suffering. Terrorism in general is more about not attacking a superior force but instead attacking something else to somehow, effectively or not, hurt the superior force.

I shudder to think that that sort of paradigm would become dominant. Warplanes explicitly targeting schools and hospitals because they are the most demoralizing and disruptive targets, using hunter/killer drones to gun down anyone without a FFID, it's all unconscionable when you extend it to its conclusion.

I also really hope that you don't think it's perfectly fine on a personal level.

<comment><USER6>
      Warplanes explicitly targeting schools and hospitals because they are the most demoralizing and disruptive targets

Well, the WW2 doctrine of strategic bombing was not far off. And it justified the firebombing of Dresden and the nuking of two Japanese cities, amongst others, by the airforce of an otherwise civilized country. Also, see the bombing of so-called dual-use objectives (that included schools and hospitals) in recent "peacekeeping missions" in Bosnia, Irak by the same airforce. So, nothing new there.

      it's all unconscionable

It is because we were raised as such - social conditioning. You can not imagine how heinous the weapons I cited were considered when introduced - <USER3> first, their users refused them, as it was not honourable or just.

      I also really hope that you don't think it's perfectly fine on a personal level.

I do not think so, but it does not matter, unfortunately. Nobody's ethical considerations matter actually. If it works, it's going to be used, and ethical judgements are going to change as soon as the winner gets their way.</comment></comment></comment></comment></comment></comment>


Sick of Flash security holes? HTML5 has its own - <AUTHOR> http://www.infoworld.com/article/2956193/html5/sick-of-flash-security-holes-html5-has-its-own.html

<comment><USER2> > _Among the risks that HTML5 brings, according to Bellanger:_

      * Canvas image-rendering exploits, which can cause buffer overflows that a hacker could then use to inject code into the session
      * Cross-site scripting, where intruders can steal information from a session in the browser
      * SQL injection, where a malicious query is used to extract information from a database in the browser
      * Cross-site request forgeries, where a user token is taken over to impersonate a user on the Web

3 of these seem older than HTML5. SQL Injection has been around a long time. How long have in-browser databases been used? Are these widely used?</comment>


Visiting the Anderton Boat Lift on My Narrowboat (2017) [video] - <AUTHOR> https://www.youtube.com/watch?v=gJDqGimPc9Q <comment><USER2> If you find this interesting, I'd really recommend learning about Falkirk Wheel - it's an absolute marvel of engineering and the only rotating boat lift in the world. I've visited a month ago and it was fascinating.

[https://en.wikipedia.org/wiki/Falkirk_Wheel](https://en.wikipedia.org/wiki/Falkirk_Wheel)

<comment><USER3> See also: Krasnoyarsk dam inclined plane

[https://en.wikipedia.org/wiki/Krasnoyarsk_Dam#/media/File%3A...](https://en.wikipedia.org/wiki/Krasnoyarsk_Dam#/media/File%3AInclined_plane_at_Krasnoyarsk%2C_on_the_Yenisie_River.jpg)

[https://www.youtube.com/results?search_query=Krasnoyarsk+Dam](https://www.youtube.com/results?search_query=Krasnoyarsk+Dam)

</comment></comment><comment><USER4> For those not familiar, narrowboats in England need to be VERY narrow.

[https://en.wikipedia.org/wiki/Narrowboat](https://en.wikipedia.org/wiki/Narrowboat)

There's some really fascinating videos on youtube from people who live in them full time, with walkthrough tours of living room space + kitchen + bedroom.

<comment><USER5> Having lived on one as a child, I can assure you that it's not quite as idyllic as it might look.

</comment></comment><comment><USER6> Also possibly of interest to people is the Marine Railway on the Trent-Severn Waterway. Boats sit in slings or directly on the car floor and transported across the 18m elevation change.

[https://en.wikipedia.org/wiki/Big_Chute_Marine_Railway](https://en.wikipedia.org/wiki/Big_Chute_Marine_Railway)

</comment><comment><USER7> The motorways of the industrial revolution! And lovely to cycle down these days.

</comment><comment><USER8> I don't want to turn into this man.

I'm going to turn into this man.

</comment><comment><USER9> That was so thoroughly and charmingly English, but what an amazing feat of engineering for the time it was built!</comment>


Safely Reviving Shared Memory - <AUTHOR> https://hacks.mozilla.org/2020/07/safely-reviving-shared-memory/ <comment><USER2> In this article, Mozilla refers to new HTTP headers, COOP and COEP, that can be used to opt-in to cross-origin isolation and thereby grant access to features that would be dangerous under Spectre side channel attacks.

IMO, this Google doc is a better explainer of COOP and COEP, how they work, and why they help.

[https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zME...](https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zMEu9ySMCiTGMS9y0GU92k/edit)

> _" We now assume any active code can read any data in the same address > space. The plan going forward must be to keep sensitive cross-origin data > out of address spaces that run untrustworthy code, rather than relying on > in-process checks."_

<comment><USER3> I may sound like a grumpy old man, but I really really dislike this non-stop influx of complexity into every level of the stack. This is a clear case of an abstraction leaking. Microprocessor vulnerabilities should never lead to changes in a high level application protocol like that.

The work needed to implement an HTTP server is growing and growing and growing. There was some speculation a few days ago on why this is happening, and why big companies are benefiting from this. I don't think there's any conscious conspiracy anywhere, just a lot of people try to make a name for themselves. (There was a discussion on this a few days ago here: [https://news.ycombinator.com/item?id=23833362](https://news.ycombinator.com/item?id=23833362))

But I just hate this growing complexity everywhere. HTTP can and should be much simpler than it's becoming.

<comment><USER4> None of these changes impact HTTP server code. Pages that run javascript might want to set some new headers, but setting headers is something that web servers always have to do. Changing a site config to send some new headers is work for a web page creator, not the HTTP server developer. And the changes are backwards compatible, so you don't actually need to do _anything_ if you don't want to.

This new complexity is about javascript execution, and creating a browser that can run javascript has never been simple!

</comment></comment></comment><comment><USER5> Cool! Looks like SharedArrayBuffer will be re-enabled next week with the release of Firefox 79: [https://developer.mozilla.org/en- US/docs/Mozilla/Firefox/Rel...](https://developer.mozilla.org/en- US/docs/Mozilla/Firefox/Releases/79#JavaScript)

This will be big for Web Assembly. Real threads will make it possible to port more stuff and get better performance.

<comment><USER6> It's better performance for one web site, at the expense of whatever may be in other tabs or even outside the browser.

I really don't want to grant that.

Web browsers are failing badly at resource controls. I don't want to hand my whole computer over to a greedy web site. I expect my browser to stop the abusive web site resource consumption, not enable it.

<comment><USER7> While I agree that browsers generally currently appear to exercise poor control over resources like cpu time and memory amount, I'm not sure that aiming to cripple all sites equally is the right tactic here. It seems like better "scheduling" and other resource management would be something that needs work regardless of whether we expose tools to improve web application performance to websites.

</comment></comment></comment><comment><USER8> Notably disappointing: Cross-Origin-Opener-Policy must be set on a page to isolate it as _the default value is not safe_.

i.e., if I have a page with sensitive client side data, I need to set this header to prevent a page on a _different domain_ from opening a popup to that page then doing a Spectre-like attack on my web page and exfiltrating that sensitive client side data.

I don't actually entirely understand the purpose or effect of Cross-Origin- Embedder-Policy. I thought browsers already blocked cross origin requests without CORS headers in the response that allow it. Does this header UNDO that _by default_?

<comment><USER9> > I don't actually entirely understand the purpose or effect of Cross-Origin- > Embedder-Policy. I thought browsers already blocked cross origin requests > without CORS headers in the response that allow it.

CORS applies to XHR/fetch APIs, not browser loading of subresources specified in the HTML of the page.

COEP optionally extends CORS-type protection to subresources.

</comment></comment><comment><USER10> While still a ways away, its great to see progress on this front. After SABs were disabled, the use cases and power of WebWorkers shrank considerably.

Very excited to dive back into some WASM/WebWorker projects that got abandoned due to performance limitations.

</comment><comment><USER11> Imagine what the world would be like if didn't need to worry about bad actors. This is a considerable amount of engineering energy to make this safe.

I know safety isn't all about about malicious attacks, but I like to imagine living in a world without the need for locks, passwords, keys, safes, signatures, contracts, lawyers, ... we would probably all be fed and populating the solar system by now.

<comment><USER12> I have a hard time imagining such a world precisely because being a bad actor is a part of our DNA and the DNA of many many animals, plants, bacteria, and fungi we interact with. The unintended consequence of lack of selfishness could be mind boggling. Think about it this way: Silicone Valley mostly provides the last 5% of the tech needed to make any given product. You know where the rest comes from? Military tech that eventually makes its way to civilian use. Things like semiconductors, the Internet, GPS, rocket propulsion, etc. No conflict == no military == no tech == we wouldn't be having this conversation. I am definitely not saying we couldn't all be a whole lot nicer to each other. But I am saying that we wouldn't be human if that was wired into us.

<comment><USER11> Do you think ancient Rome could have landed someone on the moon had they not fell?

<comment><USER12> Ancient Rome was very military driven. They also had classes of people, which I'd argue is about as selfish as you can get. They could absolutely land on the moon with enough time.

</comment></comment></comment></comment><comment><USER13> I played with the K on the word HACKS at the top of the screen for far too long.

</comment><comment><USER14> Nice to see it is eventually going to be re-enabled, however if Firefox doesn't make it as easy as Chrome, that is what most costumers will focus on regarding applications that make use of threading alongside WebAssembly.

<comment><USER15> In Chrome we already require these headers on mobile, and plan to require them on desktop soon.

<comment><USER14> Fair enough, so far I only toyed around with the desktop version.

Just making a note that if you want to foster PWAs over native, or Electron workarounds, better not make us jump through many hoops.

</comment></comment></comment><comment><USER16> The web is such a mess.

</comment><comment><USER17> So how will these headers work for shared hosting sites where you normally cannot modify the hosting provider's HTTP server?

<comment><USER18> You can set headers with .htaccess.

<comment><USER19> Only in specific situations, where the site is using Apache and has .htaccess files enabled. I would argue that using Apache in the first place is non- optimal, but enabling arbitrary .htaccess files for clients is also a potential disaster.

Then again, I suppose there are enough people out there who just want to FTP up their wordpress code and call it a day, so... ugh.

<comment><USER20> WordPress expects a working .htaccess for its URL structure, as do most modern PHP applications. So virtually all shared hosts will support .htaccess.

> I would argue that using Apache in the first place is non-optimal

What would you prefer? nginx is not suited to shared environments at all.

<comment> john-shaffer > WordPress expects a working .htaccess for its URL structure

I haven't heard this. I'm running WordPress via NGINX with no issues.

</comment></comment></comment></comment></comment><comment><USER21> tl;dr:

`about:config` -> `dom.workers.serialized-sab-access` -> true

Otherwise you risk sites opting in to Spectre. Why Mozilla thinks this is a good thing is beyond me.

<comment><USER22> This is either astoundingly bad reading comprehension, or a willful mischaracterization. The _whole article_ is about what they're doing to prevent Spectre-like problems. The config option is their backup plan in case they made a mistake in their threat analysis.

All in all, I thought it was a sober and mature approach to the problem.

</comment></comment><comment><USER23> _" The system maintains backwards compatibility. We cannot ask billions of websites to rewrite their code."_

I don't understand this requirement. Very few sites use SharedArrayBuffer, those few that do probably had to rewrite code to deal with it being disabled.

I also don't understand how cross-origin has anything to do with it either. Either your sandbox works, in that case cross-origin isolation shouldn't matter, or it doesn't work, in which case cross-origin isolation is not a real protection.

Am I missing something here?

Firefox is only maybe 5% of users and it has other performance problems, if SharedArrayBuffer doesn't "just work" then I'm inclined to have them take that performance hit or use a different browser.

<comment><USER2> Under Spectre, if the attacker can run SharedArrayBuffer code in your process, even "sandboxed," it can read memory from anywhere else in that process.

[https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zME...](https://docs.google.com/document/d/1zDlfvfTJ_9e8Jdc8ehuV4zMEu9ySMCiTGMS9y0GU92k/edit)

So I guess you're right that if the sandbox "works" you don't care about cross-origin isolation, but it turns out that sandboxes don't work if you run multiple sandboxes in the same process.

The mitigation browsers have chosen is to isolate each origin in its own process, preventing other origins from communicating with it. To regain access to SharedArrayBuffer, you have to opt in to this extreme form of cross-origin isolation.

It would be nice to just make the whole web default to cross-origin isolation, but tons of websites rely on cross-origin communication features, and browsers can't just force them all to be compatible with isolation, so isolation has to be opt-in.

<comment><USER23> How exactly does site-isolation prevent cross-origin communication that doesn't rely on SharedArrayBuffer, i.e. that vast majority of use-cases? It's just message passing.

I can see that site-isolation is arguably too expensive on mobile and why you might want an opt-in mechanism there, somewhere down the line.

However, I don't think there are good arguments for not just enabling it on Desktop right now, without making developers jump through hoops. Until _Chrome_ enables SharedArrayBuffers on mobile, I have no reason to care anyway.

<comment><USER2> Site isolation disables all of it. With "Cross-Origin-Embedder-Policy: require-corp," you can't even embed a cross-site image unless the other image allows it with a "Cross-Origin-Resource-Policy: cross-origin"

Enabling _that_ on desktop today would break every website that embeds cross- origin images, e.g. everybody using a separate CDN for images would be broken.

<comment><USER23> You're describing how this proposed cross-origin isolation scheme works. I understand that, I don't understand why it is _necessary_ to make it work that way.

Chrome has been doing site isolation with multiple processes for a for a while, it "just works" and it doesn't break sites.

<comment><USER24> Site isolation and origin isolation are separate concerns. In the "origin isolation" model, you need to ensure different origins are in different processes, and that their data don't leak from one to the other. In site isolation, you only care about tabs not being able to communicate with each- other.

Also, you seem to be missing something: Chrome is going to implement the same set of headers, with the same set of restrictions when they are applied. This isn't an arbitrary firefox decision, every web browser is expected to follow suit. See the various mentions of "chrome" in [https://web.dev/coop- coep/](https://web.dev/coop-coep/)

<comment><USER23> > In site isolation, you only care about tabs not being able to communicate > with each-other.

That is not true.

[https://www.chromium.org/Home/chromium-security/site- isolati...](https://www.chromium.org/Home/chromium-security/site-isolation)</comment></comment></comment></comment></comment></comment></comment>