Dark Patterns, the Ratchet - <AUTHOR> https://jacquesmattheij.com/dark-patterns-the-ratchet <comment><USER2> I was discussing some work on some opt-out we're going to be offering customers so they can either accept or decline certain automated patches to their systems, and I found myself describing the opt-out as "real opt-out", because you can flip the switch to "no" and all that happens is exactly what you want; you stop getting those changes automatically. You can still apply them manually later, or selectively, etc. We don't terminate your service or charge you more or do anything else. You just choose whether you want the convenience along with the bit of risk of changes, or if you want the control and the responsibility.

And I realized I had been subconsciously calling this "real" opt-out precisely because what I encounter in life as "opt-out" does not match that description.. "Real opt-out" is distressingly rare. Almost everything I encounter in real life is the style of ratchet described in this article, to the point where my brain without consulting me decided I needed a new word/phrase for what we were doing.

</comment><comment><USER3> A new Cortana popup's been showing up on the Windows 10 machines this week, where you can enable it, or have it "remind you later". >.<

I feel like every mode dialog needs a "f--- off" response. When YouTube asks me every fifteen minutes if I'd like to try YouTube TV, my answer isn't "no thanks", a polite declination of this generous offer. It's "f--- off", you incessant greedy tools.

<comment><USER4> That's everywhere on Windows. They did the same thing to try to railroad people into installing Windows 10. They do the same thing for every software upgrade.

OS X isn't much better.

<comment><USER3> Actually, Microsoft's current strategy for pushing updates is to "accidentally" break the options that let you withhold updates for a period of time. They've broken them like three times in the last six months, arbitrarily forcing large groups of Pro users to later versions of Windows than they should've gotten.

<comment><USER5> I found a way to get rid of windows updates. You just need to not have enough disk space... Every time I boot, I have a modal asking me to free more than 8GB to start the update.

<comment><USER3> The goal isn't to "get rid of Windows updates". Windows Updates are _important_. Of course, we do need to control those updates better. And Microsoft needs to be better about keeping those updates stable.

<comment><USER5> I only meant it as a joke, I'm just wishing Windows Updates would be less bloated than they are now, it would help speed up the process and keep customer complaints down. Also I don't need to wait 20 minutes in front of a blue screen when I do updates in Ubuntu.

</comment></comment></comment></comment></comment></comment><comment><USER6> The longstanding root of the problem is that we're relying on software that is under the control of an adversarial party, especially for creating a UI. This necessarily means that incentives are misaligned, and we are left as an unaccompanied homo sapien to be outwitted by the machine in front of us that we may have paid for, but that does not work for us.

It will be interesting to see where the GDPR goes, especially with regards to surveillance companies we don't directly interact with. But as long as we continue to do things like utilize a specific retailer's software for researching and planning purchases, the incentives are for that retailer to design that software to push us into funneling as much business (and extraneous personal data!) as possible to themselves.

<comment><USER7> > _The longstanding root of the problem is that we 're relying on software > that is under the control of an adversarial party, especially for creating a > UI._

One of the original ideas of the "semantic web" was that the entities that provide data and the entities that _display_ the data should be decoupled and freely combinable by the user.

That idea didn't gain particularly large support with website developers.

I wonder why... /s

<comment><USER8> Because there isn't much incentive to do something that makes it easier to not get paid for your content?

It already rubs me the wrong way when Google scrapes content from sites. I'm not surprised the dream failed if that's what it was.

<comment><USER9> "/s" at the end of a comment means the author was being sarcastic ;)

</comment></comment></comment></comment><comment><USER10> It's funny how they only want to repeatedly confirm your decision when you give the answer they don't want.

Every time my Facebook messenger app updates it asks me to confirm my phone number (which it already has through some other method). It employs multiple dark patterns to trick me into confirming, and because of this I've very nearly done so by accident.

This stuff might be profitable in the short term but many of us see through it — especially the younger generations — and it's eroding any trust you may still have with people.

Companies need to cut this shit out ASAP if they want to be trusted in the future.

<comment><USER11> Cutting this out puts a company at a disadvantage to competitors. This is a case where the government "of the people and for the people" should step in and write some _real_ legislation, _and enforce it_. Unfortunately, "of the people and for the people" is effectively ancient history now, they're far too busy bickering over Russian trolls and fulfilling their donors wishes. What a sad state of affairs.

<comment><USER12> I'm not against regulation on principle, but how specifically would you write something against these patterns? I have a hard time seeing how to describe them in a general way - and "I know them when I see them" doesn't make good law.

<comment><USER11> Write the law vaguely and make punishments potentially scarily harsh, the general idea that if companies would like to continue to play dumb farmer, they better hope they don't run into someone with a strict personality. In law, there is the notion of both the latter and the spirit of the law, so this notion isn't unprecedented.

You might think this is a bit crazy, and you'd be correct, but it's nowhere near as crazy as _thousands_ of things in the actual reality of our current legal system (banks crashing the global financial system, yet no one was guilty of anything, black men being executed at point blank range and the cop walking away, etc etc etc etc etc).

</comment></comment></comment></comment><comment><USER13> This strikes me as an area where legislation could have a significant impact. It's an area where there is absolutely no economic incentive to do the right thing. It seems similar to the way email lists and spam were back in the early days of the internet. Based on my observations, the CAN-SPAM act requiring automated mailings to have an unsubscribe link actually seems to have been fairly effective at improving that situation. Granted, there is still spam, but the legit mailing lists are a lot easier to opt out of than they used to be. Perhaps some legislation relating to terms of service agreements could help with this problem?

</comment><comment><USER14> Not privacy related but how about that damn "Ratchet" that iPhones have to get you to upgrade the OS? You are literally presented with two choices: upgrade now or remind me later. The remind me later choice means getting a daily nag with the same two choices. I inevitably lose this little cat'n'mouse game and accidentally click the upgrade now option. Yes, you can delete the update file to postpone the prompt for a bit but that is a hassle and only temporary anyway. APPLE, I DON'T WANT TO UPGRADE!!! Every time I inevitably accidentally upgrade, the UX responsiveness degrades another step. For the third phone in a row I'm at the point where I feel like I need to upgrade to new hardware to get back to the responsiveness level I want. I think we all know this is no coincidence.

<comment><USER15> You might be overly sensitive. My wife still runs an iPhone 6 (not 6s), on the latest OS. I can only _just_ tell the difference between it and my 8 (also on the latest OS.) in app load times for giant apps. Otherwise (scrolling, network, etc.) there is no functional difference unless you're sitting there with a stopwatch.

Don't propagate the false "planned obsolescence" meme. It's tired and counter- productive, especially from a security standpoint.

<comment><USER16> Maybe you're just not that sensitive to it? App load times aren't what keeps me from updating, it's stability -- iOS 11 is _still_ ridden with bugs, which is ridiculous for a 6 month old OS used by millions of people worldwide. Of course, CPU throttling is another valid reason to hold off, or, if you use a phone with a smaller screen like my SE, you might not want to update to an OS that doesn't scale well for your screen size..

</comment></comment></comment><comment><USER17> You know, if a country ran an election over and over until they got the "right" answer it would obvious that said country wasn't a democracy. I would have no problems if every time I opened an app or logged into a website it asked if it could have the set of permissions it needed (or wanted). Or, it could ask me once, then make me go into the settings to change my answer if I changed my mind.

But asking over and over until I say yes, then never asking again is just as nefarious my aforementioned election strategy.

<comment><USER18> I don't think it's much of a stretch to call it abuse.

Imagine this was a person-to-person thing. Person A wants person B to consent to something person B does not want to consent to. And let's not beat around the bush here: we're all thinking of something sexual right now. A repeatedly asks B, and no matter how many times B says no, A claims that B said "maybe later". B does not get to say "fuck off" unless B somehow quits A altogether.

Now that is messed up enough already, but what these forms do is _give you no other option than answer "maybe later"_. That's a level above putting words in someone's mouth that I am sure would be considered a form of violation if someone in a position of power could do that to someone else.

And that very much applies here: I don't get to create the pop-ups in an app or on a website, so the app-makers are abusing a position of power here.

<comment><USER19> I had just thought of this exact analogy too. Another one that came to mind is a forced/coerced confession. Usually it's combined with something more extreme like sleep deprivation/psychological abuse but the way it often works is just asking someone over and over for hours whether they committed the crime / how they did it. Eventually people confess just to make it stop. I see this as the same thing on a smaller scale: eventually you just accept the terms/update/whatever to make the annoying notifications go away. But you were still coerced into that decision out of annoyance and frustration

</comment></comment></comment><comment><USER19> Excellent post. I recently dealt with "The Ratchet" for several months on my old iPhone, because I didn't want to upgrade to the new OS at the time for battery/performance reasons. Every single day I'd get a full screen popup telling me to enter my passcode to update, or I could click on a smaller box at the bottom to remind me later. It was my own phone and I couldn't even make it stop asking me to update.

The other place I noticed it recently was Reddit's mobile website, which asks me to download the app TWICE every time I reopen it on my phone. The first prompt is a bottom banner taking up about 40% of the screen on my phone with the small link to the mobile site situated uncomfortably close to the much larger button which takes you to the app store. The second is a popup from clicking on a link, which takes up about 60% of the screen and is centered. It's workable, but it's almost as annoying, persistent, and anti-user as Facebook messenger on mobile web browsers.

It's infuriating seeing some of your favorite products try to pull this on you. I wish I could tell the developers to stop being assholes to their faces.

<comment><USER20> The Reddit example extends to Android as a whole - I can't speak to Apple iOS due to inexperience.

Browsing websites with a companion app always prompts you to view in the app or install the app, and the presentation is always biased toward doing so instead of declining. I wish there was an option to indicate that you don't want to be prompted in this fashion in the future - either all around, or to have it remember specific apps that you don't want to install.

It really is a persistent annoyance. The Reddit website in full desktop mode has also recently been pestering users about logging in, and it does so every time you navigate to the site if you aren't already logged in to an existing account.

It is really quite annoying, and has actively caused me to use the site less. I'm much less likely to use a timesink or unfocused browsing activity if I'm being pestered while doing so. I imagine that this type of activity is a significant portion of the whole for such websites, so it really seems disingenuous, unless their long-term plan is to pull a Facebook and focus on revenue through selling user data to third parties (which I imagine is most likely the case).

</comment></comment><comment><USER21> Google are buggers for this one.

Not now should be "Not now and Never".

They don't stop doing the thing you told their UI to stop doing they 'pause' it.

GDPR is going to be great.

<comment><USER22> > GDPR is going to be great.

Does GDPR explicitly prohibit the use of these patterns? Or will it spawn more of them to trick you into accidentally opting in?

<comment><USER23> Maybe. Per Article 7(3) (in particular the last sentence)[0]:

>The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

As I read it, if you're going to annoy your no-consent-given-(yet)-users with a "convenient" popup every time asking whether they consent... Then you also have to annoy your consent-already-given-users with an equally "convenient" popup every time asking whether they _still_ consent. Break the anti-pattern by forcing the developers to pull it all the way through.

At any rate, it gets rid of the "Aha! given at last! now you can never revoke it!"-part of the ratchet.

[0] [https://eur-lex.europa.eu/legal- content/EN/TXT/PDF/?uri=CELE...](https://eur-lex.europa.eu/legal- content/EN/TXT/PDF/?uri=CELEX:32016R0679&qid=1490179745294&from=en) (page 37)

</comment></comment></comment><comment><USER24> To pick on a different company, every once in a while when I start Revolut (fintech mobile bank acount like thingy), I get asked if I want to upload my contact list so that I can easily send/receive money from my contacts. There is no option to "Never".

<comment><USER25> If you're using iOS, then they only get one shot at asking for permission with the system prompt, and if you say no, they can't do it again. So what most applications do is show a custom prompt (which they can show an unlimited number of times), and if you agree to that, then they show the system prompt, which users are unlikely to refuse at that point.

This means that it's pointless for them to show their custom prompt if you've already refused access, because even if you agree, they can't get the system prompt to show up again. So you can _probably_ make the repeated prompts disappear by either a) agreeing to their custom prompt then refusing access when the system prompt appears, or b) going to Settings > Revolut and refusing access to your contacts there. The latter is probably the best way of doing it.

<comment><USER26> > This means that it's pointless for them to show their custom prompt if > you've already refused access, because even if you agree, they can't get the > system prompt to show up again. So you can probably make the repeated > prompts disappear

No. I have seen this defeated on a few apps-- they harass you with the custom messages, and when it realizes it can't trigger the system prompt, it just tells you to go into settings and approve it manually. Failure to follow through means the custom messages will continue harassing you as long as the permission has not been granted.

</comment></comment></comment><comment><USER27> LinkedIn is particularly adept at repeatedly asking you to share your e-mail contact list.

Don't think there is an option: Never share my contacts and stop bugging me about this option.

<comment> yjftsjthsd-h Solution: single use email account. For bonus points, and address book where each entry it a complaint about LinkedIn.

</comment></comment><comment><USER28> I'm wondering whether GDPR is going to make this worse.

It used to be that the GWR train Wifi would automatically log me in. But now that has changed, and it takes me to a pre-populated log-in screen, which requires me to untick the "Add me to the mailing list" button, and tick the "T&Cs" and "Privacy statement" buttons.

I suspect that this is a GDPR hoop to show they have consent for every bit of data they use. But all I have to do is forget to untick the "Add me to your mailing list" button once...

<comment><USER29> The GDPR doesn't allow default-checked opt-in checkboxes. They aren't "clear affirmative actions".

Article 4.11: _" 'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her"_

<comment><USER30> So now we have to go back to every site/service/app including unchecked but mandatory tick boxes about agreeing to their terms and privacy policy in the checkout process, thus both annoying just about everyone and potentially reducing conversion rates while making no practical difference to anything whatsoever? I guess we can file that with the "cookie" law and the consumer protection rules that say if you want to download any digital content you just bought immediately instead of waiting 14 days first then <insert scary legalese about losing a right to cancel under some law you never heard of here>. I think they're under "well intentioned but utterly lacking in practical understanding".

<comment><USER12> Those tick boxes can only be mandatory if the data is actually needed to provide the service - the user can't be forced to allow his data to be used for marketing purposes, for example. Also, if it's obvious for what purpose the data will be used (e.g. filling in your address for delivering a package), you don't need a tick box.

So there should be little need for mandatory boxes.

<comment><USER30> As ever with the GDPR, things are going to get subjective and you take your chances until the picture is clearer. A strict interpretation appears to be that, for example, a business that uses a customer's email address as an account ID on its web site and sends only essential messages to that email address doesn't need consent, because the legal basis for the processing is performance of a contract, but if the email address is also used for other form of communication (even if the message is genuinely relevant and something the customer would almost certainly want to receive) then that may require active consent. That could lead to a lot of places adding those checkboxes back in just to make sure they're covered, even if they aren't strictly necessary.

<comment><USER12> Actually, they can't add those checkmarks, because consent must be specific (use this data for this purpose), so a generic tick box about agreeing to their terms and privacy policy won't fly.

<comment><USER30> Well, at that point, all semblance of reality would have been lost anyway. It seems highly unlikely that any businesses, even huge ones that have data- hoarding business models, are going to start itemising opt-in consents in their sign-up process rather than just having a compliant privacy policy and a single active consent to processing under it.

<comment><USER12> If they don't, I'm sure my national data protection commission will be happy to remind them.

<comment><USER30> Unless they really want to play chicken over something that is clearly an unreasonable interpretation of the rules, I doubt it.

Using the GDPR to go after one big player that seriously screwed up is one thing. I certainly wouldn't be comfortable if I held Facebook stock right now.

But going after _all_ the big players, just for not complying with something that is probably impractical for any of them to comply with, is something else entirely. How long do you think public sentiment is going to support government regulators and the GDPR if the likes of Facebook, Google Mail, WhatsApp, Instagram and SnapChat all go dark across the EU for an hour, or a day, or a week?

<comment><USER12> _unreasonable interpretation of the rules_

There's nothing unreasonable about it, it's the plain reading of Article 7 (2).

Regarding the big sites, I don't see how is that relevant to your initial point about whether "every site" will have mandatory checkboxes, and so I'll let someone else read the magic 8 ball.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> I completely agreed until this point:

>Of course it would be trivial to have a log of recently given permissions and an 'undo' option for each of those.

No, that's not trivial. It's not _hard_ , but it's pretty far from _trivial_. Trivial would be removing the "not now" functionality from this question.

Maintaining a list of permissions and implementing the ability to undo them from a common area doesn't sound trivial at all to me, even if that only meant "no permission _in the future_ ".

If you were designing the app from the ground up to support that, it'd be a lot easier. But it still wouldn't be "trivial".

I went to go find the definition of "trivial", but I didn't get what I expected, and I'm sure it isn't what the author meant, either. "of little value or importance."

I was looking for something along the lines of "taking a negligible amount of effort". And I don't think implementing an entire interface and storing a list of data for it is trivial, let alone the part where you can take actions from that interface that potentially have system-wide ramifications.

<comment><USER32> The computer science sense of "trivial" comes from the mathematical sense, "Related to or being the mathematically most simple case. More generally, the word "trivial" is used to describe any result which requires little or no effort to derive or prove." [0]

And of course "trivial" is related to "obvious" when used in a math lecture.

[0] [http://mathworld.wolfram.com/Trivial.html](http://mathworld.wolfram.com/Trivial.html)

</comment></comment><comment><USER33> In browser, I can use this plugin ([https://addons.mozilla.org/en- GB/firefox/addon/nuke-anything...](https://addons.mozilla.org/en- GB/firefox/addon/nuke-anything-enhanced/)) to destroy those annoying popup.

In mobile, no such luxury, so instead always use the web app version unless unavoidable, like whatsapp.

</comment><comment><USER34> Yes. More on this in context to A/B/C/D.

[https://hackernoon.com/deception-degenerate-a-b-testing- ecce...](https://hackernoon.com/deception-degenerate-a-b-testing-ecce6635000e)

Note: I am the author.

</comment><comment><USER35> Textbook example was LinkedIn's "Upload your Gmail contacts" prompt.

It would keep asking the user every time they visited their page.

</comment><comment><USER36> If only there was a government agency who was:

 _Working to protect consumers by preventing anticompetitive, deceptive, and unfair business practices, enhancing informed consumer choice and public understanding of the competitive process, and accomplishing this without unduly burdening legitimate business activity._

</comment><comment><USER37> Aaaaand.. that's why we have GDPR.

<comment><USER31> GDPR only applies when the user doesn't give consent. This dark pattern is about obtaining that consent, not about using the user's data without consent.

<comment><USER37> GDPR also governs the way in which consent can be obtained, and the withdrawal of consent.

</comment></comment></comment><comment><USER38> Is the ratchet a good design strategy for software updates (e.g. Chrome, Mac OS)?

<comment><USER39> It worked for Windows.

</comment></comment><comment><USER40> Opt-out means "we can't directly use your information but wait! We'll find a sneaky hard to trace way to sell your information to others"</comment>


Pandom – True random number generator - <AUTHOR> http://ncomputers.org/pandom <comment><USER2> I have no idea what this is. It has no description of how it works on homepage. That it's just software makes me doubt it's a TRNG in first place. The code is assembly I can't read. I suggest people staying clear of this thing.

<comment><USER3> hi, i wrote the code. i am bad on writing descriptions and explanations. if you have doubts, please analyze source file test.s section f, read about sys_write, sys_open, sys_nanosleep here: [http://blog.rchapman.org/posts/Linux_System_Call_Table_for_x...](http://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/) and about tRNG timing jitter here: [http://www.chronox.de/jent/doc/CPU-Jitter- NPTRNG.pdf](http://www.chronox.de/jent/doc/CPU-Jitter-NPTRNG.pdf) .... it needs 4 ubits (32 equiprobable time deltas) per each time measurement.

<comment><USER2> A HAVEGEd-like RNG as I suspected. For your web page, just modify it to say that "Its entropy comes from CPU execution-time jitter like HAVEGEd does." People familiar with such generators will instantly know what to expect. I did one of these many years ago in a more blunt, simple, and imprecise form. It was a hack. I get the motivation but was concerned about relying solely on it.

The reason is mentioned in the paper you link. The CPU's and programs are deterministic machines. They appear to have non-deterministic behavior when facing unknown combinations of instructions during execution of the system. I believed it would do fine on a system with unpredictable workloads. However, there's two things remaining that could make entropy low: a predictable workload such as an embedded, real-time system; starting state of system executing same calls in same order on same hardware might not produce the amount of non-determinism in the paper. The first isn't important to your use case in all likelihood but the second might be.

My solution was to use a real TRNG to produce the seeds. Then, one of the things the RNG would do over time is replace those seeds with something random. That way it always has a truly or very random start. This also helps in real-time embedded assuming the low-priority task doing this ever gets executed. If you have no TRNG, I had two strategies for that: rolling 8-sided D&D die in a shoebox given 8 numbers maps to 3 bits perfectly; shuffling cards good, type them into text box in order, and repeat that once or twice. Whether die, cards, or both, you type the numbers into a text field or text file that you hash with SHA-256. Incidentally, this is also how I generated my TrueCrypt passwords as a BASE64-encoded version of SHA-256 hash is 64 characters.

So, start with truly random seed, occasionally replace the seed, run your numbers through a CPRNG regardless to avoid repetition in the bits that TRNG's sometimes do, and log as much of the TRNG output as possible (millions of bits minimum) to run through as many tests as possible. Might also make a nice experiment to test my hypothesis about how much it passes randomness tests during system startup from power off to the point TRNG is ready for delivering numbers. Do that 30 times or so to compare against what randomness looks like in a system that's been running a while.

Note: All of this shouldn't get too much fixation as a HAVAGEd-style RNG will be the last way they own you. They'll use an exploit or bad configuration first.

<comment><USER3> instead of talking with words, i talk with facts. whenever you have the proof, that pandom doesn't offer 64 ubits / 64 bits, please contact me. you have to work with test.s have a nice day and good luck :D

<comment><USER2> You've measured the internals of Intel processors and their interactions with inits or other homogenous workloads to have "facts" backing your claim of real entropy vs apparent entropy? That's pretty impressive if you don't work at Intel. I'm guessing you're not working with "facts" at all so much as guesses based on looking at output of a black box with a limited sample of workloads.

Good news for you, as I said before, is that beating your RNG is harder than just finding a 0-day in your system. It won't break because (a) low uptake and (b) economics of hitting something else. ;)

<comment><USER3> hi, proofs of unpredictability are inside pandom/amd64-linux/proofs folder and were generated using make install-kern, running linux with parameters rw init=/usr/lib/pandom/kern

</comment></comment></comment></comment></comment></comment><comment><USER3> installation tutorial here: [https://www.howtoforge.com/tutorial/how-to- install-pandom-a-...](https://www.howtoforge.com/tutorial/how-to-install- pandom-a-true-random-number-generator/)</comment>


Google announced Project Glass Technology - <AUTHOR> http://techfond.com/google-announced-project-glass-technology/

<comment><USER2> Please stop posting this

</comment><comment><USER3> It's a repost</comment>


Wall Street Beset by Hackers Multiplies Pay for Key Executives - <AUTHOR> http://washpost.bloomberg.com/Story?docId=1376-NCF1Y46JTSEX01-6VBJO8VTQL4TNK70D0VT52GB8R

<comment><USER2> Wall Street Beset by

Hackers Multiplies pay for

key executives.

Ha ha! Best "found Haiku" clickbait title ever! If only Basho had lived to see this.</comment>


Why the Computing Cloud Will Keep Growing and Growing - <AUTHOR> http://www.nytimes.com/2016/12/25/technology/why-the-computing-cloud-will-keep-growing-and-growing.html <comment><USER2> The fundamental problem with cloud in the current era is that hardware is actually pretty good, and has plateaued in many meaningful ways. If you're an IT manager working a 3-year depreciation/refresh cycle, you can look at your estate and think, well actually the headroom we put in at the beginning of this cycle was more than plenty, we can sweat the assets for an extra year or perhaps an entire cycle and reallocate that budget or return the money to the business. Maybe you can even avoid layoffs. Same with upgrading software, you can say version X does what we want and save the money on new licenses, training, etc etc.

Cloud robs you of the ability to manage your business in this way. You pay the vig or the lights are switched off - no ifs, no buts. I personally am a huge fan of cloud as a technology, but as a business model, it seems to heavily favour vendors over customers, in a way that makes even Oracle's licensing terms look fluffy and benign.

<comment><USER3> Isn't the USP of the cloud that you don't need to buy and manage the "physical" devices?

I mean yes, maybe some companies that already exist have an infrastructure management team, but if you want to start a business, the less physical stuff you have, the better.

<comment><USER2> You still need to manage them. All "cloud" saves you really is the effort of racking'n'stacking, which is 1 day out of a 1000-2000 day lifecycle.

I concede that cloud lets you get up and running very quickly - just like staying in a hotel lets you live in a foreign city very quickly too. But if you want to stay longer than a few weeks, you'd be looking at an apartment instead...

</comment></comment></comment><comment><USER4> The article seems to only go into shallow depths as to the motivations for "cloud", i.e. "because microsoft want to". There are however bigger, more meaningful, and more sinister motivations for the "cloud".

Migrating products and services to be "online", which is essentially what the cloud _is_ , is a win-win - politically and economically.

Being online means that Senior Analyst Mike Bloggs from GameCorp Co. can make monthly summaries about which ad struck, about which user did what, about how well that microtransaction performed with each user. It means that CTO Satya from Microsoft gets tax breaks et al, discussed over the meetings he often attends with government, for exchanging user data with FBI, GCHQ, etc. It means VP of Sales Matt Thebosspants from EA can control access to a game with codes, DMR-ing content.

It's a win on all sides, and there is nothing you can do about the ever- spreading cloud.

Heard of those cloud-connected toys for kids nowadays? Ain't that cute.

<comment><USER5> >"It's a win on all sides, and there is nothing you can do about the ever- spreading cloud."

Yes you can, you can run your own servers. Home servers don't have to be complicated to run, nor do they have to provide every online service ever conceived. An easy to run email server could be something that proves popular.

<comment><USER6> > An easy to run email server could be something that proves popular.

This is not able to exist anymore. While the server software itself can be automated, the never ending maintenance and defense of your IP(s) on RBLs, as well as the never ending cat & mouse game of spam fighting, is a full time job that only grows the more you use your email server.

<comment><USER5> >"the never ending maintenance and defense of your IP(s) on RBLs"

If you use IPv6 this problem goes away, right?

>"as well as the never ending cat & mouse game of spam fighting"

This can be automated in a number of different ways.

The low-tech solution is to use consensus amongst users. Allow home servers to share spam lists, and if multiple users mark an email as spam it's marked as spam for everyone. You'd still allow individual users to whitelist email domains they didn't personally want marked as spam. Similar arrangements work well for ad-block lists, I see no reason why the same approach can't be taken for spam email lists too.

The high-tech solution is to use machine learning to pick up on clues that an email should be marked as spam. This wouldn't be something that individual users would need to manage, it could come built-in with the home email server software. It could also evolve over time, both from its own research and from human guidance.

</comment></comment></comment></comment><comment><USER7> Can someone with better knowledge of finance than me explain the significance of this sentence?

> A.W.S. was 10 percent of Amazon's revenue, but more than 100 percent of the > company's operating income.

<comment><USER8> Here [1] we see that Amazon's (The Conglomerate's) profit was $513M.

In the same article, we're told:

 _The operating income for A.W.S. more than tripled in the quarter to $604 million._

Therefore, the conglomerate made $513M, and separately, a subsidiary company, AWS made $604M. This means that other parts of the conglomerate lost a total of $91M

Here's the 5 year old version.

If your family harvests 10 bananas, and you harvest 6 of them, and your family gives away 5 of them, you contributed more than your family kept.

[1] [http://www.nytimes.com/2016/04/29/technology/amazon-q1-earni...](http://www.nytimes.com/2016/04/29/technology/amazon-q1-earnings.html)

</comment></comment><comment><USER9> The current competition is good for users. Hopefully there will not be one dominant winner in the _cloud_ _wars_.

<comment><USER10> Oligopolies aren't that much better.

</comment></comment><comment><USER11> Actually, no i dont think that this will happen. All it needs is one persistent, mutating virus, that can rekindle even after it has been detected once and self modify to jump habitats- sort of the malaria-melding-plague of computation, and the whole centralizing approach is prone to downfall.

Safety in numbers, safety in monoculture, always attracts this peril

</comment><comment><USER12> My CPA wife wants a source or explanation for the sentence "A.W.S. was 10 percent of Amazon's revenue, but more than 100 percent of the company's operating income." Does anyone have a link?

</comment><comment><USER13> cloud computing will be dead when organic computers come online. a single organic computer will be able to process more computations than all the computers on the planet in a thousand years.

</comment><comment><USER14> From the article: _"When has Amazon ever thought about anything other than world domination?"_

From the Terminator series: _Skynet begins to learn at a geometric rate. It becomes self-aware at 2:14 a.m. Eastern time, August 29th. In a panic, they try to pull the plug._</comment>


1 Million+ Deprecated URLs - <AUTHOR> http://www.gstatic.com/trends/websites/sitemaps/sitemapindex.xml hi, i was just taking a real good look at the www.google.com/robots.txt and i found this little gem in there

  Sitemap: http://www.gstatic.com/trends/websites/sitemaps/sitemapindex.xml

 besides that fact that google killed on of their more usefull tools (google trends for websites) it seems they forgot the tell the robots.txt team (if there is such a thing)
well, anyway, i just wanted to say: google trends for websites, you will be missed. <comment><AUTHOR> hi, i was just taking a real good look at the www.google.com/robots.txt and i found this little gem in there

      Sitemap: http://www.gstatic.com/trends/websites/sitemaps/sitemapindex.xml

besides that fact that google killed on of their more usefull tools (google trends for websites) it seems they forgot the tell the robots.txt team (if there is such a thing)</comment>


My experience going from 17" MBP to 15" rMBP for programming - <AUTHOR> http://pineapple.io/discussion/retina-mbp-for-design

<comment><USER2> Just a further extreme datapoint: I just went from a 13" MBA to an 11" and am not missing the extra pixels at all, for terminal based web development. I keep the terminals, browsers, and virtual machines running the servers in full screen mode and just flick between them. Oddly, it's easier than clicking or cycling around the windows on a full sized desktop.

The smaller pixel size and my no longer young eyes conspire to make it a poor man's retina display. (Not completely, the retinas are still better, but I am less distracted by pixel edges than I was on the 13, but I couldn't by next June's machine last weekend.)

I'm still desktop bound for Xcode work, but the 13" didn't do it for me there either.

</comment><comment><USER3> I was also not sure whether the 15" retina display would be as good as the 17" 1920x1200 display. I now use my 15" Retina in scaled 1920x1200 equivalent most of the time when I'm doing programming work (when I'm not at my desk using a large external monitor), and it's actually better than the 17" in that mode -- due to the way they did scaling, fonts and widgets render with more detail.

That said, there are situations where the 15" Retina 1920x1200 scaled is not as good as the 17": When I am sitting in bed (or maybe a couch), and the display is further away than it would be if I were sitting on a desk. In that situation it's not ideal, because the fonts become harder to see. But there are two potential solutions to that: If the app I am using supports zooming, just zoom the content (e.g. web browsers all do this) OR switch to the best- for-retina 1440x900 equivalent. I usually use best-for-retina when I'm not doing programming. But, I still have my 17" MBP, and it is my designated programming in bed laptop.

One of my favorite things about the Retina display is that I can _arbitrarily choose resolutions_ without any perceived decrease in quality. This is something we had with CRTs, and didn't really have with LCDs until now.

Another potential downside: Apps that don't support the retina display look pretty terrible. They look best in scaled 1920x1200, but still not that great. The only app I use that doesn't support the retina display is Ableton Live (and it's entire UI is vector-based and can scale via a zoom setting, so you think it wouldn't be hard).

</comment><comment><USER4> I was originally concerned that switching up to 1920x1200 was going to show artifacts from subpixel rendering, but that's not the case at all. Text still looks very crisp. Highly recommended.

2D scrolling isn't great at the highest resolution on the original rMBP. Tons of pixels to move around. I assume the new graphics in the latest rev improved this.

<comment><AUTHOR> Yes definitely. I opted for 16gb and the top CPU, but I have yet to see any choppy scrolling or anything of that sort.

</comment></comment><comment><USER5> You can also use it at its native 2880x1800 resolution. [http://www.reddit.com/r/apple/comments/vi9yf/set_your_retina...](http://www.reddit.com/r/apple/comments/vi9yf/set_your_retina_macbook_pros_resolution_to/)

<comment><AUTHOR> Very cool, thanks. I wonder how this differs from the scaled option.

<comment><USER6> The "best" scaled option gives you a virtual resolution of 1440px wide. Slide to the right and you get 1680px and 1920px.

<comment><USER5> 1920 _1200 is good for everyday use. 2880_ 1800 is usable in the short-term, when lots of real estate is needed and no external monitor is available.

1440*900, imho, shouldn't be allowed on such a screen. It seems like a huge waste.

</comment></comment></comment></comment><comment><USER7> +1 I also had an experience much like this when switching from 17 to 15 rMBP. Now the only problem is the Cinema Display looks like shit now :)

</comment><comment><USER8> I quite like pupil: [http://pupil.io/](http://pupil.io/)

It allows you to change the resolution (zoom) from the menu bar.

<comment><USER9> I use gfx status [http://gfx.io/](http://gfx.io/) for this.

<comment><USER10> I think you're confusing the two.

gfxCardStatus only shows which graphics card is active.

Pupil only allows you to change screen resolutions.

They complement each other, but have no overlapping features.

<comment><AUTHOR> Lol at your username. How appropriate.

<comment><USER10> Stop talking to your computer and get back to work!

</comment></comment></comment></comment></comment><comment><USER11> > _A power button that is a key on the keyboard_

Wait. Why this is great?

<comment><AUTHOR> I just like it more than the other power button, feels more natural. The other one you had to kind of push hard, as if it were 'stuck'

<comment><USER12> On the other hand I've now accidentally pushed the keyboard integrated power button several times on my Air instead of pushing the Delete key.

</comment></comment></comment><comment><USER13> does it bother anyone that the optical drive is no longer present in the rMBP models? i know i very rarely use my optical drive, but for some reason i feel like i would miss it. haha.

<comment><USER14> The only Mac that still has an optical drive is the inexplicably still available (it's more expensive than a MBA, and worse in most ways) 13" non- retina MBP. You can get a USB DVD drive for practically nothing, though.

</comment></comment><comment><USER15> Ditched my 15" for a 13" rMBP with similar results as OP.</comment>


Remote announces $11M in Seed Funding - <AUTHOR> https://blog.remote.com/announcing-our-seed-financing/ <comment><USER2> Isn't $11M considered on the larger side of Series A? Are we going to have IPO seed rounds in 5 years?

<comment><AUTHOR> I don't think so. If you don't receive any seed round, it should be considered a series A because it was $11M?</comment></comment>


Somewear: limitless communication built for adventure - <AUTHOR> https://www.kickstarter.com/projects/124657937/somewear-limitless-communication-built-for-adventu <comment><USER2> I wonder what happens if you're in the wild and you've used up all of your plan messages for the month?

<comment><USER3> Hey there - I'm on the team at Somewear and if you've hit your data limit there is a simple overage fee for however much you go over. We don't block people and the overage fee is only slightly higher than standard rates.</comment></comment>


Sergey Brin shows off Project Glass - Amazing or Disappointing? - <AUTHOR> http://www.robgonda.com/2012/05/31/sergey-brin-shows-off-project-glass-video/ <comment> jack-r-abbit Amazing or Disappointing? My answer is _Prototype_. I have been interested in a wearable computer for many, many years. I look forward to seeing Glass evolve from a proof of concept into an actual product. I'll reserve my amazement and/or disappointment for when that time comes. Until then... it is just a prototype.

</comment><comment><USER2> This interview with Sebastian Thrun is a bit more revealing.

<http://www.charlierose.com/view/interview/12321>

</comment><comment><USER3> Wait, the Lieutenant Governor of California, a sitting public politician, has his own TV show?

<comment><USER4> Via SF Examiner:

"A spokesman for the lieutenant governor's office said in a phone interview that the show will be for Newsom to promote California, which Newsom has been doing since talking office in January 2011. The show, his office said, will be separate from his political office, and no state funds will be used for the show."

There must be a better use of his time as the second-in-command of the largest state in the U.S. and one of the world's largest economies.

[http://www.sfexaminer.com/local/2012/04/gavin-newsom-host- sh...](http://www.sfexaminer.com/local/2012/04/gavin-newsom-host-show-current- tv)

<comment><USER5> Maybe not. Like VP of the US, LG of CA is largely a ceremonial role. [https://en.wikipedia.org/wiki/Lieutenant_Governor_of_Califor...](https://en.wikipedia.org/wiki/Lieutenant_Governor_of_California)

</comment></comment></comment><comment><AUTHOR> comment from the blog via Axure:

People severely underestimate how hard it is to build a head-mounted display that is small, light and provides good, high-res image. To do it cheaply adds another order of magnitude of difficulty. It has been the pursuit of many technology companies for decades.

I'm pretty sure, the Vuzix device is in the tens of thousands of dollars. And it's on a wire.

Oakley might hint all they want, as many companies have over the years, but they admit themselves in the article you've linked to that they've been chasing this unicorn since 1998.

And devices like the Epson Moverio BT-100 or Sony HMZ-T1 are a whole different class: they're entertainment clunkers that you wouldn't wear on your head on the street. What Google will likely offer is of unprecedented size and weight, bearable looks to wear among real people (not nerds), it's wireless, capable of linking with your device of choice (smartphones, possibly laptops), and will have to carry price tag acceptable for more affluent consumers (say, those who can afford iPhones and top-of-the line Android phones). So, when you ask, is it really that hard, I would respond: you have no friggin' idea.

</comment><comment><USER6> It seems that this would rather drastically interfere with your peripheral vision. Looking at Sergey wearing it at 0:17 in the video, it looks like around 60% of the right side of his view is obstructed by the device. While certainly some cool tech, I'm skeptical about how well that would integrate into your daily experience.

You certainly wouldn't want to wear it while driving or operating equipment.

</comment><comment><USER7> Not a serious comment, but that image of Sergey reminds me a lot of the Bill Gates "borg" icon that Slashdot liked to use. How ironic is that?

</comment><comment><USER8> i think the key to remember when looking at google vs possible competitors isn't the actual hardware, but the software behind the glasses. Yes, Oakley might be making their own HUD glasses, and they will probably be very good looking and functional, but will they be useful.

</comment><comment><USER9> "Don't touch the pad on the side" ..... prototype or not, what kind of usability nightmare is that? You put on glasses by grabbing the sides.. The control should be based on your eye movements or something like a watch.

<comment> jack-r-abbit > _prototype or not, what kind of usability nightmare is that?_

The kind that allows you to figure out what works and what doesn't.

I guess it has been almost 2 years now but I recall a certain phone maker giving the advice "don't hold it that way" when an actual product (in the store... being sold to millions) was experiencing an issue of that nature. I think they survived that. :)

</comment></comment><comment><AUTHOR> You would think Google would do better ... also, if it's a prototype that doesn't do anything, why Google is building hype by having Sergey and Sebastian Thrun wear it in public?

</comment><comment><USER10> To anybody saying this is disappointing, please watch this:

<http://youtu.be/grxL5umOE6g>

</comment><comment><USER11> Yeah, that's what I want, another way for people in a conversation to not pay attention to me.

</comment><comment><USER12> To me that's rather disappointing for 2 years work and the announcements made before this.</comment>


Slack's secret to growth might be desktop software - <AUTHOR> https://sprint.ly/blog/slack-chat-secret-growth/

<comment><AUTHOR> Anyone looking to build their own desktop application with JavaScript, Node and Electron should take a look at bojzi's tutorial:

[https://medium.com/@bojzi/building-a-desktop-application- wit...](https://medium.com/@bojzi/building-a-desktop-application-with- electron-204203eeb658)

<comment><USER2> I chose node-webkit, came to know about Electron later. It was too late to switch. I am going to release my desktop app made in node-webkit soon. It has got its own quirks. But the app development time was fast and I could leverage the nodejs plugins as well as the jquery for the app. I am sure this applies for Electron too.

<comment><AUTHOR> Electron looks really solid, especially since GitHub is supporting it as open source.</comment></comment></comment>


Callogram - <AUTHOR>

New photo sharing app that brings caller ID into the 21st century.  Currently allows users to select and assign an image to other users and then when that user is called the image appears on the other end of the line.  Essentially makes each call a mini surprise.  We are close to allowing users to assign a short five to ten second video, but struggling with codecs.  Any ideas other than third party solutions?<p>The google play address for the app is: https://play.google.com/store/apps/details?id=com.callogram.android&feature=nav_result#?t=W251bGwsMSwxLDMsImNvbS5jYWxsb2dyYW0uYW5kcm9pZCJd <comment><USER2> I'm assuming both the caller and receiver need the app installed? If so, that's tough, but not undoable.

If you want people to actually download it, you really should invest a few hundred dollars on 99Designs and get a decent app icon.</comment>


Python Flask NSA Backdoor - <AUTHOR> https://github.com/plausibility/flask-nsa?=hn <comment><USER2> This isn't about a backdoor in NSA's Flask (SELinux). This title will be misunderstood. Add [python] or [parody] or something.

<comment><USER3> Got a link for that? I've honestly only ever heard of the Python Flask, never the other.

<comment><USER4> > "Security-enhanced Linux (SELinux) is a reference implementation of the > Flask security architecture for flexible mandatory access control."

[http://www.nsa.gov/research/selinux/faqs.shtml](http://www.nsa.gov/research/selinux/faqs.shtml)

<comment><AUTHOR> That's quite a weird naming coincidence in this case!

</comment></comment></comment></comment><comment><USER5> Alternatively, a more popular version for Rails: [https://github.com/goshakkk/nsa_panel](https://github.com/goshakkk/nsa_panel)

<comment><USER6> That's actually what this was based off of, funnily enough!

</comment></comment><comment><USER7> Looks like a fairly useful admin console actually. Time to fork it!

</comment><comment><USER8> I still feel that this title is misleading, since I understood it to mean "there is a backdoor in Flask, and here is the evidence" before I clicked through.

</comment><comment><USER9> Little bobby tables is at it again...

</comment><comment><USER10> I think this is actually not as funny as the real thing. As far as I can gather, FISA 702 orders [http://www.govtrack.us/congress/bills/110/hr6304/text](http://www.govtrack.us/congress/bills/110/hr6304/text) , used to target non-resident aliens, don't require the NSA to state that "I think they are a terrorist" or give _any reason or justification at all_ for wanting all your data to the FISC court, let alone to the website operators.

</comment><comment><USER11> NSA Backdoor as a Service a.k.a NSA BS

<comment><USER12> Funny, I would have turned it into an acronym of NSA Baa'S. Then we could give them a sheep as a mascot and everything would work.

</comment></comment><comment><USER13> According to Snowden the NSA is very good at MITM attacks.

No parody needed to something that alarming.

And joking about it only dilutes an extremely serious concern.

</comment><comment><USER14> Shouldn't the NSA image say "Verizon" and not "AT&T"?

<comment><USER15> In 2009 AT&T was found to have systems installed by the NSA in their wiring rooms that made a replica of all data coming into those rooms.

source: [http://www.pbs.org/wgbh/nova/military/spy- factory.html](http://www.pbs.org/wgbh/nova/military/spy-factory.html)

</comment></comment><comment><USER16> Why not code it in Clojure or Lisp?</comment>


Ask HN: Anyone willing to hear me practice my 6 min pitch via Skype? - <AUTHOR> I need to practice my pitch.<p>Anyone willing to hear it via skype and give feedback? <comment><USER2> Upload it to YouTube as an unlisted video and submit the link to HN so we all can watch your pitch.</comment>


Sorry, Linux. Kubernetes is now the OS that matters - <AUTHOR> https://www.infoworld.com/article/3322120/kubernetes/sorry-linux-kubernetes-is-now-the-os-that-matters.html <comment><USER2> Wat. Kubernetes is not an OS. It's an orchestration system. It orchestrates docker containers which run... Linux. This article was vomited out by someone without even the most basic understanding of what they are talking about. Or maybe I am missing the joke? Is this a deliberately absurd article?

<comment><USER3> It's an somewhat provactive when stated that shortly as a thesis, but the thrust is Kubernetes has significant more value as an _economic concern_, not as a _system critical engineering component_ like the HN comments are taking it.

With the evidence cited, it is a powerful argument

</comment></comment><comment><USER4> Something tells me Linux guys/gals will still be the ones getting calls when the Kubernetes instance explodes.

<comment><USER5> Something tells me we'll all stop hearing about Kubernetes someday but we'll still be talking about Linux.s

</comment></comment><comment><USER6> I'm impressed. This article reads like a successful troll post during the golden era of Slashdot.

</comment><comment><USER7> Holy popups on that site. There was a thick "want more InfoWorld" banner in the center of the page for most of the visit.

</comment><comment><USER8> I've seen this statement many times... But does Kubernetes run on hardware natively? Of course not. Does Kubernetes not use containers, which in turn use some kind of linux bootfs? Is Linux not more important than ever, since we now put Kubernetes into OpenStack to spawn thousands of containers..?

"Kubernetes is the new $X" generates a lot of clicks I guess...

<comment><USER9> Remember how Docker was the replacement of everything... 6 months ago? :)

<comment><USER6> People have been saying that since 2014 at the least. We're still waiting.

</comment></comment></comment><comment><USER10> Kubernetes and Serverless...no hardware required :D

<comment><USER11> It just runs in the clouds!!!

</comment></comment><comment><USER12> This site is cancer, after clicking 5 popups, I was asked to sign in to read the full article.

</comment><comment><USER13> Thank you all for giving this article the treatment it deserves.</comment>


What It's Really Like to Risk It All in Silicon Valley - <AUTHOR> http://www.nytimes.com/2016/02/28/upshot/what-its-really-like-to-risk-it-all-in-silicon-valley.html?action=click&pgtype=Homepage&version=Moth-Visible&moduleDetail=inside-nyt-region-5&module=inside-nyt-region&region=inside-nyt-region&WT.nav=inside-nyt-region <comment><USER2> How would NYers react if the San Francisco _Chronicle_ referred to Bronx or Queens as Manhattan? SF is not in Silicon Valley.

/rant

</comment><comment><USER3> Hey man, this has been posted six times in the last 24 hrs.

Look at the "past" button. You may want to delete this.</comment>


Ask HN: A Big Company was hacked, they won't admit it. What can I do? - <AUTHOR> A long time ago I submitted a custom e-mail address to a VERY large organisation for an in-store discount. Now, several months later I've begun receiving 419 scams and fake invoice phishing emails.
This is an address that you really can't just guess.. And it's the only address I'm receiving them on.
The company will not admit they've been breached. Nor will they tell me which parties my information has been supplied to.
Just as well I can block all emails being sent to that address now.. The exact reason I set it up this way.
I can confirm with friends who also signed up that they've started receiving the same emails.
Here's the kicker. It's illegal for them not to notify us of a breach in this country (Australia).
What can I do? <comment><USER2> Tell the regulator. I assume there is a regulator if it's illegal for the company to not tell you about a data breach?

</comment><comment><USER3> BigCo may not have been hacked. Could also be that they sold your data. Either to someone unethical or to someone who resold it or to someone who got hacked.

</comment><comment><USER4> Sending an e-mail to Krebs with all the details sounds like a good first step.

</comment><comment><USER5> Gather as much detail as you can and tell a journalist. Sunlight is the best disinfectant.</comment>


Christopher Domas: Hardware Backdoors in X86 CPUs - <AUTHOR> https://github.com/xoreaxeaxeax/rosenbridge <comment><USER2> VIA/Centaur C3 processors are internally RISC and the front end converts x86 instructions into RISC instructions that the processor executes. People used to ask "can I generate native RISC code?" and Centaur always said no, but you know they must have debugging functionality to do that.

And now someone has discovered that sometimes you can enter debug mode from ring 3 and they're calling it a backdoor.

<comment><USER3> How is it not a backdoor? Just because it's unintended or due to a very complex reason doesn't mean it's not one.

<comment><USER4> Well, if it's a documented feature, I'd call it that. You don't call "single user mode" a backdoor.

Granted, you can disable single user mode.

<comment><USER5> According to the datasheet, this is by design:

"The mechanism for initiating execution of this alternate set of instructions is as follows: 1\. Set the FCR ALTINST bit to 1 using WRMSR instruction (this is a privileged instruction). This should be done using a read-modify-write sequence to preserve the values of other FCR bits. 2\. The ALTINST bit enables execution of a new x86 jump instruction that starts execution of alternate instructions. This new jump instruction can be executed from any privilege level at any time that ALTINST is 1."

So to turn on the ability to execute ring-0 non-x86 instructions from ring 3, requires an initial privileged instruction. I believe (from other commenters) that the issue arises because some of the cpu's left the fab with ALTINST set to 1 by default. Meaning, no privileged instruction required. Clearly, that's a fuck-up somewhere.

</comment></comment></comment></comment><comment><USER6> They so clearly titled this "X86 CPUs" instead of "VIA C3 CPUs" or "VIA C3 x86 CPUs" on purpose.

Clickbait title in my opinion, they wanted the casual observer to confuse this with Intel/AMD at first glance.

</comment><comment><USER7> This is by the same badass who wrote a compiler that generates only MOV instructons [1]

[1] [https://github.com/xoreaxeaxeax/movfuscator](https://github.com/xoreaxeaxeax/movfuscator)

<comment><USER5> Thanks for that little side-bar/rabbit-hole. Fascinating, as is the paper he based it on. I'm itching to get home and try this out - specifically, I'm interested on what the performance might be like.

<comment><USER8> performance: something that takes seconds now takes hours.

ah, here it is - branchless doom (in the validation/doom directory - [https://github.com/xoreaxeaxeax/movfuscator/tree/master/vali...](https://github.com/xoreaxeaxeax/movfuscator/tree/master/validation/doom) ):

> The mov-only DOOM renders approximately one frame every 7 hours, so playing > this version requires somewhat increased patience.

</comment></comment></comment><comment><USER9> These were designed by Centaur Technology (based in Austin, TX), I'd love to hear from any alums (danluu?) what the purpose of the coprocessor is.

BTW there's an interesting documentary about Centaur, free to watch on Prime Video.

[https://www.amazon.com/Rise-Centaur-Glenn- Henry/dp/B01FSZU6F...](https://www.amazon.com/Rise-Centaur-Glenn- Henry/dp/B01FSZU6FK)

<comment><USER10> > _I 'd love to hear from any alums (danluu?) what the purpose of the > coprocessor is._

Absolutely agree there, I can imagine it being ridiculously interesting.

But the truth might also be equal parts boring and scary instead. I mean...

> _The backdoor allows ring 3 (userland) code to circumvent processor > protections to freely read and write ring 0 (kernel) data. While the > backdoor is typically disabled (requiring ring 0 execution to enable it), we > have found that it is_ enabled by default _on some systems._

> _The core executes these commands (which we call the 'deeply embedded > instruction set'), bypassing all memory protections and privilege checks._

> _The rosenbridge backdoor is entirely distinct from other publicly known > coprocessors on x86 CPUs, such as the Management Engine or Platform Security > Processor; it is more deeply embedded than any known coprocessor, having > access to not only all of the CPU 's memory, but its register file and > execution pipeline as well._

This is enough anti-plausible-deniability that I can just sweepingly point everybody in the direction of the big fat (flashing!) elephant in the room and the "..." sitting next to it.

I mean, VIA didn't have as much success as Intel or AMD, but they _are_ a known name. Anything that implements x86 is going to have market penetration to some extent, and VIA achieved success in the industrial and embedded sectors.

If danluu was able to comment here and debunk what I'm saying, I would be both very surprised and even more delighted.

<comment><USER11> If I knew anything non-public (and in this case I don't -- this is from before my time there), I wouldn't be able to talk about it :-)

This has now been pointed out in another thread, but this feature is documented in the datasheet here: [http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemia...](http://datasheets.chipdb.org/VIA/Nehemiah/VIA%20C3%20Nehemiah%20Datasheet%20R113.pdf). See Appendix A, A-9 & A-10, as well as the section on CPUID bits.

</comment></comment></comment><comment><USER12> Title should be renamed to: Hardware Backdoors in Obscure x86 CPUs made in 2003.

<comment><USER13> ... and embedded in ATMs with a 20 year life span.

Your comment sounds a bit dismissive of the vulnerability with an implication that it would never be a problem. If that was _not_ what you were implying I apologize. It is critical that even "old" chips vulnerabilities be understood so that one can understand the risks. It pains me terribly every time I power up the Agilent signal analyzer in the lab and it boots Windows XP on its Pentium III chip.

<comment><USER14> I wonder if any of these chips ended up in electronic voting machines?

<comment><USER15> That is one place you don't need hacking CPUs to hack the result. Plain files vetted by no one etc etc.

</comment></comment></comment></comment><comment><USER16> > VIA processors are renowned for their low power usage and excellence in > embedded designs; we believe that the functionality described was created in > good faith as a useful feature for the embedded market, and was > unintentionally left enabled on some early generations of the processor.

What is the use of this feature?

<comment><USER17> I could see using a secondary core as a watchdog in an embedded environment-- if something went too wrong, perhaps the secondary CPU can either get some valuable logging data or stuff the system with code designed to restore it to a controllable state.

</comment></comment><comment><USER18> We should go back to real mode. Imagine all the sudden possibilities. No pesky memory barriers, no protection faults and superb integration of applications of all kind. Application could even share the same memory and the better one wins.

"If nothing is secure, everything is secure" \- Lincoln

But seriously: I don't think this "feature" is a real backdoor. It is nonetheless an interesting topic.

I am more concerned about bugs and backdoors in modules like TPM/ME or other even less documented surprises. Wouldn't be the first time that happened and we can only hope, that better people find these type of vulnerability first.

<comment><USER19> Have you heard of Temple OS? It's an operating system where everything runs in ring 0.

<comment><USER18> Never heard of it but it seems interesting. Exceptional crazy perhaps but I will definitely take a deeper look.

</comment></comment></comment><comment><USER20> Sandsifter was pure genius, I can't wait to read the whitepaper for this one!

<comment><USER21> The talk is worth its weight in gold [https://www.youtube.com/watch?v=KrksBdWcZgQ](https://www.youtube.com/watch?v=KrksBdWcZgQ)

</comment></comment><comment><USER22> Seems via specific? Rather than "all x86"

<comment><USER23> This is still a huge target. I used to be in point of sale engineering, and the majority of the quality terminals the big OEMs(NCR and their sub brands, posiflex, etc) were pushing were running these for a LONG time past when you'd think C3 was "dead". Similar vendors i bumped into were pushing stuff with them in it still when i got out of that industry.

There are a LOT of machines out there which will be run essentially until they break down(and a lot are fanless, and will pretty much last until they can't be kept up to date). You have to remember, a lot of big chains(and banks!) paid for extended XP support and then extended-extended XP in the form of windows POS.

This is a "every terminal in a huge fast food chain gets owned and no one finds out for years" sort of vulnerability. This is the first step to something like the target breach all over again.

<comment><USER24> >This is a "every terminal in a huge fast food chain gets owned and no one finds out for years" sort of vulnerability. This is the first step to something like the target breach all over again.

Utter nonsense, this bug will not lead to RCE.

You might be able to implement a fancy rootkit with this, but that's all. Advanced rootkit tech is neither necessary nor particularly helpful for these sorts of breaches.

</comment></comment></comment><comment><USER25> Documented instruction set switch which is just implemented poorly. But the real news here seems to be that the ALTINST is set to 1 by default in some C3 generations.

</comment><comment><USER26> [https://www.reddit.com/r/programming/comments/95zgaq/rosenbr...](https://www.reddit.com/r/programming/comments/95zgaq/rosenbridge_hardware_backdoors_in_x86_cpus_repo/)

</comment><comment><USER27> This is a HUGE wake-up call.

It really is incredible to see that a third party apparently has discovered a genuine backdoor in a production CPU with completely independent research. If that's within reach for a standalone researcher, what secrets lie in well- funded organizations at the nation level?

Perhaps this will bring further mindshare to the RISC-V approach in the future?

<comment><USER28> That would be nice, but I'm more hopeful in the immediate for openpower to gain widespread usage on the desktop. Google seems to be banking on it for servers, at the very least.

<comment><USER29> Isn't openpower not actually very open? At least with RISCV we can compete vendors while maintaining a compatible instruction set, I'm not sure how many people are going to produce openpower chips.

<comment><USER30> In the long term, I think you have a point here. It would be nice to have IBM not being the only producer of, say, the POWER15. In that sense RISC-V is substantially more open than OpenPOWER.

But parent was talking about in the immediate timeframe, and right now (and I predict for the next few years at minimum), if you want free(r) and ballpark performance class with x86, then you're going to have to play with POWER. I don't think ARM is there yet with respect to grunt and some ARM designs have some of the same concerns about creepy dark corners of the processor die. It's why there's a Talos II under my desk.

<comment><USER29> I wanted one of those, just couldn't justify the price. I've been toying with the idea of running Reactos or Haiku on an FPGA as a cheaper "you own it as much as possible" variant.

</comment></comment></comment></comment></comment><comment><USER31> This is absolutely insane! With all the recent bugs and features that _looks_ like backdoors I have completely lost faith in x86.

We need simple open ISAs (like RISC-V) and a handfull of trusted organizations that inspect the manufacture processes to protect ourselves from this. A bit like how countries and organizations send people to inspect other countries democratic voting processes, or like how IAEA inspect nuclear stockpiles etc.

I call for:

\+ Open source.

\+ No creeping featurism.

\+ Multiple inspection organizations that watch the process from source code to final chip product.</comment>


Why the lazy coder in you would enjoy Project Lombok - <AUTHOR> http://zeroturnaround.com/rebellabs/why-the-lazy-coder-in-you-would-enjoy-project-lombok/

<comment><USER2> The trouble is, Lombok extends your compiler and needs to be integrated into your IDE. So you actually face most of the problems you'd have when moving to a new language. And it's actually easier to just switch to Scala, where this kind of functionality is built in (case classes).</comment>


Liberia students all fail university admission exam - <AUTHOR> http://www.bbc.co.uk/news/world-africa-23843578

<comment><USER2> I am sure some will read this and believe it to be a tragedy. Yet I am happy to hear that the administration and University officials are maintaining their standards. Over the long haul this will be for the benefit of everyone as it will help them identify issues with in their curriculum and education system.

I do understand that they are in very trying circumstances and are making do with what they have. Yet by setting the bar high and not making excuses for not meeting it they are setting themselves up for long term success. I would not be surprised to see them turning out great students in the next 5 years.

<comment><USER3> I had the exact same feeling. It's tough to swallow failure, but I hope the students accept that the bar is high for their own good. Or else, going above it means little.

</comment></comment><comment><USER4> Zero? Sounds like they just want an excuse to cut the budget. Middle schools in Iowa pull a similar con by making standards artificially high to take pre algebra. The consequence is very few students taking calculus; thus the district has to fund very few AP classes or students taking freshman college classes at school district expense.

</comment><comment><USER5> I'd hope there are reasonable bridging course options for those who'd like to persist rather than abandon their dreams.

</comment><comment><USER6> Lack enthusiasm? If not before, they will now. A clean seep like this sounds fishy.</comment>


Gmail To Roll Out Ads That Learn From Your Inbox - <AUTHOR> http://techcrunch.com/2011/03/29/gmail-to-roll-out-ads-that-learn-from-your-inbox/

<comment><USER2> Of course, since the original Gmail ad privacy fears were raised, Facebook has come along and gone much further.

</comment><comment><AUTHOR> I guess the important thing here is that this system is isolated from the rest of the adsense platform.

</comment><comment><USER3> The important thing is that they still can't read your mind...right?</comment>


Ask HN: What web browser engines are under active development? - <AUTHOR> With the recent layoffs at Mozilla, I'm wondering quite simply: which browser engines are actively being developed, and which browsers are using them? From what I understand, we're just left with WebKit, Gecko, and Blink?<p>Are there any other engines in active development? <comment><USER2> There's something called Servo, although from what I understand, it's not going to be presenting any mainstream competition to Chrome any time soon.

[https://servo.org/](https://servo.org/)

<comment><USER3> Most of the team were laid off [0], Servo was a Mozilla project. They're still reeling, but it looks like Mozilla will be moving their efforts to Firefox proper, rather than integrating the best parts of Servo into Firefox.

[0] [https://github.com/servo/servo/discussions/27575](https://github.com/servo/servo/discussions/27575)

</comment></comment><comment><USER3> lynx is still under active development, so that might count. It uses a fork of libwww as the engine.

Goanna is a fork of Gecko for Pale Moon, but development is slow.

KHTML is basically in maintainence-only, but is WebKit's ancestor.

</comment><comment><USER4> Ghost Browser

<comment><USER5> Ghost browser is chromium based. Says it right on their website: [https://ghostbrowser.com/](https://ghostbrowser.com/)</comment></comment>


Reverse Proxy Performance – Varnish vs. Squid (Part 2)  - <AUTHOR> http://deserialized.com/reverse-proxy-performance-varnish-vs-squid-part-2/

<comment><USER2> In other news: a Ferrari is faster than a four-door luxury sedan, hummingbird wings move faster than those of an eagle, and a racing horse is faster than a pair of pack mules hauling a wagon.

Varnish is cool, but it's not a replacement for Squid. It can address some aspects of the problem space, but nowhere near the majority of them.

This also fails to discuss the configuration of the proxies. The thing is...Squid operates on a huge number of platforms, and the default configuration favors compatibility and reliability over all else. Asynchronous IO, cacheability and expiry rules, memory and disk usage, etc. all make a big difference in performance, concurrency, and cache hit rates.

There are arguments to be made for using Varnish in some deployments, just as there are arguments to be made for using nginx or Lighttpd instead of Apache. But, there are also trade-offs.

<comment><USER3> _It can address some aspects of the problem space, but nowhere near the majority of them. [...] There are arguments to be made for using Varnish in some deployments_

Since you, presumably, have some experience with Squid and/or Varnish and the 'problem space' could you perhaps discuss or opine more concretely on that? It can be surprisingly difficult to derive useful information from indignant metaphors about Ferraris and eagles.

<comment><USER2> Yes, I do have some experience in the area. I was a core Squid developer for several years, and my previous startup was a proxy caching appliance vendor. I have been aware of Varnish for years, and have experimented with it several times over those years.

Varnish has narrowed the feature gap quite a bit over the years, but it's still not particularly narrow, and Squid hasn't been standing still.

I will admit that I have never deployed Varnish in production, while my experience with Squid spans thousands of servers, so I know a lot more about Squid than Varnish. And, it's been three years since I worked in the field at all. Both products have evolved quite a bit in that time (including a major rewrite in C++ for Squid).

Nonetheless, after a quick perusal of the docs for Varnish, I can say that for pretty much everything Varnish can do, Squid generally has three or four different tactics built in for approaching the same problem. Caching policies, ACLs, source selection (whether load balancing, hash-based source selection, etc.), logging, authentication, encryption (Squid supports SSL on either side, Varnish doesn't support SSL in any form, as far as I know), other protocols (I once deployed Squid for a top three computer manufacturer across several worldwide offices to allow their customers to access formerly FTP only support resources via HTTP; not possible with Varnish), etc.

Actually a luxury sedan vs. a Ferrari isn't really appropriate...Squid is more of a Winnebago filled with goodies, while Varnish is a stripped down (but very, very fast) race car. Both have their place. If all you need is what Varnish can do, then you should use Varnish. My metaphors were not indignant, they were intended to be illustrative of the difference in design goals of the two projects. One seeks to solve a wide variety of web caching and website acceleration problems with excellent platform compatibility, good performance, good security, good reliability, and reasonable configuration. The other seeks to solve a very small set of website acceleration problems with excellent performance; performance is, and always has been, the primary motivation driving Varnish, and it is very successful by that metric.

My point was not to criticize Varnish, but to point out that it is a solution to a very specific set of problems, and that in my seven years of working in the website acceleration industry, I rarely came upon a deployment that would have been well-served by those particular features; if I had, I very likely would have deployed Varnish instead of Squid. I am agnostic when it comes to Open Source software, as long as the quality is high, and in this case quality is high for both projects. But most of the time, the customer needed several of those other features of Squid, and performance was only third or fourth on the priority list.

</comment></comment></comment><comment><USER4> We use varnish at vg.no (online newspaper) Its quite effective for unpersonalized content. We run 2 varnish boxes, each of them sees ~2-3k requests / sec. Backend sees only ~30 req/sec..so pretty good cache ratio.

For personalized content esi seems to be the way to go, but havent tried that yet.

</comment><comment><USER5> What are the use cases for setting up reverse proxies for production web apps (of medium to small scale) versus using a CDN like Panther Express/CDNetworks?

(Genuinely curious)

<comment><USER3> There are lots of good reasons that go beyond content caching (which is the topic of the article).

Somewhat terse write-up here: <http://joshua.schachter.org/2008/01/proxy.html>

The basic idea is that there's fair bit of useful logic that can be handled by a simpler, lighter-weight, more easily securable front-end system than the lumbering tank that is your app server. This includes basic load balancing/failover, partitioning (requests of type foo go to these servers, all the low-latency ajax stuff over there, static content somewhere else), babysitting slow clients, blackholing malformed requests, etc.</comment></comment>


Why I Left Google - <AUTHOR> http://spencertipping.com/posts/2012.0530.why-i-left-google.html

<comment><USER2> Fascinating account, but even more fascinating is the author's consultancy:

<http://spencertipping.com/zeroconsulting/>

 _You email me with a problem you'd like me to solve. (Be sure to put "zero" in the subject so that my email filter catches it.) This could be anything: a debugging project, advice about something, a library you need, end-user code, etc. Anything you send me is confidential. I'll then follow up with you with any additional information I need and any initial impressions I have._

 _I will then try to implement a solution _and will never send you a bill_. I may or may not be able to implement something, depending on a variety of factors including my skill set. If I'm successful, I'll send you what I come up with. You may, at your option, pay me whatever you think my solution is worth. It's fine if this is nothing at all; that's useful information for me (I won't nag you about it, for instance)._

<comment><USER3> Wow, that's cool. Clearly a guy with a love for the art. I'd be interested to hear how this approach works out for him and the breakdown of his project offers once he's been at it a while.

</comment></comment><comment><USER4> So, one of the major reasons is because you don't like Java. I don't like some things people do with Java, but generally it is indeed good enough. In fact, as far as I'm aware, there are three official languages in Google: Java, C++ and Python. Wasn't it possible to get assigned to python stuff?

<comment><USER5> Agreed. To be honest I don't see why he left...from his description it would almost make me want to work there.

Java and C++ have their problems, but in general they work very well. If I was in charge of software development at Google I wouldn't be using some obscure language.

I agree with his comment about bugs...Google's products seem very buggy, and they don't seem to give much of a crap about fixing them.

<comment><USER6>
            Google's products seem very buggy, and they don't seem to give much of a crap about fixing them.

That's the essence of Silicon Valley right there. The Cool Kids don't fix bugs. They don't test their code much beyond "Well, it doesn't crash for me.". The Cool Kids only write new code using the latest and greatest programming languages - because they're cool, naturally. (Yes, this flies in the face of the JavaJavaJava slant mentioned in the article - must be some interesting forces there to keep all of the Interns and College Grads from incessantly advocating for whatever teaching language they used in school.)

</comment></comment></comment><comment><USER7> "My experiences working with this committee were completely positive, but there was often a two-month lag before I got an official reply from them." -- he's describing the situation where they own everything you do if it has anything to do with them.

I have a pet hypothesis which is that these non-competes are strangling innovation in the Valley (and beyond). I know I personally made sure to shut off the "ideas" part of my brain until I was free and clear lest they try to claim ownership of things I would later invent.

This "delay for long enough to kill it" thing happened to a friend of mine. I wrote about it here: <http://rachelbythebay.com/w/2011/09/16/squashed/>

<comment><USER8> First, this is not the normal open sourcing process. He says "This uncertainty bothered me a lot, since I wasn't sure whether my project could be legally released as open source.". The normal open sourcing process takes about 3-7 days. If he really wanted certainty about releasing it as open source, he could have gone through that process and been done with it.

The process he is talking about is the process of Google granting ownership of various IP rights that google would normally own, to the employee. For various reasons (ethics, patents, copyright, etc) this is more complicated, and takes longer. Google is one of the few large companies that even lets you do this, AFAIK. The humorous part of all this is that the page describing the process, states quite clearly it will take about 2 months to make a decision. So it's not like the 2 month wait was unexpected, either, and phrasing it like he does implies that there was some amount of uncertainty in the time period where he was being strung along, which is simply not the case.

</comment></comment><comment><USER9> "Coding standards and reviews prevented bad low-level decisions, but not bad high-level ones"

This is true for coding standards and reviews everywhere. That's what _design_ standards are for -- i.e. some kind of process around specifying a technical design.</comment>


A Study on the Prevalence of WebAssembly in the Wild [pdf] - <AUTHOR> https://www.tu-braunschweig.de/Medien-DB/ias/pubs/2019-dimva.pdf <comment><AUTHOR> I've been less optimistic about WebAssembly than most HN commenters, but I was still surprised by this paper. WebAssembly is being used at all on less than 0.2% of sites; those uses boil down to just a couple of hundred of unique modules; and half of the use is malicious.

Why is WebAssembly such a flop? I would argue it is because it solves a problem that very few web developers face (pure computation speed) at the cost of worsening a problem that very many web developers face (complexity of the web platform).</comment>


Why Some Teams Are Smarter Than Others - <AUTHOR> http://www.nytimes.com/2015/01/18/opinion/sunday/why-some-teams-are-smarter-than-others.html <comment><USER2> _Finally, teams with more women outperformed teams with more men. Indeed, it appeared that it was not "diversity" (having equal numbers of men and women) that mattered for a team's intelligence, but simply having more women. This last effect, however, was partly explained by the fact that women, on average, were better at "mindreading" than men._

I wonder how this article would have been received if it stated : 'Teams with more men performed better. This can be explained by the fact that men, on average, are better at solving certain problems than women'. I almost never hear about a scientific study where they discover that men are better than women at something.

<comment><USER3> I thought I'd add a few tidbits here on gender differences.

I play women's football and coach high school guys football. Football is one of the most teamwork-dependent sports out there. Everyone has to be doing his job every single play. There's no way for one player to carry the team.

Before I started coaching guys' football, I had heard consistently from other coaches in my women's league that women are way easier to coach than men in the game of football. Reasons given included less attitude, less individualism, less ego, more willing to work together, etc. When I started coaching high school ball, this was exactly the case. So much of my time was wasted beating the individualism out of these boys and getting them to play for each other, not themselves.

Maybe it's that football attracts a certain type of male. But I think women might be more naturally disposed to working on a team than men on average.

<comment><USER4> I'm pretty sure Manning and other great QBs were capable of carrying entire teams. Not to argue your point, with which I agree, but just saying :)

<comment><USER5> I don't see how even an exceptional quarterback can be effective if the offensive line and other backs don't block consistently well, or if the receivers don't consistently run the right routes, escape their coverage, actually catch the ball, and run well with it after the catch, or if the running backs don't find the holes the line must create, make good cuts, deflect tackles, and never fumble, or if the place kicker and/or punter don't consistently deliver when one of those things goes wrong, or if despite doing all that stuff right the defense never makes a stop.

<comment><USER3> I agree. Offense can't do anything without a solid line. QB would be sacked every play and RBs would be tackled for loses all day long.

Talk to any football coach and they'll tell you how critical the line is to the entire offense. Our old QB used to cook a special dinner for all her o-line every season as a thank-you.

</comment></comment></comment></comment></comment><comment><USER6> This part:

"Online and off, some teams consistently worked smarter than others. More surprisingly, the most important ingredients for a smart team remained constant regardless of its mode of interaction: members who communicated a lot, participated equally and possessed good emotion-reading skills."

can be read as a variation on John Boyd's OODA loop. Boyd made the point, repeatedly, that in war and sometimes in business, victory typically goes to whoever can iterate through ideas more quickly, as new information comes in. The winners are not necessarily smarter, they simply iterate faster based on the information they have. And the same seems to be true of the teams being described here.

<comment><USER7> More information on OODA: [http://en.wikipedia.org/wiki/OODA_loop](http://en.wikipedia.org/wiki/OODA_loop)

</comment></comment><comment><USER8> My guess is that what make a group successful in the short run, like if you throw a group of strangers together and tell them to do tasks together in a monitored environment for 5 hours, may not be the same things that make a group successful in the long run.

The importance of emotional intelligence should decrease as roles are carved out and members define their niches, and the importance of individual ability should increase as the group optimizes itself.

<comment><USER9> That sounds nice, but my experience is usually that people start to build fiefdoms that they don't want other people messing with, intraoffice politics gets involved, and groups become less and less about solving problems and more about individuals working for their own promotions.

<comment><USER8> That's a complex system of overlapping and competing subgroups hopefully functioning together as one large group. I would expect that to be more complicated.

</comment></comment></comment><comment><USER10> I might be wrong, but I had a look at the original paper's methods and the experimental process seems to be based around producing many p-values and then trawling looking for significance. They don't seem to correct for multiple- testing outcomes though. This resembles what's been described as p-hacking ([http://www.nature.com/news/scientific-method-statistical- err...](http://www.nature.com/news/scientific-method-statistical- errors-1.14700))

I could well be missing something though, so please correct me if I'm off the mark.

</comment><comment><USER11> People overvalue (democratic) teamwork. I'd like to argue that a good leader with a team of followers is more effective than a team where everyone is equal. For example: the pyramids, cannot be build by one man, but wouldn't have existed if it wasn't for central leadership.

Take Steve Jobs, it was his vision that made Apple successful.

Teams need skill, but they must also be undivided. Democracy in teams essentially divides the team, those opposed and forced to act according to the majority will not be cooperative. The best results are that of a single visionair with or without a team of followers.

<comment><USER12> > For example: the pyramids, cannot be build by one man, but wouldn't have > existed if it wasn't for central leadership.

Because they were valueless items to the thousands of people that it took to slave and die creating them? Yes, those things probably wouldn't have been erected if it were a democratic society at the time. I don't see how that's a bad thing.

The Pyramids are in fact a perfect example of the perils of the "strong leader" model of leadership. At the time, they were a fantastic waste of their society's resources.

Divisiveness will, in fact, kill a team. We're on the same page about that. However, teams throughout history and software development that have had "strong leaders" have plenty of track record of being internally divided. Focusing on "Steve Jobs" is a huge example of survivor bias. Nobody hears about the "strongly led" teams that don't make it big, or anywhere.

Democracy doesn't "divide" teams. It gives people a voice to work through their _already present_ divisions. However, the key word there is _work_. Simply saying you're a democracy without having patience to go through the work won't get you anywhere. Neither will putting together a team filled with people with irreconcilable differences.

<comment><USER13> How about sending a man to the moon? That also seems like a waste of resources, we just aren't morally opposed to it because everyone got paid. However politically they both seem to be in the same class of great human endeavours with no practical value.

<comment><USER4> Neil deGrasse Tyson argues, and I agree, that the ability to send people, probes, satellites, etc. into space is of utmost importance on a grander scale. Imagine being a species capable of space-flight that is unable or unwilling to save itself from destruction when an asteroid comes too near. "We would be the laughing stock of the universe -- 'Oh haha, yea, look at those silly humans who could have saved themselves, but didn't.'". The space program is incredibly expensive, but what is the cost of Earth?

</comment></comment></comment></comment><comment><USER14> I'm not sure that calling this measure "collective intelligence" is fair. If you look at the paper, this is measuring the ability for a team to move quickly without stepping on each others feet. I'd expect "collective intelligence" to measure the ability of a group to come up with the right answer to a difficult problem without so much time pressure and in that case I bet you'd find a much greater impact from intelligent individuals.

</comment><comment><USER15> The inherent flaw of teamwork is that responsibility is actually atomic. As soon as you assign the same responsibility to a group of two or more persons, things will start to go wrong sooner or later. If you look more closely at successful teams of the past, you will notice that they succeeded because they actually worked as a well-coordinated group of individuals, with a clear separation of responsibilities. Ringo Starr never played the guitar, and John Lennon kept his hands from the drums. If a team is unable to assign responsibilities to its individual members, you don't get a team, you get a committee. And it is no accident that "design by committee" has a negative connotation. What you get out of a committee is not the greatest idea a single member had. What you get out of a committee is the lowest common denominator. And if that denominator happens to be low enough, you won't get any usable results at all.

<comment><USER16> The example would work just as well in reverse: _Because_ Lennon _could_ play the drums, they made great music.

There is a risk in divided responsibilities: If you don't understand the other person's perspective or area of expertise, the group stops working as a coherent whole.

<comment><USER17> Divided responsibilities among team members, but each individual with the ability to understand the other — which actually returns us to the "theory of mind" that the article refers to.

</comment></comment></comment><comment><USER18> Wonder how did they measure the individual skill of participants. Because as far as I am aware skill is what helps teams to succeed most. And if everyone was of the same skill, it's not that surprising if those with other advantages, like better emotion reading, performed better.

</comment><comment><USER19> De-paywalled: [https://archive.today/BM7BT](https://archive.today/BM7BT)

</comment><comment><USER20> Emotional intelligence is also intelligence. I.Q. tests doesn't bear that.

So smart teams are better than less smart. But it's not about the I.Q. score but about the whole intelligence (emotional and logical) of the team members.

</comment><comment><USER21> I think this is yet another reason why we should be more sensitive to others and allow for more diversity in our field.

</comment><comment><USER22> Url changed from [http://www.theatlantic.com/business/archive/2015/01/the- secr...](http://www.theatlantic.com/business/archive/2015/01/the-secret-to- smart-groups-isnt-smart-people/384625/?single_page=true), which points to this.

</comment><comment><USER23> I am surprised that they say that more women lead to a better performance. There is no single female-dominated team that comes to my mind that achieved exceptional performance. All the great achievements and inventions of humanity, top notch startups, product teams etc. - all consisting of few or no women. Am I missing here something?

<comment><USER24> Note that they don't claim that a female dominated team improves performance, but that adding women to a male team improves its performance.

 _All the great achievements and inventions of humanity, top notch startups, product teams etc. - all consisting of few or no women_

That's a pretty bold claim.

Maria Goeppert-Mayer. Chien Shiung Wu. Anne McKusick. Lilli Hornig. Colleen Black. Leona Woods Marshall.

Look them up. Consider the possibility that the fact that they aren't famous just as instructive as the fact that they exist.

<comment><USER25> I'm not sure it's fair to suggest that those women aren't famous as some sort of mark against societies sexism (presuming you might feel that way). There are a great number of men that aren't famous who have made significant contributions to science, and there do exist famous women who have contributed.

I'd venture to say most people know, Marie Curie, Jane Goodall, Rosalind Franklin, just to name a few whose names I recognize.

<comment><USER23> I don't say they don't exist, but what's the ratio? It is also a fact that the higher the IQ gets, the more men we count.</comment></comment></comment></comment>


Google Cloud Source Repositories (beta) - <AUTHOR> https://cloud.google.com/source-repositories/ <comment><USER2> Anyone know if they're planning on charging for this? It's hard to beat gitlab.</comment>