Fired Google memo writer draws scorn, cheers and a job offer (from Wikileaks) - <AUTHOR> http://www.reuters.com/article/us-google-diversity-idUSKBN1AO1WY <comment><USER2> This guy touched a nerve, and now he is the latest football in a really toxic culture war being waged right now. All of the various culture warriors on both sides are now going to be lining up to take their 15 minutes in the spotlight, to wear on their sleeves their commitment to their cause (both sides).

The loser in all of this will continue to be any sense of nuance or rational debate. If he had a point, it's lost now in claims of "anti-diversity". If his opponents had a point, it's lost now in claims of "PC authoritarianism".

<comment><USER3> So if we were to have a rational debate, what points did he have, and points did his opponents have?

<comment><USER2> The original post that started all of this is here: [http://gizmodo.com/exclusive-heres-the-full-10-page-anti- div...](http://gizmodo.com/exclusive-heres-the-full-10-page-anti-diversity- screed-1797564320)

Some useful ideas in that post which were buried: Google itself has unexamined biases; There's real fear among some people that they can't speak their mind on sensitive issues because they might be ostracized for fired for them (which the author was); Google needs to have an open and honest discussion about the costs and benefits of our diversity programs; Google needs to focus on psychological safety, not just race/gender diversity.

By my count, zero of those were discussed after the memo. Related to the content of the linked article we're discussing -- the author tried to actually promote diversity with some ideas (albeit in a hamfisted, and potentially offensive, way)

His opponents have some points too... (here's a typical response: [https://medium.com/@yonatanzunger/so-about-this-googlers- man...](https://medium.com/@yonatanzunger/so-about-this-googlers- manifesto-1e3773ed1788))

The memo is pushing a fairly outdated and unsupported notion of fundamental biological differences between the genders. The memo did not out and out say "women can't code" but it sure did seem like that's what he meant. The memo author did not for even an instant think about what affect his memo would have on other people, and so whether misinterpreted or not, he may be guilty of creating a hostile work place. The memo called for "De-emphasize empathy". This would validly seem to many people like a really bad idea.

On a sensitive cultural issue, engineers will tend to get upset if what they write/think is misinterpreted. But on emotional issues, you'd best pay attention to how your message arrives, because it's always more important than what you intended your message to mean.

His opponents are currently drowning him out, but the way that even they are doing it isn't terribly intellectually honest. For example, making simple claims that all of his claims are refuted by decades of science but neglecting to proffer that science is a fairly normal but annoying intellectually dishonest thing to do in a debate.

\--

Google got put in a bad situation here. Diversity is a very important cultural value to them. So they couldn't do nothing. And I also think it's a terrible idea to fire a person who was explicitly writing about how the company won't permit open discussion of hard issues. __This is what makes him a culture war football, because the extremes on both sides will be able to look at this case, and see all of their worst fears __.

<comment><USER4> I do not see "women can't code" anywhere in that memo. I see "women are less likely to take interest in coding (for biological reasons possibly)" which is completely different thing.

<comment><USER2> Granted. To this point, I'd say this: more than half the internet read his memo and understood "women can't code". At some point, it doesn't matter if that's not what he said. The impact of his work is how people perceive it, not what he meant. This isn't really fair, but it is so.

One thing that's obvious: the author clearly did engage in broad generalizations about half of the population; your quoted sentence is proof. He hedged these statements with others, saying that of course it always depends on the individual. But when a person makes broad generalizations about populations, they're always playing with emotional fire. And once people get bothered and emotional, all of the rational hedging in the world won't save your job.

</comment></comment></comment></comment></comment><comment><USER5> Wikileaks may have started with the best intentions from the "information needs to be free" playbook (or maybe it has always been corrupt).

But it is very clear for anyone who has been watching, that they are absolutely operating as an arm of the Russian government now.

They put their "reputation on the line" to denounce the Steele Dossier. I wish I could remember the other weird calls they've made recently... but there have been a few.

There has been congressional testimony claiming Wikileaks as a propaganda arm of the Russian government.

Through the US election they switched their hosting to Russia: [http://www.stopfake.org/en/wikileaks-switched-to-russian- web...](http://www.stopfake.org/en/wikileaks-switched-to-russian-web-hosting- during-election/)

Current CIA director Mike Pompeo: [http://www.thedailybeast.com/trump-cia- boss-wikileaks-is-a-r...](http://www.thedailybeast.com/trump-cia-boss- wikileaks-is-a-russian-tool)

James Clapper former Director of National Intelligence. [http://dailycaller.com/2017/05/08/clapper-wikileaks-is- russi...](http://dailycaller.com/2017/05/08/clapper-wikileaks-is-russian- propaganda-video/)

Not being funny - but I think a job at wikileaks is likely going to get you walking out the door in handcuffs one day.

<comment><USER6> Way to drag the Red Scare into a totally unrelated topic.

<comment><USER5> So the topic isn't entirely unrelated. In fact there is some evidence out there that the story itself is being artificially amplified by Russian social media bot accounts.

        http://dashboard.securingdemocracy.org/
        Updated on August 8, 4:28 PM

        The second story related to the firing of
        a Google employee who wrote an internal
        manifesto against diversity. In both cases,
        users amplified existing hashtags as well as
        mainstream news content. Influence operations
        aim to raise the profile of certain themes and
        issues, but they don't always create the content
        they amplify. This is likely the case with the
        Google story, which has been trending among
        far-right users.

        Russia frequently amplifies content related to
        the far-right in both the U.S. and in Europe,
        but it does so opportunistically. It's easier
        to amplify something people are already talking
        about than to create a trend out of thin air.

Gamergate was similar. Right wing discord was amplified opportunistically.

These are stories which reasonable shouldn't be more than a "blip" but by amplifying their importance it serves the Russian strategy. There are a number of strategic reasons that it benefits their aims.

They sow chaos & discord. Make the fringe appear larger and more powerful than it is. Embolden & attract people who may have had "leanings" or agreed with smaller parts of it.

It's a propaganda war. It is totally asymmetric and the USA is getting crushed by it.

Recognizing that is important.

<comment><USER6> > the story itself is being artificially amplified by Russian social media bot > accounts

Any shit (or anything that looks like shit) about US would be amplified, because the idea they are pushing is "maybe it's crappy here, but you wouldn't believe how crappy it is _over there_ ". It's a very powerful and very successful strategy, they didn't invent it (pretty much every totalitarian regime has used it) but they are surely following it.

> who wrote an internal manifesto against diversity

Useful rule: anybody who writes "manifesto against diversity" didn't read it, doesn't know anything worthy of mention about it and should be completely ignored.

> Right wing discord was amplified opportunistically.

 _Every_ discord will be amplified opportunistically. That's what they do. The right thing to do is to ignore them.

> These are stories which reasonable shouldn't be more than a "blip" but by > amplifying their importance it serves the Russian strategy.

Russians didn't make it a story. Google and MSM did. Also people throwing a fit because somebody published a thoughtcrime did.

> They sow chaos & discord.

They sow nothing. Nobody in US watches them. Nobody in US cares about them. Stop blaming Russians for what Americans do to themselves.

> It's a propaganda war

Maybe. But if it is, it is a propaganda civil war.

> It is totally asymmetric and the USA is getting crushed by it.

On the contrary, USA doesn't even notice it. The rating of any Russian media outlet in USA is zero. The only way anything gets to the eyes of the public if US media amplifies it - which now unfortunately they do quite a lot, because the stupid part of Democrats thinks that blowing up the Red Scare would help them topple Trump. And they don't care about the collateral damage. Absent that, the influence of Russian media on the US is zero point zero.

</comment></comment></comment></comment><comment><USER7> Original memo: [https://assets.documentcloud.org/documents/3914586/Googles-I...](https://assets.documentcloud.org/documents/3914586/Googles- Ideological-Echo-Chamber.pdf)

Might be worth actually reading it before arguing over whether this kind of material should be censored and its author shunned.

<comment><USER8> It's a bit ridiculous he was _fired_ , but by the same token I don't buy the biology story he's telling.

I feel like if he had skipped that and simply made his suggestions then the memo would have firmer ground to stand on, because then others could say they support them without giving the impression they are sexist.

</comment></comment><comment><USER9> This has been flagged as a dupe, but the other posting didn't rise:

[https://news.ycombinator.com/item?id=14955319](https://news.ycombinator.com/item?id=14955319)

</comment><comment><USER10> Did the original title include "(from wikileaks)"? If not, then that's a curious bit of editorializing, given wikileaks' history with Hillary.

<comment><USER11> It removed the clickbaity part of the title. Withough that I have to skim the whole article just to find that information

</comment></comment><comment><USER12> If this guy changes his pronoun, heads will explode.

</comment><comment><USER9> _> James Damore, the engineer who wrote the memo, confirmed his dismissal, saying in an email to Reuters on Monday that he had been fired for "perpetuating gender stereotypes"_

It's time to start scouring the Twitter feeds of female Google employees searching for tweets that perpetuate stereotypes about the male gender, and report them to Big Brother.

<comment><USER13> Nobody's stopping you. GLHF.</comment></comment>


Arrest warrant for WikiLeaks founder Julian Assange for sex crimes - colin-de-vries http://edition.cnn.com/video/#/video/bestoftv/2010/11/30/tsr.assange.warrant.cnn

<comment><AUTHOR> From what I've read so far, it boils down to this: the two women in question only accuse him of not using a condom when allegedly they only consented to sex with a condom. There was no "forcing them to sexual actions" involved, as the sex was allegedly consensual. At least, that's what has been reported so far.

"Rape" may technically be the correct term under Swedish law, despite being used all over the world under vastly different meanings.

Alas, similar to, by now, nearly everything having to do with Wikileaks, how people view this is vastly dependant on their personal opinions about Julian Assange and the ethics of what Wikileaks does in general. This has nothing to do with 'criminal justice' anymore, it's just a farce (going both ways).

Edit: Also, this is NOT an international arrest warrant. According to Interpol itself, it is a "red notice", calling for help in identifying and apprehending Mr Assange, not an arrest warrant. See <http://www.interpol.int/Public/Wanted/Default.asp>

</comment><comment> colin-de-vries Sure and "they" believe that "we" the people are that stupid? Even if he would be guilty the timing is, to say the least, remarkable.

<comment><USER2> But... Let's just suppose that he _is_ indeed guilty - I mean, there isn't anything out there about his person that says he _isn't_ the kind of "bad boy" who in terms of sexual encounters simply takes what he wants with force. What happens with Wikileak's reputation and the political weight of the so-far released documents if he really is guilty?

<comment> colin-de-vries I would say that it wouldn't matter what he has done, even he turns out te be a serial killer. The information in the documents still hold's it value.</comment></comment></comment>


The World's Recycling Is in Chaos. Here's What Has to Happen - <AUTHOR> https://www.wired.com/story/the-worlds-recycling-is-in-chaos-heres-what-has-to-happen/ <comment><USER2> What's the past year has shown us is that "we" never were recycling. We were just sending our garbage to China and they've had enough of it. The entire concept of postconsumer material is basically a marketing concept to appeal to a higher wage consumers.

<comment><USER3> I was under the impression that the only thing really being recycled was aluminium (and other metals, to some extent).

Typical plastic and paper waste is pretty dirty, due to misunderstanding of what can be recycled - anywhere from just thinking anything vaguely paper or plastic can be recycled to places where people apparently think recycling bins are just different colored trash bins (or just dont care). Contamination of otherwise recyclable materials by food is also an issue. Its also not worth much since the feedstocks for new paper and plastic is pretty cheap.

Glass is also fairly worthless, since it needs to be sorted by color to realistically be recycled. Mixed glass I believe is generally landfilled or "up-cycled" into some sort of crushed aggregate for various purposes.

<comment><USER4> Lots of cardboard and paper is recycled in the US. It works fine.

It's also the case that any metal a scrapyard will pay you for is economical to recycle. The majority of discarded steel is recycled.

</comment></comment></comment><comment><USER5> Single stream recycling is the majority style of municipal recycling here in the United States. It's popularity was along the lines of why we got Chip & Sign and not Chip & PIN EMV: Governments consider their citizens too uninformed and friction averse to sort their own recycling. They felt the consequence of that would be that the municipal recycling would become an underutilized money pit.

Unfortunately, those governments got the predictions right, but got the consequences wrong. The cost of uninformed citizens putting plastic grocery bags, gardening hoses, and all sorts of non-recyclable trash into the single stream is extremely costly. Single stream plants shut down several times a day to remove plastic film bags from their machinery, untangle hoses, and remove literal tons of tainted recyclable material because someone threw a full paint can in their recycling bin.

This is further exacerbated by many municipalities providing a recycling bin that is larger than your yard waste and trash bin. A city I lived in previously did this and many of my neighbors would just put their trash bags into the recycling bin because their trash bin was full.

As such, single stream recycling has been on the ropes since before China raised it's standards. Now it's in full on panic mode.

That said, I don't want to put up with a Japanese style rotation of trash days, special trash bags, and 50 page manuals on how to sort your trash and when to put it out either. Unfortunately, we're going to have to move away from single stream if we want to increase recycling efficiency, it seems.

<comment><USER6> If a person dumps a paint can into their recycling, that person is not going to clean and sort their waste into multi-stream recycling.

<comment><USER5> True, but I posit the opportunity cost of them not recycling is less than the current actual cost of tainted materials from single stream.

</comment></comment></comment><comment><USER7> Pursuing Zero Waste has turned out to be a fun hobby for me. I started because I got tired of throwing things out all the time and then losing time to dealing with the trash.

<comment><USER8> I have a few questions [no particular order].

* How are you reducing your waste? Reducing input? Efficient internal usage? Efficient yet minimal output?

* What do you do with the waste you do still have [assuming any]? Re-purpose it, like a trash-to-treasure type deal?

* Do you consider your time dedicated to Zero Waste not "losing time to dealing with trash"?

<comment><USER7> I'm only playing around for now, Toyota-style. Also, our area lacks some infrastructure that others take for granted (e.g., bulk product stores with bring your own container) For example, we got a carbonater as an at-bat. This eliminated 3-4 1L seltzer bottles per week, plus some cola 20 oz.s (via Cube Cola). Will it be worth it? We'll see. But that's why it's a "fun hobby", i.e., past-time status. Other things are on deck like composting as much as possible. I'm already making bread regularly, but bread bags don't account for much trash, so that's really a preference thing at this point. I'm also experimenting with fast methods of making fruit spreads from frozen fruits. I like PBJ sandwiches with jam, so I was tossing 1-2 jam jars a week. The general idea is to learn truths about time/money costs and trade-offs via rapid experiments. If things go well, we gel the stuff that works into weekly workflows and enjoy less trash. We already reaped a minor victory. The trash company had some... business issues, and didn't pick up for a month. What we tossed still fit in the bin when they finally came back.

</comment></comment></comment><comment><USER9> The answer is reducing consumption.

<comment><USER10> Trader Joe's at least has made an effort to cut down on the use of plastic packaging for their produce. So in this way, at least plastic consumption will be reduced at the consumer level, even if only for Trader Joe's shoppers. I always felt bad purchasing from them purely for the amount of packaging that was involved.

[https://www.fastcompany.com/90318155/heres-how-trader- joes-p...](https://www.fastcompany.com/90318155/heres-how-trader-joes-plans- to-cut-1m-pounds-of-single-use-plastic-from-its-stores)

<comment><USER3> Here's basically the entire article: they will "no longer offer single-use plastic bags to customers, replace the plastic produce bags and Styrofoam packages with compostable alternatives, and avoid using compounds like BPA in packaging".

Trader Joes has always been semi-unique as a grocery store in that a reasonably high percentage of their produce comes as a multipack on a paper/stryofoam tray wrapped in plastic. It always struck me as wasteful as well.

</comment></comment></comment><comment><USER11> Locally, a community recycling center is in the process of closing down. This after having had its pickup and processing costs approach $100 a ton now. Since the "tipping fee" at the local dump is only about a third of that, guess where all of that formerly recyclable material is now headed? I expect that our much larger municipal recycling program will soon be taking a similar path.

</comment><comment><USER12> Good. Every country should deal with their waste on their own, otherwise no one will ever do something to reduce it.

</comment><comment><USER13> What are things software developers (which I presume most of HN is) can do to make more recycling possible?

EDIT: It does seem, reading from this, that the packaging of goods have gone too complex to be simply sorted by hand because the packaging itself can be contaminated by the paint etc.</comment>


How Linux mastered Wall Street - <AUTHOR> http://www.itworld.com/open-source/193823/how-linux-mastered-wall-street

<comment><USER2> "As late as 2007, Wall Street exchanges were still largely run on Unix, such as HP's AIX and Sun Microsystems' Solaris."

Isn't AIX developed by IBM? HP maintains HP-UX if I'm not mistaken.

</comment><comment><USER3> Frankly, I'm often surprised that how much of wall street is still windows based. A year or two ago I spoke to a co-location vendor who told me that most of their customers run their automated trading strategies on windows machines. A friend is currently working with a very popular market data vendor who only provides windows API. Some of their customers use linux, but they are forced to use WINE! The vendor has no plans to provide linux based api, something more portable like java or even straight tcp/ip message specification.

<comment><USER4> A lot of this has to do with Excel. Average finance guy lives in Excel and no, libre/open office is not a replacement as they will not run a huge number of macros and DLLs connecting spreadsheets to external systems. Quant guys are often locked in matlab world and again - octave on Linux cannot be used due to incompatibilities.

<comment><USER3> I forgot about Excel. I think people outside of wall street will be surprised at this. I, myself, used a visual basic app to do some trading (not visual basic.net, VB!) as recently as a couple of years ago :).

Even in the linux world, PERL is used by many quants for their analytics...not just to parse files, but as an alternative to R, matlab, etc.

<comment><USER5> It's Perl, not PERL. /sigh.

Also, Perl is A Real Language, unlike.. ah, >.>, Excel.

<comment><USER3> Let me switch sides for a moment and defend some of what happens here. In certain instances, Excel is a very good tool. In fact, if Excel's performance could be improved, it would become the best tool for some scenarios.

For example, you need to manage a stream of data. You have prices coming in and you need to publish another set of prices going out (perhaps you are trying to peg quotes in the market off another set of quotes...details don't matter). Use Excel's RTD to put incoming prices into some cells. Calculate the outgoing price by typing out a simple formula which references the original cells.

All other commonly used languages are more batch oriented, rather than stream oriented. In other languages, the code will implement some sort of call-back method to handle incoming data. This program will need some sort of "main" method. Perhaps the program will need to be compiled. Certainly the user will have to know how to run it.

A non-programmer will obviously pick the excel solution (and many programmers will as well).

The financial industry does lots of things ass backwards -- a few of them really do make sense :)

<comment><USER6> I wonder if a more explicit graphical flow-based programming system would be even easier than the implicit flow-based setup that's going on behind the scenes in Excel. For example, you have an object that represents an incoming stream of quotes. An output pin on that object connects to a "formula" object, which is wired to an output stream object. It's all based on ancient ideas (like Max/MSP, Pure Data, etc.), but maybe it could be useful.

Disclaimer: I created a flow-based system for home and building automation (no doubt one of many), so I tend to see uses for it everywhere ;).

<comment><USER3> Explicit graphical flow-based systems have their own issues. If the logic is simple, the systems are manageable. However, complex logic very quickly leads to a very complex graph with huge number of lines criss-crossing each other, until they make no sense.

Conal Elliot has done some interesting work in the area of "visual programming." The following is a good paper, but entirely academic: <http://lambda-the-ultimate.org/node/2159>.

</comment></comment></comment></comment></comment></comment></comment><comment><USER7> Ahem. I know of at least one HFT in NYC that's _killing it_ with FreeBSD.

<comment><USER8> If you read the article you'll see it's talking about exchanges, not those trading with them.

<comment><USER7> Not so:

> "The trading shops saw that the lowest-latency solutions would only be > possible with Linux," Lameter said. "The older Unixes couldn't move as fast > as Linux did."</comment></comment></comment>


Kindle DX as E-Ink computer monitor (2012) - <AUTHOR> https://tinyapps.org/docs/e-ink-monitor.html <comment><USER2> This piece is likely pertinent due to the discussion of e-ink screens: [https://news.ycombinator.com/item?id=18100447](https://news.ycombinator.com/item?id=18100447) from a couple days ago.

I can see the appeal of something Dasung 13" screen: [https://www.amazon.com/Dasung-Ink- Paperlike-13-3-Monitor/dp/...](https://www.amazon.com/Dasung-Ink- Paperlike-13-3-Monitor/dp/B07GWGFW1B) for long, sequential text documents. It'd make an interesting second display. Just not for $1,200.

<comment><USER3> [https://www.amazon.com/BOOX-Ereader-Android-Interface- Dual-T...](https://www.amazon.com/BOOX-Ereader-Android-Interface-Dual- Touch/dp/B077GVLMJN) what about $800? (it's not an affiliate link)

<comment><USER4> That product packs both a screen and a standalone ereader for that price. Sounds like a superior deal compared to Dasung, in every regard.

<comment><USER5> BOOX ereader has significant delay when it is used as computer display (according to reviews on [http://goodereader.com](http://goodereader.com)). Dasung display is much smoother.

<comment><USER6> Right, but you can enable A2 which uses a different drawing algorithm and adjust the full refresh period, but it is NOT a means to play games or watch a movie. If you do, you are probably using it wrong to begin with ;-)

</comment></comment></comment></comment></comment><comment><USER7> I actually wish there were a whole [laptop] computer and an OS designed around an e-ink display so it wouldn't be a pain to use in bright direct sunlight.

<comment><USER8> Lenovo has a new laptop called the Yoga Book. The keyboard is an e-ink display that can be used as an e-reader. Windows, so not a full OS, but definitely a step in that direction.

Here is a non-affiliate link: [https://www.lenovo.com/us/en/tablets/windows- tablets/yoga-bo...](https://www.lenovo.com/us/en/tablets/windows-tablets/yoga- book-windows-series/Yoga-Book-with-Windows/p/ZZITZTWYB2L)

<comment><USER9> Just a clarification, this is actually the previous gen version, where the keyboard area was intended to be a digitizer for handwriting and pen input.

The new one with e ink keyboard is called the Yoga Book C930 and should be available later this year. Lenovo's mobile sites are a mess so I can't seem to find a page for it at the moment but there are many video previews of the device.

</comment></comment></comment><comment><USER10> I love my DX. I just wish Amazon would push an update where the screensaver was the last page read.

<comment><USER7> Why would an e-ink device even need a screensaver or to turn the display off? Isn't just leaving a displayed picture as it is the most energy-efficient and display-saving solution on e-ink?

<comment><USER11> > Why would an e-ink device even need a screensaver

To display adverts?

<comment><USER7> OMG. Thanks g-d I have a PocketBook rather than a Kindle and have never seen ads on e-ink...

<comment><USER12> Note: Back when I bought my Kindle Paperwhite, Amazon offered an ad-supported version and one completely without ads.

The price difference IIRC was roughly $99/$119, so please don't let the parent mislead you into thinking every Kindle comes with ads.

<comment><USER13> As unobtrusive as the ads on a Kindle are, there is not really any good reason to pay the extra to avoid them. At least the e-ink ones. If I was going to ever buy another Kindle Fire, I would definitely get an ad-free version though.

</comment></comment></comment></comment></comment></comment><comment><USER14> The paperlike hd looks interesting. [https://www.amazon.com/Dasung-Ink- Paperlike-13-3-Monitor/dp/...](https://www.amazon.com/Dasung-Ink- Paperlike-13-3-Monitor/dp/B075FL8DKV/ref=sr_1_3)

I Liked my DX but the screen wasn't adequately protected and I let the magic fairy goo out.

<comment><USER15> > The paperlike hd looks interesting. [https://www.amazon.com/Dasung-Ink- > Paperlike-13-3-Monitor/dp/...](https://www.amazon.com/Dasung-Ink- > Paperlike-13-3-Monitor/dp/..).

A blog post featuring that display was discussed yesterday here on HN: [https://news.ycombinator.com/item?id=18100447](https://news.ycombinator.com/item?id=18100447)

</comment></comment><comment><USER16> > Note that in some jurisdictions, it may actually be illegal to jailbreak > your tablet (but not a phone!).

I believe an exception was carved out for this a couple years ago, so it should be legal to jailbreak both tablets and phones now.

</comment><comment><USER17> Does anyone know why Amazon stopped selling the DX?

<comment><USER10> Poor sales is the most likely reason.

</comment></comment><comment><USER18> I'm hoping we see color e-ink displays integrated into TV displays so they're not such an eyesaw when not in use.

<comment><USER19> I fear the day. Their screens, when off, will then be used to present advertisements 24/7

<comment><USER20> Too true... a lot of "smart" TVs are already heading in that direction... I'd be happier seeing better AndroidTV support by application vendors, and a refresh for the Shield TV.

</comment></comment></comment><comment><USER21> Anyone knows where large e-ink displays can be purchased directly for electronic projects/prototyping?

<comment><USER22> In answer to your question, E-ink themselves sells large displays and controller modules: [https://shopkits.eink.com/product-category/e-ink-display- mod...](https://shopkits.eink.com/product-category/e-ink-display-modules/)

<comment><USER21> Thanks! That's very expensive, I didn't expect this price range. I saw some stuff on AliExpress that was a lot cheaper, but I guess the spec might not be the same.

</comment></comment></comment><comment><USER23> that's a little fucked up</comment>


Ask HN: How to filter Bitcoin, ico, blockchain - <AUTHOR> Hi,<p>This may just be a general question, but in my case I would like to know what method I can use to filter out the bitcoin, distributed ledger, ico, digital currency, satoshi etc...threads on HN. <comment><USER2> I am writing up an article about my system for filtering HN right now.

I wouldn't have seen this post if it wasn't an 'Ask'.

</comment><comment><USER3> I'm interested in a filtering method as well.</comment>


How to Raise Crypto in a Bear Market - <AUTHOR> https://medium.com/@SaitoOfficial/how-to-raise-crypto-in-a-bear-market-f7576996cb97 <comment><USER2> Heads up that this is my company, although the piece was written by my cofounder. If anyone has any questions, I'd be happy to answer them or get Richard online to share.</comment>


Waze machine learning - <AUTHOR> I use Waze for my daily commute to work. For the most part I follow the route that it suggests, but towards the end I take a slightly different route which saves about half a mile. I wish Waze could learn from this. Don't know if it already learns better routes from users but certainly not in my case. <comment><USER2> Or When you turn the wrong way and ways shows that you save time.You're suppose to save time by following Wave, no?</comment>


ThinkPwn: System Management Mode arbitrary code execution - <AUTHOR> https://github.com/Cr4sh/ThinkPwn <comment><USER2> Don't just plaster Lenovo with this - they're getting the splatter because Cr4sh has been researching their firmware, but this is a multi-vendor issue.

A few important notes from the article and the releaser's blog post:

* This is not a Lenovo problem so much as a problem for multiple vendors who used BIOS based on Intel's reference information. The original problem was with source code provided by Intel. The same problem is confirmed to exist in at least one HP system.

* This was apparently fixed back in 2014, but there doesn't seem to be an indication that it was recognized as a security flaw then or at least it wasn't noted as a security fix. 2014 isn't that long ago in terms of propagating BIOS updates.

* Cr4sh apparently decided to just release, "I decided to do the full disclosure because the main goal of my UEFI series articles is to share the knowledge, not to make vendors and their users happy."

* His assessment is "It's very unlikely that this vulnerability will be exploited in the wild, for regular customers there are much more chances to be killed with the lightning strike than meet any System Management Mode exploit or malware."

<comment><USER3> Although you are correct, I don't feel it's bad to blame the vendor who was running code that they didn't know the source of, nor the reasoning behind it's existence.

<comment><USER4> So, literally every vendor? Can you think of a single example of a vendor not running UEFI code from others, not running either Qualcomm's kernels for ARM chips, nor distributing Intel's ME firmaware, nor distributing AMD's TPM firmware?

I don't think there's a single OEM that knows what they're actually running – if there is, SAMSUNG would likely be it, because they have a chance at actually doing everything in-house.

<comment><USER5> Probably Apple, too - they prefer to implement things in-house wherever possible.

<comment><USER6> Apple now ships UEFI updates with every version of OS X.

<comment><USER7> Does Apple use UEFI now? Everything I've read suggests Apple forked at EFI 1.10 and never looked back.

<comment><USER6> They would have to in order to boot later versions of Windows using UEFI.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Quite the hilarious "security advisory" [0] that Lenovo put out. They manage to take zero responsibility, shift blame to the researcher/IBV/Intel, and admit that they ship SMM code of both unknown author and purpose.

[0] [https://support.lenovo.com/us/en/solutions/LEN-8324](https://support.lenovo.com/us/en/solutions/LEN-8324)

<comment><USER4> > and admit that they ship code of both unknown author and purpose.

That's literally what every vendor does nowadays. Do you think LG can get the code for the firmware of the SoCs they use in their phones? Do you think the coreboot guys can get the source for the Intel Management Engine firmware? Do you think any of the firmware in your system comes from your OEM and is secure?

This is a failure in the entire industry, and it's getting worse every day.

The proper solution would be simple, too: Allow everything to be flashed with custom software, but allow the user to set a cryptographic key with which updates have to be signed. By default, the system could accept the OEM key, the user could lock it further down.

Provides additional security for corporations and nerds, provides additional flexibility, provides the ability to modify the firmware.

<comment><USER8> > Do you think any of the firmware in your system comes from your OEM and is > secure?

No, of course not. But I'm surprised that Lenovo would tacitly admit this.

<comment><USER9> To be honest this has been going on ever since the first day random OEMs started shipping X86-based machines. There's really nothing to admit.

Back then we had Amibios, Pheonix bios etc etc, but these days we call it "UEFI" and "firmware" and everyone gets up in arms about it.

</comment></comment></comment></comment><comment><USER10> Interesting bit form Lenovo's security advisory on the matter[0]:

> Shortly after the researcher stated over social media that he would disclose > a BIOS-level vulnerability in Lenovo products, Lenovo PSIRT made several > unsuccessful attempts to collaborate with the researcher in advance of his > publication of this information.

[0] [https://support.lenovo.com/us/en/solutions/LEN-8324](https://support.lenovo.com/us/en/solutions/LEN-8324)

<comment><USER11> Clear as mud.

Lenovo has previously sacrificed user security and privacy for money (superfish), so it does not surprise me that they have done it again, and these kinds of weasel words aren't going to get me to buy another Lenovo product again.

Here's an idea: How about not putting backdoors in our products?

How about making it easier for consumers to replace software on systems they own?

<comment><USER12> Lenovo has always maintained a higher standard for their Think products, Superfish was only an issue on the Idea line. Doesn't excuse the debacle, but ThinkPad's are their professional line of notebooks and they make every effort to keep a positive image.

<comment><USER13> Lenovo only maintained the "standard" for their ThinkPads because it was an explicit condition of IBM when they sold the ThinkPad line to Lenovo.

<comment><USER14> The sale happened ten years ago and it is extremely unlikely that there are any contractual obligations for this anymore. Let's put this meme to rest; Lenovo has been building solid Thinkpads.

<comment><USER15> what?! since when? I every single thinkpad I bought since my T43P has been a total piece of shit in comparison.

Methinks you have never owned an IBM Thinkpad to make that statement.

<comment><USER14> I have used _exclusively_ Thinkpads since 1997.

The one I bought in 1999 broke through a cracked screen when a pencil got wedged between the frame and the screen because the hinges were not as strong as those today.

The T42, T43 and T60 series were absolutely incredible for their times but were now without fault; even back then they screen bezel was huge and you had to pay unreasonable money to get a screen with a higher resolution than 1024x800.

My Z60 was a fantastic machine that I ended up giving away. Its battery life, however, will not be missed.

My last T420 has an assembly that flexed far more than I liked and buttons whose pretty uniform black wore out with use, but I still keep it in the closet because it's indestructible. It's ugly as sin though.

I have my minor disagreements with the keyboard design of the X250, but the trackpad is _great_ , the screens have actually usable brightness now with their default configuration, and battery life has gone way, way, _way_ up.

Let's not look at the past with rose-colored glasses. Every one of those machines had a minor issue as far a Linux compatibility (always different), but back then it was a pain in the ass to get the WiFi working, whereas now if anything I might have a complaint about default keyboard bindings. Things change, but at no point in all that time did I have to send any of those machines for repairs (save for the Z60's fan getting clogged with dirt and some random memory module that died).

People get enamored with their machines and their particular quirks, but I much prefer the new, thinner machines. The tradeoffs are tradeoffs, and the defects are just different. Hell I even prefer the new chiclet keys over the old keys.

The _only_ thing I can say is different is that the frame of the newer machines flexes more. That is not a defect; a frame that flexes is far more resistant to falls and impact. All of my machines have fallen off chairs at some point; all of them survived intact.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> > Vulnerable code of SystemSmmRuntimeRt UEFI driver was copy-pasted by Lenovo > from Intel reference code for 8-series chipsets.

> Alex James found vulnerable code on motherboards from GIGABYTE (Z68-UD3H, > Z77X-UD5H, Z87MX-D3H, Z97-D3H and many others):

This is beyond the scope of just Lenovo machines.

<comment><USER17> As confirmed by Lenovo as well:

> The package of code with the SMM vulnerability was developed on top of a > common code base provided to the IBV by Intel. Importantly, because Lenovo > did not develop the vulnerable SMM code and is still in the process of > determining the identity of the original author, it does not know its > originally intended purpose. But, as part of the ongoing investigation, > Lenovo is engaging all of its IBVs as well as Intel to identify or rule out > any additional instances of the vulnerability's presence in the BIOS > provided to Lenovo by other IBVs, as well as the original purpose of the > vulnerable code.

[https://support.lenovo.com/ca/en/solutions/LEN-8324](https://support.lenovo.com/ca/en/solutions/LEN-8324)

</comment></comment><comment><USER18> Starting with the X230 series of ThinkPads, Lenovo has used flash write protection to prevent "unauthorized" BIOS modifications. Owners of X220 laptops and below are able to reflash the BIOS to remove Lenovo's whitelist of WLAN/WWAN cards; the X230 models are currently stuck with Wi-Fi N and Gobi 3000 3G-only cards due to Lenovo's whitelist. Would this exploit allow ThinkPad owners to reflash their BIOS chip without desoldering and flashing with external hardware?

<comment><USER19> My coworker replaced his BIOS/UEFI with an open source version (thinkpads enable this). It allowed him bypass Lenovo's whitelisting of "approved" hardware, so he could install his own 3g modem.

He repurposed an old Arduino into an SPI flasher and a chip clip to sit on the bios flash chip.

[https://twitter.com/thomas_cannon/status/703633676102471680](https://twitter.com/thomas_cannon/status/703633676102471680)

<comment><USER20> Is the open source version you speak of Libreboot? That's the only open source BIOS replacement I know for any thinkpads. That Thinkpad looks a bit new for full-fledged librebooting! Did he have to reflash the ME firmware back on?

</comment></comment></comment><comment><USER21> I wish we could even purchase machines without SMM, Intel Management Engine, and similar features. On any machine I own, I want the CPU and the software running in ring zero to be the last word on what happens. I don't think it's unreasonable to ask for a system that meets this requirement.

<comment><USER22> As I commented elsewhere, we can, see [https://news.ycombinator.com/item?id=12037410](https://news.ycombinator.com/item?id=12037410)

<comment><USER23> Old, outdated, expensive hardware with low specs? Nope. I have a lot of respect for what they do but it's not the solution we need.

<comment><USER24> An alternative is to use ARM-based devices: they typically lack microcode updates, and while TrustZone hypervisors are often present and the situation varies by device, at least some devices should allow the user to gain full control of the CPU without having to exploit anything. (I don't know how common that is, because every device manufacturer has their own boot process, and from some quick Google searching it seems like most of the time nobody bothers to figure out how the TrustZone stuff or the boot chain works, being satisfied with custom Android images...)

ARM Chromebooks in particular I think are theoretically supposed to have fully open source firmware, though the documentation is a little sparse... probably mostly for the same reason, lack of interest.

<comment><USER25> As far as I know anything Allwinner-based lets you run whatever you like with full control of the CPU, probably the same with other Chinese ARM SoCs but there seems to be more of an open source community around Allwinner for some reason. (The other main alternative is Rockchip.)

</comment></comment></comment></comment></comment><comment><USER26> Joanna Rutkowska has written about Intel based products that are possibly vulnerable to the Intel management engine code. Even if you run an open source operating system such as Linux or FreeBSD, there is still proprietary code in the management engine that you cannot look or verify that its secure.

Here is the paper [http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf](http://blog.invisiblethings.org/papers/2015/x86_harmful.pdf)

UEFI is another gigantic hide point for malware.

I think one could possibly run more simple platforms such as Raspberry PI, Odroid which may not have embedded management engines. That should be more secure than x86 platforms.

<comment><USER27> Even the raspberry pi ARM cpu is slave to the VideoCore GPU, as the GPU (and its corresponding binary blob) is what initializes first on powerup and only later does it boot up the ARM CPU.

<comment><USER28> The situation is better than what it was - [https://github.com/christinaa/rpi- open-firmware](https://github.com/christinaa/rpi-open-firmware)

</comment></comment></comment><comment><USER29> Also found in an HP DV7 4087CL from 2010: [https://twitter.com/al3xtjames/status/749063556486791168/pho...](https://twitter.com/al3xtjames/status/749063556486791168/photo/1)

</comment><comment><USER30> This should be good news for people looking to getting rid of Computrace, effectively a rootkit, from surplus Thinkpads.

[http://forum.thinkpads.com/viewtopic.php?t=114641](http://forum.thinkpads.com/viewtopic.php?t=114641)

Yes, I bought a surplus Thinkpad (T61) and found it had Computrace activated on it. Grrrr.

Yes, I could call the Absolute(R) Software number and they should disable it for me. I have not been willing to sit on hold and jump their hoops to date. Since I run linux on the laptop, is fairly low risk for me, but Absolute(R) Software could inadvertently or intentionally "brick" my laptop. Grrrr.

<comment><USER31> AFAIK all the ThinkPads have a BIOS option to disable CompuTrace. Mine has three options: "Enabled", "Disabled" (default option) and "Permanently disabled".

The "permanently disabled" option erases the CompuTrace blob from the flash chip, so it cannot be re-enabled afterwards.

This may not be the case for their non-business machines (i.e., not ThinkPad).

</comment></comment><comment><USER32> What are we up to now? Three preloaded spyware scandals, possible remote execution via the Intel stack and now this vulnerability. That's just what we know about, who knows what else exists. I don't think I can buy another one, which is sad as I think it was a timeless and great design.

<comment><USER33> I plan on using my quad core T520 for probably another 5+ years. All of their laptops after the T520 series have the full size keyboard with numberpad which off-sets the center of the keyboard, so now your typing is mostly happing on the left side of the keyboard and that causes wrist strain.

Having a numberpad is really lame on a laptop. I won't buy one and I know of no one else that likes the numberpad either.. sadly many manufactures are doing the same.

<comment><USER34> Wow this was actually going to be a major buying factor in my next Laptop, was really considering a gaming laptop for the numpad but I guess it wouldn't be too difficult to buy a bluetooth numpad for the right side of the keyboard/get used to the numbers above the keyboard. Thanks for this angle. Never considered wrist strain.

</comment></comment></comment><comment><USER35> T450S user here. What exactly does this mean for me? I get it's a security issue, but that's about all I understood...

<comment><USER36> The attack against you would be interdiction, where the NSA (or whomever) would MITM shipping and receiving.

What shipping and receiving? Somewhere between where you will receive the package -- be it your home, PO Box, postal office, etc -- and the originating storage facility (ie: warehouse), there is a long list of hands exchanging your product. One of these hands would be an NSA agent's hands.

[https://en.wikipedia.org/wiki/Interdiction](https://en.wikipedia.org/wiki/Interdiction)

Who is targeted? In all likelihood, businesses, but I'm sure individuals are targeted as well.

The attack requires physical access to the hardware.

And just to be clear -- it's not just Lenovo products. The net seems to have been cast much wider and other devices seem to be affected (HP laptops, desktop motherboards).

<comment><USER37> I'm sure the NSA has other ways of bypassing security of the proprietary firmware (likely even through the front door), so this single exploit doesn't really add to that threat.

What it hopefully does do is cast a little ray of light on this suite of user- hostile firmware, helping us expunge this long present software muck that, for example, allows such interdiction attacks to be so easy.

</comment></comment></comment><comment><USER38> I've always liked the build quality of the ThinkPad series though it's been a few years since I've put my hands on one. That said, it looks like they need to spend similar attention on the software. On the flip side, though, I wonder if this solves the issue with the Yoga laptops I read about recently where the user could not disable SecureBoot in order to install the operating system of their choice.

It's a little sad to be excited about a vulnerability because it might provide an opportunity for a consumer open up the products they rightfully purchased.

<comment><USER39> I'm running Ubuntu on a Yoga 2 Pro, I hadn't heard about that issue. Either the exploit is now a transparent part of the Ubuntu installer, or it doesn't affect the Yoga 2.

<comment><USER38> I guess I could have provided context in that comment. :o)

Here's the story I was referring to:

[https://globalvoices.org/2016/06/16/in-defense-of-free- softw...](https://globalvoices.org/2016/06/16/in-defense-of-free-software-my- case-against-lenovo-in-mexico/)

And the HN thread:

[https://news.ycombinator.com/item?id=12027574](https://news.ycombinator.com/item?id=12027574)

</comment></comment></comment><comment><USER40> Cool. Now Lenovo admits they have no idea whose this code is and what it is supposed to do. It sounds like a shitty excuse of junior programmer: "Hey man, not my fault! I have just copy-pasted that snippet from StackOverflow!"

</comment><comment><USER41> So this is traceable to the Intel reference implementation. I am going to assume incompetence but let's say I would assume malice instead (some government agent wrote the reference spec full well knowing it's exploitable with or without the knowledge of Intel) how would one go about soft-proving that?

Compare machines that are vulnerable in the wild and same spec machines from important people at Intel and/or suspected government agency (assuming they'd simply use a non-vulnerable version instead of some completely different hardware)?

</comment><comment><USER42> I thought I have an intermediate level C knowledge, but I have no idea what is happening in the vulnerable line:

        *(v3 + 0x8)(*(VOID **)v3, &dword_AD002290, CommunicationBuffer + 0x18);

As I understand it is (was) an example code from Intel. Example codes should be easy to understand and well documented.

<comment><USER43> It's C generated by disassembling x86 assembler code. It is _not_ an example code from Intel.

The function pointer at `v3 + 0x8` is invoked with arguments: (1) the pointer at `v3 + 0x0`, (2) some fixed pointer, and (3) a pointer into the CommunicationBuffer.

E.g. here's more idiomatic C code to represent the same idea:

        struct Thunk {
          void *argument;
          void (fp)(void *, DWORD *, void *);
        };
        struct CommunicationBuffer {
          uint64_t unknown[4];
          struct Thunk *thunk;
          ...;
        };

        EFI_STATUS __fastcall sub_AD3AFA54(
            EFI_HANDLE SmmImageHandle, VOID *CommunicationBuffer, UINTN *SourceSize)
        {
          struct CommunicationBuffer *cb = CommunicationBuffer;
          if (cb->thunk) {
            cb->thunk->fp(cb->thunk->argument, &dword, &cb->unknown[3]);
            cb->thunk = NULL;
          }
          return 0;
        }

<comment><USER44> What idiomatic C code uses thunks? Is this an interpreter/runtime for a functional language or something? Or do some optimizers introduce thunks?

<comment><USER43> `qsort_r(3)` in libc, for example. It's not uncommon in idiomatic C code.

</comment></comment></comment></comment><comment><USER45> OK so what can be done to prevent this being an issue on my machine?

</comment><comment><USER46> Really hope Lenovo respond soon. Feel like I should leave my ThinkPads hibernated for now.

<comment><USER47> I think this exploit requires local administrative access. If an attacker already has this, you're pretty screwed to begin with.

In other words, while this could definitely make an attack more damaging and harder to remove, it doesn't seem like a reason to stop using a computer that has decent software and physical security.

<comment><USER16> This exploit just requires physical, not administrative, access to the machine. You build an EFI "app", put it on a flash drive, and execute it from the UEFI shell.

<comment><USER48> Well, physical access ranks higher than administrative. If an attacker has physical access, no system is secure, if only because the _interface_ to the system is no longer.

<comment><USER49> its not longer fair to call game over with physical access;

indeed countermeasure like full disk encryption, computrace and Mac firmware passwords are all examples of things we do to raise the difficulty for a physical attacker.

<comment><USER48> And the vast majority of them is trivially defeated by a bug inline with your USB keyboard.

<comment><USER50> You can reconstruct a lot of information with a keylogger but nowhere near all of it.</comment></comment></comment></comment></comment></comment></comment>


Made in Fayetteville - <AUTHOR> http://mobilefwd.com/blog/made-in-fayetteville-the-trivi-al-app-is/

<comment><USER2> I really wish all Arkansas tech were in the same area. If the scene in Conway/LR area combined with the scene in NW Arkansas, we could have a pretty nice community. I am actively searching for a good tech scene.

</comment><comment><USER3> There are numerous Fayettevilles. It took some digging to find out that this refers to the one in Arkansas. It might be worth specifying on the Made In Fayetteville page.</comment>


Ask HN: Does anyone else go right the comments? - <AUTHOR> I've noticed lately that more often than not I have been going directly to the comments and not clicking on the post links on HN. Instead I am inferring what the posted item has to do with from the title and then seeing what the commentary is around the topic. At that point I may go ahead and actually read the article. Does anyone else do this or am I just crazy? <comment><USER2> "HN, tell me what to think".

I too am a bit guilty of this. In all seriousness, there are a lot of smart people here so it's a reasonable thing to do IMO.

</comment><comment><USER3> I always go comments first. Too many articles on the front page are sensationalists pieces with no real information.

The intelligent comments are what keep me on HN.</comment>


Ask HN: PhD students - how do you find a remarkable research topic? - <AUTHOR> I stumbled upon Seth Godin's TED talk yesterday in which he presented his Purple Cow meme about the importance of being remarkable. As I listened, I couldn't help but think how true his words were, even for research.
I'm a PhD student in my second year currently searching for that topic that I'll pursue for the next few years to ultimately get a degree. One thing I've noticed looking at older students is that they fall into three camps. The first group pursues a random assortment of small projects for ~5 years and graduates with a "stapler thesis" -- essentially a grab bag thesis describing their small forays. The second group picks an obscure and incremental topic and pursues it, becoming an expert on a novel, but ultimately unexciting, phenomena.
The final group are the ones that truly succeed, and I expect are the ones that land jobs at top-tier research schools. They are the ones that manage to innovate not at the research level, but at the conceptual one. Rather than thinking up new ways to better old problems, they find a way to look at things that completely surprises/delights people when they hear about it.
So to all those PhD students out there that fall into this third category: how do you do your brainstorming? How do you identify the large-scale research themes waiting to be discovered? Is it dumb luck, inherited gift, or the result of a process that can be learned? <comment><USER2> With hindsight I would suggest the following:

(01) Most PhD Research is unremarkable. Do some research in your field, list all PhD theses over the last 30 years and give them a score. How many made a mark on the field? My guess possibly 1/1000. You can do the same with journal papers, possibly 1/3000.

(02) Citations is not a measure of success of a research paper/topic. Is this research applied today? Is it useful?

(03) The Dons in the UK had one measure of success of a PhD. It had to _advance the field_ and be original. Most Science advances this way. There is one major breakthrough and hundreds of small steps to advance it forward. (this would probably fall within your second group).

(04) Do a social graph on 3-5 topics. Who is working where? If you want to land in say one of the big Research Institutions, make sure that there is on- going research in this area by that Institution.

(05) Decide who you want to get _married_ to. Your thesis supervisor would be the most important person for you over the next few years. Is he interested in the research you are interested in?

My late professor used to advise that your PhD is you license to carry out research and not your major work.

If I had to do it all over again, I would do the social graph and go from there. I would also try and get into an area that _scales_ rather than purple cows or black swans. At the moment anything with a prefix bio is still virgin territory as far as I am concerned.

Perhaps if you could let us know your field, people might be able to give you some ideas. You could also try reposting the query as _If you had three-five years to do research in Computing/field, what would you choose as a topic and why?_

<comment><AUTHOR> Thanks yannis, these are some great comments.

With regard to the social graph one, I've heard advice akin to this from several people: that the person is more important than the topic when it comes to advisors. When you look at the PhD as a license to carry out research, rather than a major work itself, this makes sense. But it is sure hard to force yourself to adopt that attitude when you're in the middle of it. From the student perspective, it is tempting to make the argument, "This professor doesn't fit my personality, but I really want to work on this particular topic."

Regarding scalability, what you say makes sense. Indeed, I am a bit jealous of people with a bio- prefix; they are in the same spot computer scientists were in a few decades ago.

As far as my personal background, I am a Computer Science guy with a background in the systems community (semantic web, databases, web architecture) who is interested in getting more into machine learning. I'd love any advice on where you think the exciting momentum is in that area.

EDIT: Re-worded for clarity.

<comment><USER2> I think there is both large scope to do research as well as exciting momentum in Large-Scale Machine Learning. As data in many domains arrives faster than we are able to learn from it, we need to switch from the traditional "one- shot" machine learning approach to systems that are able to mine continuous, high-volume, open-ended data streams as they arrive. Establishing the theoretical basis of such an approach, is still virgin territory.

</comment></comment></comment><comment><USER3> You could do worse than to listen to Hamming:

<http://www.paulgraham.com/hamming.html>

But, having said that, when you ask:

 _Is it dumb luck, inherited gift, or the result of a process that can be learned?_

The answer is "all of the above". You need to follow good procedures that you will learn with experience, you need to have certain qualities, not the least of which are _social skills_ \-- bad research well described will trump brilliant but poorly-presented research every time -- but do not underestimate the role of dumb luck. For every awesome research problem that turns out to be tractable, there are many that just don't pan out.

There's a story I heard about Feynman. They say that Feynman used to take on grad students, and they would ask him what to work on. Feynman dreaded these questions. If he told a student to work on Interesting Problem X, and (s)he labored on it for years, only to find that it was intractable and therefore ultimately uninteresting after all, he was afraid the student would be terribly depressed, as depressed as only a late-term Ph.D. student can be. The story was that Feynman would tell the students to come back in a day or two, then take a problem and frantically work it out as fast and as far as he could in a day, trying to get a few years ahead of the student in a few hours, far enough ahead that he could be confident that an answer was likely to exist. Then he'd hide all his notes and present the problem to the student as an interesting and novel new idea.

Unfortunately, if you aren't a theorist, and your adviser isn't quite as smart, conscientious, and downright devious as Richard Feynman was, you'll be a normal grad student: You'll work away on a problem, and maybe it will be exciting, and maybe it will be boring, and the odds are on _boring_. [1] The secret is not to worry about this. If you want a successful research career, just _keep moving_ from problem to problem: Finish your thesis (yes, with a stapler if you have to -- when you gotta finish, you gotta finish) and then devote your postdocs to finding a _better_ problem, using all those Hamming- inspired skills you've been working on.

\---

[1] One truism: By the time you finish your thesis _you are likely to be so bored with your own project that you will want to scream_. Even if your project, properly presented, is actually pretty exciting to the independent observer. You lose perspective in your fifth or sixth year. That's why it's more important to keep moving than to hold out for the _perfect_ project, or the _golden_ dissertation.

<comment><AUTHOR> That is a great story about Feynman, and thanks for the Hamming article link.</comment></comment>


Using the Internet to Physically Harm - <AUTHOR> http://www.govtech.com/gt/290089?topic=117671

<comment><USER2> You may laugh at me now, but I'm 100% dead serious when I say that this sort of thing will be a HUGE problem if BCI 's become popular in the future.

<comment><USER3> fwiw, gibson's neuromancer comes to mind here

</comment></comment><comment><AUTHOR> This is the most disturbing hacking incident I think I've ever heard of, and I hope it makes people take the importance of good security measures to heart.

<comment><USER4> As the article says, I don't know if you could call this 'hacking' as such. I wonder if it would be possible to use a program to detect animated images likely to trigger epilepsy, and block them?</comment></comment>


Decent numbers, what to do (call for suggestions) - <AUTHOR>

My site has PR 4-6, 122,000 inbound links (all from media properties), 32K uniques/month, and  275K pageviews/month.  What strategies would the HN community suggest to generate revenue given these stats? <comment><USER2> if the only information you can share is traffic stats, my response will be "post ads". you can get into a better quality ad network with higher traffic.

all other options depend too much on what the site itself to be able to make a suggestion based purely on traffic stats.

<comment><AUTHOR> inbound links are a mix of from major metro area newspaper sites.

what else would you like to know? not opposed to a straight sale to allow someone to make best use of the site. Thanks.

<comment><USER2> what does your site do?

</comment></comment></comment><comment><USER3> URL?</comment>


Ask HN: How to have innovation culture at large companies? - <AUTHOR>

I'm part of a team trying to propose ways to institutionalize a better culture of innovation. In particular, we are a group of 50ish people in an engineering-like group at a larger company of >1000.
Does HN have suggestions or examples of what (not) to do? It would be nice to be able to point to stories from other organizations.
A couple of ideas that we had:
 - A policy to let people propose pet projects and then give them 10% time for it.
 - 'Mini' hackathons (one day or a few hrs/week for a couple of months. <comment><USER3> I have a secret I can share. Steve Jobs allowed Edgar Schein to have teams of his grad students follow Steve around and record every conversation and interaction. But Schein made one mistake - He gave Steve the right to veto the final book which was produced. When Steve saw that the book was almost exclusively about him, and didn't put him in a positive light, he refused to let it be published. So Schein rewrote the book into "Organizational Culture" \- it is famous because it coins the term "corporate culture" \- and it mostly describes Steve and how he created a culture of innovation (even though the examples are based on other executives.) When I read the book while working for Steve it was amazing - it described Steve with incredible accuracy (though, unfortunately, it lacks good examples since Schein couldn't describe how Steve handled specific situations.) For me, the book was like a master class in creating a culture of innovation.

In hindsight, I've often wondered how the benefits of a culture of innovation could be created without the derangement of Steve. Personally, I did my best work for Steve. To a large extent, the most positive thing I remember was that nobody was destroying my motivation to innovate. Every other company where I've worked talks the talk but doesn't walk the walk.

<comment><AUTHOR> I will look into this book, thanks! Were there any specific items that stood out to you as being important (besides having a Steve Jobs)?

<comment><USER3> Well, I would have to say that there is a synergy to the techniques - <USER2> several of them together and consistently is incredibly important. At some point everybody knows that innovation is important, and it just becomes part of the DNA of the organization. Really, I've never worked anywhere else where we had such a culture. Nobody had to tell you. No speeches.

</comment></comment></comment><comment><USER4> _A policy to let people propose pet projects and then give them 10% time for it._

Oh, yeah, no.

I have read research on this. You can foster a culture of innovation by doing things like giving away theater tickets, giving them time to do whatever the heck they want without proposing anything and seeing if anything useful turns up, and generally giving them more leeway to screw off, not less. The minute you try to slave _innovation_ to results, you kill it. It just dies.

I wish I could recall the name of a book or article or something. I cannot. Innovation is about putting different things together. You want to foster creativity by getting people doing different things and then find a way to capture the value. If you try to determine first if it has value, this will not work. It is a little like the idea that for brainstorming sessions, it is critical that you NOT pass judgment. You just toss out ideas and write them down, no matter how wacky sounding. Then you judge them LATER. Creativity and innovation need to be born of a situation with few constraints. These things do not perform on command. Milking them for value has to come at a later stage.

Start hobbyist type clubs at work. Have social events for people to meet and greet. Get cross connections going. Give away tickets to theater or other enriching experiences. Feed the creative process. Don't try to make it "productive" from the get go. Capturing value has to be a later step in the process.

Best of luck.

<comment><AUTHOR> Thanks for the perspective. Yea, I was hesitant to suggest pitching an idea before granting the 10% time because a lot of ideas need more time to percolate before sharing. Do you know of cases other than Google about sharing time between the day-to-day and creative projects?

<comment><USER4> Off the top of my head, no. Sorry.

</comment></comment></comment><comment><USER5> I like the 10% thing, but the problem is that a lot of the legitimately innovative products would never be authorised.

The 10% thing, to me, only works if it allows people to escape the internal political machine. Let's say you have an existing product, 1 mil+ LoC and ten years+ old, and some young upstarts want to try and rewrite it from scratch, of course the management is going to outright say "no" because:

A) It would take an entire department many years to accomplish the same task.

B) It won't generate new revenue streams even if successful.

C) It competes with an existing product.

But that's exactly the type of thinking that causes very successful companies to ultimately have the rug pulled out from under them when external developers do the same exact thing, and are able to deliver a more modern alternative in fewer lines of code (because it didn't evolved, it was designed that way) and with less bugs (due to better use of libraries and pre-existing code bases).

I guess what I am getting at is: that term "let people" has a lot of baggage. Ultimately you might just see people using their 10% not to innovate but instead just to do more of the same-old, same-old because that's all management will allow.

I've always wondered if big companies shouldn't try to simulate a "startup." Imagine this: You take ten developers and one manager. The big company continues to pay their normal salary, and they have six months, their own space, and a modest budget to produce whatever they want (no questions asked). The thing they produce is then trialed and if it proves to be successful, there's a personal financial incentive to the eleven people involve (e.g. they get a % cut of the profits for a period).

Essentially do a startup, but take the risk out of it (no financial danger), and keep the incentive (since they personally financially gain). Do one "startup" a year using a different eleven (10 + 1) people. As a bonus you'll likely see a morale gain due to just changing up what people do day to day.

Something can also be said for turning it all into one giant competition. See Steve Jobs with the Lisa vs Mac "war." It might have ultimately got Steve fired, but it also kept both teams on their toes and may have worked if he hadn't have gone overboard with it (and the Lisa in general). When he returned he continuously started projects which ate away at other products Apple produced (e.g. iPhone Vs. iPod, iPad vs. Macbook, and so on).

<comment><AUTHOR> Thanks for the response. I think the reasons for not requiring authorizations are really good.

I think the 'internal startup' idea is good... Have you had experience with it or know of a company besides Apple that did something like that?

</comment></comment><comment><USER6> for one, get people out of their chairs consistently, a hell of a lot more often. Creativity is stifled sitting at computers. innovation and problem solving comes from a sythesis of ideas. Humanity sitting at a desk is not a physically optimal way to tap into the brain's higher functioning or generating energy from collaboration.

<comment><AUTHOR> Makes sense! We think that breaking out of the daily tasks is important. One area that we are also struggling is whether or not to include the sales/product team in this. Typically, we already work on _their_ ideas, but we want to help the engineers develop this influence as well.

</comment></comment><comment><USER7> One thing you don't need is an innovation department. That's pretty much an oxymoron.

Instead, focus the entire organization to deliver the best possible product for the user. No compromise. That's where innovation is.

<comment><AUTHOR> I totally agree - you can't force ideas. But what we are trying to improve is that instead of everybody working to meet the daily requirements, that we try and shift the culture to recognize that ideas need room to breathe and time to be worked on. We're trying to find specific implementations of innovation- culture, other than Google's 20% time, as examples of institutionalized ways of promoting idea generation.

</comment></comment><comment><AUTHOR> Thanks for the responses so far. One thing I think is interesting is how much mindshare Apple has in the innovation field. Are there other companies (in particular non-tech) that stand out?

</comment><comment><USER8> Three things are needed IMO: 1) autonomy 2) upside 3) minimum red tape</comment>


My #1 Doh moment so far - <AUTHOR>

I sold the domain name socialgraph.com for $1500 to some woman claiming inexorably to want it for "just a personal homepage". Ah well, I thought, I will probably never get around to building something for this particular domain anyway, might as well make a few bucks.
A few weeks later, Mark Zuckerberg is on Web 2.0  Summit telling about something he calls the Social Graph and I whip up the whois results for socialgraph.com.
Administrative contact: firstname.lastname@example.com
Doh! Would probably have been able to score a few more bucks from recognizing the term social graph before Mark did.
Proof is in whois record history for socialgraph.com. <comment><USER2> You still made a profit ;p stop looking in the back mirror OR just build something to take on facebook ;p

</comment><comment><USER3> You shouldn't have been domain camping in the first place :)

<comment><AUTHOR> Maybe not :) Although I'm reluctant to call it camping when you have a clear idea of something to accomplish with the domain. Even if it's not to take over the world :)</comment></comment>


BMW are complying with the GPL - <AUTHOR> https://shkspr.mobi/blog/2016/03/bmw-are-complying-with-the-gpl/ <comment><USER2> Interesting: BMW did share the OSS they used, and in the process they also revealed lots of outdated packages in use. This of course leads me to wonder: Vulnerabilities?

It is after all an Internet-connected vehicle.

Despite the article author's recognition given for BMW's OSS compliance, I am dismayed to see yet another example of likely inconsideration given toward implementation of security in the engineering of an Internet-connected vehicle.

This sort of negligence is eventually going to result in some rather ugly outcome.

<comment><USER3> Total guess: as a regulated company, they may have to get approval for their code, which would include validated versions of 3rd party code. If they have to go through that with any new version of 3rd party code, they may not want to make that effort.

<comment><USER2> Well, the first time a hacker vehicle exploit results in one or more deaths of the driver and/or passengers of one of these Internet-connected vehicles, it's going to be all over the news. Right around then... and when the lawsuits hit, some execs/directors are going to realize that such effort is far less costly than the PR disasters that can unfold when corners are cut.

I mean, obviously some people at Volvo thought that actual emissions compliance was far too costly to bother with --and that didn't even result in a vehicle accident or personal injury. Certainly their bottom line has had a major impact as a result. The potential for PR disaster with Internet- connected vehicles is certainly much more concerning.

The inevitability of some such future tragedy and resulting media-fueled PR disaster for one or more vehicle manufactures is a certainty. It's only a matter of when and which vehicle manufacturer(s) will be liable. When that happens, I'm certain that such sizable companies can figure out how to streamline the approval process with whatever regulatory bodies might be involved, or they'll just learn to live with the pain… for being for less than the much greater pain of a PR disaster.

<comment><USER4> > Well, the first time a hacker vehicle exploit results in one or more deaths > of the driver and/or passengers of one of these Internet-connected vehicles

It's the infotainment system according to one of the original blog posts. And in fairness the previous post was all about the updates they were providing - albeit unencrypted.

<comment><USER2> It doesn't matter if it's the infotainment system so long as it's connected to the rest of the electronics. Yes, hacks have already exploited critical vehicle controls via Internet infotainment systems. So long as vehicle manufacturers do not physically separate the electronics, such vulnerabilities will surface. Currently, the standard practice is to build out the electronics for a vehicle as a single system.

<comment><USER5> I'd rather wait until your claims of security issues and remote hacks are verified for the particular vehicle here.

All of this is just crying wolf so far.

<comment><USER6> Remote-drive vulnerabilities have been demonstrated in infotainment systems, proving that the class of vulnerabilities is real. There's no need to prove it can happen for every single vehicle to be concerned about general best practices.

<comment><USER5> Yes there is. If this system have no write ability onto the relevant CAN-bus, the class of vulnerability you talk about (which comes from the Jeep hack) does not exist.

But sure - best practices should be followed.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> I've got a draft to our CEO sitting in my inbox outlining why we should open source _some_ of our code - the majority of the argument posits that "technical investment" (as a corollary to technical debt) is possible. OSS can be viewed as a "technical share market," and by moving non-competitive code to open source you stand to reap "technical profit" or dividends. Not to mention that open-sourcing code usually entails a major cleanup effort (technical debt removal) prior to release.

I've already got CoreCLR listed as a positive example of this process and I really hope that BMW is rewarded for compliance (with feedback and patches) - having more examples will only strengthen my point that more can be gained by working with open source, instead of merely consuming permissive open source.

Either way, it's great to see compliance from such a large corporate.

<comment><USER8> Send it. If I can control and extend the computing environment in my car, I will buy that car. I will also release the code I write for it - which creates apps other car makers don't have.

<comment><USER9> If you end up tweaking the breaking system, just don't do it too late at night and remember putting an "I hacked my car's software" sticker somewhere visible from other cars in the road.

<comment><USER10> The "braking" system - or was that typo intended?

Either way, you don't need a license or even much in the way of special tools to replace the brake pads, rotors, calipers, or hoses on any vehicles on the road today. The parts are casually sold at tens of thousands of auto stores across the country in enormous volumes every day, many of them to ordinary men and women working on their cars in their garages. Not all of them get it right, but there is no outcry against this maintenance - why should there be a problem with software?

To further assuage your fears, braking systems and other safety-critical components have layers of software and physical fail-safes. If the wheel sensors report unusual data, all-wheel-drive may be disabled. If the anti-lock code doesn't work, you still have regular brakes. If the vacuum assist doesn't work, you still have manual brakes. Similar layers are present in the steering and engine control. If a mechanic applies caliper grease to the brake pads, all of this is for naught - but there is little the software can do to completely disable the brakes.

<comment><USER11> > Either way, you don't need a license or even much in the way of special > tools to replace the brake pads, rotors, calipers, or hoses on any vehicles > on the road today.

Some cars sold today require connecting of specialised diagnostics tool which will allow to change brake pads. Without this tool your calipers will not open. What this tool does? It just sends some commands through vehicle CAN bus, but those commands are proprietary, so you need to pay them about $10k-$100k a year to have access to commands for their cars and licence to use them in your tool.

</comment></comment></comment></comment></comment><comment><USER12> Good to see the follow up on this. And for what it's worth, I think Terence has handled this well and is being overly harsh on himself. The original comment was just a throwaway aside and not even an accusation. I don't think he should hold himself responsible for how others took the comment & inflated it.

As the owner of a BMW, he's entitled to ask BMW for a copy of the LGPL source used. Job well done.

<comment><USER13> I wish people stopped trying to tip-toe around the poor, hurt feelings of BMW. BMW is a big company and can afford to have properly trained customer reps that know how to point to the source code. We're the little guy here trying to figure out how our cars work; BMW is the giant just meeting their bare minimum requirements.

<comment><USER14> BMW doesn't actually have any feelings - it's a corporation, and it doesn't care how much some hacker is upset when a twitter rep doesn't know what open source is. The only people who care about software licences are people who write software. Deal with it.

<comment><USER15> > The only people who care about software licences are people who write > software.

This is not true in any way - people who use and sell software, such as BMW, spend a lot of time, money, and lawyers on licensing issues.

Corporations care about anything that affects their bottom line, and a distinguished hacker who raises a small ruckus could ultimately build into disaster. It's simply responsible to have your front line know who to refer people to when they ask if you're in compliance with the law.

</comment></comment></comment></comment><comment><USER16> Some thoughts:

Most of the companies ship older pieces of software for one important reason: They need to avoid GPL/LGPL/AGPL version 3. Version 3 of GNU GPL gives users more freedom which companies hate.

For GPLv2 the companies had to just give away the source code. But they need not give away a way to change the software in the hardware. Which was then popularized as Tivoization. Version 3 of GNU GPL family of licenses fixed that. But companies didn't.

So you can see a pattern in any hardware (routers, Cars, etc.) and even in OS like Mac, *BSD etc. And the pattern is they always avoid GPL v3. So they always have old gcc, coreutils, bash, and everything else. They say its GPL, but there is a vendor lock-in, as always.

<comment><USER17> TL;DR: Companies don't hate "giving users more freedom"

Having worked with IP lawyers on multiple consumer electronic products across multiple companies, I believe you are over-simplifying the situation. Every IP lawyer I've talked to didn't care about tivoization -- if you want to go run your own code on our hardware, great, good luck. The main issue with GPLv3 was always the patent clause: [http://www.gnu.org/licenses/gpl-3.0.en.html#section11](http://www.gnu.org/licenses/gpl-3.0.en.html#section11)

I've never met an IP lawyer working for a company with many (hundreds to thousands) of patents allow use of the GPLv3, out of fear that it could undermine their ability to enforce patent rights defensively. Hardware companies produce a ton of patents. The manufacturers of routers, cars, and even Apple care deeply about their patents. They're not willing to toy with some untested clause in a license of some free software, when there is a perfectly usable version of that software without such a clause.

IANAL so I don't know for sure if this is the case, but speaking from experience, this is what lawyers have always told me.

Second, companies generally don't make it easy for users to run custom software on their products for a few reasons. You generally put software on products one of two ways: physically, or over-the-air (wifi/ethernet/some other way). With both methods, "signed" payloads are usually used for one of two reasons: to make sure it is error free. It's difficult to have the device already know the checksum, but calculating a signature against a pre-installed signing certificate is easy and works pretty well. You also get the added benefit of decreasing the surface area for remote attackers, since only the trusted company can sign the payloads. Typically, also, physical writing is "disabled" during assembly (e.g. not populating components, sealing off access, etc.) which helps keep costs down and keep the design looking slick.

The second reason "signed" payloads are used is for "Tivoization". I've never heard anyone say "we don't want customers putting their own software on a device they purchased." No doubt it happens, but it is rare for sure.

Should companies spend more time and resources to make it easy for their customers to modify their devices, in a sane and secure manner? Possibly. But in today's cutthroat consumer-electronics world, you'd be hard pressed to find a company willing to spend that extra engineering effort on something so frivolous.

<comment><USER18> I have heard this theory before but the one fact that speaks against it is the Apache license. GPLv3 did not not invents its own patent clause, but rather copied significant parts of apache as a base (stand on the shoulders of giants, avoid NIH, and so on...).

 _" Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor's essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version."_

 _" each Contributor hereby grants to You a perpetual, worldwide, non- exclusive, no-charge, royalty-free, irrevocable (except as stated in this section) patent license to make, have made, use, offer to sell, sell, import, and otherwise transfer the Work"_

They did add one major change (beside rewording and reordering), and that was to address the Microsoft-Novell patent agreement. A distributor can not chose to exclusively grant the patent rights to just a selected group, but must do so on a all-or-nothing deal. Once you provide a patent grant and complying with the license, the patent grant is given to everyone who might later receive a copy.

So for all those companies that are happy to distribute apache licensed software but not gplv3 software, and is objecting on the subject of patent clause, one must ask why they have a problem that the patent grant is extended to everyone.

<comment><USER17> Well, the Apache license is different from GPL in that you are not required to distribute any source, and your "derivative works" do not fall under the license. I can freely use Apache licensed software and jumble in all my patents and even statically link it all together there is no impact to my patents whatsoever.

The point you make covers contributors, which is great! It means if I contribute to an open-source project that uses the Apache license, there are no catches, not even if I contributed something I or my company has patented. So you, as an end user, or consumer of this software, are safe w.r.t. patents. Hurray!

(Again, IANAL!)

</comment></comment></comment></comment><comment><USER19> One of these things is not like the other… [https://github.com/edent/BMW- OpenSource/blob/master/FOSS_S1/...](https://github.com/edent/BMW- OpenSource/blob/master/FOSS_S1/desktop.ini)

<comment><USER20> Why do they have cups? Is there a 'print from car' button? [https://github.com/edent/BMW- OpenSource/tree/master/FOSS_S1/...](https://github.com/edent/BMW- OpenSource/tree/master/FOSS_S1/cups)

<comment><USER21> They could be providing lots of extra unrelated source code packages to the guy, perhaps just to be thorough and to avoid missing anything, perhaps to just fill the DVD (don't let those ones and zeroes go to waste!), or perhaps to mess with people :) (e.g. throw in a SNES emulator source code to make hackers spend days searching fruitlessly trying to figure out how to make the BMW interface start playing Mario)

</comment></comment></comment><comment><USER22> Just wonder is anyone tried to get (L)GPL sources from Tesla?

<comment><USER23> Yes. I asked 2.5 years ago, no reply.

<comment><USER24> Probably time to get Software Freedom Conservancy involved:

[https://sfconservancy.org/copyleft- compliance/](https://sfconservancy.org/copyleft-compliance/)

</comment></comment></comment><comment><USER25> Off-topic: The title and several post refer to BMW as a plural: "BMW are complying" and "Do BMW have any obligation...?"

I know BMW stands for Bavarian Motorworks, a plural, but so does the US, and it is a singular entity today.

Are the people using BMW plural non-American? I've never heard that here in Texas.

<comment><USER26> They (BMW) are a group of people. They (BMW) are complying.

That's the way I've had it explained to me.

<comment><USER27> How is that an appropriate explanation, when you--presumably--wouldn't say "The group are complying"?

<comment><USER26> Corporations are viewed as collective nouns to be used with plural verbs, where as "group" is a collective noun that is treated as singular. I can't think of a context in which I'd use a plural verb with it, but I can think of dozens of such nouns that I would. You can say "The group is complying. They have an obligation." without it sounding awkward, however.

Something about formal, notional and situational agreement[0].

The "they" explanation just helped bridge the gap in my mind.

[0] [https://en.wikipedia.org/wiki/Comparison_of_American_and_Bri...](https://en.wikipedia.org/wiki/Comparison_of_American_and_British_English#Formal_and_notional_agreement)

</comment></comment></comment></comment><comment><USER28> There are some interesting things in there. tcpdump? Locally patched one at that? I wonder how is it used... maybe it's just used for debugging, but given that it's part of the deployed packages it's still interesting.

edit: it looks like it was added specifically for IEEE 802.15.4 debugging

</comment><comment><USER29> As someone who has enforced the GPL for a few decades, I have to note the GPL compliance process isn't done here yet. Someone actually has to verify that the "scripts used to control compilation and installation of the executable"(s) actually work. Is anyone working on that?

</comment><comment><USER24> Interesting that they use SuperH CPUs. There is an in-progress Debian SH4 port. Debian on your car!

[https://wiki.debian.org/SH4](https://wiki.debian.org/SH4)

<comment><USER30> The Linux on Dreamcast effort made a ton of progress running on SH4. I haven't touched it in years, but I remember it being pretty mature, and that was quite a few years ago.

I guess this means that BMWs are basically just a Dreamcast with wheels?

</comment></comment><comment><USER31> Most of these packages aren't modified at all? Wouldn't it be just enough to provide the Links?

<comment><USER32> I think GPLv3 lets you just provide links to upstream mirrors if it's unmodified, but GPLv2 doesn't have such a provision.

</comment></comment><comment><USER33> What about their in-house software that links against this software? Or is it all LGPL?

<comment><USER34> How would inhouse software affect GPL compliance?

<comment><USER33> They are possibly distributing a derivative work without releasing the source code, if it GPL licensed.

</comment></comment></comment><comment><USER35> The string 'open source' appears three times in the article, the word 'free' doesn't appear (outside of the file listing, in the context of things like FreeScale, etc).

The string 'open source' does not appear at all on either:

      http://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html

     or

      http://www.gnu.org/licenses/gpl-3.0.en.html

Relevant as we're specifically referring here to the GNU Public Licence.</comment>


LivingSocial lost $558 million in 2011 - <AUTHOR> http://www.washingtonpost.com/business/economy/livingsocial-lost-558-million-in-2011/2012/02/01/gIQAjId3hQ_story.html?tid=sm_twitter_washingtonpost

<comment><USER2> Would be interesting to see what kind of return they get on their advertising activities - even in Australia I see a lot of offline billboards.</comment>


A Collection of Examples of 64-bit Errors in Real Programs - <AUTHOR> http://software.intel.com/en-us/articles/collection-of-examples-of-64-bit-errors-in-real-programs/ <comment><USER2> I found myself chuckling at all the odd little pictures used to denote invalid memory areas or edge conditions (16-bit Windows is a semi-truck stuck in mud, integer truncation is the top of a truck getting shorn off by an overpass). Haha!

This is definitely one of the more colourful technical documents I've read.

</comment><comment><USER3> _Despite the passing years, programs or some of their parts written in C remain as large as life. The code of these programs is much more subject to 64-bit errors because of less strict rules of type checking in the C language._

Yeah, because a language with 4 different typecast operators is type safe.

<comment><USER4> As far as I know, C only has one; perhaps you are thinking of C++?

<comment><USER3> I'm making fun of C++ programmers that think C++ is better than C, like the authors of this article.

</comment></comment></comment><comment><USER5> While some of these are great examples of common pitfalls with 64 bits errors, I find it amusing that the first example has a deeper conceptual problem: You can't (shouldn't) use memset to assign NULL to a pointer variable. In many (maybe most) implementations the address 0 is used by the implementation for NULL pointers but the standard allow any number (that can't be a valid address). The compiler automatically converts both 0 and NULL to the proper number when assigned to a pointer; but setting all bytes to 0 (as with memset) only works in the implementations that actually use address 0 for NULL pointers.

<comment> alok-g I was under the impression that NULL is required to be zero by the standard by now. If still not, it's high time that they give up! Differences like this between theory and practice do not go away easily. The decision is changing which one is easier, the culture or the rule...

<comment><USER6> It hasn't, and it won't, because a definition of NULL as "all-bits-zero" would be inconvenient for some embedded systems, where I/O ports or interrupt vectors are mapped at low addresses.

</comment></comment></comment><comment><USER7> Pretty basic stuff, but unfortunately when these errors are made in real life, they are sometimes very hard-to-catch heisenbugs.

<comment><USER8> I hadn't heard the term _heisenbug_! Here's a link for anybody else who may not know the term (and others of that sort): <http://en.wikipedia.org/wiki/Unusual_software_bug>

<comment><USER9> Wikipedia's attempts to come up with names for these classes of things that "everyone" already groups together, but which have no widely used name, because it has to give the article _some_ sort of title, are a pretty nice feature of the encyclopedia. "Unusual software bug" has a nicely euphemistic feel to it too, sort of like "anomalous condition".

</comment></comment></comment><comment><USER10> Ah ... I remember the good old days when you just had to be careful about big- endian/little-endian when doing bit twiddling :)

</comment><comment><USER11> The article failed to mentioned that there are few "C" language 64-bit models - where ints, shorts and longs can be of different size (or all equal to the pointer size). Some compilers, operating systems, and combinations of take one model as preferred over another (or just assumes that model).

[http://en.wikipedia.org/wiki/64-bit#Specific_C- language_data...](http://en.wikipedia.org/wiki/64-bit#Specific_C- language_data_models)

<comment><USER12> Why do some people put C in quotes when talking about the language? Do they also type "Java" or "Perl"? It's bizarre.

</comment></comment><comment><USER13> Non C/C++ user here...

A lot of the problems are due to the assumption an integer is big enough to store a pointer.

Just wondering: is there a way to make the compiler barf if such an assignment is done? Or for generating a runtime error if the assignment doesn't fit?

<comment><USER9> I believe gcc will warn about this, unless you explicitly pass _-Wno-pointer- to-int-cast_ , which will "suppress warnings from casts from a pointer to an integer type of a different size."

</comment></comment><comment><USER14> This article can be summarized as follows: use size_t and ssize_t when doing pointer arithmetic

<comment><USER15> Sure, as long as you are working with a standard and linear memory model. The assumption that size_t and ptrdiff_t can store a pointer may break down on segmented memory architectures for example. If you want to code against the standard instead of an assumption, use uintptr_t and intptr_t instead.

<comment><USER16> When would someone want to use intptr_t instead of uintptr_t? Does a signed memory address even make sense? Perhaps intptr_t is available to avoid compiler warnings about mixing signed/unsigned ints when adding a uintptr_t and a (signed) ptrdiff_t.

<comment><USER15> While I don't know of any specific use-case, it is of course very easy to imagine an architecture with signed memory-address space. One could for example separate protected/kernel memory from user land memory with the signedness.

</comment></comment></comment></comment><comment><USER17> I get a:

504 Gateway Time-out nginx

Is this one of the example 64-bit errors?

Edit: Now it's working</comment>