Microsoft Mission Impossible - <AUTHOR> http://www.mondaynote.com/2013/10/13/microsoft-mission-impossible/ <comment><USER2> I don't understand the fatalist mood in articles like these.

Microsoft is still a very healthy company, and now they _finally_ got that healthy competition. Competition is good for the market, it's good for us consumers. Hell, it might even be good for Microsoft in the long run.

I'm admittedly a bit of a Microsoft fanboy, but I doubt that would've been the case if MS had still been the monopolist steam roller it once was.

The current market has forced MS to truly innovate and to be a much more friendly company in general (evidenced by e.g. their broad contributions to open source these days). How can that be bad?

</comment><comment><USER3> One of the really surprising things about Microsoft is that despite all the caustic internal politics, CEO antics, missteps, misfires, a business model designed to extract maximum money from everybody, and even questionable development and design practices, on occasion really _great_ software (and hardware) comes out of there.

World class, amazing, top of the industry with no true peers.

For example, despite all of the good ideas and theory and philosophy, open source, after 13 years of effort, (while there's definitely been good work done in the area) has yet to produce an office suite that's _at least_ as good as MS-Office is in all areas.

I'm sure the MS-Office codebase is a horrible mess, but the end user bits are good enough for nearly all of the weird edge-cases that 99% of users want and 99% of users can learn to use it to some level of effectiveness in a couple afternoons.

That's amazing.

<comment><USER4> I'd be interested to hear what your other examples are, but that doesn't surprise me at all.

If OpenOffice (etc) ever had comparable staffing (quantity and variety, not even questioning quality) that MSOffice has had for 15-20 years, I'd expect more comparable results.

<comment><USER5> Visual Studio is probably the best way to write C++. Windows is probably the best operating system for the enterprise and is ahead of OS X and Linux in bringing a desktop OS to tablets and touch laptops. C# is arguably the best language for writing enterprise applications. Xbox arguably won the console war of the current generation. Kinect is the only consumer product like it. Surface Pro is probably the best desktop replacement tablet. (disclosure: microsoftie)

<comment><USER6> Yes, I think it's arguable that MS won the console war.

Could you tell me what you are measuring to reach that conclusion? Last I looked, the only category where the Xbox was ahead is US sales, and even there, they were only marginally ahead of the PS3.

<comment><USER7> I question why anyone would think winning a generation (or two) would mean the war is over?

There's pretty much always been multiple competing consoles, and I don't think Sony and Nintendo are ready to throw in the towel.

<comment><USER3> I would not be surprised at all if we see other competitors enter the market in the next 2 or 3 generations. For example, Samsung or even an unknown. As the hardware is now basically topping out, it will eventually commoditize to the point that even smaller companies can have a go at the market.

</comment></comment></comment></comment></comment></comment><comment><USER8> I think the people who say Microsoft has been a huge failure for the last decade should take a better look at the numbers that matter. The stock price doesn't matter. In 2000, we were at the top of the tech bubble. Bubble means valuations were stupid.

The story talks about 2000 report with 19.3 billion from windows and 23 billion total revenue. On the other hand, Microsoft made 19.9 billion in revenue just last quarter, with 5 Billion in net profit. 6 Billion operating income because of the surface writeoff.

Are other companies doing better? Yes. Could Microsoft have done better? Yes. Have they done badly? Not at all. They have grown revenues and profits at huge and absurd levels over several different divisions. They are also not going to die any time soon, and I don't think there are too many options to take a company this big private.

<comment><USER9> Microsoft has done quite well financially, but where they look bad is when you see how much Google, Apple, Facebook, Amazon, etc. have grown in the same period.

One thing I learned in business school is the measure of a CEO is not whether or not they did a good job, but rather if they did a better job than someone else in the same position. It's hard to look at Microsoft in the last 10 years and think that they have done as well as they could.

<comment><USER8> That's silly. Google, Facebook, and Amazon barely existed at the beginning of this timeframe, and Apple was near death. Microsoft on the other hand was a several hundred billion dollar company. To expect similar growth rates is absurd, and only one of these companies is actually a direct competitor.

</comment></comment></comment><comment><USER10> I would say their enterprise health isn't terrible and might even be growing.

But they're getting trounced in the consumer market so handily, and by so many other competitors, that it seems impossible they'll see ever see meaningful growth there. A lot of that is because of the legacy freight they're forced to carry wrt their PC and enterprise concerns...and because of the memories of everyone who had to deal with crappy MS systems in the 90's and early 00's.

I've often said it wouldn't be a terrible thing for MS to spin off a consumer division. It could integrate fully into MS's current services, but it would be free of the psychic burden of the "Microsoft" brand, with all of the stodgy uncoolness that that entails. Not to mention a separate company would be free to move more quickly in the face of the rapidly changing consumer market. However, the board would probably consider this to be a "hail mary" play.

I will be very interested in seeing how the new CEO handles the consumer side.

</comment><comment><USER11> I find the "iPhone killed Microsoft" story to be unconvincing, despite its popularity. Yes, the iPhone is wildly successful beyond anything Microsoft has invented in the 21st century, but _its a smartphone_ \- whereas, as this article itself states, Microsoft was in the business of peddling a Windows/Office bundle. So its not as if Apple and Microsoft are competing on that front; no one buys an iPhone to replace their computer (or at least, I've yet to see a single example of such), much less their word processor.

I mean, yes, Apple also handily outmanoeuvred Microsoft in those areas where they do compete, and has beaten back Microsoft's forays into mobile. But Microsoft's problems are much more mundane- office software became a commodity, and they've failed to produce a new OS that's a clear-cut improvement over Windows 95. One could imagine a Microsoft that found a way to meaningfully innovate purely on the good old PC platform and be successful without any of this mobile devices tomfoolery.

<comment><USER12> Ask a teenager if they'd rather give up their iPhone or their laptop; I guarantee they'll say laptop.

The real problem for Microsoft and PC makers is that everyone has a PC and they don't need a new one. Whatever PC almost anyone has is now good enough. People are spending their money on the latest phones and tablets.

<comment><USER13> True, a teenager would say that, but that's because teenagers are pretty shortsighted. Just wait until they get home and have to type up a school report. A few attempts on the touchscreen and even the most headstrong teenager will be ready to swap it for a laptop.

And while it's true that the PC market is sort of saturated, the tablet market too will suffer the same fate.

In the end the only thing that will continue to sell is services.

<comment><USER12> > Just wait until they get home and have to type up a school report.

I speak from experience, they will just use whatever PC is laying around or stuffed in a corner.

</comment></comment></comment></comment><comment><USER14> A note of context about the author -- Jean-Louis Gassée was the man behind BeOS and was an executive at Apple in the 1980s.

</comment><comment><USER9> The biggest problem with Microsoft after say 2005 was that it let things like Windows and Office drag it down to the point that if things competed with either, they were killed with fire.

For example, look at what Ray Ozzie got built with Azure, or what J Allard did with the Xbox, Xbox 360, Zune, and Courier. Azure was in a prime spot to do what Amazon ended up doing - being the computing platform for the cloud. Instead, nobody at Microsoft wanted to listen to Ray because selling Windows and Office on PC's and servers is the thing that drives MSFT today. Thus, if it competed with either, it's not going to get the kind of respect it deserves.

Look at where Microsoft is now on the consumer side. J Allard and his team were basically paving the way for Microsoft to make great consumer devices. Zune basically gave them Metro UI, Xbox 360 showed them how to do consumer hardware and supply chain management worldwide, and they were working on the Courier about the time the iPad hit. Microsoft did nothing with it and the iPad replaced literally millions of low end Windows laptops and netbooks. It took Microsoft something like 3 or 4 years to have an even competitive touch tablet experience with the Surface, and then it bundled desktop Office on a touch device.

The iPhone debuted in like 2007 and Microsoft is still peddling a desktop mode Word Processor on a touch tablet as a good idea.

The Surface launched without consulting the one team that had shipped tens of millions of hardware devices at Microsoft - the Xbox team and consequently built about 3 million too many Surface RT units which cost the company $900 million in losses.

For as much as Microsoft is trying, and they really are trying, Windows and Office are as much of a curse as they are a blessing in the modern era of devices, services, and the cloud. Where they end up is anyone's guess, but all the people who seemed to "get it" at Microsoft the last 7 years or so basically got ran out of the company and I have no idea if the people who are still there really "get it" enough to compete with the likes of Samsung, Google, Sony, Amazon, and Apple.

Also, remember when Microsoft was so terrified of Google owning search that they tried to buy Yahoo! for $45 billion? Imagine if that had gone through.

<comment><USER15> I mentioned before that the HTML export in Word/Excel 2013 is pretty much unchanged from 2003, complete with setting "Microsoft Internet Explorer 6 or later" in Web Options causing things like VML to be required that is not supported by IE10 anymore by default. You can see this if you draw a shape for example. I wrote an Ars Technica forum post on this.

</comment></comment><comment><USER16> I have a completely contrarian view: They should stop trying to be a competitor to Google and Apple. Continue with Windows and Office, and continue to improve them.

Get out of EVERYTHING else including all internet services and everything that is just a money-losing proposition.

Then buy back as many shares as possible, keep buying back shares and if the shares get too expensive start paying billions and billions in dividends.

Not every company is meant to be the next wave of the future, why not be content with how successful they are and be really good at it, continue to be great at it, and get out of everything else, banking as much money as they can in the process.

</comment><comment><USER17> Partial blogger says something partial, more news at 11.

</comment><comment><USER18> Summary: Steve Jobs Steve Jobs Steve Jobs

</comment><comment><USER19> > In an earlier incarnation I saw Microsoft play legal hardball against anyone > who tried to sell PCs with both Windows and another OS installed at the > factory…)

I know they played commercial hardball with people wanting to offer options other than MS operating systems. Does anyone have any information about them playing legal hardball (lawsuits or threats)?

<comment><USER20> How about this one?

[http://www.justice.gov/atr/cases/f3800/msjudgex.htm](http://www.justice.gov/atr/cases/f3800/msjudgex.htm)

The relevant chapter is III.H.64: "An aspect of Microsoft's pricing behavior that, while not tending to prove monopoly power, is consistent with it is the fact that the firm charges different OEMs different prices for Windows, depending on the degree to which the individual OEMs comply with Microsoft's wishes. "

EDIT: Replaced the link to the final version in stead of a proposal, added the quote

EDIT2: Duh, I totally missed your point. Yes, they have resorted to also that tactics lately. Just a few high-profile cases.

\- Microsoft sues Barnes & Noble over patents - [http://mashable.com/2011/03/21/microsoft-sues-barnes- noble/](http://mashable.com/2011/03/21/microsoft-sues-barnes-noble/)

\- Microsoft sues Salesforce - [http://news.cnet.com/8301-13860_3-20005306-56.html](http://news.cnet.com/8301-13860_3-20005306-56.html)

\- Microsoft sues Motorola - [http://www.techdirt.com/blog/wireless/articles/20101001/1356...](http://www.techdirt.com/blog/wireless/articles/20101001/13562611251/microsoft- sues-motorola-for-patent-infringement-over-android.shtml)

IMHO especially the B&N case is telling. A very sad story.

<comment><USER19> Thanks for that although I don't think it backs up the point I was questioning. Your inital quote confirms the commercial hardball that I never doubted and your later links confirm patent licensing demands against Android manufacturers although which isn't really about an "earlier incarnation [of MS]" and they have been making patent licensing deals with a great number of Android manufacturers so I'm not even sure I'd count it as hardball.

Note that I am not a supporter of Microsoft and avoid their products largely because of the commercial hardball they played when they had monopoly power but the original article suggested that they played "legal hardball" with OEMs who wanted to ship devices (I interpreted as PC's) with additional operating systems rather than just MS ones. I had no recollection of this and was looking for a reference before I add it to the list of offences I believe MS to have committed. It is not implausible but it was a new claim and I wanted to understand it.

I'm interested in understanding why you think the B&N case is so sad and telling. I haven't investigated the patents claimed but in principle the idea that MS requests fees for using it's patents isn't actually a problem for me.

</comment></comment></comment><comment><USER21> This article significantly understates the valuation picture of other tech companies during the dotcom bubble era.

Cisco was briefly worth more than Microsoft during the dotcom bubble. They had a $557 billion market cap, which is completely left out of the chart. Intel peaked at $509 billion (August 2000) - also left out of the chart. Nortel was worth $283 billion at their peak. Lucent was worth $285 billion. AOL was worth $222 billion. Oracle and Sun were both worth over $200 billion. Yahoo was worth $140 billion.

So they conveniently left out a cool $2.3 trillion or so in market cap among just a few other tech companies. Not to mention the various crazy valuations for companies worth tens of billions briefly.

</comment><comment><USER22> I'd take the job on for about 5 seconds before I pulled my golden ripcord. This is a job that no one likely can succeed at.

<comment><USER23> And I would take the job for $1 yearly and turn the company around. No golden parachutes needed.

MS has so many resources and good people that it is almost impossible with the right vision to fail on delivering.</comment></comment>


Troubled Obamacare website wasn't tested until a week before launch - <AUTHOR> http://washingtonexaminer.com/troubled-obamacare-website-wasnt-tested-until-a-week-before-launch/article/2537381 <comment><USER3> I've commented on HN recently on how ABSOLUTELY EYE-GOUGE INDUCING AWFUL it is to do any kind of software work for the Federal Government. Due to a broken hiring process and union-like job security, it is filled with incompetent morons constantly scheming to find any desperate way they can to demonstrate value. (I of course am talking about the GS-12 and up levels)

The men and women who work hard and care are like the proverbial Atlas: they do the work of 15, with the other 14 people in their group using their exurban DC commute to excuse their 7AM - 3PM schedule, of which the first 3 hours of their day is spent surfing the net doing jack shit. And then these fucking assclowns get promoted.

These are the people who do things like make major interface and usability changes to a massive healthcare website and just magically expect the contractor (CGI in this case) to be able to do it. They don't give a shit about wasting taxpayer money, because it has no effect on their career at all. Failed projects don't get you demoted or fired, schedule slips are so normal that nobody even bats an eyelash....

This causes any sane person who points out the cost in time and money of bullshit bikeshed type changes to be rolled over by the horde of overpaid lemmings who are trying to yell as loud as they can before they head out at 3pm for their kids volleyball game in Manassas.

If this looks like a rant, it is. I hate the GS system. It gives government a bad name, and these overpaid assclowns do nothing but fail, supplying ammo to every Rush Limbaugh in the world advocating for elimination of government.

Please, please, if somebody with power is reading this: fix the government hiring system. Fire the lazy assholes who work 5 hour days and pull six figures. Fire the people who think not knowing how to use a computer beyond Outlook doesn't interfere with their ability to perform as CIO of an agency. Fire people who are in charge of projects that go over budget and late. Fucking fire people.

Next week I'll be going in and meeting a GS-14 (just promoted for 13) who does NOTHING at work but talk about his motorcycle and martial arts. When tasks are handed to him, everyone else groans, knowing that it will simply not be done. Instead they go behind him and perform the tasks and hope he doesn't find out, cause if he does he will pull rank and humiliate them.....

Venting over.

<comment><USER4> This is not a rant, because it's the truth. To outsiders, this attitude seems hyper-negative because it's difficult to comprehend the level of ineptitude found in federal government IT. As a non-national who has done some (very non- sensitive) on-site IT work for the U.S. government, I experienced this firsthand for several years. (And before I get accused of elitism, my home country doesn't necessarily have the answers either.)

When all of the Snowden and PRISM stuff broke, my first thought was to chuckle and ask, "How?" Based on my experiences with federal IT workers, it's hard to imagine there is a room of crack coders underground in some basement or deep inside some mountain just knocking it out of the park.

<comment><USER5> The NSA recruits at some of the best graduate schools. In some quarters, the joke is that if you have a PhD in math, comp sci or software engineering and you're not teaching or doing post-doc work, you must be working in the _black_ world, which includes NSA.

<comment><USER3> Agreed. A young woman sitting next to me at a Hadoop oriented class during the summer (right as the Snowden info was coming to light) had just left the NSA.

She was brilliant. Little coding experience outside of Perl, but was able to keep up on the exercises in Java with only minor hiccups due to her lack of familiarity. She had been recruited out of graduate school.

On the other hand, she became extremely hostile when the Snowden incident was mentioned by people next to us (they didn't know her former employer) and was stating repeatedly that "None of you know what you're talking about, and if I was allowed to I would correct you, but I can't." and "Do you really think people can just sit down at a computer and spy on people without their supervisor's approval?" (as it turns out, we were right, and she was profoundly wrong)

It was a revealing moment, because it demonstrated the group think that can permeate even the most brilliant mind. Of course, she also thought there was nothing wrong with mathematics education in the U.S., which in my opinion makes her clearly deluded.

</comment></comment></comment></comment><comment><USER6> Shocked! I am shocked to hear that a major tech project with a hard deadline was pushed through at the last minute.

Kidding aside, a selfish part of me likes things like this because it lifts the veil and shows me that plenty of other people screw up. It's easy to dismiss it as a botch or idiot contractors but I'm guessing there's a lot of smart people, who worked long hours, and it's just hard to do right in these circumstances.

</comment><comment><USER7> There was a $600+ Million price for the website that was previously mentioned in HN comments on this topic, and others were claiming that this number was debunked, and the actual price was $30 Million or so.

NBC News has now released a report on what the actual numbers are. It's $196 Million as of 5/15/2013, and the price appears to be on its way to $292 Million: [http://www.nbcnews.com/video/nightly- news/53309356/](http://www.nbcnews.com/video/nightly-news/53309356/)

Anyway, I apologize if it looks like I'm spamming the thread with it (I posted at the bottom of the thread as a reply). That's not my intent, but I think it's important information.

</comment><comment><USER8> Why would this be surprising. It's a project with huge scope, with dependencies that they can't fully control (IRS, Social Security etc), with likely changing requirements, and a tight deadline.

It's not like they could have released in beta and iterated, or waited until it was perfect. It's the nature of the beast - if the major annoyances don't get fixed in a reasonable [1] amount of time, then it's worth writing reams over.

1\. Undefined.

<comment><USER9> The IRS interface is working fine [1]:

 _Sarah Hall Ingram, the director of the IRS 's Affordable Care Act office, told a House panel Wednesday that the IRS hasn't experienced similar problems.

"The portion of the responsibilities the IRS is in charge of is going fine," Hall Ingram said._

[1] [http://thehill.com/blogs/healthwatch/health-reform- implement...](http://thehill.com/blogs/healthwatch/health-reform- implementation/327483-irss-obamacare-implementation-going-fine-official-says)

<comment><USER10> According to the IRS.

<comment><USER11> Well, they could be telling the truth. E.g. " _(If and) When_ we get a query, we respond to it in our N second allowed window" (as I recall the total time allowed is 7 seconds).

I'm pretty sure some decent fraction of the entities Healthcare.gov queries behind the scenes are doing their job.

Well, most of the time. One thing that occurred to me is that if certain actions require a _lot_ of backend queries to different sources, multiplying the probabilities each could outright fail or blow the window could result in an overall flaky system.

Which doesn't directly explain why the offline part of the registration system is failing so often.

</comment></comment></comment></comment><comment><USER12> I have no particular opinion about this. However, in the context of an article that relies heavily on unnamed sources, it's worth pointing out that the Washington Examiner is a conservative tabloid founded in 2005 by Philip Anschutz.[1]

[1] [http://www.politico.com/news/stories/1009/28355.html](http://www.politico.com/news/stories/1009/28355.html)

<comment><USER13> I will make no bones about the fact I don't think Obamacare was a good idea on any level. But I say that just to put my cards on the table. Forget politics. I'm also a software engineer. Take off your politics hat and look at this with your software engineer hat. Tell me, with a straight face, that this shows any sign of being functional any time soon. Tell me that every software engineer alarm bell you have isn't going off. Tell me that this website, which consists of multiple pieces (insurance info in, user info in, user selection mechanisms, user information flowing back out to the insurance companies, and with every last one of those bits having endless, endless business rules associated with them, and this a gross oversimplification of what's there) only has problems with the user parts, coincidentally isolating all the problems into the only part we've really collectively looked at, and once those are ironed out it'll all go perfectly smoothly because this is an isolated occurrence and not indicative of the whole project.

Republicans and Democrats and bureaucrats and judges and media and internet commenters and everybody else can say whatever they like about whatever they like in whatever forum they like with as much or as little truth as they like, but the software doesn't care. It either works or doesn't. It can't be cajoled, can't be bargained with, can't be threatened, can't be ideologically swayed, and it's too stupid to be capable of any kind of cover up regardless of what its motivation may be. It is what it is, no matter which way you voted in the last election or which way you vote in the next.

<comment><USER11> We're already hearing about backend nightmares. Can't find the _Washington Post_ article where I first read it, but this UPI one citing them has the details I remember ([http://www.upi.com/Top_News/US/2013/10/12/Obamacare- website-...](http://www.upi.com/Top_News/US/2013/10/12/Obamacare-website-bugs- vex-insurance-companies/UPI-75911381598024/)):

" _Several industry executives told The Washington Post the daily reports on new enrollments since the roll-out of the Affordable Care Act have often included duplicative information, such as people enrolling and canceling several times in a day._ "

And you left out e.g. connecting to Experian to get the consumer's credit score, which is part of plan pricing (a general trend with deductibles going up). That one, I've noticed, pretty much requires the registration ... but doesn't explain why the site forbids under penalty of perjury playing "what if" to determine how you might best arrange things for you and yours.

<comment><USER11> And referencing a _Wall Street Journal_ article that's behind their paywall, [http://www.marketwatch.com/story/obamacare-woes-widen-as- ins...](http://www.marketwatch.com/story/obamacare-woes-widen-as-insurers-get- wrong-data-2013-10-18) says:

" _Emerging errors include duplicate enrollments, spouses reported as children, missing data fields and suspect eligibility determinations, say executives at more than a dozen health plans. Blue Cross & Blue Shield of Nebraska said it had to hire temporary workers to contact new customers directly to resolve inaccuracies in submissions. Medical Mutual of Ohio said one customer had successfully signed up for three of its plans._"

On the other hand, _if_ they get _something_ , this tells us one simple method the insurance companies can generally use to resolve issues. Although it sounds like they'd best contact everyone who maybe signs up, and no doubt the system will be telling two or more companies that some customers have signed up....

A lot messier than CGI Federal's Medicare.gov's Part D prescription plan signup system, where in all fairness the info is binary (I've signed up with X plan) and both sides can depend on the site doing the right thing.

</comment></comment></comment></comment><comment><USER14> Surprise, surprise the government is still using waterfall.

<comment><USER15> Well, read the article. The claim is that requirements were still changing 4 days before the launch. That's not waterfall, that's just no process at all.

<comment><USER5> I wonder if the requirements had already been finalized and it's just the "final" signed off documentation that was delivered so late. . .yes, still broken/no process.

</comment></comment></comment><comment><USER16> The fundamental issue here, like many projects of this size, is that it was trying to deliver a solution to a ridiculously complicated process. Moreover the way of procuring that solution is also fundamentally broken. Simplifying the underlying process would take a level of politics that is sadly well beyond even one party, let alone two.

</comment><comment><USER17> Wait...it was tested?

</comment><comment><USER5> I find it hard to believe that CMMS actually performed system integration, such as it was. I find it easy to believe that CMMS hired a contractor to perform system integration. And just as the individual contractor employees saw issues, there were probably government employees within CMMS who also saw issues. . .and just enough senior executives - government and contractor - <USER2> ignore the "naysayers". . .and insist on having their fingers deeply in the pie of such a high-visibility project.

And, of course system integration was not the only project management/technical issue with this project.

<comment><USER11> I don't see why you find it so hard to believe. Hubris is a pretty common human flaw, perhaps it was felt this was too important to leave to the professionals.

In this article, we have two sets of sources using two different methods telling us this, and one of them is able to go on record, true name and all. It's also entirely consistent with the observed results (of course, so is having an outside integrator).

<comment><USER5> Climb down. . .I'm not accusing anyone of lying or fabricating. And yes, I'm well aware of the prevalence of hubris. I find it hard to believe because, having worked on both sides of the fence, I've never known or heard of any agency of any size, even DoD, doing the integration themselves. They almost _always_ have contractors doing it, though they may manage the contractors and call themselves integrators. I believe they may have referred to CMMS as integrators without giving any thought to the contractor who actually performed the integration - at the contracted direction of CMMS.

<comment><USER11> Errr, I didn't think you were, and am sorry if I gave that impression.

But I've stumbled across even more confirmation, first from a _New York Times_ article on the 12th that I'm amazed we missed ([http://www.nytimes.com/2013/10/13/us/politics/from-the- start...](http://www.nytimes.com/2013/10/13/us/politics/from-the-start-signs- of-trouble-at-health-portal.html?_r=2&pagewanted=all&)), which says:

" _One highly unusual decision, reached early in the project, proved critical: the Medicare and Medicaid agency assumed the role of project quarterback, responsible for making sure each separately designed database and piece of software worked with the others, instead of assigning that task to a lead contractor._ "

And then a _National Review Online_ (flagship publication of the Right, going back to 1955) article by a non-specialist who got information from 5 CMMS officials who also aren't software engineering types (but of course all concerned are learning a lot now, as I'm sure most of us did once upon a time). In [http://nationalreview.com/corner/361577/assessing- exchanges-...](http://nationalreview.com/corner/361577/assessing-exchanges- yuval-levin) he says they confirm most everything in the NYT article _but_ the also disputed here by eyewitnesses claim that coding didn't start until February. For integration:

" _The people I spoke with did all confirm the importance of one other detail in the Times story: that CMS did not hire a general contractor to manage the exchange project but handled that overall technical management task itself. None of the people I spoke with wanted to get into how this decision was made or at what level, but all of them agreed that it was a very bad idea and was at the core of the disaster they have so far experienced._ "

The above also might have input from the 3 insurance industry people he talked to.

And it's refreshing to see a lot of people put politics somewhat to the side to figure out just what went wrong in project management and software engineering land. The whole nation is getting an education in this, or as the NRO author put it:

" _But [the CMMS officials] are policy and management people, not information- technology experts.

This latter point turns out to be quite important. The reaction of these individuals to what has happened in the last two weeks is the reaction of people who are coming to realize that their expectations and understanding of web development were mistaken. They believed (as I did too, I admit) that whatever technical problems the exchange sites encountered at first could be cleared up quickly and simply once things got going—that the contractors developing the websites could just respond to problems on the fly, as they became apparent. It is now increasingly obvious to them that this is simply not how things work, that building a website like this is a matter of exceedingly complex programming and not "design," and that the problems that plague the federal exchanges (and some state exchanges) are much more severe and fundamental than anything they imagined possible. That doesn't mean they can't be fixed, of course, and perhaps even fixed relatively quickly, but it means that at the very least the opening weeks (and quite possibly months) of the Obamacare exchanges will be very different from what either the administration or its critics expected._"

Well, its policy type critics. A lot of us expected the common big project screwups, which are hardly confined to the government.

</comment></comment></comment></comment><comment><USER18> $500mm web site. 1/2 of a billion. for a website.

<comment><USER19> > for a website.

No, for a complex web of third-party integrations underlying byzantine business logic. With a web site as the end-user interface.

<comment><USER11> And with the powers that be _constantly_ changing the requirements.

According to the first anonymous source of in this article, up to the 4th or 6th day before launch.

No matter how good CGI Federal is, if they were being forced to constantly rework stuff that should have been frozen months ago that'll bust the budget and overall decrease quality as other stuff doesn't get the time needed for polishing and testing as well.</comment></comment></comment>


Giant Plush Microbes - Toxoplasmosis, Gangrene, Etc. - <AUTHOR> http://www.thinkgeek.com/geektoys/science/6708/

<comment><USER2> This has been on thinkgeek for a long time. Why is it so high here now today, spam?

</comment><comment><USER3> Also available from the MOMA Shop in New York and Cyberdog in London.

</comment><comment><USER4> :-O</comment>


On eve of IPO, Twitter reports patent threat from IBM - <AUTHOR> http://arstechnica.com/tech-policy/2013/11/on-eve-of-ipo-twitter-reports-patent-threat-from-ibm/ <comment><USER2> This is pretty standard operating procedure, unfortunately. They can expect software licensing audits as well.</comment>


I Rented Apartments To Rent Out On Airbnb For Profit - <AUTHOR> http://needwant.com/p/rented-apartments-rent-airbnb-profit/

<comment><USER2> He did not include expenses for insurance, property damage, paying tax and so on. And he still was only able to turn out a healthy profit in one of four locations.

Does not look like a viable business idea to me.

However it may be a good way to lower rent or afford an oversized appartment.

<comment><USER3> Essentially, he's operating as a realtor, or landlord-as-a service. A broker, a middleman, who smooths the process and reassures customers. It doesn't seem very scalable, but if it doesn't take much time then great.

</comment></comment><comment><USER4> Let me ask the question everyone else is - when will I have the time to do this? Haha.

</comment><comment><USER5> Then one of your guests brings bedbugs and the nightmare begins.

<comment><USER6> Or accidentally causes a fire which damages the building and the other tenants property. His insurance would definitely not cover anything like that.</comment></comment>


Ask HN: What job could you do that you can't get? - <AUTHOR> Is there a job which you would like to have, know you would be great at, but there is an arbitrary obstacle in the way of you obtaining that job, even though you could perform that job currently?
For example, some people are naturally great teachers, but to teach in certain areas requires a degree.
Or perhaps you have a friend with a better job than you have, but they come to you for help because you are good at whatever it is they do professionally.
If there is a qualification that you think is bogus but you notice it is regularly asked for, I'm interested in hearing about it.
If you have a story about how you overcame an obstacle in being hired while lacking a qualification, please share that too. <comment><USER2> When I was first starting out in the tech industry, I was lucky enough to get hired in a sys-admin-like job for a small (<25 people) company without a degree.

I'm not talking about securing Ft. Knox or dealing with critical infrastructure. Just your basic stuff: updates, passwords aren't "password", daily troubleshooting stuff, onboard new employees, deal with tech vendors, clean up the spreadsheets, put on a security awareness presentation, handle ordering new equipment, etc.

Most positions like this, at least in my area, ask for a bachelors and a few years work experience. It's ridiculous, really, considering this type of catch-all low-level tech work can be completed by anyone with a decent handle on computers.

I dont think CS degrees are bogus, but for a job of this calibre.. It's like requiring a Fields Medalist to crunch your budget numbers.</comment>


Ask HN: Someone's using my ID on the web, what should I do ? - <AUTHOR>

He took a domain name and a fake yahoo email with my name and surname. What would you do if you were in the same position ? Should I care or not ? <comment><USER2> You could try contacting Yahoo about the email, I'm not sure how well that would work, but you've got tons to work with on the domain name.

You're you, he's not. Dispute the domain, how it's your name and your address: <http://wdprs.internic.net/>

Additionally check out <http://www.icann.org/en/udrp/> if you want to go further.

<comment><AUTHOR> Thanks for these good advise and for the links.

</comment></comment><comment><USER3> How do you know it's fake? I have a Google Alert set up for my name, and see news about at least 6 other people with the same name as me.

<comment><AUTHOR> I know it because of the address on who.is, it's mine (I should have known if there was someone with the same name at my building). The all thing seems to be a bad joke, but I want to know who is behind it

</comment></comment><comment><USER4> Register another top-level domain under your name and out-SEO the imposter.

<comment><AUTHOR> Good point , I'm not so good at SEO but I'll do my best.

</comment></comment><comment><USER5> Maybe you're on Substance D?

<comment><AUTHOR> I thougt about that but no, I also thought about sleepwalking but as far as I know myself definitively no.</comment></comment>


Dear Twitter, Please Make AMP Optional - <AUTHOR> https://www.alexkras.com/dear-twitter-please-make-amp-optional/ <comment><USER2> I feel like this constant anti-AMP rhetoric has extraordinarily little to do with users, and primarily are web developers who don't like that AMP rolls back a lot of abuses. The argument isn't just "I don't like AMP", it's "No one should like AMP!" and it grows tiresome.

<comment><USER3> No, that's never the argument I've seen. It's always been fairly well accepted that fast pages are good and AMP helps to make pages fast. The common argument - one which I unreservedly agree with - is that pages could be made fast without the use of AMP and especially the web-breaking nature of Google's implementation.

The fact that users like AMP is not material - the problems that it causes are not ones they are going to see in the short term.

<comment><USER2> But the common argument is nonsensical. Yes of _course_ sites could make non- abusive, readable content. But they don't. The non-stickiness of the web, coupled with a low attention span of users, has yielded a sort of tragedy of the commons. AMP is a standard to say "this can't do that".

We _should_ have an HTMLite of the sort like AMP. Like how Google Gears became a variety of accepted web standards, it should build into something rather than the nonsensical claim that it does nothing.

<comment><USER3> That's fine. I agree; "HTML-lite" is fine, and most of AMP is even an acceptable implementation of that concept.

But in practice, the way AMP is used has fundamental problems. Like the fact that content is hosted by a third party, or that links are broken, or that scrolling is wrecked. I like the speed of AMP; the implementation is catastrophic and I wish dearly that I could disable its appearance in Google search results.

<comment><USER4> > ... I wish dearly that I could disable its appearance in Google search > results.

You can if you use [https://encrypted.google.com](https://encrypted.google.com)

</comment></comment></comment></comment></comment><comment><USER5> AMP is such an egregious attack on open standards it shouldn't be possible. The fact that it is shows the system is broken.

The whole point of having a system is to prevent short term interests from trumping long term health. Tomorrow any monopolist can offer a short term fix for a fraction with the public lapping it up only to run down competitors and capture the market. This is well known monopolist behavior with strong systemic safeguards which curiously are not working.

People keep on complaining about heavy web pages but what happened to faith in markets and letting users decide? Surely if a website is too heavy people will automatically seek alternatives. So there is a contradiction here, does the market work or does it encourage a race to the bottom? Perhaps without Google's monopolist intervention a more open less self interested solution could have emerged.

Google is becoming a monster with an obsessive insatiable appetite for information and knowledge. A push back is long overdue or we will pay with private self serving entities controlling access to our own information and knowledge.

</comment><comment><USER6> Put this on the list of dozens of settings Twitter should be offering users, like opting out of seeing likes from people you follow, or permanently turning off "in case you missed it".

<comment><AUTHOR> Yeah, it's a long shot. Yet they took the time to get the AMP in.

</comment></comment><comment><USER7> The website owner has added markup to a document that states:

"Hey useragent, if you understand this markup, please send mobile users to this other URL that I have provided."

Twitter then respects the website owner's markup request.

If the markup was "here's a mobile optimized page", we wouldn't get this kind of strong reaction in HN. If the markup was "here's a the language X variant of the document", we wouldn't get this kind of reaction in HN.

<comment><AUTHOR> May be you are right, I'll have to meditate on that one.

Edit:

It's a complicated situation. Google offers a great carrot/stick to get people to adopt AMP. Publishers adopt it. Other platforms start using it. A lot of users like this format. Some users hate it and the idea of it.

As I've mentioned before, I do think that Twitter was trying to do the right thing for their users given the situation we are in.

It would be nice to have "request Desktop version" option for AMP, but not sure if it's too much to ask.

<comment><USER7> If the publisher provides both AMP and non-AMP versions of a document, it is possible to write a browser extension that will redirect to the non-AMP URL when provided.

You would want to look for <html amp> to detect this case, and then <link rel=canonical> to determine the possible non-AMP URL. If that URL differs from the current URL, redirect to it.

If you personally want a per-user option here to override the publisher, this seems like the way to go, but there is some similarity to ad-blocking here.

<comment><AUTHOR> Yes, except it's not so easy to do in Safari on iOS.

</comment></comment></comment></comment><comment><USER8> If Twitter is redirecting to the original URL, what's the problem? It muddies the claim of those that oppose AMP so fervently to mix AMP the framework with the use that Google makes of AMP. The publisher has decided to use this technology to make their mobile page. It's perfectly valid (and well engineered) HTML and javascript. Asking for a non AMP version of a page is like asking for the non React page or the non Bootstrap page.

<comment><USER9> Google recommends that the "canonical" link always be the one that gets shared. [https://news.ycombinator.com/item?id=15086192](https://news.ycombinator.com/item?id=15086192) Implementations have been ignoring this, but it does seem more predictable, and also less likely to break if a publisher removes AMP later.

<comment><USER10> And deep linking be damned right? Now we have to mess with the canonical url to include the deep linked resources so that sharing works and a page that could have been static need dinamic generation of their meta

</comment></comment></comment><comment><USER11> Twitter for iOS has an option to open all links in reader mode. It's awesome!

[https://medium.com/@pixeldetective/open-twitter-links- direct...](https://medium.com/@pixeldetective/open-twitter-links-directly-in- safaris-reader-mode-on-ios-58cc4eeaa14e)

</comment><comment><USER12> I make a somewhat popular Chrome extension [1] designed to aid website readability. I think this article is spot-on, and I'm going to look into adding a feature to my Chrome extension that does precisely this article suggests (changes "amp=1" to "amp=0" on twitter links).

Ping me if you want to try this feature in beta: email@example.com.

1: [https://chrome.google.com/webstore/detail/beeline- reader/ifj...](https://chrome.google.com/webstore/detail/beeline- reader/ifjafammaookpiajfbedmacfldaiamgg?hl=en)

</comment><comment><USER13> OP does not explain WHY he wants AMP to be optional. In the other article the author says "I don't know why I do it, but for some reason it just doesn't feel "right" to me to consume the content through the AMP. It feels slightly off, and I want the real deal even if it takes a few seconds extra to load."

That is a weak argument to persuade a major corporation to change the way something behaves or give the option to change the way something behaves.

OP should put himself in the shoes of Twitter: "What do I get by making AMP optional?"

...now you know what their response will be.

Edit: fair rebuttal, thanks for the response

<comment><USER14> Well, why AMP, and not plain HTML? It's pretty clear at this point that AMP isn't any faster than simple HTML, and some of the limitations are clearly shift control (and advantage) to platforms like google, away from the hosting site.

I mean; stripped down pages are way overdue, but it's mixed in with some unnecessary powergrabbing and arbitrary restrictions. And it's not like it's hard to strip down pages.</comment></comment>


Microsoft recommends using a separate device for administrative tasks - <AUTHOR> https://www.zdnet.com/article/microsoft-recommends-using-a-separate-device-for-administrative-tasks/ <comment><USER2> Are there any other good resources for this kind of advice or writing about the topic?

</comment><comment><USER3> I agree with this. I have a separate user for admin tasks. We go out of our way to not document who has elevated access.</comment>


Duct tape and the brittleness of Agility - <AUTHOR> http://beust.com/weblog/archives/000519.html

<comment><USER2> Is it just me, or are flamewars these days just not what they used to be?

<comment><USER3> I am not thinking of this as a flamewar, but an interesting discussion about TDD and agile amongst people whose opinion I respect. And it is really an ongoing reaction to the first chapter of C@W. There is much more food for thought in the other chapters.</comment></comment>


Train TensorFlow models faster and at lower cost on Cloud TPU Pods - <AUTHOR> https://cloud.google.com/blog/products/ai-machine-learning/now-you-can-train-ml-models-faster-and-lower-cost-cloud-tpu-pods <comment><USER2> Does this require distributed training?

My understanding and experience is that it is not always trivial to get linear training speedups with additional machines.

It can be sometimes hard to get any speedup at all.

The difference with gradient descent can be described simply as:

* Single-machine training: take more steps

* Distributed training: take fewer but more confident and accurate steps. This could allow you to take bigger steps (learning rate) as well, but there is a limit to this as well.

They are not equivalent processes and it is an area of active research how to get an equivalent result with distributed training.

<comment><USER3> I worked on a research project that set out to answer that question:

[https://arxiv.org/abs/1811.03600](https://arxiv.org/abs/1811.03600)

We looked at a bunch of different model architectures and datasets and found that you can get speedups from larger batch sizes up until a certain point, but that point is different for different datasets and architectures. The range of good hyperparameters is also narrower for larger batch sizes, which makes tuning harder.

<comment><USER4> To clarify, we found the range shrink if one trains for a fixed number of epochs and expand if one trains for a fixed number of steps. So tuning can be easier or harder depending on the budget.

</comment></comment></comment><comment><USER5> Full ML Perf results can be found here: [https://mlperf.org/results/](https://mlperf.org/results/)

</comment><comment><USER6> Julia runs on these ;). Well, it will once multicore access for non-TF frameworks is public.

<comment><USER7> We're on it! = D

</comment></comment><comment><USER8> What a pity Google TPUs are locked in Google Cloud - many would like to use them on their own, in already owned servers. It kind of slows the ML progress, such restriction of access to the product.

<comment><USER9> How these chips work is pretty reliant on Google's specific infrastructure and there's a stark difference between the work needed to offer a service and selling chips. It isn't a matter of bad will or trying to slow ML progress but a matter of what's practical.

<comment><USER10> > How these chips work is pretty reliant on Google's specific infrastructure.

I find that hard to believe. Can you be more specific?

<comment><USER11> I haven't been at Google for years and never worked on TPUs, but off the top of my head:

They control the system attached to the chips. That includes the kernel and userland (glibc, libstdc++, etc.).

Very limited number of configurations (CPU, RAM, network, motherboard, any RDMA use) to qualify.

Monitoring, profiling, diagnostics, firmware, networking, security and automation follow the internal Google standards.

They can tune cooling to accommodate Google's motherboards and racks, whether it's air (v2) or liquid cooling (v3).

You can bet that they talk directly to the GCS backends through Stubby/gRPC, rather than sending HTTP traffic through the outside network and traversing GFEs.

Then there's all the other "mundane" stuff they don't need to worry about: packaging, manuals, warranties and user-facing RMA, multi-tenancy, etc.

<comment><USER10> As far as I'm aware, they're still on OCP, which standardizes the bulk of this. Basically, this comes down to not being willing to be bothered with testing on diverse hardware.

Which, fair enough, is a pain.

<comment><USER9> Google isn't on OCP afaik. Their hardware layer is pretty custom. Maybe you were thinking of Facebook?

Google's hardware layer is one thing; as btian mentioned, TPU also is deeply integrated with software infra e.g borg [https://ai.google/research/pubs/pub43438](https://ai.google/research/pubs/pub43438)

<comment><USER11> Years ago, Google announced they'd join OCP. I'd be surprised if even half the fleet made the transition, given how much mileage they like to get out of old hardware.

Besides, for special toys like TPU pods it's not clear that they would value adhering to OCP standards above anything else.

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> Curious what will be the answer from Nvidia.

<comment> david-gpu This is what NVidia says [0].

Notice how Google did not submit benchmark results for several tests.

[0] [https://blogs.nvidia.com/blog/2018/12/12/record-breaking- mlp...](https://blogs.nvidia.com/blog/2018/12/12/record-breaking-mlperf-ai- benchmarks/)

<comment><USER12> NVidia won RESNET-50 benchmark with 80 nodes of DGX-1, curious if it is accessible in the cloud, and how much it will cost to rent it..

</comment></comment></comment><comment><USER13> I thought TPUs were mostly used for inference, because they're low- precision. Has that changed?

<comment><USER14> Yep. That was the first generation that was only for inference. Subsequent generations can do inference and training.

</comment></comment><comment><USER15> TF only? Any reason why, besides Google tech lock in?</comment>


Web 2.0 Media: New Way To Monetize Your Blog - Amazon Context Links Launch Today - <AUTHOR> http://www.avinio.blogspot.com/2007/03/new-way-to-monetize-your-blog-amazon.html <comment><USER2> I've been seeing these recently and they're incredibly irritating. They're like Microsoft's ill-fated "smart tags". The moment I come across one of these it's an automatic back-button click.</comment>


More Is Different (1972) [pdf] - <AUTHOR> http://www.physics.ohio-state.edu/~jay/880/moreisdifferent.pdf <comment><USER2> "Quantity has a quality all its own." (Misattributed to Stalin, probably related to the Marx quote in the paper. [https://en.wikiquote.org/w/index.php?title=Joseph_Stalin&old...](https://en.wikiquote.org/w/index.php?title=Joseph_Stalin&oldid=1993027))

Some stray observations.

"More is Different" is also the slogan of the Nanyang Technological University annual conference on complexity. There are some phenomenal presentations there, many on YouTube.

[http://www.ntu.edu.sg/ias/upcomingevents/complexity12/Pages/...](http://www.ntu.edu.sg/ias/upcomingevents/complexity12/Pages/default.aspx)

Related to the issue of emergent phenomena is:

Polanyi, Michael. "Life transcending physics and chemistry." Chemical & Engineering News 45.35 (1967): 54.

</comment><comment><USER3> As someone who was in condensed matter physics, I think this is one of the most important articles for understanding the modern mindset in physics, and even fields like machine learning.

Seeing how something can be based on the rules of something else, but have novel emergent behaviour, opens up a whole new ways of thinking about phenomena.

</comment><comment><USER4> This is one of the most insightful articles of the last 50 years of physics, and written in a way that nearly anyone with some scientific training can understand.

Aside: Not quite sure why the random ohio state pdf got the link... then went to the original and realized it's _still_ behind a paywall at Science. There is NO good reason to keep it locked up.</comment>


Apple Snubs Firm That Discovered Mac Botnet - <AUTHOR> http://www.forbes.com/sites/andygreenberg/2012/04/09/apple-snubs-firm-who-discovered-mac-botnet-tries-to-cut-off-its-server-monitoring-infections/ <comment><USER2> Good job on Dr. Web on finding this and trying to do the right thing but these quotes give a different context than you'd get from the article title and lede:

"Sharov believes that Apple's attempt to shut down its monitoring server was an honest mistake."

"In Apple's defense, it may not have recognized Dr. Web as a credible security firm when the company contacted Apple earlier this month–I hadn't heard of the firm either until its discovery and analysis of the Flashback botnet."

It looks like Apple wasn't the only one surprised by this:

"But the better-known security firm Kaspersky confirmed Dr. Web's findings on Friday. A Kaspersky representative said it hadn't contacted Apple with its findings and hadn't had any direct communication with the company, and Kaspersky researcher Kurt Baumgartner wrote in a statement that 'from what we've seen, Apple is taking appropriate action by working with the larger internet security community to shut down the Flashfake [also known as Flashback] C2 domains. Apple works vigorously to protect its brand and wants to rectify this.'"

<comment><USER3> That kind of "we didn't know" will only get you so far in this day and age where 1 second on google will get you a wikipedia page on dr web saying they've been around since 1992.

The world is bigger than firms who are big in america and that kind of american centric thinking also won't go down well on the web.

<comment><USER4> American centric? You realize Kaspersky is Russian as well?

<comment> guard-of-terra Everybody at Kaspersky knows who Dr. Web is. It's a household name in Russia.

So it's probably the article's honest mistake if you infer otherwise from it.

</comment></comment></comment></comment><comment><USER5> How long will it take to change the mindset at Apple to think about security before shipping? Microsoft did their job years ago, now Apple has to follow.

How long will it take for Mac users to learn that viruses are indeed a threat on all kinds of computers, not just PCs? I can only hope Apple will take a more active role in educating them.

<comment><USER6> ... they have. They don't ship OS X with Java anymore. The only exploit this attack campaign is using is a Java exploit. They install Java when the user attempts to run something that needs it.

The next best thing they'll have to do is, when they install it, disable the web plugin in Safari by default or add an interstitial that prompts the user for it to run.

One 500k node botnet really is not that large in the grand scheme of things.

<comment><USER7> I think "they have" is a bit overstated, unless you just mean they've shown improvement in the last few years. Things like functional ASLR and more use of seatbelt in Lion are definitely headed in the right direction; however, there seem to major gaps in testing and validating security--even basic stuff like continuous fuzzing and automated security testing. Also, their response and turnaround time is generally worse than Microsoft's (close to a year has not been uncommon). I can understand Microsoft's slowness due to their massive compatibility matrix and enterprise customer base--but Apple doesn't have that excuse. Apple has also been historically ignored as a mass malware target, so maybe a 500k node botnet is a helpful wakeup call.

And just to be clear, I'll admit that I'm not a disinterested party here. The Chrome security team carries the bulk of the WebKit security workload (fuzzing, auditing, fixing, etc.). That consumes a tremendous amount of my team's time, and prevents us from focusing more on Chrome. So, I'd definitely appreciate it if Apple were significantly more proactive about security.

<comment><USER6> Why does Apple need to fix security bugs in Webkit? Are they being exploited somewhere by attackers I'm not familiar with? It doesn't seem like there is a problem to solve.

I'd venture to say that Apple is more proactive than most other vendors about security because they look at the forest and not just the individual trees.

<comment><USER7> I talked to Alex briefly at CanSec about your strategy. I appreciate the idea of setting a minimum bar, but it can start to sound like selling feel-good security. It's easy to say in hindsight "all you had to fix was these ten bugs and ignore the rest." The truth, however, is that you can't reliably predict that in advance. History has shown that even the low-end mass malware moves to more advanced techniques as targets become harder. And, of course, the strategy you're proposing does nothing for those at risk from targeted attacks (which is something I'm professionally seeing more and more of).

<comment><USER6> Actually, history does not show that low-end mass malware moves to more advanced techniques and you CAN predict the vulns they'll target in advance, as long as you're familiar with their motivations, capabilities, and incentives. <http://www.trailofbits.com/research/#eip>

Again, show me an actual attack that has exploited Safari. Ever. Targeted, mass malware, I don't care. Apple has better shit to worry about and their investment in Seatbelt was worth 1000x more than individually fixing the limitless supply of bugs in Webkit. Problem solved, move to next actual issue.

<comment><USER7> You can scope the discussion to mass malware on desktop Safari, but that's just reductio ad absurdum. Any fortune 500 or government has to be concerned with real attacks, not just tamping down the noise floor. And as for Apple, they've historically been more interested in protecting their manufacturer subsidy by stopping iPhone jailbreaks--in which WebKit exploits against Safari have played a key role.

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> This 'discovery' did certainly boost Dr. Web's market share though! 'Dr. Web Light' is now the number 2 most downloaded free app on the Mac App Store: <http://cl.ly/1z0Z1F0P29221K1y3X01>

</comment><comment><USER9> There is obviously no point in reiterating how Apple is removing Java, how they are adding VMs, code signing - etc.

The only way for them to improve security is to take it seriously, because the amount of code shipped with each release will only go up, never down. The attitude needs to change.

There is of course lots of data support this argument. Just do a quick Ctrl+F through <http://support.apple.com/kb/HT5130> for 'arbitrary code execution'. 21 hits, and many of them in core apple components. These are almost extinct on Windows by now.

<comment><USER10> _because the amount of code shipped with each release will only go up, never down._

Actually, it went down with the Mac OS X 10.6 Snow Leopard release. Up to 7 GB less. [1]

1\. [http://en.wikipedia.org/wiki/Mac_OS_X_Snow_Leopard#New_or_ch...](http://en.wikipedia.org/wiki/Mac_OS_X_Snow_Leopard#New_or_changed_features)

<comment><USER11> I'm nitpicking, but 7GB in binary doesn't necessarily mean 7GB in source code.

</comment></comment></comment><comment><USER12> One interesting sidenote in this story is the fact that Mac OSX now has enough market share that it no longer enjoys security-by-obscurity from targeted malware, let alone herd immunity.

<comment><USER13> It never did. It has simply been much more secure. The "security by obscurity" claim was a rationalization of windows fans to justify why the mac was so much more secure.

Anyone who genuinely understand security understands that obscurity is not a form of security. There are many incidents of high profile targeted attacks against owners of macs that could have occurred in the past two decades if Apple hadn't been taking security more seriously.

</comment></comment><comment><USER14> The biggest problem is as long as people think Macs are secure... they will never be.

<comment><USER13> Which is why there are botnets of millions upon millions of Macs out there infected by viruses, while its really big news that a trojan manages to get 600,000 infections on Windows.

Oh, no, wait, its the reverse!

<comment><USER14> :) . Typical . I never mentioned anything about Windows. All I said was w.r.t computer security you are most venerable when you don't have the fear of bad things happening to you.

<comment><USER15> You made an either-or proposition. Either you're secure or you're not. The responder nailed it correctly: the issue is not "secure/insecure". His example showed that it's a measure of utility. How much effort expended by Apple and its users is worth the probable reduction in botnets on that platform and their consequent damage? Because botnets are historically so rare on MacOS (9 or X) the utility equation has always been very much in the don't-worry-about- it category. Not so for (for example Windows).

Will this equation change significantly with the new botnet? I think it's unlikely, but I dunno. Regardless, all-or-nothing seems to be the _wrong_ perspective from which to examine this problem.

<comment><USER14> I never mentioned Macs are more/less secured. All I am trying to say is w.r.t computer security the sense of being secure & letting your guard down is the most insecure thing. Its just not about Virus,Trojans , Worms etc .. its also about social engineering. I tell my mom don't open random links .. I don't mention if its on email or a webpage or if its on Windows or her Android phone.

</comment></comment></comment></comment></comment><comment><USER16> Annoyingly, the Java 2012 update REMOVED the -uninstall option from Java, so you have to rm it and clean up the installhistory plist manually if you want to uninstall Java from Lion

</comment><comment><USER17> so Apple first ignores Oracle's warning and fails to issue the patch. Later it react by removing Java and tries to shut down the security firm's domain.

How responsible :)

<comment><USER18> No, Java wasn't removed. Java was _updated_ on systems where it has been installed.

</comment></comment><comment><USER19> >"We don't know the antivirus group inside Apple."

What antivirus group...

</comment><comment><USER20> >"For Microsoft, we have all the security response team's addresses," he says. "We don't know the antivirus group inside Apple."

Does Apple even have an antivirus group?

<comment><USER21> They definitely have people working on OS X's malware protection (XProtect). The definitions file can be found at /System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/XProtect.plist (Flashback A/B/C are in there for me).</comment></comment>


Pusher - Realtime client push service powered by websockets - <AUTHOR> http://pusherapp.com

<comment><USER2> This is really awesome; except as an app developer, I really rather get a library that I own and have on my own infrastructure than a SaaS model, especially for something so critical to my application.

<comment><USER3> If you just want the raw "back end WebSocket-compatible multiplexing daemon" functionality, that's not hard to code/devise. You can use something like: <http://github.com/gimite/web-socket-ruby> \- What services like Pusher provide is all the API stuff on the front, maintaining the servers, keeping those daemons running, and, well, just making it super easy to get going without worrying about the back end so much.

<comment><USER2> All the API stuff on the front I'd pay for. However, I'm already paying for "maintaining servers, keeping them running, and worrying about the backend" -- so I don't want to pay for it again.

This might just be MY preference, and others might beg to differ.

</comment></comment></comment><comment><AUTHOR> Luke Redpath has also published an interesting post: Pushing events to your iPhone using WebSockets and Pusher [http://lukeredpath.co.uk/blog/pushing- events-to-your-iphone-...](http://lukeredpath.co.uk/blog/pushing-events-to- your-iphone-using-websockets-and-pusher.html)

<comment><USER4> I've been using notifo to notify myself of the completion long-running computing tasks.

Growl could probably do the same thing, but I already have notifo working and I'm a cheapskate. (Plus, IIRC if I want to use Prowl I need to have Growl running on a PC somewhere).

</comment></comment><comment><USER5> Try Socket.IO: <http://labs.rosepad.com/socket.io/>

<comment><USER6> It's usually writing a good server that is the pain point here.

<comment><USER5> <http://github.com/Rosepad/Socket.IO-node/> powered by Node.JS, check out the basic chat app in 10 LoC

</comment></comment></comment><comment> a-priori Oh, fun :) I'm just about to launch a similar service, called Zeropoll. It seems you're pushing the event-handling logic to the client side, whereas Zeropoll generates Javascript on the server (ala RJS) and pushes that to the client.

Your demo apps are great, by the way. Just curious, what's your business model going to be?

<comment><AUTHOR> When we're out of beta we will be offering several plans, probably limiting the max clients. There will always be a free plan though :)

</comment></comment><comment><USER6> This is great, I was thinking about making a similar app, but never got around to it.

I'd love a simple ACL for channels. For example, you could do S3-style channel+timestamp+hash authentication, with the hash generated on the server with a secret key. Then for every channel I'd have channel17@r for read-only access, channel17@w for write-only, and channel17 for rw access (default). The way I understand the current system once I have the key for a channel I have unlimited access to it forever.

<comment><USER7> I am working on something exactly like this, but as an open-source NodeJS project.. it lets you define a parameter (by default, session_id) and then checks a memcache instance for that key, and uses that to get access to channels with a specific prefix (by default "user:")... so you can have a channel "user:34343". This shoves authentication back into your app with the only dependency being a memcache instance shared by the NodeJS server and the web server. All of the other communication is similarly RESTful. if you want an email when i've got more to show, let me know.

</comment></comment><comment><USER8> This sounds very interesting, but since it is a SaaS model and you are relying on their infrastructure, what exactly are they looking at as their business model? Freemium? Any idea of pricing?

It is something I could use in an app I'm working on right now, but I'm just building a simple free tool and would be interested what their plan is for the service before I get myself tied to it.

</comment><comment><USER9> Looking good! One question: As I was checking out the "theater booking" demo, I opened two windows, and in one window I checked out 2 seats. It required an actual refresh on the other window to show the updated seating chart; however, on the other app I tried (to-do list), that was not necessary.

Was this done on purpose?

<comment><USER10> Sounds like a bit of a bug.

There may be minor glitches in the demo apps. They haven't been where we've been focussing the majority of our energy :)

</comment></comment><comment><USER11> Great! Exactly what I need to supplement Google App Engine.</comment>


Show HN: Nemesis is a social synchronous multiplayer platform on Android - <AUTHOR> https://play.google.com/store/apps/details?id=com.nemesis.nemesis&referrer=utm_source%3DShow%2520Hacker%2520News <comment><AUTHOR> Have a bit more details on a related Reddit post: [https://www.reddit.com/r/AndroidGaming/comments/41j2uo/devfr...](https://www.reddit.com/r/AndroidGaming/comments/41j2uo/devfree_nemesis_is_a_social_synchronous)

We also have a new version coming out soon, that we're hoping is a bit slicker in design: [http://i.imgur.com/M8jPeQV.jpg](http://i.imgur.com/M8jPeQV.jpg)

Still lots of bugs to fix, but we're working on it!</comment>


Awesome Recurrent Neural Networks - <AUTHOR> http://jiwonkim.org/awesome-rnn/ <comment><USER2> Wow, this is awesome! Thank you.</comment>


Verification by Gradient Descent: Fixed Perimeter and Maximum Area = Square - <AUTHOR> https://trigonaminima.github.io/2019/12/grad-desc-area/ <comment><USER2> Is the notebook available in github? I would like to review the code of plots and animations. The post and links is awesome.

<comment><AUTHOR> Thanks. You can find the notebook here: [https://github.com/TrigonaMinima/Notebooks](https://github.com/TrigonaMinima/Notebooks) with the name (Gradient Descent - Maximum Area.ipynb). Because of the embedded plots and gifs it's big in size so it's takes time to render on GH</comment></comment>


Outage in Azure South Central US for Last 5 Hours - <AUTHOR> https://twitter.com/AzureSupport/status/1036934901545750528 <comment><USER2> Apparently, their status page is also down, so twitter is the only source of information, for now.</comment>


Facebook is the new AOL - <AUTHOR> http://www.theverge.com/2015/1/4/7488495/facebook-is-the-new-aol <comment><USER2> Been awhile since I worked at AOL. One of the funnier moments for me was when I started working there, someone referred to the client (the one they shipped via CD) as WAOL (pronounced - Whale). IIRC, the executable was waol.exe.

Jokes aside, they had some pretty fierce technology on the backend that, had it seen the light of day of Open Source, would have been the precursor to Docker and Protocol Buffers. All this back in the 90's.

<comment><USER3> Man. The only purpose of all for me back in the day was that you could call them up and they'd ship you a stack of 5.25/3.5 floppies so you could "share" "the service" with your "friends". i.e. Punch a hole where the write protect window should be and yay, free, really cruddy, media!

<comment><USER4> For a long time, the stickers they used on the 3.5 floppies would peal off perfectly. No sticker residue at all.

</comment></comment></comment><comment><USER5> I think Facebook is well aware, that it could be over tomorrow, that is why they will survive. AOL tried to grow, I think Facebook acts more reasonable. They know the others can not get them in the social network space, no matter how hard they try, if they just secure their market share with acquisitions and slowly increase profitability. They do not try to win in another domain as the new Microsoft, Google does.

In the end Amazon will win. Most of the others make their money by advertising or by selling technology to companies, which make their money with ecommerce or advertising. Amazon owns every part of this stack, which actually makes money. The bigger the Amazon brand grows, the less money will be left for the others. At the moment, this is not visible, because the whole market grows. Amazon knows this and just reinvests and waits.

<comment><USER6> Last time I checked Amazon's hardware line... didn't go too well. Amazon is a retail company, not a software company. Remember that.

AWS (the closest thing to software Amazon owns) will converge to 0 profitably as competitors copy the easily replicable service.

<comment><USER7> AWS and competitors are very capital intensive businesses. While the software might be easy-ish to replicate with a medium sized software team, the capital required to set up and then run dozens to hundreds of packed data centers is prohibitive for most competitors. The cloud market will turn into the chip market, where the capital cost of fabrication facilities is an enormous barrier of entry to the market. That is why the only real potential competitors in the space are from companies with lots of cash to burn and who can leverage the same "we need data centers anyways" model that Amazon does.

<comment><USER8> But it doesn't have to be dozens to hundreds of packed data centers. It just needs to be a lot of smaller operations, and a few mid tier like Linode, providing the same service at various prices and scales that make sense to various sites.

</comment></comment></comment></comment><comment><USER9> Dvorak said the same thing...in 2010

[http://www.pcmag.com/article2/0,2817,2372729,00.asp](http://www.pcmag.com/article2/0,2817,2372729,00.asp)

<comment><USER10> or 2007 apparently.

[http://kottke.org/07/06/facebook-is-the-new- aol](http://kottke.org/07/06/facebook-is-the-new-aol)

</comment></comment><comment><USER11> I know relating things is very natural, but I don't feel Facebook is the new AOL at all until they offer ISP and a web browser. That is what made AOL AOL. Facebook may be many peoples main destination, but it isn't how they connect to the internet, it isn't primarily a gateway to other sites. Facebook doesn't want you to leave Facebook at all.

<comment><USER12> > Facebook doesn't want you to leave Facebook at all.

AOL didn't use to _let you_ leave AOL. For many years it was a 100% isolated walled garden. _That_ is what made AOL AOL many years before AOL became an ISP.

They only grudgingly started adding ways of accessing internet content as the growth of the net so outpaced AOL that they had no alternative in order to keep subscribers.

<comment><USER13> And so began the Eternal September and the <aol> faux-tag on Usenet.

I remember for a while on Usenet arguments were won by simply pointing out the other person had an @aol.com address.

</comment></comment></comment><comment><USER14> Facebook is the new _Myspace_. Same basic concept. Same growth in ad density over time. Same decline in customer experience.

AOL is still a dial-up ISP, with 2 million customers still paying $20.48 a month. That's where their profit comes from. Their new junk-content business turned out not to generate much profit. ([http://www.washingtonpost.com/blogs/the- switch/wp/2014/08/07...](http://www.washingtonpost.com/blogs/the- switch/wp/2014/08/07/aol-still-makes-most-of-its-money-off-millions-of-dial- up-subscribers/))

<comment><USER15> As your link states, most of AOL's revenue in fact comes from content. Most of the profit comes from dial-up.

<comment><USER14> Fixed.

</comment></comment></comment><comment><USER16> In one of the bargain-binned dot com frenzy era books, I remember an AOL executive dismissively claiming that they (AOL) could put a AOL login or logout popup ad that said "Click here to pay $19.99 for absolutely nothing" and some fraction of a fraction of their customers would buy.

It cannot be ruled out that those kinds of ads won't ever come to Facebook. Ads that buy with one-click (despite Amazon's patent) and rely on partial user confusion and deception as a business model.

<comment><USER17> I can rule it out.

If Facebook did that, or even if advertisers did that and Facebook didn't kick them off, it will put the brand in serious trouble, they'll get fined, etc.

This is the sort of thing small scummy businesses do where the owner can hide behind it, go bankrupt and start again. It's not something a top company would do.

I am not saying big companies won't do evil things. This isn't going to be one of them.

And also you don't need to confuse people into paying for nothing. You can do it with their eyes wide open. In-game purchases, for example.

</comment></comment><comment><USER18> In regards to Qualcomm dominance, thankfully there is no total domination yet - especially in the lower/midrange segment, where there is MediaTek (heh, and MediaTek is the 4th largest IC designer worldwide).

And actually, I prefer MediaTek phones - you can root every single one of them and in contrast to other phone manufacturers, their preloader (first stage bootloader) even allows reading back the entire ROM. No restrictions. (For the interested, google for spFlashTool)

<comment><USER19> I agree. Qualcomm is dominant, but not quite "Intel-dominant" in mobile, especially when Apple makes another few hundred millions chips of its own.

That said, it's becoming increasingly worrisome that so many OEMs just "default to Qualcomm" these days. If I were Samsung's CEO I'd put much stronger focus on making my own chips and putting them in my own devices (just like Apple), while _also_ selling them to others, just like they sell their Super AMOLED displays and so on. I would also buy out AMD, mostly for their GPU expertise, but also to enter in the server/data-center market, which is more profitable than the mobile market. Samsung has the money and marketing clout to do much bigger things than AMD can do right now alone.

I don't know what the hell Nvidia is doing in mobile, but they always seem to screw something up. Their non-focus on energy efficiency in "mobile" and their focus on "performance" for umm.. _tablets_ , has proven to be a mistake _with every single chip generation_. Stop it, Nvidia! You need to win smartphones, not tablets, which are a dying breed already. And to do that you need low-end chips as well not just "PC-class mobile chips", otherwise you'll _never_ get the market share you need to help you become "popular" in the mobile market.

And finally Intel - oh, Intel, how I despise thee. Two main reasons why I don't want Intel to win even 5 percent of the mobile market. Short version: 1) they are anti-competitive, 2) they don't deserve it.

Long version - Intel has started having quite the "monopolist culture" a while ago (at least a decade). They've learned that playing the monopolist card when in power "works" (to crush competitors and entrench themselves in the market), and they try to use it as often as they can and to the limit of the law (or even well beyond it, if no one is paying attention). Intel has almost wiped out GPU vendors from laptops through strongarming of OEMs and shady pricing tactics and, with Broadwell and Skylake having an even bigger focus on GPU performance, I predict within 2 years no one will even hear about an Nvidia GPU in an Intel-based laptop (unless we're talking $2000+ machines - maybe).

They also have a monopoly in CPUs for PCs and are now using the profits they get there to sell their their Atom chips _below cost_ (a practice that's _illegal_ in many countries, but either they aren't paying attention or Intel manages to twist that into some kind of "business deal" they are making with OEMs).

That's just the anticompetitive part. The "don't deserve it" part comes from the fact that Atom sucks compared to the highest-end ARM chips, even though it's built on 22nm FinFET, and those ARM chips are built on 28nm planar (if we're to compare them at the time of market launch) - essentially a 3 year/one node and a half process advantage for Intel. So they are trying to push bad products into the market and gain market share by selling them below cost to trick some OEMs into accepting their chips. And I say "trick" because that's what it is - at best, a short term advantage of them, because if Intel would ever have even 20 percent of the mobile chip market, those same OEMs would have to pay them more than what they pay for ARM chips, because it's "Intel".

So many other shady Intel practices such as tricking consumers into thinking "Celeron" chips are Celeron, when in fact they are Atom, lying about the _real_ TDP/power values of their chips to make it seem like their PC chips are almost comparable to ARM (while being misleading about the fact that they also have much lower performance) and so on. Intel is a shady company through and through when it comes to selling its products.

<comment><USER18> > Intel has almost wiped out GPU vendors from laptops through strongarming of > OEMs and shady pricing tactics

You forgot one point: _good (open-source) drivers_. Intel drivers Just Work (tm), no matter if the OS is Windows, Linux or OSX. AMD/ATI drivers... not so much, and NVidia's work, but are still closed-source.

And the "The drivers Just Work" doesn't end for Intel in GPU drivers, but also the other driver classes - just take wireless and chipsets. One driver package for all, supplied by Intel, no need to hunt down obscure czech or russian sites for drivers (hello, Atheros).

<comment><USER20> You shouldn't need to look very hard for Atheros drivers, since they're often included in the kernel. At the very least, they're in your distribution's repository, since they're not proprietary.

<comment><USER18> I'm talking about Windows here, to be honest. I use both Windows and Linux and, well, when I configure laptops, I always use Intel (and NV for the GPU) components because they are guaranteed to work without spending hours on Google.

</comment></comment></comment></comment></comment><comment><USER21> Not sure what Google is but I still see most people do this:

Me: Yeah, go to xyzx.com

Them: Google.com ENTER -> XYXZ.com -> Click on first result

<comment><USER13> I see people do this from time to time and I've never understood it.

<comment><USER22> I do this and the biggest reason is to avoid mis-typing and hitting a phishing site.

<comment><USER13> Interesting, and fair point. I tend to type things explicitly for the opposite reason, because I trust my fingers more than some obfuscated typo in an URL - but I see logic on both sides.

OTOH normally when I ask the people I see doing this why, their answer is more along the lines of "dunno" :)

</comment></comment></comment></comment><comment><USER23> I think it will be different for VR this time around. Probably not in 2015, but after that...

<comment><USER24> I think we are hitting the point where the technology is there, even if it is a bit rough. Unfortunately it is still bleeding edge, and it seems like adoption will take a while.

</comment></comment><comment><USER25> Interesting Generalization. I contest that Facebook is in a much better situation and condition than AOL.

</comment><comment><USER26> Surely weechat is the new AOL - or does something that is only used by 800m people not count?

<comment><USER27> I unfortunately think you mean wechat and not weechat.

<comment><USER28> For reference:

\- [https://weechat.org/](https://weechat.org/)

\- [http://www.wechat.com/en/](http://www.wechat.com/en/)

</comment></comment></comment><comment><USER29> Samsung is new Nokia

<comment><USER30> But what is the new iPhone?

<comment><USER31> The 6? ;)</comment></comment></comment>


JavaScript: var functionName = function() {} vs function functionName(){} - <AUTHOR> http://stackoverflow.com/questions/336859/javascript-var-functionname-function-vs-function-functionname

<comment><USER2> Brilliant..!!! Seems like all JS Devs jumped into explaining. First explanation is incorrect for sure.</comment>


Stanford Javascript Crypto Library - <AUTHOR> http://crypto.stanford.edu/sjcl/?

<comment><USER2> Appending a ? to the URLs you submit to HN is tacky. I am curious about the first time that you resubmitted a URL with a ? for the karma boost. Did you feel crafty or creepy?

<comment><AUTHOR> I thought it's extremely useful and worth re-sharing and many people here apparently do that. I don't know why would you bring in the concept of Karma boost here, unless you were used to doing such things by yourself. I only feel sorry for you.</comment></comment>


Software Dogengineer job at Google - <AUTHOR> https://www.google.com/about/careers/search/#!t=jo&jid=32155002&

<comment><USER2> Much want!</comment>


EFF: Tell Us Your DRM Horror Stories about Ebooks, Games, Music, Movies and IoT - <AUTHOR> https://www.eff.org/deeplinks/2016/03/ebooks-games-music-movies-and-internet-things-tell-us-your-drm-horror-stories <comment><USER2> I don't know if it is a horror story, but I bought a kindle edition of a reference work to use on my iPad (it was a kindle-fire book, apparently optimised for tablets) and the app is so slow that searching or flipping pages is useless.

There are cracked PDF's version of the book, which I can search in seconds and flip pages fast, copy content into a google search and use my build-in dictionary to look up words.

The PDF version is everything the kindle version is not: Free and useful.

<comment><AUTHOR> Please tell the EFF about that.

</comment></comment><comment><USER3> I recently wanted to show my wife a video game I enjoyed when I was younger. The game used SecuROM DRM which I was unable to work around in Wine. Apparently, it requires an insecure driver in Windows, which has since been removed. I really wanted to play this game, so I was forced to manually enable the disabled driver in Windows 7 by following this guide: [http://www.howtogeek.com/230773/how-to-play-pc-games-that- re...](http://www.howtogeek.com/230773/how-to-play-pc-games-that-require- safedisc-or-securom-drm-on-windows-10-8.1-8-7-and-vista/). The SecuROM driver has apparently been removed completely in Windows 10.</comment>