TechShop shuts down all U.S. locations, declares bankruptcy - <AUTHOR> https://techcrunch.com/2017/11/15/techshop-shuts-down-all-u-s-locations-declares-bankruptcy/ <comment><USER3> They informed employees of the shutdown as they were firing them. This was a few days AFTER they revoked the employees insurance benefits without notice or explanation. Those same employees were also told that they're unlikely to get their final paycheck.

As for me, I was suckered into pre-paying for $500 worth of classes that I'll never be reimbursed for. So many people who's livelihoods depended on their facilities were completely blindsided. Members who had been there for years were told they had hours to remove their belongings or they would be confiscated. The whole thing is a complete mess.

All of this just a few weeks after opening a brand new location in Brooklyn. I simply can't comprehend the level of negligence and mismanagement here.

<comment><USER4> > Those same employees were also told that they're unlikely to get their final > paycheck.

This as a Finn sounds crazy. Here the employees are protected to a degree if the company goes bankrupt then the government will pay the final paycheck and the government will be the first one to get their money back from the bankruptcy (before any banks/other creditors when any existing assets are sold)

<comment><USER5> This is what makes a European a European, and an American, American. We have different standards and expectations about the social contract between enterprises and society.

Also, no wonder American companies tend to grow a lot faster without many impediments. The whole American system is built to support and protect the enterprise, not the people. In Europe, as an enterprise, you have a lot more requirements and obligations to fulfill.

And even though I have a disadvantage running a company in Europe as compared to the US, as a European I believe it's the right thing to do.

<comment><USER6> Except in France, unemployment is 10% while in the US it's 4%. My point on this is that it's a lot bigger of a risk to start a company in France, it's harder to hire and fire and thus it makes it a more risk-adverse environment.

So the thought experiment -- is it better for someone to work for a year and then get fired unexpectedly or not work at all and collect unemployment money for 3 years?

I thought about opening an office in France for a dev team, but after looking at the real costs -- there's no way I could afford it. The actual salaries are fine, but adding in social charges, then all of the ridiculous "protections" \-- it's easier for me to hire guys in Serbia, pay them well while not having the financial risk of having to take care of employees when my business may not be able to support them.

So there are 5 French engineers that aren't working now and 5 Serbians that are because I can't afford the risk of hiring French workers because as the business owner, I'm the "bad guy" \-- despite funding my little company out of my own pocket and not even being able to pay myself a salary. To be on the hook for French social benefits and the job protections when I can't even provide that for myself? No thanks.

So I've had Serbian devs for the past 2 years and exactly zero French devs -- despite paying the Serbians the same net salary I would have paid the French.

I'm an anecdote, but that's the other side of this "protection" that EU workers "benefit" from -- it's great when they DO have a job, but there are countless jobs that don't exist precisely because of these policies -- and the jobs that do exist pay far less than American jobs (despite similar living costs) because companies have to price the risks into the salaries they offer. So rather than paying a dev $100k per year plus benefits -- a French company would pay $40k per year plus benefits. Then they have roughly 1.5 years of "cushion" in case they're stuck with an employee they can't simply fire.

Before folks start to talk about how France has better social benefits and thus a lower salary is ok.. Net disposable income is vastly less than in the US. And, US companies provide health/disability/etc. benefits in addition to a higher salary. So the idea that French companies pay a lower salary because health insurance is free is just ridiculous -- since French companies aren't paying for health insurance, they should be able to pay even higher salaries than the US right? But the reason they don't is because they have to hedge the risk that they can't fire this employee.

I'd rather work an uncertain year at $150k than three years of $40k guaranteed, but that's just me. I'm an optimist while most French I know are decidedly pessimistic.

<comment><USER7> I'm sympathetic to your general point but it doesn't seem very relevant to this discussion.

It's one thing to have employment law where you can't hire/fire people at will. I agree that's relatively inflexible and I'd prefer the American model (as a European). There's no free lunch here, you either need to pay for this out of your taxes (as in France), or pay lower taxes and save for the unexpected loss of job yourself (as in the US).

It's an entirely different thing that a company can't meet its basic contractual obligations, i.e. the ability to pay salaries. That's a case where a contract was made, there seems to be something very wrong with basic US corporate law that would allow this to happen, i.e. a company should have enough assets on hand to pay salaries in the event that it goes bankrupt.

In most of Europe companies are obligated to insure against this eventuality. I can't drive a car on public roads without insurance, why should a company be allowed to operate if it isn't insured against failure to meet its basic contract obligations?

<comment><USER8> > I'm sympathetic to your general point but it doesn't seem very relevant to > this discussion.

That you should judge the economy as a whole instead of picking one aspect and extrapolating what "our values are".

Europeans tend to view issues through a classist lens. That society is split up into the workers, and the capitalists, and that your ranking in the social hierarchy is solidified.

For better or worse, we don't see it that way. Today you're a worker, tomorrow you're a business owner. I would say America has more workers-turned- entrepreneur than anywhere else in the world. We have more millionaires who came from "worker" background than anywhere.

I've seen it first hand on multiple occasions. I've seen immigrants come to this country with _nothing_ , work incredibly hard, build a business from scratch, and turn into employers in their community. It's the story of my family and many others here.

If the barrier for these immigrants starting a business was anything like complying with EU regulation - I promise you these businesses and their communities would not exist.

<comment><USER4> > Europeans tend to view issues through a classist lens. That society is split > up into the workers, and the capitalists, and that your ranking in the > social hierarchy is solidified.

And yet social mobility between the classes (they exist in the US too even though you don't necessarily think in terms of them) in many European countries is better then in the US. Especially the nordic countries. Pretty much the only EU countries doing worse then US are UK and Italy and the difference between US and UK is much smaller then US and Finland for example.

Maybe we Europeans are a bit pessimistic when it comes to our economic futures but in terms of the chance of making from poor to rich (or vice versa) in many places we are doing better then the US.

[https://inequality.stanford.edu/sites/default/files/Pathways...](https://inequality.stanford.edu/sites/default/files/Pathways- SOTU-2016-Economic-Mobility-3.pdf)

<comment><USER8> There's some truth here but it seems we're comparing apples to oranges considering Finland is the size of a US city. I wonder how a top US city compares to Finland for example, or the EU as a whole compares to the US in class mobility.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER9> I was a member of Austin's TechShop for two years. It was interesting contrasting it to the ATX Hackerspace. The hackerspace (a few years back, anyway) was much better at building a community. The fee was only $35/mo, and they had a starving student discount, and you were also free to invite your friends to tag along. As a result, there were always people just hanging out at the hackerspace. A lot of near-college-age space cadets and techno- dreamers, and they'd be there all day. You could go there to work on a project, or just to mooch off of the conversation.

TechShop never developed a community. It felt sterile in comparison. The fees were more like $125/mo (at the time, and only went up from there). There was no central area to hang out in and chat. And inviting a friend along cost something like $20. These conditions resulted in the demographic becoming more like a bunch of upper middle class dudes who managed to get a few hours away from the fam to work on their project. There was no social core, it never became a hang-out.

There were also some financial issues which really turned me off. I had spent about $1500 on classes early on (thinking I'd just get signed off on all of the machines asap so that I was free to work on anything), but I later found out that if you didn't badge into a machine for over 12 months, your credential for that machine expired and you had to pay to take the class again. Boom, easily $1000 down the drain. By the time they started hiking up their membership prices, I was disillusioned and declined to renew.

<comment><USER10> To each his own I guess, but socializing and constant noise around when others are socializing is the main thing I hate about hacker spaces. I would gladly pay extra to have a "sterile" workplace for my projects.

<comment><USER11> Yeah if sterile means people don't leave shit around everywhere and dump their unwanted junk in case someone wants it then sign me up.

On the other hand it sounds like the safety paranoia (have you been inducted to use this hacksaw?) is even worse than at hackspaces.

<comment><USER12> At TechShop they were really conscientious about safety, but I don't think that extended into "hand tools". Power tools, certainly.

And I don't have any problem whatsoever about restricting access (and policing) to the larger or more dangerous equipment.

Lathes and milling machines can easily maim and kill if not treated with respect and knowledge. Laser cutters must be supervised when running, or a fire is easily possible (not to mention understanding why you shouldn't cut sheet PVC in a laser cutter). Water jet and plasma table cutters are not toys for the uninitiated.

I have zero problems with such rules. It's one thing if you own the tools yourself in your home shop; do what you want, whatever consequences result. But when you are doing it in a public or semi-public manner, having such rules and regulations should be a sign of quality of the space.

</comment></comment></comment></comment><comment><USER13> At the Redwood city location there were many artists and small businesses that depended on the facilities. It will be a big blow to them.

I think they got reckless with their expansion. The San Jose location moved to a new location after their lease expired. They chose to relocate to a prime location in downtown San Jose and ended up with a million dollar shortfall to renovate and open the new location. They somehow managed to scrounge the money through an appeal to the community and opened but it must have ruined their financials.

At the same time they were opening in other cities. If their financials in the Bay area were shaky (as they admit in their closing statement on their website) then it is not clear why they were taking on more risk by expanding.

<comment><USER14> They had no choice but to expand. They had a fairly large corporate office, which needed income from a lot of sites to cover the overhead. I was thinking about investing and got a good look at the financials - only the three Bay Area shops were profitable. Bottom line, they overestimated how many makers out there are willing to pay $150 per month to support their laser cutter habit.

<comment><USER13> Could you reveal whether the Bay Area shops were borderline profitable or operating with decent margins ? I was surprised that they managed to stay open for more than a decade and assumed that they had figured out a decent sustainable business model.

<comment><USER15> San Francisco and Mid-Peninsula were break even (as of 2015). The rest, including San Jose were hemorrhaging money.

<comment><USER12> I'm kinda surprised to think that about the "Phoenix" (Chandler) location; they were essentially "given" the building they used by the city; it was also a shared space with some portion of ASU (IIRC).

I wonder what will happen with that ASU program (I think it was part of the engineering school)? I wonder if they will simply take over the space and continue using it (though probably closed to the public)?

</comment></comment></comment></comment></comment><comment><USER16> Really tragic. I toured their SF facilities and was really impressed with the seriousness of their equipment. Definitely a huge leap above the average maker shop.

Ultimately the high price wasn't what held me back from joining, but the tool use policies required by their insurers. You had to pay for a brutally waitlisted class before they'd let you use so much as a laser cutter. I wonder how much this contributed - both the cost of insurance and its consequences - to their decline.

<comment><USER17> > You had to pay for a brutally waitlisted class

For better or worse, that's been the model at every makerspace I've been a member of/looked into. And I think it makes sense, insurance-mandated or not. Lots of expensive, potentially dangerous machinery that if used wrong can destroy itself, its user, and/or those nearby.

Also, in my experience once you've built up enough trust with the admins they'll let you get a crash course from a member who knows what's up and skip the fees and formal training process.

<comment><USER18> I remember my experiences in high school metal shop. The teacher impressed on us the dangers of leaving the key in the metal lathe chuck when turning it on. One day, naturally, a kid left the key in the chuck and turned it on. There was a loud bang as the chuck flew up and through the ceiling. It could clearly have killed someone if they were in its path.

I don't want to be around people who use powerful machines without proper training, or around kids using those machines, or using those machines around kids who treat the shop as a playground.

<comment><USER19> > using those machines around kids who treat the shop as a playground

Definitely the biggest hazard in my comprehensive school tech. classes. Little makes you move to the other side of the room faster than people throwing random pieces of scrap at a powered disk sander, and I'll never forgot the noise an LED makes when shorted across a 230VAC wall socket (with a locker key jammed in the earth pin for good measure...).

I sometimes wonder how the only injuries I got from those years was a minor soldering burn (dropped the iron) and accidentally impaling the palm of my hand with a screwdriver.

<comment><USER12> The high school I went to in the late 1980s was originally the city community college; the campus was pretty large. The woodshop was located in what was termed the "industrial arts" building (the building essentially was a high school "techshop" all on its own; small engine repair, drafting, autoshop, woodshop, metalshop, etc - all under one roof, three stories tall).

Well, the woodshop itself had equipment that was decades old; some of the equipment was quality stuff dating from the 1930s. We had this huge surface planer machine that could take wood 6 inches thick and 8 feet wide; it took a good 10 minutes for it to come to a complete stop after powering it up.

A friend of mine wanted to see if it would plane 1/2" in one pass off a 2x6; the instructor of the class had no problem with trying it, either!

It did. You wouldn't believe the sound it made, but it didn't miss a beat doing it.

</comment></comment></comment></comment></comment><comment><USER20> Wow. I'm speachless. I remember when Obama visited the TechShop near me in Pittsburgh. This was supposed to be the next big thing! The harbinger into the Uberization of the workforce. What a bummer and major dissapointment. I met with the staff there numerous times; they were fantistic people - <USER2> educated and helpful. This is just so dissapointing. There are quite a few makerspaces and hackerspaces in Pittsburgh. I hope this doesn't spell the end of this movement.

</comment><comment><USER21> I hate to be the guy who says he saw this coming, but I doubt I'm the only one who did. Renting out prime real estate in downtown areas, buying very expensive tools and machinery, and letting people use them for a very small percentage of the cost? Not a good business model.

<comment><USER22> I felt the same way when I toured the Austin Techshop. They touted some hugely expensive machine and I was thinking 'How many people need to cut an 8 inch block of marble with precision?'

Honestly, I think a similar concept would work with much more basic equipment.

The various Hackerspaces seem like a good bet.

</comment></comment><comment><USER23> I suspect there is still a business model there. When I was looking for access to machine shop tools in Boston area (I primarily needed a good accuracy CNC mill) I found nothing that worked for me. Best match was a "maker space" with a mess inside, 4 machines 2 of which were broken (including their one CNC) and remaining two looking suspicious.

How can I use machines? Take a class after sign up. When is the next class? Not sure, in a few months maybe; they fill quick, too, so keep checking often. The attitude of an admin I checked with was "get lost, we have enough members already".

I finally found what I needed at a university hobby shop: working machines, busy but good access to tools, efficient admins. To get CNC access I needed 2 short classes that I could both schedule within 2 weeks.

Before I found that though I would gladly pay higher membership fees for a clean, efficient machine shop access. Just my 2c.

<comment><USER24> Market size would be a challenge. You likely represent a very niche segment - a highly technically savvy hobbyist who wants to work on tools yourself for the love of it.

For anyone doing requiring 3D printing, CNC etc professionally or even as a semi serious hobby, I'm sure there would be firms who can execute and fedex you the job.

Here in Singapore when I moved into our apartment, I ended up having to design a custom child safety lock for my windows. I found quite a few 3D print shops which could deliver the next day at quite a reasonable rate - fast enough for me to iterate the final design within a week.

<comment><USER23> > Market size would be a challenge.

Possibly, but I am not sure about this. When I was looking (about 5-7 yrs ago, US, Boston area) there were two types: cheap and nonfunctional beyond toys or "we run your jobs for you". First type, as they are cheap, have no interest in new members building things; in fact, as the membership is so cheap they try to sell all sorts of overpriced classes as memberships do not cover costs.

At the other end there are those who take your design and ship you the product, as you said. This is OK for many cases, but gets pretty expensive and inefficient for prototyping. And there was nothing in between to fill this wide gap.

In fact, when I was looking for such a shop and asked friends if they know a place that would let me pay membership to use a decent quality 3+ axis CNC mill and a laser cutter no one knew of a place but several said if I found one, would I please let them know. So I suspect the market _is_ there.

The situation is much better with 3D printing -- there are small shops everywhere and some could even let you come inside and iterate if you chat with owners. However, inexpensive 3D printing is nowhere near the accuracy, reliability and robustness of the end product you get with inexpensive milling.

<comment><USER25> I think you just answered your own question there. Look up the price of a 3-axis mill with the capabilities you're looking for. The cheapest you'll find is probably the Tormach 440, which starts at about $7K. A laser cutter in the range you're likely looking for runs about the same. Now look at the unit economics on that and figure out how many people like you would need to pay to use the machines before breaking even, before even getting into rent, maintenance costs, insurance, and the inevitable repairs needed when a non- professional uses it and breaks it. It's just not worth it to have that level of machinery available to the public unless it's part of a bigger TechShop- like setup where dues are a grand a year and classes that much again (there's a similar place to TechShop in Orange County, for example, with an almost identical cost structure).

For what it's worth, I run a 3D printing shop (we also have a laser cutter and woodworking equipment) and we let people prototype on our machines occasionally. 3D printing is an order of magnitude more accessible than milling, and probably about twice as easy as laser cutting, and if one of our machines goes down due to user error, it's cheap and easy to replace parts and won't stop operations since there are plenty of others.

</comment></comment></comment></comment><comment><USER26> I frequented the Redwood City location but bailed after the expansion. Or rather, I bailed after everyone else who I mooched knowledge off of bailed. Still, it was great while it lasted. Ace Monster Toys is similar in the East Bay.

[https://www.acemonstertoys.org/](https://www.acemonstertoys.org/)

<comment><USER27> Nice, I hadn't heard of this place before, but a little far for me. I was actually looking at techshop and planning on going there since I had some small projects I wanted to do.

I'm on the peninsula, is there something similar in this area?

</comment></comment><comment><USER28> What a shame. There was one right next to the San Jose State University campus. They were forced to move when construction on new private student housing began where their building had been located. After a lot of hardship and pleas for donations they had just finished moving into a new location right on 2nd street in the middle of downtown.

video featuring many of the regulars at the SJ location [https://youtu.be/vYBivF3YNlg](https://youtu.be/vYBivF3YNlg)

</comment><comment><USER29> Previous discussion: [https://news.ycombinator.com/item?id=15705072](https://news.ycombinator.com/item?id=15705072)

</comment><comment><USER30> There was a location near me, but I could never justify spending that much money on something I'd use for a a day or two a month. Between commutes during the week and traveling on weekends there would never have been time to make it worthwhile. Sad to see them go under though.

<comment><USER9> You hit on what I suspect is a missed opportunity on their part. There are a lot of businesses which seem to be thriving on the "too cheap to bother canceling even though I stopped using it" idea, like the $10 gym memberships you see.

Perhaps they could have come up with a drastically price reduced membership which only allowed for a couple of days of use per month? It would have eaten into some of their full memberships, but I suspect they could have dramatically grown their membership in that fashion.

</comment></comment><comment><USER31> This is just terrible. We need more, not less, access to tools in our society.

We joined with a few other startups to offer something to the members who were affected.

glowforge.com/techshop

</comment><comment><USER32> I could never justify joining the Pittsburgh one when it was open. I did visit a few times and always felt like they had too many employees and too much space for what they were. They also chose one of the most expensive places to rent in a city filled with affordable real estate.

</comment><comment><USER33> Pragmatic question: what are the alternatives in the Bay Area that are available to me right now?

I'm most interested in having access to a laser cutter, mill, and lathe.

<comment><USER34> Most community colleges.

If you develop a good relationship with the prof, he'll let you run a mill.

Take a class or two, and see how far it gets your. They are usually pretty cool.

<comment><USER35> it seems really sad that these longstanding resources don't get as much attention in the maker community as they should. the teaching staff is usually super experienced and helpful, the costs are priced to allow people to get themselves into regular blue collar work. most importantly for me they are trying to train you to be a professional craftsman, not just getting you to the minimum level that you can show up once a month and mess around and probably not hurt yourself.

ccsf welding courses are vastly more useful and 1/4 the cost of a crucible course

<comment><USER36> There's a political angle or herd mentality that makes it hard to go to CC. If you can get past it, they are great places for an individual to learn, but if the social or social media stuff is a significant fraction of being in the makerspace, then its not going to work.

<comment><USER34> What do you mean by herd mentality?

If you want to make contacts, that's different from running a lathe, but maybe I'm oversimplifying.

I will say that people at makerspaces generally want to be there, whereas people in CCs generally see it as more of a steppingstone to a decently paying job. You might get more out of one or the other, but there's no denying that makerspaces charge extortionate rates for machines that the CC provides virtually for free, if you know the prof well enough so he lets you sneak in.

</comment></comment></comment></comment></comment><comment><USER37> Eh good riddance. I recall encountering a litany of safety issues at their first location. For instance... a properly set up machine shop has the milling machines placed in the corners of the room, and the remainder with shields around them. This is so that if a part is improperly fixtured, the part won't be shot out of the vice at a neighboring operator. When a certain mill made a terrible noise at the speed I needed to operate it at, I was told to crank the speed up until the noise went away. This is when the location was run by the core group of people who started it... and thus I'm not surprised that it was mismanaged at scale as it grew.

</comment><comment><USER38> These kind of facilities should be paid for by tax dollars (which they are in other countries). They provide a needed place for people to tinker and learn which is beneficial to the community overall.

</comment><comment><USER12> This is rather unexpected and surprising to me. I wonder what it was about the business model that just didn't work?

When they opened the Chandler location here in the Phoenix area, I quickly signed up for a year's membership, but that turned out to be a mistake. I certainly didn't get my money's worth, but the mistake was on my end, not theirs: They were located in the east valley (where it seems all the cool kids are), and I live in the west valley; it was a good 100 mile drive round-trip for me to go there. I hardly ever went as a result, and the membership was wasted.

The space itself was amazing otherwise; had it been closer to my home I am sure I would have used it more often than I did for the tools I didn't otherwise have at home (like the laser cutters, for instance). I was always impressed how they had workshops for just about everything you needed to take an idea from a concept (CAD/design) to finished prototype.

There more more than a few startups that got their start at TechShop; one of the more famous examples was Square (they prototyped the original swipe reader thru TechShop).

I am now wondering what, if anything, this says (or what effects it will have) about other maker and hackerspaces. We don't really have very many in the Valley. For myself, I'll just continue doing what I've always done, and work from home or over at my friend's shop.

</comment><comment><USER39> Update: the founder of Square is re-opening the St. Louis location.[1]

The Deputy City Manager of San Jose has his staff looking into what to do about the San Jose location.[2] There's a good chance San Jose and the Downtown Development Association will make something happen. They're very aggressive in building up downtown San Jose. In 2008, it was almost totally empty, and they want startups to locate there.

[1] [http://www.stltoday.com/business/local/inventors-take- heart-...](http://www.stltoday.com/business/local/inventors-take-heart-st- louis-entrepreneur-will-reopen-maker- space/article_31d842e2-4637-5948-b7d7-1f0b963554de.html)

[2] [http://www.mercurynews.com/2017/11/16/rip-techshop-san- jose-...](http://www.mercurynews.com/2017/11/16/rip-techshop-san-jose-what- comes-next/)

</comment><comment><USER40> More broadly, it's kind of sad how little actually came of the "Maker Movement," at least in terms of startups. MakerBot sold for $400M and there are plenty of small 3-D printer companies targeted at hobbyists. Ponoko and Shapeways are solid if unspectacular. Arduino and Raspberry Pi are both solid projects, AdaFruit and Sparkfun are solid businesses. Make: Magazine is cool, but still a niche publication.

Of course, startups aren't the only measure of success. The net positive is hundreds of thousands, maybe millions of younger hackers who may go on to build the next hardware company based on lessons learned at a MakerFaire.

<comment><USER41> > More broadly, it's kind of sad how little actually came of the "Maker > Movement"

I'm not sure I agree. However I do believe the "Maker" movement was over sold by O'Reilly media and Dale Dougherty in particular. I stopped subscribing to Make Magazine few years back when it became apparent it was little more than a print version of Hackaday or Instructables.

Regardless of Maker. There is a plethora Robotics Competitions, existing Hacker spaces and STEM is huge.

The number of kids that were going to tinker at home is a fairly fixed. Where we'll really move the needle in terms of more people getting into engineering is in formal education (inc Robotics competitions).

Disclosure: I'm a little biased, I help design and build IDE's for some of these comps, e.g. [http://zerorobotics.mit.edu/what-is- zr/](http://zerorobotics.mit.edu/what-is-zr/) but I also have advocated and help implement "maker spaces" in my local school system. There is a sea- change, so I'll push back on the idea that little came of the 'maker movement'

<comment><USER40> I totally agree — There was just this point where the Economist and other general interest publications were covering it like the 3rd industrial revolution. More robot clubs are great, but it's hard to think of a single billion dollar company that came out of it.

<comment><USER15> I don't credit Techshop for any of this success, but lore had it that Square built their prototype at Techshop.

<comment><USER39> The case. Not the electronics.

</comment></comment></comment></comment></comment><comment><USER42> I belonged to the Redwood City TechShop for a year and was surprised five years ago seeing a TechShop planned for Raleigh, NC when we were thinking of moving to RTP. I'm not sure that it ever opened, it didn't last long.

We ended up in Winston-Salem, NC instead, and I look forward to checking on Mixxer when it opens, $550/year, [https://wsmixxer.org/](https://wsmixxer.org/). Winston-Salem has a big arts community, might be an interesting place.

<comment><USER43> I was a member at TechShop RDU for a couple years. It started as an independent makerspace, got acquired by TechShop in 2011, then closed in 2013. It was a really cool place and I miss it. A lot of interesting characters there.

As others have said in this thread, I think TS had a tough value proposition to build a business model around. Classes were a pain and a fairly big start- up cost for new members, but inevitable to satisfy insurance requirements. The monthly membership fee was fairly cheap considering the awesome equipment they had, but expensive if you could only manage to go a few days a month. Plus whatever storage fees for larger projects and/or the hassle of carting your stuff around.

On top of that, management at both locations I used (RDU and Arlington) seemed a bit chaotic. Sad to see them go out of business either way.

</comment></comment><comment><USER44> For those of you in SF, you should look into Noisebridge. They don't have nearly as many tools or machines as TechShop, but they have a lot and it's all free.

<comment><USER45> Noisebridge is a cultural institution in and of itself. Such an amazing space to spend time in

</comment></comment><comment><USER46> The Brooklyn location just opened two weeks ago. Its fully stocked, and most of the equipment has never been used. What a waste!

</comment><comment><USER39> Discussions elsewhere concerning TechShop revival are on Facebook [1] and on Slack (somewhere).

[1] [https://www.facebook.com/groups/128112754534676/](https://www.facebook.com/groups/128112754534676/)

</comment><comment><USER47> People really decided to hate Peter Thiel during the last election. But he is right about the fact that you can't do anything in the physical world in the United States anymore.

Between housing and real estate prices, insurance, taxes, lack of government support, environmental protections, requirement to pay for health insurance for employees,layers of regulations, minimum wage laws, sexual harassment lawsuits (it only takes one and your company is over)...you just can't operate a physical space with drills, laser cutters, saws, advanced electronics and machinery at a profit in America anymore.

TechShop was the last gasp of American industry having any sort of future. With Tech Shop, we can also probably say good bye to a good deal of real trade skills people learn at these locations. They really tried to make it work. I have spoken to some of their founders myself - The amount of work it takes to set up even one of these facilities is simply staggering. If I were to show you the spreadsheets, business plans and research these guys invest to open ONE shop it genuinely rivals that of a full startup per location.

My heart really breaks.

There are a few companies able to survive with physical presences like this in the Bay Area now, but they are all backed by the power of Jabil, Flextronics, Autodesk. Some small indie chain can't make it in these conditions.

Unfortunately, we can expect more of this as a country. We are one recession away from a full republican route (they are doing a spectacularly awful job and deserve to be thrown out) and all signs are pointing to a fully socialist government being next in line.

Socialist governments are not known for their desire to roll back worker protections, undo environmental protections and regulations, nor is their focus on enabling businesses. Although I will say Canada seems to be doing better than us in many ways when it comes to accelerating genuinely valuable little companies like TechShop.

I am genuinely beginning to advise people to consider moving to Asia where innovation is able to happen, it won't be done in a America anytime soon.

Between Trump and his socialist successor - and the wonderful incompetent state of California I don't have a good feeling about American innovation anymore.

<comment><USER48> People are down voting you, and yes people hate Pete Thiel. At the same time I see this current thread (the one we're reading, abut TechShop _running out of money_ ) full of people saying they would have joined but it was _too expensive_.

What you are saying at least partially makes some sense and it makes me sad people are downvoting you in a clearly reactionary way.

<comment><USER49> > TechShop was the last gasp of American industry having any sort of future.

I suspect downvotes because of this, as much as the politics. The absurdity of a small, nonprofitable company being "the last gasp of American industry" and the odd lamentations around that.

I live in the Southeast. Drive through nearly any county in GA, NC, and SC (the region I'm presently most familiar with) and you'll find a surprisingly large number of manufacturing centers.

> With Tech Shop, we can also probably say good bye to a good deal of real > trade skills people learn at these locations.

And none of the people working in them were trained by Tech Shop. They were trained on the job or in trade and tech schools.

<comment><USER48> Sure, your right - I was just trying to say that something was ringing true in his statement ... people finding it too expensive to learn stuff like this, meanwhile the company trying to do it not making enough money to stay afloat.</comment></comment></comment></comment>


Kite: Thoughts on Security - <AUTHOR> https://kite.com/blog/thoughts-on-security/ <comment><USER2> Something people should consider when thinking about tools like Kite:

If you're a contract developer, or a developer working full-time for a consulting firm, you might not have the authority to determine for yourself whether it's contractually allowable to upload code to Kite's servers. But if you're working for a pro shop, you can bet every dollar in your pocket that the contracts your firm has with its clients technically prohibit it.

Kite is really neat, but I'm a little uncomfortable with the idea that I'd have to remember to remind consulting vendors not to let their developers use it when working with my codebase.

<comment><AUTHOR> This is great feedback, and definitely something we need to address.

Initially we've been focused on giving users control and transparency. We need to extend this to employers.

One quick idea that we'd love your feedback on: a .kiteignore file that can exclude Kite from responding to files that match a certain pattern (e.g. "secrets.py"). Presumably an employer could put a "[^.]*" in a repo-level .kiteignore file, and anyone working with that repo would have to explicitly delete that file to use Kite with it.

We'd love to hear any other ideas folks might have as well!

<comment><USER3> The only way to truly solve this problem is on-premise devices that do not push data to Kite, honestly.

I'd need to ignore every file I have.

<comment><USER4> Why does the device need to be on-premise? Would a Github Enterprise-like setup, where you have a dedicated Kite instance/VPS at their datacenter, work for you?

<comment><USER3> Contractual agreements, NDAs, etc. might make it impossible to disclose work product and/or source code to a 3rd party which would include Kite.

> If you're a contract developer, or a developer working full-time for a > consulting firm, you might not have the authority to determine for yourself > whether it's contractually allowable to upload code to Kite's servers. But > if you're working for a pro shop, you can bet every dollar in your pocket > that the contracts your firm has with its clients technically prohibit it.

As tptacek said, you might be prohibited and/or not have the authority to do so.

> Why does the device need to be on-premise? Would a Github Enterprise-like > setup, where you have a dedicated Kite instance/VPS at their datacenter, > work for you?

We run GitLab on-premise so I'm not familiar enough to answer. However, if by "their" you mean Kite? Yeah, that won't work as its essentially the same thing. [e.g. Disclosing it to a 3rd party outside of my control]

</comment></comment></comment></comment></comment><comment><USER5> I had the top comment on the original post and was critical of Kite's approach. I still think that Jetbrains has proven that you can be very effective locally without consuming your entire machine, because the needs of one project do not require making sense of all Python libraries. You only need to make sense of the fairly small subset of libraries that a given project actually uses.

That said, I think this response is terrific. The value proposition was outlined well. Feedback loops are important and cloud services naturally have much tighter loops. Security considerations are no different than they are for GitHub, so those will not be insurmountable for many.

So, neat looking product and very nice response to initial feedback!

<comment><USER6> Expanding upon this line of thought I am not sure their comment RE: storing data indexed in 32GB of RAM holds any meaning considering it requires a hop over the wire to access. Locally stored indexes on disk would likely be much faster.

I would imagine a smooth update mechanism could allow you to update file indexes without loosing too much agility on feature development but come with huge security gains.

<comment><USER7> Well they say "machines" so it might be much more than 32GB. (Though on disk it might be strongly compressed.) And on HDDs, a few seeks is actually slower than a network round-trip.

<comment><USER6> Uncompressed might indeed eat up tons of disk space.

Admittedly I was thinking of an SSD + some caching in RAM when thinking of this timing. But I was always under the impression an HDD seek would be on the order of 10's of ms? I'd assume a query to a cloud service would be on the order of 100-200ms.

<comment><USER7> The network latency should be somewhere around 40ms assuming you're in the US on a proper connection. If a query takes 10 disk seeks (10ms each) vs 10 RAM accesses + HTTP parsing...

</comment></comment></comment></comment></comment><comment><USER8> It's not really about 'security being addressed', we all know that. It's about marketers creating the illusion that security has been addressed for end users that don't understand it anyway. In the case of stuff like Windows, it's about eventually forcibly removing control from the users by pushing updates.

I think it's dishonest to not just simply post that 'if you're afraid of the cloud, you are not our target market, go away'. I guess it's a capitalism thing. Wouldn't look good to investors, or whatever.

I am sad because I have a beefy machine, and I want to use this, but I can't. I'd pay for it, you know? But I don't 'do' SaaS, the reasons are too long to list here.

More concretely, 32GB RAM is trivial, and preselecting my languages is... I've already pre-selected them! It takes months, years to learn a language :P

Kite looks really super cool.

</comment><comment><USER9> You "launched", really? Maybe internally, but I haven't received even an email confirmation that you've got my "signup request". As far as most of us are concerned, you launched a video.

<comment><USER10> second that. I never got so much as a confirmation email when I signed up. Signed up again today--I'd really love to have a tool like this while I attempt to learn programming.

</comment></comment><comment><USER11> Many people complaining about security because of the nature of the 'cloud' here. This is what I thought when github came out as well. But look today, everyone has their code (supposedly their IP) on github. Ulitmately, kite's track record on the cloud will trump any security considerations.

<comment><USER12> The difference here is GitHub doesn't auto-upload Python files without me knowing. If I open my secrets.py file I know it's not getting uploaded to GitHub because I see it's absent from the staged files.

I don't think Kite prompts you before uploading every time you open a file.

<comment><USER13> Maybe add a .kiteignore then?

</comment></comment></comment><comment><USER14> This sort of open communication is great way to start to build trust of users (both relating to security and otherwise). I was thrilled to see the devs responding to comments positively in both the HN and reddit threads.

I'm looking forward to seeing Kite expand their security support and I can't wait to try it out on Linux.

</comment><comment><USER15> Reposting since it wasn't answered earlier:

Even though I trust you, there's no way anyone can guarantee that a hacker won't get into your database and get my proprietary source code.

I'm no security expert but one way I can think of is creating an encryption system which works like this: all my source code will be stored encrypted on your (non-ephemeral) databases. The decryption key will be stored on my computer, and it'll be transferred to the server when I run Kite and destroyed as soon as I quit Kite. The key will be stored in your server only in an ephemeral storage (in-memory database etc.) Do you have something like this in the works?

<comment><USER16> The approach you described is largely security theater. Supposing an attacker has compromised a machine and is capable of retrieving stored data, it reasonably likely that the attacker will be capable of either capturing the key as it is transmitted or reading the key while it is stored in memory.

If you start with the assumption that a machine is compromised, then there's not really a way to guarantee secrecy of anything done on the machine. Homomorphic encryption resolves this, but (as far as I'm aware) it is too computationally expensive to be viable at present.

</comment></comment><comment><USER17> Some things I didn't seem mentioned (I may have skipped over) which would be awesome:

* Let us delete all of the data we have stored on your servers, whenever we want. * Let us see all of the data we have stored on your servers, whenever we want. I really don't care how you're manipulating it, but would like to see (and additionally delete) any information you have stored on me that I'm uncomfortable with.

<comment><USER4> While those would help with consumer confidence, the reason the EULA probably disclaims all that is because the data is very hard to track down.

It may be on magnetic tape backup in archives. Do they have to dig out each roll of tape each time for each customer who wants to erase a segment of their data?

It may be indexed or used as input to shape a larger or disconnected part of the software. It shows up in logs, and therefore in archived statistics analysis. It may have been copied and modified incrementally by a dozen other users. Should all these developments from user data be destroyed because they are based on old data with a delete request?

Perhaps an opt-in to a feature that doesn't back up or analyze your data for an hour could help prevent "committed the password to version control" accidents. But it would need to be opt-in, because the whole point of Kite is that your code is indexed in real time, right?

</comment></comment><comment><USER18> Not (directly) related to the security, but I was wondering if you were inspired by any research from academia when creating this. I only ask because I just watched a talk from a Stanford professor from 2012 where he talks about anonymizing and aggregating everyone's code in the cloud to create better documentation, albeit as a one sentence aside at the end of an otherwise unrelated talk.

<comment><AUTHOR> The initial idea came from thinking about live contextual search and community. This thinking intersected with programming because of my background, and once that happened there was a lot of iteration—informed by research, and mostly conversations with friends—to get where we are today.

</comment></comment><comment><USER19> I'd like to hear a statement like this that explicitly acknowledges something like, "as a private company funded by Silicon Valley investors, we need a clear way to capture more and more value, and that's a big reason why we want to collect your data on our servers and use a client model for our proprietary algorithms."

That's how it works, we all get it!

</comment><comment><USER20> For the record, we went through this too. Kite is awesome, and I have no doubt it will succeed, but we fought the enterprise virtual appliance train for years. The cloud grew, we got more customers, but there were certain verticals we could never reach: finance, government, etc.

We recently built a virtual appliance. It's growing infinitely faster than our cloud solution ever did. Those numbers speak for themselves.

Certain products just need to have the virtual appliance option. I'm sure Kite will get there one day.

For now, I'm going to use it for personal projects because it's still a badass solution to a problem I have. :)

</comment><comment><USER21> "Some folks still use Garmin GPS due to privacy concerns, but most of the world uses internet-connected navigation for its many advantages: fresher maps, more coverage, better tuned navigation algorithms, better user experience because iteration is 10x cheaper, etc."

There is one thing missing: people use Google Maps, Waze etc simply because it's free.

</comment><comment><USER22> Just out of interest is there a plan to make Kite work on an iPad rather than just a window on my computer - even some kind of screen sharing with (basic) touch support would be excellent.

I will probably never use it because it scares the crap out of me that I'll type my password in the wrong window though :-)

</comment><comment><USER23> This is more about Thoughts on Privacy than security.

</comment><comment><USER9> Unfortunately,

        Convenience > Security

Laziness is both a curse and a blessing.

</comment><comment><USER24> So how do I sign up?

<comment><USER25> [https://kite.com/](https://kite.com/)

You sign up for an invitation. I am curious to know how long that invite typically takes. I just signed up about an hour ago.

<comment><USER24> I "signed up" last week. Nothing yet.

<comment><USER26> Same. I have heard no anecdotes of people being invited yet either.

</comment></comment></comment></comment><comment><USER13> > "we believe we will set industry standards that will be adopted across > multiple categories of tools such as continuous integration and code review > systems"

Excuse me? Why is that? It sounds like either they think they are programming wizards or they believe the CI folks are incompetent, none of which signals a company I would like to trust.</comment>


What should be the name for a Twitter alternative - <AUTHOR> was wondering what a twitter alternative would be called <comment><USER2> Avalanche. Each post is a flake. "I just flaked out that picture." "I need to flake her back."

<comment><AUTHOR> that's a flake comment</comment></comment>


What Keynes Knew About Bitcoin - <AUTHOR> https://www.bloomberg.com/news/articles/2017-11-09/keynes-worked-out-the-bitcoin-interest-rate-it-s-57 <comment><USER2> Just another clickbait headline article which barely mentions Keynes for the "effect" while explaining one of the terms in a futures market - backwardation.

The explanation is also incomplete. No mention of "cost of carry" or contango. While forgetting backwardation doesn't imply _only_ interest rate but risk premiums too.

To top it, the implication of the so-called _interest_ is from an exchange called Deribit. The 24-hr volume on the market is ~3.8 million or 1% of last 24 hr BTC volume (from coinmarketcap). Not to mention the contract size is $10 which 0.0014 BTC at current prices. The market is super illiquid to be use for any kind of useful analysis.

<comment><USER3> So what do you think the cost of borrowing bitcoin should be?

<comment><USER4> The whole thing is absurd because we don't have to guess or speculate-- just look at what the actual historical rates have been for BTC margin loans on exchanges such as Poloniex. Nowadays the rate is pretty low, 3.5% to 5%, but it can spike to much higher levels based on supply and demand (for example, leading into the bitcoin gold fork, rates spiked because the exchange wouldn't credit BTC balances with the fork if the coins were being lent at the time).

</comment></comment></comment><comment><USER3> [https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iI77KmfJdUn...](https://assets.bwbx.io/images/users/iqjWHBFdfxIU/iI77KmfJdUn0/v1/1800x-1.png) that is not what line charts are for.</comment>


Theoretical limit to how hard it can rain - <AUTHOR> http://www.reddit.com/r/askscience/comments/i1zla/is_there_a_theoretical_limit_to_how_hard_it_can/c208i5d

<comment><USER2> That's not very useful limit.

First, the hottest temperature recorded was probably in some place like Death Valley, so the humidity was probably very low. Thus there isn't nearly as much water is the air as indicated by the saturation pressure.

Second, if you somehow did manage to have hot air fully saturated with water mix with very cold air, the hot air has much higher heat capacity (due to all the water in it). One cubic meter of -83C air has a mass of roughly 1kg, so a heat capacity of 1kJ/K. The heat of vaporization of water is about 2000kJ/kg, so by the time you'd condensed about 70g of that water, the cool air would have heated up to +55C (and that ignores the heat capacity of the hot air and the water).

So it's pretty safe to say, yes it's a _limit_ but not a very useful limit as it is so far above what's physically possible.

</comment><comment><USER3> While not close to the theoretical maximum, the observed records are, nonetheless, stunning.

1 min - 31.2mm (1.23")

60 min - 305mm (12.0")

12 hr - 1.825 m (45.0")

24 hr - 2.467 m (97.1")

72 hr - 3.929 m (154.7")

96 hr - 4.869 m (191.7")

12 month - 26.47 m (1042")

source (<http://wmo.asu.edu/#global>)

Almost all of the records come from La Réunion ( <http://en.wikipedia.org/wiki/R%C3%A9union> ), which is an island straight east of Madagascar. If you're from the US, think of the Hawaiian islands but in the Indian Ocean. Significantly, the island has peaks that rise up to 3,070 meters (10,070 ft).

I am guessing large Indian Ocean cyclones get going and then just run slap into this vertical peak in the middle of the ocean. Then, rain. Rain for apparently days straight.

<comment><USER4> Straight east of Madagascar.

<comment><USER3> fixed

</comment></comment></comment><comment><USER5> Can there be any non-technical response to this that isn't roughly equivalent to "Awesome"?

Meh. I love the depth of the answer, and what an awesome visualization :D

<comment><USER6> I share your sentiment. The whole waterfall from the sky imagery got me. Eye opening. Sometimes you can find a gem like that on Reddit. Sometimes.

<comment><USER5> I think I prefer to get my Reddit filtered. Like this.

<comment><USER7> There's a Reddit for that... <http://www.reddit.com/r/bestof/top/>

<comment><USER8> However, that also tends to promote funny threads, in-jokes, etc.

Still better than the average front page for sure, but don't expect it to be the reddit of three years ago.

</comment></comment></comment></comment></comment><comment><USER9> That would make a great simulation to watch.

</comment><comment><USER10> Alright, we need some fans and a massive heat pump, let's make this happen.</comment>


Released and Certified: Qt Safe Renderer - <AUTHOR> https://blog.qt.io/blog/2018/05/31/function-safety-certified-qt-safe-renderer/ <comment><USER2> A little of topic, but I'm confused about something.

These certs open the door for medical devices, which is great.

I work on Class 1 medcial device. We have customers and regulatory people saying I can't even use Qt because we compile it ourselves. Apparently, once we have access to the source code, we must bring the software up to our target safety class.

This of course isn't feasible. Apparently, this even applies to the kernel.

My regulatory people are demanding that we hire someone like WindRiver to deliver use pre-compiled images and tool chains, removing the source from our hands.

I don't follow regulatory closely, but this has got to be wrong. Are you saying that I can never use open source software? Even if the software has these certs like this (Safe Render)? Surely we can still treat 3rd party libs as SOUP, even if we have the source, yeah?

<comment><USER3> You can use any SOUP you want, the rule is that it is up to you, medical device seller, to write the requirements (performance or other) you want from it, and verify them. Additionally, you need to assess any risk added by the inclusion of the SOUP and mitigate them. (The effort depends on whether you include it into a Class A/B/C sw unit). You are ultimately responsible for any bug in the SOUP. And this is rather orthogonal to license of the sw.

Since this is a daunting task to verify something like QT, now you can at least pay for the certified version, and point some of your risk mitigations directly to the QT specifications/FMEA/Test results.

The usual strategies to avoid having to validate a huge external SW is to either have HW redundancies, or to segregate it completely from your main SW so that any failure of your SOUP is harmless.

<comment><USER2> We use Yocto. By default, the distribution is super minimal.

As I enable features in the Kernel, or add dependencies, they are driven based off of some functionality of our GUI/device which is tested/validated before each release.

So, if I enable squashfs in the kernel, and I can boot my box (which uses it), I can say that I have tested the requirements needed from the Kernel.

If I add in openssl for TLS connection to mobile devices and have validation in place to ensure connectivity, I can say that I have tested the required functionality of openssl.

I'd think this would be enough, but I never can seem to satisfy regulatory people. They are (in general) not very technical.

<comment><USER3> I would say it depends a bit of the usage of the system, and what is the worse case scenario of a failure (patient data corrupted, life sustaining devices switched off), in which case you might need to add another mitigation (CRC check, manual procedure) independent of your Yocto box.

<comment><USER2> I would understood under those circumstances where patients are at risk.

I'm not trying to get consultation services from HN, but for the sake of discussion, these devices are recorders used for post-op educational purposes. External/separate monitors are used for the actual operation.

I bring this up because the risk is very low, yet I have had multiple customers who wish to distribute our product ask about this.

This is turning into more of a rant than anything. I'll end with this comment.

<comment><USER4> You aren't expected to do anything in analysis and mitigation for SOUP that you shouldn't already be doing for all of your own software. The point is you can't just punt on that stuff when you use others software. It doesnt have to be that onerous, but you do need to put some thought into it.

</comment></comment></comment></comment></comment></comment><comment><AUTHOR> ASIL-D, SIL 3, SIL 4 und IEC 62304:2015(2006+A1) certifications mean that Qt can now officially be used for displays in automotive, medical devices, trains etc.

<comment><USER5> What were the previous alternatives?

<comment><USER6> Roll your own while following the regulations to get the safety certification.

</comment></comment></comment><comment><USER7> I've always been very impressed by the work of the Qt teams. I don't do much coding in C++ but when I have dabbled in it using Qt feels like a breath of fresh air.

<comment><USER8> yeah, after working in the web world and being depressed by javascript apps that consume 100% CPU doing nothing to render a page of ads, I love to go back to Qt and spend 5 minutes writing a high performance app that does amazing things.

It's really incredible how the world of software developed by adults differs from the software developed by kids.

<comment><USER9> That's just so out of touch with reality. People with that attitude scare me because they lock us into the "one true solution" rather than the one that actually makes the company successful. Nobody pretends that JS/electron apps are supafast, but don't pretend like they don't have tremendous benefits too.

<comment><USER10> there are many true solutions, electron is not one of them though.

>but don't pretend like they don't have tremendous benefits too.

Javascript+html+css is not a global optimum in the solution space of "making cross platform GUI apps", its just the best solution that exists right now (if you are afraid of C++), and that is too bad.

We could have simpler, better performing ways if we bothered to do things that aren't web related more often.

<comment><USER11> But time and money is a real constraint for projects. It's hard enough writing native Android, native iOS, and a web app to boot without also having to write native Mac, Linux, and Windows and dealing with all the cross platform UI quirks on Qt.

<comment><USER12> Wait, what? How are you going to write a native app with less quirks than Qt? VTK? That's a little disingenuous.

<comment><USER11> This is in reference to using Electron so you don't have to both write a web app and a native desktop app using Qt (in addition to native mobile, where performance issues are much more noticeable).

<comment><USER13> ...and electron apps have no UI quirks and no performance issues on mobile.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> Are the 'safety critical' UI components rendered any differently to the non- critical ones? From reading the related blog posts, I understand that they are generated in a separate process, but asides from that detail, are they any more reliable?

Or to put it another way, if we an pick some UI components and marking them as safety critical' somehow improves their reliability, why would you not mark everything as safety critical?

Does the safety factor decrease as more and more components enter the safety critical section? Why not subdivide the UI into more than just one 'critical' process and one 'non-critical' process, e.g. perhaps a light-weight process per component?

<comment><USER15> The article links to [http://blog.qt.io/blog/category/functionalsafety/](http://blog.qt.io/blog/category/functionalsafety/) which has a lot more details.

The short answer tho, is that "the tooling separates out the safety-critical elements for execution by the Qt Quick Renderer run-time."

</comment></comment><comment><USER16> Sounds like Qt Safe Renderer is a graphics library for displaying safety- critical information in cars, planes, medical devices etc.

In these domains, safety-critical information has to be displayed by certified hardware/software; QT Safe Renderer just got certified and released.

<comment><USER17> It doesn't specifically state aviation. Is it covered under one of their certifications?

<comment><USER18> Aviation has their own standards. But all of these standards are quite similar in their requirements. So reaching the first certification is the hardest part.

</comment></comment></comment><comment><USER19> How do those standards compare to aviation? Are there similar certifications that would allow to use a software implementation like this?

<comment><USER20> Friendly neighbourhood aerospace systems engineer here.

Yes, the certifications on the aviation side are DO-178C for Software and DO-254 for Airborne Electronic Hardware. Rather than SIL or ASIL (Automotive Safety Integrity Level), the aviation equivalent is DAL (Development Assurance Level). Of course, while they each use letters for levels of Integrity / Assurance, in aviation DAL A is the most stringent and in automotive ASIL-D is the most stringent.

[https://www.rapitasystems.com/blog/what%E2%80%99s-difference...](https://www.rapitasystems.com/blog/what%E2%80%99s-difference- between-sil-and-dal-how-does-it-affect-my-code-coverage)

<comment><USER21> Kinda related question is there a do-178b certified compiler that coult compile a future certified qt?

<comment><USER20> Not just compiler but operating system as well. Look at the names like Wind River, Green Hills or even LynxOS for a certified compiler / OS solution

<comment><USER21> Ah yes I took the 5 day greenhills training for a project that got put on hold. Was wondering if anything opensource exist for do187b usage. For example a GCC toolchain and a standard set of libraries (apart from the OS)

</comment></comment></comment></comment></comment><comment><USER22> Does a compiler exist with the same certifications?

<comment><USER23> Yes.

[https://developer.arm.com/products/software-development- tool...](https://developer.arm.com/products/software-development- tools/compilers/arm-compiler/safety)

<comment><USER24> When I'm seeing TÜV seals for highly-complex IT-related topics, I'm always asking myself if the people working for TÜV are really qualified for doing such certifications. The TÜV historically inspected steam engines and is mostly known today for doing driving tests.

<comment><USER25> Here in Germany, the TUEV not only certifies nuclear power plants, but will be involved in most of the precursory steps (the politics of a general 'Atomausstieg / nuclear power phase-out' aside for the moment)

[https://www.tuev-sued.de/plants-buildings-technical- faciliti...](https://www.tuev-sued.de/plants-buildings-technical- facilities/fields-of-engineering/nuclear-services/nuclear-power-plant- licensing)

</comment></comment></comment></comment><comment><USER26> Sounds like a great achievement! Congrats to the team!

So is this a completely separate implementation from Qt proper? Do they share some API and tooling?

</comment><comment><USER27> This does not really mean Qt (and/or QML) is certified. It means there is support in QtCreator for exporting certain graphics (tell tales) so that they can be rendered by Qt Safe Renderer and if that happens on a certified RTOS the system could be certified.

So the Qt libraries or QML renderer are still not certifiable.

<comment><USER18> Nor will they ever be, at least at that high level. The standards are very strict about what is allowed in the code and Qt is coded in a way that is fundamentally incompatible with that.

But that is okay. Isolating the core components that have the highest safety requirement and developing the rest to a lower standard is accepted and good practice. You also need to have an operating system that enforces the separation and a design that guarantees that the safety critical part cannot be disrupted by failures in the rest of the system.

For example, a fancy navigation map display is not safety critical at all and developing that to ASIL standards would be madness. Icon ovelays for engine or braking system failures are quite important, on the other hand. Separating then out into a different process and making sure that it cannot be affected by a misbehaving navigation system is just common sense. So even with the current limits, this is very useful.

<comment><USER27> Sure, I agree that you should limit ASIL certified software as much as possible. Nothing running on Linux will be certified ever.

That also limits the benefits of Qt Safe Renderer. I think it is mostly a marketing thing within the automotive sector. The competitors there (Disti, Kanzi, etc) have their "solutions" for safety critical and say Qt can't handle it. So Qt needs to check the box of "safety critical" to fend for themselves.

Tell tales can quite simply be implemented by hand coding. But there is OpenGL SC which possibly could support more fancy and certified graphics. It could be nice if Qt/QtCreator/Qt3dStudio supported that in some manner. Having a layer that is safety critical and separated out to it's own OpenGL SC code. The usual argument for this kind of stuff is that nice graphical ADAS features (think advances HUDs) will need this (although I think it is still reasonable to hand code it in OpenGL SC).

</comment></comment></comment><comment><USER28> Just to be clear, QT still has the same licensing, correct? dual:LGPL or commercial

commercial license costs + not redistributable (example, if included in a BSD or MIT library/framework/tool...)

or LGPL (also requires project to be LGPL)

just checking, as it's a factor in why Qt is not universal, but only ubiquitous, which is still a good thing, because "diversity" and not wanting to put the fate of all gui forever into the hands of one entity etc..

but: any other declarative (like qml) gui frameworks out there in Linux land?

<comment><USER29> Note that some modules are not available under the LGPL. You don't get charts, data visualisation or any of the embedded tooling.

LGPL does not require the project to be LGPL. It simply means that you must provide users means to link your program to a version of Qt that they've compiled, or you provide the source of the Qt distribution that you compiled to build your application. You can have a commercial, closed-source, application using LGPL Qt.

"A program that contains no derivative of any portion of the Library, but is designed to work with the Library by being compiled or linked with it, is called a "work that uses the Library". Such a work, in isolation, is not a derivative work of the Library, and therefore falls outside the scope of this License."

Contrary to popular belief you can even statically link an LGPL library and remain closed source, but you may need to distribute your object files so that someone can statically link a different library version with your code.

I'm not sure what happens if you modify Qt in some way though, presumably you're still covered if you release the modifications you made.

Full answer here: [http://answers.google.com/answers/threadview/id/439136.html](http://answers.google.com/answers/threadview/id/439136.html)

<comment><USER30> I'm pretty sure Chart, DataViz, etc are now available in the open source edition.

<comment><USER31> Yes, under GPLv3[1], though that may be unpleasant to people who wanted to use only LGPL-licensed Qt.

1: [https://doc.qt.io/qt-5/qtmodules.html#gpl-licensed- addons](https://doc.qt.io/qt-5/qtmodules.html#gpl-licensed-addons)</comment></comment></comment></comment>


The Twitter Rules - <AUTHOR> https://support.twitter.com/articles/18311 <comment><USER2> Twitter's enforcement of their rules is so arbitrary and selective I wonder why they even have them. Innocuous accounts get banned over banter, people get their "Verified" status stripped from them if they say the wrong thing (shouldn't it just mean "this person is who they say they are"?), and yet there are accounts with hundreds of thousands of followers that doxx people and tell their followers to harass them.

It's still a useful platform for now, but they seem to be trying their hardest to be anti-user.

<comment><USER3> It does _not_ simply mean "this person is who they say they are" and never has. Everybody knowledgeable about Twitter (including Twitter themselves) who makes this claim is gaslighting. Twitter's own documentation explains that the blue checkmark is reserved for accounts of "public interest". The checkmarks are displayed prominently in the avatar photo of accounts, rather than simply as an element of a user's profile.

Verified Twitter accounts are promoted Twitter accounts. Twitter does the blue checkmark thing as a perk to attract noteworthy people to their platform, and to draw the attention of ordinary users to those noteworthy people.

<comment><USER4> > It does not simply mean "this person is who they say they are" and never > has.

I was under the same impression that OP was, so I looked up the verified account announcement from the Twitter in 2009[1]:

"To prevent identity confusion, Twitter is experimenting (beta testing) with a 'Verified Account' feature. We're working to establish authenticity with people who deal with impersonation or identity confusion on a regular basis."

[1] [https://web.archive.org/web/20090615114316/http://twitter.co...](https://web.archive.org/web/20090615114316/http://twitter.com/help/verified)

<comment><USER5> Meanwhile when they opened up the application process for anyone to request verification, they made the implication that a verified account was a "high quality" account you might want to follow.

[https://www.prnewswire.com/news-releases/twitter- announces-a...](https://www.prnewswire.com/news-releases/twitter-announces- application-process-for-verified-accounts-300300831.html)

>We hope opening up this application process results in more people finding great, high-quality accounts to follow

This seems to be where the line started blurring between "this is who they say they are" and "this account is an asset to our platform."

<comment><USER4> Oh, without a doubt, it has morphed over time. It probably should be called something else now. But to say it was never about identity is false.

</comment></comment></comment></comment></comment><comment><USER6> > Accounts using unauthorized badges as part of their profile photos, header > photos, display names, [...]

Interesting. Of course there's no way to put an actual badge in your display name. But this sounds like it's targeted at Julian Assange, who ends his name with a blue diamond emoji that is reminiscent of a verified badge if you're not looking closely.

<comment><USER7> I hope they don't act on Assange's blue emoji. It's gloriously petulant (as is Twitter's refusal to verify the account, in fairness) and deserves to be preserved.

</comment></comment><comment><USER8> > We believe that everyone should have the power to create and share ideas and > information instantly, without barriers.

I can't wait for this to mean what it used to mean: owning a domain and putting up a website.

<comment><USER9> With registrars being as censorious as they've been lately?

<comment><USER10> How censorious have they been lately?

<comment><USER11> [https://en.wikipedia.org/wiki/The_Daily_Stormer#Site_hosting...](https://en.wikipedia.org/wiki/The_Daily_Stormer#Site_hosting_issues_after_the_2017_Unite_the_Right_rally)

<comment><USER10> So these 5 or 10 companies don't want to host this one website.

I guess "Not very censorious" or "Not enough data" is the answer.

<comment><USER11> It's not 5 or 10, every single domain provider have banned them so far. Still happening today.

</comment></comment></comment></comment></comment></comment><comment><USER12> Twitter's lawyers are probably out celebrating this weekend.

</comment><comment><USER13> Even though superficially they are cracking down on every conceivable way of abusing and harming others, including mere "wishing" for harm, I see _nothing_ about one of their user's favorite pastime: Attempting to cause _economic_ damage to a target, such as loss of customers or loss of job. It's an interesting omission.

</comment><comment><USER14> What a disaster. Comparing twitter of today to what it once was makes me sad.</comment>


Women Leading Math and Physics - <AUTHOR> http://abstractions.nautil.us/article/164/19-women-leading-math-and-physics <comment><USER2> I think the main criterion for selection for this article was perhaps ones that were covered previously by Quanta Magazine. For physics any such list that doesn't include the physicist Lisa Randall is not well-done. A few more that can be included in physics: Amy Mainzer and Alessandra Lanzara.

For math Maryam Mirzakhani (first woman Fields Medal winner in 2014) is included in the photos but not in the list.

<comment><USER3> Notable absence of Sophie Morel too, that's quite odd.

</comment></comment><comment><USER4> Marie Skłodowska-Curie is missing. And with all the shit she have been through (including opposition for her to have a PhD and then Nobel prize, and well a lot of things) she is still a leading woman in physics and chemistry and being a women fighting for women's rights.</comment>


Jeff Bezos Protests Privacy Invasion, as He Builds Surveillance State - <AUTHOR> https://theintercept.com/2019/02/08/jeff-bezos-protests-the-invasion-of-his-privacy-as-amazon-builds-a-sprawling-surveillance-state-for-everyone-else/ <comment><USER2> > But Bezos, given how much he works and profits to destroy the privacy of > everyone else (to say nothing of the labor abuses of his company), is about > the least sympathetic victim imaginable of privacy invasion.

That hits the nail on the head. It seems kind of like poetic justice (though I don't personally agree with anyone's privacy being violated).

From the Medium post by Jeff Bezos [1] linked in this article:

> "My stewardship of The Post and my support of its mission, which will remain > unswerving, is something I will be most proud of when I'm 90 and reviewing > my life, if I'm lucky enough to live that long, regardless of any > complexities it creates for me."

Seriously, how much of a cognitive dissonance and compartmentalization must one have to not see the ill effects of his ruthless actions when contemplating looking back on his life when he's 90 (or old enough)? Having one thing to be proud of and hundreds of other things to be ashamed of — is that a good sign of introspection?

[1]: [https://medium.com/@jeffreypbezos/no-thank-you-mr- pecker-146...](https://medium.com/@jeffreypbezos/no-thank-you-mr- pecker-146e3922310f)

</comment><comment><USER3> "Jeff Bezos Protests Privacy Invasion" seems a bit of a stretch, since I can't find him doing so anywhere on Medium or even in the linked article. He seems to be merely dealing with the fallout without commenting on the privacy issues.

<comment><USER4> He says he doesn't want his personal texts and photos published. He says he has retained an investigator to find out how these texts and photos were acquired in the first place. That looks and sounds like a protest of the privacy invasion to me.

<comment><USER5> In the context of blackmail

<comment><USER4> Of course. When else do privacy issues matter most?

<comment><USER5> All kinds of other ways - subtle manipulation, advertising, evaluation by power structures etc.

<comment><USER4> I didn't say the other problems with a lack of privacy don't matter. I asked when else does a lack of privacy matter most. It matters most when you receive a direct and immediate threat as a consequence of your lack of privacy.

Jeff Bezos is finding out the hard way what a lack of privacy means. If he had had actual privacy he wouldn't be in this position in the first place.

<comment><USER5> I think the other problems matter vastly more.

They are happening to all of us all the time, and are deeply corrosive to society.

Blackmail is comparatively rare, and may not actually be as harmful even to the individual who is the target.

Just because they are pervasive and so we learn to live with them, we should not underestimate how severely damaging they are.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> When will the media realize that Amazon didn't invent facial recognition software? It would be here regardless of Bezos.

<comment><USER7> This is a weird take. Does it extend to anything? Murder would be here regardless, so it's NBD if any particular individual murders? Fraud is going to be here regardless, so individual instances of fraud are NBD?

Why does it matter who invented something when the conversation is about building an empire around it?

Here's the article summary to ponder:

> _If Bezos were the political victim of surveillance state abuses, it would > be scandalous and dangerous. It would also be deeply ironic. That's because > Amazon, the company that has made Bezos the planet's richest human being, is > a critical partner for the U.S. Government in building an ever-more > invasive, militarized and sprawling surveillance state._

Which of that ruffles you?

<comment><USER6> It's disingenuous to compare a tool to an act. Would you blame Home Depot if someone bought a pipe there and used it to bludgeon someone to death?

<comment><USER8> If they marketed it as a bludgeoning tool.. Yes.

<comment><USER6> Neither pipes nor facial recognition software are marketed for criminal purposes. And neither amazon nor home depot invented them.

<comment><USER9> Now wait a minute. Serveillance technology is definitely sold as more than just tools for building a house. They are tools of war and authoritarianism. Sure you have your run of the mill equipment for securing your building. But then you have massive networks of Spyware to catalog an entire nation's activity embedded without notice into the products you use without your consent. Your politician will sell you it for homeland security but the companies that sell the tech to the government sell in the same way arms dealers do. A Tomohawk missile is also a tool. And if home depot was selling that, especially if they were selling it under the pretence of a 'self defence tool' you but your shiny behind I'd have a problem with it. Wouldn't you?

Now consider home depot and Amazon are both warehouse businesses. Only one of them is helping the US government extend its digital spy network and increase its cyberwar capabilities.

<comment><USER6> Surveillance is not unethical, it's not unique to Amazon, and it's not remotely new.

Cameras are surveillance technology. Are you outraged at every manufacturer of cameras? Cameras are directly marketed as security systems (aka "surveillance").

A person staring at a CCTV looking out for a specific person holding a photo has been around forever. Facial recognition makes them more efficient.

None of this is new. None of this is unique to Amazon. Making this about amazon is dishonest.</comment></comment></comment></comment></comment></comment></comment>


Ask HN: What are some best hacks to get first 1000 users for my new website? - <AUTHOR> <comment><USER2> I have this 100+ comment thread in my favorites [https://news.ycombinator.com/item?id=14191161](https://news.ycombinator.com/item?id=14191161)</comment>


Talk by LoveFilm's CEO Simon Calver - <AUTHOR> http://www.ucl.ac.uk/advances/training/entrepreneurshiplectures/videos/spring2012

<comment><AUTHOR> Incredible what they did after the fire, from nothing back to operations in 48h</comment>


Why Google Should Customize your Gmail Login Page to Prevent Phishing - <AUTHOR> http://ethanheilman.tumblr.com/post/31897384881/google-should-customize-gmail-login

<comment><USER2> There are several reasons not to do this:

1\. Unless Google can roll this out in a short timeframe to all their properties with 100% reliability, it's basically useless. If half of their login screens don't have it, there's no way for a consumer to tell the difference between a hacked site and a legitimate malfunction (such as a cleared cache, or fresh computer installation). Luckily, Google's web logins are already centralized, but people also log into Chrome, their Android devices, etc.

2\. You can never remove the customization. You better be sure you want to support custom images forever, because you are committing to a promise: your customers' login screens will look exactly the same from now on. The only way to migrate away from it is to bite the bullet and deal with a ton of people who think that their browser or Google has been hacked because it's missing their custom picture.

That's too much commitment to a stopgap measure for a password form that Google wants to obsolete anyways. They'd rather have you authenticate to your browser or via a device anyways, long term.

<comment><AUTHOR> 1\. Even if they roll it out to all their login pages fresh computers are still a problem (it is addressed in the article), but the current state of affairs is that "users can't tell the difference between a hacked site and a legitimate site". When this system fails it is just as bad as the current system, when it is setup it is significantly safer.

> You can never remove the customization. 2\. Google can just announce they > are moving away from the customized login page on their login page. The > customized login page is trusted so the new information is trusted.

The customization can be framed as an extra security measure that power users who want to protect themselves from phishing attacks can setup on their home computer. Similar to the way google rolled out two-factor authentication.

>They'd rather have you authenticate to your browser or via a device anyways, long term.

Long term this is right login screens will move off of the browser, but security must be concerned about the now. Note that phishing still presents a risk on mobile device login screens. As long as your security depends on something you know, phishing attacks will be relevant, and client-side identification of trust will still be relevant.

</comment></comment><comment><USER3> They already have all of this for GAFYD (Google Apps For Your Domain) users, which has a free version that I've been using for ~5 years:

<https://www.google.com/enterprise/apps/business/pricing.html>

You can set a custom image and apply some simple style tweaks to the sign-in box on the login page. Here's mine:

<http://i.imgur.com/xReSS.png>

<comment><USER4> FYI - You missed one occurrence of the domain.

<comment><USER3> shhh.. lol

</comment></comment></comment><comment><USER5> The time honored solution to this is not how you propose- Its called double- stepping and its annoying from a UI perspective.

Step 1: Enter your username and click "go"

Step 2: you are presented with a image you have chosen before- If the image matches, you enter your password and click continue

USBank.com does this, try it by typing in a random name, like cstevens - Notice how it doesnt accept a user + pass on the same screen

<comment><USER6> Double stepping is fundamentally weaker from a security perspective. The phisher can present you the username screen, use it to fetch your correct image from Google, and present the image to you.

This proposal is better in the sense that the correct image is cached locally and protected by the browser's local storage origin policy.

</comment></comment><comment><USER7> the easier answer is to leverage SSL authentication. There's no reason we should have to use passwords every time we login to a site. All sites have to do is generate a single device asymetric key pair and provide the one part to the client's browser (we'll call this private) and associate the other part ("public") to whatever account you care about.

Now, you still need some other element to authenticate the user when they visit a website from a new device/browser, but this would mean that you don't have long term cookies that serve the same role and are therefore more extractable over the wire (as we've seen in the past) and would negate these type of attacks.

Also, the tech exists in browsers today already, many SSL registrars already do it.

</comment><comment><USER8> "3. This is really the tricky part as an attacker can wipe browser cookies at will."

No need for an attacker, I do wipe them at will. Every time I close the browser.

</comment><comment><USER9> It's what Yahoo has been doing for a while. They call it "Sign-in seal" and it's basically a custom picture you select yourself.

</comment><comment><USER10> There have been studies showing that users don't notice the absence of cues like this.

<comment><USER11> Oooh, I'd love to have a link to that. Is this recent work?

</comment></comment><comment><USER12> Why? Their two factor authentication works just fine.

<comment><AUTHOR> Someone can just steal your two factor authentication token by asking for one at a forged login page.

<comment><USER12> It's not that easy. I use the "push" authentication model, aka Google sends me an SMS whenever I need to authenticate a _device_. I don't request it explicitly. The pairing is made between the authentication code, and that device. Now, if it happens that I'm stupid enough to enter my login details into a fake page, the interesting part would be the lack of SMS from the Google side, but I will get an SMS when somebody else would try the credentials. Tough break. Besides, this week's phishing attempt asked me my: name, Google account, password, recovery email address. They say that https is as secure as the user that's using it. Same goes for this stuff.

device = browser profile, aka for two browsers on the same machine you need two authentication tokens. Same goes for the same browser with two profiles.

</comment></comment></comment><comment><USER13> What about machines with multiple Gmail users? Counting on user data when the user is logged out seems like a major problem right off the bat. (But how is a hacker going to clear your cookies remotely?)</comment>