Meltdown and Spectre - <AUTHOR> https://spectreattack.com/ <comment><USER2> It's not everyday that a security issue is borne out of a side-effect of _underlying theory_ ; in this case, how out-of-order execution works. It's almost as bad as if someone proved P = NP, rendering all cryptography useless on the spot.

The game is changed forever, and CPU designers across the industry will likely have to can some or all of OoOE, setting performance back considerably. It can take years to reachieve performance we're used to today at the security level required.

<comment><USER3> How many years should we think back?

I have some old laptops at home and they work quite well with a proper Linux setup.

Should we think in terms of slowing everything down by some factor, or just slowing tasks that need an un-throttled CPU?

<comment><USER4> Qualifier: I'm working off articles and a few computer-architecture courses from college, so don't trust me too much here.

Taht said... Branch prediction and TLBs have been ubiquitous since about 1975. We're seeing vulnerabilities in ARM processors with unit costs of a tenth of a cent. We don't have to go _that_ far back; if nothing else our toolchains and manufacturing techniques are far better. But if we're forced to discard speculative execution as a _concept_ , which I think may be necessary to entirely prevent side channels, we'll be going way, way far back. Further back than the Pentium 4.

Fundamentally speaking, the power of out-of-order execution is not one of engineering. It's not like object-oriented programming or version control in that it simply makes it easier to engineer fast processors. It is more powerful on a fundamental level. And there's been so much theoretical and practical work put into it over the decades that it may take more decades to bring a different mathematical formalism up to the same level of development.

Let's just say that I _really hope_ we don't have to throw out out-of-order execution. It'd suck. Hard.

<comment><USER5> It's not so much out of order as it is the speculative execution. Predicting a branch and then trying to run the code after the jump while you wait on the branch itself to finish calculating. At least that's my understanding from the papers. This means that otherwise normal out of order techniques like memory load/store reordering and such aren't subject to these particular attacks. I hope that attacks on them aren't found either because those are some of the biggest gains because it can allow better cache coherence and avoid misses, or make the impact of one almost non-existent since it can do other instructions while waiting on a load from system memory.

<comment><USER6> My understanding is: Speculative executive is flawed, out of order makes it hard to tell when the errors are going to be really bad.

</comment></comment></comment></comment></comment><comment><USER7> Video demonstration of the Meltdown attack was just taken down: [https://www.youtube.com/watch?v=RbHbFkh6eeE](https://www.youtube.com/watch?v=RbHbFkh6eeE) due to "violating YouTube's policy on spam, deceptive practices, and scams."

<comment><USER8> Thanks for pointing that out. I've escalated internally to have the video restored.

Edit: the video has been restored.

<comment><USER9> "I've escalated internally" wow almost as cool as "I called the POTUS and the TSA thing is fixed now"!! Kudos and thanks

</comment></comment></comment><comment><USER10> Besides the LWN article _Notes from the Intelpocalypse_ [1] this is the best high level overview I've seen for now. Here is are a few quotes (emphasis mine):

 _Am I affected by the bug?_

Most certainly, yes.

 _Can I detect if someone has exploited Meltdown or Spectre against me?_

Probably not. The exploitation does not leave any traces in traditional log files.

 _What can be leaked?_

If your system is affected, our proof-of-concept exploit can read the memory content of your computer. This may include passwords and sensitive data stored on the system.

 _Which systems are affected by Meltdown?_

Desktop, Laptop, and Cloud computers may be affected by Meltdown. More technically, _every Intel processor which implements out-of-order execution is potentially affected_ , which is effectively every processor since 1995 (except Intel Itanium and Intel Atom before 2013). We successfully tested Meltdown on Intel processor generations released as early as 2011. _Currently, we have only verified Meltdown on Intel processors. At the moment, it is unclear whether ARM and AMD processors are also affected by Meltdown._

 _Which systems are affected by Spectre?_

Almost every system is affected by Spectre: Desktops, Laptops, Cloud Servers, as well as Smartphones. More specifically, _all modern processors capable of keeping many instructions in flight are potentially vulnerable_. In particular, _we have verified Spectre on Intel, AMD, and ARM processors_.

 _Which cloud providers are affected by Meltdown?_

Cloud providers which use Intel CPUs and Xen PV as virtualization without having patches applied. Furthermore, cloud providers without real hardware virtualization, relying on containers that share one kernel, such as Docker, LXC, or OpenVZ are affected.

 _Why is it called Meltdown?_

The bug basically melts security boundaries which are normally enforced by the hardware.

 _Why is it called Spectre?_

The name is based on the root cause, speculative execution. _As it is not easy to fix, it will haunt us for quite some time._

[1] [https://lwn.net/SubscriberLink/742702/e23889188fce9f7f/](https://lwn.net/SubscriberLink/742702/e23889188fce9f7f/)

<comment><USER11> I don't see user-mode linux, QEMU, or KVM on that list, or am I mistaken an they are affected as well(so maybe some amd users are safe?). Another reason I advocate every spinup should have FDE by default with a ssh key entry shimmy at initram, or is this runtime cpu acccess so it gets anything live? If so that's scary.

</comment></comment><comment><USER12> I understand this "isn't the point" etc - for curiosity sake: How practical are these exploits? From my reading, it seems using them in an attack against a sophisticated target is incredibly difficult, and against an unsophisticated target is still probably prohibitively difficult? I'm not an engineer so please pardon the ignorance.

<comment><USER13> A nice little gif from twitter: [https://twitter.com/misc0110/status/948706387491786752](https://twitter.com/misc0110/status/948706387491786752)

User typing into a "secure" Linux (edit: was MacOS - can we do strikethrough here?) password dialog while another process steals the data.

The _first_ attack was incredibly difficult, but once there's a proof of concept, copies will proliferate.

<comment><USER14> That's Gnome, not MacOS ;)

</comment></comment></comment><comment><USER15> Pleased to see a growing set of links at the bottom for the relevant information for different OSes, etc...

However, somewhat surprised that Ubuntu isn't present - done a fair bit of searching today and have only found that the patches are in progress, which I'm a bit surprised about given the disclosure timeline that appears to be in place, and that SuSE and Red Hat seem to have patches in place and ready to go?

* EDIT * - since posting this, there is now an Ubuntu link present, and an explanation that they were expecting disclosure on Jan 9th.

<comment><USER16> That is a little surprising. Definitely making me re-evaluate my choice of local Linux.

<comment><USER17> This was supposed to release on January 9th, but Google pulled the trigger earlier due to community members putting the pieces together and starting to draw press attention. It isn't very fair to blame Ubuntu for being behind.

<comment><USER16> It's not just that. I've been experimenting with different distros a lot this year (Fedora, Mint and Ubuntu for committed stretches) and Fedora is the only one where the machine didn't regularly hang for some reason after a few days. Was happening multiple times a day with Ubuntu and currently much less often with Mint. Never happened at all with Fedora though.

Between that at Redhats promptness on this it's just giving me more confidence in that side of the house.

</comment></comment></comment></comment><comment><USER18> Practical questions for ordinary users: as I understand it, a malicious actor could inject Javascript into a web site which could read all my computers memory. To read, for example, my bank credentials, would they have to be sitting in memory at the time the malicious code was executed? Could I mitigate this risk by, for example, quitting my browser and relaunching it after visiting my bank? Or will my unencrypted password still potentially be lingering somewhere in memory? Could vendors provide a "memory cleaner" that I could use between web site visits?

<comment><USER19> Typical allocator free() calls don't actually overwrite the memory, meaning that the data stays there until it happens to get overwritten by a future process, which is an unpredictable event. When I was doing research on the cold boot attacks I did a lot of "strings /dev/mem" and would notice stuff related to things I was working on several days ago. As our cold boot paper described, this could sometimes include things that you were doing even before the computer was last rebooted.

There is a really nice paper on this particular topic

[https://benpfaff.org/papers/shredding.html/index.html](https://benpfaff.org/papers/shredding.html/index.html)

which describes some useful countermeasures which haven't been widely implemented. If they had been, they could have somewhat reduced the impact of opportunistic exploitation of memory disclosure vulnerabilities.

</comment></comment><comment><USER20> Mostly OT, but is there an explanation for why the "Meltdown" vulnerability was named specifically as such, I mean besides the term's meaning when it comes to "melting" security barriers? Coincidentally, "meltdown" is currently a very popular term to describe reactions/revelations re: a soon-to-be- released politics book titled "Fire and Fury" [0]. I guess yet another example of "Naming things" being one of the hard problems.

[0] [https://www.publishersweekly.com/pw/by-topic/industry- news/p...](https://www.publishersweekly.com/pw/by-topic/industry- news/publisher-news/article/75734-pre-orders-for-wolff-s-trump-book-skyrocket- as-trump-has-twitter-meltdown.html)

<comment><USER21> [https://meltdownattack.com/](https://meltdownattack.com/)

> Why is it called Meltdown?

> The bug basically melts security boundaries which are normally enforced by > the hardware.

<comment><USER22> Not a bug according to Intel.

</comment></comment></comment><comment><USER23> I've been reading up a bit on these attacks and I was wondering if there are any particular requirements to implement them in an arbitrary language?

For example, can you implement the attack with Java but without JNI? i.e. are syscalls required to be able to leverage the exploit?

</comment><comment><USER24> Would cable modems or wireless routers be vulnerable? My router's specification page does not list what CPU it uses. Haven't checked on my modem yet.

<comment><USER25> Everything is vulnerable to Spectre.

<comment><USER26> Not everything. In-order CPUs such as Cortex-A7 and Cortex-A53 are not affected. Confirmed by Arm at [https://developer.arm.com/support/security- update](https://developer.arm.com/support/security-update) "all other Arm cores are NOT affected"

<comment><USER25> Doesn't Spectre just require speculative fetching? In which case in order is not sufficient as to guarantee immunity.

It's Meltdown that relies on out of order execution.

[https://meltdownattack.com/meltdown.pdf](https://meltdownattack.com/meltdown.pdf)

[https://spectreattack.com/spectre.pdf](https://spectreattack.com/spectre.pdf)

</comment></comment></comment></comment><comment><USER27> From the Ubuntu wiki, it's clear that someone broke the coordinated release date of January 9th. Does any one have more insights on why the news broke to soon?

[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAn...](https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown)

<comment><USER28> From what I recall, patches started showing up in the Linux Kernel, causing lots of buzz and speculation among the security community.

People noticed that one patch was only being applied to Intel processors, leading some tech blogs to speculate that only Intel processors were affected by the bug, and that triggered a PR response from Intel. Then someone reverse- engineered an exploit and posted about it on Twitter, and the cat was out of the bag at that point, so they moved up the disclosure timeline.

<comment><USER29> And it's a good thing they did that because a motivated black hat with the correct skill set most likely did, too. Not to mention nation state cyber ops.

</comment></comment></comment><comment><USER30> [https://meltdownattack.com/meltdown.pdf](https://meltdownattack.com/meltdown.pdf) [https://eprint.iacr.org/2013/448.pdf](https://eprint.iacr.org/2013/448.pdf)

TLDR: Userland process' read access to Ring 0 memory will throw an exception (n.b.: kernel mode memory is actually mapped into process' address space), but before that the instruction reading the memory is actually executed and data are cached. The process can use value of data as an address in userland for another read instruction. Now the process just needs to check range of possible addresses where the data was read from and see how long it takes (using rdtsc) to access them - if it's quick, then we have a match.

Is that correct, or am I missing something? e: write changed to 2nd read

</comment><comment><USER31> How does this affect the end-user security of the apps we use every day, like Gmail, Twitter, GitHub, Stripe, etc.?

<comment><USER32> All your passwords, are belong to the Internet

</comment></comment><comment><USER33> So far the possibility of JavaScript attacks looks the biggest concern for the normal users. (Assuming that you don't install any software from fishy sources, of course). And cloud service and virtualization service providers are under the biggest threat.

</comment><comment><USER34> If I understand it correctly (not entirely sure), an adversary needs to have code running on a system to exploit either attack - would Javascript running in a browser be in principle sufficient to be able to exploit this, or are there some mitigations (sandboxes?) in place to prevent this from happening?

Edit: Okay, found this post from yesterday: [https://blog.mozilla.org/security/2018/01/03/mitigations- lan...](https://blog.mozilla.org/security/2018/01/03/mitigations-landing-new- class-timing-attack/)

Thanks for the reply!

<comment><USER35> Yes javascript is sufficient.

I think Spectre is theoretically possible with just untrusted _data_ (not just untrusted code).

It would need an existing trusted program that has a branch-predicting loop like the one in the paper. The attacker would feed untrusted data into the loop and then observe secrets through cache timing.

It's weird code, so it's probably unlikely an existing program would have it, but it's not outside the realm of possibility. The attacker would also need a high-precision way to measure the timing of the operation, which also might be hard to find in an existing program, but not impossible.

Just something else to keep you awake at night!

<comment><USER36> They need code execution to observe that cache timing, though, and they need to prime the branch predictor and cache.

<comment><USER35> I think the branch predictor can be primed with well-crafted data? (start off with a long series of 0s for X)

For the other aspects like getting the cache timing, that does seem harder. I don't really know if it's feasible in practice.

</comment></comment></comment></comment><comment><USER37> The paper on this site is well written explaining the method of using ROP with branch mispredict to load gadgets. Anybody interested in this, ROP, caches and branch prediction/misprediction is all in the intro [1]book[2]course CSApp

[1][http://csapp.cs.cmu.edu/3e/labs.html](http://csapp.cs.cmu.edu/3e/labs.html) [2][http://www.cs.cmu.edu/~213/schedule.html](http://www.cs.cmu.edu/~213/schedule.html) (Youtube lectures)

</comment><comment><USER38> Just want to share an technical article about meltdown with things that isn't covered in the white paper. [https://www.moesif.com/blog/technical/cpu- arch/What-Is-The-A...](https://www.moesif.com/blog/technical/cpu-arch/What-Is- The-Actual-Vulnerability-Behind-Meltdown/)

</comment><comment><USER39> Would a microcode update be possible to fix this? I assume not and that it's fundamental to the speculative execution architecture, but haven't yet seen anything that explicitly addresses the question. Presumably _if_ it is possible then it would reduce any longer term financial consequences for Intel of the problem.

</comment><comment><USER40> Skimming the flush+reload paper I see how timing alone is enough to get e.g. a private key if the underlying algorithms are known and prone to revealing what they're working on.

Meltdown however seems to be able to arbitrarily read memory (at about ~500 kB/s).

How does this work that it can read from the cache?

</comment><comment><USER41> Are the chips used by Intel Management Engines subject to these attacks as well?

<comment><USER42> Yes, but the two have nothing to do with each other.

</comment></comment><comment><USER43> Does anyone know the amount of dollars involved in the bounty paid by Intel?

</comment><comment><USER44> Marked as dupe? Seriously?

</comment><comment><USER45> Other domain used to publish the same info: [https://meltdownattack.com](https://meltdownattack.com)

</comment><comment><USER46> How would one exploit a Google Cloud physical machine for example? One would still need to inject/patch a file to exploit processor right?

<comment><USER47> Meltdown doesn't _directly_ allow modification of code. However, a guest VM could run userspace code that accesses ring 0 / kernel memory of the hypervisor / physical machine.

This would mean that security certificates, passwords, etc of the hypervisor could be exposed, which could then allow compromise.

<comment><USER48> I would also assume this means exploits on a machine provisioned with multiple VMs from different customers would allow a malicious customer to leak data from another customer's VM located on the same machine.

</comment></comment></comment><comment><USER49> Well, I'm feeling mighty good about my purchase of a 2011 intel Atom chip back in the day... Now if only I knew which box it's in...

<comment><USER50> I wouldn't count on that to be enough. The Atom still speculatively issues and begins execution on instructions past branches and a quick glance at the pipeline[1] makes me think it can start on loads before the branch resolves, the same way an ARM A8 can despite both being in order.

[1][https://www.anandtech.com/show/2493/11](https://www.anandtech.com/show/2493/11)

</comment></comment><comment><USER51> Admins: why did you take this down? The previous submission didn't get any attention and this had some good discussion.

</comment><comment><USER52> Which one did OSX partially protect against? Also, which one allows JS execution to activate the attack?

<comment><USER35> I don't know what the OSX protection was, but that's probably Meltdown. Meltdown = using native code to read kernel/system memory.

Spectre is the one that can be done with JS.

</comment></comment><comment><USER53> The youtube video says:

"This video has been removed for violating YouTube's policy on spam, deceptive practices, and scams."

LOL!</comment>


Bubble 2.0: The Video - <AUTHOR> http://www.techcrunch.com/2007/12/04/bubble-20-the-video/ <comment><USER2> That was funny and well done.</comment>


Illegal streams, decrypting m3u8's, and building a better stream experience - <AUTHOR> https://blog.jonlu.ca/posts/illegal-streams <comment><USER2> Super interesting, and for some, incredibly useful. But I do wonder why you seem married to chrome as a browser when others seem more suitable for this task? Familiarity? Compatibility with streams?</comment>


Ask HN: Alternatives to GMail? - <AUTHOR>

I've gotten fed up with the UI changes that been made to (inflicted on) gmail in the last two years or so; new compose is the last straw. What are some good alternatives?  SSL, non-"flat" UI and a good thread/conversation view are my only musts, skins/themes are a nice-to-have. <comment><USER2> I can recommend [https://fastmail.fm/](https://fastmail.fm/) which has been a really solid experience for me over the last few months. The UI is quite nice—see Mike Masnick's write-up for some screenshots.[^1]

Their servers are located in the US, tho, which might be a cause of concern for some—but that wasn't part of the question. (Personally, I will be probably moving my mails off of FM for that particular reason.)

[^1]: [http://www.maxmasnick.com/2013/07/19/fastmail/](http://www.maxmasnick.com/2013/07/19/fastmail/)

<comment> workhere-io Here's another review of FastMail (shameless plug): [http://blog.workhere.io/my-experience-with-fastmail-as-a- gma...](http://blog.workhere.io/my-experience-with-fastmail-as-a-gmail- replacement/)

</comment></comment><comment><USER3> I'm fortunate enough to have the resources to run my own email server. I host a few VMs on a dedicated server and had some space left for a Zimbra 8 installation.

I hate to promote pay-for's, but their Open Source Edition is still very flushed out.

If that's any interest to you, I'd be happy to host a few accounts. Canadian servers so standard CIRA and Canadian Privacy Protection Act rules apply.

</comment><comment> workhere-io Domains at [https://gandi.net](https://gandi.net) include IMAP (1 GB). Combine that with Thunderbird or Sparrow and you're good to go. Another option is FastMail.

</comment><comment><USER4> IMAP. Or search for previous Ask HNs, there are dozen on the topic.

<comment><USER2> > SSL, non-"flat" UI and a good thread/conversation view are my only musts

Your answer "IMAP" doesn't _entirely_ fit here.

<comment> workhere-io IMAP + Thunderbird fits his requirements, as far as I can see (although I'm not sure what he means by non-"flat" UI).</comment></comment></comment>


High school student hacked into Apple servers, downloaded 90GB of secure files - <AUTHOR> https://9to5mac.com/2018/08/16/melbourne-apple-hack/ <comment><USER2> The headline sort of negates the "secure" adjective.

</comment><comment><USER3> > Apple's systems logged the serial numbers of the MacBooks used to carry out > the attacks

Does this most likely refer to the hardware IDs use to sign into FaceTime / iMessage?</comment>


PrimeSense bought by Apple for $345M - <AUTHOR> http://www.geektime.com/2013/11/17/a-sensible-exit-primesense-bought-by-apple-for-345m/ <comment><USER2> This is likely a soft landing. Microsoft is actively developing their own time-of-flight depth camera in-house rather than using Primesense's "projected computed stereo" solution. Primesense probably saw the writing on the wall...

I like disassembling depth cameras and laser rangefinders. We used the sensors extensively in robotics, back when the only ToF option was the $10k Swiss Ranger SR4000. You can find some of my writings on my robotics website:

[http://www.hizook.com/blog/2010/03/28/low-cost-depth- cameras...](http://www.hizook.com/blog/2010/03/28/low-cost-depth-cameras-aka- ranging-cameras-or-rgb-d-cameras-emerge-2010)

[http://www.hizook.com/blog/2010/06/20/low-cost-depth- camera-...](http://www.hizook.com/blog/2010/06/20/low-cost-depth-camera- update-microsoft-kinect-november-others-follow-shortly)

[http://www.hizook.com/blog/2009/01/04/velodyne- hdl-64e-laser...](http://www.hizook.com/blog/2009/01/04/velodyne- hdl-64e-laser-rangefinder-lidar-pseudo-disassembled)

<comment><USER3> Can you recommend a low cost depth camera for robotics?

<comment><USER2> If you're indoors, any of the Primesense devices are best (Kinect or Asus Xtion). If you're outdoors, you can't really rely on the Kinect -- the projected IR light patterns get drowned out by the sun. Then you have to go a time-of-flight solution: the Swiss Ranger SR4000 (expensive!) or the PMD Technologies sensor (I've heard they're available for a couple $hundred now). Kinect2 is supposed to be time-of-flight when it is released too.

</comment></comment></comment><comment><USER4> A small note to the HN moderators: the previously submitted title of this article mentioned Kinect by name, and I clicked through. If I had seen just the new title, "PrimeSense bought by Apple for $345M", I would have no idea what it was and moved on. I'm sure the new title is more succinct/accurate, but the old title was more helpful.

<comment><USER5> +1 especially given the fact the OP here is the Author as well.

</comment></comment><comment><USER6> This might be the last chance to get a developer unit [1]. Depends what Apple intends to do with the technology, I guess, but they usually seem to keep technologies for themselves. FingerWorks stopped selling immediately when Apple acquired them [2].

[1] [http://www.primesense.com/developers/get-your- sensor/](http://www.primesense.com/developers/get-your-sensor/)

[2] [https://en.wikipedia.org/wiki/Fingerworks](https://en.wikipedia.org/wiki/Fingerworks)

</comment><comment><USER7> There goes the industry. PrimeSense was, to my knowledge, the only company selling affordable room-range 3D sensors to independent developers.

There are countless unexplored avenues for 3D sensing technology, far beyond gimmicky gestural controls. My own application, as a high-accuracy presence detector for home automation, reached the front page of HN a few years ago ([https://news.ycombinator.com/item?id=2303395](https://news.ycombinator.com/item?id=2303395)). Others were using these sensors for DIY robotics applications, telemedicine, etc.

Now we'll probably have to wait another 20 years for another round of patents to expire before we "little guys" get another shot at depth sensing.

Good luck to PrimeSense, they probably deserve the exit, but bad news for the rest of us.

<comment><USER8> You're being too pessimistic. Depth sensing is not that complicated. Even vanilla stereo vision has gotten really good in the last few years and will only get better.

<comment><USER9> Can you explain to me how Depth Sensing works at a high level?

<comment><USER7> Some useful starting points:

[https://en.wikipedia.org/wiki/Time-of- flight_camera](https://en.wikipedia.org/wiki/Time-of-flight_camera)

[https://en.wikipedia.org/wiki/Structured- light_3D_scanner](https://en.wikipedia.org/wiki/Structured-light_3D_scanner)

[https://en.wikipedia.org/wiki/Range_imaging](https://en.wikipedia.org/wiki/Range_imaging)

</comment></comment></comment></comment><comment><USER10> This purchase certainly makes one wonder what Apple is up to. Kinnect has been, for the most part, a party-game interface, and that's not really in Apple's bailiwick. Capri is not really small enough or appropriate for phones, since you tend to gesture _with_ your phone rather than _at_ it. It is small enough that it could be included in laptops and tablets though. There are obvious gimmicks Apple is likely to go for, like gesturing at your laptop to make it unlock or summoning Siri with a dance move. It might also be a decent couch-interface for Apple TV, if Apple hasn't completely given up on that yet.

Here's hoping Apple has something interesting under wraps to put Primesense to work on and isn't just filling up their patent war-chest.

<comment><USER11> > you tend to gesture with your phone rather than at it

Samsung at least have been _trying_ to change that: [http://www.samsung.com/us/support/howtoguide/N0000003/10141/...](http://www.samsung.com/us/support/howtoguide/N0000003/10141/120552)

Not that I've ever seen anyone do it.

<comment><USER12> Samsung never been succeeded anything else than copying something.

<comment><USER13> If you copy something, and the copy is _better_ than the original in some way, is the copy still a copy?

When do you get to call it innovation?

<comment><USER12> Did you buy the Galaxy Camera? That was the real first product that they can say something _original_. Unfortunately, nobody supported them. How about Galaxy Watch? It was the second, and also nobody helped.

Have you checked out Bada SDK? Have you used KIES manager?

Or, what's your point? Are you telling me that they really have something _better_? So they're not a copy?

In which way? Do you mean the _Android_ which comes from Google? Because Android is just an assembly? Are you talking about [AMOLED]([http://m.youtube.com/watch?v=z8I5oMxbO9Q&desktop_uri=%2Fwatc...](http://m.youtube.com/watch?v=z8I5oMxbO9Q&desktop_uri=%2Fwatch%3Fv%3Dz8I5oMxbO9Q)). Or are you talking about TouchWiz widgets? Which looks so similar to iOS, even Google warned them to stop copying. Or Wacom tablet in Galaxy Note series? I know some people want it for Wacom tablet. Is it also Samsung's innovation just like Android which is also a Samsung's innovation?

It's irony that the word "Android" is actually a legally registered exclusive trademark owned by Samsung in Korea. Any other companies can't sell a phone named "Android" in Korea. So maybe you're right. That's very innovative strategy. But personally, I don't think _real innovators_ won't do such crap.

Please tell me only one thing they really made _better_ rather than copying other one. Not just larger and more. Because you won't call adding one more wheel to a Toyota truck as an innovation.

I am not talking they're not trying. They sometimes try, and any trial for original product horribly fails. Isn't it true?

They really suck at original or innovation. But for copying? Oh they're supernatural. They're doing it over decades, and even has been supported from government for that.

It's simply because _you can 't derive originality or innovation by copying others._ If you ever have tried to make something new, or better, you should know that you must break existing one first. Copied but better? That's impossible doesn't make sense at all.

<comment><USER14> I didn't know that Google let Samsung register Android as a trademark in South Korea, that's pretty strange.

<comment><USER12> There's a story. Here're details.

An unknown Korean company registered the word "안드로이드" which is the Korean representation of "Android" as exclusive trademark in Korea, and Samsung negotiated with them and bought (or leased) fully exclusive right for the trademark from them. So other companies can't use the Korean word in their product in Korean market.

Google also registered trademark of the Korean representation for that but only in limited fields, (computing hardware/software), so there was no problem to register the trademark for any another fields (mobile phones, advertising, games communications, internet service, radio, TV …).

</comment></comment></comment></comment></comment></comment></comment><comment><USER15> I'm really surprised Microsoft hasn't bought the company yet already. Kinect is the key differentiator for the Xbox versus the Playstation, and it can't be a positive thing for Microsoft's supply chain for a key manufacturer to be bought up by Apple.

<comment><USER16> Microsoft doesn't use PrimeSense for the XBox one. It's all in-house now. Should have negligible effect on the supply chain.

<comment><USER17> Presumably Microsoft has a perpetual license to PrimeSense's IP? Or does someone else entirely own that?

<comment><USER18> They bought another company in the field(3dv systems), which used a totally different physical principles(instead of dual cameras, using time of flight of photons) in their tech.

<comment><USER19> Canesta. I looked into their stuff before the Kinect came out. I am no expert in the field, but I thought their time-of-flight sensor is really clever. Basically, the speed of light is too fast to get an accurate ToF measurement within living-room distances using timers. So they use a technique where the intensity of the reflected IR is directly proportional to the ToF. Since you can measure intensity with much more accuracy and precision (and ease) than the time taken for light to travel a few meters, you get a pretty accurate 3D point cloud of the space being sensed. I can't find their white paper that explains this, but it's a good read.

<comment><USER20> That's interesting...was it an effect based on attenuation of the light? i.e. reflected photons from close objects will attenuate less than ones further away therefore intensity will be higher?

<comment><USER19> Something along those lines, but they also did something clever with the timing of emitting IR flashes and correlating the received number of photons with those flashes. I really wish I could recall more clearly, but I looked into it around 2007 - 2008. I tried finding the white paper, but all the links are dead :-( I might have a copy lying around, though... I'll try to dig that up.

<comment><USER20> Don't sweat it, I just think that if that's the method, it's a really cool hack.

<comment><USER19> Eureka! Found it on scribd:

[http://www.scribd.com/doc/40735369/Can- Esta-101](http://www.scribd.com/doc/40735369/Can-Esta-101)

<comment><USER17> Thanks for the link :) Do you happen to know how to download the pdf off scribd? It looks like you need to _pay_ scribd to do it (or to read past the first few pages), which doesn't quite seem fair since I'm assuming they don't have a license to the content themselves, in which case it'd be someone else's copyrighted content they're profiting off...

<comment><USER21> Can't get it off scribd, but thanks to the magic of archive.org (seriously! amazing stuff), the entire pre-purchase canesta website is still up. Just look prior to mid 2010 or so. Here's the exact pdf in question:

[https://web.archive.org/web/20091122234143/http://www.canest...](https://web.archive.org/web/20091122234143/http://www.canesta.com/assets/pdf/technicalpapers/Canesta101.pdf)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> IMHO, gesture navigation suck. It's much more expensive for your body to move your arm+hands around compared to one single click of a finger.

If you are playing a game, it's fine, you want to move around depending on the game style. But once you're looking for relaxing activities, like flipping over channels, is stressful.

<comment><USER23> > It's much more expensive for your body to move your arm+hands around > compared to one single click of a finger.

It's less expensive than hunting around for the remote in the couch cushions for five minutes.

</comment></comment><comment><USER17> Regarding the headline, "A sensible exit: PrimeSense bought by Apple for $345M", does anyone have any opinion on the price here? It seems reasonable, but really just serves to highlight just how _absurd_ the Snapchat offer was earlier this week (in my opinion).

<comment><USER24> If you still have a problem with snapchat you don't understand human behavior, startup dynamics, advertising and large audiences.

<comment><USER17> This is entirely true. I don't understand Snapchat's valuation in the slightest, which is why I mentioned it here in comparison to this acquisition. I'm yet to see how large audiences and advertising revenue are an answer to anything; see MySpace and Zynga, both of which fulfill(ed) those criteria. Snapchat seems like an easy service to clone in theory relative to, say, a YouTube or a Twitter-certainly Facebook could do it-so what are they bringing to the table exactly? Where does their value come from? A bit off topic here anyway. I just thought it was a nice comparison.

<comment><USER25> MySpace and Zynga are tiny compared to SnapChat.

</comment></comment></comment></comment><comment><USER26> This is disappointing (or encouraging, if you're an Apple competitor). Primesense is inferior technology. Kinect 1 (Primesense) uses structured light scanning, while Kinect 2 (not Primesense) uses far superior "time of flight" measurement.

<comment><USER24> And Leap Motion is way better than both.

<comment><USER27> Depends on the use case. Leap is not very versatile.

</comment></comment></comment><comment><USER27> Looks like Microsoft got the better deal here with a better camera and lower acquisition price.

[http://venturebeat.com/2009/02/21/sources-confirm- microsoft-...](http://venturebeat.com/2009/02/21/sources-confirm-microsoft-is- buying-3dv-systems/)

</comment><comment><USER28> If Apple did indeed acquire Primesense, there certainly is good possibility that they will keep the hardware and software for themselves and stop licensing it out to other companies.

I wonder if this spells doom for the following products: ASUS Xtion [http://event.asus.com/wavi/product/xtion.aspx](http://event.asus.com/wavi/product/xtion.aspx)

Structure Sensor [http://www.kickstarter.com/projects/occipital/structure- sens...](http://www.kickstarter.com/projects/occipital/structure-sensor- capture-the-world-in-3d)

</comment><comment><USER29> This is probably bad news for leap motion who was surely hoping apple would acquire them. Maybe google will acquire leap?

<comment><USER24> Appple rarely pays full price and the non-apple opportunity is far larger. I'd say Leap remains in an even better position.

</comment></comment><comment><USER30> Didn't they already try to sell their tech to Apple before they went to MS, but got turned down?

</comment><comment><USER31> I've worked for a number of years on the motion processing sensor side. The Apple acquisition makes sense, as it helps to add another input device for what I suspect will be an Apple TV. For the most part, everyone has hands and arms. To enable your hands to control what's showing on the screen seems in theory to be quite practical.

On the flip side, playing games is one thing.... controlling your TV is a different story altogether. I'm not sure how great an experience it will be. Samsung already has gesture controls on some of their camera-equipped TVS. The experience of waving your hands around for control can actually get a bit tiring.

It will be interesting to find out how Apple plans to integrate this technology into their devices.

</comment><comment><USER5> Here are some facts:

        $85M investments so far.
        3 years ago, the company refuses $400M offer from Microsoft (rumour) - saying:
            "we are here for the long run".
        It Powering XBox Kinect, Dumped at XBox One.

Don't ask me for citations, as this is a Israeli company, and the sources are mainly Hebrew tech-news sites.

Also amongst "Most Innovative Companies (2011)" [1]

[1] [http://www2.technologyreview.com/tr50/2011/](http://www2.technologyreview.com/tr50/2011/)

</comment><comment><USER32> I don't think this has anything to do with Apple TV or gestures on tablets. IMO, those are gimmicky applications of the technology that look cool but aren't practical on a daily basis. My guess is that Apple is making an augmented reality play, hedging that Google Glass will be successful and they'll have to compete with them. Infrared motion tracking has a lot greater potential to be successful in augmented reality versus the single camera setup Glass uses.

</comment><comment><USER33> This makes a lot of sense especially if Apple wants to move Apple TV on. Lots of TV manufacturers like Samsung has gesture navigation implemented already.

This should be exciting.

<comment><USER34> For all intended purposes, this one is defintly meant for the AppleTV (or iTV). PrimeSense's tech is still years away from being able to put inside a smartphone (allthough tablets are another option which is more possible in the medium-term future).

</comment></comment><comment><USER35> This is a huge win for Apple! I expect to eventually see this in product categories they don't even offer yet, like smart home products. Not to mention the obvious, that they could add gesture support to the AppleTV.

</comment><comment><USER36> I speculate this is a reaction to Google's recent acquisition of Flutter.</comment>


Top 100 Startups Disrupting Cloud and SaaS - <AUTHOR> http://blog.rightsignature.com/2012/03/rightsignature-named-to-ondemand-top.html

<comment><USER2> Great company with the greatest product since sliced bread.

-PL</comment>


How the sugar industry shaped key government research about your teeth - <AUTHOR> http://www.washingtonpost.com/blogs/wonkblog/wp/2015/03/11/the-sneaky-way-the-sugar-industry-shaped-government-funded-dental-research <comment><USER2> Has anyone here closely investigated the research that led to recommendations to brush teeth after every meal or at least two times a day, as e.g. suggested on toothpaste containers, and to floss frequently, etc.? Any idea how well designed / how complete the relevant studies were? Have there been more recent improved studies? In the last few years I've heard second-hand some alternative recommendations to brush before meals rather than after, but I haven't ever done my own research review.

I've long suspected that a good diet + brushing the teeth very carefully a few times per week would be more effective than drinking soda and sweet and starchy foods + brushing after every meal, just based anecdotally on how my own teeth feel to my tongue depending on my diet and toothbrushing frequency.

<comment><USER3> I feel the same way. A few years ago I became convinced that any well known brand name toothpaste was doing more damage to my teeth than help. I switched to using clay based tooth pastes as well as some other powders, and sometimes Ill take some tea spoons of cod liver oil. I grew up with cavities every visit and now it seems like going to the dentist is pointless. They tell me my teeth look great and I must be brushing and stuff, but really I just don't eat much sugar and brush my teeth with toothpaste that is edible, floss occasionally. I think dropping the listerine was the hardest part and also the most helpful. But ultimately it just makes sense in my own mind to brush with a paste that won't poison me if consumed.

<comment><USER4> I stopped eating all sugar for 3 years (all carbs actually).

My dentist loved me. My dental visits consisted of me walking in, getting briefly looked at, the dental hygienist doing a quick go over my teeth, complementing me on how clean they are, and sending me on my way.

When I want back to eating sugar, my dental visits suddenly got a lot longer. The cleaning of plaque alone is now at least twice as long.

<comment><USER5> Why did you go back to eating sugar?

Dropping the low carb thing I can understand. I do low carb paleo on and off as my fiscal and lifestyle circumstances dictate... but I keep my sugar intake low regardless.

</comment></comment></comment></comment><comment><USER6> Listening excessively to one lobby group is as hazardous as eating excessively exactly one staple - be it sugar or wheat. Moderation is important, both in politics and nutrition.

<comment><USER7> In general, not so simple.

The industry shapes the culture, but worse, the law and the market.

Very typical example is the corn lobby group, whose result on the market is to cause junk food to be much cheaper than nutritious food, thanks to perverse subsidization. In turn this makes much more difficult for a relatively large part of the population to eat correctly - practically difficult.

<comment><USER8> This is one of the more bizarre artifacts of our system. And it took the concentrated efforts of almost everyone involved to make it this way.

But _in a way_ , cheaper is always better. Nutritious food is also cheap, relatively, unless the "nutritiousness" of it is also a price differentiator. Frozen veggies are pretty easy to get, IMO - but it seems there usually has to be a largish supermarket to buy them in. And that implies a finance model, which implies a governance structure, which in the end means more dependence in suppliers being "standard". Junk food makers probably can spend more bandwidth on being "standard" and less on "quality".

If I had to describe Whole Foods model I would say that it intentionally "violates" this tendency.

I have never been to a Trader Joes, and I usually use a mix of WalMart and the dominant local chain - Publix when I lived in Florida. Whole Foods is kinda creepy to me to shop in. I can't say exactly why.

<comment><USER9> _Whole Foods is kinda creepy to me to shop in. I can 't say exactly why._

Namaste: [http://www.huffingtonpost.com/kelly-maclean/surviving- whole-...](http://www.huffingtonpost.com/kelly-maclean/surviving-whole- foods_b_3895583.html)

<comment><USER10> For me, it's the paradoxical idea that not only do some dirty hippies have enough money to shop there, but also that there are enough of them to actually keep the company in business. Nationwide.

</comment></comment></comment></comment></comment><comment><USER11> Sort of reminds me of Huxley's "Brave New World" when they traumatized the young children to recoil at nature so that when they grow up they never want to take trips out to the country, and so that they would spend all of their money on expensive sports equipment for recreation instead.

<comment><USER12> yes, we are already there. And instead of reading books like that one, we entertain ourselves with tv series.

<comment><USER13> Not me, I watch the travel channel so I can see the beautiful outdoors. Oh...

</comment></comment></comment><comment><USER14> A similar thing happened with the red meat industry.

From the first food pyramid evidence was already showing intake should be minimized, but the lobby fought back, and the pyramid was changed.

You will notice that the current food plate still carefully avoids saying anything at all about red meat: [http://www.choosemyplate.gov/food- groups/protein-foods.html](http://www.choosemyplate.gov/food-groups/protein- foods.html)

Compare & contrast against the evidence-supported [http://www.hsph.harvard.edu/nutritionsource/healthy- eating-p...](http://www.hsph.harvard.edu/nutritionsource/healthy-eating- plate/)

<comment><USER15> You implicitly assume that the research that shows red meat is bad for you is correct.

<comment><USER16> Interesting research in this direction is making progress, helping to explain WHY red meat may be dangerous:

[http://www.sciencedaily.com/releases/2014/12/141229152226.ht...](http://www.sciencedaily.com/releases/2014/12/141229152226.htm)

<comment><USER15> Sure, it may be dangerous. Here's the thing- I've been around for a while and read a lot of stuff in the mainstream media about which combinations of foods will kill you and which will make you immortal. As these have changed over the years and as I have failed to see convincing evidence in the medical literature I have concluded that people have a strong urge to believe that doing something mildly unpleasant (not eating something delicious) now can somehow prevent much worse things in the future. Its the same mechanism and magical thinking that inspired our ancestors to sacrifice goats to appease the gods and assure a great harvest. Wrapping the explanation in scientific jargon is just the latest iteration of a priest in shiny robes.</comment></comment></comment></comment>


Ask HN: What's the best android tutorial you know of? - <AUTHOR>

Preferably video. <comment><USER2> Team Treehouse is what I used. It may be a little slow if you have java experience, but it's very thorough. I went from knowing nothing about java/android to building a useful, simple app integrated with an external api within a week. They recently updated the whole course for material design, android studio,and lollipop.

</comment><comment><USER3> A part from video i think [http://www.vogella.com/tutorials/android.html](http://www.vogella.com/tutorials/android.html) is best on www Even my college teachers use to take help from these tutorials

<comment><AUTHOR> Found it Today too and started following it. Thanks for the link.

</comment></comment><comment><USER4> Google teaches a course on Udacity on how to build Android Applications. I learnt from there.

[https://www.udacity.com/course/ud853](https://www.udacity.com/course/ud853)

<comment><AUTHOR> Looks good, never heard about this one. How long did it take you to master android programming?. I'm at the beginning and struggling.

<comment><USER4> It takes time. Perhaps two months to understand all the build systems properly.

</comment></comment></comment><comment><USER5> I liked the Coursera course a lot:

[https://class.coursera.org/android-002](https://class.coursera.org/android-002)</comment>


Former top official says Fed should 'Maybe' create 'FedCoin' to rival Bitcoin - <AUTHOR> https://www.nytimes.com/2018/05/04/upshot/should-the-fed-create-fedcoin-to-rival-bitcoin-a-former-top-official-says-maybe.html <comment><USER2> What is a "blockchain"?

To me, a blockchain is a way of solving double-spend problems in a Merkle tree maintained by open distributed consensus, by using some scheme to resist Sybil attacks. The scheme is not necessarily proof-of-work, but the fact that there's a double-spend problem and you're solving it is key to the idea.

If you don't have a double-spend problem because all your transactions commute (e.g., Certificate Transparency), you don't have a blockchain, just a Merkle tree. Which is great, you don't have to incur the costs of mining at all, nor do you need to think about mining incentives and structures.

If you're not using distributed consensus because you have a central coordinator, you don't have a blockchain either, and again, you get to not think about mining. Whichever transaction reaches the coordinator first wins, so double-apend becomes irrelevant.

If the Fed wants to build FedCoin, I don't see any reason why they should refuse to be the central coordinaor and instead outsource consensus to the internet. I don't see any reason why they _would_ , if they want to influence monetary policy at all—70% of Bitcoin mining last year was in China, which meant that it would have been straightforward for China to (globally!) freeze a Bitcoin address, and a little more complicated but still possible to prioritize or throttle certain transactions.

Maybe being protocol-compatible with Bitcoin or ERC20 or something would help, but fundamentally this would be an API to transfer USD, not a decentralized system.

See also patio11's Tweet [https://twitter.com/patio11/status/583698553614143488](https://twitter.com/patio11/status/583698553614143488) "Most advantages of Bitcoin which matter are captured by, and improved upon by, a LAMP app which simply holds account balances." If the Fed wants to build that app, great!

<comment><USER3> There is already a word for what you are talking about, and you used it:

Consensus.

So I counter your argument. It is useless to call "Blockchain" something that must necessarily have consensus. Or else we should just call it a consensus mechanism, not a blockchain. So instead, I propose the following:

A blockchain, is a cryptographically signed linked list.

Note, things like "a distributed ledger" aren't included in that definition. Why? Because a distributed ledger is only possible if writes are cryptographically signed. Else, it is too easy to fake, sybil, forge, exploit, manipulate, lie, or mutate the ledger in a public setting.

I've done a lot of work on commutative transformations (CRDTs, at [https://github.com/amark/gun](https://github.com/amark/gun) ), and while they are a very different (and more scalable) approach to arriving at consensus (through deterministic means), I still think it is appropriate to call such CRDT/DAG/Merkle/other cryptographically based systems a blockchain. Why? Simply because they can be used as a distributed ledger, and that is the point that most people actually talk about/intend.

At the end of the day, what people intend when they talk about "blockchain" isn't even cryptography or technology, it is simply an economic model. An economic model that doesn't require institutional trust.

So in that sense, would a FedCoin pass as being a "blockchain"? From a technology standpoint, sure, but not from an economic perspective.

Would love to hear your counter-thoughts!

<comment><USER4> > A blockchain, is a cryptographically signed linked list.

I've always assumed this definition by analogy with _Cipher Block Chaining_ ([https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation...](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher_Block_Chaining_\(CBC\))), but of course where a word starts out and where it ends up can be two very different things.

<comment><USER5> > Ehrsam, Meyer, Smith and Tuchman invented the Cipher Block Chaining (CBC) > mode of operation in 1976

Seriously, even the term was coined back then and the concept is actually pretty identical if you think about it.

</comment></comment></comment></comment><comment><USER6> The basic premise of this headline represents a complete failure to grasp the point of a cryptocurrency, which is to take the power of money issuance _away_ from incumbent authorities who can back it with physical force (that is, states), and devolve it into a first order power available to any social group. The paradoxical claim that a centralized bank could ever issue currency based on the presumption of decentralized support is epitome of misapprehension, or at least misappropriation of jargon.

The Fed already has "FedCoin" for all intents and purposes, and does not need the cooperative casino incentive system known as a blockchain in order to compel rules-compliant participation from its users.

<comment><USER7> We tried the "anyone can issue money" model in the 1800s, all it led to was bank runs and scams. The current system exists for a reason.

If the blockchain crowd wants to relearn those lessons, they are welcome to, as long as they keep their shenanigans out of the real economy and away from people who don't want anything to do with the experiment.

<comment><USER8> Well, ultimately a decentralized blockchain tackles the issue in a much different way. In the 1800s, if you were a money issuer, you could print any amount you wanted. In a truly decentralized blockchain, there are defined rules for how new currency enters the system. You cannot just print new money. The amount that exists is fully visible by anyone.

Transparency is everything. This also explains why a currency like XRP is not a real blockchain. Beware these pseudo-blockchain projects, because they are much more similar to your example from the 1800s.

<comment><USER9> As the proliferation of newly created digital currencies should tell you, printing new bills at will has been replaced by creating new currencies at will. So a series of new bills in the old system is now equivalent to a new blockchain. While we have thus the well perpetuated illusion of an ever fixed amount of currency, the system moves towards massive inflation due to an incentive to create new currencies.

<comment><USER10> It remains to be seen how that will work out. If your equivalency were correct, we'd expect the issuance of new currencies to reduce the value of old ones, and so far we're not seeing much evidence of that.

Hayek wrote a book arguing that a system of competing privately-issued currencies would ultimately result in currencies with stable value. Of course we haven't yet seen evidence for that either.

<comment><USER11> > If your equivalency were correct, we'd expect the issuance of new currencies > to reduce the value of old ones, and so far we're not seeing much evidence > of that.

I'm not sure what evidence we should even be looking for here, but certainly the share of Bitcoin in the cryptocurrency markets has dropped alongside its value[1]. Anecdotally, most people I've talked to holding, say, ETH, would be holding more BTC otherwise, so it's hard to argue that the competition doesn't depress the price.

As for the Hayek reference, I have some thoughts on that: [https://paulbutler.org/archives/stop-dragging-hayek-into- bit...](https://paulbutler.org/archives/stop-dragging-hayek-into-bitcoin/)

1: [https://coinmarketcap.com/charts/#dominance- percentage](https://coinmarketcap.com/charts/#dominance-percentage)

</comment></comment></comment></comment></comment></comment><comment><USER12> Another clickbait piece. Reading through the byline:

 _If cryptocurrency and blockchain technology really are the future of money, the world's central banks need to get involved, a former Fed governor argues._

Isn't that a big "if"? And in that case, the real headline should be - "If Cyrptocurrency is the future Feds should build a Fedcoin says a former Fed Governor".

And I think people who talk about how banks/Visa might be affected by cyrpotcurrency should take some time to read this:

[https://www.forbes.com/sites/francescoppola/2018/04/21/bitco...](https://www.forbes.com/sites/francescoppola/2018/04/21/bitcoin- banks-and-a-whole-lot-of-fud/#1548eecb21f1)

HN link:

[https://news.ycombinator.com/item?id=17000721](https://news.ycombinator.com/item?id=17000721)

</comment><comment><USER13> There's an interesting paper[0] from the Bank of England that considers the challenges and opportunities central bank issued cryptocurrencies might entail.

0\. [https://www.bankofengland.co.uk/working-paper/2016/the- macro...](https://www.bankofengland.co.uk/working-paper/2016/the- macroeconomics-of-central-bank-issued-digital-currencies)

</comment><comment><USER14> Not sure why NYT is taking some "former governor's" opinion on this. Let's take a look at what the Fed itself (themselves?) think. Quite recently (2018-04-16): "The Case for Central Bank Electronic Money and the Non-case for Central Bank Cryptocurrencies" at [https://research.stlouisfed.org/publications/review/2018/02/...](https://research.stlouisfed.org/publications/review/2018/02/13/the- case-for-central-bank-electronic-money-and-the-non-case-for-central-bank- cryptocurrencies)

In a nutshell, the St. Louis Fed thinks there's no good case for central banks to get involved in creating cryptocurrencies (though there is a case for fiat electronic money). ISTR that the Swiss National Bank expressed pretty-much the same opinion, too, not more than a few weeks ago.

<comment><USER15> It's worth noting that most central banks _already do_ have electronic money (called 'central bank reserves'), which commercial banks use for settling inter-bank payments between each other, as well as transfers to and from the Government (Government spending into private bank accounts, tax transfers to the Government from private bank accounts, and the purchasing of Government bonds and securities).

What the linked paper is talking about (it's also part of the Swiss proposal) is to provide accounts for private individuals (not just banks and large financial institutions) to access this kind of money. The advantage is zero risk of losing your money (unlike commercial banks it wouldn't require the Government having to bail anyone out or insure anything), but the downside is reserves don't attract any interest.

</comment></comment><comment><USER16> How about fedDigitalCash? It's crazy that I pay a few percent of every transaction to visa for no reason every time I buy anything in 2018

<comment><USER17> Yes, paying a few % on every transaction to move kilobytes of information over a network is absurd. The true cost is less than pennies but the EMV cartel led by VISA has successfully kept the price many orders of magnitude higher, employing anti-competitive tricks like: hiding the cost to consumers by contracually preventing retailers from increasing prices for VISA payments.

<comment><USER18> Free/cheap digital payments exist (eg. EU SEPA credit transfers); for credit cars, however, the majority part of the cost (and thus price) is not just making the payment but ensuring that payments are reversible in case of fraud and other disputes, and that customers can get their money back _even if_ the money can't be recovered from a fraudster.

If you'd add a reputable escrow service, dispute resolution system and fraud insurance on top of any cryptocurrency, these features will drive the cost up just as high or more.

</comment></comment></comment><comment><USER19> "It would be quite a twist if a technology whose most ardent fans are motivated by distrust of central banks became a key tool for those banks."

It's the other way around: the fact that _publicly provable and verifiable_ financial systems are possible, yet the central banks didn't work this out (what they should have been striving for from the start), nor improve on it for another decade now is what fuels distrust of the old _blindly trusted_ financial systems.

<comment><USER20> Pretty much nails this on the head. The FED failed at its mission and is due for disruption. Considering how poorly our democratic system is working, it's too going to come from private or open source industry.

</comment></comment><comment><USER21> The money part of the technology is not important for central banks. Underlying technology allows more useful solutions than cryptocurrency.

What Fed and others in banking want is new forms of distributed accounting and settlement processes. You can apply the cryptographic technology for verifying and connecting database rows across institutions in a way that is both transparent, private and secure. If there is a public ledger online, it can be audited by anyone.

</comment><comment><USER22> Isn't that what a line of credit is? Or a debit card? It's got a history of spending, it's very hard to double spend, and its completely traceable?

Sometimes I think fed has learned from Bitcoin that they don't trust us with Bitcoin, and they shouldn't trust us with cash either. I don't feel like they really give a shit about what a distributed ledger actually accomplishes and how it protects users.

Additionally, mining. Mining is a huge problem in my eyes because it wastes a ridiculous amount of energy to not produce anything. I'd love to just buy-in with my credit card or with cash, and have those coins generated (until supply is depleted) to meet the value at that time. If fedcoin worked like that, that'd be neat. Otherwise, it's just an energy sink, and I think we should start being more conscious at where all this energy is going.

Side question, HNers who use Bitcoin, why are you using bitcoin? Why aren't you using monero? If it's just convention, then switch! That's how conventions change!

</comment><comment><USER23> It could create FedCoin. But, instead it will allow the investment banks to make it for them and then sign off on whatever they makeup because they can not only make it legal but make it easy to use.

Then the government would just let those coins that pass through this with open arms. Regulation now is the biggest part of an ICO and if you are an investment bank and want a big piece of the distributed ledger pie you probably are already figuring out how to do this.

I was at a meeting with laywers who wanted to understand what an ICO is. KYC and AML laws are now the big problems on implementing an ICO. 2017 was the start of the ICO boom and 2018 will be the start of the enforcement. Expect a bunch of coins to disappear.

<comment><USER24> > 2018 will be the start of the enforcement

For what it's worth, I've been hearing "X will be the year of regulatory enforcement" since 2014. So far all we've seen is a very level-headed and even-handed approach targeting just the outright scams. "year of regulatory enforcement" in the crypto currency space is becoming a bit like the "year of linux on the desktop" meme.

<comment><USER25> Yes, the SEC will continue to take a very light touch. There's no upside to them cracking down on ICOs. The only people losing money are the people who mostly understand the risks of cryptocurrencies and "invest" anyways. The SEC may get serious when grandmothers lose money or there's blood in the streets. Until then there's a kind of regulatory sovereignty that must be defended on a pro forma basis eg the slam-dunk enforcement actions and various announcements that "some ICOs are securities but we won't say which, never the less it's our decision to make and nobody else's." The _only_ real risk to the SEC is that some other regulator like the NFA or the CFTC will step in and say "these coins are currencies and we're gonna regulate them" or "these coins are commodities and we're gonna regulate them."

<comment><USER26> > _There 's no upside to them cracking down on ICOs_

To add: enforcement resources are limited. Every cryptocurrency fraud investigated is a bread and butter fraud ignored. While _caveat emptor_ isn't the law of the land, justice is a slow-turning mechanism. What will be enforced in the long term need not be addressed in the short.

</comment></comment></comment></comment><comment><USER27> HN previously discussed a Bank of International Settlement Report on Central Bank Cryptocutrencies - [https://news.ycombinator.com/item?id=15278063](https://news.ycombinator.com/item?id=15278063)

</comment><comment><USER24> > But what if central banks themselves entered the game? What would happen if > the Federal Reserve, or the European Central Bank or the Bank of Japan used > blockchain technology to create their own virtual currencies? Besides, that > is, having some cryptocurrency fans' heads explode?

Maybe some of the wacko nut-jobs out there in cryptocurrency fandom. But most would welcome this with open arms. It would mean that you could create smart contracts denominated in fiat, or trustless exchanges, or trustless covered shorts on the price of bitcoin, etc. What's the downside?

<comment><USER28> I'm probably one of those "wacko nut-jobs out there" that you refer to, so you may just want to dismiss my point outright with ad hominem. However, I don't think any of us wacko nut-jobs would care about fed coin, _as long as_ they don't go after competing coins. In fact, I welcome the competition. As long as it's free competition, may the better, less manipulable, coin(s) win.

<comment><USER24> Why competition? This isn't a zero sum game.

<comment><USER29> It is. You either store value in dollars, euros, gold, real estate, art or bitcoin.

You can't "dobule spend" the same value.

<comment><USER24> The market cap of bitcoin going up does not make the market cap of gold, usd, or real estate go down. Total aggregate wealth is not zero/fixed sum.

</comment></comment></comment></comment></comment><comment><USER30> Pretty sure the USD is enough.

<comment><USER31> You can't transfer USD electronically without using banks or third-party services that are trying to skim basis points off the entire economy. In theory a well-implemented FedCoin could be more neutral and efficient.

<comment><USER2> That's not a limitation of USD. If the Fed wanted to create an API that let you do that and sidestep banks, they could. (And if they couldn't because a government agency can't casually destroy an industry like that, that restriction applies to FedCoin, too.)

<comment><USER31> Indeed, and I think an implementation of "FedCoin" would probably be better off without a blockchain, given that you're trusting the government anyway.

</comment></comment></comment></comment><comment><USER32> "we don't see any immediate systemic risk issues" \- Warsh, 11 July 2007

[https://www.gpo.gov/fdsys/pkg/CHRG-110hhrg38388/html/CHRG-11...](https://www.gpo.gov/fdsys/pkg/CHRG-110hhrg38388/html/CHRG-110hhrg38388.htm)

<comment><USER31> Please be specific; the link between the financial crisis and a hypothetical FedCoin is not at all obvious.

<comment><USER33> The connection is that this is the same person making both predictions.

</comment></comment></comment><comment><USER33> Looks quite close to the way the Basis people ([http://www.basis.io/](http://www.basis.io/)) talk about a central-bank-run version of their currency, where the bank can target a level of inflation and let the system do the rest.

</comment><comment><USER34> China already has WeChat money. It's literally everywhere. To the point where, you often spend days without touching money. People now sigh and groan and ask for the manager to get the key to open the till if you insist on paying with cash.

</comment><comment><USER35> They want to do away with unaccountable physical cash. Another method of tracking and control. They will keep their gold of course.

</comment><comment><USER36> Answer: No thanks.

</comment><comment><USER37> If I can't buy, let's say... heroine completely anonymously with FedCoin then I think the whole spirit of the initial vision has been violated. Call me crazy but I don't think this is what's envisioned by those that would advocate for something like FedCoin.

</comment><comment><USER38> It's not "should".

More like "when"

</comment><comment><USER39> They should create it just to show that it will be a failure.</comment>


Foreign Policy on whether cyber-warfare is mostly hype. - <AUTHOR> http://www.foreignpolicy.com/articles/2012/02/27/cyberwar

<comment><AUTHOR> Rebuttal: [http://www.foreignpolicy.com/articles/2012/02/27/cyberwar_is...](http://www.foreignpolicy.com/articles/2012/02/27/cyberwar_is_already_upon_us)</comment>


Help the Graphics team track down an interesting WebRender bug - <AUTHOR> https://mozillagfx.wordpress.com/2020/02/18/challenge-snitch-on-the-glitch-help-the-graphics-team-track-down-an-interesting-webrender-bug/ <comment> Const-me I'm almost sure it's incorrect usage of D3D. I've encountered and fixed similar bugs in my 3D graphics code.

Based on the symptoms and difficulties to reproduce, I think what you see on the screenshots are incomplete renders. The FF code submitted some draw calls to GPU, and copied the render target texture without waiting for draw calls to complete. A good way to fix is use a D3D11_QUERY_EVENT query to wait for completion of rendering.

If all GPU access happens through D3D11 this shouldn't happen i.e. the API guarantees to wait for the completion of previously submitted draw calls. It may happen in practice when mixing multiple GPU APIs, e.g. when using DXGI surface sharing to pass textures between D3D11 and DX9. Also, it may happen when using D3D from multiple threads. Easy way to detect the latter, set D3D11_CREATE_DEVICE_DEBUG flag when creating the device, and read warnings in debug output of the process.

Another possibility is just bugs in rendering code. To troubleshoot them, [https://renderdoc.org/](https://renderdoc.org/) is awesome. Unfortunately, if the FF doesn't use D3D to present, only rendering to textures, some changes to FF's source code is required to capture frames with RD, see this page for details: [https://renderdoc.org/docs/in_application_api.html](https://renderdoc.org/docs/in_application_api.html)

<comment><USER2> The problem with using RenderDoc is that it doesn't capture ANGLE GL function usage, only the underlying D3D calls. So you have to correlate the high-level GL API calls with whatever ANGLE is lowering them to yourself.

It would be nice to have a native D3D11 backend (and D3D12, and Metal, and Vulkan) someday, but that day isn't today. gfx-rs, or wgpu-rs, looks promising as an abstraction layer over all of these APIs.

<comment> Const-me > it doesn't capture ANGLE GL function usage

It's opensource with MIT license. I wouldn't expect too many issues supporting such use case, given RD's support for normal OS-supplied GLES. I would only expect complications if you'll try capturing both layers at the same time, GLES between your app and angle, and D3D between angle and d3d11.dll.

<comment><USER3> RenderDoc does have some issues tracking calls from ANGLE's backend, but workarounds are documented here for some platforms: [https://chromium.googlesource.com/angle/angle/+/master/doc/D...](https://chromium.googlesource.com/angle/angle/+/master/doc/DebuggingTips.md#running- angle-under-renderdoc)

</comment></comment></comment></comment><comment><USER4> I used to have this problem __ALL__ the time. So I can give some specs to help anyone, because another comment suggests old hardware.

I __only__ experienced the text tearing. It would basically be a slash through the screen, usually two or three where text would just be displaced. A small scroll would fix it.

This has happened to me in both Manjaro and Ubuntu and on two different computers. The Manjaro is a Inspiron with a 1060Qmax. The Ubuntu has a GTK Titan Black (so old).

I have not experienced these glitches in fairly recent memory. So probably last two versions of FF. These computers are my daily drivers and I keep them fairly up to date.

Usually where these glitches would happen is in long form text articles. I don't recall seeing them on Reddit, but more like NYT. Hope this helps.

<comment><USER5> I've been experiencing this too! On only one of my machines. I did a complete Windows reinstall but the problem persisted.

It doesn't happen too often, but iirc I saw a text glitch sometime in the past few days. Moving my mouse over the glitched area or a small scroll solves it for me too.

<comment><USER4> Yeah I could get rid of it by scrolling or highlighting the text. I remember looking it up and only find like one small bug report a year ago. But I don't see it anymore. Are you on the newest FF? I don't use nightly and I haven't seen this problem in awhile.

<comment><USER5> Just checked, I'm on latest regular FF, non-nightly. I don't recall seeing it in the past couple days so maaaaybe it's resolved now? I'll keep an eye out for it in case I see it again.

</comment></comment></comment></comment><comment><USER6> This bug happens to me somewhat often. In fact it happened to me yesterday. It fixes itself after a couple of seconds. No idea how it happens - I haven't noticed a pattern.

I have a GTX 1070.

<comment><USER7> Could you file a bug for us? [https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&comp...](https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&component=Graphics%3A+WebRender)

<comment><USER8> I'm in the same boat with Windows 10 + nvidia 2080ti. Not sure why you want a bug report filled when neither of us have any way of reproducing the issue nor more information about where/when it happens.

<comment><USER9> Because that's what bug reports are helpful for: organizing and collecting data, which helps with the whole "finding a repro case" and eventually fixing this issue.

Did you think bugs got fixed by mentioning "me too" in a HN comment thread? :)

</comment></comment></comment></comment><comment><USER10> I was having a weird WebRender issue last year, except it was causing sudden reboots until the computer stayed powered off long enough for the GPU memory to be cleared. I had enabled WebRender in Linux (it's experimental, I know), and the computer would run fine for weeks at a time, then reboot out of nowhere. It would continue to reboot any time I opened firefox, sometimes a few minutes after starting firefox. The reboots would persist even when I would boot into Windows instead of Linux after one of the forced reboots. Once I narrowed it down to firefox causing the reboots, I started it in safe mode and disabled WebRender, and I haven't had any issues since. This was with a 1050TI graphics card.

<comment><USER11> That sounds more like a Linux or hardware issue than a webrender one! (Likewise if a website causes Firefox to crash, that's a Firefox issue rather than the website's)

</comment></comment><comment><USER12> I am fairly certain I've seen this bug, but on macOS using a MBP's integrated graphics. I opted into WebRender a while ago via about:config, so I had figured it was just a random beta issue. Will have to see if I can capture it next time it happens!

<comment><USER13> Same here as well, but in fairness I've also seen it happen in Chrome too on the same sites.

<comment><USER14> Came here to say this. I've seen this on my (2015 13 inch MBP), in both Chrome and Firefox.

</comment></comment></comment><comment><USER15> Heh, i was talking about this today. I do three days a month for a client where I use their computers and it's the only time I ever use Windows 10 and the only time I see this. I was asking around about it but no one else was using Firefox. Next time I'm in I'll pay more attention.

<comment><USER7> If you can grab the info in about:support for that machine and file a bug: [https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&comp...](https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&component=Graphics%3A+WebRender) that would be helpful!

</comment></comment><comment><USER16> I get it all the time but I have gfx.webrender.all set to false. gfx.webrender.blob-images, webrender.dcomp-win.enabled, force-angle, picture- caching, triple-buffering.enabled are set to true

However gfx.webrender.enabled is set to false so are they even active?

FF 72.0.2

<comment><USER11> If you got to about:support and check the value of "compositing", you will see if webrender is enabled.

</comment></comment><comment><USER17> This is so bizarre for me because it's like a flashback. I was seeing errors _exactly like this_ in Firefox years ago, around 4-5 years or more I'd say.

This was on windows 7 64bit with a probably outdated install because my favorite extension for vertical tab tree was always behind on version support.

This error would manifest when I had many tabs open for a long time. I'd often keep sessions of hundreds of tabs open for weeks. The errors would start to appear and gradually get worse until I had to force crash ffx and restart (and recover my tabs!)

Not really actionable or reoro, but anecdotally maybe it helps to hear this isn't strictly new.

</comment><comment><USER18> Looks a lot like older graphics cards over heating. I worked in graphics QA.

<comment><USER19> I get this frequently. Usually when an update fires and I scroll. Have not yet been able to reproduce reliably. I really doubt it's overheating, since it takes a fraction of a second to happen and it couldn't heat up that quickly.

<comment><USER20> > _it couldn 't heat up that quickly_

It could, actually, especially if it's not well maintained.

<comment><USER19> It's a $1200 GPU, I do make time to clean. I'm not saying it's Firefox specifically, perhaps a strange interaction between Firefox and the latest Nvidia drivers. But you're welcome to come check my machine.

</comment></comment></comment></comment><comment><USER21> Son of a gun, I have been running into this issue sporadically ever since I built my new PC with a Radeon 5700 XT, and I thought it might have been a bug in the drivers or a bad card, but turns out it's this instead.

For what it's worth, I downgraded my drivers to the last set of drivers from 2019 (19.9.2) and the problem seems to have gone away, but I'm having other issues instead (for instance, half the screen flashes dark when Night Light turns on). Guess it's time to upgrade and file some bugs.

</comment><comment><USER22> The state of debugging for graphics code is deplorable. When you run code on a GPU you almost always have a gigantic closed source binary blob underneath you, the graphics driver. Graphics drivers contain complete compilers that munge your code with a focus on speed over correctness. The graphics driver is often years out of date, and you can't even run it yourself to reproduce issues unless you go out and buy the exact hardware that each user has.

The state of the art in debugging GPU issues is to have a closet full of random hardware purchased used on eBay that hopefully contains something close enough to what you need to reproduce the issue you're working on.

Most fancy debugging tools pretend that GPUs don't exist and GPU-focused debuggers are incredibly buggy and feature-poor, not to mention hardware specific in many cases.

<comment><USER23> I've never understood the logic behind closed-source drivers. Nobody pays for a driver, people pay for hardware. If you want your hardware to get better support, and therefore become more popular, aren't you incentivized to open- source the drivers?

<comment><USER22> > Nobody pays for a driver

This is not true. Driver quality is a major differentiating factor between GPUs and absolutely influences purchasing decisions.

GPU makers don't want their competitors to be able to take parts of their drivers and benefit from them. They want to protect trade secrets. They want to avoid revealing how many of their competitors' patents they are violating. They don't own the rights to some third party code or trade secrets that are incorporated in their drivers. They want to avoid revealing future product plans.

Of course it's debatable whether closed source drivers actually help with all of the above reasons, or whether they are good reasons to begin with. But those are the reasons.

<comment><USER24> AMD Radeon has made multiple of their performance-enhancing projects of theirs open source only to have nVidia copy and implement their work without reciprocating the favor.

<comment><USER25> Is it mandatory to reciprocate? If not, then that's a problem of their own making, isn't it?

<comment><USER24> It's not mandatory, but it sure isn't polite, especially when projects like HairWorks are killing AMD because it's a driver handling issue more than a hardware one.

</comment></comment></comment></comment></comment></comment><comment><USER26> OT: This is the first time firefox has warned me about blocking social media trackers. Funny that it happened on one of mozillas own websites.

<comment><USER27> Yeah that's a wordpress blog quickly put together outside of mozilla's official blogging infrastructure. There was no really good reason to do that, it was just laziness on our end.

</comment></comment><comment><USER28> But hunting is one of the easy to apply kinds of crowd wisdom. Let's hope Mozilla gets enough data to nail down the root cause.

</comment><comment><USER29> Black rectangle rings true here. I get it pretty reliably on my phone (preview nightly, Android). If I click a GitHub link and FastHub automatically opens (any GitHub link), when I go back on the phone I see a black rectangle for the whole page.

Pixel 3. Hopefully it's a common codepath.

<comment><USER11> That sounds like a separate issue. Similar to one I had before on android, but fixed. If you go to settings, about Firefox nightly, what version does it say?

Does the black go away by itself after a couple seconds, or when you scroll, or does it stay forever?

</comment></comment><comment><USER30> I haven't seen this particular issue but I've seen very similar bugs in my own work where GPU and CPU are not properly sync'd when using glyph or small image cache textures.

E.g. gpu has a frame pending, CPU updates glyph cache, GPU renders pending frame using incorrect cache data.

</comment><comment><USER31> I had a similar issue in Chrome and a regular crash-to-desktop in the main game I was playing at the time (Divinity 2) on Windows 10 with a GTX 970. I also had major problems with YouTube.

My fix was to turn off all the Dynamic Clock and GPU Boost stuff in the NVIDIA control panel.

</comment><comment><USER32> Hmm... This looks identical to something that occurred on Ubuntu 14.04 when I came out of suspend, except it happened to all gtk apps. Switching to another virtual terminal then back to 7 seemed to reinitialize something and fix it.

Even nowadays, on rare occasion on Ubuntu 18.04, something like this occurs during startup of Android Studio. I don't recall seeing it on Firefox since at least 16.04 though.

</comment><comment><USER33> I wonder if Mozilla has enough resources to test on Windows machines, or if it's just bad luck with hardware configuration, or something else entirely. I reported an unrelated bug in Nightly where I couldn't use smartcard authentication and since it only reproed on Windows we had a back and forth exchanging screenshots and logs until the root cause was narrowed down.

</comment><comment><USER34> I had issues like this in May of last year in Chrome on Windows 10. Oddly it happened most frequently on TravisCI's website, and I thought at first that it was a TravisCI issue!

It turned out a Windows updated over night and replaced my AMD driver with some old compatibility driver. After updating back to the most recent driver the issue went away.

</comment><comment><USER35> A classical race condiction double bug. What happens here is there is a a special case of the data. So other routine of processing the data is used.

It causes a race condition that results in proving incomplete data to the next step of the process.

There is surely logic to prevent it from happening. But the data initially used the bad routine so no one expects the race condition to occur.

And at the end we have a bad routine that processes data badly because data are bad and incomplete. This routine does not expect how it receives the data and in what time.

In a result rendering breaks, but for the logic of the code it seems fine. So the error block is displayed. Gor GPU rendering it is a black box.

What is interesting if you did deep enought to find all these 3 issues that cause it each of them separately is fine. It is what they do together causes the issue.

Very nasty thing to track. And also fix. Because on a high level there is little to about it. And a workaround is mostly to detect the situation and process data slightly different way to avoid the issue, or to just do processing two times in a rather hacky way.

</comment><comment><USER36> I have seen very similar bugs (the same text glitches for sure) under Linux (Radeon RX580, open source drivers) in the past. I had put it down to open source drive stack bugs, but maybe it was actually a Firefox bug?

I'll try and take a screenshot next time it happens & report it.

</comment><comment><USER37> I have seen this in the past (I use FF-nightly on MacOS) but subsequent updates seemed to have fixed it. Although maybe some other factor affecting the frequency. Will keep an eye out.

</comment><comment><USER38> Why the Nightly version only, I'm curious?

<comment><USER39> Presumably there are other graphics bugs that have been fixed in Firefox Nightly but still exist in the Beta or Stable Release channels. Best to debug and reproduce the bug in the code closest to version the Mozilla engineers are using.

</comment></comment><comment><USER40> > Update: we have created the channel #gfx-wr-glitch on Matrix

Funnily, this alias is incomplete and therefore not enough to join. A room ID might have been enough, but just an alias without a server part is worthless, a bit like someone left an e-mail adress as gfx-wr-glitch@, without specifying the rest.

I've successfully joined trough #gfx-wr-glitch:mozilla.org, (roomid is !qaAtjMWizEgMcVSbNH:mozilla.org, no alias on matrix.org) and told them so.

Edit: they fixed it. I wonder how often that happens with those new to Matrix?

<comment><USER41> I don't think that's a "new to Matrix" thing.

They run their own server, just like they ran their own IRC server before, and at first didn't really consider the need to make that explicit. I doubt there was any misunderstanding of the tech, or that the channel names are per- server.

</comment></comment><comment><USER42> > Without having a way to reliably reproduce this bug, we are at a loss on how > to solve it.

I wish non-technical people understood this.

</comment><comment><USER43> I'm curious, why does a team working for Mozilla need to host their blog as a free account on wordpress.com? They really don't have a unified blog system to provide a more official feeling to all their different departments?

Or is this just an unofficial blog from people that is unrelated to Mozilla?

<comment><USER44> In this respect (and probably others) Mozilla is more like a ragtag army of rebels than a uniform-wearing platoon of soldiers. The blog is hosted on WordPress because the person who started it found it most convenient, and it never got migrated anywhere else. We also have hundreds of different github organizations and repos (despite also hosting our own "official" mercurial server), use lots of different communication tools, spread documentation over multiple wikis and bug trackers, etc.

But yes, this is an "official" blog from Mozilla employees on the graphics team, of which I too am a member.

<comment><USER43> That's both strange, very confusing, and amazing at the same time :-)

It surprised me that Mozilla is able to simultaneously have things like the MDN, basically the best resource for HTML and Web APIs, but then other references or publications scattered around everywhere.

</comment></comment></comment><comment><USER45> This reminds me of the comments section or sometimes a mailing list for a particular bug in a driver or a low-level component and most of all the replies were from 'users' who weren't helping to solving the actual problem in the discussion. Then one day an unknown contributor not only was able to reproduce the bug but also sent an actual fix and ended up gaining commit access to the project after staying there for a while.

Whenever I hear the 'mythical legend of the 10X rockstar developer', I think of them. Mozilla needs more of those developers to reproduce AND send patches to interesting bugs like this. Not the whining copypasta forum-posting 'users' calling themselves 'developers' who take many open-source projects like this for granted and don't appreciate the time spent by the maintainers of the project.

Nowadays they're usually doing this on a developer social network through every maintainers nightmare 'The Issues Tab'.

<comment><USER46> Hah! As an open source maintainer for a mildly popular repo a big chunk of my time is spent weeding out people filing issues and opening PRs for trivial changes (like adding a line to the README file) just so they can claim to be a "contributor". Meanwhile there are a ton of issues that are ready to code with a full explanation and are even marked as such ("good first issue" or whatever else) that stay untouched.

Regardless of community engagement, perceived interest, Github stars or whatever else — finding a developer willing to spend actual time and effort to make a project better is very, very rare.

<comment><USER47> I've made a bunch of one line PRs that I'm worried are perceived like this, but they're always a fix for something that cost me a lot of time. Examples include adding quotes around CSS base64 URLs (our base64 string included //) and changing the case of some headers in documentation (headers were downcased upstream and the example in the doc failed silently). Are these the kind of PRs you don't like?

<comment><USER46> Not at all. It isn't the size of the PR that matters, but I generally want contributors to:

\- Discuss their changes beforehand (usually on the issue page)

\- Use patterns and practices that the rest of the codebase follows

\- Listen to comments and feedback

\- Write tests

While the work is "free", it should still be treated professionally.

<comment><USER48> > \- Discuss their changes beforehand (usually on the issue page)

Interesting. When I last looked at contributing to open source, some general advice was to offer up code even if its likely the wrong approach. The idea being that maintainers are busy, and there's lots of people that drag on their time without ever contributing anything. Showing you're actually willing to put in time and effort will make the maintainer more likely to guide you in the correct direction because you've already shown you're willing to spend time on the issue.

<comment><USER49> I feel the same way. Although I have only been starting to contribute recently, I thought that by offering code first via pull request I wouldn't be perceived as a whiner in the issues section.

<comment><USER50> This is definitely true. I'm not a fan of Issues discussion with random people who are not known to be reliable contributors. Talk is cheap, show me the code.

</comment></comment></comment></comment></comment></comment></comment><comment><USER51> Given this is the mozillagfx blog, one would hope the "gfx" displayed on the blog were a little better: I can't make out the graphical glitches described in those tiny low-resolution screenshots.

<comment><USER52> you dont see the glitches in this image [https://mozillagfx.files.wordpress.com/2020/02/screen- shot-g...](https://mozillagfx.files.wordpress.com/2020/02/screen-shot- glitch.jpg)

<comment><USER53> Is that not how reddit looks?

<comment><USER54> Interesting to note that even the address bar appears to be affected. Several characters are missing from the URL in that screenshot.

<comment><USER8> Yeah, when I had it happen to me, it happens to the entire Firefox instance, settings page, url bar, tab names, context menu (right click menu) and everything in between.

<comment><USER39> Much of Firefox's UI is HTML and can be affected by bugs like this. But it is very interesting to see that bug appears to affect both the app UI and web page at the same time.

</comment></comment></comment></comment></comment></comment><comment><USER55> is this a real request for help, or a marketing-look-at-our-blog thing?

<comment><USER56> If you can suggest a better way to get word about a tricky bug out to people who don't usually look at Mozilla's bug tracker I'm sure they'd be happy to hear it :)

</comment></comment><comment><USER57> This very much sound like a similar issue Linux users are facing from more than a year and it's still not resolved? [https://askubuntu.com/questions/1088324/firefox-becoming- unr...](https://askubuntu.com/questions/1088324/firefox-becoming-unresponsive- after-suspending-on-kubuntu-18-10)

<comment><USER58> I don't think so - in the Linux bug, Firefox becomes unresponsive, whereas in the bug in the article, Firefox runs as normal, and the blanks can be cleared by scrolling or mousing over.

I see a somewhat similar bug on my Linux box, where windows flicker between black and normal, and the flickering stops if i focus on the window. I don't think it's specific to Firefox, though - i believe i've seen all sorts of apps do it. I do have an nvidia graphics card, FWIW.

<comment><USER57> As someone who experience this very often I can't say that Firefox is becoming unresponsive, you can still scroll up/down, change tabs, etc.. but the all pages are glitched similar (even worse) to the screenshots.

<comment><USER7> Can you file a bug? [https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&comp...](https://bugzilla.mozilla.org/enter_bug.cgi?product=Core&component=Graphics%3A+WebRender)

</comment></comment></comment></comment><comment><USER59> You should ask the people having the issue to switch graphics cards, PSU and RAM since this >90% smells like a memory/power issue. I think you've just gotten unlucky and collected a few similar reports of people having memory corruptions. I am guessing you cache renderings and that is why the issue sticks around until you re-render.

If you want to reproduce it yourselves then perhaps try pointing a hairdryer from a distance at the various components until they start to create trouble, or alternatively just overclock them towards the breaking points.

<comment><USER59> Why the downvotes? Anything contradicting this which you might want to share in text instead?</comment></comment>