Canada Post to phase out urban home mail delivery - <AUTHOR> http://www.cbc.ca/news/canada/ottawa/canada-post-to-phase-out-urban-home-mail-delivery-1.2459618 <comment><USER2> As the article notes, two-thirds of Canadians already do not have home mail delivery. Many urban residents, like myself, who live in newer areas with community mail boxes (a mail box that is maybe 100 metres from your home with everyone's mail) or in any type of apartment or condo building do not have mail delivered to our doorsteps.

It's secure (the boxes are locked unlike a doorstep mailbox), convenient (parcels can be locked in a special parcel dropbox, the key for which is deposited in your own mailbox, instead of having to be retrieved at the post office) and cheaper for the postal system.

Only people who live in older, more affluent areas built before community mailboxes receive home mail delivery. It's effectively a subsidy from us to them. Good riddance.

<comment><USER3> We don't know the economics of super boxes versus home delivery, and it would be perilously naive to assume that a move to it demonstrates that it is fiscally prudent. Money goes from one person's pocket to another person's pocket.

Superboxes are significant structures that have to be built and maintained to withstand literally unending vandalism and attempts at theft. They are urban blight, and most quickly become an eyesore that are, by federally forced mandate, pushed onto a community and then maintained at Canada Post's leisure and low level of standards. If any other business wanted to build such ominous structures throughout a neighborhood the barriers and costs would be enormous, and you talk about home delivery being subsidized? [In that self-destructive, race-to-the-bottom, worst-outcome-for-all way that is so disheartening].

Give me a break.

Where a mail carrier once walked briskly through a neighborhood (doubling as a set of eyes and ears in the community, for what that's worth), now they park their truck and sit at the superbox for half an hour while they sort mail into boxes.

I cannot, for the life of me, comprehend how it has made anything more efficient. And of course the grossly inefficient Canada Post of today, with sky-high postal rates and terrible service standards, already is horribly inefficient, so shouldn't the superbox thing have been proven by now?

And it's curious that you note their security given that most have keys that endure for years (from owner to owner to owner), and they are -- right now -- very common target for thieves: Why bother suspiciously going door to door (where the residents would be more likely to quickly retrieve their mail anyways, instead of some common box down the street) when you can pry open a superbox and steal the mail of dozens of people at once.

[http://ca.news.yahoo.com/blogs/dailybrew/locked-canada- post-...](http://ca.news.yahoo.com/blogs/dailybrew/locked-canada-post- community-mailboxes-aren-t-secure-193119352.html)

Canada Post has always been a derelict, massively dysfunctional corporation. Their parcel delivery service is only profitable because they _don 't deliver parcels_: They give you a delivery notice and force you to drive to a depot _n_ miles away in the most grotesquely inefficient delivery scheme devised by man.

<comment><USER2> The cost of community mail delivery is not unknown. CMBs have existed for decades and the article states that the cost of home delivery is 130% more. So I would submit that we do actually know the economics of it. The cost differential is about $762 million/year ($269-$117 * 5MM mailboxes).

I actually worked part-time as a mail carrier doing home delivery once. It's not easy work, especially in the winter. A lot of people don't maintain their driveways and walkways in the winter and it can be hazardous especially when you're carrying 15 kg or more of mail.

CMBs aren't high-security. But they're surely more secure than unlocked home mailboxes, especially in sleepy suburban neighbourhoods where no one is home for most of the day.

I don't disagree that Canada Post could likely save money in other ways. But this seems to be a rational place to start.

<comment><USER3> _The cost of community mail delivery is not unknown._

Imagine that UPS figured that delivering packages to your door is a real sucker's game, and they were in a monopoly industry where they could unilaterally make moves that competitors couldn't competitively undermine.

So they want to build big, onerous, eyesore structures everywhere throughout a neighborhood.

How much do you think it would cost them to do that? What do you think they will pay to rent the spaces, for instance?

Canada Post pays nothing. The federal government just forced it on municipalities. To make this even more built on imaginary economics, Canada Post forces _developers_ to pay for Canada Post to install the superboxes ($200 per address).

One of those beautiful forms of downloading that of course end-users pay for, but somehow it saves the end user money.

In any case, Canada Post does not publish numbers for CMBs. They publish numbers for group mailboxes (how credible and all inclusive they are we certainly don't know), which includes a massive array of group deliveries, of which superboxes are a subset.

 _I actually worked part-time as a mail carrier doing home delivery once. It 's not easy work, especially in the winter._

I'm not saying it is. But what is happening here is a battle between the union and Canada Post, and both are a part of the problem. One of the reasons home delivery has so many imaginary expenses is that it is a secret known country wide that doing home delivery is a dream job because you are paid for the route, but most carriers can complete the route in a small fraction of a work day, though it is assessed, over long battled union rules, as a full work day.

It's a battle of imaginary work and imaginary expenses, and in the end everyone loses.

<comment><USER2> You raise a good point that Canada Post doesn't pay a true market cost for the real estate its CMBs sit on. But this is the nature of a quasi-public monopoly. But that's the price we pay for you to be able to send a letter from anywhere, to anywhere.

You raise another good point that the cost of home delivery is inflated by the pay-by-distance union rules. But this issue is close to intractable. Given the political reality of this situation, do you think postal workers will give up these rules without a long, disruptive strike? Do you think the government wants to get within 10 miles of another postal strike?

<comment><USER4> | But that's the price we pay for you to be able to send a letter from anywhere, to anywhere.

Except now, it's not anywhere, it's _somewhat adjacent_ to anywhere.

<comment><USER5> That's just a matter of resolution. Canada Post never did deliver to say, the inbox on your desk, you always had to go to the mailbox to pick up your mail.

What the GP means is that Canada Post serves all areas of the country. If you try to send a package to a rural area via UPS, they'll charge you courier rates and then just mail it for you.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> Wow! Look at that sharp decline in volume of mail! It's now 10% of what it was 4 years ago!

Oh, wait, the horizontal axis doesn't start at 0.

<comment><USER7> Here is a graph with zeroed X-axis.

[http://i.imgur.com/OAul7h2.png](http://i.imgur.com/OAul7h2.png)

At the average rate of decline (constant ~4.5% decrease in mail delivered per year), it should reach 10% of 2008's usage by 2050. This obviously does not reflect reality, and it's just a napkin calculation.

<comment><USER8> Curious to know how much of that is spam. Since the advent of email, nearly everything that ends in my own mailbox are bills and statements, government- related correspondence, the occasional e-commerce related package and (shit tons of) spam. If the two former went full electronic, there would be very little point in having a mailbox at all -- unless you actually read your spam.

<comment><USER9> Little known fact: almost all of the spam (at least in my area) is not postal delivery. Private couriers deliver it. You can affix a "pas de pub" (no ads) sticker to your mailbox, and it stops. (It's possible the post also stops some spam delivery with this notice)

I havne't received junk mail in over a year.

<comment><USER10> Canada Post delivers junk mail to my private mailbox. Changed my bills to online (for those I could) and posted letter-stickers to my mailbox saying "No Admail Please" and now I get 0 spam mailings. Also opted out of CMA marketing, including opting out former residents addresses.

</comment></comment></comment></comment></comment><comment><USER11> The most lucrative part of mail delivery, parcel post, is doing well. Canada Post also owns 91% of Purolator, another parcel delivery service similar to UPS or Fedex, which is also doing just fine.

To me, this is the same as telcos complaining about the last mile problem. It's expensive to deliver something to someone's house, particularly when people choose to live in sprawling neighborhoods with little connectivity in terms of roads. If I have to drive to someone's house, would I rather deliver a letter for 60 cents or less (bulk mail), or a parcel for $4 to $10?

Just like the telcos, the government grants the postal service a monopoly on first class letters so that they, amongst other things, guarantee connectivity to remote parts of the country at a flat rate. If that's important either the government has to pony up tax money to provide the service, or the cost of the service has to go up. One thing the government has been unwilling to do is charge different prices depending on how much a letter actually costs to send. I'm certain people in remote communities might balk, but maybe dynamic pricing makes sense, particularly when anyone can print their own postage with cheap laser/inkjet printers.

</comment><comment><USER12> Note: they only proposed this idea, they haven't confirmed it. Just like in August when they were asking the government for money, they proposed cutting delivery to every-other day. With this announcement, they got the bail-out money and are now proposing a much more drastic solution. Neither have been implemented.

<comment><USER13> When I moved to the suburbs, I thought I would hate the community mailboxes, but they've actually turned out to be handy, because most small and mid sized packages can be securely delivered into the community mailbox.

Larger packages or those that require a signature are usually dropped off at the mail depot at a nearby drug store, which is open late.

When I buy online, especially from the US, I try to ship via USPS for this reason (also because they don't add exorbitant Canadian brokerage fees the way UPS and FedEx do).

<comment><USER14> Yes, UPS (the courier) are thieves when it comes to outrageous "brokerage" fees. Unfortunately a lot of places won't ship USPS (the post office) because they can't get a signature as proof of delivery.

<comment><USER13> I just bought a $150 item, of which $20 was shipping and then had to pay $60 COD to UPS at the door, of which $40 was a brokerage fee to UPS (the rest was duty and tax).

Outrageous is an understatement.

<comment><USER15> Next time you get a package from UPS just don't answer the door.

1) Call/Email UPS and request a commercial invoice and the depot the parcel is being held at. If it's not being held at a depot tell them you want to self- clear and for them to hold it. You may have to argue with them for a while to convince them this is a possibility.

2) Go to a CBSA office with the original receipt, commercial invoice and depot location, and pay taxes to get your B15 form. You shouldn't pay taxes on shipping.

3) Call UPS and ask them where you can send the B15 form.

4) Send them the B15 form with your tracking number on it and ask them to release your package.

<comment><USER13> >> Next time you get a package from UPS just don't answer the door.

Well you actually have to do it _way_ before that. My package was held at the border in Windsor/Detroit for a few days before it cleared. Once it's on a truck to your house, it's already too late to avoid brokerage fees.

What's sad is that UPS actually offers a slightly higher rate (only a few bucks more) that bypasses the brokerage fees, etc on shipments to Canada.

The problem is that most smaller online sellers don't know about it or care to research it.

<comment><USER15> You can decide to self clear at any point before accepting the package. It doesn't matter if they've made you an invoice or not.

</comment></comment></comment></comment></comment></comment></comment><comment><USER16> I've lived in downtown Montreal for the last ten years. For as long as I can remember, they've been doing exactly this with packages. Even if you're home, the mailman will just leave a slip saying that you can pick up your package at the local Canada Post outlet.

I have to wonder whether this will mean a huge boon to mail scanning services like outboxmail.com

<comment><USER13> One feature that I like:

If you have a newer community mailbox, smaller packages get left in a larger compartment in the community mailbox and they leave the compartment key in your own mailbox.

After you pick it up, you drop the key in the outbound mail compartment. It's very handy if you're not home to receive packages. In a way, it's like BufferBox.

<comment><USER17> The larger compartments are barely the size of a regular mailbox here in France though.

So, while I can understand the desire to reduce costs on the part of Canada Post, I thought they offered zero convenience to users.

And going out in the cold and the snow to fetch my mail in winter in a sidewalk-less neighbourhood was really not a pleasant experience (even if they were not very far from our house).

<comment><USER18> In Canada we have winter weather 6-8 months of the year. We LOVE going out in the cold. We play in the cold. We drink in the cold. We go out naked in the cold (after a hot tub session).

<comment><USER17> Well, that's not what people say while they're shoveling the snow out of their driveway just after the snow plow filled it with snow from the street, though.

Or when they slip in the slush and ruin their mail when coming back from the community mailbox.

</comment></comment></comment></comment></comment><comment><USER19> It's a great idea. I think that as time goes on, less and less mail will be sent.

I don't even open my mail anymore. They are just bills. I look at the sender, and then log onto their website. It's almost like a reminder, incase I forget to pay a bill.

Actually, now that I think of it, I only get bills from 1 or 2 companies. The other text/email me.

</comment><comment><USER20> Why not significantly increase the price of bulk mailing? More money for the post office, less advertisements in my mailbox. win-win. If they increase the price too much the reduction in usage will more than offset the increase in price, but I doubt that they're close to that yet.

<comment><USER21> At least in the US, bulk mail subsidizes the rest of the system, because it's a system with very high fixed costs spread over a larger volume.

</comment></comment><comment><USER22> I wish that first chart extended back to say... 1996.

I think it would have given a better scale to indicate how much the rise of the internet has effected traditional mail delivery.

</comment><comment><USER23> For being a developed country Canada has pretty terrible parcel and mail delivery, largely due to wonky regulations. Canada Post is horrible and UPS is excessively expensive for no good reasons. It's held back the advance of e-commerce there significantly.

<comment><USER13> Really? I am generally happier when a company offers Canada Post as a shipping option.

I don't have to worry about being home to sign for the package, and for stuff coming from the US via USPS, I don't have to worry about exorbitant surcharges from the likes of Fedex or UPS.

OTOH, it's nice that UPS Canada's standard shipping no longer requires you to be at home (signature not required) but you also have to worry about people stealing your package if you live in a dodgy neighborhood.

</comment></comment><comment><USER24> As a frequent Canada Post user, it still gets me that it's cheaper to send something to Europe or the US than it is to a fellow Canadian.

What factors allow USPS to be cheaper for the consumer while providing better service?

<comment><USER25> Losing money? [http://www.nytimes.com/2013/08/10/us/post-office-loss- declin...](http://www.nytimes.com/2013/08/10/us/post-office-loss-declines-in- third-quarter.html?_r=0)

<comment><USER24> Unbelievable. Looking around, it looks like postal system are often operating at a loss. Looks like an industry that could use some fresh eyes.

<comment><USER26> Not everything is meant to be run for-profit.

<comment><USER27> The main thing screwing over the USPS is the _moronic and absurd_ requirement that they pre-fund retirement for people who don't even work there yet. And then when they try to petition to change their policies to deal with the shortfalls (no Saturday delivery, etc), congress smacks 'em down.

</comment></comment></comment></comment></comment><comment><USER28> Australia Post has had 3 consecutive years of growth with a group profit of $312 million after tax last year. They offset their regulated business (eg mail delivery) which loses $218 million a year with things like parcel delivery that are very profitable and growing. In a country where everything generally costs far more than other places stamps are 60c. I wonder how long that is sustainable.

Perhaps increased competition in the Canadian market makes it harder for them to make the profits needed to subsidise their mail delivery.

</comment><comment><USER29> I'd love to see some cooperation between courier services when it comes to last-mile delivery services. Any package sent to me via international air- mail, which is cheap compared to most couriers, goes through canada post's last mile. This is actually pretty brilliant. If the package is small and no duties are required to be paid, it goes right in the superbox on my street. If it's larger or requires duties, it goes to the nearest canada post station, which is about a five minute walk from my house. Canada post stations are everywhere and have great coverage.

Compare this to UPS or Purolator (which Canada post owns the majority of). They always try to deliver packages in between noon and 5pm, when I (and probably most other people) am never home. They each have _one_ bloody depot in the city, open roughly 12-5 naturally, and it's a freakin' half-hour drive out of the way. Invariably, I have to go out of my way to drive over to their office to pick up my packages because they are incapable of delivery during the hours I am home (and they won't just drop off packages over a certain value). Though purolator may be owned by Canada post, they do not use Canada Post's last-mile infrastructure. Horrendous! Isn't the point of paying _extra_ for a courier _convenience_?

If Canada Post were to take over last-mile delivery from UPS and Purolator, or at least take over the failed deliveries so customers only have to go to the local post-office, they could bring in extra cash while vastly improving service to customers. Why on Earth isn't this being done, if not for UPS (which can burn in _HELL_ for all I care), at the very least for Purolator?

P.S. UPS is utter bloody crap for cross-border shipments. Any U.S. vendor who only ships via UPS does _not_ get my business. The common joke up here is that "UPS stands for _Use Purolator Stupid_!".

<comment><USER30> The last mile handover is usually where things go horribly wrong.

That's why vendors that operate internationally choose UPS, the only courier that can deliver from a factory in China to a doorstep almost anywhere on the planet without having to hand it over to local services, which will vary wildly in quality.

Also, nobody wants to pay the extortionate prices an old school state monopoly like Canada Post apparently is. It always surprises me that North-America holds on to their state systems where in Europe all of this is being privatized and post offices are disappearing. The monopolistic postal service is exactly why competitors can't invest in a better service.

<comment><USER29> You must be in the U.S., because you have no clue what kind of shenanigans UPS plays. For example, if a package crosses international borders, certain brokerage forms need to be filled out. You can do this yourself, but most carriers include this in the price of postage. UPS only includes it in their most expensive level of shipping. If you use UPS ground, for example, they'll tack on brokerage fees unless you do the brokerage yourself, and the fees are disproportionate! $50 on a $200 package is typical. You either have to resign yourself to wasting time on forms or buy the expensive UPS shipping, because the cheap shipping will actually be more expensive after brokerage! UPS is also very sneaky when it comes to letting you know you can do the forms yourself. Several times, UPS reps have told me I couldn't do it unless I went in person to the port the package entered the country through! This is _not_ true, but they keep telling customers that.

In short, UPS can suck it. Horrible, horrible company. They're fine if you're shipping from the U.S. to the U.S., or perhaps even from China to the U.S, but from the U.S. to Canada they are horrendous. Avoid at all costs!

</comment></comment></comment><comment><USER31> Canada Post is an entity that sustains itself solely by delivering direct marketing junk mail. As a Canadian citizen I would prefer to see it disappear entirely. If people need things physically sent to them they should rely on the private sector (FedEx, Purolator, etc).

Such a system would reduce waste and encourage digital of documents, invoices, etc. +1.

</comment><comment><USER32> What if they made the door-to-door delivery a premium subscription that one could opt-in? That could provide some revenue to offset the losses they are posting. If you decided not to get it, your mail goes to the community mailbox.

<comment><USER33> I doubt that makes much economic sense. If the delivery person has to walk to your door, he or she might as well deliver to all the doors in between.

<comment><USER34> and they could price that into the model. A person's price is $50/month - $10 per neighbor that is signed up.

</comment></comment></comment><comment><USER35> There's also the extra emissions factor. Instead of human powered clean energy they will all have vehicles, which no doubt will cost extra in gas and vehicle maint costs when we are supposed to be moving away from fossil fuels

</comment><comment><USER36> Small but perhaps worthwhile thought - I didn't see argued or tested that reduced convenience of mailbox locations and delivery might actually reduce the pieces of mail delivered using Canada Post.

Here in the US (I know, I know - different) a great deal of my daily mail is marketing material. I would definitely not walk to my post box to reach it so the reach / impact for advertisers would go down. Reduced impact would bring reduced spending. I think mailed marketing material is somewhat outmoded and wasteful, but I definitely still see it and thumb through my catalogs.

<comment><USER37> I'm not sure I follow. Wouldn't you still have to check your mail anyway for something that is non-marketing material? Once you're at the box, you might as well take whatever's there, right?

<comment><USER2> A common problem is that people simply don't pick up the marketing mail (or worse, drop it on the ground next to the community mailbox). It piles up until their mailbox is full, and then the local postal worker knocks on your door and reminds you to be a nice person and pick up your mail.

<comment><USER38> That seems like a great opportunity! Put a big recycling bin right there, but before recycling the contents go through and catalog the mass marketing mail that was discarded without being read. Then sell that information back to the marketers. Less waste, more targeted mailings, money for the post office, everyone wins!

Yeah, I'm kidding... though it might actually work.

<comment><USER39> I could see this leading to some interesting community discussion: "So, who's the ONE guy in the neighborhood that doesn't discard his Visa ads, and is responsible for all the mail we get?"

</comment></comment></comment></comment></comment><comment><USER34> IMO all things of importance fall into two categories 1) it can be sent electronically or 2) it is important enough to go get it from a central location (be it central boxes or a depot for bigger items).

Additionally: If mobility is an issue and its a good that must come physically to you (prescription for example), then its of value to pay UPS/Fedex/DHL/Competitor to come to your door.

</comment><comment><USER40> Great idea. Remember that in Montreal, you have to climb outdoor stairs covered with ice to get to the mailbox. Or roads blocked with snow.

Easier to have a common area. We already have that outside cities anyway.

</comment><comment><USER41> And of course, there's someone posting about the US Postal Service in the comments.

<comment><USER42> Assuming you're talking about the same comment I'm looking at, they do try to suggest "a North America wide attempt by Conservative Party's to destroy the Public Postal service and in turn destroy two of the largest unions." which makes it relevant.</comment></comment>


Khan Academy on 60 Minutes - <AUTHOR> http://www.cbsnews.com/video/watch/?id=7401696n

<comment><USER2> This has been a very helpful site to me personally for brushing up on some rusty concepts, and I am thankful for it.</comment>


The Halloween Core War Tournament - <AUTHOR> http://corewar.co.uk/halloween2014.htm

<comment><USER2> I never got off the newbie hill, but I loved Core War when I was a kid. This will be fun to watch, if just for nostalgia.</comment>


Larry Page Reorgs Staff, Anoints Sundar Pichai as New Product Czar - <AUTHOR> http://recode.net/2014/10/24/google-ceo-larry-page-reorgs-staff-anoints-sundar-pichai-as-new-product-czar/ <comment><USER2> I don't envy the man. Just last night I led a Google+ "Hangout On Air" for a tech meetup I organize. The whole universe around Google+ products and related tools is so dense, opaque, and counter-intuitive I felt like Bill Gates trying to use Moviemaker(1) in 2003.

(1)[[http://blog.seattlepi.com/microsoft/2008/06/24/full-text- an-...](http://blog.seattlepi.com/microsoft/2008/06/24/full-text-an-epic-bill- gates-e-mail-rant/)]

<comment><USER3> Yea, I am glad Vic Gundotra was fired. I wonder why wasn't he fired earlier.

<comment><USER4> Yeah, I'm also glad they fired Vic. And yes, @selmnoo of course Vic is going to say positive things. One, he has no reasons to say anything negative, google gave him such an amazing opportunity; and two, he is a professional executive and corporate savvy. He will never say anything negative publicly, it'll be a career suicide.

Google has one huge problem in general when it comes to hiring. I call them the China of tech companies. They have a lot of engineers and a large infrastructure so they can copy anything that works and use their scale to get market share.

Hearing from friends who have interviewed with Google, it seems to me they are good at hiring great engineers, they've hired bunch of MBAs but they're not able to hire product-driven entrepreneurs or give them space to shine.

<comment><USER5> _> they've hired bunch of MBAs but they're not able to hire product-driven entrepreneurs or give them space to shine._

Possibly related to why they acquihire so much?

<comment><USER6> No, I don't think they can acqui-hire them effectively either.

</comment></comment></comment></comment></comment><comment><USER7> This is purely speculative, but for me it looks like Larry Page may be preparing Google towards becoming a more privacy-aware company that you can entrust with information.

Why do I think this?

Trend: I think that 2014 has led to consumers becoming more actively aware of privacy. Google will be aware of consumer behaviour changing in this space. I have noticed in my general non-techie personal circle that people are far more protective of personal data and changing their online behaviour compared to two years ago. I think this is Google's current Achilles heel.

Tech: Google has so far got the best track record of security implementations which are open to anyone using their end-to-end platforms. They could seriously leverage this capability as a differentiator if it wasn't for the perception that they 'snoop' on its users.

Mission: In contrast to this Trend Larry Page has always been enthusiastic about a big vision of how consumers can benefit from sharing information to the right people, for example in the health space. At I/O 2013 this was a big topic for him: so many people's health could be improved if they would be able to comfortably share their personal data with the right people. The true value of this has massive potential.

Indications for a Pivot: Eric Schmidt is currently touring Europe, stating that Google doesn't 'read' email and does not make its money from analyzing your personal data. In the end Google's best bet may be to try to transform itself into a personal, trusted data company.

<comment><USER8> Inbox looks to be going the other direction, though. For example, they are now making it harder for you to delete e-mails. All are archived by default. Why do you think that is? Because they want to mine them for as long a possible. Unfortunately, for Americans, it also means that after 180 days the US government can get access to them without a warrant (according to the outdated ECPA).

<comment><USER9> The threat of someone looking through ancient emails aside, there really is no reason not to store old messages forever. They're incredibly small, and you never know when you'll want to reference an old discussion because someone comes back into your life.

In the bad old days before archiving, people got in the habit of deleting emails because there was no better way to get them out of the inbox.

<comment><USER10> How long ago is "old days" to you? I've got every single email (other than junk mail) I've sent or received since 1999. I use Outlook, and everything older than 30 days gets archived into a local .PST file. Couldn't be easier.

</comment></comment></comment></comment><comment><USER11> IMO Sundar has executed brilliantly at the things he's been tasked with so far, so I'm excited to see him take on more responsibility.

<comment><USER12> They should have given him Maps too.

I've recently been using Nokia HERE Maps for Android and I am liking it a _lot_ more than Google Maps (which on Android has been pretty crappy since the 6.x->7.x transition, IMO, and is forever crippled due to Google's continued pretending that people's cellphones always have a usable network connection). I've been enjoying using HERE Maps to the point where it has me considering getting a Windows phone as my Nexus 5 replacement because Maps was the killer Android app for me before they messed it up.

<comment><USER13> I've noticed Google Maps has been getting really bad recently too. It seems every quarter I notice features I used disappearing, it taking more clicks to do anything, and basic functionality like loading the search points on the map barely working (since they moved to these new card search results and you have to scramble to get the map you want).

There are some good replacements out there, at least, like City Mapper.

</comment></comment></comment><comment><USER14> Remarkably, 3 of the top 8 executives that run Google - the so-called L-Team (Larry's team) are from the IITs (Indian Institutes of Technology):

Amit Singhal(IIT Roorkee 89), Sridhar Ramaswamy (IIT Madras '89) and Sundar Pichai (IIT Kharagpur '93)

[1] [http://theiitian.com/the-iitian-tech-trio-that-runs- google-2...](http://theiitian.com/the-iitian-tech-trio-that-runs-google-2/)

<comment><USER15> It's not so remarkable considering the IITs aren't a single university. They are dispersed across all of India which is a fairly large country geographically.

Also the fact these three people come from India isn't that remarkable considering that there are 1 Billion people there. Now if they were from some small developing country like say Sri Lanka or Bhutan, it would be really impressive.

<comment><USER16> yeah, isn't it even quite the opposite, I'd be really surprised to hear otherwise. The startup scene in SF is predominantly white, but SV is nothing like that, pick any large software company and you'll find the split is something like 80% Asian, split with varying amounts between south asian and the far east (india and china/taiwan) with the remaining 20% being of european descent. Whenever I interview for a position, I can guarantee one or more of the candidates will be from one of the IITs. As someone said, with CS being such a strong emphasis in two of the largest population centers of the world, this really isn't very surprising at all. America was and continues to be an immigrant's best opportunity for prosperity with the shift over the centuries from europeans to asians.

<comment><USER17> IIT as alma-mater gives the engineer an escape vehicle from India. That is partially why you see so many of them at interviews in SV.

</comment></comment></comment></comment><comment><USER18> Definitely an uphill task from here onwards for anyone other than Sundar Pichai to become the next CEO of Google.

<comment><USER19> Well page still has quite a way to go

</comment></comment><comment><USER20> Perhaps the price of keeping him from going to MS?

<comment><USER15> I don't know. Being the head of the largest mobile operating system(that's still growing) alone should be a big enough incentive to stay.

</comment></comment><comment><USER21> "Reorgs staff"

</comment><comment><USER22> This is a strategic move to give Larry Page more free time for Mandarin lessons...

</comment><comment><USER23> The only thing I was able to think about is how the whole article was send to them by some PR and they just copy pasted it. The language. The horror.</comment>


Serving an NSManagedObjectContext over an NSConnection - <AUTHOR> http://cocoawithlove.com/2009/01/serving-nsmanagedobjectcontext-over.html

<comment><USER2> Love this blog (found it here). The idea is simple; in Ruby, you'd just be doing:

      class CoreDataClient

       def method_missing(meth, *args)

          @socket.write(Marshal::dump[meth, args]))

          l = @socket.read(4).unpack("N").first

          Marshal::load(@socket.read(l))

       end

      end

You get the same effect in Cocoa by setting delegates.

We did used the same trick in our product to get the Subversion SWIG bindings out of our Rails processes and into a dedicated evented server we could cache in; we just replaced the SWIG interfaces with facades that turned method invocation into network messages. Huge win.</comment>


Show HN: My First Side Project To Go Live - <AUTHOR> http://www.feed-alert.com/

<comment><USER2> I think you need to provide a little blurb about what the site actually does.

Also, use the placeholder attribute of the textbox to say what the purpose of the textbox is. Am I entering an email, a username, a password?

<comment><AUTHOR> hmm, placeholders should be working. Agreed about the blurb though.</comment></comment>


npm v7 beta 9 - <AUTHOR> https://blog.npmjs.org/post/628356819518210048/release-v700-beta9 <comment><USER2> Good overview for the v7 work is here:

[https://blog.npmjs.org/post/617484925547986944/npm-v7-series...](https://blog.npmjs.org/post/617484925547986944/npm-v7-series- introduction)

I've got a ton of npm fatigue, most of it related to bad decisions in the 6.X series. A lot of the things in this road map are in line with the sort of things I would do if I found myself having to write a better package manager (which I really don't want to be in charge of), so I hope that works out for them, and thus for the users.

Package installation from a remote server is just too many separate concerns to try to solve in one ball of mud, and it shows. Pushing responsibilities down the stack where the inconsistencies can be spotted with local reasoning is probably the only way to spot, let alone fix a bunch of these issues. It's frustrating to see bug reports where people say "X is happening" and the maintainers say "We only do X when you do Y," people respond, "but we didn't do Y" and then get crickets.

I'm already conserving political capital that I plan to spend on pushing us through upgrades to whatever version of NodeJS ships with npm 7.1.2.</comment>


Being the largest Hybrid Cloud customer at Rackspace - <AUTHOR> http://www.rackspace.com/blog/being-the-largest-hybrid-cloud-customer-at-rackspace/

<comment><AUTHOR> I'd love to hear from this audience what parts of our architectures would be most interesting to put together technical posts about first.</comment>


The Future of Energy Isn't Fossil Fuels or Renewables, It's Nuclear Fusion - <AUTHOR> https://www.forbes.com/sites/startswithabang/2017/04/12/the-future-of-energy-isnt-fossil-fuels-or-renewables-its-nuclear-fusion/#3e3d62f33bee <comment><USER3> Renewables decentralize energy.

The whole point is to make it not a commodity you have to constantly buy and transport, but something everyone at all levels of infrastructure could make themselves locally.

There's a Moore's law of solar called Swanson's law which is on track for what in today's terms we'd effectively call "free energy" sometime in the nest few decades.

Another big idea is that these don't require any manual capturing, transport, and feeding of fuel. You install them, make sure they are clean and essentially that's it. Nothing more to mine or constantly load into the machine.

A robust, fault tolerant, dynamic system of community and family power is the actual future and only dramatically decentralized things like that will ultimately be politically viable and sustainable.

They will more likely survive wars and infrastructure collapse; something that a model reliant on a few multibillion dollar plants will never be able to do.

Sustainability is not only about ecology but also about decomodifying energy and not having to be constantly reliant on some large group of people maintaining an infrastructure to keep the lights on.

<comment><USER4> My off-grid friends struggle to get house insurance, because without "grid electricity" insurance companies don't consider a house worthwhile (it's actually a really, really nice house, worth close on a million dollars now).

Anyway, my friend asks the insurance assessor how often he has a power failure at his house "Oh, only a couple of times a year" says the man.

In 10 years living off grid, my friends have never had a single outage.

<comment><USER3> We'll get there. The decentralization is the actual revolution more than the mechanism of solar power.

Not only is local, sustainable low cost energy production getting cheaper and easier but the post-industrial household energy use is going down.

We've replaced CRTs and incandescents. Our new buildings have better weather proofing and even our kitchen appliances have dramatically improved.

Even in places like Los Angeles, the public have been clamoring for and enthusiastically voting to _gasp_ tax themselves to build mass transit systems. The average vehicle fuel economy has been going up consistently for years. This trend towards lower cost, more efficient things is one consumers have been wildly supportive of and will continue.

The future of low energy at low cost is the stated reason that companies like PG&E are moving away from nuclear based primarily on financial forecasts.

<comment><USER5> Most people are not renewable energy enthusiasts. They don't want to install, maintain, and be responsible for their own electrical generation plant if they can just pay a utility to provide it.

People can have their own wells, or collect and store rainwater, but most don't if utility water is available.

Every home in any remotely civilized area is already wired for utility power. Utility scale renewable energy, if that can be done cost-effectively, probably makes the most sense for the most people.

Otherwise you have an expensive purchase and installation of solar panels, a transfer switch if you keep utility power connected as a backup, battery installation so you have electricity at night, etc.

It's just more complexity and expense than most people want to deal with, compared to paying a hundred dollars or so a month to the utility.

<comment><USER3> Totally agree. Unless there's a super-easy way to retrofit very few will bother. However, let's think 100 years out.

By this time, the cost threshold of things in the class of solar is perhaps a few hundred dollar fixed cost for your needs. Just like you don't need to be an energy-saving enthusiast to get a non-crt computer screen today, low-cost commodity energy generation hardware will dominate the marketplace and essentially be the only consumer-facing option.

If you are an "I don't care" consumer like most are, the cheapest and best business model would be to have either someone come by and put the thing in or to franchise it out like 7/11 so every neighborhood gets their own low-cost plant.

Either way, large power-generation infrastructure projects are likely to give way to an even larger consumer-facing power-generator infrastructure.

In the shorter term someone somewhere (maybe reading these words right now) will come along and make a version of solar or solar-equivalent tech a sexy luxury toy for wealthy people to show everyone how rich they are. It will get hyped-to-hell-and-back. Big players will slap their head and say "oh darn that was obvious" and quickly move in to snatch the market and there will be a wild ride for all the VC groups involved. It'll mint a few 22-year old billionaires from either MIT or Harvard who will be paraded as visionary geniuses for our time. So lovely.

Don't know when, don't know where, but it's coming. (ok, my real guess is geopolitics will destabilize oil prices and create a climate for adoption within the next 3 years - the cost metrics have just started working out in the past 12 months)

</comment></comment></comment></comment></comment><comment><USER6> The future of energy is nuclear fusion -- carried out in a tremendously massive reactor at a safe distance of 150 million km from the nearest civilian population. Technology to convert radiation from that reactor directly to electricity is already cost-competitive with other energy sources and the price is still declining rapidly. Together with secondary capture techniques that drive turbines based on air or water flows driven by the energy of that reactor, the majority of humanity's energy needs will be met by that one source in a few decades. Smaller reactors will never reach a cost scale to be competitive, even if they can eventually be made to function.

<comment><USER7> He said with little to no evidence.

</comment></comment><comment><USER8> Compare and ponder "Fusion reactors: Not what they're cracked up to be": [https://news.ycombinator.com/item?id=14202488](https://news.ycombinator.com/item?id=14202488)

</comment><comment><USER9> DotNetRocks (a popular .net podcast) does "geek outs" every so often on science/technology. They've done a couple on Nuclear Fusion. It gives a great overview of all the different companies and their approaches to nuclear fusion. Highly recommended.

[https://www.dotnetrocks.com/?show=1415](https://www.dotnetrocks.com/?show=1415)

</comment><comment><USER10> The main issue I see with fusion is a chart I saw (that I'm not sure how accurate it was though), that showed the amount of funding needed to achieve breakthroughs over time.

All funding for fusion was far below the level needed for breakthroughs to be made, so until the motivation and funding are at the level needed, I think we will probably not get fusion as soon as we need it. Eg 20 years from now instead of 10

</comment><comment><USER11> I was just reading about bubble fusion. From the info I found it seemed like the whole reason it won't work is because the researcher that discovered it was dishonest. (And it couldn't be replicated)

But it seems like one experimental design failing shouldn't rule out the entire concept? It seems like it's physically possible, no? Ie nothing in physics rules it out.

<comment><USER12> Taleyarkhan's failures alone shouldn't rule out a concept, agreed. A bigger problem is that although sonofusion does appear capable of creating small plasmas which in theory could be hot and dense enough for fusion, the amount of time during which the plasma remains at that temperature and density seems to be too small. In other words, there seems to be insufficient containment.

A common misconception about fusion is that containment is all about keeping the particles from leaving. But often, it is more about keeping the energy from leaving. A momentum-based containment design like sonofusion uses is subject to Rayleigh instabilities which carry the energy away in fast moving particles.

<comment><USER11> Interesting point. Is that basically the same problem NIF has albeit in a different medium?

<comment><USER12> Basically.

</comment></comment></comment></comment><comment><USER13> I am getting to feel that fusion runs out of time. They already barely have enough time for large-scale rollout before renewables overtake everything. In 10 years from now, if someone achieves net energy positive fusion, it will be solution in search of a problem - cheap and abundant electricity will be a reality.

<comment><USER14> That is a bizarre claim to make. Energy will not be far cheaper and more abundant in 10 years. Trillions of dollars are invested in infrastructure that has lifetimes of 50+ years. It is not economically or technologically feasible to undergo an energy revolution that quickly. Even if we gathered the political and financial will, our production facilities and supply chains could not feasibly handle the load of rebuilding the world's energy infrastructure in a single decade.

[https://www.youtube.com/watch?v=5guXaWwQpe4](https://www.youtube.com/watch?v=5guXaWwQpe4)

<comment><USER15> Infrastructure becomes obsolete and is scrapped all the time, disappointing investors. Newcomen steam engines didn't get to their end of life or anywhere near it, they were mostly scrapped when Watt's revolution happened no matter how new they were. You're saying that investors have been caught short by present trends. I think that's true.

<comment><USER14> That's not what I am saying. I am saying that if you are competing against something that has already been built and has 50 years of fixed costs already sunk, the hurdle to surpass it is enormous, far more enormous than competing against new marginal construction. I am also saying that energy infrastructure is a thing that costs trillions. We literally do not have the capacity to replace it in a mere 10 years, even if we built 10x the solar and battery factories and ran them 24/7\. Current trends extrapolated forward have no indication that this will happen.

(For the record, I am very bullish on solar power, having worked and consulted in the industry. But I am also grounded enough to realize that the revolution will be gradual, not done in 10 years. 10 years is not much time for something so capital-intensive. It's not like phones or computers.)

I regret even commenting in the first place, because I hate feeding the dynamic of giving attention to poor quality and ill-founded comments. I wish I was discussing something constructive instead.

<comment><USER15> Maybe what you want to say is that obsolete tech and plant has the "advantage" that it can now operate on marginal costs and ignore replacement costs since that won't be happening, making many previous "fixed costs" suddenly free and therefore not costs at all - something I well remember being taught in economics classes at university. This is true as far as it goes, but that path assumes relatively low marginal costs - not the case for energy. Coal isn't that economical - as for fracking, that's new tech not old; it may be a big part of the picture for a long while, and save some but not most of the old plant (large numbers of gas generators are a fairly recent phenomenon themselves.) From your selective choice of terminology, I don't think you've looked at economic theory in depth, here. In any case, all of this is perfectly consistent with what I said earlier.

When the transistor arrives, vacuum tubes are just swept aside despite the fixed costs. Ten years did that, less in fact, I was there. There's a rather extreme threshold effect, once the right price point is passed, the old tech just falls off a cliff. There's a great chart of that happening to Kodak due to digital photography, extremely suddenly, despite all the fixed costs. They were making their best profits one year, staring at death the next. This link is close to the chart I remember seeing. Note the extraordinary difference one year makes! Every mall had a very expensive photo developing plant, then not. Scrap value only. [https://macromon.wordpress.com/2012/01/19/creative- destructi...](https://macromon.wordpress.com/2012/01/19/creative- destruction-2-0/) Because solar power effectiveness varies geographically the cliff will be a bit smoother, of course.

Only in a real banana republic could you hold new tech off for a half-century, and you'd need to halt trade to do it.

I'm old, I've seen a lot of change, and tons of valuable things - <USER2> large amounts of infrastructure, become valueless very suddenly, not to mention my collection of VCR tapes.

There is such a thing as first-mover advantage, but that applies to new tech not old, so I'm assuming you don't mean to refer to that.

I regret your stooping to vituperation. It wasn't necessary, or accurate.

<comment><USER14> Yes, that's what I wanted to say. Which is why I said it.

Let's look at some facts:

* No one in the market agrees that energy will abundant and cheap in 10 years due to solar and batteries becoming far cheaper than natural gas. Natural gas companies have not been shorted to zero. Utilities are continuing to make capital expenditures. Natural gas plants are continuing to be built. Corporations are continuing to sign long-term power purchase agreements with renewable generators that lock in prices for 20 years. Maybe everyone is suffering from a collective delusion, or maybe energy transitions take decades.

* The EIA projects roughly flat energy consumption out to 2040, with natural gas and renewables taking share from coal and nuclear. Hardly abundant.

[https://www.eia.gov/outlooks/aeo/pdf/0383(2017).pdf](https://www.eia.gov/outlooks/aeo/pdf/0383\(2017\).pdf)

* For natural gas power plants, about 1/3 of the levelized costs are capital costs.

[https://www.eia.gov/outlooks/aeo/pdf/electricity_generation....](https://www.eia.gov/outlooks/aeo/pdf/electricity_generation.pdf)

* There are strong dynamic effects that will slow the transition. As the penetration of solar grows, the non-solar consumption peak will move to night-time and the marginal value of solar falls by about 1/2\. Conversely, as natural gas plants shut down, their cost of fuel will fall and the value of their spinning reserve and other ancillary services will rise.

* Building a transmission backbone for new utility-scale solar will take decades. San Diego's Sunrise PowerLink took 5 years of environmental review and construction, for instance:

[https://www.irwaonline.org/eweb/upload/web_novdec_12_Sunrise...](https://www.irwaonline.org/eweb/upload/web_novdec_12_SunrisePowerlink.pdf)

* Increasing the supply of large power transformers to build out a new transmission backbone for utility-scale solar will face significant supply constraints:

[https://energy.gov/sites/prod/files/Large%20Power%20Transfor...](https://energy.gov/sites/prod/files/Large%20Power%20Transformer%20Study%20-%20June%202012_0.pdf)

* Today no energy storage solution is economical. Probably the solution with the great hope of scale-based cost reductions is batteries. How many batteries would we need? World electricity consumption is about 50,000 GWh per day. If solar displaces natural gas, then for overnight and peak backup, we need storage on that scale.

[http://www.wolframalpha.com/input/?i=world+electricity+consu...](http://www.wolframalpha.com/input/?i=world+electricity+consumption+%2F365.24)

* Can we hope to even approach producing 50,000 GWh of batteries within 10 years? Global annual production of batteries is around 30 GWh a year right now. There are factories under construction now to bring that up to around 100 GWh around 2020. Given that factories take years to design and build, that means we need to scale lithium production by roughly a factor of 1,000 and scale battery production roughly a factor of 1,000 and get the plans and investment lined up in the next couple years. Is Tesla ready for 1,000 Gigafactories? Absolutely not.

[http://www.visualcapitalist.com/wp- content/uploads/2015/05/l...](http://www.visualcapitalist.com/wp- content/uploads/2015/05/li-ion-featured.jpg)

Regarding your transistor example - First, according to Wikipedia and Science magazine, the transition was gradual over the 50s and 60s:

[https://en.wikipedia.org/wiki/Vacuum_tube](https://en.wikipedia.org/wiki/Vacuum_tube)

[http://www.sciencemag.org/news/2012/05/return-vacuum- tube](http://www.sciencemag.org/news/2012/05/return-vacuum-tube)

Second, the size of vacuum tube industry was never the size of the global energy industry. Building new transistors factories can be done. But building new factories to ramp up to trillions in battery and solar cell production within a single decade is ludicrous.

P.S. I would appreciate it if your comments didn't assert to me 'You're saying' or 'Maybe you're trying to say.' It's more polite if you say 'What _I think_ you are saying is....'

<comment><USER15> No you didn't say it, there was no way to tell that you hadn't factored in threshold effects from your first post, nor that you had glossed over high marginal costs for energy. Points you then pointedly ignore when replying.

If you don't want to be asked what you're saying precisely, you just have to provide more detail earlier, or at the very least the proper rubrik. I just don't understand the hostility here mixed into factual matters.

There's little to answer in your last post. Your definition of gradual was decades; re solar power it's already been decades, but the actual transitions to new technologies - the mass adoptions - happen quickly - so you're really changing the subject. The first consumer product (radio) to appear in my city with transistors came in the early sixties, at a price of $79 - a fortune then - but only a few years after that, you couldn't buy a regular radio with tubes. The transition was very rapid. Kodak's stock took a long time to fall to earth, but the loss of revenue was sudden, and massive.

Re transmission - solar will strongly tend to be local. Batteries: you can look up discussions of Vanadium batteries (just one novel tech) elsewhere on HN, but note that individual batteries are now being built that are nearly 1GW - so 50,000 GW is very far from impossible - even if that figure turns out to be accurate. Not impossible at 5 cents a watt. Betting that this or that is impossible is usually a bad bet. [https://www.forbes.com/sites/jamesconca/2016/12/13/vanadium-...](https://www.forbes.com/sites/jamesconca/2016/12/13/vanadium- flow-batteries-the-energy-storage-breakthrough-weve-needed/#a6ee7675bde8)

Actually, far larger "batteries" exist - reversible dams, many built only for energy storage purposes. Analogous mass systems have also been proposed using air and salt.

<comment><USER14> I apologize if I came off as hostile. I don't feel hostile. In any case, I think it's fine to ask folks for clarification. But I think it's rude to assert: "What you're trying to say is..."

Also, even if Vanadium flow batteries achieve commercial success and drop energy storage costs down to 5 cents a kWh, that's still above wholesale electricity prices of 2-4 cents a kWh:

[https://www.eia.gov/electricity/monthly/update/wholesale_mar...](https://www.eia.gov/electricity/monthly/update/wholesale_markets.cfm)

Lastly, the EAI disagrees with your assertion that solar will be local (which I interpret to mean rooftop). It forecasts lower costs and higher volumes for utility-scale installations, which benefit from greater economies of scale.

<comment><USER15> Again, nobody can tell where your argument went wrong if you don't provide the steps, so all anyone can do is ask.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> Would be great if we could harness fusion energy. But in present and near future, renewables are the saviours.

<comment><USER17> Renewables are simply fusion capture at a distance ;)

<comment><USER18> I like the joke that my house is fusion-powered; the reactor is of course located in a remote industrial area, for safety, and I rely on an array of roof-mounted receivers for long-range wireless power transfer. Conveniently enough, this reactor happens to be a deregulated and tragically undersubscribed public utility service...

<comment><USER17> Love your comment. Reminds me of something I'd read in a Douglas Adams book.

</comment></comment></comment></comment><comment><USER19> Isn't the power production inside the sun on the order of 300 W/m3? Is it at all reasonable to think we could scale this process to 0.1-100 MW/m3, to become economically viable?

</comment><comment><USER20> Fusion is the future of energy... and always will be.

<comment><USER21> Always just 20-30 years away, always lots of new and promising experiments results that are _just about_ to pay off.

<comment><USER20> zactly.</comment></comment></comment>


Apple EFI Firmware Security Vulnerabilities - <AUTHOR> https://trmm.net/EFI <comment><USER2> Remember when BIOS flash ROMs were write-protected with a physical hardware switch/jumper? It was an extremely simple measure that basically made it impossible for the BIOS to be corrupted by software, malicious or otherwise.

It was certainly "inconvenient" to perform BIOS updates, but back in those days BIOS updates weren't all that common either. I don't think it should ever be "convenient" to do something like that with basic system firmware - by its very nature, it is supposed to be stable and rarely changed. Somehow this is making me terribly nostalgic... for the days when BIOSes seemed far less buggy and in need of constant change. Now, I hear stories of laptops with factory- installed crap that silently updates the BIOS in the background(!), bricking the machine when something else unfortunate happens coincidentally with it (e.g. hard reset.) I remember the ritual of "boot from a floppy to a plain DOS prompt, run the updater, and wait for a few tense seconds as it updated the BIOS".

The mention of "Thunderbolt Option ROM" makes it clear that Thunderbolt is basically an external version of PCI(e). In other words, even without being able to modify any firmware, plenty of other maliciousness is already possible - the same with any other device that has direct access to the system bus. In the same way that you probably wouldn't plug a random untrusted PCI(e) adapter into your system, you should exercise the same caution with Thunderbolt...

<comment><USER3> I'm not sure if the jumpers were meant as a malware protection.

        [...] make it impossible for the BIOS to be corrupted
        by software, malicious or otherwise

The jumper could enable the erase voltage for the flash. On the other hand it could also just pull up or down a pin that is queried before the flash routine does its work. For example one Intel Mobo manual[1] says explicitly the jumper protects from _accidental_ corruption.

        Jumper JP4 controls the protection scheme that
        prevents accidental damage to or rewriting of the data
        stored in Flash memory.[1]

[1] [http://www.manualslib.com/manual/77721/Intel- Iwill-P4d-N.htm...](http://www.manualslib.com/manual/77721/Intel- Iwill-P4d-N.html?page=40)

<comment><USER2> That is an interesting example of a hybrid protection scheme - you get to choose between "software decides", "always protected", and "always unprotected". Given that the jumper is located right next to the flash, I'm inclined to believe this is a true hardware protection; likely the middle pin is connected to the write-enable of the flash, the left pin is connected to a GPIO so the software can control it, and the right pin is connected to a constant voltage to disable any writing via hardware. The open position leaves the pin free to allow writes.

</comment></comment></comment><comment><USER4> Out of curiosity: Can anyone point me where to find how a recent x86-cpu actually boots? Where's the code that gets executed in the first few CPU cycles?

The bulk of the firmware, that's clear, nowadays will be fetched from a serially connected flash, which this initial code will copy to the (then initialized) DRAM, also probably in several stages. But where do the first few instructions hide? Mask-rom in the CPU, or the chipset?

I know how initial bootup works on my day-job-default-CPU (a m68k/coldfire that basically just starts executing from a parallel connected flash), on a few ARMs and some PPC, but I have no idea about a "typical" intel core/i5..7/... CPU.

<comment><USER2> The first "code" would probably be microcode in the CPU itself, but if you mean x86 instructions, recent CPUs boot in the same way as the orginal 8086: the first instruction after a reset is fetched from FFFF:FFF0, or 16 bytes less than the end of memory, in realmode. The BIOS ROM is mapped into this area.

There are some good articles here:

[https://sites.google.com/site/pinczakko/](https://sites.google.com/site/pinczakko/)

<comment><USER4> > the first instruction after a reset is fetched from FFFF:FFF0

I trust you that this logically will certainly be true, but: what memory will that access to ffff:fff0 be mapped to if the "bios" in my PC is stored in a SPI flash that certainly can't be connected directly to anything resembling a "address/data-bus" in a modern PC...

<comment><USER2> There is circuitry that translates the requests from the CPU into read commands to the serial flash. Depending on the system, this can be in the LPC- connected SuperIO, the southbridge, or on laptops more likely part of the EC (embedded controller) which is also connected via LPC. This is also why executing from the BIOS is _slow_ \- SPI flash bandwidth is in the dozens of MB/s range, and if it's going over LPC the max bandwidth on that is <16MB/s.

If you're really interested in this stuff the articles in the above link are a good read, as well as datasheets for the various chipsets involved. I'd recommend even looking at the original IBM PC/AT Technical Reference, with BIOS listings and full schematics.

<comment><USER4> Indeed, fascinating! The CPU will have to wait thousands of waitstates for each bytes from the SPI-flash, but who cares in the first few ms of booting ;-). Thanks for pointing me in that direction!

There's quite some information also in the "7-series chipset datasheets" (and 8-series) from Intel, it seems that they have a very elaborate SPI implementation, in the chipset, in hardware...

</comment></comment></comment></comment></comment><comment><USER5> [http://theinvisiblethings.blogspot.ca/2011/09/anti-evil- maid...](http://theinvisiblethings.blogspot.ca/2011/09/anti-evil-maid.html)

 _" Anti Evil Maid is an implementation of a TPM-based static trusted boot with a primary goal to prevent Evil Maid attacks.

The adjective trusted, in trusted boot, means that the goal of the mechanism is to somehow attest to a user that only desired (trusted) components have been loaded and executed during the system boot. It's a common mistake to confuse it with what is sometimes called secure boot, whose purpure is to prevent any unauthorized component from executing._"

<comment><USER6> I was just coming here to say I would pay money for a pre-rootkit-rootkit. Someone has to get there first and it might as well be my own code.

</comment></comment><comment><USER7> Can their be an external IO port that is both (a) fast and (b) access limited?

\-- BadUSB shows that the USB controller can fake keystrokes, modify the recipient USB controller, etc.

\-- This attack now shows an even more dangerous attack that can be mounted by a malicious thunderbolt adapter (the one that you unknowingly connected by habit at a conference, say).

Trammell is giving a longer talk about this work at CCC next week. ([http://events.ccc.de/congress/2014/Fahrplan/events/6128.html](http://events.ccc.de/congress/2014/Fahrplan/events/6128.html))

The attack is implemented (he has a demo macbook with "ThunderStruck" bootloader), and it has been disclosed to apple >400 days ago.

One aspect of the attack can be patched with 2-byte change, but apparently apple hasn't bothered.

<comment><USER8> > Can their be an external IO port that is both (a) fast and (b) access > limited?

Yes. eSATA is one example. 10 gigabit Ethernet is another. DisplayPort is, for certain applications.

</comment></comment><comment><USER9> I believe that the two year old Option ROM vulnerability to which this post refers was this one described by Loukas(snare) at Black Hat and Ruxcon 2012: [https://www.youtube.com/watch?v=XcFvgAsfdqg](https://www.youtube.com/watch?v=XcFvgAsfdqg)

Although I may be wrong, it's certainly a related vulnerability and an interesting presentation to watch. Skip to ~54mins if you just want to see the demo.

</comment><comment><USER5> [http://puri.sm](http://puri.sm)

 _" The first high-end laptop that respects your freedom and privacy. The Purism Librem 15 is the first laptop in the world that ships without mystery software in the kernel, operating system, or any software applications."_

<comment><USER10> >i7-4770HQ

haha

Intel cant even get rid of binary blobs from their official open source Atom platform (minnowboard).

Intel UEFI bios is >100K lines of hand tuned spaghetti code that never saw version control system, thats straight from the mouth of Intel employee.

<comment><USER11> I know that legacy BIOS has its issues, but from what I have seen and read, EFI/UEFI is a quagmire.

<comment><USER12> (U)EFI is essentially a little OS that eventually loads the OS that runs the software you care about. Intel sponsors most of the core OS code (mirrored) at: [https://github.com/tianocore/edk2](https://github.com/tianocore/edk2)

A Bios vendor takes that code, drops in a bunch of hardware init code from Intel (or AMD), adds thier own user interface, "csm16" old-school BIOS implementation, and value-adds like debugging and automation for factory test and provisioning.

In order to comprehend anything in the codebase, the first step is probably to get acquainted with the local vernacular. [https://github.com/tianocore/tianocore.github.io/wiki/Acrony...](https://github.com/tianocore/tianocore.github.io/wiki/Acronyms- and-Glossary)

</comment></comment></comment></comment><comment><USER13> What I find most incredible about this is that apple has been told about this over and over again for the past 600 days, and did nothing would be the bigger issue.

I have watched Trammel demonstrate this attach right in front of me about a year ago. Apple has repeatedly ignored the fact that they are vulnerable.

It should also be noted that while this talk is Apple focused, it not a Apple thunderbolt specific attack. It affects all badly implemented thunderbolt ports.

Apple's growing popularity and strong hardware standardization makes them especially susceptible to the wormificaiton of this attack. How many offices have a supply cabinet with thunderbolt to HDMI/Ethernet/other connectors that are shared around the office freely?

</comment><comment><USER14> Wanted:

\- "Tripwire" for firmware - host-based (not perfect) & bootable live cd/usb/image (still not perfect)... Perhaps some JTAG verifying device that could be hard-wired to all supported chips directly? (Very painful to setup, but potentially interesting.)

\- Host-based peripheral firewall (not perfect, but more usable) - e.g.: selectively disable, ask user permission and/or limit rights to connecting devices from the various buses: USB, FW, PCI, SD card, SATA/SAS, BT, TB, SPI, FC, ... On OSX, it's doable considering VMware Fusion "patches" IOKit (check out IORegistryExplorer) selectively based on user preferences (whether to redirect a USB device to a guest or to the host).

<comment><USER15> The second thing you mention already sort-of exists in the form of qubes os: [https://qubes-os.org/](https://qubes-os.org/)

</comment></comment><comment><USER16> > the larger issue of Apple's EFI firmware security and secure booting with no > trusted hardware is more difficult to fix.

IMO this shouldn't really be a problem. If the SPI payload disables writes before executing anything unsigned, then it's really quite hard to bypass.

Presumably the bug is a result of EFI capsule on disk support. The design is sh*t for exactly this reason.

The firmware could lock the flash, detect the capsule after initializing option ROMs, copy it to RAM, do a full reset, then find the capsule in RAM and verify a signature prior to re-locking the flash, though.

</comment><comment><USER17> Would it be possible to create a virtual thunderbolt port similar to virtual cd/dvd drives? and if so would that be vulnerable?

</comment><comment><USER18> Has anyone looked at using VTd to secure Thunderbolt devices from the system bus?

<comment><USER16> That wouldn't help. This attack happens long before the OS loads, and EFI explicitly _executes_ code from the option ROM, so DMA isn't even involved.

</comment></comment><comment><USER19> Curious as to why the title is "EFI Firmware Security" and not "Apple EFI Firmware Security," which is the title of the piece linked?

<comment><USER20> Do we have reason to believe that non-Apple implementations are any better?

Most non-Apple computers don't have an external PCI bus, so there's that.

<comment><USER19> No, not necessarily, and yet the article was specifically about an Apple exploit. Just seemed off to omit that from the post title.</comment></comment></comment>


A Web Of Apps - <AUTHOR> http://techcrunch.com/2011/12/30/a-web-of-apps/ <comment><USER2> i'm not convinced that app discoverability is a problem that needs to be solved. yes, there are 600K iOS apps and most of them are dying in obscurity. but that's a good thing. most of those apps are utter garbage and deserve to be obscure.

good, useful apps do not have a discoverability problem. it isn't hard to find the evernote app. i go to their website and get a link to it, or i type it in to the search box in the market. it is much more difficult to find an evernote rip-off, but why would i want to do that?

i find the list of obscure startup names tackling the app discovery problem to be fairly telling. if i've never heard of your discovery service, i won't be discovering much on it. they need to solve their own discovery problem before they attempt to solve anybody else's.

</comment><comment><USER3> I think there are at least 2 big areas for innovation around app discoverability: social + location-based. Social refers to being able to easily find out what apps your friends or people you trust are using. As with most other behaviors, social has a big influence on what apps we may want to use. On the iOS, at least, innovation is partly blocked by iOS API that don't allow an app to enumerate all the apps that are currently installed.

For location-based discovery, imagine you go into Home Depot, and the app that lets you self scan in products and self check out automatically gets pushed down to you (or notifies you to be available). That sort of thing doesn't happen yet, and there is certainly opportunities for innovation.

</comment><comment><USER4> Software discovery is an unsolved problem. Apps is just a particular part of the whole problem (an important one nevertheless).

This is particular bad for games. What is the best game? It really depends on the user taste. Sites like Kongregate apply usual recommendation algorithms to ease this, which, I believe, is a nice first step in the right direction[2].

[1] <http://www.kongregate.com/>

[2] [http://venturebeat.com/2007/11/11/facebook-search-expands- wi...](http://venturebeat.com/2007/11/11/facebook-search-expands-will-it-take- on-google/)

</comment><comment> k-mcgrady URL Schemes (and intent filters) could be really useful if it was easier for developers to use. Launching another app with a URL scheme is simple if you know the URL but in order to do something useful the app you link to would need some sort of public API you can work with and pass data to.

The most visible, useful, example of URL schemes is Facebook SSO. When a user logs into your app using you Facebook credentials they are redirected to the Facebook app (or website) where it authorises your app and then uses your apps URL scheme to return the user back.</comment>


CERN frees LHC Data - <AUTHOR> http://www.symmetrymagazine.org/article/november-2014/cern-frees-lhc-data

<comment><USER2> This is great.

Check out [http://opendata.cern.ch/](http://opendata.cern.ch/) for more info. Pretty neat visualization tool they got there: [http://opendata.cern.ch/visualise/events/CMS](http://opendata.cern.ch/visualise/events/CMS).

</comment><comment><USER3> Previously: [https://news.ycombinator.com/item?id=8635698](https://news.ycombinator.com/item?id=8635698)</comment>


Show HN: Geofable – tell stories with maps - <AUTHOR> https://geofable.com <comment><AUTHOR> Hi HN,

I'm Dan from Geofable. We're building a tool for telling stories with spatial data using interactive map-based infographics.

Our team has built geospatial software for the US Government for the past decade, and we've seen the same problems come up over and over: existing map- making tools are expensive, hard to use, and often don't make good looking maps. In order to make maps that do look good, agencies end up hiring entire teams of GIS experts, programmers, and graphic designers.

Geofable is a new tool with the goal of making it easier for people to build visualizations with their spatial data without being an expert. We're currently in beta, and would love your feedback. Thanks!</comment>


Millionaires Cash Out Of California - <AUTHOR> http://blogs.forbes.com/digitalrules/2007/07/millionaires-ca.html

<comment><USER2> PG, you wrote the following some time back:

> What it takes is the right people. If you could get the right ten thousand > people to move from Silicon Valley to Buffalo, Buffalo would become Silicon > Valley. (<http://paulgraham.com/siliconvalley.html>)

If the millionaires are really moving out of CA, shouldn't this herald the move of a silicon valley type startup atmosphere to the city or cities millionaires are moving?

<comment><AUTHOR> hmm not sure... I think if millionaires are moving out, it doesn't mean entrepreneurs are

</comment></comment><comment><USER3> The article wasn't completely clear about where these millionaires are actually living. One client saved nearly 100K/year by declaring a primary residence in another state (Wyoming). Does that actually mean he/she lives there?

Another thing - almost anyone who bought a modest house in a nice neighborhood in most of the bay area, los angeles, san diego, santa barbara... more than 15 years ago is probably a millionaire on paper. I have a feeling a lot of these millionaire cash outs are retirees tapping home equity.

But are high tech entrepreneurs, flush with a mil from their first success, eager to leave silicon valley and resettle in Wyoming? Seriously doubt it.

</comment><comment><USER4> If it's just tax evasion they may still be living and doing business there. A Wyoming millionaire can invest in a California company.</comment>