HN user

RomP

351 karma
Posts4
Comments38
View on HN

It was speeding. Bill is well-known for his love to fast cars. Later, in Seattle, he held the record of fastest Microsoft -> SEA airport drive, for a very long time. The legend says it was only beaten by someone illegally using HOV lanes, but Bill very justifiably refused to recognize that time.

This is simply unkind to the competition (and to the poles alike): "Tesla achieved this outcome by nesting multiple deep aluminum extrusions in the side rail of the car that absorb the impact energy (a similar approach was used by the Apollo Lunar Lander) and transfer load to the rest of the vehicle. This causes the pole to be either sheared off or to stop the car before the pole hits an occupant."

There's winning and there's crushing the opponents. One shouldn't gloat in the latter case, but this case deserves an exception.

Congratulations Elon and the team on tremendously nice engineering!

How about the following schema for adding a new key to the list of Authorized Keys when NO AUTHORIZED KEY IS PRESENT:

* the procedure requires a module produced and sold by the manufacturer() to any garage that can verify its identity and satisfy manufacturer's specified security requirements (e.g. owning a safe and having no history with local police);

each such module is unique. It contains unique public/private keys and its public key is singed by the manufacturer;

* the procedure of adding the key to the list of Authorized Keys requires the car (actually, its ECU) to only accept incoming requests signed by such modules whose public keys are signed by the manufacturer. When the key is added, the ECU stores:

the key info;

the module's unique ID (IMPORTANT);

timestamp + lat/long;

* if there are no old authorized keys present (very rare scenario, since most of the time the owners want to replace just one lost/stolen key, but not both), the ECU requires 15 minute grace period with the module attached at all times, during which the car is flashing its hazard lights and honks. It makes a small nuisance in the garage once in a while, but attracts enough attention in the middle of the night if somebody is stealing it.

Now, if the car is stolen and then recovered, the police would dump the list of authorization requests and identify the module used. If this module was stolen or copied, the garage who owned the module becomes responsible for the damage to the car's owner. The ID of the module is placed on the revocation list. The revocation list is broadcasted via Sirius/XM/FM/BMW Assist/OnStar/Intelsat/etc.

This allows independent garages working on the cars, but places enough responsibility on them for keeping the system secure, with the override mechanism in form of revocation lists.

This method would NOT prevent all types of thefts (thugs can put the car on the flatbed and do the swap in the middle of the desert, or they can swap the ECU unit completely, or do some manipulations with the stolen "good" key), but it makes it significantly more difficult to authorize a new key and drive away.

(*) in case the manufacturer ceases to exist, some other company (another car manufacturer, perhaps) inherits the master key and will be responsible for authorizing garages to do key management.

I'm one of them. I asked this same question in my team a few weeks ago: I got very similar sampling. The team is composed of 7 hackers (native code, embedded speech-related software). In other words, I tend to believe the results we're getting so far.

Fly the Airplane 15 years ago

I'm not an Airbus engineer and I'm not privy to their research (undoubtedly many thousands hours involving scenarios we can't even imagine) and the reasoning behind this design. This catastrophe is rooted in human-machine interface and we should wait for the official investigation report, which will come very shortly and will include recommendations to aircraft designers (including UI aspects), training procedures and crew management procedures, to mention just a few.

My layman view is that the first step in principle "fly-navigate-communicate" could be accomplished by placing the aircraft into the "pitch an power" configuration: 5 degrees nose up + TOGA. This didn't happen. But this is my layman view: I'm down here in a comfy chair with a cup of tea, and they were up there, in a thunderstorm with flashing warning lights, frozen pitot tubes and 228 souls behind their back. We shouldn't judge them: we should only learn.

Fly the Airplane 15 years ago

Great narrative, but factually wrong on at least two accounts:

>If the pilots has switched a button to re-enable autopilot, everyone on board would have lived. But they didn’t. One co-pilot made a single, absurd mistake–for twenty full minutes–that brought the plane down.

First factual error: The button they should've switched is not the auto-pilot button (which they operate many times per flight), but the flight mode button (which most pilots never operate in their career). When the plane lost at least two of the three pitot tube readings, it went from the NORMAL "Law" to the ALT "Law", where the airplane doesn't guard itself against many pilot errors. When the pitots de-iced shortly thereafter, the plane did NOT go back to NORMAL "Law": it had to be switched there manually. The pilots did not do that and it seems to be the consensus so far (can't state that for certain before the official report is released) that they did not realize they were flying the plane in ALT and then DIRECT Law.

Second factual error: the "absurd mistake" lasted nowhere near 20 minutes. The first problem appeared at 2:10:03UTC and flying into the ocean occurred at 2:14:28UTC -- 4 minutes 23 seconds in all.

Can't find any English sources, but here's the link to what appears to be the source for most of the charts: http://peregrins.com/elect/results.csv.gz

And here is the official (government-provided) results: http://www.izbirkom.ru/region/izbirkom, also in Russian, but Chrome does an OK job translating it.

I did NOT check if the table from the first link is consistent with the data in the official results. Somebody more determined than I should do that. This page: http://eugenyboger.livejournal.com/4514.html publishes the scripts used for composing the csv file from the official results.

not really an API, but related: touchless/cardless ATM:

an App on my phone which I can use to find the nearest ATM and make a withdrawal. It knows my account credentials. I tell it how much cash I need. The app generates the transaction, encodes it in the QR code. I show the phone screen to the ATM's camera. The ATM dispenses the cash, takes photo of the person receiving the money and attaches it to the transactions log/statement.

No germs exchanged, no risk of skimming, more security (password vs. 4-digit pin code), no need to carry the ATM card around.

This has been answered million times: besides the historical reasons (which are extremely powerful), it's performance. Performance not as in how fast would it take to calculate this, but performance as in what is the worst case scenario for calculating this. Think Garbage Collector, mostly. But also think ability to control exactly how the data represented and stored in memory. Tighter storage == fewer cache misses. Market moves away while fluffy managed data travels from RAM -> cache -> CPU.

If one watches a few more episodes of the show, it would become obvious that the Prius fuel consumption test was a joke, like everything else in the show. Come on, we can do better than expecting a fair review of a hybrid car from a guy who comes up with increasingly witty descriptions of his erections caused by the power and speed of various sports cars.

Edit: it probably didn't come across like it, but I think that the show is hilarious and it is one of the very few reasons to own a TV. But a car review show (as in, the source of information on the automotive industry) it is not, and is not meant to be.

It's similar to saying that having expendable bullets and grenades is OK until you use the last one while still on patrol. Solution: preparing for it by taking more. Knowing that they're designed to fail/be repaired easily changes the approach. The argument I'm trying to make is that it would be cheaper/lighter/more_versatile to get many expandable droids than to get one robust and universal.

Also, highly-adapted droid != highly-adaptable droid. There is no need for an amphibious droid in Afghanistan, just like one doesn't use the same apparel in all climate zones. As long as interface/principles are the same (like a PC), various versions of it can be used in (almost) any environment without extensive re-training.

Some of the things you're listing are must-haves (secure channel), but most are not. If increasing reliability and versatility makes the drone last 10 times longer and costs 10 times more -- it's not worth it in the long run: it's goal to trigger the first IED it can find, anyway. Even if it's not, it still would be cheaper and easier to buy 10 drones or make them modular enough so anybody with some X-Box experience can snap a new one together in the field. Manuals? -- nah, see the X-Box thing above. Besides, who reads RC cars' manuals? Replace/repair? -- a dumpster full of modular parts is lightyears ahead of any repair technician in the field. Production lines? -- there already exist production lines for RC cars, aren't they?

To put it in the familiar context: what you're describing (and what DoD is used to) is a mainfraime. These guys just made a PC.

It's not the OS. It's the hardware. While USB devices are somewhat more difficult to use for exploits like this, any FireWire or PCMCIA device has full access to the RAM through DMA channel (1)

Worth repeating: they can read ANY page in RAM. Including those which contain user key hashes, session hashes and any password which happens to be stored in clear in memory.

While OS can protect process' memory from all other processes, the DMA is one level closer to the metal. No matter what OS you're running, plugging random devices to your system means the game is over.

(1) HW virtualization mitigates some of these risks: I'm not familiar with the details of it. But since most of the machines are running without the HW virtualization still, they are still vulnerable.

edited for formatting

I sometimes wonder how long would it take for the civilization to re-create the current level of technology, if all the material artifacts disappear one day: books, computers, robots, factories, even hammers. If all that remains is the current level of knowledge in the heads of 7bln people, how long would it take from the stone age to Core i7, heart transplants and Boeing 787s? And how much different the world would be if we had to re-create this from scratch without the legacy of previous technological generations?

A little over 100 years ago the humanity just learned how to overfly one football field.

In space, today, we're in pre-aviation days: we're still using hot air balloons for transportation. We make them lighter than air (i.e. shoot them up in space) and let the wind (i.e gravity) to carry them places.

Imagine the most educated human 120 years ago is being told about planes heavier than air, air transportation over oceans, jet-powered planes, autopilots and fly-by-wire, not to mention people on the moon. He would say it's impossible, due to energy constraints. Today a daily JFK-NRT flight uses more energy than all the horses which lived two centuries ago would be able to produce in their lifetimes, combined (my math may be off by one order of magnitude: it's late here). Today we're this person. Educated enough to have valid arguments against it, but utterly incorrect.

You're attacking my use of the "obvious" word. Yes, the obviousness needs to be applied at the moment of the invention -- I agree wholeheartedly. I also agree that talking about obviousness of the already patented invention today is pointless: the information is published and everybody can claim that they had the same idea. We're on the same page here.

Now, the differences. The idea of storing markup and data in separate containers, at least one of which is XML-based is not something anyone with knowledge of XML can not think of. Let me re-read the patent in question. Yep, I got it right. While I can't turn off my hindsight, I can't also think that CSS doesn't fit into this, as well as many other technologies. BTW, i4i, in case you're reading, I didn't give you this idea and you can't use it, at least because CSS is at least 2 years older than issuing date of patent 5787449. Which reminds me of the prior art arguments, but I digress.

All that is neither here-nor there. You say it's not obvious -- I say it is. What really matters is the goal of the exercise. Patents were created when inventions were _hard_. Coming up with the idea of pumping air out of the glass tube with wolfram wire in it required lots of costly tests, trials and errors. Do you know how many stores stocked wolfram back then? Patents were created to _encourage_ innovation on the assumption that not too many people can afford innovating in the same field at the same time. Fast forward to today. Coming up with software patents today requires a whiteboard, a Word document and a phone to call a lawyer. I know, I have a few of those (equally embarrassingly obvious, I must add). Does it protect me and my invention _today_? Nope, since I can't afford to sue somebody even if I can prove beyond a reasonable doubt that the patent has been infringed on. Big companies plow over individual investors with their army of lawyers. The opposite, however, is not true (the in-app purchasing patent story is the point in case).

Another aspect of patent situation today is the shier vastness of the field. Who can afford doing patent searches for literally every line of code before it is written? So we all are forced to live on the minefield. This serves as an argument against innovation by individuals. And that brings results which are directly opposite to the original goals of the patent system. Which is not a good thing.

This is an abomination. This patent clearly fails the obviousness test (that is, if somebody is capable of reading the patent all the way through without being disgusted and embarrassed for the "inventors"). Unfortunately, most of the software patents are like this: the Patent Office is clearly failing us. Math formulas are not patentable, and software is just that: math.

Seems like our only hope is if somebody powerful and famous, with a big software patent portfolio, can sacrifice it for the good of the industry and advocate for banning software patents. Steve Jobs and his position against DRM in music comes to mind as a similar move. Wouldn't it be great if leaders of the industry get together and petition/lobby for this change? One can only dream...

I wish the point about adding and removing people to the thread had some more rules, like:

* if people are added to the thread, the body of e-mail should start with [adding A and B so they can {do X}];

* if people are removed from the thread, they should be BCCed and the first line of the e-mail should read [BCCing C and D for now to minimize the noise].

Also, can't really agree with the breaking up e-mails point. It's usually costlier to follow extremely branchy thread than to filter the relevant points from a linear thread.

[edited for formatting]

I always thought that what Apple does best is taking a cumbersome consumer device and making it simple. E.g. iPhone replaced 4 or more devices with one (phone, iPod, internet+mail client and GPS, at the very least, and that happened before the AppStore opened). I really don't think that people at Apple sit around the table and think in terms of vertically integrated models, platforms, monetizing and all that other high-level stuff. I bet they think about user experience and do what needs to be done to achieve it. Integration models, platforms, partners, etc. come in next, they are secondary in the big schema of things.

From the user perspective, people need simple access to the following types of content: * real-time (think ESPN, Speed Channel and breaking news) * near real-time content (talk shows, nightly news, first-run TV shows) * archived content (moves on DVDs)

The archived content problem is solved by Netflix. The near-real-time problem is solved by Hulu (some networks, like HBO and Showtime are not there yet but will be once paid subscription becomes relevantly popular). The real-time problem is not solved -- flash-based players on news sites do not count. Apple might be able to to the third one, the way the newspapers are now published on the iPod.

In my view the opportunity is to bring all 3 types of content into one box, under one UI and wrap it into the nice user experience. Add IP-only delivery and a-la-carte subscription (e.g. I want monthly pass to 3 shows from Showtime and one show from HBO, but not the whole network), and users will ditch their $150/month settop boxes in droves.