justabystander

Plenty of people claim that they're scared to contribute because Linus might yell at them. That's unfounded for a lot of reasons.

TL;DR: Test your code before you submit it. Don't accept or acknowledge patches from others that haven't been reviewed or tested. And if you make a mistake, own up quick and he's not going to yell at you. It's pretty simple.

He will occasionally jump in and yell when people aren't accepting responsibility for problems they caused. Especially when they won't accept nicer, less authoritative criticism from their peers.

That's what happened in this case. Check the follow-up message in the thread where Linus explains his dissatisfaction (http://lkml.iu.edu/hypermail/linux/kernel/1710.3/02507.html). The contributor who caused the regression was caught denying that there was even a regression. His patch had already long been identified as the culprit and reverted. But over the course of three weeks he was insisting that it was not a kernel regression. Essentially he dug in for 22 days saying that it wasn't his problem. And he wasted tons of valuable contributor time where people were nicely telling him that, yes, it was indeed a regression.

Multiple people were telling him about the "don't break userspace" policy and how it was a regression. And yet that contributor was still deflecting responsibility for the problems caused. But the problem is that this patch would leave the distros in the lurch - scrambling to update their configuration before the kernel breaks behavior. And that's without any ETA on their "long term ... flexible solution" (http://lkml.iu.edu/hypermail/linux/kernel/1710.3/00380.html). Thousands of people with varying levels of technical competency would have had their systems break in unexpected ways.

Quite frankly, he earned the dressing down. And plenty of people tried to be nice to him about it. It just didn't take hold in his mind until Linus dropped in to rudely remind him that even "correct" behavior is a regression if it breaks userspace. Also note that Linus said the issue had been escalated to him. Someone explicitly brought this to his attention because there was a distinct lack of progress due to CYA responsibility deflection.

It's not a regression unless something was broken first, then fixed, then the SAME ISSUE comes back in a later code change.

No, it's when a change results in unintentional behavior that breaks previously supported scenarios. You might want to double-check your definition. I think you're actually referring to a recurring issue.

It might not be about commercializing so much as including it in some of the *BSDs which don't allow for GPL code in the core. Otherwise, they'll probably have to write a new implementation. But yes, there is that risk.

The OpenVPN Windows kernel TUN/TAP driver is really super scary.

I believe you. Everything about OpenVPN code scares me. Not sure if it helps, but I checked out an article by Dmitri Varsanofiev on using the TUN/TAP driver (http://www.varsanofiev.com/inside/using_tuntap_under_windows...) and it seems he was able to work with the driver from managed (C#) code without actually modifying the driver source at all. It seems he was just invoking two Win32 API call methods from Kernel32.dll: CreateFile and DeviceIoControl. If he can do it from C#, it should be doable from rust.

From his sample, it seems you could work with the tunnel device without modifying the source code at all. Although that means you've still got a major code wart from OpenVPN haunting you. And even if it works, I'm not sure if that's the recommended approach. But if you're insistent on supporting Wireguard on Windows versions before 10, the TUN/TAP driver might be the only route available. I don't think those VPN APIs existed in Windows 7 and I think they were private in 8/8.1, if memory serves.

The good news about the UWP APIs is that you once you confirm that it works, you could potentially get it up on the Windows store and make it easy for people to install and update. Though there's tons of notes that the VPN APIs are restricted, and you can only publish apps that use them after you get reviewed and your account gets those permissions. You can still sideload, (locally install) though. Honestly, I don't think the review would be a huge obstacle, though. I think Wireguard has some fans in MS.

By the way, if you're into Windows programming and want to help out, don't hesitate to email team@wireguard.com.

I mostly work on the managed side of things, but I try to keep fresh on APIs and platform features. I'm not sure my workload really allows me to be a major part of the project, but if you've got a public portal that tracks your tasks, I might be able to subscribe and pop in and do some legwork from time to time. Especially if someone's writing the core functionality in some DLL that's easy to call. Do you have a public issue tracker? Or is it mostly IRC and mailing lists?

First of all, love the project. Thanks for tackling it and sticking to it.

I know that talking about a windows client is really early at this point, but is your team considering implementing it in a way that actually uses the UWP VPN provider interfaces (https://docs.microsoft.com/en-us/uwp/api/Windows.Networking....) instead of (or in addition to) the OpenVPN-style system tray app? I know there's been some strides towards using UWP from rust. And if you're thinking about it, early consideration might give extra time for any necessary interactions with MS.

It would be really nice to have an open-source VPN implementation actually integrate with the OS, and I think it might provide the impetus people need to ditch OpenVPN. So even if you don't plan on directly working to integrate with the OS interfaces, please consider referencing the APIs when working on userspace libraries. Keeping the needs in mind could at least simplify any future efforts in that regard.

fork the project and remove the offending code

Yeah, it's possible. And it will probably happen at some point or another, now that it's open source. But that won't stop the momentum of the core product.

Also historically, is /var/log any different from telemetry? I can easily figure out which applications were installed, what the hardware on the system is, which cron jobs were executed etc.

Telemetry by definition includes the transmission of logged data. System logs may be collected and transmitted internally by an organization, though by default it is not. But pretty much everyone would be up in arms if a software vendor collected logs of not only what their own software is doing, but what other software on a user's system is doing. And that's the main problem with Windows telemetry - it's too invasive, resource intensive, opaque, and integrated for people to stomach. So they turn it off wherever they can, and thus starts this disgusting game of whack-a-mole with Microsoft.

The dotnet cli isn't as bad, but Microsoft has earned some black eyes from the behavior of their other departments. So everyone's going to feel the heat until they learn too control their greed for data.

There's also a warning the first time you use it

If you'd actually read the issue before commenting, you'd realize that this behavior was added after people complained about the telemetry not being obvious. It's the sixth comment on the issue (by guardrex) - not even that far down. The very next comment is an MS contributor saying that he makes a good point that it wasn't obvious, and that they'd improve it in a future release. Which is why there's now a warning when using it. I mean, the link is old, but it should be understood that an issue on preview tooling from over a year ago might not represent the current state of the tooling. But yeah, on first release, all the notice you got was a blog post, if you even bothered to look for it.

It's also a fair point that it's still not made very clear that what information is collected under what circumstances. It's a huge problem with Windows, so you can understand why people have their jimmies rustled even over something small. Especially since windows 10 makes it impossible to completely opt-out of telemetry. Even after disabling the visual options, it's still regularly calling out to Microsoft servers. Even if you disable the services, updates will turn them back on and other services will start it up. And then it chews through your system's CPU like it's starving. Which means it's probably collecting far more data than it needs.

Finally, sometimes it's not even about what's collected or that there's an opt-out procedure. Sometimes just having a mechanism for transferring data can cause problems. 'sushihangover' comments on that issue that someone failed their HIPAA audit based on this behavior. I've no idea if it's an accurate example, but there are government, medical and enterprise environments where any non-sanctioned traffic is strictly prohibited and can cause liabilities.

Telemetry needs to be easy, simple, and thorough in its opt-out mechanisms. Microsoft has failed its users on this frequently and recently. I don't think this particular instance is that bad, but they should be doing damage control in all products based on the public perception that they're spying on users.

SQL Server Management Studio, on the other hand, is much better about its analytics opt-in request. Microsoft is a big company with varied practices. Not every division deserves a high-five about their privacy practices.

It's definitely nothing out of the ordinary and is common practice among many tools and apps you already use. Your smartphone sends back way more data if you're that concerned.

Let MS take their knocks when they earn them. And it's totally fine if people point out that Microsoft has a problem with opting users into unwanted telemetry. Even if it's not important data, it's data that someone didn't volunteer to give up. It's a horrible, common-place practice that needs to end.

Honestly, they might not need automatic telemetry if they just made volunteering information during a bug or slowdown significantly easier. If it was easy to, for example, enable telemetry for a Visual Studio session to track down why it runs like a whale, and then to review the information sent before it was sent, people would use it all the time to better the software. Instead, people turn off everything they can and don't bother to enable it (required for some MS feedback apps) to report issues because they don't know what'll sneak across.

When your telemetry is easy, open, and transparent, people will gladly opt-in when they think it's needed. Or they can hide the data they care about and share the rest.

If crimes were easily trackable and prosecutable, we probably wouldn't have such a hard time keeping criminals in jail. We still have crimes committed in jail that don't get properly solved, much less sentenced.

Also, this isn't necessarily about dumb kids being busted for drugs or stealing, but organized crime members. The possibility of them ordering hits from inside prison walls or tracking down people in witness protection kind of makes people nervous about letting them talk with anyone and everyone. That's not to say it's the most effective means, since smuggling, messengers, visitors and other means still exist for passing information. But that's not really an excuse to not try at all.

academics provide such an incredible amount to the world we live in.

This is true, but it's not terribly efficient about doing so. Much of it provides little to no useful return, and some of it actively harms the world we live in. If we wish to talk about the value of academics, we must honestly look at the whole balance sheet. Value isn't just about revenue, but costs, as well. And with rising tuitions and falling class quality, the ROI of a college education isn't as high as it used to be. For students and for society in general.

the academic discipline with its rigor, criticalness, and policing against self-promotion is a kind of last-bastion for intellect in the West.

I'm really struggling to word this in a polite way without discarding facts (sorry if I'm rude), but, what kind of fantasy led you to believe this is or has been the standard for academia?

- Academic discipline is more about knowing how to file papers and abuse TAs and post-grad students for free work, rather than about following scientific processes. There's been truckloads of articles lately about insufficient scientific rigor on published papers - especially in the social sciences. The glut of students, professors and information has lead to more noise than signal. Self-referential theories get presented as fact, where papers reference other papers still in peer review. Student thesis subjects are encouraged to focus on the professors' work in order to increase citations and prestige. Controversial papers are encouraged instead of scientific papers, which has caused all sorts of problems in academic journals and the parasitic journalists who write clickbait from them. And then there's the ever-present massaging of data and discarding of any contradictory samples.

- Self-promotion is absolutely huge in academia and has been that way for decades. That's how "publish or perish" came to be a staple of the industry. Not to mention the prestige factor in selecting mentors and advisors, politics in academia between people at the professor level can get extremely vicious. Elite oligarchies are as fixed in academia as anywhere else. And if they can't teach, they just move into administration and promote themselves there. Administration is probably the worst part of a modern educational institution - full of waste and corruption. Like how Katehi got rehired at her chancellor-level salary after a year's vacation after that pepper spray incident at UC Davis. Academia is literally infested with bad actors. Not to say there aren't good ones, but the bad ones are especially well connected and hard to evict. There's no policing against it except against the people who get caught before they're successful at entrenching themselves.

- Critical thinking isn't even remotely a curriculum requirement anymore. Many classes actively discourage critical thinking, and instead encourage rote memorization or directed analysis instead. In some classes, if you dare to challenge the narrative presented, you might receive Title IX sanctions for your oppressive actions from students and professor. After which you'll then be brought before a panel, denied representation and judged by a biased group more focused on maintaining image and federal funding than on the truth. And this might be from something as small as questioning the statistics or the sample set from a study. Students are encouraged with safe spaces and other policies that prevent them from processing or even seeing opposing viewpoints. That is not "criticalness". It's pandering.

- Deceiving students in academia is also a thing. Once again, there's the whole problem with scientifically bad papers being encouraged, published and referenced without peer review. These things make it in to curriculum and don't get pulled out after a retraction. Some classes will teach you that you shouldn't critique at all. Class books are often written by the professor to supplement their income, and contain their own pet theories. They put out a new edition every year with minor changes just so you can't buy a used book. And you've obviously never sat through a lecture rant on the professor's pet grievances. Lecture after lecture on the evils of western civilization from a person who literally couldn't survive outside of it can really tire you out. And honesty about career applicability for degrees is at an all-time low. Partly because some of the people teaching you have limited career aspects themselves and don't like to stare the facts in the face. Dishonesty about the value of the information presented and its critical reception is kind of the worst kind of dishonesty when you're charging someone a year's salary to listen to it.

There are good things about a university education. And not every situation is this bad. But it is not the ivory tower you're perceiving, and likely hasn't been that way for the majority of your lifetime, if not all of it. The honest, naked pursuit of science and truth always been the ideal, but rarely the reality. We don't want to throw the baby out with the bath water. But we've got to be more honest and objective about problems in academia if we have any hope of fixing them.

There's also Google's terrible reputation of poor and unreachable support, as well as the unappealable terminations of service. And they're not limited to consumers - some companies have had service terminated leaving them with no recourse.

Google's offerings are as much software as hardware, and having Google drop your account over a misunderstanding and thereby disabling all your laptops for several weeks would be a nightmare. Many of the people in charge of making purchasing decisions will have this type of concern in mind.

Whether they can turn that around and make a strong enterprise support channel is a valid question. But it's going to take some strong sales and tech to get people to risk trying it out. Google's a great company as long as you don't have to actually talk to anyone. Which makes them wholly undesirable for companies that obsess over the number of nines in their reliability.

There's kind of a lot of issues. Especially with psychology and sociology and the areas they intersect.

1. Replicability of social psychology results are estimated at 25%. (Cited in article, from http://www.nature.com/news/over-half-of-psychology-studies-f...)

2. People are not reporting non-significant results. Which means we get an incomplete picture of the validity of certain hypotheses. (from article)

3. The numbers don't line up when comparing observed power and significance of results. (from article)

4. Some results data is erroneous or falsified. The GRIM test that surfaced a while back shows numeric "results" that cannot possibly be derived from the sample data. (https://medium.com/@jamesheathers/the-grim-test-a-method-for...) (https://www.vox.com/science-and-health/2016/9/30/13077658/st...)

5. Many authors on the papers don't want to share the data from their papers - even if it's a condition of publication. (from a previous article about the GRIM test that I can't find) This doesn't directly equate to maliciousness or deceit, but it illustrates incorrect attitudes in the field. Some authors consider it undignified to have someone "check their work". Others are concerned of fallout if their data contains errors. (Generic mainstream blog/press article on reproducibility https://www.vox.com/2016/3/14/11219446/psychology-replicatio...)

6. Ridiculously small sample sizes are often used in experiments. Often this doesn't seem to affect how the results are received, though it should. (briefly discussed in article and comments)

7. Papers and studies are cited in articles and future papers before they've been peer reviewed, replicated, or proven sufficiently to justify their inclusion into the field. Thus the results are "baked in" to social psychology as fact at an uncomfortably early stage. (http://blogs.plos.org/mindthebrain/2015/12/30/should-have-se...) This kind of feeds into the hype machine where people focus on significant results - even if the data needs massaging to get there. Even after being refuted (if refuted) the field and its fans never seem to fully recover and back away from bad science. By then it's already made its rounds on Facebook and it's even referenced in the worst of the college intro to psych/sociology courses.

8. Journals in general need to be more open with their data. Especially with publicly-funded research. Paywalls don't help progress.

9. Corporate/politically funded white papers publish studies without making the connections clear.

The field needs a massive overhaul in the sense that its participants need to stop chasing controversial results in the press and instead focus on reproducible results and methods. All fields need some of this, but psychology needs it more than others.

I've got something that listens to other devices (ACPI buttons, etc), but nothing that touches the touchpad. It's also a driver that's specific to the model (the main driver won't handle 3 button devices), so it's not like it shouldn't have undergone testing on the laptop.

I'd still suspect synaptics, as it's probably not checking its input properly. As no other device has problems with this.

UDF supported by all three OSes natively and openly

Wasn't there a major problem in that all the operating systems supported different versions of the UDF standard? And most of them treat it as an optical disk format, so I wouldn't be surprised if some of them acted like it was read-only.

Synaptics drivers are horrendous. In addition to the terrible performance, mine has given me 10+ bluescreens on Win10. I'd love to remove them, but they're needed for some of the basic functionality. And they also seem to randomly make my mouse laggy (when I'm at a desk and plugged in).

Honestly, a generic trackpad driver that suppliers 2-finger scrolling, 2/3 finger mouse button emulation, and _maybe_ pinch-to-zoom would be all I want. If someone put in some plugin interface with an API so everyone could add the additional magic, it would help people with more complex needs. I'd love to kick synaptics to the curb. They've had decades to write a driver for the only thing they're known for, and yet still can't seem to handle it.

I don't think he's advocating that he should be setting the rules or self-evaluating. He just wants the rules to be sensible and sensibly enforced. He has justification to complain if the modifications they requested violated safety policies, risked patient well-being or defeated the purpose of the study. Policy that doesn't add any benefit deserves to be questioned.

Not to mention that the questions were already being asked. He just wanted to ask them earlier to compare against the eventual diagnosis. It's not the kind of study that should have been abandoned in frustration after two years, as happened here.

Yes. Updates to those files didn't seem to be reflected in bash until I'd closed and reopened the terminal.

If your app is a database server, probably yes.

They explicitly don't support that. From the article:

Linux distro's [sic] running atop WSL are for interactive user scenarios, NOT for running production workloads on Apache/nginx/MySQL/MongoDB/etc.

And the last time I checked, it's not suitable for services. The moment I closed the bash terminal, all the processes I had running through WSL terminated - including nginx and tomcat.

IBM has a huge problem with misrepresentation. It goes all the way to the top, with a CEO that promises major growth without a clear plan forward. The employees themselves seem to doubt whether they'll have a job in the near future, given the near-annual mass layoffs and the unclear market strategy.

Talking about market strategy, no one knows what IBM does anymore other than garner support contracts and land body-shop jobs. Everyone knows Watson because it's won Jeopardy and a few other games. But that's not because Watson is ground-breaking or anything, but because IBM hasn't done anything else new in 5-10 years. So Watson seems less like a crowning achievement, and more like debris from the Titanic. The company's treading water, and barely, at that.

Sales, however, swears that Watson can do everything from getting the best tax return to curing hair-loss and replacing 80% of the work force. But anyone who's not a fool knows that current AI still has to be tailored towards an industry to be useful. And that's still going to take a huge amount T&M investment. Which you can see from the well-known failed (and expensive) Watson projects.

Usually the only companies who fall for it are the ones where management is less about technical skills and more about kickbacks and favor trading. Or national/international-level contracts where the most important thing required is someone to blame or sue when things inevitably go wrong. Everyone else either understands the technology is more complicated than the presentation, or they have enough insight into IBM to discount the powerpoints.

I mean, IBM still isn't as bad as Oracle. But, if I had to pick a metaphor for IBM's reputation... I'd go with "IBM is as much an innovator as Steven Seagal is an action star."

This feeds directly into the popular narrative that the working poor somehow lack moral fortitude.

Not really. Not every bad job is held by an oppressed proletariat. Many times they're held by mischievous PFYs who still think they're immortal and that $20 is a lot of money. Youthful indiscretions are one the most common sources of this type of behavior. It's extremely common to not have a professional attitude in your "first real job", or to not even consider most minimum wage jobs as a "real job". There's an entire genre of movies that relies on this culture. Slacker culture has been part of pop culture for decades, now. When you don't have any actual responsibilities it's pretty common to treat any new ones like a big joke, or as "suggestions".

And it doesn't just happen at work - there are people with extremely cavalier attitudes towards education. I had a conversation with my kid about other kids getting around attendance rules in high school by showing up to class and then "going to the bathroom" and not returning to class again. Skipping class to go smoke, race, shop, etc has been a thing for at least 50 years. It's kind of telling, though, that most slacker movies were about college-age (or younger) kids. Ones for adults (e.g. Office Space) are pretty rare and rather niche.

It's important that we recognize that professionalism is not a natural (or an exclusive) trait. Babies don't pop out of the womb screaming "Please advise." The teenage years are full of people pushing boundaries to learn how they fit into society. We expect mistakes at that age, and those expectations are frequently met.

I've literally met hundreds of people who blew off classes because they weren't the ones paying for it, or who called in sick after a hangover or because they didn't like their job. I've stood around at parties listening to people tell stories of how they ditched work. I had a co-worker call in sick because he "couldn't get his car out of the garage." And having six dead grandmothers in a year is a trope now. It's not everyone, for sure, but it happens. It's just that people do it less with the jobs that they value in the careers they've invested into.

That said, we do need a lot of labor reforms around hours worked, employee rights and privacy, cost of living adjustments, etc. And we need better safety nets for citizens. But those will always extend far more slowly to a job that can be filled by 90% of the population. The supply of entry-level workers far outstrips the demand.

Well, Paypal's been getting away with pretending to not be a bank for over a decade now...

The VPN changes your network route. This can get you around geographic locks (services that only work in certain areas). It can also get you around traffic issues, if your ISP has technical/political routing issues. Like with Comcast/Verizon refusing to add additional peering because they wanted to double-bill netflix traffic.

Some VPN services also advertise additional privacy or anonymity, but trusting a stranger to not sell you out to their local government isn't usually a good idea.

From a business standpoint, you may want web and network services without exposing them to the wider internet. So they're only accessible on IPs in local subnets. VPNs will get you inside the wall.

but I don't see Musk referred to as "Elon" much on HN.

Nearly every time the people I interface with introduce him into a discussion, he's referred to by full name. His first name sounds a bit weird to me out of context - all strong vowels. But I hear his employees refer to him by first name. It'll differ from place to place.

What are the chances the HN user-base is actually more familiar with Meyer?

There's also the fact that these huge comment trees are linked to articles and have titles that usually include the person's full name or company at the top. In every case we're talking about someone on Hacker News, we're immediately susceptible to the brevity exception as everyone reading and commenting already contextually knows who you're talking about.

Using a full name in contextual discussion sounds weird to me, honestly. I knew a person who would call me by my full name as I was leaving parties and other social engagements and it was weird and awkward because it was overly formal and I used to date that person. And I didn't appreciate the loud, immediate attention.

Which name you use when referring to strangers is kind of random. I have some people who call me by last name, others by first. A lot of it depended on how they were introduced to me, or whether I lived in a place where that name was uncommon. People like to categorize, and often the more unique a name, the better.

It's important to always assume good faith when someone does something that's weird to you. I've been recently working a lot with social services, which has a lot of good examples of deescalating situations. Like with abused children - when the come into care they will quite commonly interact in an uncomfortably familiar or even sexual fashion because they've lived in situations where those lines weren't very clear. It's not bad behavior - it's just the survival skills they've learned. In those cases, it's most important to just not freak out and calmly talk your way through things. Adults who attempt to read motive out of their behavior tend to start a lot of unnecessary conflict.

I'm a bit weird because I actually bought etiquette and flower arrangement books. This stuff is interesting to me, although the changing landscape of social etiquette frustrates nearly everyone. Just keep in mind that a lot of the words we speak, as well as the way we speak them and the way that we refer to each other is based on unspoken rules that subtly alter between generations and across cultures. There's no one rule for interactions anymore. Even though we like to pretend that there is when someone crosses our own boundaries.

but dudes never get called "first name", only "last name".

Mayer is a really common name. The only way to distinguish her from the 15 Mayers I know is by full name. But in a conversation about her, I'll use whatever's shorter.

But let's also address the partial vs full name argument that commonly comes up. I hear that argument a lot. Warren Buffett is a good example. Nearly every time he's mentioned, it's by full name unless you're already talking about investment. Using his full name adds a bit of gravitas.

Partial name usage over full name is usually indicative of a few things:

1. Familiarity: The speaker feels familiar with the person - either through personal contact, proximity or extensive exposure.

2. Uniqueness within context: There's only one person with that last name that people would think of when you mention the name. If you're talking about operating systems, saying Gates or Torvalds is often enough to understand. And if you're on stage sweating and awkwardly chanting at a tech conference, people will understand that you're "pulling a Ballmer".

3. Brevity: If you talk about a person long enough in a monologue or discourse, or over a long period of time you'll get tired of mentioning their full name. Last name is usually preferred culturally unless there's a chance of confusion with another person.

4. Personal preference: Sometimes some names roll off the tongue better than others. If a speaker finds a name hard to pronounce or spell, they might pick another.

5. Cultural unfamiliarity: Nadella was easier for me to remember by his last name than his first name "Satya".

6. Rhetoric: You might be trying to appeal to a well-known authority by their most common reference to add panache (e.g. "Gandhi" vs "Warren Buffet"). And this reference can depend on whether you're trying to put a positive spin vs. a negative one. "Barack Obama" vs "Obama" is a good example, with the first/last combo being used more frequently by supporters and just the last name (or the first/middle/last combo) used by detractors.

On the other hand, long names might be preferred due to alliteration or rhyming ("Marissa Mayer" and "Rami Rahim" just flow really well), possible confusion with regular nouns ("Elon Musk", "Steve Jobs"), or that's how they were introduced ("Tim Cook").

Finally, insiders (employees and/or industry partners) will refer to a person differently than outsiders.

So, no, it's not about sex. Sex might be a contributing factor to familiarity or rhetoric depending on the person. But there are plenty of famous men that are referred to by their full name with respect (Buffet) or scorn (Ballmer).

Chrome has had them for a while. Supposedly they just hid them behind a flag because they weren't satisfied with some perceived deficiencies in the spec. (Check out https://v8project.blogspot.com/2016/04/es6-es7-and-beyond.ht...) WebKit did have it somewhere between mid-October to early December of 2015. (http://web.archive.org/web/20151207203829/http://kangax.gith...) Chrome didn't get it until late April of the next year (http://web.archive.org/web/20160526102037/http://kangax.gith...), though there's no snapshot until late May. People worked on the spec in a different order.

Chrome also had a failing array prototype under some non-standard syntax for a while. Despite claiming 100%, Kangax didn't show them passing. Test results have fluctuated as the tests themselves were refined. I've seen some passing results later turn into fails. That's why none of the browsers are at 100% for ES6 currently.

I'm still grudging at Apple for the year's delay between Safari 9 and 10, which left all the clueless Apple customers on ~53% ES6. Yes, WebKit had regular updates, but they didn't do a gradual release and few people thought to install WebKit instead of Safari (or even the TP). Other browsers had much better beta channels than Apple. And didn't pointlessly delay on things like WebRTC. Or block other browser engines like iOS to protect their app store.

Chrome did a good job of releasing updates gradually, but there are still some ES6 performance issues to be ironed out.

Protests usually follow some egregious government policy or action. Yes, there are protests that aren't very well organized, or lack a core concept to them. But those quickly fall apart with limited or no intervention. When they don't fall apart, it's an indication of something that's already wrong, rather than something that's about to go wrong.

There were actually some leaders with sympathetic and liberal movements in the times that led up to (and during) the TS incident, but afterwards the Chinese government either forced them to toe the party line or removed them from power. Their unwillingness to allow peaceful dissent, their massive overreaction, and their blatant suppression of the facts and of the expressions of grief afterwards have certainly fixed the governmental direction for quite some time. Hardline censorship and oppression supporters got more power, while those opposed got purged or learned to stay quiet. The government policy was at a crossroads until then, but they doubled-down on a surveillance state.

A government that straight up murders citizens during a peaceful protest and then refuses to let them talk about it for decades after has a huge effect. It's not just on the leaders in power, either. Even if they don't get the whole story, the Chinese populace is quite savvy about what can and can't be talked about. Most people will stand up for what they think is right when the risk is relatively small. TS reflected that, with academic elites being openly honest about their opinions about the state and future of the country. China was changing a lot and they thought there was finally a chance for a dialogue. But it was made quite clear that non-violent protest will be squashed and you will quite possibly be murdered or smeared for speaking a contrary opinion - even if it's out of patriotism.

It drove all dissenters into hiding or out of the country, leaving an empty playground for military and political power seekers who had no problem with heavy-handed retaliation.

Curious how the extreme violence of the Chinese response in Tienanmen is responsible for the continuation of the government politics; while the same extreme response in Syria would be responsible for tearing apart the country.

The thing in common is that, rather than listen to their citizens, the government chose suppression and murder. The citizen reactions in both cases are hugely different. But the source of the problem isn't different - an oppressive government. We don't shame people who back down when the alternative is death or civil war. It's an understandable choice. But we do shame people and governments who literally can't tolerate dissent without military might. Especially if they won't let you talk about it afterwards. Resorting to military might is a sign of political weakness, not strength.

They didn't. Google predates Baidu by two years. It's possible they could be talking about a specific technology, but not likely. Google had a Chinese subsidiary at one point in time, but stopped bothering as the government got in their way and assisted Baidu at every turn. Like with most situations where a foreign company competes with a Chinese one.

And that's before you get into the fact that China really doesn't want any foreign info-based companies operating in its borders, given their heavy propaganda machine. They'll tolerate it only until they can clone it and expel it.

only affects people that enabled a remote management feature.

The AMT can't be completely disabled, so people might not have to explicitly enable it to be vulnerable to AMT exploits.

It's not like every Intel system is silently waiting for an exploit payload.

It's not like it's Intel makes it easy to navigate their CPU and motherboards feature set. Manufacturers are also known to do a bad job on their BIOS/EFI. And given that the computers most likely to be vulnerable are those most likely to be used by businesses and professionals, the damage potential is pretty staggering. But yeah, netbooks are probably safe.

Questions this brings up:

1. What's the estimated bandwidth impact of this data collection? Many users have very limited data use, and chatty messages on play/pause/volume change wouldn't be appreciated.

2. HTTP or HTTPS?

3. How does it work with other apps (like Google Music) that might provide more music details? Like does it send more information when the id3 tags have all the fields filled in? Things like comments, encoding, etc might also be transmitted. Streaming services like Spotify probably try to trim that as much as possible, but local files could have a lot more data.

4. Can you see anything about the anonymous id that might make it not that anonymous? I mean, the device serial number alone kind of defeats an anonymous id. But there's been a fair amount of work in reidentification of anonymous data, and many developers take shortcuts when generating their "anonymous" data. (https://arstechnica.com/tech-policy/2009/09/your-secrets-liv...).

5. It's sending this data in the background, correct?

6. What does it send (if anything) during calls, emails, texts, map navigation, and voice commands?

They could even pitch it as helping to keep prices "low".

Considering that code has creation and maintenance costs, I doubt this would ever actually reduce the price. They would just inflate the final price to cover the cost. And if it collects enough data to actually make money, the price reduction would probably not significant enough to match perpetual data theft. Not to say that some people wouldn't go for it. It's amazing the lengths people will go to for free or cheap products.

But there's still the many liabilities of collecting, transferring and securing sensitive data. People who know the risks and hassles involved with identity theft would be very selective about these services.

For those that missed it, a representative from one of the other companies named in the suit helpfully dropped in to provide additional context on their company's part in this. It even had a super positive "happy to answer ... questions" attitude. It was deleted in a few minutes as they realized how poorly that was going to turn out.

The reaction wasn't unexpected. Especially since, while they were supposedly not directly purchasing or selling the data, they did help collect the data that Bose allowed themselves to buy or sell. And the TOS allows for third-party collection and use of data with little restriction.

I did grab a snapshot and the text, but it's quite full of personally identifying information - name, position and company, as well as links to their dropbox account. I think the information is important, but I'll try to leave out those details. Not that it would stop anyone determined to dig through case details.

In any case, maybe this will help people to discuss the points they were making and share their attitudes about them without receiving a massive Twitter storm.

1. The suit implies that [Company x] buys the data from Bose for marketing, advertising, targeting or profiling. We don’t do that. We help Bose collect event tracking data (like you send to Google Analytics) and send that data to their product analytics tools (like Mixpanel, Amplitude, Crashlytics, Crittercism, AWS Redshift, etc.) Analytics tools like this are used to create reports to understand how a product is being used or how a product is performing.

2. The suit claims that the event tracking was done unexpectedly and in secret, but that’s not true. We require that our customers (like Bose) get appropriate customer consent, not collect any data in violation of the law, and not pass segment any sensitive customer information as defined in applicable laws. To the best of our knowledge, Bose complies with all of that. On the main screen of the app, there’s a link to “Privacy Policy” front and center

To be clear, no one thinks that you didn't do your job from the beginning in attempting to cover your legal bases. We're aware that analytics is a valid business. And that it has some valid use cases. But analytics is also an industry that gets abused frequently and doesn't self-regulate.

In this particular case, people are upset because the hardware is not completely functional without the app - so people can't just not use it or "opt out" without losing part of what they just paid a fair amount of money for. No one would use the app except for that functionality, so collecting information on "app use" when the use of the app is a manufactured scenario seems quite unfair for a high-end product.

When collecting data in these scenarios, you need to be explicit about what you're collecting and not deviate from it. Data overreach and intentionally vague language are both received poorly. It could be that they're only collecting audio metrics. But their TOS would also allow them to collect information on every running app at any time (ostensibly it could effect quality) or on phone contacts (like if you made a call using the hardware), device location, texts, calls, and could conceivably transmit even more sensitive information.

All it takes is one wide tie with a bright idea to slip that "feature" in. Furthermore, there's nothing stopping Bose from changing their TOS at a later point. So these "protections" don't really protect the consumer.

Bose chose language that gave them too much potential freedom, and they're paying for that. You just did your job, yes, but honestly the job probably wasn't required for this particular product.