bibabaloo

I don't agree with all their business practices, but if you're looking for an alternative, Garmin watches do all of that well these days. I'm quite happy with my Forerunner 735XT.

You're correct, but from my understanding shifting the trust to the FPGA is a productive move as an potential attack is much more difficult to execute. Bunnie explains on his blog [1] better than I can:

> The CPU is, of course, the most problematic piece. I’ve put some thought into methods for the non-destructive inspection of chips. While it may be possible, I estimate it would cost tens of millions of dollars and a couple years to execute a proof of concept system. Unfortunately, funding such an effort would entail chasing venture capital, which would probably lead to a solution that’s closed-source. While this may be an opportunity to get rich selling services and licensing patented technology to governments and corporations, I am concerned that it may not effectively empower everyday people.

> The TL;DR is that the near-term compromise solution is to use an FPGA. We rely on logic placement randomization to mitigate the threat of fixed silicon backdoors, and we rely on bitstream introspection to facilitate trust transfer from designers to user. If you don’t care about the technical details, skip to the next section.

[1] https://www.bunniestudios.com/blog/?p=5706

In a similar vein, is there a cost effective way to purchase a single ipv4 address? Just for the novelty I think it'd be cool if I could spend ~$100 to have an ipv4 address that's permanently mine.

I'd argue that the whole point of ARM (as in ARM holdings) is to make money for their shareholders! :-)

> Imagine all your favourite tools like ls, grep, ps we're just one monolith

Like BusyBox? :-)

At the risk of wanting this to be something that it's not - what's the reasoning behind not targeting Precursor towards running (embedded) Linux? With a little more RAM it seems like the specs would make it a great fit for Linux, which might allow for a broader ecosystem of use cases?

Is there something I'm missing that means developing a new OS (https://github.com/betrusted-io/xous-core/) works better for Precursor? Keen to understand the rationale, cause I think I'm probably missing something here!

edit: There's a good explanation on the CrowdSupply page - seems like it's in order to make it a more secure platform:

> Simplicity addresses the reality of only having 24 hours in a day. Even though the full source code for the Linux kernel and Firefox is published, nobody has the time to personally review every release for potential security problems; we simply trust that others have done a good job, because we have no other choice. Precursor rolls the clock back to the early 2000’s, when mobile computers were powerful enough to be useful for single tasks, while simple enough that individuals or small teams could build them from scratch. But don’t worry, despite its simplicity, Precursor’s computational capability exceeds that of the Palm Pilot series. It’s more on par with a Nintendo DS: sufficient for core security tasks such as authentication, instant messaging, crypto wallets, and even end-to-end encrypted voice calls.

Yes - I have to say it is a little frustrating that there isn't an easy way to find new postings. Would be great to be able to sort comments by new. Or maybe there's a way to do this with third party services?

> Steveslist currently has a very simple and slightly fragile cron setup. We have a single “scheduled jobs server”. We use crontab on this server ... This setup isn’t scaling very well ... We’re considering setting up a new system using a modern tool like Kubernetes.

Do people use Kubernetes for running scheduled jobs like this? It seems like it'd be overkill but in saying that I'm not sure if I know of anything that can be used for running scheduled tasks in a reliable and observable way that's scalable. Maybe Jenkins?

> The thing is the kernel is kinda hurting for maintainers

Source? AFAIK the kernel is probably one of the most, if not the most, well-funded and maintained open source projects.

You should be able to get a starter going without too many issues. Some tips:

- Use bottled water

- Use organic rye flour to feed the starter

- Be patient :)

I'd be free to choose the version of software to run on it. If they were to, for example, put out a release that broke compatibility with a niche game that I enjoyed, I could downgrade and continue to play that game. But, honestly, it's more about the principle.

Huh, that's a really nice way of looking at it. I suppose I was thinking that it's my device that I've paid for so there shouldn't have unnecessary restrictions imposed on it. But it's true that I'd prefer a restricted device with a greater game library over an unrestricted device with no games!

I'm curious, how do Nintendo justify such an anti-consumer protection? It seems like it only really has upside for them.

Some counter experiences, just based on my own annecdata.

> * You, the individual, are not important. The product is important, the department that delivers the product is less important, the teams that comprise the department are less important than that, and so on. Again, accept the reality and just relax.

Working at startups I have never felt less important as an individual. The product is #1 and I only exist as a cog in the machine to produce that product and make the founders money. In a big company I was encouraged to pursue professional development, my professional goals and dreams were catered for and I felt like I could make personal progression.

> * Expect insufficient test automation, lots of regression, and plenty of repetition. Also expect everybody to be an expert that is in a hurry and things in a unique way. Just be patient, politely nod, and just relax.

Again, opposite experience, startups don't have time for test automation whereas big companies generally do.

> * If you don’t like being bored and are highly risk adverse you might find the big company life highly depressing.

I'm often bored at my startup though never lacking for work. It's just that the work can often be monotonous work because the startup doesn't have time to automate it or hire someone to do it. At a startup, its rare that you're encouraged to explore something new that might not work out. There's just not the time or budget.

> In order for this to be a "Python user space", you would need to implement or include a lot python equivalents of standard user space tooling. Python grep, python awk, python top, python vi, python gcc (lolz), and even python CPython (lolololz), etc.

Who says you need those particular utilities to make a user space? You could have a user space without a shell, much less gcc, vi or awk.

Am I wrong to assume that cloud vendors are the most worried about these sort of exploits? Having exploits that would allow customers running on the same hardware to access each others' data seems like it would be disastrous for them. So much so that they're probably OK with paying the performance penalty (or, more accurately, passing the extra costs onto their customers!).

Honestly, I think that's what makes working at a large "web-scale" company so attractive to me. When you're running at that sort of scale you can't afford to be as apathetic about performance so there's a lot more engineering effort put into efficiency, because it makes financial sense to do so. OTOH, in a lot of enterprise type companies, you can be nothing more than a "feature monkey".

I searched but couldn't find any info - why do they need a custom kernel? What changes do they make and why don't they upstream them?

Without have the ability to merge two files that have started from the version and then diverged, git loses a lot of its usefulness, IMO. Unfortunately it's not trivial to merge the type of files that other professions use (eg: images for marketers or drawings for architects or even standard .doc word files). Not to say that conceptually it shouldn't be possible to merge the files, but the tech isn't there.

I'm not any epidemiologist, so if someone knows more please correct me, but I read that viruses with a high mortality rate are much easier to contain. Mainly because the virus more naturally dies out as it kills its hosts. That was one of the reasons that SARS didn't reach pandemic scale with its 10% mortality rate.

I have to wonder if Covid-19 is in the 'sweet spot' of dangerousness, as it has a mortality rate that doesn't hamper its ability to spread but still kills a lot of people.

Can you share the sort of things you've been doing with it?

How do you spread it without also spreading the stronger virus?

It's amazing to me that there's 1000s of 'more useable Jira' variants out there, but IME every team that tries to use one inevitably ends up back using Jira.

> why not do it now?

I'm guessing to give people time to alter their plans etc.

> Unless they are magically different from every other country

They seem to be! Nobody really knows why, but even if their testing is inadequate you'd still expect to be seeing a lot more deaths if the virus was rapidly spreading. More info: https://www.japantimes.co.jp/news/2020/03/20/national/corona...

> our smartest people - both in the actual elite and here on HN - exclaimed that wearing a mask "does nothing".

I'm fairly convinced that the messaging behind the "masks don't do anything" rhetoric is to prevent a shortage to people who need them. Yeah, everyone wearing masks would probably effectively slow the virus but if there's known supply chain issues and everyone stocking up would cause availability issues for doctors & nurses, then we have to take the lesser evil.

> These next generation systems, on the other hand, don't pretend that you can build a host OS in any shape or form you want (hence very few base packages) but rather that you build "just enough of Linux to run containerd" -- the rest of what you would typically put into your baseOS goes into various containers. This is a very different approach to constructing the bootable system, but subtly so -- which I don't think a lot of people on either side of this debate appreciate.

This is a valid approach if you want to build something that can only run containers, but IMO is somewhat orthogonal to the Yocto and Buildroot goal of building distros for embedded platforms.

It's awesome that people are making new tools to do similar things to Yocto and Buildroot in this post-container world, but I don't think it's really fair to say that bottlerocket is a direct competitor to Yocto/Buildroot. It's probably fairer to say that bottlerocket makes it easier to do things that Yocto/Buildroot aren't really designed to do. Hopefully both live on, serving their own niche! I'm all for specialised tools rather than generic 'do it all' tools.

Has there been anything published about corona virus cases per ethnicity? Or many confirmed cases of people of non Asian ethnicity getting it?

It'd be great to hear a comparison of when you'd want to use Deviceplane vs something like mender.io or updatehub.io. I'm a great fan of the A/B dual image update strategy because it's simple, atomic and resilient to errors or loss of power during an update. Does Deviceplane still provide some of those assurances or would I want to use Deviceplane in conjunction with something like Mender?

I deploy updates on IoT devices that are unattended and can only afford minimal downtime. If an interrupted update (due to loss of network connectivity or power) caused a device to be unreachable/unupdateable it would be bad. I'd also be concerned with using DevicePlane as it's presented because I'd have no way of updating the device's kernel version that I first deploy with.

Can you elaborate on this? How do you make use of Ubuntu in this way and why was it hard to use Yocto? For the usual embedded Linux workflows I'm used to, it seems like building on top of Ubuntu would necessitate re-implementing Yocto features.

I often feel the same way. I enjoy the hunt of tracking down an impossible bug and enjoy getting a proof of concept out for a difficult problem, but hate doing all the 'boilerplate' type stuff to take something from a PoC to a production system.

I've often wondered if I'd be more suited to working in security and doing something along the lines of reverse engineering. Or maybe doing something like SRE where the job is solely optimizing systems and tracking down issues.