Quantcast
Channel: Hacker News
Viewing all 25817 articles
Browse latest View live

FlureeDB, a Practical Decentralized Database [pdf]


Fibratus: Tool for exploration and tracing of the Windows kernel

$
0
0

README.md

Build statusCoverage StatusCode HealthGitter

Fibratus is a tool which is able to capture the most of the Windows kernel activity - process/thread creation and termination, context switches, file system I/O, registry, network activity, DLL loading/unloading and much more. The kernel events can be easily streamed to a number of output sinks like AMQP message brokers, Elasticsearch clusters or standard output stream. You can use filaments (lightweight Python modules) to extend Fibratus with your own arsenal of tools and so leverage the power of the Python's ecosystem.

Installation

Download the latest release (Windows installer). The changelog and older releases can be found here.

Alternatively, you can get fibratus from PyPI.

  1. Install the dependencies
  • Download and install Python 3.4.
  • Install Visual Studio 2015 (you'll only need the Visual C compiler to build the kstreamc extension). Make sure to export the VS100COMNTOOLS environment variable so it points to %VS140COMNTOOLS%.
  • Get Cython: pip install Cython >=0.23.4.
  1. Install fibratus via the pip package manager:

Documentation

See the wiki.

Support

BeerpayBeerpayOpenCollectiveOpenCollective

Yagmail: sending mails from Python the easy way

$
0
0

This document aims to show how to use yagmail in your programs. Most of what is shown here is also available to see in theREADME, some content may be duplicated for completeness.

Start a Connection

As mentioned in Configuring Credentials, there are three ways to initialize a connection by instantiatingyagmail.SMTP:

1. With Username and Password: e.g. yagmail.SMTP('mygmailusername','mygmailpassword') This method is not recommended, since you would be storing the full credentials to your account in your script in plain text. A better alternative is using keyring, as described in the following section:

2. With Username and keyring: After registering a keyring entry for yagmail, you can instantiate the client by simply passing your username, e.g.yagmail.SMTP('mygmailusername').

3. With keyring and .yagmail: As explained in the Setup documentation, you can also omit the username if you have a .yagmail file in your home folder, containing just your GMail username. This way, you can initialize yagmail.SMTP without any arguments.

4. With OAuth2: This is probably the safest method of authentication, as you can revoke the rights of tokens. To initialize with OAuth2 credentials (after obtaining these as shown in Setup), simply pass an oauth2_file to yagmail.SMTP, for example yagmail.SMTP('user@gmail.com',oauth2_file='~/oauth2_creds.json').

Closing and reusing the Connection

By default, yagmail.SMTP will clean up after itselfin CPython. This is an implementation detail of CPython and as such may not work in other implementations such as PyPy (reported inissue #39). In those cases, you can use yagmail.SMTP with with instead.

Alternatively, you can close and re-use the connection withyagmail.SMTP.close() and yagmail.SMTP.login() (oryagmail.SMTP.oauth2_file() if you are using OAuth2).

Sending E-Mails

yagmail.SMTP.send() is a fairly versatile method that allows you to adjust more or less anything about your Mail. First of all, all parameters for yagmail.SMTP.send() are optional. If you omit the recipient (specified with to), you will send an E-Mail to yourself.

Since the use of the (keyword) arguments of yagmail.SMTP.send() are fairly obvious, they will simply be listed here:

  • to
  • subject
  • contents
  • attachments
  • cc
  • bcc
  • preview_only
  • headers

Some of these - namely to and contents - have some magic associated with them which will be outlined in the following sections.

E-Mail recipients

You can send an E-Mail to a single user by simply passing a string with either a GMail username (@gmail.com will be appended automatically), or with a full E-Mail address:

yag.send(to='mike@gmail.com',contents="Hello, Mike!")

Alternatively, you can send E-Mails to a group of people by either passing a list or a tuple of E-Mail addresses as to:

yag.send(to=['to@someone.com','for@someone.com'],contents="Hello there!")

These E-Mail addresses were passed without any aliases. If you wish to use aliases for the E-Mail addresses, provide a dictionary mapped in the form {address:alias}, for example:

recipients={'aliased@mike.com':'Mike','aliased@fred.com':'Fred'}yag.send(to=recipients,contents="Hello, Mike and Fred!")

Magical contents

The contents argument of yagmail.SMTP.send() will be smartly guessed. You can pass it a string with your contents or a list of elements which are either:

  • If it is a dictionary, then it will be assumed that the key is the content and the value is an alias (currently, this only applies to images). For example:
contents=["Hello Mike! Here is a picture I took last week:",{'path/to/my/image.png':'PictureForMike'}]
  • If it is a string, then it will first check whether the content of the string can be read as a file locally, for example 'path/to/my/image.png'. These files require an extension for their content type to be inferred.
  • If it could not be read locally, then it checks whether the string is valid HTML, such as <h1>Thisisabigtitle!</h1>.
  • If it was not valid HTML either, then it must be text, such as "Hello,Mike!".

If you want to ensure that a string is treated as text and should not be checked for any other content as described above, you can use yagmail.raw, a subclass of str.

If you intend to inline an image instead of attaching it, you can useyagmail.inline.

Using yagmail from the command line

yagmail includes a command-line application, simply called with yagmail after you installed it. To view a full reference on how to use this, runyagmail--help.

In Ancient Skeletons, Scientists Discover a Modern Foe: Hepatitis B

$
0
0

One of the teams was led by Eske Willerslev, a geneticist at the University of Copenhagen who has helped revolutionize our understanding of human prehistory by collecting DNA from age-old skeletons.

In some instances, by grinding teeth and bits of bone to powder, and then pulling out fragments of genetic material, he and his colleagues have succeeded in reconstructing all of the DNA of individuals. But along the way, the scientists discovered that human genes aren’t the only ones hidden in bones and teeth.

In 2015, Dr. Willerslev and his colleagues discovered DNA of the bacteria Yersinia pestis, which causes bubonic plague, in seven Bronze Age skeletons unearthed in Europe and Asia.

Photo
A image made with colored transmission electron microscopy of hepatitis B. One researcher is resurrecting extinct strains of the virus from genes recovered from ancient skeletons, hoping to learn more about how today’s strains might evolve.Credit Bsip/UIG, via Getty Images

His team turned over raw genetic data they had gathered from hundreds of ancient skeletons to the Centre for Pathogen Evolution at the University of Cambridge for further evaluation.

“He handed us a gold mine,” said Barbara Mühlemann, a graduate student at the university and co-author of the new study.

Ms. Mühlemann and her colleague Terry Jones led an inspection of 114 billion fragments of DNA retrieved from the skeletons of 304 people who lived 200 to 7,100 years ago. In most of the fragments, the researchers found nothing of interest.

But in the remains of 12 skeletons, they discovered that a tiny fraction of the recovered DNA came from viruses. A closer look revealed that the bones carried the same infection: hepatitis B.

Today, the virus represents a massive burden on human health. Present in blood and saliva, hepatitis B can be transmitted by pregnant mothers to their unborn children, and also can be spread through sex or by sharing needles.

Chronic infections can lead to liver cancer. Each year, the World Health Organization estimates, hepatitis B kills 887,000 people. Researchers have long wondered how it became a worldwide menace.

A virus like influenza, which can spread through the air and also infect birds and pigs, may race around the planet in a matter of weeks. But hepatitis B depends on close human contact.

In 2012, researchers studying a mummified body in Korea from the late 1600s discovered DNA from the hepatitis B virus, specifically a strain common today in Asia.

Photo
Skeletons from a mass burial of ancient warriors, one of which was among the dozen infected with hepatitis B studied by Dr. Willerslev and his colleagues. Their research demonstrates that hepatitis B existed across Europe and Asia as early as the Bronze Age.Credit Dr. Alexey A. Kovalev

In January, another team recovered the virus’s DNA from a 450-year-old mummy from Italy. That virus belonged to a strain still found around the Mediterranean today.

But the skeletons in which the Cambridge geneticists found hepatitis range from 820 to 4,500 years old. The research, published in the journal Nature, demonstrates that hepatitis B existed across Europe and Asia as early as the Bronze Age.

“It gives a whole new light on understanding human suffering in the past,” said Hendrik Poinar, an expert in ancient DNA at McMaster University.

Researchers at the Max Planck Institute for the Science of Human History in Jena, Germany, also have been gathering DNA from ancient human remains — and they, too, suspected that hepatitis B might be lurking in the collection.

Johannes Krause and his colleagues examined DNA extracted from the teeth of 53 ancient people in what is now Germany. Three of them were infected with hepatitis B, it turned out: one who lived about 1,000 years ago, a second person who lived 5,300 years ago and a third who lived 7,000 years ago.

The last individual belonged to a population of Europe’s first farmers, who had spread across the continent from Turkey.

Dr. Krause was struck by the abundance of viral DNA found in the teeth, which suggests that the individuals had massive infections of the virus. “It must be really late stage,” he said. “It could have contributed to the death of these people.”

Dr. Krause and his colleagues posted a copy of their paper online on Sunday; the final version is to appear in the journal eLife on Thursday.

In an interview, Dr. Krause said it was striking that both teams of researchers found several skeletons with hepatitis B, including a number of extinct strains. “It seems to have been quite prevalent in the past,” he said.

The two studies together raise a host of new questions about the history of a killer. For example, how did the virus first evolve?

Dr. Krause and his colleagues found that their Stone Age viruses were most closely related to strains of hepatitis B found today only in chimpanzees and gorillas.

He speculated that the virus jumped from apes to humans early in the history of our species in Africa. “It’s more likely this is really an old pathogen in humans for the last hundred thousand years or more,” he said.

He and his colleagues have already started looking for hepatitis B in Neanderthal fossils. Other viruses may turn up in ancient human bones, Dr. Krause suspects — especially another human plague, smallpox.

“I’m quite sure we’d find it if we looked hard enough,” he said.

One of the co-authors of the Nature study has taken a novel next step: He is resurrecting extinct strains of hepatitis B in a secure laboratory.

Dieter Glebe, a molecular virologist at the National Reference Centre for Hepatitis B and D Viruses in Giessen, Germany, has manufactured DNA molecules that contain the viral genes recovered from ancient skeletons.

When he inserts that DNA into human cells, they produce viable hepatitis B viruses. It may be the first time these strains of hepatitis B have existed in several thousand years.

Dr. Glebe is bringing Bronze Age viruses back to life in order to see how they differ from the strains that infect people today. Studying ancient viruses could give researchers clues about how today’s hepatitis B might evolve in years to come.

Looking into the virus’s past, he said, “we can make predictions about the future.”

Correction: May 9, 2018
An earlier version of this article misstated the name of the city where the National Reference Centre for Hepatitis B and D Viruses is located. It is in Giessen, Germany, not Gliese.

Continue reading the main story

IBM's Early Computers

$
0
0

In describing the technical experiences of one company from the beginning of the computer era, this book unfolds the challenges that IBM's research and development laboratories faced, the technological paths they chose, and how these choices affected the company and the computer industry. It chronicles the transformation of IBM into a computer company in a remarkably few years, discussing projects that ended in frustration as well as the more successful ones, and providing a sense of the atmosphere, the people, and the decision-making processes involved during the company's rapid technological transformation. IBM's Early Computers is a unique contribution to the modern history of computers. It focuses on engineering alternatives rather than business and general management considerations and reveals the significance of imaginative solutions to problems in design and technology, from initial experiments with electronics in digital machines to the threshold of the System 360 era. This fair and balanced account of IBM's role in shaping today's electronic revolution identifies the individuals (both inside and outside the company) whose pioneering work influenced developments at IBM. The book's fourteen chapters briefly survey the card machine era and then cover electronic calculation, the magnetic drum calculator, the Defense Calculator and other first-generation products, ferrite core memories, magnetic tape, and disk storage development, programming, transistors, "Project Stretch" (which involved disappointments but led to one of IBM's greatest successes) high-speed printers, research, and new-product-line considerations.

Charles J. Bashe, Lyle R. Johnson, John H. Palmer, and Emerson W Pugh are senior members of the staff at IBM's Thomas J. Watson Research Center, each with many years of technical and managerial experience in the developments they describe. IBM's Early Computers is included in the History of Computing Series, edited by I. Bernard Cohen and William Aspray.

MoviePass has changed people’s moviegoing habits

$
0
0

On May 2, echoing the cries of a weary nation, Gizmodo ran an article titled “At This Point, MoviePass Is Just Messing with Us.”

It was a response to the many changes that MoviePass had made to its service in the past year, and particularly in late spring, when the subscription service altered its offerings from a movie-per-day plan to four per month and an “extended trial subscription” to iHeartRadio, a thing nobody seemed to have asked for.

The company quickly reinstated its standard plan in early May, with CEO Mitch Lowe claiming that “we never planned to abandon the flagship product that everybody loves,” and that the short-term change was a promotional tool. MoviePass users sighed with relief, but also a bit of trepidation.

If you’re starting to doubt at this point that MoviePass really has a long-term plan, you’re not alone — after all, the current $10-per-month plan is just the latest in years of retooling from the company, which has at various times offered a $50-a-month plan that spectacularly backfired, a voucher-based partnership with Hollywood Movie Money, and a $30-a-month plan using a debit card, which looked a lot like today’s MoviePass except it cost more.

MoviePass may survive. Or its business model may, in the end, be unsustainable. But on a broader scale, the more interesting story may be the way MoviePass alters how people go to the movies — and what that means for an industry that is struggling to survive.

MoviePass works for one big reason: movie tickets are too expensive

Most people agree that there’s one big reason they don’t go to the movies more often: Movie tickets are expensive.

“I used to see maybe one movie per month,” Tyler told me. In his 20s and living in Portland, Oregon, Tyler said the price of movie tickets was the limiting factor in going to the theater. “The movie had to hit some kind of threshold of ‘cultural moment’ (like a Marvel film) or acclaim (like an Oscar nominee) in order for me to justify spending the $10 to $15 to see it, when I could just as easily wait and watch it at home.”

That’s a common chorus for many people. Gavin, who is in his 30s and lives in a small town about 90 miles from Nashville, told me that “since about 2012 I’ve mostly avoided theaters because of ticket prices and being a dad to young children. I knew it would be cheaper and more convenient to wait a few months and catch new movies at Redbox.”

Last August, AMC Entertainment Holdings announced its stock dove 25 percent, citing weak ticket box office.
Frederic J. Brown//AFP/Getty Images

A recent report from the National Association of Theatre Owners showed that the average movie ticket price nationwide had risen 3.6 percent over the past year, from $8.85 to $9.16. That price varies widely across the country. And when you add in the cost of travel, food, and maybe a babysitter, that’s a lot.

But someone who paid the $10 monthly MoviePass fee introduced in August 2017 could make back their investment by seeing only two movies per month — and in some markets, where average ticket prices run more like $12 to $18, the cost of a MoviePass subscription is less than one ticket purchase. So it’s not at all surprising that when MoviePass introduced this offer, enrollments shot up — from about 20,000 in August 2017 to 2 million by February 2018.

MoviePass reimburses theaters for the full price of the tickets, which means the more people use the service, the more money MoviePass loses — which led a lot of people to wonder how on earth it could be a sustainable business.

People have speculated about how MoviePass plans to stay afloat, including leveraging data it collected from users, sponsorships from studios to help push specific films, and strong-arming theaters into sharing profits from concessions. The AMC theater chain, in particular, voiced strong objections to MoviePass, arguing that it couldn’t remain viable and would set unrealistic expectations among customers. And in late April, an external auditor voiced doubt over the business’s sustainability.

But for now, MoviePass’s cheap, mostly unlimited plan helps undercut the high cost of movie tickets — which seems to be changing the way people go to the movies.

Expensive movie tickets shape how people go to the movies

When movie tickets are expensive, people tend to wait until they can go with others — an outing with friends or family, or a date. Moviegoing becomes an “event,” like going to a concert or a play.

Before subscribing to MoviePass, Tyler said, “I would almost never go to the theater alone, mostly because the type of movie that hit that cost-effectiveness threshold for me was the kind of movie you specifically want to see with friends.”

Gavin had a similar experience before getting MoviePass. “My theater trips were usually one of the following: my wife and I occasionally going to the movies on a date, taking my kids to see the latest Pixar movie, or going alone to see a new thing by a favorite filmmaker like the Coen brothers,” he said. “I would guess I’d go to the movies less than 10 times in a calendar year. Probably closer to five theater trips a year.”

The “event” nature of moviegoing often meant that people tended to go to the movies on weekends, when other people were free. And some people were deterred from taking a risk on a movie with mixed reviews or that they weren’t sure they’d like. If you’re going to spend all that money, you want to know it’ll be worth the investment.

MoviePass effectively takes away the limiting factor of cost. Subscribers pay one monthly fee and can go to a movie every day, if they want, without the risk of investment.

Taking away that barrier to entry appears to already be having an effect. In a survey of MoviePass users published in April, the Hollywood Reporter found that the subscription had altered viewing habits for subscribers — sometimes substantially.

THR’s report found that on average, MoviePass users watched six more movies in the past month than nonsubscribers, and that subscribers were twice as likely to attend a movie on opening weekend as nonsubscribers — a metric that matters to movie studios since opening weekend numbers can play a big part in creating buzz around a film. And significantly, 42 percent of subscribers were parents, compared to 28 percent of nonsubscribers — indicating that cutting down on movie ticket costs may make paying for a babysitter and a night out more appealing. (See the accompanying chart for more of the survey’s relevant findings.)

More than half the THR respondents named specific movies they saw because they had MoviePass. The most popular included big-budget studio comedies Bad Moms Christmas and Daddy’s Home 2, alongside arthouse fare like Phantom Thread, All the Money in the World, Molly’s Game, and Hostiles.

Robert, a senior citizen living in Brooklyn, cited a similar trend in his viewing. He uses his MoviePass once a week. “I’m more likely to try something that seems less of a sure thing, or that has mixed reviews,” he said. “For example, I saw You Were Never Really Here, which I had mixed feelings about but was glad I saw.”

Gavin concurred. “I’ve been more likely to take risks and see movies I wasn’t sure I would enjoy, like The Shape of Water and Game Night,” he said.

MoviePass has also brought flexibility to cinephiles living on a limited budget. Thomas, who is in his 20s and works for a church near Baton Rouge, Louisiana, used to go to the movies with his wife on Tuesdays, when the local Cinemark and AMC theaters had discount nights. But that had its drawbacks. “Since MoviePass, we can now go on any night of the week,” he said. “I work for a church, so a lot of my nights are taken with work events, meetings, Bible studies, and so on, so it’s definitely been a huge gift for both of us.”

“Now, I worry less whether a movie will be ‘worth it,’” Tyler said. “So now I see three or four movies per month. I probably go alone 75 percent of the time. It’s made the ritual more appealing because of the cost-effectiveness.”

And the MoviePass model is attractive even for those who are inclined to see lots of movies anyway. I have a MoviePass, but as a working film critic I see almost every film at press screenings or festivals, long before they hit theaters. Still, there are times I want to go to the theater — to see a movie with my husband, or to catch a film that wasn’t screened for critics, or to rewatch a movie I haven’t seen since a festival release months or years earlier, or to watch an older film at one of New York City’s many excellent repertory theaters. In the past, the high cost of aNew York City movie ticket was enough of a deterrent to keep me away — but now I’m much more likely to go to the theater on the spur of the moment, or because I find myself with an unexpectedly free evening.

That’s true for many MoviePass holders. The THR survey found that MoviePass subscribers are 38 percent more likely to decide what to see once they show up at the theater. “I favor particular theaters, so if I’m anticipating a movie, I’ll choose based on that,” Tyler said. “But I also make more last-minute decisions now, like, ‘Oh, this is playing in 30 minutes nearby — sure, I’ll go see that.’”

MoviePass’s policies are giving some users pause

For MoviePass, though, that spur-of-the-moment system is both a feature and a bug.

On the upside, it can mean people take a chance on movies when they wouldn’t have in the past. But one reason people may wait to choose their movie is that MoviePass’s system requires them to be physically near the theater before they “purchase” the ticket — and that can be a problem.

MoviePass’s system presently consists of two parts: an app and a debit card. Users have to be within 100 yards of the theater to reserve their ticket via the app. That’s smart on MoviePass’s part: It means that users have to turn on their phone’s location services in order to reserve the ticket, creating data that MoviePass (in which the data analytics firm Helios and Matheson bought a majority stake in August) can in turn collect and use for various purposes.

MoviePass debit cards can be loaded with funds and used to purchase tickets at theaters.
Darron Cummings/AP Images

But it also can be restrictive — particularly for subscribers who live in areas with highly trafficked movie theaters. Laura, who’s in her 30s and lives in San Francisco, got a MoviePass subscription, but she hasn’t used it yet, largely for this reason. “I bought the pass primarily because you could use it at Alamo Drafthouse, which I love and is near to where we live,” she said. “But trying to compete with tons of other people for limited spots at the theater is kind of a drag.”

“In the age of being able to buy a ticket and choose a seat on an app a week before a movie comes out, it’s super inconvenient to have to wait until the day of and go to the theater in person, hoping there will be tickets left,” she added.

The risk of being shut out of a film during busy times may in fact be one reason that MoviePass users are more apt than nonsubscribers to show up during the week. “I think 100 percent of the 12 or so movies I’ve seen with MoviePass in the past three months were matinees or weeknights,” Tyler said. “The fact that you can’t buy your ticket in advance of the date makes me want to pick times I think will be less crowded — I saw Infinity War at a 10 am showing.”

Several people I talked to also said that MoviePass made them more flexible about which theater they went to. Many favored nicer theaters, with more comfortable seats, or theaters that were closer to home. But if the MoviePass app showed that the film they wanted to see was at their less favored theater, they still were likely to go to that one.

One big recent change to MoviePass’s service is the decision that people can no longer see the same movie more than once using their MoviePass. While plenty of people don’t see movies multiple times in theaters, others do — including me — and the change has been a source of frustration.

Gavin said he saw movies he really enjoyed multiple times, including Annihilation and Black Panther. “That is something I have never done in my life due to ticket prices,” he said, but MoviePass’s new policy “bums me out.”

I reached out to MoviePass for comment, and the public relations team offered this statement:

We recently made some updates to our Terms of Service, including the policy that MoviePass subscribers are only permitted to see any movie in the theaters once with their MoviePass. This falls within our continued effort to limit fraud on our app and has been effective in doing so in the past.

The company did not respond to further requests for comment.

But there are two obvious reasons why MoviePass would enact this policy. One is that people in a household (spouses or roommates, for instance) could theoretically share a MoviePass account, with people trading off days. An update to MoviePass’s app released in late April locks each MoviePass account to one mobile device, making this much more difficult, but it still wouldn’t be impossible. Restricting users to only using MoviePass for a movie once, though, makes it even more difficult, discouraging would-be sharers.

And because MoviePass is reimbursing theaters for the full price of each ticket, it has a vested interest in making sure a person can’t see the same movie every day — it costs them money. (If you think that’s unlikely, don’t forget how many times people went to see Titanic back in the day, or how many people were planning repeat viewings of Black Panther before it even came out.) A finite number of movies are available in theaters at one time, and so by restricting the number of times a user can see a movie to one, MoviePass potentially cuts down on the number of times a subscriber will use the pass each month.

Still, while that kind of policy might drive some subscribers to see a wider variety of films, the new policy could also be annoying for the sort of cinephile who wants to rewatch the same movie over and over while it’s still on the big screen. The net effect, in all likelihood, is that some of those people will now simply not see the movie again a second time, because of the high cost of buying a movie ticket. Why not go see something else instead?

MoviePass shows that the future of movie theaters is probably in a subscription model

That sort of change in moviegoers’ viewing habits is probably what AMC was worried about when it said MoviePass “wasn’t doing moviegoers any favors.” When MoviePass changes moviegoers’ habits, it also changes the way they value movie tickets, AMC argued, and “only sets up consumers for ultimate disappointment down the road if or when the product can no longer be fulfilled.”

But MoviePass’s continued popularity despite its many changes to its model indicates that the real need for change might lie with the movie theater business itself.

Subscription models — in large part prompted by Netflix’s DVD-by-mail service, which killed Blockbuster — now drive home entertainment. People don’t want to pay a per-viewing fee to rent or buy media anymore. Netflix, Hulu, and other services trade on the idea that you should be able to get your movies and TV for one fee per month, something you are happy to pay because it’s predictable.

Millennials in particular love the subscription model, something that retailers are taking note of as the demographic grows in buying power. A study conducted by the payments processor Vantiv in 2017 found that more than 70 percent of millennials have a product subscription and 89 percent a service subscription — a reaction, they suggest, to being “bombarded with an abundance of choice,” and a percentage that far outpaces boomers and Gen-Xers.

Rapper Big Boi performs at the MoviePass x iHeartRadio Festival Chateau in La Quinta, California, on April 15, 2018.
Joe Scarnici/Getty Images

I’m 34, which makes me a millennial; among my subscriptions are streaming music, film, and TV services; several magazines and newspapers; a coffee roastery that sends me a pound of coffee every two weeks; and a subscription to a software suite from Adobe that would be too expensive to purchase outright and constantly upgrade. Others I know maintain subscriptions to vitamin and health supplement providers, razor manufacturers, and wardrobe rental services.

MoviePass fits right in with the subscription economy, and in a demographic that advertisers are eager to reach — something the company likely hopes to capitalize on. And the numbers seem to make one thing clear: Given a subscription model for tickets, people are more likely to go to the theater.

For a struggling theater industry, that could be a boon. The National Association of Theatre Owners recently indicated that the number of tickets sold in the second quarter of 2018 fell 6 percent from the first quarter, and that US movie admissions in 2017 fell 6 percent, for the lowest earnings since 1995. The industry is in trouble, and it doesn’t seem like adding comfier chairs and better food is going to save it if à la carteticket prices keep going up.

So it makes sense for a subscription service to evolve to compete with that older model. And even if MoviePass fails, the model it’s operating on is already being tested by other theaters. Some cinemas (especially small and independent theaters in locations that have a devoted filmgoing audience) have started membership programs that give subscribers access to discounted or free tickets and other special events.

The movie theater chain Cinemark announced a membership program of its own in December: For $8.99, members received one free movie ticket per month (with unused tickets rolling over into the next month), discounted ticket prices, reserved advanced seating, and a 20 percent concessions discount. Independent theaters, like Chicago’s Music Box Theatre or New York’s Metrograph, have introduced membership programs of their own. Some of those benefits don’t measure up to MoviePass’s one-movie-per-day model, but some of the other benefits may be attractive to regular customers, like being able to reserve tickets ahead of time (instead of having to be within 100 yards of the theater).

Still, what’s not yet clear is whether MoviePass’s model, or anyone else’s, can save the movie theater industry. For most people, prices are still just too high — a symptom of a struggling industry that MoviePass treats but doesn’t cure. But if MoviePass can’t figure out how to turn a profit, it will eventually crash. If it can figure out how to turn a profit, it may still cut into theaters’ bottom line. And even if MoviePass implodes, some other company may come along to disrupt the business.

All that’s sure about the movie theater business’s future is that nothing is sure. What’s clear is that MoviePass represents the first act in an ongoing cultural shift in how we see movies on the big screen. But to know the future of the movie theater business, we’ll have to wait and see how the second act unfolds.

May 2018 RISC-V workshop proceedings

$
0
0

RISC-V Workshop in Barcelona Proceedings

7-10 May, 2018

Co-hosted By

Co-sponsored By

 

Keynote sessions at the event included Robert Oshana, vice president of software engineering research and development at NXP, Martin Fink, executive vice president and chief technology officer at Western Digital, and Mateo Valero, director at the Barcelona Supercomputing Center.

  • Monday, May 7, 2018 – A half-day of tutorials from the working groups of the RISC-V technical committee. The sessions covered topics such as base ISA ratification, BitManip, compliance, debug, formal spec, memory model, opcode space management, privilege spec, security, software toolchain and vector extensions.
  • Tuesday and Wednesday, May 8-9, 2018 – Two full days of presentations on RISC-V architecture, commercial and open-source implementations, software and silicon, vectors and security, applications and accelerators, simulation infrastructure and more.
  • Thursday, May 10, 2018 – The event will conclude with RISC-V Foundation meetings, restricted to members of the RISC-V Foundation. The day will consist of Technical and Marketing Committee face-to-face meetings to progress the work currently underway within our various Task Groups.

Each workshop has helped both document the rapidly rising popularity of RISC-V and boosted it further due to the information shared and collaborations formed at the event.

Proceedings

Check out the slides from each of the sessions below and stay tuned for the videos.

Monday, 7 May, 2018 RISC-V Workshop Tutorial Day

TimeEventSpeaker, Affiliation
12:30pmRegistration
1:00pmRISC-V ISA & Foundation OverviewRick O’Connor, RISC-V FoundationSlides
1:15pmBASE ISAAndrew Waterman, SiFiveSlides
1:50pmPrivileged ISAAllen Baum, Esperanto TechnologiesSlides
2:25pmMemory ModelDaniel Lustig, NVIDIASlides
3:00pmNetworking Break
3:20pmVector ISARoger Espasa, Esperanto TechnologiesSlides
3:55pmDebug SpecificationGajinder Panesar, UltraSoCSlides
 4:30pmFormal SpecificationThomas Bourgeat, MITSlides
5:05pmLLVM for RISCVAlex Bradbury, lowRISCSlides

Tuesday, 8 May, 2018 RISC-V Workshop Day 1

TimeEventSpeaker, Affiliation
8:00amRegistration and Networking Breakfast
8:45amWelcome Address & Foundation OverviewRick O’Connor, RISC-V FoundationSlides
9:00amState of the Union: RISC-VKrste Asanovic, SiFiveSlides
9:25amThe State of RISC-V SoftwarePalmer Dabbelt, SiFive and Arun Thomas, Draper LaboratorySlides
9:55amVector ISA Proposal UpdateRoger Espasa, Esperanto TechnologiesSlides
10:25amThe RISC-V Formal Specification Technical Group: Progress ReportRishiyur Nikhil, BluespecSlides
10:40amRISC-V Memory Consistency Model Task Group UpdateDaniel Lustig, NVIDIASlides
11:55amNetworking Break
Keynotes
11:20amSoftware Drives Hardware, lessons learned and future directionsRobert Oshana, NXPSlides
11:50pmUnleashing the Power of Data with RISC-VMartin Fink, Western DigitalSlides
12:15pmNetworking Lunch
1:30pmRISC-V Debugging: Custom ISA Extensions, Multicore, DTM VariantsMarkus Goehrle, Lauterbach Engineering GmbHSlides
1:45pmGDB for RISC-V: Extending Support for Bare Metal Multi-core DebuggingJeremy Bennett, EmbecosmSlides
2:00pmA Common Software Development Environment for Many-core RISC-V based Hardware and Virtual PlatformsGajinder Panesar, UltraSoC and Simon Davidmann, ImperasSlides
2:15pmHiFive Unleashed: World’s First Multi-Core RISC-V Linux Dev BoardYunsup Lee, SiFiveSlides
2:30pmHiFive Unleashed Expansion Options and CapabilitiesTed Marena, MicrosemiSlides
2:45pmSimulating Heterogeneous Multi-node 32-bit and 64-bit RISC-V Systems Running Linux and Zephyr with the Open Source Renode FrameworkMichael Gielda, AntmicroSlides
3:00pmNetworking Break
3:25pmDebian GNU/Linux Port for RISC-V 64-bitManuel Fernandez Montecelo, Debian CommunitySlides
3:55pmFedora on RISC-VRichard Jones, Red Hat and David Abdurachmanov, IndependentSlides
4:10pmSmallest RISC-V Device for Next-Generation Edge ComputingSeiji Munetoh, IBMSlides
4:25pmVideo: The MareNostrumSlides
4:30pmPoster / Demo Previews
6:00pmNetworking Reception, Posters Sessions and Demos

Wednesday, 9 May, 2018 RISC-V Workshop Day 2

TimeEventSpeaker, Affiliation
8:00amRegistration & Networking Breakfast
8:45amFast Interupts for RISC-VKrste Asanovic, SiFiveSlides
9:15amRISC-V DSP (P) Extension ProposalChuan-Hua Chang, Andes Technology Corporation and Richard Herveille, RoaLogic BVSlides
9:30amRISC-V ISA Cryptographic Extensions Proposal SummaryRichard Newell, MicrosemiSlides
9:45amFormal Assurance for RISC-V ImplementationsDaniel Zimmerman, Galois and Joseph Kiniry, GaloisSlides
10:15amNetworking Break
 10:45amUndefined, Unspecified, Non-deterministic, and Implementation Defined Behavior in Verifiable SpecificationsClifford Wolf, Symbiotic EDASlides
11:00amFoundational HPC Systems for 2020 and BeyondSteven Wallach, Micron TechnologySlides
11:15amKeynote: European Processor Initiative & RISC-VMateo Valero, Barcelona Supercomputing CenterSlides
11:45pmNetworking Lunch
1:00pmSecuring High-performance RISC-V Processors from Time SpeculationChristopher Celio, Esperanto Technologies and Jose Renau, Esperanto TechnologiesSlides
1:15pmUse of RISC-V on Pixel Visual CoreMatt Cockrell, GoogleSlides
1:30pmLinux-Ready RV-GC AndesCore with Architecture ExtensionsCharlie Su, Andes Technology CorporationSlides
1:45pmProcessor Trace in a Holistic WorldGajinder Panesar, UltraSoCSlides
2:00pmRISC-V Meets 22FDX: an Open Source Ultra-low Power Microcontroller Platform for Advanced FDSOI TechnologiesPasquale Schiavone, ETH Zurich and Sanjay Charagulla, GlobalFoundriesSlides
2:15pmAriane: An Open-Source 64-bit RISC-V Application Class Processor and latest ImprovementsFlorian Zaruba, ETH Zurich and Luca Benini, ETH ZurichSlides
2:45pmNetworking Break
3:15pmRISC-V Support for Persistent Memory SystemsMatheus Ogleari, Western Digital Corporation
3:30pmThe Hybrid Threading Processor for Sparse Data KernelsTony Brewer, Micron TechnologySlides
3:45pmHow PULP-based Platforms are Helping Security ResearchFrank Gürkaynak, ETH ZurichSlides
4:00pmRISC-V Virtual Platforms for Early RISC-V Embedded Software DevelopmentLee Moore, Imperas and Hugh O’Keeffe, AshlingSlides
4:15pmRISC-V Workshop Barcelona ConclusionRick O’Connor, RISC-V Foundation

Munchery Shuts Down Operations in LA, New York and Seattle

$
0
0

the on-demand delivery startup, has shut down its operations in Los Angeles, New York and Seattle, the company announced on its blog today. That means the teams from those cities are also being let go. In total, 257 people (about 30 percent of workforce) were let go, according to a Munchery spokesperson.

“We recognize the impact this will have on the members of our team in those regions,” Munchery CEO James Beriker wrote on the company blog. “Our teams in each city have built their businesses from scratch and worked tirelessly to serve our customers and their communities. I am grateful for their unwavering commitment to Munchery’s mission and success. I truly wish that the outcome would have been different.”

With LA, New York and Seattle off the table, Munchery says it’s going to focus more on its business in San Francisco, its first and largest market. This shift in operations will also enable Munchery to “achieve profitability on the near term, and build a long-term, sustainable business.”

The last couple of years for Munchery has not gone very well, between scathing reports of the company wasting an average of 16 percent of the food it makes, laying off 30 employees and burning through most of the money it raised.

During that time, Munchery tried a number of different strategies. Munchery, which began as a ready-to-heat meal delivery service, in 2015 started delivering meal recipes and ingredients for people who want to cook. Then, Munchery launched an $8.95 a month subscription plan for people who order several times a month. In late 2016, Munchery opened up a shop inside a San Francisco BART station to try to bring in new business.

But it’s not just Munchery that has struggled. The on-demand food delivery business is tough in general. Over the last couple of years, a number of companies have shuttered due to the now well-known fact that the on-demand business is tough when it comes to margins. The most recent casualty was Sprig, which shut down last May, after raising $56.7 million in funding. Other casualties include Maple, Spoonrocket and India’s Ola.

Munchery has raised more than $120 million in capital from Menlo Ventures, Sherpa Capital and others. In March, the company was reportedly seeking $15 million in funding to help keep its head above water.


The Jaguar Is Made for the Age of Humans

$
0
0

“There’s a jaguar in the baño,” George Olah told me with a small smile.

“Um?” I managed, squinting into the dusky Amazon forest surrounding our camp.

“She’s behind that tree. Look for spots,” Olah said. Then: “No. That tree,” pointing to a trunk between 30 and 40 feet away.

In an instant, I registered that, yes, the bathroom trail we had cut through the Peruvian jungle was indeed occupied by a member of the largest cat species in the Americas. She was so close that if she launched herself at one of us, it would be game over in seconds.

“Shiiiiiiiiit,” I said as we—unarmed except for a couple of machetes and a small slingshot—quickly moved closer to get a better look.

Powerful predators that kill by puncturing skulls with their tremendous bite, jaguars reign over both ecosystems and mythologies. Everyone hopes to see one of the spotted cats when they visit this part of Peru, and on several earlier occasions, I’d been lucky enough to glimpse the cats along the riverbank. But this was the first time I’d been jaguar’d out of the damn bathroom.

And it was the first time I experienced what I’ve learned to call jaguarness.


It was our second night in Peru’s Candamo Valley, which is tucked between two Andean ridges in the country’s southeast. Olah, a conservation geneticist at Australian National University, was looking for wild macaws to catch and outfit with satellite tracking collars, and he was hoping to find the colorful birds here, in one of the most remote places on Earth.

To get to Candamo, we had spent several days traveling by motorized canoe, first up the Río Tambopata, then on the swift and treacherous Távara, and finally through the series of rapids that guard the valley’s mouth. Candamo is so isolated, and so tricky to get into, that it has earned the nickname “the last rain forest without humans.”

No one has ever really lived in Candamo. Or at least, there’s no evidence for continual human habitation, though rumors swirl about drug runners using the 350,000-acre patch of rain forest to move their wares across the Bolivian border by air. But even the rubber hunters of the 1800s, who so completely bled the area’s trees, mostly stopped short of Candamo. Now, the only lingering signs of their presence are downriver along the Távara, not far from the site where both Peruvian and foreign scientists once tried—and failed—to establish a research station.

So Candamo’s wildness only thrusts itself upon a handful of researchers, the occasional lucky journalist, and indigenous fishermen, the only people allowed to hunt in the valley. In other words, this rain forest is arguably one of the most stubbornly isolated places on the planet—and perfect for finding truly untamed animals.

Before departing for Candamo, we were told to expect some unusual behavior from critters unaccustomed to humans. We heard about monkeys dropping out of trees to investigate their strange bipedal cousins; and once we arrived, we quickly learned that the caiman lounging in the river didn’t bother to swim away while we rinsed off our dishes.

But jaguars that crept into campsites, completely unruffled by a bunch of humans with headlamps, tents, and Olah’s phone blasting the same silly pop song over and over? No one expected that.

Had I done a bit more research, I would have learned that in one sense, our experience wasn’t that unusual. Many humans who visit the Peruvian rain forest are calmly watched by a jaguar or two. Most of them, however, don’t realize they’re under surveillance.

The Ese’Eja, indigenous to this area of Peru, say that the jaguar only shows himself to you when you are ready to see him, and Panthera onca generally live in solitude and take great care to avoid conflict with humans. In fact, while individual lions, tigers, and leopards have hunted people, jaguars have never been known to systematically pursue us.

Those who have studied jaguars say they sense a kind of preternatural consciousness in the beasts, a combination of disciplined energy and shrewd awareness that allows the jaguar to unleash its power in calculated ways. Alan Rabinowitz, struggling to find the right words, calls it simply “jaguarness.”

“There weren’t really proper English terms I could put together which really get it,” says Rabinowitz, the chief scientist for the global wildcat conservation organization Panthera. “I sometimes say ‘gentle giant,’ but it’s not a giant among the cats and it’s not gentle, really. It’s this very, very powerful animal that you could walk up to and holler at, and it’ll go away.”

Those seemingly contradictory qualities, along with the jaguars’ exquisite predatory capabilities, offer the cats hope of surviving in a human-dominated age.


No one knew how long the jaguar had been watching us. We’d pulled our canoe up to the spot in the late afternoon, then macheted a clearing in a flat patch of jungle uphill from the river. Then we’d cooked dinner under the observant gaze of several monkeys, and afterward, one of our crew had headed to the baño. Along the way, he had noticed the twin orbs glowing in the beam of his headlamp.

“The light was not too strong, her pupils were still very wide,” reported Davíd Attila Molnár, a filmmaker. “I saw two sparkling eyes that were dangerously far away from one another.”

Molnár quickly retreated. But the jaguar stayed near her tree, even after all nine of us showed up for a look. She occasionally yawned, displaying an impressive mouthful of teeth. Eventually, she curled up in the leaves like a house cat on a window seat and went to sleep, her sporadically twitching ears visible through the brush.

A photograph of a jaguar behind jungle plants at night
The jaguar at the author’s camp (Nadia Drake)

After 20 minutes, she stirred, woke up, and set her golden eyes upon us once again.

We weighed our options with a mix of bemusement and awe. Should we post rotating pairs of guards? Try and scare her off? Forget about the whole situation and go to sleep?

Spent from a long day of fighting off swarms of bugs, I went to bed, wagering that an otherwise nonaggressive jaguar wouldn’t suddenly decide to eat me.


Rafael Hoogesteijn, a veterinarian and biologist in the Brazilian Pantanal who has studied jaguars since the 1980s, is aware of only one instance in which a wild jaguar killed a human without provocation: In 2008, in the northern Pantanal, a cat dragged a fisherman from his tent and killed him, eating part of his face and neck.

But, “that jaguar population had been baited for some time,” Hoogesteijn says. Baiting, which is now forbidden by the Brazilian government, is a strategy used to lure jaguars onto beaches with various meats so that when boats full of tourists arrive, the habituated cats do, too.

“When the cats are not baited, they get angry, and then you have accidents happen,” says Hoogesteijn. “But people go on doing it because they gain a lot of tips from tourists.”

The handful of other documented jaguar attackson humans have primarily occurred when the cats are provoked by hunters and their dogs, are disturbed near a fresh prey carcass, or are protecting their cubs. In some cases, it’s not even clear whether the attack was the work of a jaguar or a puma, the second-largest cat in the Americas.

“There is no reason, really, to be fearing jaguars if you don’t mess with them,” Hoogesteijn says. “In the wild, they don’t want any confrontation with humans—they see you as another very potent predator.”

Of the more than 160 interactions Hoogesteijn has had with jaguars, he says he only felt truly threatened once, when a jaguar mock-charged him and his colleague Fernando Tortato. “He was running, really mad, angry, roaring, showing his teeth, hair bristling—and stopped about 10 or 12 meters from us and then jumped off the road,” he recalls. “We almost shitted our pants.”

Statistic after statistic suggests that, left on their own in the wild, unprovoked jaguars just aren’t inclined to attack humans (captive jaguars, unfortunately, are a different story), although we certainly make easy prey for a cat that normally weighs between 100 and 200 pounds, can bite through armored reptiles and turtle shells, and is strong enough to haul cows and tapirs into trees.

“I’m much more afraid of walking in grizzly-bear country than I am of walking in big-cat country,” Rabinowitz says.


Not long after dozing off, I awoke to Olah shaking my tent, yelling that we needed to abandon camp and run for the boat, NOW. I grabbed my camera and headlamp and threw open the tent flap, expecting to see eight panicked people sliding down the trail to the riverbank, jaguar in pursuit.

Instead, I saw eight people standing almost completely still, transfixed by the large, dappled cat gracefully, silently stepping down the hill. Her muscled body stretched and contracted as if she were a coiled spring, each foot falling perfectly into place. When she reached the small, shrubby patch of forest, she paused, settled down in the foliage, and stared at us.

No one knew what to do. Though the cat was not displaying any signs of aggression, we were a leap away from an apex predator that kills with a single bite and easily outweighed the smallest of us.

Unarmed, and reasoning that perhaps she might behave similarly to pumas—who retreat from or don’t bother larger animals—several of our team decided to link arms and slowly walk toward her, with the intention of gently driving her back into the forest. But as the human chain began moving down the trail, the jungle’s fiercest beast rose onto her paws and did a most unexpected thing: She padded toward them. Calmly, quietly, one foot in front of the other, the jaguar walked even farther into camp, on a collision course with our burliest crew members.


Once, in Belize, Rabinowitz had an encounter with a jaguar that mirrored our experience in Peru. He’d been tracking the cat for a while when suddenly, he realized that the joke was on him—the jaguar had circled around and was tracking the human. Soon, face to face with the cat and unsure what to do, Rabinowitz took the passive option.

“I could get big and scream and act crazy, but the cat wasn’t doing anything—it was just walking and curious,” he says. “So I kneeled. And the jaguar sat. Which is not what I expected.”

After a bit, Rabinowitz straightened up and slowly backed away. The cat did, too.

“He stood up, walked away, and looked back,” Rabinowitz recalls. “It was incredible. Well, it’s always incredible in retrospect. At the time it was pretty scary. You know there’s nothing you can do if that animal wants to hurt you.”

He and others suspect that the jaguar’s evolutionary history sets it apart from the other, more aggressive members of its Panthera genus. Though all the big cats predate humans, lions, tigers, and leopards share millions of years of evolutionary history with hominids, both ancient and modern, as a simple consequence of geographical distribution.

Jaguars, on the other hand, do not. Though their evolutionary tree is patchy at best, scientists suspect jaguars are descendants of Asia’s clouded leopards. Several hundred thousand years ago, those prehistoric jaguars—likely larger and lankier than the cats of today—crossed over the Beringian land bridge in the Arctic. And as they worked their way down the American continents, inhabiting territory that once stretched from the northern United States to southern Argentina, jaguars encountered dire wolves, saber-toothed cats, and mammoths—but no humans.

An illustration of a jaguar prowling through tents in a camp
Lucy Engelman

Humans didn’t follow the cats over that far-northern land bridge until about 20,000 years ago, and as a relatively recent addition to the Americas, humans never really came into conflict with jaguars—at least, not until a geologic eyeblink ago. During our eons of absence, the cats grew accustomed to a mostly solitary life in deserts and dense jungle habitats, sustained by a multitude of prey species that didn’t walk on two legs.

Hoogesteijn also points to the impacts of colonization and the recent, devastating rise of the pelt trade, both of which may have sculpted the jaguar’s current attitude toward humans.

“Hundreds of thousands of jaguars were killed all around Latin America,” Hoogesteijn says. “Those that survived were the more wary, the most secretive, and the least conspicuous.”

Whether through genes, learning, or a combination of both, those traits are likely prevalent in today’s declining population, which is now classified as “near threatened” by the International Union for Conservation of Nature. It occupies a small percentage of its historical range, which has contracted to exclude most of Argentina, El Salvador, and Uruguay. And, though jaguars were spotted near the Grand Canyon and along the west coast of California as recently as the early 1900s, only a handful of cats have since been seen in the deserts of the far southern United States.

Our jaguar, though, who lives deep in a valley where humans are scarce, apparently never learned that curiosity can occasionally kill a cat.


In the small, brushy clearing behind our camp, everyone stopped. The jaguar was just a few paces from four startled humans, and an easy leap from the spot where the rest of us were watching.

After a beat, both parties backed away, one more gracefully than the other. I’d begun to accept that a lurking carnivore was just a new reality to be endured until daybreak—let’s take turns on jaguar duty, in pairs!—when someone suggested that perhaps we ought to try slinging a few small rocks in her direction, using the slingshot we used to lob climbing ropes into the jungle canopy.

Our boat driver, Braulio Poje Mishaja—who’s from the Ese’Eja community of Infierno, near Puerto Maldonado—began to gently launch rocks toward the cat. They whooshed through the air, landing in the vegetation near the jaguar. Once, twice, three times. After a long, silent moment, she got up, turned around, and slowly stepped back up the hill and into the forest.

¿Qué significa el tigre para los Ese’Eja?” I asked Poje Mishaja. What does the jaguar mean to the Ese’Eja?

Es el rey de la selva,” he answered. The king of the jungle.


Many humans just don’t think they can tolerate large, toothy beasts as neighbors, no matter how peaceful those beasts may be. In North America, we’ve dramatically reduced the ranges of pumas, bears, and wolves, executing “problem” animals, claiming pelts for trophies, and moving into territories that simply can’t support healthy populations of both humans and predators. Sometimes, our actions have rendered entire subspecies extinct, and the loss of these top carnivores has ecosystem-wide effects that are slowly making themselves known.

In Africa, lions have lost nearly half their population in just two decades, and across Asia, tigers are doing similarly poorly. In Latin America, jaguars are suffering heavy losses, too. The exact number of jaguars killed each year is not known—it’s illegal to kill the cats throughout their range, so data are scarce and unreliable—but biologists estimate the numbers to be in the hundreds, especially in countries like Brazil, where the bulk of the jaguar population lives.

Today, most of the cats are killed out of fear or in retaliation for attacks on livestock, but there’s a rising threat in Bolivia, where buying pressure from Chinese medicinal markets is now focused on the spotted cats. Chinese buyers might shell out more than $100 for a single jaguar canine tooth—and given that each cat has four of those teeth, and the laws prohibiting killing are rarely enforced, it’s more than enough economic incentive for poachers.

“It’s not going to be long before they come here,” says Daniel Couceiro, a biologist who works near the Bolivian border in Peru’s Tambopata National Reserve.

But a new population estimate, based largely on the results of 117 camera-trapping studies and some models of human population density, suggests there could be more than 170,000 jaguars throughout the Americas. That number might not sound too bad, but the researchers caution that the estimate is likely to be optimistic—and that population numbers could be much higher, if the cats were able to reclaim their ancestral territories.

So there’s hope for the jaguar. Perhaps more than any of its Panthera kin, it’s a triple threat, extremely adept at swimming, climbing trees, and roaming the land. Its ability to take advantage of the landscape surely helped it survive the mass extinction at the end of the Pleistocene, which left only two large cat species in the Americas, and its diverse menu means there’s almost always something a jaguar can catch and eat. Perhaps most importantly, its solitary nature means that it can live on the fringes of human habitation, slinking through the underbrush in search of capybaras and other treats, often without being detected at all.

“Their ability to adjust to a variety of environments, including ‘edge’ environments, makes them better adapted for a humanized world,” says the University of Alabama’s Michael Steinberg, who studies attitudes toward jaguars among the Maya in Belize. But, he says, “Jaguars won’t survive without a sympathetic or at least neutral local human population, and they need forested areas through which they can move, hunt, and retreat.”

While jaguars do need continuous corridors of habitat, Rabinowitz says that most of those spaces already exist, and are already being used by humans in ways that allow jaguars to disperse, rest, hunt, and survive.

Through its Jaguar Corridor Initiative, Panthera is working with governments from Mexico to Argentina to protect and maintain lands for jaguar survival, to convince Latin America governments that it’s important to enforce legislation protecting the cats. And, they want to enlist the Chinese government’s help in quelling demand for these otherwise useless animal parts.

Jaguarness, Rabinowitz says, will take care of the rest if all of that falls into place. “The jaguar is adaptive, it’s smart, it’s resilient,” he says. “If the jaguar falls, a hell of a lot is going to be falling before it.”


Most of the others had gone to bed, and camp was quiet, but Olah and I stayed up, passing a bottle of rum back and forth and keeping a wary eye out for our feline friend. We sat near the baño where the jaguar had materialized hours earlier, sweeping our headlamps in great, looping arcs. Yet all we saw were ghostly spiderwebs, glittering with tiny, gleaming eyes.

She was probably just out of sight, quietly watching us watch for her. But we never saw her again.

Tesla Executive Leaves for Alphabet Self-Driving-Car Unit Waymo

$
0
0

A senior Tesla Inc. executive, who was the company’s main technical contact with U.S. safety investigators, has left for rival Waymo LLC, according to people familiar the decision.

Matthew Schwall, who had been the director of field performance engineering at Tesla, exited the company as the National Transportation Safety Board has been investigating multiple crashes involving the electric vehicles. Mr. Schwall’s exit coincides with Tesla’s announcement Friday that its engineering chief, Doug Field, was taking a leave of...

Show HN: Create-React-app-parcel, a CLI for Creating React Apps with Parcel

$
0
0

README.md

a fun experiment to create react apps with parcel instead of webpack cos why not

Latest version 0.0.19


npm i -g create-react-app-parcel

crap my-app# or create-react-app-parcel my-appcd my-app
yarn start

You will have a very simple folder structure, same as create-react-app:

my-app
├── README.md
├── node_modules
├── package.json
├── .gitignore
├── public
│   └── favicon.ico
│   └── index.html
│   └── manifest.json
└── src
    └── App.css
    └── App.js
    └── App.test.js
    └── index.css
    └── index.js
    └── logo.svg
    └── registerServiceWorker.js

No configuration or complicated folder structures, just the files you need to build your app.

npm start or yarn start

Runs the app in development mode.
Open http://localhost:1234 to view it in the browser.

The page will automatically reload if you make changes to the code.
You will see the build errors and lint warnings in the console.

npm test or yarn test

⚠️ warning: this functionality is untested for now

npm run build or yarn build

Builds the app for production to the dist folder.
It correctly bundles React in production mode and optimizes the build for the best performance.

The build is minified and the filenames include the hashes.

Your app is ready to be deployed.

yarn eject

ejects you out of this shiznit like so

Contributing

We'd love to have your helping hand on create-react-app-parcel! Ping me on twitter @swyx to discuss or file an issue, this is super new

Acknowledgements

We are grateful to the authors of existing related projects for their ideas and collaboration:

License

Create React App Parcel is open source software licensed as MIT.

Official Emoji

of course it's the 💩

A guide to better embedded C++

$
0
0

Disclaimer: this, by no means, is not a definitive description of the whole embedded-specific development. This is just a small good practice about interaction with hardware.

Embedded is a wonderful versatile world which allows developers to create various interesting everyday devices (in collaboration with the hardware team).

The motivation behind this post is pretty simple: there is a lot (A LOT) of bad embedded code. There are several reasons for that:

  1. No background programming experience or education. Very often electronics students are taught plain C or C with classes (watch Kate talk about that).
  2. Difficult debugging. Most embedded systems are slow and have very limited debug abilities (sometimes even none of them at all). This is not a problem per se but may lead to numerous hotfixes and spaghetti code.
  3. Exotic architectures (where the byte is 24 and 32 bit long) with various compilers. Previously it used to be mostly custom stuff, but now processor manufacturers tend to fork some GCC or LLVM version and build a custom toolchain. This leads to problems with code reuse and significantly slows down the new standards adoption.

Long story short, the goal is to convert this code (CubeMX, STM32):

voidSystemInit_ExtMemCtl(void){__IOuint32_ttmp=0x00;registeruint32_ttmpreg=0,timeout=0xFFFF;register__IOuint32_tindex;RCC->AHB1ENR|=0x000001F8;tmp=READ_BIT(RCC->AHB1ENR,RCC_AHB1ENR_GPIOCEN);GPIOD->AFR[0]=0x00CCC0CC;GPIOD->AFR[1]=0xCCCCCCCC;GPIOD->MODER=0xAAAA0A8A;GPIOD->OSPEEDR=0xFFFF0FCF;GPIOD->OTYPER=0x00000000;GPIOD->PUPDR=0x00000000;GPIOE->AFR[0]=0xC00CC0CC;GPIOE->AFR[1]=0xCCCCCCCC;GPIOE->MODER=0xAAAA828A;GPIOE->OSPEEDR=0xFFFFC3CF;GPIOE->OTYPER=0x00000000;GPIOE->PUPDR=0x00000000;// .../* Delay */for(index=0;index<1000;index++);// ...(void)(tmp);}

To something like this:

voidSystemInit_ExtMemCtl(){rcc.Init();gpio.Init();}

The code in question is hard to read, understand and maintain. The worst is that it’s all true even for the developer who wrote it in the first place. Give him a break for a couple of months and he won’t remember what GPIOE->MODER is.

We can make this code better with the help of two bright thoughts from smart men:

All problems in computer science can be solved by another level of indirection

David J. Wheeler

C++ is a zero-cost abstraction language

Bjarne Stroustrup

The idea behind this is the possibility to create abstractions and separate layers with no performance penalty. When all is said and done, the compiler will optimize out all of the high-level abstractions and generate exactly the same code. Most of the hardware device’s levels of indirection may be represented using the following drawing:

abstraction

Imagine you have a board with some chip on it and your job is to set up some block. First of all, you open the datasheet and see something like this:

bbp2

Ok, we have a vague understanding of the SoC. Our job is to make the DDC (digital down converter, very useful stuff often used in hardware-based digital signal processing) work as we want to. The simplified schematic is below:

ddc

So let’s build our abstractions! According to the diagram above, we start from the very bottom, very low-level. We start with registers. Usually, they’re represented in documentation as something like this:

register

Numbers above mean bits, below are the fields, and this image is usually followed by the table with fields description. It is worth saying, that working with registers usually mean:

  1. A lot of work with bit-fields
  2. A possibility of a value change outside of the program flow

Unfortunately, a lot of embedded low-level libraries deal with registers this way:

*(volatilestd::uint32_t*)reg_name=val;

It takes register address, stored at the reg_name variable (or even #define-constant), casts it to the volatile pointer, dereferences it and stores a value. This is bad for several reasons:

  1. The code is hard to read and maintain
  2. Virtually no possibility for encapsulation and raise an abstraction level
  3. When there are several registers functions usually turn into the code spreadsheet (more than that, it is usually copy-pasted)

There is, however, an alternative. The register in question may be represented as a structure:

structDeviceSetup{enumclassTableType:std::uint32_t{inphase=0,quadrature,table};std::uint32_tinput_source:8;TableTypetable_type:4;std::uint32_treserved:20;};

If the internal fields require any recalculation, this may be done by implementing the GetFoo() and SetFoo() methods. By the way, I’m very excited about this proposal to allow default member initializers for bit-fields.

The next step is to place the object of this structure in the corresponding memory. Depends on what your codebase prefers, this may be done as placing a pointer, a reference, or using a placement new:

autodevice_registers_ptr=reinterpret_cast<DeviceSetup*>(DeviceControlAddress);auto&device_registers_ref=*reinterpret_cast<DeviceSetup*>(DeviceControlAddress);autodevice_registers_placement=new(reinterpret_cast<DeviceSetup*>(DeviceControlAddress))DeviceSetup;

But wait, earlier I said, that register values may change outside of the program scope! In current realization, a compiler is free to cache the object and you will be reading cached value, which is not what we’re expecting.

There is a way to tell the compiler that the value may change, and it’s volatile. I know that this keyword is being misused by a lot of programmers and it has a reputation like goto statement. But it was made for this type of situations (this is a great place to start).

volatileautodevice_registers_ptr=reinterpret_cast<DeviceSetup*>(DeviceControlAddress);volatileauto&device_registers_ref=*reinterpret_cast<DeviceSetup*>(DeviceControlAddress);volatileautodevice_registers_placement=new(reinterpret_cast<DeviceSetup*>(DeviceControlAddress))DeviceSetup;

No, we’re certain, that every read will be performed.

N.B. Accessing registers modified by the hardware may be treated as a multi-threaded application. Therefore, it is worth considering using std::atomic<T> instead of volatile T. Unfortunately, our production compilers don’t fully support C++11 (NM SDK is C++98 with no STL whatsoever, ARM Compiler 5 has C++11 at language-level, but their highly embedded-optimized STL is C++03), so I can’t battle test it. However, compiler explorer shows promising disassembly: link.

Ok, the register part is over, adding a level of indirection: let’s set up a device. Most of the time, devices can be represented as a group of registers or other devices, as simple as that:

structMixer{NCOnco;MixerInputmixer_input;// ...};

Developers should implement common setup methods, as well as access methods for a fine-tuning:

NCO&GetNCO(){returnnco;}

Going further up the abstraction pyramid we create a channel, consisting of devices:

structChannel{Mixermixer;Normalizernormalizer;Downsamplerdownsampler;PackUnitpack_unit;};

And, finally, the whole DDC as an array of channels and some control registers:

structDDC{std::array<Channel,number_of_channels>channels;structControlRegisters{// ...}control_registers;};

This whole thing is called hardware abstraction layer (HAL). It provides the programmatic interface for the developer to interact with the hardware. The greatest thing about HAL is that you can substitute real hardware with the PC-model. This is a big deal to talk about in another article. Shortly, the advantages of models are:

  1. Models allow developers to write programs without the actual hardware. This situation occurs during the development of the processor or the board.
  2. Model development enhances the understanding of the hardware developers are working with.
  3. With models, you can debug in post-mortem mode. Collect command dump or some information and run your model with that data.

In this article, I tried to convince you that the hardware-oriented code can be written in a good way and with no pain for future maintainers.

Scale API is hiring engineers and ML practitioners

$
0
0

Who we are

We're a world-class team that's changing how companies function. We've worked at Facebook, Snapchat, Palantir, Quora, and more.

Our team has built the simplest API for human intelligence. AWS changed the game by removing the need to run your own infrastructure, which enabled a new generation of software companies. We want to do the same by removing the need for you to run your own operations team.

A static binary rewriter that does not use heuristics

$
0
0

README.md

Multiverse is a static binary rewriter with an emphasis on simplicity and correctness. It does not rely on heuristics to perform its rewriting, and it attempts to make as few assumptions as possible to produce a rewritten binary. Details about Multiverse can be found in the paper "Superset Disassembly: Statically Rewriting x86 Binaries Without Heuristics."

Multiverse currently supports 32-bit and 64-bit x86 binaries.

Requirements

Multiverse requires the following Python libraries:

  • capstone (linear disassembler) (we use a slightly modified version that is needed to rewrite 64-bit binaries. Our modified version can be found here)
  • pwntools (for its assembler bindings)
  • pyelftools (for reading elf binaries)
  • elfmanip (for modifying elf binaries) (can be found here)

Compiling

Multiverse is written in Python, but its code to generate a binary's global mapping is written in C. This must be compiled before binaries can be rewritten. To do so, run make and the global mapping code will be compiled.

Running

Multiverse can be run directly, but this will only rewrite binaries with no instrumentation. This can be used to make sure that everything is installed correctly or to debug changes to the rewriter. Running multiverse.py on a binary will rewrite it. It can be run like this: ./multiverse.py [options] <filename>. There are several flags that can be passed to Multiverse to control how a binary is rewritten:

  • --so to rewrite a shared object
  • --execonly to rewrite only a main binary (it will use the original, unmodified libraries)
  • --nopic to write a binary without support for arbitrary position-independent code. It still supports common compiler-generated pic, but not arbitrary accesses to the program counter. This is not currently recommended for 64-bit binaries.
  • --arch to select the architecture of the binary. Current supported architectures are x86 and x86-64. The default is x86.

Rewritten binaries are named as the original filename with "-r" appended (e.g. simplest64 becomes simplest64-r).

Rewritten binaries must be run with the LD_BIND_NOW environment variable set to 1. This prevents control from flowing to the dynamic linker at runtime. Since we do not rewrite the dynamic linker, this is necessary for correct execution (e.g. to run simplest-r, type LD_BIND_NOW=1 ./simplest-r).

A very simple example program is provided (simplest.c), which is automatically compiled when building Multiverse's global mapping code. This can be used to test that Multiverse is installed correctly. For example, to rewrite only the main executable for simplest64, the 64-bit version of simplest, type ./multiverse.py --execonly --arch x86-64 simplest64 and then run it with LD_BIND_NOW=1 ./simplest64-r.

rewrite.py is a utility script to rewrite a binary and its libraries, so that multiverse.py does not have to be run manually for each library, and it automatically creates a directory for the rewritten libraries, plus a shell script to run the rewritten binary. For simplicity when rewriting binaries, we recommend using this script. For example, to rewrite simplest64, type ./rewrite.py -64 simplest64, and the script will rewrite the main binary and all its required libraries (as long as they are not dynamically loaded via a mechanism such as dlopen; since statically determining dynamically loaded libraries is difficult, they must be manually extracted and their paths be placed in <filename>-dynamic-libs.txt, and then rewrite.py will rewrite them). This may take several minutes. When it is complete, run the rewritten binary with bash simplest64-r.sh.

Instrumentation

Multiverse is used as a Python library to instrument binaries. Right now, the instrumentation API is very simple and consists only of the function set_before_inst_callback, which takes a function that is called for every instruction that is encountered and will insert whichever bytes the callback function returns before the corresponding instruction. The callback function should accept a single argument: an instruction object, as created by the Capstone disassembler. It should return a byte array containing the assembled instructions to be inserted.

In order to use multiverse, a script should import the Rewriter object (from multiverse import Rewriter) and then create an instance of Rewriter. Its constructor takes three boolean arguments:

  • write_so to rewrite a shared object
  • exec_only to rewrite only a main binary (it will use the original, unmodified libraries)
  • no_pic to write a binary without support for arbitrary position-independent code. It still supports common compiler-generated pic, but not arbitrary accesses to the program counter. This is not currently recommended for 64-bit binaries.

exec_only and no_pic are performance optimizations that will not work on all binaries. For a main executable, write_so should be False, and for shared objects, write_so should be True. If exec_only is False, then all shared objects used by the binary must be rewritten.

Two simple instrumentation examples can be found in icount.py (insert code to increment a counter before every instruction) and addnop.py (insert a nop before every instruction). These are currently configured to instrument only the main executable of 64-bit binaries. For example, to insert nops into simplest64, type python addnop.py simplest64, and to run the instrumented binary, type LD_BIND_NOW=1 ./simplest64-r.

We are working on a higher-level API that will allow code written in C to be seamlessly called at instrumentation points, but it is not yet available.

Citing

If you create a research work that uses Multiverse, please cite the associated paper:

@inproceedings{Multiverse:NDSS18,
  author    = {Erick Bauman and Zhiqiang Lin and Kevin Hamlen},
  title     = {Superset Disassembly: Statically Rewriting x86 Binaries Without Heuristics},
  booktitle = {Proceedings of the 25th Annual Network and Distributed System Security Symposium (NDSS'18)},
  address   = {San Diego, CA},
  month     = {February},
  year      = 2018,
}

Building a $30k/Month User Testing Service – Askable Co-Founder Interview

$
0
0

Hey, I’m Andreas Zhou, one of the co-founders of Askable. We’re an Australian based startup and we’re the “Uber for user testing”. Basically, we help UX designers recruit, manage and pay people for in-person usability testing or market research. For designers, it’s a huge time/money saver. And for the participants, it’s really good side income plus they get their opinions and ideas heard.

Previous to Askable, I was running a digital agency with of a team of about 40 full-time staff. I started the agency with one of the other co-founders, John Goleby. Over the last 10 years, I’ve worked on various projects as a video and audio producer, project manager, digital marketer, UX / UI designer and programmer. I definitely consider myself a sort of jack-of-all-trades.

We launched an MVP of Askable in July of 2017 and got one sale that month of $1500 USD. As of this month so far (April 2018) we’ve done $38,000 USD in revenue and continue to grow around 30% month to month. We’re a team of 8 people based in Brisbane, Australia.

In the beginning (or even now) do you maintain a full-time job while launching?

So we were probably a little different compared to other companies with how we made time for Askable from the beginning. As I mentioned earlier, in 2007 John Goleby and I started a web design agency after dropping out of school. Around 2012 we implemented sort of an internal incubator program for all of our staff (we had 10 full-time employees at the time) at the agency.

We took out a lease for a second office, and we gave everyone one day (paid) every week to go there work on their own projects. Yep, this was heavily inspired by Google’s own 80/20 time! It was a huge decision for us because unlike Google we didn’t have massive profit margins or lots of spare cash in the bank. But we were adamant about having an outlet for building our own products (no client revisions hooray!) and working on our own passion projects so we decided to give it a go. We probably churned out more than 30 projects/ games/apps/side businesses over the course of the next 5 years. Most of them were complete crap but we always learned something from it.

And then finally around about June of 2017, Vivien Chang who was working as a UX designer at the agency came up with the idea of building a platform for recruiting participants. Mostly because she was so fed up with how painful it was for her to recruit people for her UX projects at the agency. A month later we launched an MVP and since then, Askable’s growth has turned into a full-time job for her, myself and a few others at the agency.

So long story short, we introduced an internal incubator program at our digital marketing agency, gave everyone one day a week to work on their own projects and Askable was born from that almost 5 years later.

How did you acquire customers/subscribers/users?

We started by reaching out to local agencies when we launched initially in July 2017. We contacted all the UX designers in our own network. We got one sale that month from a smaller agency, also based in Brisbane. We managed to get the full 20 participants that they requested and got great feedback from them, which gave us the confidence to push further outside our own network.

Our first real big marketing push was basically cold emails, which has remained by far the best channel for customer acquisition. Because we had a really specific target audience, it made sense for us to use LinkedIn as a source of prospective customers. We got a really good reply rate from that first batch so we just kept doing it.

I think a key factor to the positive response rate was the fact that we were designers ourselves, and most UX designers really empathized because they had experienced first hand the pain of recruiting and managing user testing participants.

It’s been pretty easy to get participants to sign up for testing jobs since the money is really good. We paid $80+ for a 45-minute session. In the early days, we spent a lot of time on the phone calling people we knew and asking (*cough* begging) them to participate. As we’ve grown, we’ve mostly stuck to word of mouth or using free Gumtree ads, or sometimes paid Facebook ads.

I think the best advice I can give to anyone looking to start their own startup is to think hard about solving your own problem. It goes beyond domain expertise. There are immense benefits, especially in sales. Being able to really empathize with your customer because you’ve been through the pain yourself is a huge advantage, as well as being part of an existing community. It’s super powerful stuff.

What software/platforms/tools have you utilized since launch? Which have worked / not worked?

So the way we got in touch with people on Linkedin was using a tool called Hunter.io, which helps you find someone’s email address. That works really well and continues to be our bread and butter for new customer acquisition even today. Highly recommend checking it out, I originally saw it on ProductHunt.

Something that didn’t work was Google Adwords. We found that many of the keywords like “focus groups” or “product testing” brought in people who were looking to make money by participating in tests rather than clients who wanted to make bookings. There was no easy way for us separate the two and we wasted a bunch of money on bad clicks.

Some other tools that we use:

  • Twilio for all the automated SMS’s that go out to participants.
  • We use node.js / React / GraphQL / MongoDB in our stack and it’s been incredibly good for our purposes
  • Intercom for customer support which gets used almost every day
  • Slack for our internal comms and team notifications
  • We use Figma for all the design work since it’s all browser-based which makes it easy for the team to share design files (no downloads necessary). Before that, I was using Sketch but Figma has been much better because of that.
  • Stripe to handle payments and Xero for accounting

How did you fund your startup and how do you make money/revenue?

In terms of funding, running our internal incubator program meant all our projects were ‘bootstrapped’. We didn’t need any seed funding to get started since we’d already been operating with 20% of our time set aside for working on side projects.

Revenue-wise, we charged money from day one because we had to. Without charging clients, there was no way for us to pay the participant incentives, which would have left us without participants which wouldn’t have worked. So that was baked in from the start. We decided to turn a profit by charging a recruitment fee of $50-$80 per participant, depending on the customer’s requirements.

Because most of our early customers were UX designers in our personal network, we knew they were already paying exorbitant recruitment fees to market research companies (sometimes upwards of $250 per participant), or spending hours and hours doing it themselves. So our value proposition was already pretty good vs existing solutions.

Luckily for us, we already had a lot of the payment handling experience and software in place for the agency business, which made it easy to get customers set up on Xero and start invoicing. We have since introduced Stripe as an online payment method but have found that the bigger, slower moving organizations still prefer making payments by invoice. Aside from salaries though, our other expenses are pretty low since we’re a software business.

While our revenue is growing pretty quickly, it’s important to keep in mind that numbers are inflated by participant incentives. Around half of the $38,000 USD we’ve done so far in April was paid out to the participants. A lot of the revenue growth has come from word of mouth but we also continue to push hard on the sales front with email outreach and by attending or sponsoring UX design events.

To date, what have been your biggest challenges as a company? What have you done to overcome them?

Hands down the biggest challenge are getting people to turn up. For the first few bookings, we did it wasn’t a huge deal, because at that point we were calling each participant up, talking to them, establishing rapport, and sending out really personalized reminders. Plus a lot of the first participants were our own friends and family anyway, so we could rely on them to show up. But once we scaled to a point where the time-intensive, personalized reminders were no longer feasible, we were seeing a lot more no-shows.

From a customer’s perspective that’s pretty much the worst experience. Having 2-3 designers sitting in a meeting room with all their stuff set up and ready to go, only to realize that your participation is not going to turn up is such a waste of time. We had to really quickly figure out how to solve that problem.

We tried lots of different approaches, including taking a leap of faith and paying participants half of the incentive up front (as soon as they signed up). If they didn’t turn up, we’d not only have to write that money off as a loss but also pay for the incentive on a replacement participant. We found that this worked pretty well, but ultimately impacted our cash flow.

Another big challenge for us, and I guess for any marketplace startup who has to deal with two userbases (buyer vs seller), was how to scale availability and demand at the same time. This is still a challenge for us today, but we found that being careful and deliberate about how fast we scaled either side of a new market has made it much easier for us to manage the problem.

I think the main lesson we’ve learned when thinking about these types of problems is to fight as hard as we can to keep the startup mentality. I feel like it’s easy to fall into the trap of “Oh man we’ve got paying customers now, we can’t screw this up,” and start playing it too safe. But a lot of the best solutions are hidden in seemingly crazy or risky ideas, so it’s super important to maintain that “try anything” mindset, even (or perhaps especially) once you’ve grown to a point where you have a reputation on the line.

If you had to do it all over again, would you? What would you do differently?

It may still be too early to say. Since we’re only 9 months in, we’re very much still learning as we go, and there’s still so much left to do. Still, if I had to pick one thing I’d say we probably could have launched quicker. From our MVP (which was basically just a Typeform connected to Google Sheets) to our first custom built version on React / node.js it probably took us 3 months to build and ship.

We were worried that any bugs or bad UX would turn people away and that we might lose potential customers but in reality, I think if the product solves a real problem, it doesn’t really matter. We were surprised with how much crap early users were willing to put up with because I guess the value prop was so much stronger than the bugs. The app at one point was double charging some customers at checkout and we’d have to call them up immediately and refund them. Sometimes the app would crash halfway through the booking process and they’d have to start all over again.

I mean, I’m sure we lost customers in the end but I’m equally sure we would have lost the same number of customers had we launched 3 weeks earlier. Plus, so many of these problems we just couldn’t foresee in our own testing environment so it would have just been better to just ship earlier and iterate faster instead.

Lastly, if anyone reading this wants to know more about your company… where do we send them?

Come check us out at www.askable.com or follow me on Medium at https://medium.com/@drezhou

Get the latest interviews before they are published

Subscribe to our mailing list and get interesting stuff and updates to your email inbox.

Thank you for subscribing.

Something went wrong.


Germany adopts first ethics standards for autonomous driving systems

$
0
0

In a world first, Germany adopts the first set of ethical standards for autonomous driving system manufacturing.

A world first

In a country known for its production of premium vehicles, new ethical guidelines have been set not for these car’s drivers, but for the cars themselves.

Federal transport minister, Alexander Dobrindt, presented a report to Germany’s cabinet seeking to establish guidelines for the future programming of ethical standards into automated driving software. The report, was prepared by an automated driving ethics commission comprised of scientists and legal experts and produced 20 guidelines to be used by the automotive industry when creating automated driving systems.

Shortly after its introduction, Dobrindt announced that the cabinet ratified the guidelines, making Germany the first government in the world to put such measures in place.

Key Guidelines

  • Autonomous driving systems become an ethical imperative if the systems cause fewer accidents than human drivers.
  • Human safety must always take top priority over damage to animals or property.
  • In the event of an unavoidable accident, any discrimination based on age, gender, race, physical attributes, or any other distinguishing factors are impermissible.
  • In any driving situation, the party responsible, whether human or computer, must be clearly regulated and apparent.
  • For liability purposes, a “black box” of driver data must always be documented and stored.
  • Drivers retain sole ownership over whether or not their vehicle data is forwarded or used by third parties.
  • While vehicles may react autonomously in the event of emergency situations, humans shall regain control during more morally ambiguous events.

A work in progress

Slated for review after two years of use, these guidelines are certainly a large leap forward in the right direction when it comes to the future programming of autonomous driving systems. That being said, there is undoubtedly much more work to be done.

One potentially catastrophic problem presented by machine-learning oriented autonomous systems, is that should a system wrongly interpret a lesson, it could import false biases into core functions causing harmful actions to be made in the event of an emergency.

Even more significant is the challenge of being unable to predict how these systems will react in any given scenario due to our inability to personally audit changes adopted through machine learning.

While other countries have continued to take a “wait and see” position on this type of legislation, many will most likely end up deciding to follow suit, since these guidelines are in governments best interest when providing the most current safety practices in our changing world.

Would you want to see these – or similar – rules applied in your country as well? Let us know what you think in the comments below.

Git submodules revisited

$
0
0

Git's submodules are so universally derided that there's practically an entire industry devoted to providing alternatives for managing dependencies.

But like anything in git, it's often worth giving the man-pages a good going-over and figuring out whether there's some options that do what you want, or to see if they've improved lately.

What I want

So, Metre is my exemplar project. It's got a slew of submodules, in part because some of our customers run (really) ancient versions of Linux and so we're going to need to statically link. Yay, fun!

But that means managing and shipping our own build of OpenSSL, for example - and that's a terrifying prospect for our Security Guy (lovely chap called Simon). It's pretty terrifying for me, too, actually.

In practical terms, then, our release cycle involves advancing along a stable branch on all the submodules, such that we're confident that we've picked up any bugfixes. This needs to be as simple as possible - really, a single command we can run as we need to.

But, we want to have high confidence that checking out a particular commit hash of Metre will give us the same dependencies we built with.

Git Submodule Add

Initially, I went for git submodule and a lot of manual work. I (lead dev) wasn't happy with this. Simon The Security Guy wasn't happy with this. Pete, one of our senior devs, conducted a full review of the project and highlighted it too.

The problem is that one slip and a dependency could be left with a serious security issue in. And Metre is meant to be all about security.

The plus-side of git submodule is that it tracks the commit hashes of submodules, and you can check them all out at the right hash with either a git clone --recursive or a git submodule update --init --recursive.

We considered switching to something else, but then we'd lose much of the built-in smarts of git submodule, and that's also a pain.

Oh, look - branches!

A deep dive into man git-submodule and man 7 gitsubmodules, however, found me gold.

First, there's a -b branch switch to git submodule add. That adds the submodule at a specific branch, and moreover sets the "tracking branch" - the one git normally pulls from - to the remote origin branch just as you'd normally do.

Second, I found a config option of submodule.{submodule name}.branch, which stores this. This isn't quite as great as you'd think, though, because while you can set this in git config for the repository, it's not tracked.

Fear My Editor Skillz

However, submodule configuration is stored in the repository in the .gitmodules file at the top. So you can edit that file, find the section, and simply add a branch key right there:

[submodule "deps/spiffing"]
        path = deps/spiffing
        url = http://github.com/surevine/spiffing
[submodule "deps/openssl"]
        path = deps/openssl
        url = git://git.openssl.org/openssl.git
        branch = OpenSSL_1_1_0-stable

The default is master, though, so if that's all you wanted, you've got that already.

Updating Branches

The normal command for updating submodules is git submodule update. There's three flags of interest:

--init performs a git submodule init if the submodule isn't already cloned into place, and nothing otherwise - so it's always safe to use.

--recursive recurses through each submodule, running the same git submodule update command in each.

--remote is the magic - that performs a git pull along the remote tracking branch. It's this that we want.

Workflow Summary

So now the workflow looks like this:

git clone --recursive git@github.com:surevine/metre - clones the repository and checks out the HEAD of master.

git checkout foo - checks out the foo branch or commit - and will switch the submodules to the commits they were for foo.

git submodule update --init --recursive --remote - updates all submodules recursively along their tracking branches. Without the --remote, it'll reset the submodule working directories to the "right" commit for the parent.

Finally, you can:

git config submodule.recurse true - tells git that most commands should act recursively, in particular git pull.

dev.to is where software developers stay in the loop and avoid career stagnation.Signing up (for free!) is the first step.

Unaccountable system for cellphone tracking often abused by police

$
0
0

Securus Technologies markets a product to law enforcement that taps into realtime cell-tower data from mobile carriers to produce fine-grained location tracking of anyone carrying a phone; it is nominally marketed to find parolees and wandering Alzheimer's patients, but because it has no checks or balances, cops can query it willy-nilly to find anyone's location.

That's what, Cory Hutcheson, ex-Sheriff of Mississippi County, MO, is accused of doing; prosecutors say that for three years, Hutcheson abused Securus's system to track all kinds of people -- even a local judge -- without a warrant.

Securus claims that it restricts the use of its system to legally permitted surveillance, requiring users to upload warrants or court orders prior to use; but it does not vet or review those orders before granting access. Securus also does not make the alleged court orders visible to carriers before it queries their databases, meaning that the phone companies have to take Securus's word for it.

The carriers, meanwhile, are exploiting a loophole in privacy laws that nominally prohibit selling this kind of data: by burying "consent" to the sale of your location data in their lengthy, never-read agreements, the carriers are able to circumvent the law; primarily to sell your data to marketers, but also to surveillance companies like Securus.

Hutcheson is a great object lesson in the problems with "extraordinary access" or "lawful interception" rules that weaken digital security to help law enforcement. The US has about 18,000 police agencies, and Hutcheson presided over a sparsely populated, rural district. Before the latest indictments, he was already under indictment for forgery and for illegal surveillance; he lost his job following the death of an inmate in his custody (though of course, no one was held accountable for that death).

He is a crooked, corrupt cop, in other words. Whether you think he's typical or atypical, if he represents even one percent of law enforcement agents who have access to tools that allow their wielders to attack the public in far-reaching frightening ways, that means that criminals and spies and griefers have a wide pool of corrupt officials to choose from if they want to abuse the system.

We're all familiar with the detective movies where someone writes down a license plate and the PI casually remarks that he'll get a friend on the force to run the plate and find the drivers' identity. It's just not surprising that a cop might allow a friend to "harmlessly" abuse a police database. When we discuss backdooring phone crypto or other far-reaching attacks on the security of the digital world, we're really saying, "Cops and dirty cops and friends of dirty cops and their friends will all have access to all your digital life."

Privacy concerns about Securus and location services were raised to the F.C.C. last year before the company’s sale to Platinum Equity, a private equity firm, for about $1.5 billion. Lee Petro, a lawyer representing a group of inmate family members, wrote letters urging the commission to reject the deal, based in part on concerns about locating people who spoke with inmates over the phone.

Securus, founded in Dallas in 1986, has marketed its location service as a way for officials to monitor where inmates placed calls. Securus has said this would block escape attempts and the smuggling of contraband into jails and prisons, and help track calls to areas “known for generating illegal activity.”

In an email, Securus said the service was based on cell tower information, not on phone GPS.

Securus received the data from a mobile marketing company called 3Cinteractive, according to 2013 documents from the Florida Department of Corrections. Securus said that for confidentiality reasons it could not confirm whether that deal was still in place, but a spokesman for Mr. Wyden said the company told the senator’s office it was. In turn, 3Cinteractive got its data from LocationSmart, a firm known as a location aggregator, according to documents from those companies. LocationSmart buys access to the data from all the major American carriers, it says.

Service Meant to Monitor Inmates’ Calls Could Track You, Too [Jennifer Valentino-DeVries/New York Times]

The Hawk Eye: a 3D-printed three axis tourbillon project

$
0
0

The three-axis tourbillon is one of the most complex watch complications in the world. Originally based on a design by watchmaker Abraham-Louis Breguet, this type of tourbillon – literally “whirlwind” – rotates the balance wheel of a watch in order to ensure that gravity doesn’t adversely affect any part of the watch. It’s a clever, complex, and essentially useless complication in an era of atomic clocks and nano materials but darn if it isn’t cool-looking.

Based on this original, simpler model, this new three-axis tourbillon is available for download here. It consists of 70 potentially fiddly parts and runs using a basic motor.

As you can see, the main component is the balance wheel which flips back and forth to drive the watch. The balance wheel is contained inside a sort of spike-shaped cage that rotates on multiple axes. The balance wheel controls the speed of the spin and often these devices are used as second hands on more complex – and more expensive – tourbillon watches. Tourbillons were originally intended to increase watch accuracy when they were riding in a vest pocket, the thinking being that gravity would pull down a watch’s balance wheel differently when it was vertical as compared to being horizontal. In this case, the wheel takes into account all possible positions leading to a delightful bit of horological overkill.

Vigilante Hacks Government-Linked Cyberespionage Group

$
0
0

Somewhere, government-linked hackers might be panicking. A digital vigilante has struck back against what researchers believe is a cyberespionage group connected to a nation state. The hacker has allegedly stolen, rather ironically, a cache of data that the government-linked hackers lifted from their own victims across the Middle East.

The news provides a rare instance of someone targeting a so-called advanced persistent threat, or APT, as well as an opportunity for a behind-the-scenes look at a government hacking campaign.

“10 minutes of effort; intel on Iranian APTs,” the anonymous hacker told Motherboard in an online chat, saying which nation they believe may be linked to the hacking group. Some cybersecurity experts tentatively agreed. But Kaspersky, which originally reported on the hacking group it dubbed “ZooPark” earlier this month, told Motherboard it could not currently link the outfit to a known actor.

The stolen data the hacker provided to Motherboard though is noteworthy. It includes text messages, emails, and GPS locations seemingly swept up by ZooPark’s tools; audio recordings apparently captured by the malware of people speaking; and the hacker said they found another related server hosted in Tehran, Iran during their spree.

Got a tip? You can contact this reporter securely on Signal on +44 20 8133 5190, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com.

The hacker broke into a specific ZooPark server that was listed in Kaspersky’s research—the hacker then pasted their own message on to the ZooPark server, explaining how they allegedly carried out the hack, and pushed a copy to the Internet Archive as proof.

To corroborate the hacker’s claim that the data was taken from a ZooPark server, Motherboard cross-referenced the stolen material with details in Kaspersky’s recent report. Kaspersky’s report said ZooPark had victims in Egypt, Jordan, Morocco, Lebanon, and Iran. Motherboard dug through the GPS coordinates provided by the hacker and found a heavy concentration of infected devices in Egypt and others in Iran. The report added that this was an Android hacking campaign; the data obtained by Motherboard includes sections naming the model of phones, and all appear to be different types of Android devices. Kaspersky’s report said this particular version of ZooPark’s malware was created in 2016; the earliest timestamp of an infected device in the data is from that same year, and stretches up to this month.

Caption: A Kaspersky infographic on the ZooPark group. Image: Kaspersky Lab.

Kaspersky’s press release said ZooPark potentially targeted members of the United Nations Relief and Works Agency, based on the news topics that the group used to trick victims into installing the malware. And the report adds that one of the group’s pieces of malware was delivered as a fake voting app in the independence referendum in Kurdistan. Notably, one infected device included in the data obtained by Motherboard visited Islamic State-related websites, but the context of why this person browsed those websites is unclear.

Some of the intercepted text messages include verification codes for Instagram and Telegram accounts.

THE BREACH

Kaspersky’s report said ZooPark has used several different pieces of malware over the past few years. The third version of ZooPark’s malware is based on Spymaster Pro, a piece of spyware that the ordinary consumer can purchase, perhaps for spying on their children, employees, or spouses, according to the report. ZooPark’s version of Spymaster Pro lets an attacker record phone calls, monitor a phone’s internet browsing, and steal photos too.

Alexey Firsh, the security expert at Kaspersky Lab who authored the ZooPark report, said this version of the malware was delivered through so-called watering hole attacks; meaning the malware is pushed to a target once they visit a particular malicious website. Firsh said the malware came from alnaharegypt.com and alhayatnews.com, two Arabic language sites, and although he didn’t go into detail, said this particular strain of the malware was used to target “employers of international organizations.”

Caption: A section of the hacker's message left on the ZooPark server. Image: Screenshot

In February, a hacker targeted Spymaster Pro and provided the stolen data to Motherboard. After seeing the Spymaster Pro connection to the Kaspersky research, that same hacker decided to probe ZooPark’s infrastructure, the hacker told Motherboard in an online chat. The hacker claims they breached a ZooPark server listed in the report by uploading a malicious file, obtaining the server’s administrator credentials, and then moving throughout the system.

“Hacking back should be legalized so Kaspersky could of done this themselves,” the hacker wrote in their message on the ZooPark server.

In its press release, Kaspersky described ZooPark as a “sophisticated cyberespionage campaign.” Although ZooPark did start using more sophisticated malware with its fourth version, the hacker who claims to have breached ZooPark suggests the APT is anything but advanced.

“I don’t think these guys are APTs at all; LamePTs,” the hacker said. “Code reuse kills everyone in the end, if you want to be an APT dont be a fucking skid.”

Viewing all 25817 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>