An open social media network that encrypts your posts and distributes via RSS - <AUTHOR> http://www.fastcolabs.com/3016147/this-open-source-twitter-replacement-is-absolutely-brilliant <comment><USER2> > We are building the first fully-conforming trsst server, plus an open source > web client including javascript libraries for core functionality like the > cryptographic functions.

Wait, wat?

From the first glance it looks like they just patched buzz words together and decided to call it bitcoin-like decentralized syndication network on a PKI

What about anonymity? Anyone who has the whole signing chain could track down the author. The anonymity of bitcoin is achieved by mixing hubs[1], you can't split a blog post in half and mix it.

[1]: [https://en.bitcoin.it/wiki/Anonymity](https://en.bitcoin.it/wiki/Anonymity)

btw what happened to Open Source today? You have to hype on Kickstarter and waiting for people throwing money at you in order to start coding?

<comment><USER3> > javascript libraries for core functionality like the cryptographic > functions.

Clientside JS for crypto? No. Bad idea.

[http://www.matasano.com/articles/javascript- cryptography/](http://www.matasano.com/articles/javascript-cryptography/)

Their reasons:

> Secure delivery of Javascript to browsers is a chicken-egg problem.

> Browser Javascript is hostile to cryptography.

> The "view-source" transparency of Javascript is illusory.

> Until those problems are fixed, Javascript isn't a serious crypto research > environment, and suffers for it.

<comment><USER4> I spent some time working on a project to create an encrypted contact form for people to use on websites. Thought it might make for a good wordpress plugin, but I was wrong.

Having gone from a position of "why not" to "oh hell no" on javascript crypto, the fundamental problems as I see them (aside from the ones outlined in your comment):

* Each javascript engine is different, with different (or sometimes no) sources of differing (or no) levels of randomness, which is essential for crypto to work.

* Most browsers support some level of javascript introspection _whether you like it or not_. Sure, things like Content Security Policies can be used to limit access from other tabs or domains but it's not just secure delivery to browsers that's a problem with javascript, it's execution integrity too.

* Most of the Javascript crypto libraries I've seen are ports of C libraries using tools such as llvm. As such they were not designed with javascript's functionality in mind, and as such are unlikely to have been anywhere near as scrutinised for side channel leaks as something built from the ground up.

The final nail in the coffin for my project was the fact that I'm not supporting a set of browsers, I'm supporting a set of ecosystems. Anything from plugins and extensions to minor version changes can affect the behaviour of a javascript engine in an unexpected way with potentially dangerous outcomes. I couldn't in good faith release a tool that lets grandma contact you without having to install PGP but in reality may mean she gets black bagged regardless because she used a dodgy tablet with no randomness source.

</comment></comment></comment><comment><USER5> The name is absolutely horrible. And they shouldn't just re-use the RSS logo, even at this stage.

<comment><USER6> I think it's a play on "trust". Maybe capitalize on the current v for u trend and name it Trvst? It's slightly more legible and won't be a kick in the ego to change.

<comment><USER7> [http://en.wiktionary.org/wiki/tryst](http://en.wiktionary.org/wiki/tryst)

</comment></comment></comment><comment><USER8> I'll leave aside the comparisons to tent.io, app.net, StatusNet, and many other services...

Considering that most Twitter users seem quite comfortable with publishing their posts for all to see, marketing a Twitter competitor as a post-Snowden measure seems somewhat opportunistic to me, especially when there are many other benefits to decentralized/open Twitter replacements.

</comment><comment><USER9> Their whitepaper can be found here:

[http://www.trsst.com/paper/](http://www.trsst.com/paper/)

</comment><comment><USER10> Can someone explain this system? I see the word decentralized thrown around, but the Kickstarter seems based around them building a server and hosting this. What is decentralized about them controlling the user ids? Basically: What am I missing here?

<comment><USER11> Yeah, I'm not sure I get it either. They call it a "syndication network" which, for me, gives the impression of a distributed network that is strictly controlled, which defeats the purpose. I hope this is just poor wording.

</comment></comment><comment><USER12> When I click this link I just see a picture with no text. Is this brilliant open source twitter replacement limited to zero characters instead of 140?

<comment><USER13> I saw nothing but a picture of an RSS icon, and thought that was the joke: you can "follow" people by subscribing to their RSS feeds, and RSS already exists.

<comment><USER14> I don't see what the problem is. RSS works, why reinvent the wheel?

<comment><USER15> Twitter became popular because browsers didn't elegantly handle feeds. Tumblr blogs (or blogs in general) with post comments and following are much more open and just as usable as the Twitter platform, _if_ you provide easy to use rss syndication and browsers support easy to use feed browsing without having to search out a google reader replacement.

</comment></comment></comment></comment><comment><USER16> "Looks and feels like Twitter"

(actually uses screenshots from twitter to pitch product)

</comment><comment><USER17> Why does this crap gets upvoted at all?

Everyone and their mother can build a Twitter clone in 24h. Add a week for encryption and security.

There's absolutely nothing new about this idea. Nothing. They don't even have a working prototype. All thin air.

On top of that, what's the big deal with privacy nowadays? It's the opposite of what we should aim for as a society. Transparency is not only unavoidable, it's a good thing.

Market this as a tool to organize protests in countries where privacy is a necessary evil, and maybe it will make more sense.

<comment><USER18> > Why does this crap gets upvoted at all?

Who'd have guessed? It's an article about tech on a tech site.

> What's the big deal with privacy nowadays?

We found out about wholesale global surveillance.

> It's the opposite of what we should aim for as a society.

Just as I want to poop with the door closed, I also want to discuss private matters privately. Not everything in my life should be public and I should have the final say over that. Should every start-up be subject to absolute transparency? Kinda eliminates any competitive advantage if your competitors know what you're up to.

> Transparency is not only unavoidable, it's a good thing.

Transparency of government, yes. For the rest of us, mind your own damn business.

> ... privacy is a necessary evil ...

The good thing about having the option of privacy is that it's not forced upon you. If you're not happy with your life being private, you're free to share. When that option of privacy is eliminated, however, you're forced to share everything even if you don't want to, and that's pretty much the opposite of liberty.

</comment></comment><comment><USER19> I wonder when people will realize that Twitter is not the enemy. I do believe in decentralized social networking, but some software package you throw on your web server doesn't seem like the solution. We need a new Internet protocol.

Even so, I wish this team luck and hope it to gain traction.

<comment><USER20> Due to their centralized nature, and the result of being located in the US as one of the largest communication platforms, Twitter has become the enemy. It was probably not their intention to become the enemy, but that's the consequence of being located on US soil and being one of the largest service providers (just as Facebook and Google have.)

When you decentralize, where providers are only responsible for a relative handful of the overall userbase, 'hoovering' is much more difficult.

<comment><USER19> I already know about its centralization and being in the US. So what? I don't put sensitive information into Twitter like I do in Google services.

Do you expect your blogging service to be encrypted and private too? I guess the private messages should be secure but oh well, I've even heard Twitter demanding warrants for giving out DM info.

Edit: I do wish we could expect "private messages" to be private.

</comment></comment></comment><comment><USER21> Is there any intrinsic value in Twitter other than the plethora of people using it?

<comment><USER22> > Is there any intrinsic value in Twitter other than the plethora of people > using it?

s/Twitter/[any social network]/

The point is the people using it.

<comment><USER21> My (not explicit) point exactly. All this fad about twitter clones makes no sense to me.

</comment></comment></comment><comment><USER16> Sigh. There are so many people doing this. I couldn't access the main article but read the Kickstarter page. From what I understand this is a plea for funding for (basic) components that are already built by other teams, but with an extra layer of encryption and a copy-cat UI.

Why not just focus on encrypting content on an existing decentralized network project like pump.io or GNU social? Or any other open network? Build on some momentum that is already there rather than debug message transport for life?

<comment><USER18> It's cliché, but competition stimulates demand.

</comment></comment><comment><USER23> I'm not entirely sure I understand what's going on. I suggest changing the explainer video to at least a talking head - yes, old, but they have much better recall and have been proven to change brand preference (even with cigarretes)a and try to find a better synonym for 'encryption' \- Good luck. Going against Twitter is a tall order.

</comment><comment><USER24> At first glance there's stuff I like and dislike about this, but the strongest thing is probably separating out how the messages move around from how the keys move around.

Moving encrypted blobs around is easy, as long as you don't care about traffic analysis. Handling keys is a bit harder. Separating those makes sense.

</comment><comment><USER25> Thought about this before, but there is one problem: you still leak loads of metadata just like with e-mail (whom you're communicating with, when you're communicating, how much you're communicating, and perhaps other things). Because of this, I didn't see any advantage.

</comment><comment><USER26> Do they hope to be as successful as Diaspora? _" open social media network that encrypts your posts and distributes via RSS"_ sounds like a great summary of a killer project that nobody will ever use.

</comment><comment><USER27> Uh, isn't the primary purpose of Twitter to make your posts PUBLIC?

Edit: I guess the focus is on the private messaging aspect, which I never use. Perhaps this is more popular than I realize.

</comment><comment><USER28> These people look unprofessionals, judging by their intro video.</comment>


If People Were Paid by Ability, Inequality Would Plummet - <AUTHOR> https://www.nytimes.com/2019/11/08/upshot/inequality-paying-by-ability.html <comment><USER2> If people were paid by the value they end up contributing to organizations, we would see large numbers of people being charged money.</comment>


Ask HN: YouTube down? - <AUTHOR> Youtube appears to be down? I'm getting the following error:
<comment></comment><comment></comment><comment>---
500 Internal Server Error Sorry, something went wrong.
A team of highly trained monkeys has been dispatched to deal with this situation.
If you see them, send them this information as text (screenshots frighten them):
<huge hash text> </comment><comment><USER2> Comments moved to [https://news.ycombinator.com/item?id=18234750](https://news.ycombinator.com/item?id=18234750).

</comment><comment><USER3> Yes, monkeys are working!!

</comment><comment><USER4> just ended the render of my vods :(</comment>


Cloudflare Shared Details of Hundreds of Customers in Response to DMCA Subpoenas - <AUTHOR> https://torrentfreak.com/cloudflare-shared-personal-details-of-hundreds-of-customers-in-response-to-dmca-subpoenas-200903/ <comment><USER2> Cloudflare's full transparency report is here (what this article is about):

[https://www.cloudflare.com/transparency/](https://www.cloudflare.com/transparency/)

It should go without saying but Cloudflare is _required_ to provide a response to a valid subpoena per the law. American companies are subject to American law, even if Cloudflare's clients may be internationally based.</comment>


Ireland donates contact tracing app to Linux Foundation - <AUTHOR> https://www.nearform.com/blog/ireland-donates-contact-tracing-app-to-linux-foundation/ <comment><USER2> In Germany the app was developed by research institutes. Then canceled. Then SAP picked it up and charged 10 million Euros for what is essentially a few 1000 lines of UI code. The German Telekom got the same amount, just "because" and will additionally charge 2-3 million per month mostly for the hotline (with limited capacity).

So the total cost will be 50-100 millions. Despite the fact that most technical work was already done by Apple and Google for free.

I'm not even talking about the fact that my dad got a new phone to run it - sold by T-Mobile (Telekom) of course.

And hardly anyone complained.

<comment><USER3> Not sure where you get the 1000 lines from. That's ridiculous. `cloc` counts 16k lines of Kotlin for the Android app and 22k lines of Swift for the iOS app. That does not even include other aspects like the server side code or support documentation. Also it's not only the app that had to be build: It required all the notification infrastructure and coordination to deliver test result to the app. This is really one of the very few big government projects where I can't really complain about the costs. There was only one attempt at getting this done right and in time. They managed both.

<comment><USER4> If only the app were available on the US App Store. Can't use it here in Germany because of my US Apple ID.

<comment><USER5> I really can't understand this for a COVID-19 contact tracing app. You should find out how to give feedback on this to make them change availability to global.

It boggles my mind that I have to remind many app publishers that we live in a globalized world and that it's a natter of a few minutes work to just select the countries to make the app available in. More so for free apps where the publisher doesn't have to worry about taxes and payments.

Even for apps that are not localized to English or other languages, the publishers should prefer to get them out to as many people as possible in the whole wide world who may be visiting or on a long stay in a specific country.

In this case, the app developer can surely include help text that explains where the app is meant to be used or would be useful (it's also not like people with a German App Store account living in some other country would be able to use this app effectively).

<comment><USER6> Many times it has happens due legal restrictions that developer has in place in his org . It is worse when the publisher is a government body or contracted by one

</comment></comment></comment></comment></comment><comment><USER7> Isn't this just a meaningless ad?

The company is part of the development. Afaik many apps are open source. "Donating it" means offloading the support and profit from Linux Foundations status.

Nearform is involved in integrating the backend into the countries health system... so they offload the app and just do the work that gets paid well. ?

<comment><AUTHOR> It is PR - maybe I should have linked to the HSE's press release: [https://www.hse.ie/eng/services/news/media/pressrel/covid- tr...](https://www.hse.ie/eng/services/news/media/pressrel/covid-tracker- ireland-app-one-of-linux-foundation-public-health-s-first-open-source- projects.html)

The app has been open sourced by the Irish Government, not Nearform who were the developers. The copyright is owned by the HSE (the Irish public health authority).

The app being open source does benefit Nearform, though, as they can sell their services customising the app for other governments.

</comment></comment><comment><USER8> Where has a contact tracing app been successfully deployed at a large scale? Have those places seen any positive effect?

Apple/Google's APIs were widely discussed a couple months ago, but (at least in the US) it seems to have fallen off everyone's radar.

<comment><USER9> Large-scale deployments in Ireland (1.4 million out of 4.9 million people) and Germany (12 million out of 80 million people), anyway. In Ireland it has lead to the discovery of a number of positive cases, which is positive; if they'd been discovered at all through conventional means that would have taken longer and the people concerned could have been spreading it for longer.

There has also been successful deployments in Taiwan and Singapore, but AIUI they don't use the Apple/Google API and are far more intrusive.

<comment><USER10> German app downloads have just passed 16 million [1]. Or do you mean including those who deinstalled it because it was boring ;?

[1]: [https://de.statista.com/statistik/daten/studie/1125951/umfra...](https://de.statista.com/statistik/daten/studie/1125951/umfrage/downloads- der-corona-warn-app/)

<comment><USER9> Ah, no, last numbers I saw were about 12m and it seemed to have slowed down a bit. That's good news!

</comment></comment></comment></comment><comment><USER11> Is there an actual contact tracing app for the US or any US states yet?

<comment><USER12> Utah released one pretty early on (maybe April or May IIRC)? I think I heard recently they might be shuttering it because of lack of downloads.

<comment><USER13> The app failed to gain significant adoption. I believe it no longer trace's contacts.

</comment></comment></comment><comment><USER14> This pandemic is global so anything that helps countries to combat the virus is a good thing. The Irish app seems pretty good but the great thing about open source is that you can branch it to make your own app or just use the code to learn how others resolved the technical issues associated with creating a decentralized contact tracing app.

Of course an app is not a panacea but as developers we can't create vaccines or provide medical assistance. Its not perfect, as it depends on getting enough people to use it. No mean feat when there are people who don't even believe Covid exists or think it is only dangerous to older people and don't want to take any precautions like wear masks or socially distance. Even then, there are lots of technical challenges trying to use a technology like Bluetooth for a purpose for which it was never intended.

There will be a vaccine at some point (plenty of anti-vaccine people too, which might be a problem for the future) and there will be better treatments in the medium term but right now, speed is important and if it helps States to save time and get a contact tracing app quickly then it has to be a good thing. That way we are all safer.

</comment><comment><USER15> I've heard opinion that those apps are _not insanely successful_ project

Even despite having milions downloaded copies, then it wasn't "broadcasting" a lot of keys

[https://ctt.pfstr.de/](https://ctt.pfstr.de/)

Can someone say something about this? how valid this on?

</comment><comment><USER16> The "worlds most famous" claim is from the website and not the poster

<comment><AUTHOR> I wasn't sure whether to remove that as a gratuitous adjective. Even without that claim, it's an interesting development, especially as the app cost only €850k.

In contrast, our nearest neighbour scrapped their app last month after spending over £11MM (~€12MM) and are now rebuilding on the Apple/Google API: [https://www.bbc.com/news/technology-53095336](https://www.bbc.com/news/technology-53095336)

The code is already up on GitHub: [https://github.com/HSEIreland](https://github.com/HSEIreland)

<comment><USER17> I wouldn't put the focus on it being ONLY 850k, that seems a competent price, I would really like to know how in the world they spent 11M on the uk one...

<comment><USER18> I don't know specifics about the UK version, but most of those costs likely weren't on the app proper. They did run a field test, for example.

For comparison, the German version cost millions, too. That included multi- language support, setting up help lines, security evaluation, load testing millions of concurrent users and, IIRC, connecting to quite a few of different hospital computer systems.

Add in time pressure, and costs go up. Germany did get a quality system, judging by what the spokesman for the Chaos Computer Club said (paraphrasing: 'we have the unfamiliar problem that there is so little to complain about'. They never endorse stuff, so that's about as endorsing as their statements can get)

<comment><AUTHOR> It also includes the DPIA, which in itself can be an expensive process. There was a lot of concern/press in Ireland pre-release about the privacy implications of the app. It's hot on the heels of a "mandatory but not compulsory" national ID card fiasco that was determined to be unlawful by the privacy regulator last year: [https://www.thejournal.ie/psc-no-legal- basis-4766822-Aug2019...](https://www.thejournal.ie/psc-no-legal- basis-4766822-Aug2019/)

<comment><USER19> You're not wrong.

</comment></comment></comment></comment></comment></comment><comment><USER20> It seems something like a trojan horse in some core concept about freedom and privacy. It also helps, I am sure.</comment>


The Nial Programming Language - <AUTHOR> http://www.nial.com/AboutNial.html

<comment><USER2> Interesting syntax, a bit SQLish but.. friendlier? The source link is broken unfortunately, I'm wondering how performant it is.

It made me immediately think of articles recently discussing using plain text manipulation through tools like awk, sed, cut, and cat as opposed to the current batch of distributed processing tools. A language like this strikes me as a step up from those tools in terms of writing readable and expressive data manipulation and a comfortable step down from complicated object notations.

<comment><AUTHOR> My take is that it's an APL inspired language. I stumbled on it because I am interested in Iverson's APL refresh, J. It solves the problem of APL's specialized character set by mapping mathematical notation out to the same sort of psuedo-English as other programming languages. On the other hand, Iverson kept closer to his original intent and mapped everything to ASCII symbols in J.

In a sense, I think all three languages occupy the same sort of space as Fortran and Matlab [and increasingly Python]: numerical modeling where `3` doesn't just represent the mass of a sack of beans but a particular three kilo sack of beans itself.

What I found interesting is that it is only superficially more comprehensible than J or rather that J is only superficially less comprehensible. I need to look at the documentation in both. Symbols aren't any less syntactically clear than pseudo-English keywords. The advantage of J is that it assumes that the meaning of symbols isn't obvious.

[APL]: [http://pckeyboard.com/page/product/USAPLSET](http://pckeyboard.com/page/product/USAPLSET)

[J]: [http://www.jsoftware.com/](http://www.jsoftware.com/)

<comment><USER3> It reminds me even more of Q[0], a derivative of K which similarly replaces many operators with named words. I agree with your conclusion that given complex primitive operators a name seems to be only superficially more "intuitive" than an arbitrary symbol.

The need to memorize some collection of primitives before programs can be read seems to be a troubling barrier to beginners in any APL-family language, and I'm not sure how it could be addressed.

[0] [http://code.kx.com/wiki/JB:QforMortals/overview](http://code.kx.com/wiki/JB:QforMortals/overview)

<comment><AUTHOR> I think the solution is not to fret to much over beginners and focus on the people who are trying to solve problems that make learning a new language worth it. It's like regular expressions - because they describe state machines there's a limit to how far you can dumb things down.

Any programming language that seeks to map well to mathematical notation is going to have a particular set of abstractions and therefore require a particular mindset. We don't expect maths to be easy for beginners...taking off just a few of the painful sharp corners is considered a big big win. Why should other languages for describing computation be considered failures or successes under different criteria?

</comment></comment></comment></comment><comment><USER4> After trying to get an open source project on Nial started with little success I pulled the plug on it 3 years ago. However there now is some interest and I expect to put up a new source that supports 64-bit addressing and integers shortly. It will be put up on Github when it is ready. Any one interested in taking part can contact me at email@example.com Mike Jenkins

</comment><comment><USER5> Reminds me a little of NESL: [https://www.cs.cmu.edu/~scandal/nesl.html](https://www.cs.cmu.edu/~scandal/nesl.html)

</comment><comment><USER6> The link to the source code does not work. Also the source code dir on the ftp site is empty. Wanted to see how this language worked

<comment><AUTHOR> There is at least one version on Github:

[https://github.com/vrthra/qnial](https://github.com/vrthra/qnial)

Edit: there are at least two versions on Github:

[https://github.com/PlanetAPL/nial](https://github.com/PlanetAPL/nial)

Edit2: and an emacs mode:

[https://github.com/tangentstorm/nial- mode](https://github.com/tangentstorm/nial-mode)</comment></comment>


Why Scientific American's Predictions from 10 Years Ago Were So Wrong - <AUTHOR> http://gizmodo.com/why-scientific-americans-predictions-from-10-years-ago-1701106456

<comment><USER2> This is a surprisingly comprehensive and well-sourced, succinctly written article. Although the headline is a little clickbaity (why? because people are bad at predictions, especially about the future) it provides an excellent long-term perspective on technological development.

I wouldn't mind seeing this formalized into its own site, indexing predictions and claims from mainstream scientific publishing and maintaining some sort of 'progress indicators', perhaps connected with prediction markets.</comment>


Ask HN: Which language(s) should I learn to do one-man projects and earn money? - <AUTHOR> 1) No CS/programming background, but interested in functional programming (clojure, Haskell, CL...)
2) I don't intend to work for other startups/companies, just want to build my own projects and monetize them.
3) I like iOS/android programming, but I'd need to learn Swift+Java for both, and cross-platform solutions don't seem alright.
4) I also like web-apps, but I hate JS, and frankly, don't like any imperative lang for backend (python, ruby, ...)
?) Besides web and mobile dev, is there any other field where I can do solo? (of course, w/ money) <comment><USER3> Personally I use JS extensively for these kind of things. I hate JS the way most people use it, but JS is actually a crazy powerful functional programming language in disguise. And you can use it on server or client almost transparently. I mostly use only a subset of JS myself: I write const fat arrows that either return functions or immutable objects. No or very little state. I don't use "this". I use react + redux on the front-end. I maybe use 4 different language constructs total, both on the server and on the client, and my life as a programmer has become very peaceful, I can focus on delivering features. The nice thing about JS is, like the language or not, the tooling and ecosystem are awesome. For one man projects you can really make the language your own and achieve crazy productivity. YMMV.

Here's an example of what I mean, a Promises/A+ implementation in less than 100 LOC - just for the fun of it: [https://github.com/djfm/promesse/blob/master/lib/promise.js](https://github.com/djfm/promesse/blob/master/lib/promise.js)

I think it kinda feels like Haskell, yet browsers understand it :)

<comment><USER4> It's hard to compare JS to Haskell without mentioning the JS's complete lack of a type system...

That said, if you want something more ML-like in your JS, Flow is an increasingly-viable option: [https://flowtype.org/](https://flowtype.org/)

<comment><USER3> Yeah, I've been experimenting with it for a few days and I find it very promising. But the lack of types in JS is not such a pain point IMHO. In JS you can define a monad that works only with numbers, which is sometimes useful, and which you cannot do in Haskell without black magic. I think Flow's idea is that most JS programs are actually naturally well typed, and it often verifies in practice. Just because you don't have a compiler yelling at you doesn't mean your program is not well typed :)

<comment><USER5> > In JS you can define a monad that works only with numbers, which is > sometimes useful, and which you cannot do in Haskell without black magic.

What does this mysterious assertion mean?

</comment></comment></comment></comment><comment><USER6> You're making things too difficult.

You are looking for the one right answer. No such thing. Whichever you pick will have its short comings.

Remember programming languages are tools, they exist because they fill a need.

Also you have a lot of points here. Get started with one, then move on to the others.

You said you are interested in functional. Pick one. The easy way is to pick the most popular. Do a google search. Pick the most popular one, at least you'll be able to ask for help and have someone that's been in a similar situation.

For mobile, what do you have available? Pick that platform. iOS takes a bit more money. If you have both pick the one you use the most. I hear iOS brings in the most money but unless you have a great idea it's hard to standout from the millions of apps.

For web, look at what's popular so you'll have help when needed. People will tell you to use this or that but once you get started and have a few projects you'll understand what's best for you.

You can ask and ask but you will never know until you get going. Define a project, pick what language you find interesting at random and focus on only that until you finish a project.

You'll find out what you like and dislike and you'll be able to pick what language is best for you.

<comment><AUTHOR> Those are really good points, thanks!

I'll try to just get going and pick a lang for that. Web-dev intimidates me, cause I should know HTML/CSS+JS for front-end, and SQL+{ruby|python|clojure|haskell|php|...} for back-end. That's why I was thinking about going w/ sth like clojure/ruby, cause that takes care of front- end as well. But what do I know?

<comment><USER7> Take a look at hackathon starter kit, you can do javascript in the front and backend, I haven't used it but I think it looks interesting. [https://github.com/sahat/hackathon- starter](https://github.com/sahat/hackathon-starter)

</comment></comment></comment><comment><USER8> Dude this is basically saying "I want to build something, but I hate programming".

If you don't want to learn js, then forget about web programming.

If you don't want to learn any of swift or java, then forget about mobile programming.

If you don't want to learn java/python/ruby, then forget about server programming.

That leaves you with nothing, maybe learn some MS excel to become an accountant? That qualifies as one man project that will earn you money.

<comment><USER9> Obviously OP is too picky, but there are plenty of server-side and client-side options that fit the requirements. Eg Clojure / Clojurescript, Haskell, Scala, Typescript

<comment><AUTHOR> >Obviously OP is too picky...

Yes, unfortunately. I know it, but just can't help it. Maybe I'm an idealist, or maybe just not that familiar w/ the programming world.

<comment><USER10> you sound like a fat person who is trying to get in shape but is extremely picky about which 'routine' he wants to follow. he has a reason to hate each one so, they're all not good enough for him. he's looking for the perfect routine, man. one that will _guarantee_ success.

oh and also that annoying bit about eating right, well that sounds like a pain, so let's not do that, either.

all this, while sitting on the couch, daydreaming of 6-pack abs. in reality, all you have to do is walk around the damn block and you're 1/4 mile ahead of where you were before.

<comment><USER11> Oy, quit stealing my analogy!

</comment></comment></comment></comment></comment><comment><USER12> No disrespect, but why are you trying to optimize your choices so severely before you've even learned anything? You seem to know 'about' programming, but once you learn the fundamentals of programming, you can learn any language or platform you want.

I think you should just choose whatever lets you build the project you want to start today, forget trying to cross platform / future-proof your decision.

<comment><AUTHOR> Thank you.

> why are you trying to optimize your choices so severely before you've even > learned anything?

Maybe because I can't become a full-time developer, so choosing the right language matters. I actually envy "real" programmers who have time to learn more than just _one_ lang...

>I think you should just choose whatever lets you build the project you want to start today...

I like mobile/web apps, but I don't seem to find any other field where I can do on my own. Do you have any suggestions?

<comment><USER12> Most developers learn in one major language first, then adding others as they expand. Since you're looking to make money by selling software, you're probably going to work on 1) a website or 2) a mobile app or 3) desktop app (basically similar to a mobile app; compiled software probably distributed through an app store).

Do you have an Android or an iPhone? Download the IDE for your respective platform, get Hello World running on your phone. There, you're now a developer :D. Next step, follow some tutorials. Don't paralyze yourself with these decisions that seem important, they're really not.

<comment><AUTHOR> Yeah, I think I have made this way too difficult for myself... I just wish I could have all the good features of different languages altogether, but that's not gonna happen, welcome to the world of programming.

I like Haskell and LISP for the challenge, but I wish I could do mobile/web dev in them easily (like RoR).

I really appreciate your answers, I think I should just get going then, and try to figure out the rest next.

<comment><USER13> GHCJS and Purescript work with react.js and directly with the DOM. So there are options on the client side as well if you wanted FP. You could also consider learning clojure, and closurescript. A few backend teams I've met retooling all their RoR code to Haskell. Sounds like you are on the right track with your thinking, but with no CS background be sure to read books that help you understand the pros and cons of different languages.

</comment></comment></comment></comment></comment><comment><USER14> 1) _Some_ background is necessary for building and monetizing projects. Not necessarily university education, but you're not just going to pick up a book on CS and start monetizing projects that month. What's your time frame for this?

2) "Just". This is not a trivial exercise. I recommend reading your way through patio11's extensive writings on bootstrapping software companies if you're serious about this

3) OK.

4) You can't really build web apps without JS, at least in some form. Which part about web apps _do_ you like, if it's not JS or "python/ruby/...". This is probably the easiest way to monetize software projects these days though, so maybe reconsider. You can still do some pretty nifty things if you find a niche market and put up a public facing CRUD application with a few lines of Django/Ruby boilerplate.

?) I think all that's really left after your exclusions is to try pick up on the dying markets like Wordpress/CMS development. This can be done through plugins or managing entire sites for other people, or building your own ecommerce business. For the latter, look into ready-made stuff like Magento. This is really how people made money a few decades ago though -- I know a few people who have tried recently and failed.

Last suggestion is to look at more business oriented stuff. VBA is still exceptionally powerful in terms of integrating into tools (Excel) that non- tech people use. A lot of managers etc spend an inordinate amount of time doing repetitive work on spreadsheets -- you can save them hours every day with a few lines of VBA dev. Not fun, but might be what you're looking for.

<comment><AUTHOR> Good points!

About that VBA thing, I was actually thinking about automation. Bash, Python, ruby, even JS, are really great for that. But then we have VBA. I guess most things you can do with VBA in Excel, you can do with python as well.

I agree, I need some background building before jumping into programming. I just figured maybe a good programming book will cover the necessary CS parts, too. "Learning Python" is over 1500 pages, and really is intimidating. "Haskell Programming" is also +1000 pages. Do you think picking up huge books like these, will help me build the required background?

<comment><USER14> Yes, everything you can do in VBA you can do in another language, and probably more easily. But then you have to persuade the users to use your app - <USER2> they're already comfortable with spreadsheets, VBA can make it easier to get them using your product.

If you can work your way through an intro book, it'll be super beneficial! Everything in either of those books will probably be useful at some point or another. No way I'd be able to do that in your position though. Personally the only way I can learn new technology is to have a goal that I find motivating (often, 'build a system that can solve some pain point in my life') and then identify the minimum useful step I can take towards that goal, and then mess around with books, forums, documentation, etc until I've achieved that step.

</comment></comment></comment><comment><USER15> Generally it works the other way round: you have an idea for making money and need the best (or easiest) tool (or language) for execution. Starting from nowhere, your best shot is learning to customise e-commerce templates and set up stores online for you or for prospective clients.

</comment><comment><USER16> If you're just getting into things Elm might be a good bet for front-end. Maybe you'll get fewer contract gigs but the current state of JS is a mess, might as well skip it (for now at least).

</comment><comment><USER17> If you don't have any experience and programming background you should start with C/C++ to learn basics, data structures, algorithms etc. Then you may continue with C++ or move to different language - for example, C# or even F# if you like functional. With C# you can write mobile apps for both platforms using Xamarin. Please don't start with JS, actually try to avoid JS as much as possible because that's not programming language - but that's my opinion.

<comment><USER18> Yikes. Dis-recommend. I started my career in C, which was my first programming language, back in the mid-90s. It's been advantageous for me in my particular field (vulnerability researchers should know C), but I look back and wince about all the energy and time I wasted shipping code in C and C++.

It's also, for this particular question, the family of programming languages most hostile to functional programming.

ES5 JS is a clunky language, but people have built amazing things in it. ES6 JS is a credible language on its own terms. I wouldn't be wary of someone saying "Javascript sucks" (I would mostly agree), but I would be wary of someone who said "Javascript isn't a programming language".

<comment><USER17> OK, as I said, that's my opinion but I also appreciate yours :)

</comment></comment></comment><comment><USER19> It's an awfully hard question to answer without some idea of what you are trying to do to make money.

For instance you really can make web apps with very little Javascript and, for many applications, this is the way to go.

For instance, if you take the "path less taken" and not load your site up with 15 MB of Javascript, tracking pixels, third-party scripts, another 100 MB of junk from a CDN and instead move a minimal amount of data through http/2 you can make a site that loads like a bullet being shot out of a gun on a computer, phone, tablet, whatever.

This site

[https://legalentityidentifier.info/lei/get/5493000HEH4YCM7L6...](https://legalentityidentifier.info/lei/get/5493000HEH4YCM7L6N11)

has competitors that take 2 minutes to load the first page because the developers throw in everything but the kitchen sink so they can pad their resumes. It's hard to get people to see the difference, however, without actually sending them to a competitor.

Frankly I think CDNs are a scam like DOIs. DNS lookups are one of the worst things when it comes to long tail latency and if you hit enough servers the odds approach 100% that the browser is going to freeze up for 15 sec during loading because of a DNS hang.

</comment><comment><USER20> It depends a lot on your priorities between mastering a language/programming and having a successful product/service (ie. making money). In any case you should figure out first what you want to build as the choice of tools will depend on it.

Also keep in mind that while functional programming may be fun, it may be simpler and faster to just slap some php onto some random webhost (even more so when validating an idea and getting feedback) :)

</comment><comment><USER21> You will not find good answers to poor questions. You must first decide to build a house, then pick up the hammer.

Build me an iPhone app, written in Swift, that will let me sell my recycling (cans, bottles) to someone else so I don't have to drive to the recycling centre to collect the refund.

If you research your market, your audience, and verify your idea through testing and prototyping, you can get your business started without ever writing a line of code.

</comment><comment><USER4> If you want to build things with interfaces that users use, I implore you to reconsider JavaScript. First of all, it's a powerful functional language ([https://www.youtube.com/watch?v=ya4UHuXNygM](https://www.youtube.com/watch?v=ya4UHuXNygM)).

React and Redux are heavily inspired by functional languages, and the two can be used on the server-side as well (which, if you're serious about web development, is going to be important).

With React Native ([https://facebook.github.io/react- native/](https://facebook.github.io/react-native/)), sharing code becomes even easier for mobile development without really sacrificing the quality of the end-result (no more WebViews).

If you want JS to have a type-system, consider TypeScript ([https://www.typescriptlang.org/](https://www.typescriptlang.org/)), or if you want a more powerful ML-like type-system consider using Flow ([https://flowtype.org/](https://flowtype.org/)).

</comment><comment><USER22> I can completely relate to this mindset.

I was once similarly minded in that I had read enough about programming to know what was out there and what it was used for.

I then formed impressions about what was 'hard' and what was 'easy' and what I would like. It took me ~2.5 years from the start of my desire to learn, to actually write my first line of code. Picking a language, then picking a learning methodology took me that long.

Then, 2 years of learning/programming on the side, I got my first paying gig for writing code (I'm was never a full time software engineer, just learning on the side, like you). This was 2 weeks ago.

Perhaps this is a common path, or we're a special breed. What helped me stay motivated was trying to solve my own problems with code. First project was a script that took data from a google spreadsheet and texted it to me at relevant times. Took me 3-4 months to complete. Could write it in 3-4 hours now.

Find a (small) problem, write code to solve it. Monetization will come, but probably slower than you expect. Good luck.

<comment><AUTHOR> Man, this is so like me!

I guess my concern is that I want to do quality work (with well-designed languages) AND earn money for it. I'm beginning to realize that (sadly) it's not really how things are done in the programming world. As long as you can deliver a fancy web-app in short time, nobody cares if you have used JS or ClojureScript.

<comment><USER22> It's true no one cares for the most part. But clients do want maintainability, so a more mainstream language makes your skill-set more attractive. Of course I speak as a freelancer, not from a product perspective.

I picked Python, because:

1\. I thought I would give up if the language was too hard.

2\. I didn't know what I want to build eventually, and Python seemed to be used everywhere.

Getting into the mindset of spotting problems, defining it's scope and writing code to solve that SPECIFIC scope has been highly useful. It's also something to continually improve at. Good places to start are complaints from friends/family about commonly used software.

</comment></comment></comment><comment><USER23> Elm. [http://elm-lang.org/](http://elm-lang.org/)

</comment><comment><USER24> Have a look at Meteor ([https://www.meteor.com/](https://www.meteor.com/)).

\- JavaScript is basically a functional programming language, too.

\- Meteor has Cordova integration for mobile development. However I never tried out Cordova, so I can't say whether it's good or not.

\- Meteor _is_ JavaScript, but as others have pointed out, your list of conditions doesn't make sense, so I ignored your fourth point. Or perhaps program in CoffeeScript, TypeScript or a different language which Meteor can compile to JavaScript.

\- For the last point, there's a lot you could do. Depends on your experience of life. One example is emigrating to a country with low living costs and provide your knowledge from there remotely. This way you can sell for a lower price.

<comment><AUTHOR> Hadn't heard of it before. Sure, will have a look at it. Thanks!

</comment></comment><comment><USER25> Given you'd like to focus on functional languages and you'd also like to be productive enough to build and monetize apps as an individual, you might like and want to look into Elixir and Elm.

Elm is a nice functional frontend language that compiles to JS, which you'll need for web apps.

Elixir is a very good and solid functional backend language that is good for general purpose programming, as well as web app programming (via Phoenix) and embedded (via Nerves).

Both of those languages are functional and focused on developer productivity and have some very good tooling around them.

<comment><AUTHOR> Thanks. I had just heard their names before, but now I'm thinking maybe the combination of Elm+Elixir would suit my needs. Some other people have also suggested Elm here, didn't know why.

</comment></comment><comment><USER26> I use Haxe for a lot of side projects. [http://haxe.org/](http://haxe.org/) It's a cross-compiling language, so it can output javascript, java, python, c#, c++, php, and lua. It covers every platform I'm currently interested in working with.

There's communities within Haxe that focus on things like game development for iOs/Android, or react-style web programming.

You can't expect Haxe to completely smooth out all of a given target's problems and quirks, so expect to sort out some target specific quirks if you're really trying to push performance (e.g. mobile gaming). However, having most of the core business logic in one language is incredibly gratifying. And, unless you're using Scala or Haskell, I bet Haxe ends up being the most expressive and powerful language that you use day to day.

</comment><comment><USER27> Even if you hate it, the most pragmatic choice would be Javascript, it covers the browser, the server and mobile apps but you should spend at least one semester doing an introductory programming course, there are great courses online.

</comment><comment><USER28> How are you planning to make money? Making money building things on your own has very little to do with which language you use. It sounds like you're just stalling.

<comment><AUTHOR> I think language of choice decides how I can earn money, see:

Swift -> iOS

Java -> android

JS HTML CSS -> Front-end

RoR SQL -> Back-end

C# -> Desktop software

...

</comment></comment><comment><USER29> Personally I pick clojure by default. Clojure is a wonderful LISP that runs on the JVM which means there is all the libraries you need.

If I can't pick clojure, I gonna pick C because C works everywhere too and has all the libraries you need too. C is not functional but it is imperative and pretty damn simple.

</comment><comment><USER30> I'd start with what you already know. Depending on the project, different languages will be a better fit.

If you are just starting out and are focusing on web development, I'd recommend JavaScript since all you need to get going is a browser and a text editor.

<comment><AUTHOR> I hear all this hype about clojure/haskell being a better fit for web apps. Esp. ClojureScript which compiles to JS.

Is it _sane_ to ditch JS (and node.js, angular.js, bootstrap.js, ...) and go with clojure? (maybe even ruby?)

<comment><USER31> If you want webapps, it's good to understand Javascript. I __love __clojure to death so much I write it in my spare time as a developer working on other stuff. But the reality is that its surrounding community is tiny, and that makes the hurdles faced when starting much, much larger.

Clojure/clojurescript will get you a single language on front-end and back- end, but I think that from a monetization standpoint you __really __want a Javascript front-end and Java or Ruby back-end.

Keep in mind that if you use "more standard" technologies, you'll also have a more likely chance of cashing out on whatever you build if you decide to sell because the buyer will be able to hire people to fix it. If you choose something obscure without a developed community, any price offered to you will be much, much lower or even just never come.

I'd personally skip the node.js hype for now.

<comment><USER27> Agree with everything you said about Clojure[script], but isn't nodejs past the hype already? sure, articles are written for it everyday but is a technology that is used heavily in the industry, that has a large community and library ecosystem.

<comment><USER31> It's true I haven't used NodeJS for actual projects, but writing entire apps in Javascript where other languages are available does not appeal to my personal aesthetics or technical sense on many levels. Simple namespacing in JS is a burden. A lot (not all) of what I hear about NodeJS being a great tool is from people that both accept callback hell as a way-of-life, and who decline to understand anything past the headlines of great performance.

Guess how that great performance comes about - C++ and non-blocking I/O! There's also the aspect of the community that makes packages for single functions and can't develop a useable package manager (last time I checked). I'm not against it as pure infrastructure for running clojurescript, though =P.

</comment></comment></comment></comment></comment><comment><USER32> Ruby, rails and intercoolerjs is the best combo for what you are looking for.

It will still be a logic work.

</comment><comment><USER33> What is your previous programming experience?

<comment><AUTHOR> Just a couple of courses on C++ in college. Although I did work with MATLAB for my projects, if that counts.

<comment><USER33> Brutally honest: Well if you need money and hope to earn them by programming: go for something with low barrier of entry and high demand.

That used to be PHP + Javascript. You should still be prepared to put in some work in personal projects etc to convice people that you know what you claim.

If you have all time in the world and want to be perfectly positioned for some perfect future opportunity, I don't know, I have no idea.

Personally however, if I am the one to hire in the future I'll try to go with people who get stuff done.

</comment></comment></comment><comment><USER34> How can you hate JS if you have zero programming experience? Try it first.

<comment><USER3> Maybe the OP saw some code samples involving jQuery

</comment></comment><comment><USER35> then scheme is made for you. learn racket-lang.org and give a try to "lambdanative.org" to build native mobile apps.

</comment><comment><USER36> Elm, JavaScript Swift, Java Python

</comment><comment><USER37> Do it in APL

</comment><comment><USER38> English?</comment>


Better-Than-Nothing Security: Standard IPsec mode against passive attacks - <AUTHOR> http://tools.ietf.org/html/rfc5386

<comment><AUTHOR> An good reason to use IPsec is that with IPv6, the specs recommend your home router to block all incoming connections - except IPsec (ESP & IKE).</comment>


Theories on Artificial Expression (2013) - <AUTHOR> http://max.io/articles/theories-on-artificial-expression/ <comment><AUTHOR> Hi All. This is a repost as granted by the HN mods (thanks mods!). I wrote it in 2013, but thought it was appropriate given some of the comments in this post here: [https://news.ycombinator.com/item?id=10993919](https://news.ycombinator.com/item?id=10993919)

<comment><USER2> I think it's a nice article.

> While I have no formal proof, I postulate that the problem of Artificial > Expression is NP-Complete (again, not possible to solve using existing > techniques).

But this detracts from it, is it is not what NP-Complete means.

Also:

> Be aesthetically pleasing

> Be purely original

I think a good deal of human art does not fit these specifications.

<comment><AUTHOR> First of all, thanks for reading! I'm glad you enjoyed it.

I agree this is not a definition of NP-Complete, but I was writing this with a less technical audience in mind and wrestled with the description.

>I think a good deal of human art does not fit these specifications.

Absolutely true! When I wrote the article I spent a good deal of time thinking on these cases, and while art definitely covers much more than this, it fits well as a good litmus test.</comment></comment></comment>


Upgrade your SSH keys - <AUTHOR> https://blog.g3rt.nl/upgrade-your-ssh-keys.html <comment><USER3> Seriously, the _default_ options to ssh-keygen should be all anybody needs. If you need to pass arguments to increase the security of the generated key, then the software has completely failed its purpose. Passing arguments should only be for falling back on less secure options, if there is some limiting factor for a particular deployment.

There is absolutely no reason to pass arguments to ssh-keygen. If it is actually deemed necessary to do so, then that package's installation is inexcusably broken.

<comment><USER4> Well. OP says ->Generate your new sexy Ed25519 key

I too, say, No f'ing thanks [https://en.wikipedia.org/wiki/Curve25519](https://en.wikipedia.org/wiki/Curve25519) In cryptography, Curve25519 is an elliptic curve offering 128 bits of security - The curve is birationally equivalent to Ed25519, a Twisted Edwards curve.

Ecrypt II - the EU project into encryption security says: [https://www.keylength.com/en/3/](https://www.keylength.com/en/3/)

That gives you

Very short-term protection against small organizations Should not be used for confidentiality in new systems

and is equivelent to an 816bit RSA key

So how is this new key "Sexy" in any way.

<comment><USER5> First of all the Ecrypt project is is really outdated. Second you're reading the table wrong. Curve25519 gives you 128 bit of symmetric security, but the curve is 255 bit long. So from your table this compares to 3248 RSA. Third I'm no fan of such key number tables, it's a bit arbitrary and doesn't really reflect the complexities of modern cryptography.

</comment></comment></comment><comment><USER6> Something I don't understand is the "hate" that RSA gets. Yeah, Elliptic Curves are promising, have benefits (smaller/faster).

But RSA isn't broken, it is well understood, is "boring" (a plus on security, usually), has bigger bit sizes (according to people that know a lot more to me that's a plus point, regardless of EC requiring smaller ones, because of certain attacks), isn't hyped and sponsored by the NSA and isn't considered a bad choice by experts.

Not too many years ago Bruce Schneier was skeptical about EC, because of the NSA pushing for it. Now, I also trust djb and i an sure that ed25519 is a good cipher and there are many projects, like Tor that actually benefit from it, increasing throughput, etc., but for most use cases of SSH that might not be the issue, nor the bottleneck.

So from my naive, inexperienced point of view RSA might seem the more conservative option. And if I was worried about security I'd increase the bit size.

Am I going wrong here?

<comment><USER7> The bit size of the RSA modulus and the bit size of ECC keys aren't really comparable, as what matters is the number of operations required to break the primitive.

A better comparison exists between multiplicative group crypto (DH/DSA) and their Elliptic Curve variants. In multiplicative group crypto there is a trivial, obvious mapping to the ring of integers (in less mathematical terms, "factorization makes sense"), so you can use techniques like Pohlig-Hellman ([https://en.wikipedia.org/wiki/Pohlig%E2%80%93Hellman_algorit...](https://en.wikipedia.org/wiki/Pohlig%E2%80%93Hellman_algorithm)) and Index Calculus ([https://en.wikipedia.org/wiki/Index_calculus_algorithm](https://en.wikipedia.org/wiki/Index_calculus_algorithm)). In Elliptic Curve groups we use, such a trivial mapping does not exist, although there are some special cases where you can achieve this ([http://crypto.stackexchange.com/a/8344](http://crypto.stackexchange.com/a/8344)). Consequently, larger numbers are needed for security in these cases (along with strong primes).

The "bad press" RSA gets is likely due to the fact that in however many years of existence there have been a number of attacks on implementations - <USER2> example, side channel attacks, Bleichenbacher's attack on RSA PKCS#1_5 padding etc. Here's a survey: [https://crypto.stanford.edu/~dabo/papers/RSA- survey.pdf](https://crypto.stanford.edu/~dabo/papers/RSA-survey.pdf) . A simple explanation is that implementing RSA is a fun exercise for personal experimentation, but implementing RSA for use in the wild is fraught with difficulties.

Ed25519 has some nice properties aside from the size of keys and signatures. It is deterministic, removing the requirement for cryptographically random (and therefore almost unique) k - if you forget this with plain ECDSA you end up in the Sony PS3 scenario. The provided software does not rely on indexes or branch instructions, removing timing issues in those cases and making the code constant time. It has what Bernstein calls "twist security" ([https://safecurves.cr.yp.to/twist.html](https://safecurves.cr.yp.to/twist.html)). Ordinarily, an ECC algorithm should check that a calculated or received point, particularly where point compression is used, exists on the curve in question - however with DJB's "twist security" and in particular in ed25519 this is unnecessary, simplifying the job of the implementer.

In other words, it is harder to get an implementation of ed25519 wrong.

As for the NSA pushing ECC, more intelligent people than may have different views, but I believe that ECC in general is sound, taking into account the sum of our knowledge so far. As with any algorithm there are specific choices of curves and constants which weaken the setup and we have a case study where NSA pushed poor choices deliberately: [https://en.wikipedia.org/wiki/Dual_EC_DRBG](https://en.wikipedia.org/wiki/Dual_EC_DRBG) . It comes down, therefore, to whether you believe the constants chosen for the NIST curves are "cooked" or not. I can't see any evidence to support this, but this doesn't mean it hasn't happened. However, Curve25519, Ed-448, Curve41717, FourQ and Brainpool curves are all curves designed outside the NIST system and not endorsed by the NSA and Bernstein includes in his security evaluations the concept of "rigidity", i.e. a full explanation of how curve parameters are generated (see [https://safecurves.cr.yp.to/rigid.html](https://safecurves.cr.yp.to/rigid.html)) (although, apparently, there are some issues with Brainpool curve generation: [https://bada55.cr.yp.to/brainpool.html](https://bada55.cr.yp.to/brainpool.html)).

If you want to measure "time of life" as a measure of safety, using the general assumption that the longer something remains unbroken the safer it is, RSA certainly scores better in that sense (although ECC goes back to the 90s and Curve25519 to 2005, so have been around a while too) and for a correct, good, well vetted implementation of RSA I see no reason personally to stop using it, with the caveat that, as you've noticed, if you have a high throughput system, you get equivalent security more efficiently with ed25519.

An interesting recommendation in the original article is to use smart cards for high assurance environments. I personally use an OpenPGP card (v2.1) and an authentication subkey on it acts as my SSH key. For this I use 4096-bit RSA keys - the OpenPGP v2.1 spec as implemented by this card does not support ECC at all, even though the actual hardware chip ([http://www.basiccard.com/overview.htm](http://www.basiccard.com/overview.htm)) is capable of 512-bit ECC curves. The OpenPGP Card 3.0 standard includes ECC support but so far as I am aware no cards implementing it are available. The same is actually true in the JavaCard world; hardware support exists, but most JavaCard implementations you can buy are "limited" to 2048-bit RSA (If anyone knows differently I would love to know, please yell), which should be good enough for the moment but it would be nice to have some wiggle room.

So to summarise, the "hate" that RSA gets is likely due to the number of times people have seen mistakes in implementations. That said, the article makes a good point regarding the strength of brute forcing your key passphrase if you are not storing your keys on smartcards. If you are going to regenerate your key, I see no reason not to use ed25519 as you will likely be using it for host authentication anyway (modern remote hosts likely generate ed25519 keys by default, rather than RSA). I'd use it on my smartcards if I could, since there the timing difference for a signature would be noticeable. I have multiple ssh keys and those not stored on a smartcard are all ed25519. If you are considering embedded environments or high throughput ones, or many signature checks, ed25519 makes even more sense.

<comment><USER8>
        but implementing RSA for use in the wild is fraught with difficulties

Side question, is there a comprehensive list of those issues/requirements anywhere? I built a list of about five requirements based on the Cryptopals challenges I'm fairly sure there's more. Before anyone asks, this is an academic interest rather than an attempt to implement crypto.

</comment></comment></comment><comment><USER9> I disagree with the author. Before you go upgrading into ed25519, beware that the NSA/NIST is moving away from elliptical curve cryptography because it's very vulnerable to cracking with quantum attacks[0].

 _" So let me spell this out: despite the fact that quantum computers seem to be a long ways off and reasonable quantum-resistant replacement algorithms are nowhere to be seen, NSA decided to make this announcement publicly and not quietly behind the scenes. Weirder still, if you haven't yet upgraded to Suite B, you are now being urged not to. In practice, that means some firms will stay with algorithms like RSA rather than transitioning to ECC at all. And RSA is also vulnerable to quantum attacks."_

Stick with the battle tested RSA keys, which are susceptible but not as much as ECC crypto. 4097 or even better 8192-bit lengths.

There's no perceptible user benefits to using ed25519 and it's not even supported everywhere. Also you won't have to rotate all of your keys when workable quantum computers start crackin' everything.

[0] [https://blog.cryptographyengineering.com/2015/10/22/a-riddle...](https://blog.cryptographyengineering.com/2015/10/22/a-riddle- wrapped-in-curve/)

<comment><USER10> Both RSA and Elliptic Curve will fall to practical quantum computing, so the idea that you should use (weaker, slower) RSA today instead of curves because of QC is... dubious.

If you see quantum computing as a practical threat (because: you're encrypting and storing static data that needs to resist cryptanalysis for 20-50 years), you need to use a post-quantum cryptosystem. Unfortunately: nobody knows which pq systems will truly hold up to practical quantum computing, and it's possible --- even likely --- that implementations of pq schemes have dumb errors that nobody has thought to check for yet.

That's why Google's first foray into deploying pq crypto feeds both a curve computation and a Ring-LWE PQ computation into its KDF, so that unknown bugs in the RLWE exchange can't destroy the security of TLS. That's how you would seriously account for quantum computing in SSH.

The recommendations in this post are solid.

<comment><USER5> There is one argument to be made in favor of large key RSA when it comes to quantum computers: ECC may fall a bit earlier. There can be a situation where it's feasible to produce a quantum computer large enough to tackle a 255 bit ECC key, but not a 4096 RSA key. I have heard from (a few) cryptographers that this is a reason to stick with "old school" DH/RSA crypto.

I discussed this with various people involved in the postquantum debate and the general feedback I got was that this is likely not a big issue, because once quantum computers can be scaled it'll probably not be that hard to scale them up to RSA-breaking size. I think DJB once said something like "this will buy you a year" to me.

</comment></comment></comment><comment><USER11> Noob question here, why move just one step ahead. Why not 8192 or hell 16,384? I can see it can lead to higher CPU consumption on often used keys but for keys that are not accessed more than a couple of times a day, why is it such a bad idea to overdo it?

<comment><USER12> someone correct me if i'm wrong, but I believe its not just used once a day. Its used for every packet you send while connected.

<comment><USER13> The ssh protocol specs are actually quite readable. No, the slow asymmetric key is only used once to derive a fast symmetric key for the session. If you a set up a control master, then repeated logins to the same server (within some narrow window) will all multiplex over the same channel, too.

<comment><USER14> For those who have never heard of ControlMasters, I highly recommend them. SSH can multiplex multiple sessions (you invoking ssh at the terminal) over a single TCP socket — this feature is called ControlMaster. The first ssh command takes the normal amount of time, but every command after that is just ~a round-trip. No slow asymmetric key exchange. If you close all your connections, there a (configurable) timeout until the ControlMaster's connection closes.

You can combine this fact with zsh's autocomplete powers, and get pretty- close-to-instant (on a good connection) tab-completion of directories _on the remote server_ , which is extremely nice when trying to scp something, as you can tab complete the paths in that command.

(It also saves a few PIDs on the server, as a single sshd child deals with all your connections.)

<comment><USER15> > You can combine this fact with zsh's autocomplete powers,

I found that recent versions of SSH have begun hashing `~/.ssh/known_hosts` which nerfed zsh autocomplete pretty badly. You need to set "HashKnownHosts no" in `~/.ssh/config`. The SSH change was made to prevent a key compromise from giving an attacker a ready-made list of vulnerable next targets.

<comment><USER16> But can't they also just find the hosts by looking at your bash history?

<comment><USER17> Bash history rotates (or can be managed, which a lot of people do), whereas known_hosts will have every server you ever accessed and is rarely ever touched.

</comment></comment></comment></comment></comment></comment></comment><comment><USER18> Can someone explain to me why RSA 2048 is "recommended to change"? It's still the default for gpg keys and as far as I know is widely thought to be secure for at least few hundred years!

<comment><USER19> It could have to do with the NSA's August 2015 plan for transitioning to quantum-resistant algorithms. In their new Commercial National Security Algorithm (CNSA) Suite, they advise a minimum 3072-bit RSA modulus:

[https://www.iad.gov/iad/programs/iad-initiatives/cnsa- suite....](https://www.iad.gov/iad/programs/iad-initiatives/cnsa-suite.cfm)

(Doh... I don't know why I'm getting an invalid certificate authority error when trying to access that site, but Qualys SSL Labs confirms it's a real error. Yikes.)

<comment><USER20> Also: with quantum computing still in its infancy, how do we actually know which types of keys would be adequate?

<comment><USER19> Koblitz and Menezes explore various theories about the NSA's new policy in their paper, A Riddle Wrapped In An Enigma:

[https://eprint.iacr.org/2015/1018.pdf](https://eprint.iacr.org/2015/1018.pdf)

<comment><USER21> For anyone reading the thread, this is an absolute must-read paper if you're at all interested in the near-future of production cryptosystems in high-risk settings.

</comment></comment></comment></comment></comment><comment><USER13> If you have servers too old to work with the latest keys, you can easily modify your ~/.ssh/config to automatically use a per-machine private key file:

      Host foo.example.com
        Keyfile ~/.ssh/my_obsolete_private_keyfile

<comment><USER22> That you should be doing anyways, shouldn't you?

<comment><USER23> You certainly can, it's almost certainly unnecessary though. SSH keys are not like passwords, compromise of a server with your pubkey in no way effects the security of your private key. Many people will post pubkeys online so they're easy to add to new servers.

<comment><USER24> Adding to this: GitHub publishes the public SSH keys of all of their users, for example: [https://github.com/teozkr.keys](https://github.com/teozkr.keys)

</comment></comment></comment></comment><comment><USER25> RSA 2048 is still the openssh default, i.e., best current advice from the openssh authors. The fact that this article's author labels that as "yellow" is a red flag.

<comment><USER20> I agree. It would be nice if the line:

> RSA 2048: yellow recommended to change

was followed by at least some link that explains why is it unsafe. Could anyone elaborate further?

UPDATE: there is now a link up in this thread, from the user fjarlq, which points to an NSA recommendation from 2015. The recommendation seems to be related to the need of having a "quantum computing resistant" key. But with quantum computing still in its infancy, how do we know which types of keys would be adequate?

<comment><USER26> Many theoretical aspects of quantum computing are well-understood, just as a lot of early work on computational complexity etc. predates the existence of (nonhuman) computers.

</comment></comment></comment><comment><USER27> Can anybody elaborate on the idea that for RSA <=2048 is potentially unsafe? Is it true? It seems that even 1024 bit keys haven't been factored yet, much less 2048, so why use anything else currently?

[https://en.m.wikipedia.org/wiki/RSA_Factoring_Challenge#The_...](https://en.m.wikipedia.org/wiki/RSA_Factoring_Challenge#The_prizes_and_records)

<comment><USER28> I want someone to explain this too -- the article does not give any strong evidence that RSA <= 2048 is unsafe.

</comment></comment><comment><USER29> Ed25519 is fast, but I don't think the speed is significantly faster to be an argument for using it. Running the borgingssl speed tool on a skylake mobile processor:

        Did 1083 RSA 2048 signing operations in 1017532us (1064.3 ops/sec)
        Did 29000 RSA 2048 verify operations in 1016092us (28540.7 ops/sec)
        Did 1440 RSA 2048 (3 prime, e=3) signing operations in 1016334us (1416.9 ops/sec)
        Did 50000 RSA 2048 (3 prime, e=3) verify operations in 1014778us (49271.9 ops/sec)
        Did 152 RSA 4096 signing operations in 1000271us (152.0 ops/sec)
        Did 8974 RSA 4096 verify operations in 1076287us (8337.9 ops/sec)
        ...
        Did 6720 Ed25519 key generation operations in 1029483us (6527.5 ops/sec)
        Did 6832 Ed25519 signing operations in 1058007us (6457.4 ops/sec)
        Did 3120 Ed25519 verify operations in 1053982us (2960.2 ops/sec)

RSA key verification is still extremely fast.

(also don't look at these numbers purely as speed, but as CPU time spent)

<comment><USER30> Not everyone is using Skylakes. My gateway is a Raspberry Pi (for historical and power reasons) and my most often used client is ARM based.

</comment></comment><comment><USER31> [https://www.reddit.com/r/netsec/comments/543ncp/upgrade_your...](https://www.reddit.com/r/netsec/comments/543ncp/upgrade_your_ssh_keys_how_to_get_rid_of_dsa_and/)

<comment><USER8> I always find it interesting to see the disparity between comments here, and in /r/netsec on matters like this.

Here: Generally positive. Netsec: Most upvoted comments being complaints and assertions that it's bad advice. And for some reason, upvoted comments about NSA involvement in curves (which is exactly what 25519 is not).

<comment><USER32> I've started moving away from reddit for any kind of actual discussion about technical topics. It's just so... Toxic.

I don't know if it's just my point of view changing, or if it's gotten worse over the last few years, but when I see a thread there later, the top comments are always negative, dismissive, and so full of bullshit.

Just look at the recent Lenovo issue, HN had some good discussion on on what could be the actual causes and how to fix some of these problems (and why MS isn't entirely off the hook there), but reddit was just full of "Microsoft loves Linux!" Jokes and whichunting with very little to go on.

</comment></comment></comment><comment><USER33> Security is not my specialty, but I obviously wade in this field, being a developer. Having read this article I __will __say this to OP and the author:

Thank you, I am sufficiently paranoid enough to change my keys now.

</comment><comment><USER34> If you have any RHEL machines, you might wanna keep an RSA (or ECDSA) key around. RHEL doesn't support Ed25519.

I haven't checked, but I presume this also goes for CentOS, Scientific Linux, and other derivatives.

<comment><USER25> The article claims that RHEL7 supports Ed25519. Maybe RHEL6 and older do not.

</comment></comment><comment><USER35> For those who have just updated to macOS Sierra, the default SSH client configuration is to not allow ssh-dss keys any longer.

Follow these instructions to update your keys.

</comment><comment><USER36> This is my standard on new server setup (which is admittedly overkill but I'd rather have it slightly slower and safer):

[http://www.catb.org/esr/sshexport/](http://www.catb.org/esr/sshexport/)

[https://stribika.github.io/2015/01/04/secure-secure- shell.ht...](https://stribika.github.io/2015/01/04/secure-secure-shell.html)

SERVER SIDE:

sources.list (if you're on an older version of debian) deb [http://http.debian.net/debian](http://http.debian.net/debian) wheezy- backports main

apt-get -t wheezy-backports install --reinstall ssh

====

cd /etc/ssh

rm ssh_host_ _key_

ssh-keygen -t ed25519 -f ssh_host_ed25519_key -a 256 < /dev/null

ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key < /dev/null

(do not password protect server side keys)

====

/etc/ssh/sshd_config

Protocol 2

HostKey /etc/ssh/ssh_host_ed25519_key

HostKey /etc/ssh/ssh_host_rsa_key

KexAlgorithms firstname.lastname@example.com,diffie-hellman-group-exchange- sha256

Ciphers email@example.com,email@example.com,firstname.lastname@example.com,aes256-ctr,aes192-ctr,aes128-ctr

MACs email@example.com,firstname.lastname@example.com,hmac- email@example.com,email@example.com,hmac-sha2-512,hmac- sha2-256,hmac-ripemd160,email@example.com

====

CLIENT SIDE:

/etc/ssh/ssh_config

Host *

KexAlgorithms email@example.com,diffie-hellman-group-exchange- sha256

Ciphers email@example.com,firstname.lastname@example.com,email@example.com,aes256-ctr,aes192-ctr,aes128-ctr

MACs firstname.lastname@example.com,firstname.lastname@example.com,hmac- firstname.lastname@example.com,email@example.com,hmac-sha2-512,hmac- sha2-256,hmac-ripemd160,firstname.lastname@example.com

====

ssh-keygen -t ed25519 -a 256 -f yourkey.key -C whateveryouwant

<comment><USER37> For people like me who create a new server and put our public SSH keys in ~/.ssh/authorized_keys, can you explain what doing this does, and why it's good?

I can see you're limiting it to particular algorithms/cyphers, but the rest?

<comment><USER36> The stuff towards the top eliminates the insecure keys your server will try to default to. No reason to keep them on the server (IMO) - they're primarily there for backwards compatibility. I prefer to remove them entirely so I know my client/server won't ever negotiate an insecure connection.

</comment></comment></comment><comment><USER38> So I once read somewhere that RSA is simpler to implement than most other algorithms, and hence it's a safer choice than other algorithms, because weaknesses typically come from suboptimal implementation less than from the cryptographic algorithm. (Unless you use known-broken things like md5 or 3DES).

And I think that was in the context of some DSA or ECDSA weakness, possibly a side channel attack or something similar. I forgot the details :(

What are your thoughts on this? Should we focus more simplicity and robustness of the implementation, rather than just the strength of the algorithm itself?

<comment><USER30> Actually, if you ready DJB's fine papers he very much touches on this. Curve 25519 (now X25519) is specifically designed to avoid the pitfalls. The reference implementation is not too hard to understand, but granted the optimized versions are a little more delicate. Still, I _imagine_ the optimized RSA implementations are no better.

</comment></comment><comment><USER39> Maybe a more technical/comprehensive read is this[1] writeup, which I see some others have linked to. Prior HN[2].

[1] [https://stribika.github.io/2015/01/04/secure-secure- shell.ht...](https://stribika.github.io/2015/01/04/secure-secure-shell.html)

[2] [https://news.ycombinator.com/item?id=8843994](https://news.ycombinator.com/item?id=8843994)

</comment><comment><USER40> What's the problem with ECDSA?

</comment><comment><USER41> Something I found resourceful while setting up SSH on a recent server is Mozilla's SSH Guidelines - [https://wiki.mozilla.org/Security/Guidelines/OpenSSH](https://wiki.mozilla.org/Security/Guidelines/OpenSSH)

</comment><comment><USER42> >RSA 2048: yellow recommended to change

Could someone provide a link with decent explanation why? Is it solely out of fear that it will be cracked soon on quantum computer?

</comment><comment><USER43> Why not usimg this year as the name for the ssh? Then when you are using _2014.pub_ or _2013.pub_ you know it's time to upgrade

</comment><comment><USER44> Nobody is going to brute-force my git keys, especially when it's so trivial to gain access to the repos via social engineering.

</comment><comment><USER45> github doesn't support ed25519 keys does it?

<comment> y-satellite Just tried it out; works fine.

<comment><USER45> Oh really? Last time I tried it I think it didn't.

I assume they added support for it in the meantime... Great!

</comment></comment></comment><comment><USER46> In Userify (ssh key manager that only distributes sudo roles and public keys -- you keep your private keys[1]) we're going to be disallowing DSS keys soon.

I like this post - it's good advice overall. Keys are easy to handle and in some ways more secure than certificate management (which relies on extra unnecessary infrastructure).

1\. [https://userify.com](https://userify.com)

<comment><USER47> Off topic, but I want to thank you guys again for your service. You guys make it so freaking easy to manage access to our various servers and VMs- I can't even remember how we used to deal with it.

<comment><USER46> Thank you! I don't know who you are (feel free to email me @ userify.com) but we really really really love to hear stuff like that. We are launching in AWS Mktplace soon too btw!

</comment></comment></comment><comment><USER48> _the need to generate fresh ones to protect your privates much better_

Um, I'm pretty sure he meant _privacy_ , not "privates." Time for an edit.

</comment><comment><USER49> very good post about security!

many people still using RSA/DSA keys :/ some people are doing even worse things. Last week I saw one man who have shared his priv key by email message!

QWERTY people have to grow up!

</comment><comment><USER50> I wish this whole SSH business would be less complicated...

<comment><USER51> The defaults are actually fine; don't worry. You don't need to set a passphrase for your key, you don't need to run an agent. Just

        ssh-keygen -t ed25519

and paste your public key into ~/.ssh/authorized_keys. `-t ed25519` is optional.

<comment><USER52> > You don't need to set a passphrase for your key

That's highly questionable advice. The passphrase is like two factor auth, it protects you if your private key ends up in someone else's hands. That's a risk you have to weigh up.</comment></comment></comment>


Startups Are Hard in 100 Different Ways - <AUTHOR> http://techcrunch.com/2015/06/11/startups-are-hard-in-100-different-ways/

<comment><USER2> I try to keep a daily habit of meditation, exercise, healthy food and solid sleep.

Here's the key for me - even when I'm feeling great and like I can skip a session I don't. When I do skip I feel fine for a few days then it hits me.

<comment><AUTHOR> Good point - easy to miss a few days and think you are in the clear.

</comment></comment><comment><AUTHOR> Author here - any coping skills you have used to make startups more emotionally manageable? Any in the article resonate?

Also, we launched www.7cupsoftea.com/startups to help make startups less stressful.

<comment><USER3> This may seem obvious, but just setting a reminder to take a break every 45-90 minutes has helped me step away from the screen, stretch, rest my eyes, breathe, and maybe get some fresh air, all of which seem to help alleviate some stress.

<comment><AUTHOR> I like that idea of taking a break every so often. Makes sense. I'm going to try to implement that.</comment></comment></comment>


Psychedelics could be the new class of antidepressant - <AUTHOR> https://www.independent.co.uk/news/long_reads/psychedelic-drugs-new-class-antidepressant-albert-hofmann-lsd-a8437201.html <comment><USER2> Personally I think it is in everyone's interest to try it at least once.

Of course people are depressed. Most people's lives are about work that is not enjoyable, in order to get money to live somewhere.

I think it would be super weird if most people were happy. I don't mean us, the IT crowd, with tons of money and a job we mostly enjoy. We are living luxary lives, most of us.

But the others, with low paying jobs, they have no interest in? Of course a lot of them are depressed. It's a consequence of our societies and how we live.

<comment><USER3> LSD saved my life. Brought me out of a horrible depression that lasted from my teen years through my twenties, and I will always be thankful for that.

However, I disagree that everyone should try it. I've personally seen people who were predisposed to psychosis get really messed up from taking psychedelics. These things are extremely useful and powerful tools, but they should be used as a last resort.

Maybe it is in MOST peoples interest, possibly. But certainly not everyone's interest, because there are very real consequences to taking these drugs.

</comment></comment><comment><USER4> What happened to Shulgin's new class of antidepressants he was working on?

</comment><comment><USER5> First, they should try vitamin D and magnesium.</comment>


The Six-Figure Fishtank Catches On - <AUTHOR> http://www.nytimes.com/2010/08/19/garden/19aqua.html

<comment><USER2> _a minimum of $50,000, plus at least $1,000 a month for maintenance. And that's before buying a single fish._

Too rich for my blood. How about a 60inch 1080p LCD or LED TV with a Blu-Ray loop of fish swimming? That would only cost $2000 or so, and you can use it for other things too.</comment>


Competition is hotting up in the coffee industry - <AUTHOR> https://www.economist.com/business/2018/10/13/competition-is-hotting-up-in-the-coffee-industry <comment><USER2> "Hotting up" is idiomatic in Britain.

[https://english.stackexchange.com/questions/384556/hotting-u...](https://english.stackexchange.com/questions/384556/hotting- up-vs-heating-up)

<comment><USER3> As an American who has worked 6 months in the UK, I never once heard this.

An equally rare but still extant US slang phrase is probably something like "aint finna" or "i'm not about that life"

<comment><USER4> "finna" is a hypercontraction of "fitting to" (via fit'n'ta) which comes from "fixing to" or "about (going) to". So "aint finna" is really "I'm not about to", which makes the connection to "I'm not about that life" more clear.

[edited to add the connection between fitting and fixing]

[edit2, fun asides aside, I don't see what relevance this has to the original comment about hotting up.]

<comment><USER3> Really confused why I'm being downvoted and why you are explaining what finna means.

I'll restate the purpose of my comment again, in detail:

1) I said that I worked in the UK for six (6) months.

2) I said that I never once heard the phrase "hotting up", despite us often saying "make some tea" and etc.

3) I then compared the rarity of the expression "hotting up" to the rarity of certain "American" phrases.

4) I ultimately concluded that though all of these phrases exist and are used by English speakers, they are rare and niche.

5) That is to say, they are relatively obscure and not extremely widespread.

<comment><USER5> If you have not heard the phrase 'hotting up' then you have obviously not watched a TV weather report or really paid attention to your peers when they talk about the weather. It is extremely common here to use the term when describing weather that is going to become warmer over the near term.

It is not rare, but its usage tends to be a bit narrow and is now most commonly applied to weather or to competition (as in 'the contest is hotting up' where an American would use 'heating up'.)

You are being downvoted for being wrong and suggesting that your limited experience and apparent lack of awareness is indicative of the rarity of this expression.

<comment><USER3> This comment is really representative of human ego and over-confidence. Note that I cannot downvote you, but you can downvote me.

I offered an anecdote, you offered an anecdote. Many of my UK colleagues said "heating up a pot of tea".

But, since you are so very confident of yourself and your country, you swear to me that my experience is so wrong that people should not believe it happened.

<comment><USER5> You heat up a pot of tea (or would generally just say you are going to put the kettle on), you do not 'hot up the tea'. The usage is specific, which is probably why you did not notice it or pay much attention if you did hear it. OTOH, it is a very common usage when describing weather or competition.

It does not take much effort to do a bit of an online search to see that the comment you were replying to was in fact correct that this term is idiomatic British English. This is not anecdote and is easily demonstrated through thousands of examples that are but a short google search away.

<comment><USER6> >demonstrated through thousands of examples that are but a short google search away.

There are also thousands of examples of bequeath but a short google search a way but that doesn't mean anything about its place in modern language.

[https://trends.google.com/trends/explore?geo=GB&q=hotting%20...](https://trends.google.com/trends/explore?geo=GB&q=hotting%20up,heating%20up)

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER7> This would be interesting to read about, but this article seems very light on anything interesting to me. It's mostly just a summary of acquisitions and mergers.

I'm curious if any coffee fans here have any Stratechery-type thoughts on the future of the industry.

<comment><USER8> Well, the consolidation itself is kind of interesting, I think; while retail food service brands have certainly gone through consolidations before, the restaurant and cafe industry hasn't been quite as subject to it. (Not to say that it doesn't happen, but the biggest operators tend to spin off and trade brands as often as they buy them, like Red Lobster being spun off from Darden, or A&W and Long John Silver's being spun off from Yum! Brands -- yes, that local fast food place that's a joint A&W and KFC is actually two separate companies now.)

Something that this piece hints at but doesn't underline well is just how big JAB Holding Company has quietly become in the last ~5 years: they now outright own or have controlling/majority interest in Bruegger's Bagels, Canada Dry, Caribou Coffee Company, Dr Pepper, Einstein's Bagels, Green Mountain Coffee, Intelligentsia Coffee & Tea, Jacobs Douwe Egberts, Keurig, Krispy Kreme, Mighty Leaf Tea, Noah's Bagels, Panera Bread, Peet's Coffee & Tea, Snapple, and Stumptown Coffee. That is a _big_ company. Nestlé's coffee brands aren't all that well known over here, despite the push to get people to pay attention to Nespresso.

Personally, I remain unconvinced that there's a huge untapped market for "better" home coffee and espresso brewers in the US; while this sounds like a setup for a "quality, convenience, and price, pick any two" joke, in practice, it seems like you can pick either quality _or_ convenience, regardless of price. Keurig machines simply don't make very good coffee; a consumer who finds a Mr. Coffee too fiddly is _not_ going to be swayed by a coffee nerd with an Aeropress; and given that Americans don't seem to love espresso drinks unless they're fiddly steamed milk and syrup based concoctions, even a Nespresso machine isn't going to help much with the convenience aspect. JAB's signing a deal with Illy, what led to this Economist article, doesn't seem like it's really going to move the needle much over here, at least; a Keurig capsule full of Illy coffee will still be a Keurig capsule, and Illy's capsule machine that's a competitor to the Nespresso isn't likely to do any better here than any of the other Nespresso also-rans.

(I am, for the record, a coffee nerd with an Aeropress. And a Technivorm, a few different single cup dripper gadgets, a Chemex, and, yes, a Nespresso.)

<comment><USER9> The best blend of quality and convenience I've found so far is a french press. They're less fiddly and messy than an aeropress (I own one and never use it), cheaper than a drip machine, easy to clean, and produce good coffee. The only drawback is that you do need a decent grinder. A cheap spinning-blade grinder will produce a mix of large grounds and powder that will clog the mesh.

<comment><USER8> I have a French press, too. I like it, although I am not sure I would agree that it's less messy than an Aeropress, and I think it works best with darker roasts than lighter ones. But, none of the "good coffee gadgets" address the "I want something faster and more convenient than a Mr. Coffee" market that Keurig is going for. I'm not convinced you can get Keurig speed and convenience _and_ get good coffee.

<comment><USER10> The way I see it, there are 2 factors that make it hard to get keurig speed + convenience and good coffee:

1) Since brew time is a function of temperature and ground size, K-pods can use hotter water and finely ground coffee to speed up extraction of the coffee grounds, even if it results in sub-optimal flavors.

2) K-Pods probably have a complicated supply chain that would make it hard to ship fresh roasted + ground coffee. I'm sure this could be circumvented somehow, but it would most likely require an expensive solution since it's so time sensitive.(ideally you have coffee ground just minutes before brewing, or at least less than a week before brewing.)

Honestly, instant coffee is probably the best solution for extreme convenience + great coffee. Folgers instant is awful, but companies like Sudden are trying to make a decent crystallized coffee: [https://www.suddencoffee.com/](https://www.suddencoffee.com/)

<comment><USER8> While it's been a _really long time_ since I had a Keurig, I seem to remember that they used around 200°F water, and when I had one of the little "use your own grounds" containers for it, if I got the water-to-coffee ratio right it it was...decent. While it brews fast, it brews under just a little pressure, kind of like an Aeropress.

That was before Keurig had been bought by Green Mountain, though, and it seemed like they were _trying_ to manage as good coffee as they could out of K-Cups. They were contracting mostly with specialty coffee roasters, and the K-Cups were filled with nitrogen to try and preserve the flavor. There were a couple I found that I did actually like, although I don't know if I would if I tried them again. :) My impression is that Keurig's quality control has gone down over the years, certainly with the machines, and one suspects the coffee.

I've heard of Sudden before -- positively, from people who really care about coffee -- but haven't tried them. I probably should. I've taken a few trips to places where the nearest good coffee was quite a distance away. :)

</comment></comment></comment></comment></comment></comment><comment><USER11> This is an ad for coffee pods, disgised as investment news.

<comment><USER12> dunno as the economist paywalls this article for me. i guess i clicked too many links into their site...

</comment></comment><comment><USER13> The title "Competition is hotting up" should really be "Competition is heating up", right? Is there some play on words here that I don't understand? Using the word "heating" is both grammatically correct and works with the word play. Does the economist lack editing staff?

<comment><USER14> "Hotting up" is a British idiom meaning the same as "heating up". The economist is British. Not everyone speaks American English.

<comment><USER13> Ah, that makes sense.</comment></comment></comment>


Direct contact among galactic civilizations by interstellar spaceflight (1962) - <AUTHOR> https://www.loc.gov/resource/mss85590.011/?st=gallery <comment><USER2> For those who are curious, the Seth MacFarlane collection is indeed funded by Seth MacFarlane of Family Guy and Ted fame. IIRC he sponsors a number of pro- science activities.

<comment><USER3> Don't forget The Orville - perhaps appropriately given the topic

<comment><USER4> And Cosmos!</comment></comment></comment>


Ask HN: What are the best pieces of EdTech software you have seen? - <AUTHOR> In terms of 1) Usability, 2) Usefulness, 3) On-boarding process etc. <comment><USER2> www.mypat.in</comment>


The Paradox of Technology with Generation Y - <AUTHOR> http://yworking.com/technology/the-paradox-of-technology-with-generation-y/

<comment><USER2> I think your example of someone who is native English speaking saying "I am not good at English" is the perfect analogy. Members of GenY are likely comparing themself to other members of GenY (guys that built Facebook, for example) and in comparison, find themselves lacking. If they were to compare themselves to Baby Boomers or even GenXer's, however, they might sing a different tune.</comment>


Browser designed to help power users 'Eat The Web' - <AUTHOR> https://www.usechomp.com <comment><AUTHOR> Hi HN! Maker here. I've been a too many tabs guy for as long as I've had internet access (even back when that meant too many windows on IE). I've tried a lot of approaches: chrome extensions (OneTab, TooManyTabs, Tree-style tabs); built my own extension (TabLasso); even written down links on paper (I know).

I had this realization that most of my tab sprees came from research I was doing into specific topics—stuff that was kind of like a background job I wanted to pause on and pick up later. So I'm building a browser specifically for that.

Your tabs are organized by project, treated like a todo list, and can get cut up into just the useful pieces and glued together into a kind of summary of your progress on looking into that topic so far.

We're looking for people who have tried all the tools and want to get in on the ground floor. Excited to hear your feedback on our approach!

<comment><USER2> Create new window > bookmark all tabs > close window

<comment><AUTHOR> Totally get that workflow working for a lot of people, but not me.

I end up with thousands of bookmarks that I never revisit even though I know I saved them for a reason. Even if they're organized by the window, I don't have any context as to what I was thinking when I saved it (was I interested in the entire site, or just a piece?). After a certain point bookmarks and OneTab are just too noisey to have any value.</comment></comment></comment>


Takipi hosted production JVM debugging - <AUTHOR> http://takipi.com

<comment><AUTHOR> This is pretty fascinating, in 5 minutes you can have a level of application monitoring better than high profile tech companies do. It's a nice production level supplement to visualvm. It's hosted and right now looks interesting for small shops that can't grow this kind of thing in house.</comment>