Tech Startups Face Fresh Pressure on Valuations - <AUTHOR> http://www.wsj.com/articles/tech-startups-face-fresh-pressure-on-valuations-1451817991?=e2fb <comment><USER2> Summary, given the challenge some companies have had keeping ahead of their last private round when it comes to public markets, large funding sources are pulling back from their irrational exuberance of the last couple of years.

That is an entirely expected and reasonable thing for them to do. And it's going to force some IPOs on companies that are not ready for it, and it will cause some companies that used to be "golden" to start dismantling. And that too is entirely expected.

And some people, perhaps a quite a few, who thought they were "set for life" and perhaps even thought their kids were set for life, will find that maybe they aren't really yet. That certainly happend to me during the dot com crash and it was a sobering experience.

But like the 1,000 sea turtles that crawl out of the sand and into the surf, the 100 that survive may do so for over a hundred years. Sadly there isn't any easy way to figure out which are the survivors until they are the last ones left standing.

<comment><USER3> How fair is it to compare this round of late-stage devaluations with the dot- com bubble? From what I've read/heard, "irrational exuberance" is an apt description of the scene in the late 90's and early 2000's. But it seems like this latest tech business cycle has taken on a different flavor.

Coming off the tails of the financial crisis and great recession rather than an era of relative peace and prosperity in the 90's, this latest round of tech investing has been surrounded by a lot more vitriol and fear than the accounts I've heard of the dot-com bubble, where almost everyone was benefitting from a booming stock market and strong economy, optimistic about the future of the internet, the country, and the world.

A prime example that really struck me the other day was PGs article on inequality. [0] In it he expressed that he felt like he was a wild animal being _hunted_ \- one of the most successful, famous, and well-respected VCs in the world feels threatened by macroeconomic rumblings? And he's expressing it publicly? Did this ever happen during the dot-com bubble? [1]

Perhaps this fear is a good thing, a tempering agent. It seems large, late- round pension funds and institutional investors (who probably manage a great deal of this country's retirement/savings accounts) are being cautious and performing due diligence on these tech investments, rather than simply going along with the crazy valuations and riding the bubble for higher management fees and bonuses.

[0] [http://www.paulgraham.com/ineq.html](http://www.paulgraham.com/ineq.html)

[1] "I feel rather like a wild animal overhearing a conversation between hunters. But the thing that strikes me most about the conversations I overhear is how confused they are. They don't even seem clear whether they want to kill me or not."

<comment><USER4> I think a major difference is that in the late-90s bubble, everyone felt like they were winning. Stock market valuations were rising, many ordinary Americans held stock in dot-coms, high-paying jobs were being created that were being filled by ordinary middle-class people. Ordinary people could look at their brokerage account and think "Wow, I'm rich now!"

The only problem was that it was all fictional. Having your portfolio worth a million dollars now is useless when it's only worth $2000 when you go to sell. Getting six-figure salaries at a dot-com when you just have six months HTML experience is kinda ridiculous (okay, we have a variant of this today as well).

In many ways, this boom is a lot more honest, and a lot more real. It has winners and losers, many (but not all) of the winners put in years of hard work to get there, and people generally have a sense of where they stand. The problem is that there are far more losers than winners. That doesn't make for a positive mood, or a stable society.

<comment><USER5> In the SV, it's not uncommon for iOS and Rails developers to be paid six figures after only a little training.

This is exactly what you said was happening in the dotcom era: middle class people put in high paying positions.

The point about the stock market stands though. It is the strongest difference the current era has with the 90s.

<comment><USER6> Without disparaging iOS or Rails developers, I assume that's what nostrademons meant when he said, "Okay, we have a variant of this today as well."

<comment><USER7> I would have thought he was referring to something more steps down on the totem pole. To do iOS or Rails development you actually have to know a programming language somewhat well, especially in the case of Objective C. Or so I would have thought; perhaps I'm in unaware of IDEs and tool chains that can cover for a lack of fundamental software engineering expertise.

The variant I'd have in mind is web designers masquerading as backend system developers. That's something Node has made possible. CSS and HTML experts usually know just enough JavaScript to be dangerous--JS is table stakes these days for UI work. Node creates the illusion that they can write backend middleware, APIs and services, too. Some of them surely can, but for every one of those, I've seen ten JS "rock stars" copy-and-pasting Angular and Express code from Stack Overflow, cargo cult style, at six figures.

<comment><USER4> It was as Hydraulix said, specifically graduates of coding bootcamps. Many (not all) of those programs are very reminiscent of the "web development is hot - you can make lots of money with few qualifications!" meme that was popular in the dot-com era.

I don't actually think that web developers of today moving down the stack is all that problematic. For one, a number of them can - modern web development is a lot more intricate than it was in 1997, and if you get beyond the Bootstrap stage, it usually requires that you actually understand fundamentals of how your browser works instead of just cargo-culting some code. People who can do that usually do well in any programming language. Beyond that, Node won't really let them - it will break pretty quickly if you don't understand callbacks, async patterns, modularity, etc.

The contemporary JS world has a lot of problems, but IMHO incompetent devs isn't actually one of them. (Going out on a limb, I'd argue that all its problems actually stem from devs that are _too_ competent in one specific area not understanding what's important and what's not in the larger context of the software industry.)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> 2016 is the year when Silicon Valley feels the wrath of Buffett's "when the tide goes out" old saying, and probably most haven't been wearing swimming trunks in a long time.

The stupidity, of course, is the media and the rest of the Valley using VCs' own valuation as some sort of data, instead of the self-interested BS that it is. VCs are the greater-fool theory in action, and the greatest fool are the retail investors. Look at Groupon that somehow IPOed, and the only ones that lost money were the mutual funds and retail suckers that bought in.

VCs are considered great if they are right 1 out of 10 times. The only reason why they don't go belly up is because they stack the deck in their favor through liquidation preferences, onerous funding terms, etc. So why on earth would we believe them when they say companies like Lyft are worth 5B or Snapchat is worth 20B?

When the Revaluation of 2016 hits, it will be harsh and immediate. VCs act like a flock of birds and it's binary. Either they are in feeding frenzy mode, or they are cowards on the sidelines. When a couple of VCs start getting cold feet, they all get cold feet, and when that happens, unicorns start dying. Companies like Dropbox that have a real business model but whose maximum prospect of profits have been critically injured by Box's IPO, will probably get destroyed by either horrible funding terms or a Square-like IPO. Lyft will probably be dead by the end of 2016, and people will be wondering how they burned through 1.5B in funding.

My bet is that 2/3 of the unicorns are acquihired for terrible terms, dead or on life-support by the end of 2016. If only I could short them, I would, but since I'm living in the Valley, I'm probably going to be negatively affected by this unfortunately.

<comment><USER9> > If only I could short them, I would, but since I'm living in the Valley, I'm > probably going to be negatively affected by this unfortunately.

Hey it's not all bad. The last time this happened, traffic on 101 got really great for a few years and you could get a reservation at any restaurant you wanted to (assuming you could afford it).

<comment><USER10> Could be good for real estate prices too... If you're on the buy side.

<comment><USER11> Didn't happen last time, as capital fled the imploding tech sector and flooded into real estate, causing the prices to balloon rapidly compared to prior years.

<comment><USER10> That's very interesting, do you know if there are any articles about that?

<comment><USER11> There is a small blurb here: [https://en.wikipedia.org/wiki/Causes_of_the_United_States_ho...](https://en.wikipedia.org/wiki/Causes_of_the_United_States_housing_bubble#Dot- com_bubble_collapse). It leads to an article by Robert Shiller called "The Bubble's New Home" (Google it to get around the paywall) as well as his classic book "Irrational Exuberance".

<comment><USER10> Thank you!

</comment></comment></comment></comment></comment></comment></comment><comment><USER12> It strikes me that if the WSJ ran an article with the headline, "Hluska to earn a billion dollars in 2016" both my odds of earning a billion dollars and my realized earnings in 2016 would go up astronomically, regardless of any market or business conditions.

In other words, it is hard to quantify the extent to which coverage about how the IPO market is going to stink, and how valuations are going to hit the toilet actually cause IPO markets to suck and valuations to hit the toilet.

<comment><USER13> I don't know why your comment is being down-voted. George Soros based his entire career on this dynamic and even coined the term 'reflexivity' to describe it.

Here's where and why I think the disconnect happens. Most of our possessions in day to day life tend to have a relatively stable value. Your iPhone 6 is worth $600 dollars, oranges are $2/lbs, a t-shirt is $20. Markets for non- capital goods (i.e. goods that are consumed with 1 yr or so) are very efficient most of the time. However, the claim that 'markets are efficient' (and the kinda-corollary that there's some stable intrinsic price) gets applied to all markets all the time. But markets for capital goods are not efficient all the time (by capital goods I mean something where the lifetime is greater than 1 year ... e.g. houses, airplanes, financial investments like stocks & bonds). Because most things in our everyday life have some 'true' value its seems wrong that there are assets that don't have an 'intrinsic' value or whose value is determined by perception.

However value is determined by perception. A great example of this is GE. A little history ... up until the early 90's GE used to fund itself almost entirely with short term debt. GE was able to do this because everyone considered GE a AAA credit risk. This 'AAA' expectation from the market actually meant huge additional profits for GE because GE could continually borrow short term debt at short term rates (say 1%) and turn around and lend their customers money at longer term rates (say 5%) picking up spread. In the early 1990's Bill Gross came out and basically said 'this is crazy ... there's no way a company that is financed almost entirely with short term debt is a AAA credit'. Subsequently, GE was forced to term out their debt and this coincided with GE no longer outperforming the market (I haven't followed that closely but I think that GE has slowly been winding down GE Finance). The point here is that expectations (specifically that GE was a AAA credit) had a huge impact on the 'intrinsic' value of the company.

<comment><USER14> GE spun out GE Capital entirely and is divesting from it. Even Synchrony is separate from GE as well now. It's also selling off its appliances division to anyone that is willing to handle it long-term (seems that the sale to Electrolux fell through). This is all consistent with the strategy to return GE to an "industrial" company.

</comment></comment></comment><comment><USER15> There's a great podcast with Sam Altman discussing these "valuations" a couple of weeks back[0]. He describes how the valuations everyone talks about in the press often come from preferred stock financing rounds (ie: classes of stock which come with a caveat limiting both their upside and downside). As a result, the numbers betray what many people think to be the company's "valuation" come IPO time (Square, which possessed a 'ratchet' was an example of this apparently). As a result he said it's possible to largely disregard many of the stated "valuations" in the press for these $1bn+ companies as their financing rounds have been closer to debt than equity. One key upshot of this also was that people holding common stock (employees who have exercised options, e.g.) may be caught with their pants down as they made choices based on a stated valuation which differed from that of their shares.

[0]: The Jay & Farhad Show: The Tech Industry: Tech Bubble or Tech Bust? [https://overcast.fm/+DcD5EhUGs](https://overcast.fm/+DcD5EhUGs)

</comment><comment><USER16> There are legit tech companies and there are shitty VC-backed hype machines. The former are unconquerable forces of nature and latter should be culled before public investors are harmed.

<comment><USER17> Were the VC hype machines this big around the 2000 bubble? I was only 10 years old back then, don't know much about the industry before the crash.

<comment><USER4> Relative to the intrinsic value of the organization, they were _much bigger_.

The majority of companies funded back then were e-commerce plays focused around selling the same items you buy offline for less money and making up the difference with VC money. As a consumer, it was pretty awesome. I remember signing up for AllAdvantage.com in high school (that was a startup that would pay you to view ads, and pay you for referring friends to view ads), installing the toolbar, pocketing about $50, and then uninstalling the toolbar once they crashed & burned and were no longer paying out money. My sister (newly arrived at college) fell in love with Kozmo.com, which would deliver groceries to your door at about 20% under supermarket prices.

The whole thing was a pyramid scheme designed to prop up valuations by incentivizing early adopters with discount prices, subsidized by VC dollars, who would unload the shares on the gullible public markets for higher valuations. The early adopters got some nifty conveniences at bargain basement prices; a few lucky founders & VCs got massively wealthy; most of the unlucky founders & employees wasted about 5 years of their life; and the gullible public lost their life savings.

There's some of that now, but it's much more muted. My wife and I ate very well this summer off delivery startups that were offering FaceBook deals with VC money for prices under supermarkets. However, most of the giant companies this time around actually have solid business models that operate more efficiently than existing incumbents. AirBnB takes advantage of surplus housing capacity. Uber breaks local laws that enforce inefficiency. WhatsApp ran a really lean organization so they could offer text-messaging services at a fraction of the cost of a telecom giant. Instacart charges more than the supermarket, and people pay it. Slack has made office messaging fun. SnapChat at least realizes that its lack of revenue is a major problem, and they're heads-down trying to fix it.

The public markets are not as gullible now as they were then, and so the "unload on the unsuspecting public" strategy doesn't work as well. Companies that are based on nothing but hype & investors dollars often flame out around the C round now; we saw some of that with Secret and Homejoy.

<comment><USER18> Not for nothing: Uber is subsidizing most of their markets like crazy in a Kozmo-esque growth gamble (particularly in China), and there was this story about Instacart making the rounds the other day:

[http://www.fastcompany.com/3055033/instacart-raises-fees- and...](http://www.fastcompany.com/3055033/instacart-raises-fees-and-lays-off- recruiters-as-its-frenzied-growth-slows)

It isn't 1999 again, but I wouldn't go so far to assume that "most" of the giant companies are solid businesses just yet. As Buffett said, you don't know who is wearing swim trunks until the tide goes out. Even if companies aren't obviously subsidizing their customers' purchases (as in the first boom), there's a lot of bubble money sloshing around, making everyone's revenue numbers look better.

<comment><USER19> Uber offers good signup discounts and low rates when they enter a market, but they're also making huge profits in mature markets.

They have a business model. It just takes capital to spin up new markets. (They run a market at a loss initially, until its mature enough to take profit from.)

<comment><USER18> Unless you have access to some current insider financial data that you're leaking here, you're _assuming_ that they're making "huge profits" in mature markets, and you're further assuming that those mature markets can cover everything else.

What we _know_ from observable evidence is that they're raising tons of money, and funneling it into growth. We also know that there are lots of subsidies, on both sides of the market -- even in San Francisco, the most mature of Uber's markets, I regularly see and hear of driver referral bonuses.

It could well be that without the easy money, the Uber story becomes a lot less compelling. Time will tell.

<comment><USER4> I think he's referring to financials that were leaked a year and a half ago, covering SF, DC, and other market-by-market breakdowns:

[http://www.businessinsider.com/uber-revenue-rides-drivers- an...](http://www.businessinsider.com/uber-revenue-rides-drivers-and- fares-2014-11)

<comment><USER18> Yeah, I figured, but that's pretty old information by now. In particular, it predates the company's massive spending in China, and increased competition in the mature markets that have been effectively deregulated (e.g. NYC).

One of the ironic things about Uber is that after they overcome regulatory hurdles in new markets, they make business dramatically easier for their competitors. Taxi service without regulatory capture is a commodity product.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> The author mentions the worst companies that even I, web 2.0 bull, would never invest in [http://greyenlightenment.com/billion-dollar-startup-club- pic...](http://greyenlightenment.com/billion-dollar-startup-club-picking- winners-from-the-losers/)

He mentions box.net but ignores dropbox. No mention of Air BNB, Uber, Snapchat, Slack. Although these aren't public, there is an investor bias against hardware, but such a bias is warranted given the storied history of once high-flying hardware companies eventually soaking investors due to profit margin compression, competition, or becoming fads or obsoleted, examples being Sony, Atari, Garmin, Nintendo, Sega, Fitbit, Nokia, Motorola, Gopro, Jawbone, Skull Candy, Research in Motion, and many more.

Yeah, there is valuation pressure, but for companies that aren't very good. This is evidence investors are becoming smarter and more selective, whereas in the 90's a company like Fitbit would have had a PE ratio of 500 instead of 50, which is what it is right now.

<comment><USER21> Gopro is obsoleted? Just curious why you think so.

<comment><USER22> I have an opinion on this and will take a shot at it, would be interested to see further discussion. In a recent conference call GoPro's CEO commented that most video shot with GoPro cameras are home videos, not action videos. GoPro may have become less relevant because smartphones can now shoot 4k video at 30+ fps. Why spend $400+ for a GoPro when you have a device that is perfectly good for what you will be using it for already? Yes they're doing VR now but as we've seen from the limited uptake of their 3d kits, that won't be big enough to justify GoPro's valuation.

<comment><USER23> Beside action videos, every other device is better suited for family videos/photos. A current gen smartphone can shot 4k videos and 20+ megapixel photos just fine (and some of them are dust and water proof) - and all with a very easy user interface.

</comment></comment></comment></comment><comment><USER24> My guess is that Pinterest will have the most to prove in 2016 among the Unicorns. By far the biggest social network in terms of valuation with the least proven source of revenue.

<comment><USER25> Pinterest can at least insert itself between you and products you might buy to earn referral dollars. My understanding is that for certain markets it has a lot of eyeballs like wedding planning.

Personally, I think Snapchat has the most to prove.

<comment><USER26> I think the novelty for Pinterest will wear off. There is only so much gratification in viewing beautiful pictures put together. I don't see any other value Pinterest is providing.

Snapchat, on the other hand, at least provides a communication channel for a very active demographics. Yes, it has to compete with a lot of big guys in the space, but the utility is there in the product.

<comment><USER9> You must not hang out with middle aged women much. My wife is on there all the time, planning my daughter's birthday party or getting ideas for her next craft project. My sister-in-law is the same.

I think someone said it elsewhere in the thread, they're replacing all those magazines suburban housewives used to read, and they can advertise more efficiently than those magazines because they have better data about you and can get between you and the transaction.

</comment></comment></comment></comment><comment><USER27> Box. Uh oh. Maybe they shouldn't be building that second big building in downtown Redwood City.

Could be worse. [1] That impressive building complex on the San Francisco bay was built to be the new headquarters of Excite@Home, which went bust in the first dot-com crash. Those buildings were empty for most of a decade.

[1] [https://goo.gl/maps/DbJevhk55wA2](https://goo.gl/maps/DbJevhk55wA2)

<comment><USER28> Excite. Oh darn, I guess I had finally forgotten they existed until you said that. Curious, did you ever use metasearch solutions like Turbosearch that showed top results from all those crappy engines?

<comment><USER27> No, I'm just aware of them because those buildings are near me. There's a public jogging trail around that big complex.

<comment><USER28> Your answer is still unreal to me given I expected them to be ancient history by now.

<comment><USER27> Excite@Home is long gone. The buildings remain.

<comment><USER28> Oh OK. That makes a lot more sense to me. :)

</comment></comment></comment></comment></comment></comment><comment><USER29> Stock prices are often volatile the first few months after an IPO . Remember Mark Zuckerberg's 'disappointment' in FB's stock price? [http://www.forbes.com/sites/tomiogeron/2012/09/11/live- faceb...](http://www.forbes.com/sites/tomiogeron/2012/09/11/live-facebooks- mark-zuckerberg-at-techcrunch-disrupt/)

<comment><USER26> Actually the price tracked FB expected revenue very well. For some time after IPO, there was serious doubt on FB mobile ad revenue (as the desktop ad was not growing enough). They somehow grew the mobile add very well and that's when the stock price made the U-turn. Whether the mobile ad is a proven business or not is still the 100B dollar question.

<comment><USER30> App installs which is like yahoo banner ads of dotcom 1.0. Re targeting is effective though.

</comment></comment></comment><comment><USER20> The one for Square is off just 20% from the private round vs. Dec. 31st close. It hasn't really moved that much. Way too soon to assume it's under pressure. Most of the valuations gains were made in the years leading up to the IPO, as companies are going public later and later. That could explain why some of the post-IPO gains seem stunted.</comment>


For your eyes only: The Times goes inside GCHQ - <AUTHOR> http://www.thetimes.co.uk/tto/news/uk/defence/article4598139.ece <comment><AUTHOR> The London Times got a guided tour of a the once-secret UK intelligence headquarters and left behind their journalistic integrity. They are being used to disseminate propaganda ahead of the introduction of draconian surveillance legislation. "Snowden did enormous damage", "tiny bit of data", "only metadata", etc.

Letting in a journalist is an astute move on behalf of GCHQ and the government, but, in this instance, they have accidentally chosen a stenographer instead. The absence of a single challenging question regarding the dangers of mass-surveillance is embarrassing.

</comment><comment><USER2> Time and time again we find "journalists" (The Times has been in the pocket of the intel world for decades), academics and politicians who are cleverly seduced by getting a glimpse of the inside of the intelligence, special forces, police world etc. Too often the people charged with overseeing them allow themselves to feel intimidated by people in uniform or in intelligence. So called "Defence," "Crime" journalists etc get lazy and allow themselves to be feed like a child from the press offices of various organisations. "Sources say," "insiders say" basically becomes a form of grovelling verbatim printing of press releases and spin.

I really wish they would open their eyes and ask difficult questions (it's generally better for their careers in the long run). Or better yet, if they are afraid ask the public and experts for specific questions to put to them. When I worked in the UK Parliament, I always found it interesting that the best questions, comments and observations about these worlds came from the people who were formerly in them - e.g MPs/Lords who used to be intel or military. They were generally much more inclined to not swallow the crap pushed out by the agencies and instead ask the difficult questions - as it was a lot harder for the wool to be pulled over their eyes. Esp on issues like 90 day detention, mandatory ID cards, government surveillance powers.</comment>


Archiving JPEGs for long-term storage - <AUTHOR> https://github.com/danielgtaylor/jpeg-archive <comment><USER2> The 'jpeg-archive' tool, if anyone was wondering, appears from the source code to not produce an archive file of any kind but just a directory of lossily compressed files, does no deduplication on the file or image level, stores no hash sums, creates no forward error correction information, does not shard or store across multiple storage services under the LOCKSS principle, and otherwise doesn't do anything relevant for long-term archival storage. The title of the submission and tool are more aspirational than descriptive.

<comment><USER3> Agreed with most of these points, but FEC / sharding / storing should be handled at a different layer.

<comment><USER2> What layer of the filesystem it should be handled at can be debated (a tar with separate PAR2s? a single archive split into multiple ZFEC shares?) but that sort of thing is precisely what a long-term archiving tool should be handling for you. I don't want to mess with par2create by hand anymore than I want to try Imagemagick on multiple settings to get an acceptable tradeoff.

</comment></comment></comment><comment><USER4> Heh. As a photographer I'm not sure what utility this would have for someone like me. The last thing I want to do is smash my glorious high-bit-depth RAW files with LR adjustments into 8 bit low quality JPEGs. And if I did, ol' Photoshop can do that with image macros, and Lightroom can do it with an export. Storage costs are so cheap now and continue to fall, even a guy like me with 5TB+ of images isn't panicking about how to archive this stuff. A 9TB RAID5 is cheap as dirt compared to the rest of the costs of photography, a few rotating externals to back up is also cheap, and cloud backup is mostly only limited by network speeds. Glacier will archive stuff for $4 per month per terabyte (and falling), there is zero need in most circumstances to archive at such a terribly lossy quality level, at least in my industry. Maybe there are other applications out there, I dunno.

</comment><comment><USER5> Interesting stuff, although not a fan of the lossy recompressing, there are good open source lossless jpeg compressors like packjpg, lepton, giving ~22% compression, and a yet to be released one from the guy who made webp/brotli.

</comment><comment><USER6> So, this is a low-res facsimile of Flickr but without the original's battle- tested infrastructure or a human-friendly UI.

</comment><comment><USER7> Very interesting, specially the "jpeg-hash" tool, useful for finding quasi- duplicates (different files, but quasi-identical at visual level).

</comment><comment><USER8> I'd love something like this but for video formats that come off consumer cameras and cell phones. Especially old ones that used Motion JPEG, you ought to be able to compress them quite a lot without losing much perceptual quality, but I've no idea what the best way to do that is.

</comment><comment><USER9> How to actually archive images:

1\. Convert to png

2\. Save image on multiple storage mediums

<comment><USER10> I like that method better than:

1\. Re-encode lossily.

2\. ???

3\. Profit.

</comment></comment><comment><USER11> Slightly off-topic but does anybody know any services that you can pre-pay to store images long term? Say 10+ years.

Flickr only allow you to buy an account for the next 2 years.

<comment><USER12> Glacier is $0.004/GB

[https://aws.amazon.com/glacier/](https://aws.amazon.com/glacier/)

<comment><USER13> Just looked into the pricing and the lions share comes when you (especially quickly) need the data again.

Why not buy instead one or even multiple cheap but large USB hard disc and put it into your shelve or to your friends? It gives you immediate access for free. I don't get it why one rents a service instead of staying independent.

<comment><USER14> Data storage devices have a finite lifetime, so data storage is necessarily a recurring expense.

Copies that can't be read aren't copies any more, which means regular access is a requirement, which means another recurring expense.

Different requirements can reasonably result in different solutions, but a USB hard drive on its own is simply not comparable to storage service. A redundant set of USB hard drives with a specified replacement schedule and testing procedure would be comparable -- but if you amortize all that out, we're talking about $X + Y hours per month for Z GB of storage, which compares directly to $X/GB-month if time has a dollar value.

From this perspective, I argue that storage services like S3, Glacier, B2, and Digital Ocean Spaces are priced fairly.

</comment></comment></comment></comment><comment><USER15> Why choose a lossy compression scheme?

</comment><comment><USER16> You could make the comparison of compressions a bit more interesting by adding 100% crop to say the lips or any area with intricate detail. Also, if you do a recompression wouldn't jpeg2000 be an option?

</comment><comment><USER17> It's a good encoder. It will give you more consistent quality and better compression than your bash script launching imagemagick.</comment>


The Recompiler, a New Feminist Hacker Magazine - <AUTHOR> http://recompilermag.com/

<comment><USER2> Title should read "A possibly upcoming Feminist Hacker Magazine" because there isn't any content there, besides "coming soon".

</comment><comment><USER3> Please, please, please do not publish a print version. If you're really targeting hackers, they're not going to use it. Print versions of magazines are wastes of time, money, resources, and basically anything else that is put into them.

Also: please publish as HTML, not as PDF (or some other awful, non-responsive format). Basically, I hope this is a magazine that's not just for hackers, but by hackers as well.</comment>


Keeping Provisioning and Deployment Simple - <AUTHOR> https://www.protoapi.net/blog/1/ <comment><USER2> I mean, yeah, but you're just starting where those projects started -- rolling your own with a different idea of what "simple" means. If you actually build a business around something like this, it'll become more like the systems you mention or you'll end up switching to one of them anyway...</comment>


Show HN: BitMidi – Wayback machine for old-school MIDI files - <AUTHOR> https://bitmidi.com/ <comment><AUTHOR> Hey HN, site author here! I was asked to repost this by the HN mods (read about the second-chance queue: [https://news.ycombinator.com/item?id=11662380](https://news.ycombinator.com/item?id=11662380)).

\---

So, the context for this site is that I was reminiscing about the days of Geocities and Angelfire, when the web was quirky and fun. In those days, sites often used the <bgsound> HTML tag to include an auto-playing song in the background of a page. Usually the song was in the MIDI file format.

It's hard to describe MIDI files if you've never heard them before. The MIDI aesthetic is synth-laced, nostalgia-inducing, old-school, and endearing. It's mixed up with the first DOS video games I ever played and the first websites that I visited as a small child in '95 and '96\. A textual description can't adequetly capture the feeling of listening to a MIDI.

I was surprised and sad to learn that all major web browsers have removed MIDI file support. Perhaps this happened at the same time that the <bgsound> HTML tag was removed? This explains why I haven't heard a MIDI in many years!

So, I really wanted to play a MIDI file. When I searching the web for a MIDI websites, I discovered that existing websites were quite disappointing. It was difficult to find a site with a decent user experience. Almost all the top sites were unmaintained or broken in various ways. Most sites could not play back the files directly in the site, requiring them to be downloaded and played in an external program instead.

Quicktime also dropped support for MIDI when Quicktime X was released in 2009 which inconvenienced many musicians and probably stopped many users from playing back (or discovering!) this wonderful file format. Technically, Apple still offers Quicktime 7 for download, which can play MIDI. But it's a 32-bit app so it will likely stop working once the macOS version after 10.14 Mojave is released. Also, embarrassingly, the Quicktime 7 download link uses insecure HTTP!

Even the venerable VLC failed to play back the MIDI files I threw at it. (I later learned that VLC can actually play MIDIs and I just got unlucky with the few I tried, hah!)

There were some websites that could convert MIDI to low-quality MP3, and some sites offered inline MIDI playback using Adobe Flash, but they were flaky and impossible to get working in Chrome. Other websites implemented MIDI players in JavaScript, but they were usually missing instruments or extremely ineffecient multi-megabyte cross-compiled Emscripten libraries.

I eventually found a .ZIP archive with around 100,000 MIDI files. I wanted a way to search through them and share the best ones with friends. So I decided to build a site to address the shortcomings of existing MIDI sites.

And that's BitMidi. A free way to browse and play MIDI files!

Feedback welcome!

<comment><AUTHOR> A bit more info about how BitMidi is built...

First step, I needed to build a MIDI player in JavaScript. At first, I was determinted to write one from scratch in JavaScript and use the Web Audio API to synthesize all the instruments in code. I thought this would yield the the smallest possible JavaScript file size.

However, I didn't really have the audio engineering skills to pull this off. So ended up settling for an approach that uses SoundFonts, which are basically instrument voices or files that contain all the possible notes an instrument can play.

BitMidi uses the instrument voices from the General MIDI sound set released by FreePats.

Then I compiled the best MIDI player written in C (libtimidity) to WebAssembly using Emscripten. I put in lots of effort to optimize the built size and include the minimal amount of code. The result of my efforts are available in the npm package timidity ([https://github.com/feross/timidity](https://github.com/feross/timidity)). It's quite lightweight – just 34 KB of JavaScript and 23 KB of lazy-loaded WebAssembly, smaller than anything I've seen on any other site.

Then I put a frontend on it, so it's easy to browse all the files. BitMidi uses all the best techniques that I know about to make it super fast and snappy. The site gets perfect 100s on all categories on Chrome's Lighthouse Performance benchmark, which is extremely non-trivial in my experience.

I plan to ingest a lot more MIDI files in the future, from sources like the Geocities MIDI archive on the Internet Archive and elsewhere.

<comment><USER2> >the best MIDI player written in C (libtimidity)

Ouch. Has timidity fixed the issue where playing 2 of the same note in sequence cuts off the release tail of the first note when the second starts? Fluidsynth is written in C and doesn't have that issue and sounds better (I assume this behavior matches good MIDI hardware, but not sure about the crappy Windows GS Wavetable Synth). fluidsynth-lite is a Fluidsynth fork with dependencies removed.

<comment><AUTHOR> Okay, I stand corrected. I did a bunch of research, but I clearly missed some superior MIDI players. I'll take a look at FluidSynth-lite and see if there's some way to use it.

One issue I can already see is they use a SoundFont file (.sf2) instead of instrument patch files, which means the whole 100MB+ file probably needs to be loaded before playback. My current approach uses GUS patch files which have one file per instrument, so I can load just what's needed for a particular song and start playing much sooner.

Edit: It looks the GeneralUser SoundFont is only 31MB and it sounds almost as good as the 100MB+ one. So, while this will still be slower than my current approach of loading just the needed instruments, perhaps if I start loading it in the background with ServiceWorker and cache it forever, this could work. Thoughts welcome.

<comment><USER3> Perhaps give users the choice of which MIDI playback "engine" to use? It seems a shame to throw away all of your hard work (on the player) so far.

</comment></comment></comment></comment></comment><comment><USER4> Midi files were such a joy in the '90s!

I remember when I would get a new computer or upgrade sound cards, one of the first things I'd do was play some midi's to see how they sounded. At some point, I got a Yamaha keyboard for a gift and it happened to have a midi interface. With that, I could play my midi files through the keyboard, which sounded so much better than what the sound card could do. The keyboard also featured LED's above each key and you could isolate a midi channel to see what notes were being played. It was such a neat way to learn songs.

I actually still use midi files today if I want to do things like analyzing the chords or harmonies of a song, or if I'm learning it on guitar and a midi file is available, I can use it and easily do things like slow the track down, learn the parts, and then gradually speed it up.

Some of the midi's produced for popular songs are also very well done (although some are pretty bad!). If you're into music production, you can easily import them into your DAW and assign the channels to high-quality plug- ins and have something that actually sounds close to the real recording.

Although it's understandable why midi's days as a consumer music format are over (it was never meant to be that, anyway), it's somewhat a shame since there aren't a ton of midi files out there for songs after 2000 or so.

</comment><comment><USER5> The tricky part with the 100k downloads is that you do not have all the meta data for each file. You just have the filename, so some are just called "index.mid". Which I guess is nice for a random surprise when you play it.

My shameless plug is my old MIDI site called MIDI Delight. I had user registration, ratings, comments, top 10 lists, etc. I always wanted to get it working again like you did. It would be cool to see more user features added on your site.

I'm glad there is a new MIDI site carry the torch.

<comment><AUTHOR> I'm interested in finding ways to better organize the MIDI files. I'm curious how you figured out which category to put each MIDI file in on your website. Was that done manually by you?

<comment><USER5> Yup I had a whole UI to add the MIDI's and apply a genre. Plus I would get the time and size etc from the file when I uploaded it. Much of it was manual. Also the reason why I never got to 100k :(

</comment></comment></comment><comment><USER6> Thank you, Feross!

I can confirm that this sounded exactly the way it did when I last heard it in the pre-Napster days: [https://bitmidi.com/sublime-wrong-way- mid](https://bitmidi.com/sublime-wrong-way-mid)

Any chance of getting customizable soundfonts? Me and Ben already compiled a few here: [http://gleitz.github.io/midi-js- soundfonts/](http://gleitz.github.io/midi-js-soundfonts/)

<comment><AUTHOR> That's a cool idea!

I'm currently using the FreePats soundfont ([https://freepats.zenvoid.org/](https://freepats.zenvoid.org/)). I'm curious which soundfonts you'd like to see? What are other, better-sounding choices?

<comment><USER6> The "Fluid" pack which ships with MuseScore and "Musyng Kite" pack which is just found online are both Freely licensed and sound "better" in karaoke- parlor kind of way (though personally I think I prefer the MIDI sound you have now, which is a bit closer to how I remember it sounding before my dad invested in a SoundBlaster card.)

Having options for the overall playback sound is one of the cool features of MIDI though.

</comment></comment></comment><comment><USER6> I have uncovered a bug in Firefox with this!

Playing a MIDI file, then playing another MIDI file, then playing _another_ MIDI file, causes the "Mute Tab" feature to break. The icon disappears and right-click-Mute-Tab no longer works easier. Can somebody else confirm? Firefox 61, latest OSX.

<comment><AUTHOR> Confirmed! This happens for me too. Want to file the bug?

<comment><USER6> Done, thank you for confirming. [https://bugzilla.mozilla.org/show_bug.cgi?id=1489375](https://bugzilla.mozilla.org/show_bug.cgi?id=1489375)

<comment><AUTHOR> > There is now no way to stop the sweet, sweet sound of 90s MIDI.

I kind of hope this bug never gets fixed now.

<comment><USER3> You can't stop rock 'n roll!

</comment></comment></comment></comment></comment><comment><USER7> I wish this would be synthesized the way the Roland MT-32 would play it. IMHO that's how MIDI should sound like.

Check out the 8-bit guy showing the capabilities of MT-32 compared with PC speaker, Adlib / SB: [https://youtu.be/BMmFcs-_4x4?t=249](https://youtu.be/BMmFcs-_4x4?t=249)

Lean and back and enjoy. It's mind blowing.

</comment><comment><USER8> I used to play MIDI files on my windows 3.1 machine, so this is great nostalgia. The quality was dependent on the instruments available on the soundcard. It wasn't until years later that I realized the "real" version of a song I had listened to sounded very different to what I knew!

<comment><USER3> I remember discovering mod files, just before MP3 became a thing. Absolutely blew me away what some people achieved with that format. I remember having a version of Snap's "Rhythm Is A Dancer" which was virtually indistinguishable from the CD and yet only a few hundred KB.

</comment></comment><comment><USER9> Really cool! Do you offer collection archives for download, for distributed archival purposes? It seems like this archive ([https://www.reddit.com/r/WeAreTheMusicMakers/comments/3ajwe4...](https://www.reddit.com/r/WeAreTheMusicMakers/comments/3ajwe4/the_largest_midi_collection_on_the_internet/)) has more.

<comment><AUTHOR> That zip file is actually the one I mentioned in my comment here ([https://news.ycombinator.com/item?id=17930684](https://news.ycombinator.com/item?id=17930684)). It was the initial seed for the site. They actually had quite a bit of duplication that I removed by using content hashing.

I'll consider adding a big "download archive" button. Just curious: do you have any immediate plans for the archives, or just want to keep a copy for backup purposes?

<comment><USER9> Archival is a weird animal that doesn't behave like other things in tech. It's like scrapbooking. It doesn't have to be perfectly organized or available online. The archivist just has to be extremely consistent throughout his or her life, in order to make the files last for 50+ years, to be passed down to _another_ extremely consistent person, and so on. Imagine WWI photos. In 1920, why would _anyone_ keep those around? They had no message to portray, it was just a horrible recent event that you'd be called weird for trying to keep. Yet the few people in the chain of ownership were important for piecing together the photographic history we know today.

MIDI files are somewhat similar. Only a small population care, an even smaller population care a lot, but archivalists shouldn't be the one to determine to keep them around for 200 years. They just should, and forget it.

So yeah, that's pretty much what I do.

</comment></comment></comment><comment><USER10> Is anyone familiar with something like this but for MOD/tracker style music? I've downloaded quite a few and play them locally but it's hard work and fiddly.. it'd be awesome to just play them on the Web :-)

(Actually, I guess, sadly, just rendering tracker files to MP3 en masse and playing those would be easier.. if less cool technically.)

<comment><USER11> I think you could set your browser to immediately open the downloaded .mod/.it/etc in VLC or some other player?

I found my old collection of downloaded + self created MODs recently, some fantastic stuff in there while mine are amusing in their mediocrity :-)

</comment></comment><comment><USER12> MIDI is making a comeback. I still think the 10,000 midi files torrent is bang for buck. Something for the zombie apocalypse survival kit

<comment><USER13> The entirety of 20th century music on a single 3.5" floppy disk. It doesn't get any better than that.

</comment></comment><comment><USER14> Awesome! The downside is that I couldn't find the MIDIs that come with Windows 95 like Claire De Lune.

The upside is that I found these gems while searching for them:

[https://laughingsquid.com/windows-95-startup-sound-on- accord...](https://laughingsquid.com/windows-95-startup-sound-on-accordion/)

[https://musicthing.blogspot.com/2005/05/tiny-music-makers- pt...](https://musicthing.blogspot.com/2005/05/tiny-music-makers- pt-2-microsoft-sound.html)

<comment><USER3> Ha! You just reminded me of canyon.mid and passport.mid from Windows 3.1. Good times.

</comment></comment><comment><USER15> No one mentioned [https://vgmusic.com/](https://vgmusic.com/) ? My favorite site for videogame midis.

</comment><comment><USER16> Currently site seems to have errors:

Error – this._lib is undefined

Error – HTTP request error. JSON.parse: unexpected character at line 1 column 1 of the JSON data

<comment><AUTHOR> Are you by chance using an older iOS or macOS release? Since this is a hobby project, I decided to make BitMidi have extremely aggressive browser requirements. You must use an evergreen browser (Chrome, Firefox, Opera, Brave, etc.) or the latest version of Edge or Safari.

Specifically, the feature you're probably missing is URLSearchParams with a spec-compliant toString() method, which I believe only the latest versions of Safari and Edge have, despite what Can I Use says. [https://caniuse.com/#feat=urlsearchparams](https://caniuse.com/#feat=urlsearchparams)

<comment><USER16> On this machine I'm using Firefox-ESR (Extended Support Release) on Debian Stable. That's conservative on top of conservative; quite the opposite of what you are targeting!

I have limited grounds to complain then (short of quoting Postel's law) . Hope you continue to have fun :-)

<comment><AUTHOR> Ahh, that explains it. I'm sorry for the inconvenience. All I can say in my defense is that it was more fun to build the site using new features and because it's a new site I'm not dropping support for any existing users, just missing out on some news ones like yourself ;)

I expect the next version of Firefox ESR will have the necessary features to make the site work for you. Cheers!

</comment></comment></comment></comment><comment><USER17> I'm waiting for a Gravis Ultrasound version, might be awesome! For a quick comparison of "old-school" MIDI files played on (equally old-school) sound cards:

[https://www.youtube.com/watch?v=figScJtkQk8](https://www.youtube.com/watch?v=figScJtkQk8)

<comment><USER18> If I recall correctly, timidity (the player used here) can support GUS patches. So it shouldn't be that hard…

</comment></comment><comment><USER19> My all-time favorite MIDI, circa 1996-98:

[http://gamma.nic.fi/~rikuh/main/music/Girl%20from%20Ipanema....](http://gamma.nic.fi/~rikuh/main/music/Girl%20from%20Ipanema.mid)

Can you add it? :-)

</comment><comment><USER20> Hi, feross. This is great and you're great. Before this, I was importing my Midi files into Garage Band (which doesn't work great.) Thanks!

</comment><comment><USER21> Albino Black Sheep had a ton of very good ones back in the mid 00's: [http://web.archive.org/web/20050301075002/http://www.albinob...](http://web.archive.org/web/20050301075002/http://www.albinoblacksheep.com:80/audio/)

They don't seem to work anymore but I would love to hear some of those again.

</comment><comment><USER22> Amazing work. I wanted to do something with that same archive you mentioned but soon realized how difficult it would actually be. One idea I thought of that might still be useful - would it make sense to alter midi file playback so it uses only a reduced set of instruments? ie if something is asking for steel drum, just play that part on piano. Would that limit soundfont filesize?

<comment><AUTHOR> Yes, this would definitely reduce the SoundFont size but it would make multi- instrument songs sound pretty awful!

<comment><USER22> Yeah but let's be real, part of midi's charm is its awfulness

</comment></comment></comment><comment><USER23> My favorite MIDI player back in the day was [http://www.vanbasco.com/](http://www.vanbasco.com/) It had controls for transposition and tempo. It had visualization of the individual tracks, ability to mute and solo individual tracks The site also contains a search engine for MIDI files, but most of the links are dead these days.

</comment><comment><USER24> When I try to play anything I get:

You just blew our server's mind

Error – play() called after destroy()

This is in Chrome 68.0.3440.106.

</comment><comment><USER25> I can download the midi files but I can't seem to get anything to play directly on the site. The play button is simply non-functional piece of text with an icon next to it. This is in Chrome 68 on OSX.

</comment><comment><USER26> i love this website so much

<comment><AUTHOR> Thanks Cindy

</comment></comment><comment><USER27> This is incredible. Could you add ratings and/or play counts?

<comment><AUTHOR> I already have play counts! Just go to any MIDI page and you'll see it right there at the top. Example: [https://bitmidi.com/theme-from-beauty-and-the- beast-walt-dis...](https://bitmidi.com/theme-from-beauty-and-the-beast-walt- disney-mid)

But ratings is a great idea and I plan to add it.

</comment></comment><comment><USER28> Reminded me of the first customizable ringtones, thanks :)

</comment><comment><USER29> toto-africa.mid

good times.

</comment><comment><USER30> No sound on iOS

<comment><AUTHOR> It works on iOS. You may need to just wait a bit longer, as the instrument files need to load to play back the song and there's currently no UI to indicate that loading is still happening.</comment></comment>


For 5 decades, this man has harvested ice from Ecuador's tallest mountain - <AUTHOR> http://www.outsideonline.com/outdoor-adventure/media/film/Outside-at-Tribeca-The-Last-Ice-Merchant-of-Chimborazo.html

<comment><USER2> This reminded me of the Quechuan porters (or Chaskis, in their language) that work on the Inca Trail to Machu Picchu. For four days, they carry 24 kg of camping gear and tourists' bags, ascending and descending as much as 1,200 meters in a day, including one steep 900-meter ascent to an elevation of 4,115 meters (if I'm remembering correctly). Oh, and they do it all in worn-out sandals.

Apparently there is a movie about one such Chaski, though I haven't seen it: <http://www.michacrafilm.com/>.

<comment><USER3> I've seen the same in Nepal.

</comment></comment><comment><USER4> _Many years later, as he faced the firing squad, Colonel Aureliano Buendía was to remember that distant afternoon when his father took him to discover ice._

</comment><comment><USER5> I know it has nothing to do with YCombinator but I love seeing articles like this.

<comment><USER6> It may not be computer-related but I enjoyed reading the article.

For one thing, I learned that Quito is at an elevation of 9,500 feet.

Being at the same latitude as the Galapagos Islands, I pictured Ecuador to be more like a Caribbean nation geography-wise.

<comment><USER3> Many big cities near the equator are at elevation. The weather is more tolerable so people are attracted to the cooler spots.</comment></comment></comment>


Working through Ramadan - <AUTHOR> https://slackhq.com/working-through-ramadan-9784b352282e <comment><USER2> I have fasted for the past 20 years during the month of Ramadan. It is the most revered month for all Muslim friends and family that I know. If you think Ramadan is restricted to just not eating, you need to learn more about why Muslims are advised to fast. Not eating during fast is the least of my concern as most days I am on an intermittent fast which lasts for 16 hours as well. Personally, I have rarely experienced any decline in performance, or asked for any exceptions or exemptions from work duties. It becomes challenging waking up in the middle of the night, 3 AM, to eat and drink and go back to sleep. This year's timings are roughly from 330 AM to 830 PM in New England area. These timings change depending on your location. I make up for this lost sleep at lunch break around noon by taking a 30 minute nap. I come back to work after a nap with increased freshness of mind.

It has been a great month to inculcate new habits. I also seem to have have more time than my colleagues and get done with more work than usual days. I wouldn't do it for the whole year as I love food too much.

My charity spending also spikes in this month and this is usual for most practicing Muslims. I calculate how much money I would have spent on food on my lunch in a normal month and give that money away to someone in need. This is besides the increased almsgiving that most observant Muslims would experience.

If you are sick, young, elderly, pregnant or have any health concerns you are exempt from fasting. You fast only if you are capable.

<comment><USER3> Sounds like it's pretty much the same as the 4 weeks of fasting into Easter, Lent, which is also based on the lunar calendar. I guess that's where ramadom comes from too, and I hear that one comes from the jewish religion, to remember the flight out of Egypt, away from their religion and slavery. So maybe your prophet got it from the jews. Basically when I was a kid the family would spend pretty much the entire afternoon being together, working on the food for the evening, which was usually delicious because of that. Many days there was church, and church activities. The school would help out with the fast.

I don't agree with you at all that it increases your energy. And yeah it came with lots of completely ridiculous rules, like anything religious. If I was a muslim, with that many rules that onerous, I'd refuse to do it just for that reason alone. Such rules only serve to prove someone else's power over you and nothing more. There is no use or purpose other than that. At one point I actually thought different, and so I simply tested it. Nothing, of course, as there is no God that is so extremely petty and meddling as that.

<comment><USER4> Fasted last 15 years. In my experience, the first couple of days are tough (mainly due to the body adjusting to different sleeping patterns and the lack of coffee), but after getting over that my energy levels come back. My output as a developer increases because my concentration levels are higher. This continues to increase right through the month. While I'm fasting, I feel like "I" have complete power/purity over my body. Fasting is not only to remember the people in poverty, it is to learn self restraint. The week after Ramadhan I begin to regret going back to old habits (5 cups of coffee a day, thinking about food/snacking during the day etc).

The problem I've found people who test it have, is they try the first day and say it's too hard (it is). You only really experience the benefits after a couple of days.

</comment></comment></comment><comment><USER5> While it may be manageable for most, I wonder at what point it becomes downright dangerous for people in critical jobs.

It would be interesting to do an analysis of say Muslim Surgeons observing Ramadan fasts and the numbers and types medical errors during the fasting vs non-fasting periods.

Or the Pilots on Fast and Long Haul flights who have been fasting daily for a month....

<comment><USER6> It is hard to say in the Arab World, but judging from accent and religious greetings, I have flown during Ramadan without incident.

However, there are known exceptions to fasting when traveling during Ramadan. It is one of the few times when you are exempted, save illness, from fasting.

Despite what people say, Islam has a very practical mindset about these things and many people push themselves, name the elderly and sick, and that upsets me because I see many whose medical conditions exempt them.

How do doctors get around it? They don't show up!

Jokes aside, where I live, office hours are reduced to six hours a day. This is partly fasting, but because many stay up late to recite the Quran (Taraweeh and later Tajahhud) into the late hours of the evening and wake up for pre- dawn prayers.

</comment></comment><comment><USER7> What is interesting in Ramadan is being dependent on the moon for the calculation of this month starts and end, so in 33 years you will experience fasting in different seasons

<comment><USER8> It changes seasons every 10 years. In my mind Ramadan is forever tied to fasting in the winter because that's my earliest memory of it.

</comment></comment><comment><USER8> I was just saying the other day that fasting in Ramadan could work as alternative to Soylent[1]. Eating one meal a day frees up a lot of mental cycles that goes into thinking about food (what will I eat for lunch, where from, etc). It also allows for longer stretches of uninterrupted coding time. And probably most importantly the post-lunch slump is gone.

One phenomenon that I hadn't found an explanation for is that I get an explosive amount of energy around 6 or 7pm (just before breakfast at 8.30pm). And this hour is my most productive hour of the day.

[1]: [https://twitter.com/amasad/status/746870830370533376?s=09](https://twitter.com/amasad/status/746870830370533376?s=09)

<comment><USER9> Have you found that the freed mental cycles came later in the month, after adjusting to the fast? In my experience, fasting requires even more mental effort than I'd normally spend just to ignore hunger pangs.

<comment><USER8> yes the first 3-5 days are always tough. Especially if you're addicted to caffeine or nicotine. I would say it takes almost a week to start feeling more productive than in non-fasting state.

</comment></comment></comment><comment><USER10> Ramadan was my most productive month last year (hard to measure this year as I started at a new job just before Ramadan). There are no food related distractions (no thinking about lunch, getting up for water, going to the washroom, etc). The key was adjusting my schedule a little bit (start work later) to ensure you get enough proper sleep.

<comment> semi-extrinsic I guess it depends a lot on your job. As a counterpoint, one of my neighbours, who is Muslim, works as a chef. He says fasting is hard in that line of work: not only do you have to stay in a hot kitchen smelling of good food all day, but you can't even taste the food you're making to see if it's well seasoned etc., so you're constantly bothering other people to taste for you, thus lowering the productivity of the entire kitchen.

</comment></comment><comment><USER11> I didn't know that you weren't supposed to have water during the day. That's pretty cut throat!!!

I typically fast for 24 hours 2-3 times a week. My Energy levels have been higher since I've started this habit.

I've also done 7 day fasts and I find my brain gets sharper as it goes.

I think fasting along with meditation are two activities that I see as my "Secret weapon".

While a lot of people view them that as new age nonsense, I find they are worth 10 additional IQ points and believe they are activities that will be start to be pushed by doctors as part of what's considered preventative health care.

If you've never tried them, I'd highly recommend you consider it!!

</comment><comment><USER12> Anyone who hasn't tried a spiritual discipline (such as fasting) really should.

Belief isn't a prerequisite, and most faiths have some sort of variation on it. Whether it's a Buddhist retreat, fasting through Ramadan, fasting through Lent (my tradition, Orthodox Christianity has fairly strict fasting rules as an example), or a retreat at a monastery, spiritual discipline is a great way to withdraw from the world, focus on your inner self and learn to concentrate and deal with life's stresses.

Even if you don't believe in deities, there is practical knowledge to be gained. Also keep in mind, spiritual discipline during fasting seasons should also be done in conjunction with prayer/meditation (depending on religion/tradition), so it offers more benefits than simply dieting.

</comment><comment><USER13> One thing I'd suggest for employers: if your employee observes Ramadan and will be cooking for their family in the evening, make it easy for them to leave plenty early so they can get food ready by sundown so their kids don't have to fast longer than desired.

The kids at our elementary school who fast have a definitely lack of energy in the afternoons. It's nice to do what we can to support their home lives.

<comment><USER14> Islam exempts the young (and the elderly and the pregnant and the ill) from fasting during Ramadan. Do the kids at your elementary school fast due during Ramadan?

<comment><USER13> Yes. It depends on how old the kid is, and whether they can handle it.

</comment></comment></comment><comment><USER15> I once had a muslim roommate, who was going to a very prestigious law school at the time. He would wake up early, and study well into the night.

During ramadan he very busy studying all day. As soon as it was close to evening time, he would start cooking an insanely huge meal. I don't know how the hell he did it.

</comment><comment><USER16> It's funny to observe how people think that fasting or any other ancient rite will make their faith more valid. "If I'll eat this sandwich it will be huge sin and God will judge me".

<comment><USER17> Not a muslim myself, but its pretty apparent you haven't the faintest clue about the reasons behind the fasting.

If you actually read even a little of the article, you will notice that there is no reference to "making one's faith more valid", but rather more practical values like self-discipline, self-control, patience etc.

<comment><USER18> But of course the real reason is "everyone I know is doing it so I must fit in".

<comment><USER17> Of course, imitation plays a part whenever you have some kind of group identity. However, there's a distinction between why the practice actually exists and why people partake in it. The question being answered is the former.</comment></comment></comment></comment>


MPAA's Chris Dodd Calls SOPA Defeat a 'Watershed Event' - <AUTHOR> http://www.hollywoodreporter.com/risky-business/sundance-2012-chris-dodd-mpaa-piracy-284190

<comment><USER2> Their interest is not 'having a conversation'. They have degenerated into monopolists. Let us clarify the game they play:

One year they lobby government to strengthen enforcement. They say: piracy means they are not getting what the law says is their due. (it sounds almost reasonable!)

The next year they lobby government to expand copyright. That is: _they are deciding for themselves what is their due_.

Far from the general public interest, and, indeed, plainly very far from the free market.

</comment><comment><USER3> I like how he thinks that Netflix and Redbox are also ripping him off. It's like he expects each person who sees the movie to pay for the entire production. Anything less is ruining the industry.

I disagree with this, though. I think it should be legally required for _everyone_ to pay for the movie, regardless of whether or not they see it. That way, nobody can steal his hard work!!

<comment><USER4> Don't even joke about that.

In Denmark we pay "license" to the state, to keep the public television and radio channels going. Mind you, this isn't part of the tax and it's completely optional whether you want to pay it or not.

Except, if you have a television, an internet connection, a cellphone, a radio or any device capable of receiving a television signal via an antenna or internet connection - you have to pay. After all, you have the ability to watch/hear the content. Whether you do or not, that doesn't matter. If we paid this through our taxes, it wouldn't be an issue (compared to what else we pay for). This being a pseudo-tax masked as an optional thing, that's ridicilous though.

Oh and on top of that we pay an extra tax (which goes to the artists) on casette tapes, CD-R's, DVD-R's, VHS tapes, etc. After all, we might record songs & movies on those mediums. And before you ask, no, despite us paying that tax, it's still not legal for us to do so.

<comment><USER5> By the way, almost every country in europe has a TV licence. It definitely can be a good thing, most brits would accept that the TV licence is a good price for the BBC. They provide quality television/radio for minority groups and tend to invest heavily in industries like documentary film-making which might otherwise be ignored in a purely capitalist TV industry.

<comment><USER4> I agree that a public television channel may be a good idea, and I agree that BBC produces great content, just as our DR does. I also see that your license is ~145£ while ours is ~265£ - not that that makes the argumentative difference though.

My problem is that everybody pays exactly the same, the poor, the students, just as the rich. Everything else in our society is based on a progressive tax, just as most "extras" besides your tax is completely optional. The license on the other hand, that's a flat "tax" that everybody has to pay. With the current rules, very few can honestly say they don't need to pay it. As such - let us pay it over the tax and I'd be fine with it.

<comment><USER5> Population is obviously a factor because the cost of producing/broadcasting television content is not proportional to population. £145 * 60 million people is a lot more money than £265 * 5 million.

The BBC also makes a lot of money selling it's programming around the world, presumably most Danish TV is in the Danish language so it would be difficult to sell on.

Having said all of this, I'm in Ireland not in Britain. :-) Our TV licence is €160/annum but out national broadcaster airs commercial ads (unlike the BBC).

</comment></comment></comment></comment></comment><comment><USER6> Classic Chris Dodd. Obvious outcomes -- like the 2008 financial crisis, which occurred on his watch as Chairman of the Senate Finance Committee-- are "watershed" and heretofore "never seen before." This way, he can escape responsibility for the role his own actions played in creating the mess.

<comment><USER7> In fact, the public rejection (if final) of SOPA/PIPA are not watershed events, but evidence of Dodd's absolute failure to execute the job he was hired for.

</comment></comment><comment><USER8> <http://en.wikipedia.org/wiki/Chris_Dodd>

In office for 36 years, the first thing he does when he goes private is to lobby for a law nobody wants on behalf of his new employer. What happened to Obama's promise to stop this?

<comment><USER9> Obama's promise was to limit lobbyist movement in the other direction (industry -> government). Not that he's done a great job of that, but let's paint his promises in an accurate light.

<comment><USER8> He did mention the other way as well. I'm not sure if he was only talking about limiting the extent to people in his administration of the whole gov.

[http://www.politifact.com/truth-o- meter/promises/obameter/pr...](http://www.politifact.com/truth-o- meter/promises/obameter/promise/240/tougher-rules-against-revolving-door-for- lobbyists/)

</comment></comment></comment><comment><USER10> I want to share my results of a tertiary topic on this thread: Adam Lipsius claiming that hundreds of thousands of pirated copies of "16-LOVE" had destroyed his chances of profiting from the film.

A Google of Adam Lipsius returned his IMDB page, his Facebook page, a few videos about 16-LOVE, and no Wikipedia article. I followed his IMDB page and discovered he has participated on the producer + director level of several films. He is said to be 'known for' The People vs. Larry Flynt and Men in Black, but was involved only in the sound of those films.

16-LOVE produces similar results: virtually nothing on Wikipedia or IMDB. Its IMDB article says it is similar to films such as "Zookeeper", and is rated at around 5 stars. Completely distinct from the IMDB results, RT claims it is 100% fresh with 39 reviews. It was directed by and produced by Mr. Lipsius.

Conspicuously absent in my searches were any torrent offerings.

\---

Here's what I think:

I think 16-LOVE was not a popular film, and just plain didn't do well. I don't think piracy had anything to do with it.

My opinion is that generally you will find the noisiest, most entitled, belligerent users amongst the ranks of the free. They didn't pay for it, and so there is literally no skin in the game to persuade them to like it.

I contend that if, indeed, hundreds of thousands of people had illegally downloaded this film, there would be much, much more evidence of its existence available through Google - the same exact route I would have found torrents, by the way.

I think it was just an unknown film, with no publicity, and maybe - hell, probably - it would have done far better if it had been offered through a more direct, easily-accessible avenue.

<comment><USER11> Perhaps he found one of those ridiculous fake torrent sites that claims to have thousands of downloads for anything you pass it in a query string? He definitely wouldn't be the first.

example: [http://usenetdownloads.net/usenet.nl/v4/files.php?q=SGFja2Vy...](http://usenetdownloads.net/usenet.nl/v4/files.php?q=SGFja2VyIE5ld3MK)

</comment></comment><comment><USER12> The MPAA knows watershed events, alright.

I'm still waiting for the VCR to destroy movies, as his predecessor, Jack Valenti, predicted: "I say to you that the VCR is to the American film producer and the American public as the Boston strangler is to the woman home alone."

<comment><USER13> Let's talk about the Boston strangler.

How many women did the Boston strangler actually get? (I'll save you a trip to Wikipedia: 13, over 3 years.) What percentage of "women home alone" is that - even women home alone in the Boston area? Now compare the level of raw _paranoia_ that the strangler generated - surely, paranoia well in excess of any real risk. Perhaps this is a more apt analogy than Valenti realized.

And no one ever seriously promoted a massive reorganization of society, establishment of a surveillance state, or revocation of basic liberties in communication over the matter of the Boston strangler.

</comment></comment><comment><USER14> Another 'watershed moment' in American politics is Dodd's shameless and unapologetic shakedown of the US Congress for not staying bought.

[http://www.foxnews.com/politics/2012/01/19/exclusive- hollywo...](http://www.foxnews.com/politics/2012/01/19/exclusive-hollywood- lobbyist-threatens-to-cut-off-obama-2012-money-over-anti/)

<comment><USER15> Speaking of which, the petition has been completed, so let's see what the Obama administration does about it now:

[https://wwws.whitehouse.gov/petitions/!/petition/investigate...](https://wwws.whitehouse.gov/petitions/!/petition/investigate- chris-dodd-and-mpaa-bribery-after-he-publicly-admited-bribing-politicans- pass/DffX0YQv)

</comment></comment><comment><USER16> _"There was some back and forth about how best to combat piracy, with some in the audience advocating a strategy that supplies more content in new, affordable avenues to undercut the temptation to steal, and Fithian arguing that cheap-prices-up-front approaches such as Netflix streaming and $1 Redbox kiosks are "bad business models.""_

Clueless

<comment><USER17> Fithian represents NATO, the theater owner trade association.

He has zero interest in promoting anything other than theatrical distribution.

<comment><USER18> Oh. I was wondering why there was such a heavy military presence on the panel.

</comment></comment></comment><comment><USER17> There's a business opportunity in this article.

At the end they talk about digital-to-the-theater distribution and indie filmmakers hooking up with indie theaters.

A marketplace portal that facilitated that connection on a global basis could do well for itself.

A lot of schlepping, but a very viable market.

<comment><USER19> Yea, I never understood why that isn't the case today. I mean, they ship the film to the theaters still.

Theaters should be turnkey. Find the space, set up the Movie Market Place (MMP) hardware, make an account on MMP.com, license movies from the MMP.

Should be no different from app markets.

</comment></comment><comment><USER17> I very, very seriously doubt the film 16-Love was robbed of "hundreds of thousands" of viewers through piracy.

You can't complain about misinformation on the other side and then trot out something like that.

</comment><comment><USER20> I love how Dodd seems to extricate himself from his own statements, "the white noise has made it impossible to have a conversation about this," he said. "We've gotta find a better way to have that conversation than we have in the last two weeks."

It's as if his head isn't attached to his mouth, which I think goes for a lot of current politicians. Bringing them all down a staff of notches is entirely in order, lest they forget they represent the "people".

</comment><comment><USER21> I hate when they just pull these numbers out of their ass. I can agree that they lose money (even though I feel it is necessary to force them to innovate), but they are just creating random figures of things that would have never happened. It would be like Michael Bay coming out claiming Transformers lost 250 million dollars because of piracy.

</comment><comment><USER22> Has it actually been defeated though? I'm not that well versed in what's been going on, but the last time I read about it they just said the bill had been shelved after public outcry

Shelved surely means they'll pick it up later and push it through discreetly?

<comment><USER23> When something gets shelved it pretty much means it's dead. The president even said he was against it and we are in an election year.

Chances are greater that they would hide this in another significant bill so it can get passed.

<comment><USER24> Or it will become moot when ACTA is ratified.

</comment></comment></comment><comment><USER25> It's more like a river basin event. My fervent hope is that Dodd draws upon his years of experience weakening the economy to weaken Hollywood to the point of collapse. Hollywood should figure out how to protect its products if this is important to them, instead of demanding that Internet service providers figure it out for them and pay for the privilege.

</comment><comment><USER26> MY EYES! Thank you, Clearly... <http://www.evernote.com/clearly/>

</comment><comment><USER27> why does he make "…communicate and organize directly with the public…" sound like such a bad thing?

</comment><comment><USER28> There is no conversation to be had. They're just gonna keep pulling this shit until they pass what they want to pass.</comment>


Ask HN: Should users be allowed to disagree with the ToS? - <AUTHOR>

In every program I've used, clicking Disagree meant that the program would refuse to install, or refuse to allow me to proceed.
Or, I just assumed that's what not accepting the ToS would result in, so I felt like Accepting the ToS wasn't really making a choice beyond double-clicking the app was 'making a choice'.
But what if clicking 'decline' meant that you could actually state a rational reason, and expect some sort of human response?
And in the time it took to get that response, you could use the software? <comment><USER2> You're saying this from a user's perspective, not from the company's perspective, right? From the company's perspective, a) their lawyers will advise them that "We sometimes let users use the product without signing a contract. How do you feel about that?" invites incredible levels of legal risk, b) the person who monitors the Rejected the TOS inbox is buying themselves hundreds of hours of work answering very frustrating emails from the worst customers ever, and c) this choice will not appreciably increase any metric the company cares about.

You can get a custom TOS written by many software companies, by the way. It will just cost you a heck of a lot of money. The reason we use "contracts of adhesion" (the take-it-or-leave-it terms) is because lawyers and compliance are really freaking expensive, and we can amortize e.g. $10,000 of legal costs over e.g. 700k clients, but if you want things to be custom-negotiated then you can expect to pay $10,000 for that.

Customers frequently ask for this for Appointment Reminder, by the way. "I just have one paragraph I wanted added to the license." Sure, for enterprise pricing, we can do that. "How much is enterprise pricing?" 20X what you think it costs. "THAT'S OUTRAGEOUS." I tend to agree, but welcome to paying professional wages for professional services. If you'd like to not end up footing any legal bills, you're welcome to buy the $29 plan and click Yes when prompted.

<comment><USER3> What's crazy is that enterprise pricing often comes down to, "is that one paragraph _really_ worth $10,000+ to your business, and potentially much more than that?" If yes, pay for the enterprise pricing already.

If not...stop worrying about stuff that doesn't make that big a difference to your business!

Which of course continues to elude many people who would rather waste time arguing that $29 is too expensive. And this despite the fact that, as a business expense, $29 is quickly eclipsed by "at least one person in the business has to care about it at some point in a given month."

</comment></comment><comment><USER4> > But what if clicking 'decline' meant that you could actually state a > rational reason, and expect some sort of human response?

Sure, no problem. Just expect to pay twice or three times the original price of the program, to pay for the administrative staff required to negotiate with recalcitrant users.

> And in the time it took to get that response, you could use the software?

Never happen. In many cases a program is a collection of modules from different vendors, all with their own requirements, and none of whom would be likely to agree to negotiate with individual users about how they can use the program. And certainly not in advance of forging an agreement -- a contract -- between themselves and the user.

In mass marketing, what you suggest is simply impractical. It's not as though a program is protected by an ironclad international copyright except for John Doe of Main Street, U.S.A. who is using the program under protest while his lengthy and articulate objection winds through a corporate bureaucracy. This isn't realistic.

It's not about fairness, it's about practicality.

</comment><comment><USER5> There really are two questions hiding here, and most comments are only answering one.

1\. Could we allow users to modify the TOS for themselves and have a quick round of TOS negotiation?

Yes, for a large enough price. In most cases, the cost of having anyone even acknowledge a new customer means that customer is unprofitable. Quicken (Intuit) was the poster child for recognizing that a customer ever asking for customer support was unprofitable. Usually, a minor round of contract negotiation for a $50K product happens, and always happens for contracts greater than $250K.

2\. Can we ask the user why they balked at the TOS? If there are enough common reasons for balking we might change the TOS.

Yes, absolutely. Lawyers I work with often complain about products, some aimed at lawyers, that don't understand the diligence implications of "we may change these terms without notice". Any lawyer placing client confidential information on any service with this clause is failing their legal duty to take reasonable measures to protect attorney-client privileged information. Having a feedback mechanism might distinguish the set of "didn't sign up because of your TOS" versus "didn't sign up because product failed".

<comment><USER5> Ah, and let me add some generic TOS advice I recently passed to Experiment.com when their TOS made me balk.

1\. The check box should have a date. "I agree to your terms of service (last modified on 10/11/12)" 2\. Break your TOS into sections by usage. For example, "when growing our site", "when you create an account", "when you post a comment", "when you make a purchase". 3\. Usually, write your TOS yourself, in plain language. Then take it your IP attorney and have them mark up what's wrong. It saves you money and provides a more friendly and readable TOS. It avoids the lesser attorneys that write '"we","us", and "our" refer to MegaSoftware while the terms....'

</comment></comment><comment><USER6> The other posts by <patio11> and <lutsup> have the right of it. ToSes are written by lawyers to be read by judges who are lawyers in response to often spurious class action lawsuits filed by plaintiffs' lawyers.

You don't like ToSes? Demand some serious tort reform. If that happens, they'll get shorter. But they won't go away.</comment>


How to transition to remote work in a hurry - <AUTHOR> https://twitter.com/wadefoster/status/1237789749709959168 <comment><USER2> Ive read all the blog posts coming out on this and most of them only emphasize problems that their own product solves. Except one or two. Thinking this might help - [https://jamm.app/en/how-to-guide-to-owning-remote- work/](https://jamm.app/en/how-to-guide-to-owning-remote-work/)</comment>


Reveal - We insert video ads on user intent to BOOST REVENUES - <AUTHOR> http://www.reveal-ad.com/

<comment><USER2> Show me the money! (Jerry Maguire)</comment>


IETF Technical Plenary: Bitcoin and Internet-Scale Payment Systems - <AUTHOR> https://www.youtube.com/watch?v=RUaAcf4gLto&list=UU8dtK9njBLdFnBahHFp0eZQ

<comment><AUTHOR> Agenda: Reporting (IAB Chair, IRTF Chair, RSE and RSOC Chair) - 20 minutes

ITAT Workshop Report, Eliot Lear -- 10 minutes

Technical Topic: Payment Systems

"Internet-Scale Payment Systems: Ecosystems & Challenges", Malcolm Pearson (Microsoft China) -- 30 minutes

"Identity, Payments, and Bitcoin: Big Changes Ahead", Steve Kirsch (OneID) -- 30 minutes

Q&A - 15 minutes

IAB Open Mic - 15 minutes</comment>


Ask HN: Do you need a faster UglifyJS? - <AUTHOR>

As proof of concept I've "translated" UglifyJS's parser to LiteScript and now it runs 2.5 times faster. I'm not a heavy user of Uglify. Are you?. Should I continue and translate the compressor.js?. Do you need a faster UglifyJS? <comment><USER2> This question is going to give you skewed results because only the people who do need it would bother to reply. Personally, no, I have no use for it.

<comment><AUTHOR> Yes, I know, if nobody responds, I'll assume there's no need for it

</comment></comment><comment><USER3> I, for one, welcome our LiteScriptified UglyJS overlords.</comment>


Human Mini-Brains Implanted in Mice Integrated with Their Animal Hosts – Inverse - <AUTHOR> https://www.inverse.com/article/51589-organoids-grow-blood-vessels-and-neurons <comment><USER2> Holy cow, didn't we learn from "Secrets of Nimh"? This kind of hubris leads to the downfall of mankind.</comment>


Practical Kleptography [video] - <AUTHOR> https://www.usenix.org/conference/woot14/technical-sessions/presentation/practical-kleptography

<comment><USER2> This talk mostly relates to the NSA's presumed poisoning of NIST SP 800-90A Dual-EC PRNG. Previously it had been asserted that generating backdoored parameters was extremely hard. Green et al have an accompanying paper at USENIX Security that discusses practical exploitation of Dual-EC.

[http://dualec.org/DualECTLS.pdf](http://dualec.org/DualECTLS.pdf)

</comment><comment><USER3> Wow.

Matthew Green pointed out something really interesting that I, at least, was unaware of. Apparently encryption libs do something breathtakingly stupid: They use the same random streams for a nonce (ie an attacker may see it) then immediately after use it for various other randomness needs within the protocol. So if there is any weakness in the random generation, you're exposing at least partial state of your random generator stream. Whereas if one used different random streams for the nonce and then other needs, you wouldn't be exposing as much state. Or at least that's my very non-expert takeaway.

edit: rsa not only uses a broken prng by default, but they appear to have actively aided the nsa.

<comment><USER4> your assumptions about cryptographically secure pseudorandom number generators (CSPRNGs for short) are incorrect - one of the key requirements of secure random number generation is the inability to predict future state given previous state. See [http://en.wikipedia.org/wiki/Cryptographically_secure_pseudo...](http://en.wikipedia.org/wiki/Cryptographically_secure_pseudorandom_number_generator), particularly the part about the next-bit test.

The bit about RSA aiding the NSA is spot-on though, if dual EC DRBG is in fact backdoored.

<comment><USER3> You didn't understand.

Obviously it's a requirement to not be able to predict the future of a prng given output from one. However (and the video discussed this!) that requirement may be violated, either accidentally or on purpose.

Therefore, these protocols should be implemented in such a way that they are more robust to defects in prngs. One such way is, obviously, not putting the output of a prng in the clear, then using the next bits out of that prng.</comment></comment></comment>


Discontinue support for weak cryptographic standards - <AUTHOR> https://githubengineering.com/crypto-deprecation-notice/ <comment><USER2> Just a quick preview...we will be posting a blog post tomorrow morning with an update. Because of the delayed final blog post, we are delaying things by one week. The plan is to do a 1hr brownout on February 8th, followed by a permanent deployment on February 22nd. We realize that no matter how much notice (announced roughly a year ago), there are bound to be some systems that are both incompatible and unknowingly running on production systems. So, the hope is that a 1hr brownout will help to unearth such systems and give folks time to get them updated.

<comment><USER3> That is honestly a great idea for safe-ish deprecation in uninformed environment!

<comment><USER4> I always loved a similar idea that I believe Google uses (or used at one point) for sunsetting APIs.

You start by making 1% of requests fail on the scheduled date, then gradually increase that percentage over time until 100% of requests are failing.

This gives anyone that doesn't follow your blog or news to start realizing that there's a problem and find a solution before it completely cuts off.

I personally feel a brownout of 1 hour will barely register as a blip at many places, and if it goes back to working 100% they are liable to just ignore it after it resolves itself.

<comment><USER5> Last time we deprecated something in App Engine, we made an "opt out" flag, that customers could manually flip to keep the old way working for another week. This was reset every 7 days, until the final switchoff date. This worked pretty well; we saw fewer and fewer customers opting out as everyone updated their code, and the final deadline didn't come as a surprise to anyone.

</comment></comment></comment></comment><comment><USER6> This is a bit of a pain for .net devs on 4.5, as it by default has TLS1.2 disabled.

You can fix it with

            System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls11 | SecurityProtocolType.Tls;

but note that its a somewhat global setting (for your appdomain?) so don't just set it to Tls12 and wonder why some of your connections don't work anymore.

<comment><USER7> Isn't 1.2 like 10 years old? Why would it be disabled?

<comment><USER8> Because of broken interception proxies. In many cases, these prevented connections from being established at all if either side of the connection even just announced 1.2 support.

So it was disabled by default and in consequence it remained niche which didn't exactly improve the situation with broken middle boxes. It also made implementing it in various SSL libraries somewhat low priority (see OpenSSL)

Only as the security of pre 1.2 started really crumbling and once the Snowden revelations moved security to somewhat higher priority in the public perception, it started to at least become possible to enable 1.2 at least on servers.

Frankly, I'm impressed we actually got to where we are at now. For a long time between 2008 and maybe 2015 it really looked like 1.2 was dead in the water.

Now we're transitioning to 1.3 and history is repeating itself: despite going great lengths to hide the differentness of 1.3 to existing middleboxes, they are still breaking 1.3 connections causing more and more bad hacks to be added to the protocol. A protocol which supports version negotiation since the beginnings in the early 90ies btw.

<comment><USER7> Crumble? AFAIK, there are no known attacks against any version of TLS. Only SSL. Heartbleed was an implementation defect, not a problem with the spec. Same with Snowden. They basically just opened the front door to him.

</comment></comment></comment></comment><comment><USER9> Can someone add (2017) to the title? Without seeing the date it makes it look like GitHub is discontinuing support with a few days' notice.

<comment><USER10> If the mods do that, they should also add the date it will be disabled. If it just had 2017 in the title, it could mislead people to think support ended last year.

<comment><USER11> I feel like a less confusing title would be something like "Github to discontinue support for weak cryptographic standards Feb 2018 (2017)"

I saw this with the original 2018 in the title and immediately had a pretty bad "what the f __* Github? Deprecation periods aren 't a thing?" reaction..

</comment></comment></comment><comment><USER12> I notice that ssllabs.com/ssltest lists the cipher suites uses at github engineering as:

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (0xc02f) ECDH x25519 (eq. 3072 bits RSA) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (0xc030) ECDH x25519 (eq. 3072 bits RSA) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (0xc027) ECDH x25519 (eq. 3072 bits RSA) TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (0xc028) ECDH x25519 (eq. 3072 bits RSA) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (0xc013) ECDH x25519 (eq. 3072 bits RSA) TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (0xc014) ECDH x25519 (eq. 3072 bits RSA) TLS_RSA_WITH_AES_128_GCM_SHA256 (0x9c) WEAK TLS_RSA_WITH_AES_128_CBC_SHA (0x2f) WEAK TLS_RSA_WITH_AES_256_CBC_SHA (0x35) WEAK

Why still support the TLS_RSA_* ciphers, given that they, unlike TLS 1.1, have a known vulnerability? Is it mainly because of middleboxes that can't handle ciphers that all modern up-to-date browsers can?

<comment><USER13> > Why still support the TLS_RSA_* ciphers, given that they, unlike TLS 1.1, > have a known vulnerability?

TLS 1.1 also has known by design vulnerabilities. It only supports two cipher modes, RC4 and CBC/HMAC. The first is vulnerable to biases, the second to padding oracles + Lucky 13.

Yeah, padding oracles can be avoided by implementing crazy, complicated countermeasures. Same is true for TLS_RSA. (Though I do agree that TLS_RSA is probably more problematic.)

<comment><USER12> So ... why do they continue with tls_rsa? Is it required because of middleboxes lagging behind?

</comment></comment></comment><comment><USER14> Oh boy. This will be fun for me. I am forced to build some binaries in a dockerized Centos 5 currently to make them portable. No support for TLS 1.2 in it.

<comment><USER15> Squid proxy! (Dockerized!)

We do this for some enterprise shenanigans where we need to MITM M2M. YMMV.

<comment><USER14> Yeah. I see some ways to fix this. But it looks like unless I change something now this will break tomorrow. Nice heads up in any case :P

<comment><USER16> The article was from over a year ago, so they have given over a year heads up.

<comment><USER14> Damn. My fault then. Completely missed that.

</comment></comment></comment></comment></comment><comment><USER17> Do all command line / API utilities support TLS 1.2+ now? Many linux distros ship really old libraries, is why I ask. Then there are the older unix systems with even older libraries.

Based on their stats about 5% of connections will fail. I presume some of these are bots. I am looking forward to how this plays out.

<comment><USER16> But the data was from a year ago; presumably, with a full year notice, hopefully that number has decreased.

</comment></comment><comment><USER18> (2017)</comment>


Ask HN: Students, Scientists, and Engineers: Need to Speed Up Your Programs? - <AUTHOR>

I am an M.S. Computational Science and Engineering student who has experience in CUDA programming for general purpose graphics processing units (GPGPUs). If you haven't heard of this, it is a utilization of your graphics card to tremendously speed up scientific and engineering simulation programs by orders of magnitude (factors of 10x to 1000x). I am looking for students/scientists/engineers who use time-consuming programs and want to speed them up (for free, I am not looking for customers or anything). Contact me if you are interested and we can talk about whether your application would benefit from being ported to the GPU. Thanks for your time! <comment><USER2> What's your email address?

<comment><AUTHOR> Hi tachim, you can view a user's email address by clicking on their profile name.

<comment><USER3> You don't have an email address in your profile.

<comment><AUTHOR> Oh I am sorry, I did not realize it was invisible. It is robhlee32 at gmail.</comment></comment></comment></comment>