Fun with Swift - <AUTHOR> http://joearms.github.io/2016/01/04/fun-with-swift.html <comment><USER2> > Swift is widely marketed as a functional language

If that's true, those sources reporting that are wrong. Apple itself refers to it instead as a "protocol-oriented language" when it's not just saying "object-oriented".

Swift is definitely not a functional language in the way that it usually means, and Apple knows this, and any legit survey of languages wouldn't clump it together with much more functional languages. For example, this guy[0] knows what he is talking about.

> Where Swift shines it is in the integratiion with the underlying Objective C > frameworks on the Mac.

>Swift is a good replacement for contexts in which Objective-C would be used.

Except when you try to do anything with OpenGL or a C-based API, like Core Audio. Swift is really lagging for "power programming" with these low-level APIs. It's great for beginners who use all the high-level frameworks (though "great" is a subjective term I don't really agree with for Swift), but a lot of people who really need to get stuff done on Apple's platform are not going whole-hog Swift.

>If you're coming form Erlang/Haskell world you'll think Swift is verbose and a bit of a mess but if you're coming from Objective-C you'll think "Swift is concise and elegant"

I got to be honest, I still find I prefer Objective-C, because, it's essentially C. I can use my C structs and interfaces with zero problem. But in Swift, all C primitives are translated into Swift-only stuff, even integers!

And don't get me started with trying to use a C++ library with Swift, something that's smooth with Objective-C. Which is ironic since Swift itself is written in C++.

[0] [http://robnapier.net/swift-is-not-functional](http://robnapier.net/swift- is-not-functional)

<comment><USER3> In your provided reference, the first sentence Rob writes:

"Ever since Swift came out, I keep seeing weird comments that Swift is a functional programming language"

Swift is often promoted as being "functional":

[http://www.raywenderlich.com/114456/introduction- functional-...](http://www.raywenderlich.com/114456/introduction-functional- programming-swift)

In fact, I've tagged many articles as functional in my Swift resources:

[http://www.h4labs.com/dev/ios/swift.html?q=functional&age=10...](http://www.h4labs.com/dev/ios/swift.html?q=functional&age=10000)

Want to buy a book on functional programming in Swift?

[https://www.objc.io/books/functional- swift/](https://www.objc.io/books/functional-swift/)

<comment><USER4> People say a lot of things. Doesn't make them right.

</comment></comment></comment><comment><USER5> For people who don't recognize the name, the author is one of the inventors of the Erlang programming language. Erlang is famous for its approach to mutability, concurrency, and error handling.

</comment><comment><USER6> FWIW - This is Joe Armstrong, one of the creators of Erlang. Definitely an old-school REPL/functional guy, and I love seeing him playing around with swift.

Regarding GUIs and IDEs: I think interface builder is the best ever way to build UIs, far more fun and comprehensible than web development. I totally understand why Joe wants to control every line of code and do nothing in Xcode-- when things go wrong in the IDE they can be a pain to deal with.

For me, I think there's several common stages of Mac/iOS developer: 1\. Newbie- needs Interface builder because GUIs are all so confusing and he doesn't yet know the API. 2\. Control Freak -- knows enough (and spent enough time struggling with Interface Builder, because IB isn't a magic box and you do have to know how things are working under the hood, and the Newbie often struggles because of this).. and so he wants to avoid IB and do everything in code so he has absolute control. 3\. Starting to see the light-- tired of tiresome pointless repetitive GUI code, back to Interface builder, but this time understanding the underlying parts of it, and having a lot more fun with IB 4\. Enlightened-- uses Interface builder for most stuff, but knows when and where to drop down to GUI code and generally only does that in a highly leveraged way.

One of the things I find frustrating about web development is there is no interface builder (though some people have attempted to create them in the past, they always seem to abandon them, unfortunately.) So you're always stuck wit the frustration of constantly defining everything by hand-- when the reality is there's nothing that should stop web browsers from being able to handle auto-layout the way that iOS does.

Anyway, if you've rejected IB and are finding GUI code a PITA, try using IB in balance.

<comment><USER7> "One of the things I find frustrating about web development is there is no interface builder"

There was, and Apple killed it. It was WebObjects Builder and it was a GUI for interacting with the components you wrote in code in XCode when doing WebObjects development. It was the web version of IB, and, in its day, it was awesome.

</comment></comment><comment><USER8> > _Which to my mind is horrendous. The closure f does not capture the value of > i at the time when f is defined, changing i after f was defined make > nonsense of the idea of a closure._

Of course it should change i after the closure was defined, since the closure doesn't copy but refer to that i.

Looks like a fully proper closure.

Which language does this differently?

<comment><USER9> Objective-C does it differently by default:

        int x = 0;
        void (^block)(void) = ^{ NSLog(@"%d", x); };
        x++;
        block();

This will log 0, not 1. If you want to capture by reference rather than by value, you add __block to the declaration of x.

For a lot of people coming to Swift from Objective-C, this is a surprising change, especially if Objective-C was their first language with closures.

<comment><USER10> That's a block, not a closure. It's still an anonymous function, but the semantics are slightly odd, and derived from Smalltalk, probably altered some.

<comment><USER9> "Blocks" is what Objective-C calls closures.

A closure is just a function that captures ("closes over") the surrounding scope.

Edit: strictly speaking, the construct here is an anonymous function. Objective-C calls them "blocks" and Swift calls them "unnamed closures" or "closure expressions." Both are, or at least can be, closures. (I'm not sure if the term "closure" can be used to refer to a function that _could_ refer to variables in the enclosing scope but doesn't. Probably not.)

<comment><USER10> What you seem to be calling a closure refers to a lambda in a lexically scoped language. Particularly when they refer to free variables.

Blocks are in fact lambdas, or at least closures. I was wrong in the above. In some early versions of smalltalk, blocks had some odd semantics that made them different, but this is no longer true. However, judging by the Objective-C example above, Objective-C blocks don't create true closures, as a true closure would have the semantics of the Swift code from the article.

</comment></comment></comment></comment></comment><comment><USER11> I'm currently working on a project which makes me jump between Swift and Erlang/Elixir on a regular basis. I actually enjoy Swift's OCD typing, particularly in exchange over not having to maintain those mind-numbingly redundant header files any more.

All in all I feel as if Steve Jobs would have been proud of what the Swift team has accomplished - lots of "great artists steal" in the functional programming department while still being disciplined enough to not go overboard with features and staying true to Apple's design culture in general.

That said the lack of pattern matching really is something I've come to miss too and Elixir application code in general feels much more elegant and almost effortless to read and write in comparison to Swift.

Playgrounds are fun and all but IMHO Joe is very much right - all the cruft, the arcane NeXT "magic spells" as well as the mouse-heavy Xcode dependence should make way for new ways to do things. The kids "ain't stupid" I mean young programmers probably all grow up with some command-line fu, essentially making Unix the new lingua-franca (besides Javascript;) so why not embrace OSX/Darwin and go for something more along the lines of how RubyMotion does things?

Whipping up a simple GUI with a couple of action functions really should come with the least amount of needlessly distracting development abstractions.

It probably would also mean less Apple developer time wasted on the next potentially buggy Xcode feature..

Less is more, but again Apple is getting there, especially now that we might be on a path to more complementary open-source development tooling - so to me, doing Swift with Xcode is super productive and fun already!

</comment><comment><USER12> I think the author should do some more reading about Swift. He complains about a lack of inferred typing and pattern matching, two things which Swift _does_ support. It's more limited than Haskell, but it's there.

I also disagree with his statement that Objective-C is better for writing an operating system.

He seems to conflate using Xcode with the built-in support it has for xibs to do UI layout. You don't have to forego all of the features of the IDE just because you prefer to do UI layout in code.

<comment><USER13> > You don't have to forego all of the features of the IDE just because you > prefer to do UI layout in code.

I don't understand why you would do your UI layout in code if you can avoid it. If someone ever joins my team or inherits my code base, they're now partly responsible for maintaining the UI. Xib's and storyboards help with maintainability, legibility, and drastically lower the number of lines of code. The author even says:

> Find an example program that works then reduce lines until I can reduce no > more making a minimal example that works - then understand every line

If you care about the line count, then why are you doing all your UI in code?

<comment><USER14> Layout done in code:

\- Is type-safe, which is verified at compile-time.

\- Will break at compile-time if a breaking change is made.

\- Can be null-safe, without having to use Optional for everything.

\- Can do things iteratively.

\- Can use constants, so that you can easily modify standard paddings and sizes globally with one change.

So those are some of the advantages of doing layout in code.

<comment><USER13> Right but you'd have to document what each constant represents. Interface builder gives us a universal language. You know what the UI will look like or how it will resize etc. because it's right there. There's no confusing constant names with magic numbers. You know the _why_ behind the constraint values because you can see it.

<comment><USER15> Constants are not magic numbers. And with proper naming they document themselves. For more cusotm UI's you won't know how UI will look like. It got better with @IBDesignable but still not enough.

</comment></comment></comment></comment></comment><comment><USER16> For some reason reading the post gives me a deja vu of a win32 GUI programming tutorial :)

<comment><USER17> Hehe, must be all the HWNDs in the code :P

</comment></comment><comment><USER18> > The closure f does not capture the value of i at the time when f is defined, > changing i after f was defined make nonsense of the idea of a closure.

I have an incomplete understanding of functional programming. Are there other uses for closures (besides readability and practicality) that still work if they don't capture the value of i? If not, is this something someone should suggest as a change in swift-evolution?

<comment><USER19> He's complaining about mutable state, essentially. The function `f` captures reference to `i` but does so transparently. One might expect that `f` would be free of side effects, but since `i` can be re-bound whenever this is not the case.

Essentially it comes down to the semantics of `=` whether it's declaration or assignment. Swift appears to choose it to be assignment. If I remember right you can declare things constant which would effect declaration only (sort of) but clearly there's an expectation that this happens all the time.

<comment><USER20> > He's complaining about mutable state

Bindings rather than state, the author has no issue with captured objects being mutable, only with the captured environment being mutable.

</comment></comment></comment><comment><USER21> Swift feels very immature in many areas. For example, Swift fails with generics out of most ordinary cases. Today, you still can't restrict protocol conformance (inheritance clause) to a type-constrained extension. That's a big issue with arrays. A struct wrapper is the go-to solution for many things where Swift generics break down and it's not the best or more elegant way to resolve its limitations. Many hopes for Swift 3.0 but I doubt they'll fix those.

</comment><comment><USER22> I agree, once you step outside the bounds of "text only" you bring on a whole mess of complexity. I've always disliked programming in Eclipse or VS, it just feels wrong compared to a nice simple .py file or whatever you're working with that can be used with any editor you want.

It seems like language complexity brought on IDEs, rather than anything else. They tried to fix the verbosity of C++ and in turn, Java, by creating new IDEs rather than a newer higher level language.

</comment><comment> ben-schaaf The lack of proper syntax highlighting and long lines is making this really difficult to follow on mobile.

<comment><USER23> It is actually generalized. Not only on mobile. Hard to read indeed but very interesting nonetheless.

</comment></comment><comment><USER24> > Above all it had a REPL and I could program outside Xcode (which I hate).

If that's the "above all", not sure what his beef is with Objective-C. You could always program outside of Xcode and various sorts of REPLs were/are available.

</comment><comment><USER25> The author completely missed the point of named parameters. How am I supposed to know that the string argument of "make_window" is the title?

<comment><USER20> > The author completely missed the point of named parameters.

The author didn't miss the point of named parameters. At no point does the author even cover the point of named parameters. The author complains that:

1\. they're inconsistent, all parameters _but the first_ are named by default _and_ named parameters are still positional (you can't reorder "named" parameters in the callsite)

2\. making parameters purely positional is non-obvious and ugly

And he missed the part which takes the cake: Swift doesn't actually have _named_ parameter, parameters 1+ are _labelled_ (#1), and labels and names are independent, you can define this:

        func foo(a b: Int, c d: Int) { … }

which is called with a:c:, but the bindings are on b and d. You can also define this:

        func foo(a b: Int, _ d: Int) { … }

which is called as `foo(a:5, 7)` which while somewhat consistent is really garbage.

<comment><USER9> In Swift terminology, a and c are "external names" while b and d are "local names." I don't see much of a difference between a "name" and a "label" here in any case.

I don't understand why the ability to set different external and local names is so bad. External names are part of the API, local names are part of the implementation. It often makes sense to make them the same, but there are case where you want them to be different, and what's wrong with that? It's ultimately no different from loading a parameter into a local variable of a different name and then operating on that local variable. Yes, you can use this facility to make ugly APIs, but you don't _have_ to.

<comment><USER20> > I don't understand why the ability to set different external and local names > is so bad. External names are part of the API, local names are part of the > implementation. It often makes sense to make them the same, but there are > case where you want them to be different, and what's wrong with that? It's > ultimately no different from loading a parameter into a local variable of a > different name and then operating on that local variable.

Then why have it in the first place? That seems like a very odd feature to put front and center into the language (considering a very similar effect can be achieved with a few assignments as the function's prelude) and require using when just wanting positional-only parameters, or consistently labelled parameters.

<comment><USER9> Can you explain what "and require using when just wanting positional-only parameters, or consistently labelled parameters" means? I don't understand that.

As for why you have it in the first place, it's just because one is API and one is implementation, and there are sometimes good reasons to have them be different.

<comment><USER20> > Can you explain what "and require using when just wanting positional-only > parameters, or consistently labelled parameters" means? I don't understand > that.

As far as I can see (and the article notes), by default the first parameter of a Swift function is unlabelled, and the others are labelled. That is at callsite the first parameter _can not_ be labelled and the others _must be_. Having either all-positional or all-labelled (but still positional) requires specifying external names.

> As for why you have it in the first place, it's just because one is API and > one is implementation

But again and as you yourself noted that could trivially be done with local bindings inside the function in cases where it's desirable.

<comment><USER9> Yes, that's true, but note that you only need to specify the external names on the parameters that depart from the default. A function with external names on every parameter looks like:

        func whatever(a a: Int, b: Int, c: Int)

A function with no external names on any parameter looks like:

        func whatever(a: Int, _ b: Int, _ c: Int)

I'm not sure if you understood that or thought they all had to be specified if any were, but in any case that's how it looks.

As for "that could trivially be done," that applies to a lot of language features in a lot of languages. Virtually all language features are redundant in that fashion, yet they can still be useful by adding brevity and clarity.

<comment><USER26> The question is why is the first argument special? Also, it's weird that you have to explicitly mark the label as "_" to get positional parameters.

I find Scala's handling of named arguments much saner.

<comment><USER9> I think it's because the first argument tends to be named by the function itself. For example:

        button.setTitle("Ham and Cheese", color: red)

Note that named parameters are still positional, they just have names too. Using _ doesn't get you positional parameters, you already had that, it just removes the name. (Exception: named parameters with default values can be reordered with other adjacent named parameters with default values. Why? I don't know.)

It is mildly annoying that you have to add an extra symbol to remove the name for parameters after the first one, but that's the language pushing its preferred style.

How does Scala handle all this?

<comment><USER20> > Exception: named parameters with default values can be reordered with other > adjacent named parameters with default values. Why? I don't know.

That's actually nice to know.

> How does Scala handle all this?

No idea about Scala. In Python 3, there are 4 "classes" of parameters:

* "positional-and-named", the basic parameter can be passed either by name or by position, though passing parameter 1 by name parameter 2 by position won't work: when actually calling the function, the interpreter first fills positional parameters left-to-right then applies named parameters, so it'll raise an error noting that one parameter got two values[0]. Can be either required or with a default value. Parameters passed by names can be passed in any order

        def foo(a, b, c=5): pass
        foo(1, c=42, b=3)

* positional varargs ("args"), can only be passed positionally, can follow any number of positional parameters, will be collected as an array

        def foo(*args): pass
        foo(1, 2, 3, 4)

* named-only ("keyword parameters"), follows either positional varargs or a special placeholder. These were not possible in Python 2 in pure Python, they're similar to 1 but can only be passed by name, they can be either required or with a default value. Like 1 but more so, named-only parameters can be passed in any relative order

        def foo(*, a, b, c=5): pass
        foo(b=6, a=2)

* keyword varargs ("kwargs"), may follow named-only parameters and will collect any parameter passed by name which didn't match any formal parameter, will be collected as a key:value map

        def foo(**kwargs): pass
        foo(bar=5, baz=42, qux=1)

The C API also allows creating true positional parameters (completely unnamed), as far as I know that's not possible in pure Python.

[0] the reverse won't work either, at callsite Python doesn't allow named parameters to be provided before positional ones</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment>


Show HN: RapidFuzz – A fast string matching library for Python - <AUTHOR> https://github.com/rhasspy/rapidfuzz <comment><USER2> Ah, I will consider this as a drop in replacement on EasyALPR.

I use fuzzy text searching to compare LPR license plates with those on lists for parking enforcement.

I wrote a blog entry about Vladimir Losifovich Levenshtein and practical description of string comparison here:

[https://blog.easyalpr.com/2019/09/16/calculating-license- pla...](https://blog.easyalpr.com/2019/09/16/calculating-license-plate- similarity-using-levenshtein-distance/)

Also, here's a UI on top of fuzzy string matching if you just want to play with levenshtein distance for a few minutes: [https://easyalpr.com/tools/string- compare/](https://easyalpr.com/tools/string-compare/)

</comment><comment><USER3> Big fan of FuzzyWuzzy, so if it's the same API but with more performance, sounds great. The performance impact has bit me before.

<comment><AUTHOR> Yes api and results stay mostly the same. A small difference is that return values are always float -> e.g. a ratio of 94.664 and not rounded to 95 as it is done with FuzzyWuzzy so the results can be compared in a better way.

</comment></comment><comment><USER4> > _RapidFuzz […] is using the string similarity calculations from FuzzyWuzzy._

> _It is MIT licensed so it can be used whichever License you might want to > choose for your project, while your forced to adopt the GPLv2 license when > using FuzzyWuzzy_

How is it using FuzzyWuzzy to be exact in order to be MIT licensed?

<comment><AUTHOR> FuzzyWuzzy was MIT Licensed in the beginning, but then in 2011 decided to start using python-Levenshtein which is GPLv2 licensed and therefore the whole project got GPLv2 licensed. RapidFuzz is based on this version of FuzzyWuzzy: [https://github.com/rhasspy/fuzzywuzzy](https://github.com/rhasspy/fuzzywuzzy) and implements similar algorithms in C++

<comment><USER5> Good answer. Nice to see licensing issues taken seriously.

<comment><AUTHOR> This was the main reason to write it. I wrote a small script searching github for projects that use FuzzyWuzzy and then sorted them based on their license into three lists a) GPL License b) Incompatible License c) no license. From these three only a) is licensed correctly. From 1k repositories only about 100 used the GPL, 300 an incompatible License and 600 no license at all. So I figured there has to be some interest in having a more open licensed alternative ;)

</comment></comment></comment></comment><comment><USER6> Looks awesome. I've used FuzzyWuzzy to some success in the past but its performance was abysmal, so I'm interested in giving this a try.

Any chance you could also implement a weighted-levenshtein version? (or allow passing in a weight-table for various characters combinations as like a kwarg or something?)

edit: Something like this, but with the speed of C++ would be amazing. [https://pypi.org/project/weighted- levenshtein/](https://pypi.org/project/weighted-levenshtein/)

<comment><AUTHOR> In the last release I added a module `rapidfuzz.levenshtein` which allows calculating a normal levenshtein distance and a weighted version where substitutions have a weight of 2 (this one is actually used by FuzzyWuzzy for ratio calculations). But when there is interest in other weighting options I can add a version that allows to pass in custom costs for insertions, deletions, and substitutions

<comment><USER6> I am very interested in a version that allow you to pass in a custom substitution cost! It has a great use for OCR applications!

<comment><AUTHOR> Well then I will add it :)

</comment></comment></comment></comment><comment><USER7> It reminds me every fast python library is not written in python!

<comment><USER8> Or, they're written in pure python and run under PyPy.

<comment><USER9> ^ this :)

I once solved a performance problem by using the pure-python mysql drivers and pypy, rather than the normal c-wrapped drivers and python. The result was actually faster than a Java version of the same program using the normal JDBC drivers.

Something feels deeply wrong with a world where database performance can depend on basic string interpolation performance deep in your client-side mysql drivers... Its soul-destroying to see a naive 'safe' parameterization code coming up hottest in Java profiling results.

</comment></comment></comment><comment><USER10> I am currently using FuzzyWuzzy in my project for string similarity in a large document collection. It is quite slow, so I will definitely replace FW with your lib.

</comment><comment><AUTHOR> For everyone wondering about the actual runtime difference between RapidFuzz and FuzzyWuzzy I added a couple first benchmarks based upon the benchmarks FuzzyWuzzy is using: [https://github.com/rhasspy/rapidfuzz/blob/master/Benchmarks....](https://github.com/rhasspy/rapidfuzz/blob/master/Benchmarks.md)

</comment><comment><USER11> Awesome work! I'm a big fan of fuzzywuzzy so I'll be checking this out:) Currently I'm split between using fuzzy logic in my backend python code as opposed to it being built into a sql statement (via SOUNDEX() which does matching based on phonetic similarity).

</comment><comment><USER12> this looks neat! trying to think of something to build with this :)</comment>


Show HN: Commons Host DNS-over-HTTPS CDN with 20+ edge servers - <AUTHOR> https://dev.to/commonshost/how-we-built-a-doh-cdn-with-20-global-edge-servers-in-10-days-1man <comment><USER2> Impressive! It would be cool if you could implement some of the pi-hole DNS blocklists in your DoH CDN.

<comment><AUTHOR> Thanks! Pi-hole is a great project. We have been looking at how to incorporate filtering. Current challenge is making DOH more accessible through a reverse proxy. Coming soon: [https://github.com/commonshost/dohnut](https://github.com/commonshost/dohnut)</comment></comment>


Amazon Kinesis Analytics – Process Streaming Data in Real Time with SQL - <AUTHOR> https://aws.amazon.com/blogs/aws/amazon-kinesis-analytics-process-streaming-data-in-real-time-with-sql/ <comment><AUTHOR> How does this impact PipelineDB? Sounds similar if not identical.

<comment><USER2> Jeff from PipelineDB here. Our products are similar in that they execute SQL queries continuously on streaming data, but the main differences are that PipelineDB is 1) open-source, and 2) includes a fully functional relational database, which enables "state" and doesn't presume that data is intended to be streamed out as well as in. The latter is a seemingly subtle, but important difference because "stream out only" drastically limits use cases.</comment></comment>


Need advice on deciding signup flow - <AUTHOR> http://yayaid.com

<comment><USER2> It took me sometime to understand that the link is a job site. In my opinion, it needs to deliver it's message more clearly. For registration, I would keep a single form with a radio button set with two options, company and job- hunter. Apart from the radio button set, I'll try not to include anything other than email/password fields. Similarly for login, I would keep only one form and decide from the email address whether the current user is an individual or a company representative.

<comment><AUTHOR> Thank you for a valuable suggestion. I will try to make it more understandable as soon as possible

</comment></comment><comment><AUTHOR> The web application will ask for permission for Facebook and linkedin access but I assure you that I won't bother you or post anything on you facebook/linkedin</comment>


Google+ Head Vic Gundotra Leaving Company - <AUTHOR> http://recode.net/2014/04/24/exclusive-google-head-vic-gundotra-leaving-company/ <comment><USER2> > Former CEO Eric Schmidt admitted in an interview at the D conference in 2011 > that he missed the boat on the rise of identity on the Internet.

> "I clearly knew that I had to do something, and I failed to do it," he said. > "A CEO should take responsibility. I screwed up."

I think Eric screwed up in a deeper way that this quote admits. Google+ came up at a time of broader dissatisfaction with other social networks, particularly Facebook. From both UI weaknesses and social perception, I initially saw G+ gaining a lot of interest among disparate folks I'd loosely label "influencers". And _all_ of that interest was shot dead due to attempts to own identity by enforcing the use of real names[1].

There are very real reasons why "average" people need alternate identities online. In some cases, it's mandatory professional separation; your work persona shouldn't be conflated with your author persona, shouldn't be conflated with your close-friends persona, etc. Circles were interesting, but solved a different problem.

In this regard, I think Schmidt's big failing was analogous to the fable of the golden goose: he killed any chance Google+ had by trying to seize the golden eggs of online identity. This delayed G+'s adoption enough that Facebook in particular was able to react, improving both its then-primary web UI, make some privacy improvements, and significantly shore up its public perception.[2]

[1] [https://en.wikipedia.org/wiki/Nymwars](https://en.wikipedia.org/wiki/Nymwars) [2] Not counting the rabid social-network and/or Facebook haters, whom cannot be satisfied.

<comment><USER3> My experience is that the Real Names policy was hated by a small but vocal and influential group of users. I never heard about it from any of my friends who aren't reading sites like HN. Those people still don't use Google+, but it's because none of their friends were there, they found Circles confusing, and they didn't see any real benefit to taking the effort to learn about it. Social networks have a lot of inertia for users who aren't early adopters. If they already are connected to all of your friends on Facebook, a new social network would have to be truly amazing (or Facebook would have to really screw up, in ways that "regular people" care about) to get them to move over. I think Real Names was a drop in the bucket compared to other issues.

<comment><USER4>
      > I never heard about it from any of my friends who aren't
      > reading sites like HN.

Anecdote: a decidedly non-technical friend of mine with the last name of "Star" had his Google+ profile disabled after having his name falsely classified as a pseudonym. The only Google+ service that he actually cared about using was Hangouts (a sentiment universal among my friends, it seems... despite its faults, Hangouts really is best-in-class as far as I can tell). The end result was that he missed out on spending time with his friends because of an unanswerable algorithm attempting to enforce a dubious policy. From a user's point of view, this is incredibly frustrating.

To this day, his Google+ profile picture is the same photographic proof that he had to send in to convince them of his name's legitimacy. His rationale is that if his profile gets disabled again, he can just point to his profile picture.

<comment><USER5> <b>Hangouts really is best-in-class as far as I can tell</b>

My S4 updated from gtalk to hangouts, and I loathe it. It now crashes quite regularly, sometimes multiple times in a single chat session, and included a stupid button that starts a video chat on my phone, a feature I have never wanted and never will want, but manages to get fat-thumbed, or randomly turn itself on when I am trying to communicate with someone.

<comment><USER4> I should have clarified: best-in-class for what my friends and I need, which is essentially simultaneous multi-user voice chat that doesn't require installing an external program (if they have Chrome, it doesn't require installing anything at all), works on all platforms, doesn't mandate a laborious microphone calibration on first use, and has pretty decent echo cancellation. We were just looking to replace Vent/Teamspeak/Mumble, rather than e.g. looking for a replacement for Skype. It's been invaluable as a permanent place for our geographically-distributed friend group to idly loiter and connect to whenever anyone has a free moment.

<comment><USER6> "doesn't require installing an external program"

I had to install a .deb to use it in Firefox on Linux.

</comment></comment></comment></comment></comment></comment><comment><USER7> Vic did a pretty great job getting Google+ in decent shape, but am I the only one that finds the overall strategy among these properties confusing? I know that whenever I talk with a normal, non-tech civilian they are always confused by the service.

They have Youtube (where you can upload videos), Google+ Photos (where you can upload videos and stream as well), Google Drive (where you can also upload pictures and videos in addition to creating standalone Google Docs).

It would seem to make more sense to me that there should be a Drive where I store Photos, Videos and Documents, or there should be standalone Photos/Videos and then a separate service for Documents.

To me, these services should exist separately, but Google+ should bring them all together - meaning I can decide, from my photos/videos/documents what to post to Google+. If I want to post a video to the general public, I should post it to Youtube.

Obviously people may have different use cases (consumer vs. business) - but as someone using Google services as both a consumer and business, I find the tools confusing - and it seems to be even more confusing for my Mom.

<comment><USER8> You're definitely not the only one. Trying to understand the interaction between the various Google properties makes me feel like an idiot -- and yet I'm a Web developer with a CS degree who has been using the Web just about every day since 1994.

For example, have you ever tried to schedule a Google Hangout chat? As far as I can tell, there's no way to do it from Google Hangouts. You need to first sign in to Google+, then go to Google Events and create a new event, and then you have to specify that it's a video event.

Is it a use case they just don't care about? Is there no one at the company who's looking at this setup and thinking, "wow, this is confusing and we can probably simplify that"? Or is my brain just getting too brittle to make sense of it?

<comment><USER9> I feel that Google made better, more usable interfaces before they were taken over by designers. Modern designers are obsessed with removing features because that's the Apple religion. The new Maps is ruined because of this. Larry should fire all their designers and let engineers take over the interfaces again.

<comment><USER10> I find the new Maps to be so unusably slow, laggy, finnicky, and overall not an improvement over what Google Maps had been for the 4 years before.

And I can't figure out how to show traffic WHILE displaying directions or a location that I searched for. Seems like such a simple, commonly used thing... "Where is this place? What's the traffic outlook for the routes there?" _Sigh_

<comment><USER11> On the mobile version, zooming out (a couple of time, to some magic level) will suddenly make traffic appear (on the route and everywhere else), even while following the directions. I have not tried this on the desktop version.

</comment></comment></comment></comment></comment><comment><USER12> It appears that many employees did not like working with him. This was posted on Secret "One of the worst execs I've ever worked with. Completely skirted the design process and got designers to do one off projects for him that would derail plans for weeks on end and kill team trust". Interesting, since there is much praise from Page.

<comment><USER13> He's a polarizing figure. I know people who used to work in Social (and elsewhere in the company) that _hated_ working for them, and now they don't work in Social. I also know people in Social who really admire him as a visionary leader who's not afraid to take a lot of personal flack to get the job done.

I think this is common to many people with strong opinions and the confidence to act on them. Marissa was very similar: some people absolutely hated her, while others really respected her.

</comment></comment><comment><USER14> I like G+ for the photo back-up from my Android phone. In fact, that seems to be _the_ killer feature. I wonder what will happen to G+ if Facebook adds a similar feature.

The stream is interesting if you add enough people and organizations, but I find I can go for days or weeks without checking it. I know some people spend all day on G+, but it's unclear to me why.

Between FB, G+, Twitter, LinkedIn, and a host of other comment boards and social network wannabes, it seems to me this market is absolutely flooded, and sooner or later, social network fatigue has got to set in and cause people to seek something that's more nimble.

Maybe there's an opportunity here for some kind of meta-network that ties together several of these sites. I would like that. A single stream, one login, see all your texts, photos, and updates at a glance. Then you can drill deeper into the particular social network if you care to take the time.

<comment><USER15> > I like G+ for the photo back-up from my Android phone.

See, I don't use any of Google's 'let us manage your plaintext data' services except for mail (because email travels in the clear anyway, I'm not too bothered by that).

If they would enable me to store my phone, tablet & app settings, Chrome passwords and backed-up data on their servers, encrypted on the client with a key known only to clients I control, then it'd be a killer feature for me.

Indeed, if they would bake crypto into their products such that all data were encrypted to the public keys of the intended recipients, then I think that they'd be going a long way towards making the world a better place.

But as it is, there's no way that they are laying a finger on my WiFi password, my web site passwords, my photos or any other data I create and do not intend to send to the world.

<comment><USER16> Chrome sync (including passwords) can all be encrypted on the client. Just go to settings -> Advanced sync settings -> "Encrypt all synced data with your own sync passphrase".

Also, if you're this worried, you really owe it to yourself to put in a little effort on your email. Email is often _not_ transmitted in the clear, especially if you're using gmail already, and if you would just switch to a desktop client and IMAP or POP3 access, you can PGP to your heart's content.

<comment><USER15> I'm aware of the Chrome sync passphrase. If I used Chrome on Android (I don't—I use Firefox), would Chrome back my passphrase up to Google's systems? I dunno.

Is the crypto behind Chrome's sync anywhere near as good as that behind Firefox's? Not last time I looked.

I'm also aware that email often travels via SSL—but it's always cleartext to the sending and receiving hosts. I don't see that I'm suffering an especial risk with Gmail, since someone will always have plaintext versions of all mail I receive; I would be were I backing up data to them which I would never back up to anyone.

<comment><USER16> > _I 'm aware of the Chrome sync passphrase. If I used Chrome on Android (I > don't—I use Firefox), would Chrome back my passphrase up to Google's > systems? I dunno._

At least the docs claim that it's only saved on your device. You can believe it or not. There may be a way to verify that it's not being backed up with your normal Android data, but I'm not sure.

> _Is the crypto behind Chrome 's sync anywhere near as good as that behind > Firefox's? Not last time I looked._

It's never been not good. Maybe you're thinking of back when they didn't have the option to encrypt all your sync data locally, just your passwords? It uses Nigori[1] and the source is all available[2].

This is a little old, but it compares browser syncing security: [http://gregoryszorc.com/blog/2012/04/08/comparing-the- securi...](http://gregoryszorc.com/blog/2012/04/08/comparing-the-security-and- privacy-of-browser-syncing/)

> _I 'm also aware that email often travels via SSL—but it's always cleartext > to the sending and receiving hosts_

Fair enough, but if you're using PGP, those hosts are only the actual sender and recipient (and anyone the recipient shares an email with, of course).

[1] [http://www.links.org/files/nigori- overview.pdf](http://www.links.org/files/nigori-overview.pdf)

[2] [https://src.chromium.org/viewvc/chrome/trunk/src/sync/util/n...](https://src.chromium.org/viewvc/chrome/trunk/src/sync/util/nigori.cc)

</comment></comment></comment></comment></comment><comment><USER17> The comments on the Secret app[1] speculate that he might be joining Mozilla, Github or the venture capital firm Kleiner Perkins. What if he rejoins Microsoft instead?

[1] [https://www.secret.ly/p/wxdnkdhjnsocjxwnizhdpacufc](https://www.secret.ly/p/wxdnkdhjnsocjxwnizhdpacufc)

<comment><USER18> I think that's just people suggesting companies that have had a recent people of hiring people that say stupid things, not serious speculation. [Brendan Eich, Tom Preston-Warner, Tom Perkins] Because vicg@ also says a lot of stupid things (and does a lot of stupid things).

<comment><USER19> You got downvoted for getting the joke:)

</comment></comment></comment><comment><USER20> Google+ and Gundotra's lasting, and perhaps perverse, legacy to Google is the "social glue" that forcibly connects together most Google services.

That Google+ never quite managed to take on Facebook is obvious. A much bigger and intangible cost, IMHO, is the falling trust in much bigger Google products like search, YouTube etc. as Google+ was shoved down user's throats.

To wit, I don't use Google+, but thanks to its bundling I've also stopped logging in to any Google service on my laptop except on a strict need-to basis (for e.g. log in, update Google Drive doc, log out...or turn GPS on, use Google Maps, turn GPS off).

<comment><USER21> I find myself in the same situation, the more Google+ leaks out into their other products in an obtrusive way (ie. with "big fanfare") - the less I use those Google services.

I have however not seen many people near me, be so annoyed at this as I am. The most complains I hear about is the YouTube pop-up (that never seem to go away); Calling you out on choosing to use your real name instead of your YouTube-nickname.

</comment></comment><comment><USER22> A couple of months back I gave my feedback to Vic about how G+ is in a limbo zone between Facebook and Twitter, and that the needs of none of the use cases are met on G+. In his sincere attempt in trying to do his share of keeping the conversation vibrant on G+, Vic would (bad call, in my opinion) post pictures of his kids for thousands of his followers to see and comment on. I think this is where the non-clarity of the platform emerges. First of all, why would you post personal pictures of your family for thousands of strangers to see and comment on? And what do you do with the responses you get? Are you going to read/respond to all? What's the point of someone saying 'awww' or asking you a personal question, to which a response is not really warranted - as the askers are complete strangers. A lot of people follow others on G+ to get professional insights (as in this case) and Vic's usage of the platform as an example confuses the value proposition. My 2c.

</comment><comment><USER23> Why would someone leave a company immediately if it was under good terms? Or is it just the case that this wasn't public until today?

<comment><USER24> Because any more time the person remains there is giving information to a potential competitor (and there's no point staying if you don't want to be there anymore)

I think Marissa Meyer gave Google a half hour notice.

<comment><USER13> Marissa resigned by e-mail and just didn't come into work that day.

</comment></comment></comment><comment><USER25> 370 million monthly active users. I wonder how many of those interact with Google+ by mere accident. Personally, the only time I post stuff on G+ is when I'm using another Google service (e.g. Youtube) and they post it to my G+ stream, often without my knowledge or consent.

<comment><USER19> "We've heard that there were tensions between Gundotra and others inside the company, especially surrounding the 'forced' integrations of Google+ into products like YouTube and Gmail. Apparently, once each of those integrations was made, they were initially being claimed as 'active user' wins until Page stepped in and made a distinction."

[http://techcrunch.com/2014/04/24/google-is-walking- dead/](http://techcrunch.com/2014/04/24/google-is-walking-dead/)

</comment></comment><comment><USER26> I don't understand why people have to try and read so much into someone leaving a company. High-ranking execs and employees change jobs all the time for numerous reasons.

<comment><USER27> They really don't. What you just wrote is like saying "This is nothing out of the unusual. Cows turn themselves inside out all the time"

([http://www.southparkstudios.com/clips/149573/inside-out- cows](http://www.southparkstudios.com/clips/149573/inside-out-cows))

<comment><USER26> They really do. Anybody who's been at a big company sees it all the time. Most don't make news stories because they aren't at a sexy company like Google, leading up a division that's well-known among consumers.

You wouldn't hear about something like the head of fraud detection at American Express leaving his job. I've seen it before (not at Amex, but other large companies).

<comment><USER19> That's only because you don't read creditnews.com.

When a major exec leaves in my industry, everyone is talking about it on Monday, and lawsuits often ensue if they end up at a competitor.

<comment><USER16> non-competes are void in California.

<comment><USER28> only up to a certain seniority level

<comment><USER29> [citation needed]

There are things execs do that line employees don't that can presumably make a CA noncompete binding, like, for instance, accepting significant consideration specifically in return for a noncompete. But I don't believe seniority is itself a factor that can make a noncompete binding.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> _"I'm also forever in debt to the Google+ team. This is a group of people who built social at Google against the skepticism of so many."_

Seems like the skeptics were right, no? And this is coming from a big fan of Google. Great company, but this didn't work out. Interesting that they give Vic credit for Circles. I thought it was someone else's idea, no? Great idea, they just didn't follow up on it.

</comment><comment><USER31> IMHO Google+'s principle problem is that it's multiple efforts all under the same name umbrella. This is confusing to users and seems to have been confusing to Google.

It's a longer-than-twitter public broadcast messaging system/social network/photo sharing/single sign-on/half a dozen other things.

There's some great ideas in there. Having a subscription style feed of people I want to follow, and their long-form posts (including deep linking) is much more interesting to me that twitter. There's been some absolute gems posted on g+ that simply can't be represented on Twitter. But it falls down because all these important thoughtful posts are buried in my regular social feed.

Everybody seems to like the circles ideas for organizing our connections, that's a great idea I'm surprised still hasn't been really replicated by FB. But then I can't assert different public names/faces to different circles. So my work circle sees me the same way my demoscene friends. But I'd rather use a formal identity for my work friends and a goofy presentation of myself in the demoscene (with an old crazy picture of me from a party). But I really can't. Unifying my identities, along with my logins, wasn't a good idea. And thus I don't really use g+ for social network stuff because neither I nor most of my contacts don't really want to pay the switching cost from FB/linkedin/whatever else. So literally the major initial message for what g+ is when it was launched, I almost entirely don't use or get anything out of. I say this as somebody who really doesn't enjoy FB all that much, but recognize its importance in connecting me to people I know and want to keep in touch with.

and it goes on and on. Lots of good ideas, mucked up by bad execution and a muddled vision that doesn't map well to most people's needs. It seems like the pieces of the product that are the best bits, are the ones that are not as deeply buried into the morass. Hangouts is pretty good for example and usually works like I want it to (I usually only message people). But now I hear voice, which I use all the time, is about to get bungled up with hangouts. I bet I'll hate whatever the integration looks like. There are _tons_ of people I use voice with that I have absolutely no desire to tie up with my google+ identity.

The integration is too tight. Rather than being a bunch of well branded products, all under a unified umbrella, it's like a bunch of products were stuck in a blender, ground up and then half-baked into a some kind of...whatever it is.

I think if you can't point at a product and describe in a brief sentence, it's too big of a concept and that will start infiltrating your development of the product. What is google+?

Why not "google+ personal news" and "google+ social network" and "google+ chat" and whatever else? Each of those is focused and simple and disjoint enough not to cause confusion.

<comment><USER7> Circles seems like a good idea - but I find I don't use them.

<comment><USER32> I agree, circles mandate additional cognitive load. They should've been implemented such that each user had 2-3 circles max, like "Work", "Friends", and "Family", and it was almost always invisible (meaning you'd almost always share with all). Prompting the user each time they want to post something and making them choose from their 8-10 circles greatly increases the friction of posting.

<comment><USER33> That, and the decision is one-sided. Say I want to post something publicly about some new technology. Do I post it publicly and have it go into my family's feeds where it will be considered akin to spam? What if one of my friends actually _is_ interested in new tech but I don't know it?

I get that it would be an added layer of indirection, but to allow each user to have multiple subject personas for posting and let others subscribe to said personas might have been more useful. As it stands, I err on the side of caution and post privately to the people I can best guess might be interested.

<comment><USER34> I think it would work better one-way if you could separate "visible to" and "posted to". I would like to post to "public" and "techy people", which would mean it appears in the feeds of people I don't have in my circles who have me in theirs, and people I have in my tech circle. It would like it to still be visible to people in my other circles if they went looking for it, but it wouldn't appear in their feeds.

</comment></comment></comment></comment></comment><comment><USER35> Google+ has it's users, but to me it always seemed like the ultimate example of building something no one actually wanted.

</comment><comment><USER36> Reminds me of the post on "Mac Pravda" after Steve Jobs shitcanned the Newton division. The Google+ version would go something like this:

"Maximum Leader Page declares total victory of Google+. Workers to report to railyard at dawn for reassignment."

</comment><comment><USER37> Google+ is to Facebook, what Bing is to Google Search.

It wasn't really going to work, much like the Bing. There were simply too late to the party as were Microsoft or Yahoo to 'modern' search engine.

I only hold Vic responsible for messing too much with the web design of Google+. Jesus, no one changes underwear so often as they would UI.

In the end, the failure of missing the social bandwagon solely relies on Eric. Because Vic was working on the mobile side (I think) when Facebook was kicking in.

</comment><comment><USER38> Last week, I've posted this: [https://news.ycombinator.com/item?id=7598111](https://news.ycombinator.com/item?id=7598111)

Last week! :D

</comment><comment><USER39> Personally, I don't think Google+ should be abandoned, but I do wish some of the problems, such as the real name policy, can be fixed.

</comment><comment><USER40> Eric Schmidt said in a December 30, 2013 Engaget interview "my biggest mistake at Google was not anticipating social".

My response at the time: No, Schmidt, your biggest mistake was failing to realize that vast hoards of highly detailed and categorized personal data are not only an asset, but a tremendous liability.

Or as I put it: "Schmidt: My biggest mistake is still not realizing my biggest mistake"

[http://www.reddit.com/r/dredmorbius/comments/1u356d/schmidt_...](http://www.reddit.com/r/dredmorbius/comments/1u356d/schmidt_my_biggest_mistake_is_still_not_realizing/)

</comment><comment><USER41> Oh, good. Vic, please make sure that a) you don't miss the door and b) you take away the comment function of youtube with you.

</comment><comment><USER42> 17 comments (as of this writing), and about 1/3rd are grayed-out due to down votes.

Ergo, there are some pretty strong opinions about Vic.

<comment><USER43> There A LOT of downvoting across all HN threads recently. In every single topic there are comments upon comments that are in gray and barely any actually deserving to be there.

These aggressive downvoting sprees also seem to coincide with that change in HN stewardship from few weeks ago.

<comment><USER44> Your wording suggests that maybe you didn't see sama's announcement about the change we made to count more downvotes [1] or any of my recent comments about it.

People can reasonably differ, of course, but I don't agree that _barely any_ negatively scored comments deserve to be there. I look at all the negatively scored comments, and the vast majority are either not substantive, not civil, or both.

It's true, though, that some substantive, civil comments are getting unfairly faded out. We're asking users to give those a corrective upvote when they see them. This is a longstanding HN practice. It usually only takes one or two corrective votes to get a good comment back to par, so every user can make a difference.

Overall, this experiment appears to have succeeded in addressing the epidemic of highly toxic comments. That was our main goal, because those had increasingly been poisoning HN. That doesn't mean, though, that every other effect has been good. If rallying the community to do more corrective upvoting doesn't turn out to be enough, we'll eventually take other measures.

All: please don't add comments complaining about downvotes, though. It just adds noise.

[1] [https://news.ycombinator.com/item?id=7605973](https://news.ycombinator.com/item?id=7605973)

<comment><USER45> I won't complain about downvotes, but I would like to request a feature. In a manner similar to 'showdead', I'd like to be able to disable graying.

Here's why: when you gray out a comment to the point of illegibility, as is happening more and more, _that only makes me want to read it more._ So I end up paying more attention to downmodded comments, not less. Somehow, I don't think that's what you were going for.

I would rather have the option to judge comments on their content, and not their color.

<comment><USER44> That's a reasonable request. I've added it to our list.

<comment><USER46> Thank you for at least taking the idea under consideration.

I've more than once wanted to create a browser plugin that basically hides the voting system from the person running it. i.e. all comments are the same color, and top level ones are sorted randomly on the page - there are some hot-button issues where such a feature would be valuable.

</comment></comment></comment></comment></comment></comment><comment><USER47> I think had Google taken the approach of 'what do we have that Facebook doesn't?' vs 'what does Facebook have that we can obtain?' would've resulted in a better product (as far as value proposition goes). There was a lot of opportunity to create a unique experience, and that simply didn't happen.

</comment><comment><USER48> When I get notification that one of my friends (who is on Facebook full time) has joined new on Google+ after all these years, that shows that Google+ has failed miserably to reach the mass. I don't use Hangouts these days. Its only Facebook messenger (on Android/desktop).

</comment><comment><USER49> This post was meant to inform of Vic's departure from Google. It suddenly became a slug fest of Google +.

</comment><comment><USER50> I am really curious what he will do next.

I am just a light user of G+, FB and Twitter. That said, I enjoy G+ the most.

<comment><USER51> Xiaomi could do with a social network.

</comment></comment><comment><USER6> "He spent his last hour at the company thanking each Google+ user personally."

</comment><comment><USER52> Sorry if I'm asking a stupid question, but:

How come all these "internal memos" always leak? Is it fine to share an internal email without getting in trouble at a public company?

<comment><USER53> Politics you know the 8th layer of the OSI stack :-)

Normally some one has a line they want to run and have their friends in the media to spin stuff to its the same in politics.

<comment><USER54> I'm laughing so hard at this. I'm definitely stealing this and using this later!

</comment></comment></comment><comment><USER55> Is Vic moving to another company?

</comment><comment><USER56> How is it an "exclusive"? it's all there in public posts:

Vic: [https://plus.google.com/+VicGundotra/posts/MFrDF3W4RJL](https://plus.google.com/+VicGundotra/posts/MFrDF3W4RJL)

Larry: [https://plus.google.com/+LarryPage/posts/A2gm48nzitx](https://plus.google.com/+LarryPage/posts/A2gm48nzitx)

<comment><USER57> The "exclusive" article was posted at 10:16. Larry's post, quoted in the article, was posted at 10:18.

</comment></comment><comment><USER58> _" This is a group of people who built social at Google against the skepticism of so many."_

Well, he does have a sense of humor. They sure built it, I see many obscure names ranking on search engines...only to see an G+ empty page (along with a Youtube one--also empty. Looks like the Android signup process.)

</comment><comment><USER59> There plans to rename the service Google- reflecting to the lack of interest of the public using the service even after forcing youtube users to have an account.

</comment><comment> mauricio-OH Pushed out for sure

</comment><comment><USER60> I guess there are challenges more interesting than cat pictures to be solved elsewhere.

</comment><comment><USER61> G+ failed coz of a simple reason, Hubris.

</comment><comment><USER62> Google tried social without a real name policy (aka Buzz) and it didn't work. Google+ has better content.

<comment><USER63> I don't know how you can compare them. G+ has had a massive support from being tied into every other product, in some cases taking features people already use and making G+ mandatory for continuing to use them. Not to mention getting tied to search such that not having a G+ presence could significantly adversely affect your SEO. Buzz certainly had its problems but it doesn't mean G+ was the right way, or that real names had anything to do with the difference.

</comment></comment><comment><USER64> Can he take Google+ with him!?

</comment><comment><USER65> g+ was garbage from the start and could not compete with facebook. And anyone who used facebook know how trash it is... In terms of UI. But google made it worse experience.

Google will try to recover now :)

</comment><comment><USER66> Yes, "he" built Google+ from nothing.

<comment><USER67> The guy who "built" my house never lifted a hammer. I think our egos can take the abbreviated form of "assembled/managed the team that built G+" in stride. Context, dude.

<comment><USER68> You paid someone to build you a house. Therefore you built the house! It wouldn't have happened without you to pay, would it?

It's not dishonest, it's just shorthand. Context, dude.

</comment></comment></comment><comment><USER69> Gundotra sucked anyway. So does Google+. That's what happens when you "copy" technology, rather than rethinking/innovating. A new player to the space, and they just "copy" \- that sucks. (apologize for my negativity.)

Try Google searching on Vic Gundotra "licking the cookie".

(a metaphor for making a project "his" before others can lay claim.)

"Gundotra, we're told, would "lick the cookie" at Google by putting future products and features into presentations about Google+, long before his teams would be able to get to building them".

[http://www.businessinsider.com/sex-and-politics-at-google- it...](http://www.businessinsider.com/sex-and-politics-at-google-its-a-game- of-thrones-in-mountain-view-2013-9)

<comment><USER39> Yea, I have mentioned this before too and I think this article was submitted to HN.

</comment></comment><comment><USER70> Definition of unintended consequences: I don't instantly recognise the names Eric Schmidt, Larry Page or whoever the other guy is -- I have to look them up, and to be honest I keep mixing up Larry Page and Larry Wall. But I know Vic Gundotra, because he's the wanker who pushed the real names policy and made Google+ the laughing stock among my various communities. "I am a Google employee who likes donuts", indeed!</comment>


Ukraine soldiers bombarded by 'pinpoint propaganda' texts - <AUTHOR> https://apnews.com/9a564a5f64e847d1a50938035ea64b8f/Sinister-text-messages-reveal-high-tech-front-in-Ukraine-war <comment><AUTHOR> What I don't get is why soldiers are allowed to have their mobile phones on. Presumably they are being located and counted by their phones too.

There were claims last year that Russian malware targeted a Ukrainian artillery app and that this lead to 80% artillery losses. However, some doubts have been cast: [https://medium.com/@jeffreycarr/the-gru-ukraine-artillery- ha...](https://medium.com/@jeffreycarr/the-gru-ukraine-artillery-hack-that- may-never-have-happened-820960bbb02d)</comment>


It's Way Too Easy to Hack the Hospital - <AUTHOR> http://www.bloomberg.com/features/2015-hospital-hack/ <comment><USER3> I've been in Healthcare IT for a decade and a half or so, and I think there's definitely a reckoning coming with regard to the lapses in security.

I think honestly, the only thing that's kept this from being a problem with greater consequence is that to date it hasn't been clear that there's a real path to monetization of health data. It's been a lot more profitable to chase down credit card #'s and mass email/password combinations that lead to banking access.

I've long wondered when a solid monetization strategy for health data would show up and we'd see a quick rush to target these datasets. Trends that I see that make me think we're getting closer:

1\. Systems are increasingly net-connected, obviously. In some ways it's increasing security (literally most hospitals I've been in you could plug into any ethernet port in the building and be on a network where pretty sensitive data is sent in the clear), but it's making these systems available to a larger number of interested attackers

2\. Patients have accounts now. Health data is suddenly a not-insignificant source of email/password combinations for patients (previously just employees). Pretty reasonable to expect that health systems may be the source of future Gawker-style breaches for collecting poorly protected user credentials that can be used elsewhere.

3\. The uptick and cost-effectiveness of encryption-ransomware, personal and corporate. It's been interesting to see cases where the data itself isn't monitezed because it has some broad market value, but solely by threatening the owners with it's release or exposure. I won't be surprised if Healthcare organizations or individual patients find themselves victims of extortion either by threatening to publish sensitive health data, or to destroy it.

There is (finally) an extra-linear increase in attention to this issue in Health IT, but there's also quite a large backlog of debt and an enormous number of systems deployed that were built for a different reality than current exists.

<comment><USER4> What bothers me is that I was under the impression that if you have a HIPAA compliant information system (software or hardware) that none of these criticisms would be true, yet we know that this is essentially the norm and that healthcare providers routinely ignore the problem. What's going on such that hospitals have the worst of both worlds - expensive devices subject to incredible amounts of regulation to safeguard patients but demonstrably insecure systems? I'd hate to think of what would happen if we had no regulations whatsoever, but on the other hand the current effective infosec status of the healthcare industry seems to be not very far off from as if they had no regulations.

Did I miss something in HIPAA about "don't make it easy as hell for any random person to come in and steal patient data or command other HIPAA compliant systems to act as an agent?"

<comment><USER5> > What bothers me is that I was under the impression that if you have a HIPAA > compliant information system

The idea of a "HIPAA compliant information system" is largely empty marketing speak (less so in terms of the Transactions and Code Sets rule than the Privacy and Security rules); HIPAA and its implementing regulations do not establish specific standards for information systems (in privacy/security terms), it sets specific standards for what organizations holding PHI must do, and most of the technical features of software related to those functions are unspecified and, to the extent that there are requirements, whether the software as used is compliant will be highly dependent on the relation between the policies, specific functions performed by the organization, and how the software is used.

At most, software has features which _facilitate_ compliance with some parts of HIPAA, but you can't just drop in a piece of software and achieve turnkey HIPAA compliance.

</comment></comment></comment><comment><USER6> Many people throw hospital security into the pile of "well, lots of people don't care about infosec!" In my opinion, this stance is incorrect.

I've performed security assessments against many different industries, including banks, large enterprise, barely-funded startups, nuclear power facilities, law firms, hospitals, and more. In each of these fields, you see the "good guys" and the "bad guys" in terms of IT security strength. In hospitals, though, _the whole field_ is terrible. The best of the best -- high-tech facilities that actually care about security -- are still doing terribly compared to the average large enterprise.

Health records are becoming more valuable, and not just because of blackmail. Insurance fraud and identity theft are feasible if you've stolen someone's health records, and the information stored within is only getting broader.

Hospitals wouldn't let their medical tech slip this far. They shouldn't let their security slip, either.

<comment><USER7> There are many forms of extortion. Until recently, health care insurance coverage and care were one primary route exercised by institutions in the U.S. (Just one example: Roll over and take it at work, or you'll lose your health care.)

The ACA was supposed to help address that, but, entering its third year, I at least see significant signs of its being weakened.

So... it's not just black hat bad actors. The proliferation of this data, by means legal, or gray, in addition to black, threatens a broad and diverse swath of those who have... less than perfect statistics.

Not just in health care, but in general, I've observed a lot of apathy towards security because corporations and large institutions serve a very significant role in _diluting responsibility_ and repercussions. No one person -- at least and especially and including those with actual power to deploy resources against problems -- is really on the hook. Even in the C suite. Hell, it seems that "taking the blame" has become a significant component of such roles: You parachute out, and someone picks you up to play a repeat performance a year or two down the line.

No one really answers. And there is a lot of pressure -- below the surface -- to continue making this information more transparent and readily accessible. "Black hats" become a straw man for an industry that, in many respects, in the whole is actually trying to move in the opposite direction.

With such discontinuity, is it any wonder that the results are a disaster?

</comment></comment><comment><USER8> Forget about hacking devices. We once walked into a hospital to talk to nurses and show them a tablet app to access notes lab results etc.

The scary part was that the server room with the PACS and everything else in the building was unprotected with unlocked doors and nobody particularly caring we were there.

Imagine walking into a random law firm and walking into the server room with the ability to copy all data from all the clients.

Not cool, at all.

<comment><USER9> Most PACS get data from devices and send it to workstations unencrypted. The security model implemented on them is usually no more than a white list of IP addresses the PACS will talk to. (To be fair, many of the servers have better security available now, but hospitals haven't taken advantage of it). Combine that with insecure, unsegmented networks, and hackable WiFi, and you don't need physical access to the server room.

</comment></comment><comment><USER10> "I appreciate you wanting to jump in," Rick Hampton, wireless communications manager for Partners HealthCare System, said, "but frankly, some of the National Enquirer headlines that you guys create cause nothing but problems."

This right here is the problem - Researchers unveiled serious threats in the hardware - the ones described in the article could all be used to kill. And the response to that? "Shut up, you're scaring people".

Those headlines should be scaring people because they are scary!

<comment> FLUX-YOU You won't convince these guys, they're mostly jackasses. The only thing that will get through to them is something that pulls their negligence and horrid practices out into the light.

You need headlines to break them. They will not do the right thing until they have to, and the FDA isn't going to get that rolling.

I'd want good disclosure practices if someone was targeting my products, but I'm also not stubborn and defend terrible products with "Well, no one has been hurt yet!"

<comment><USER11> Wait until one of them (or their children) is hooked to a machine his company made, then administer a nearly lethal dose?

Is it justified if the wake-up call saves thousands of lives down the line...

</comment></comment></comment><comment><USER12> Elliot in the Mr.Robot tv-series explains why [https://www.youtube.com/watch?v=g6gG-6Co_v4](https://www.youtube.com/watch?v=g6gG-6Co_v4)

</comment><comment><USER13> _Basically, they would log on from their control server in Eastern Europe to a blood gas analyzer; they'd then go from the BGA to a data source, pull the records back to the BGA, and then out. Wright says they were able to determine that hackers were taking data out through medical devices because, to take one example, they found patient data in a blood gas analyzer, where it wasn't supposed to be._

Not to minimize the problems with the BGA or with other devices, but this points at least as much to a problem with the "data source", which is left unidentified in TFA. One reason the BGA wouldn't be worried about protecting PII might be that... it should never have PII in the first place. There's a HIPAA violation somewhere, but I don't think it's in the BGA, and the BGA isn't the only host that's assuming a safe network.

Target, Home Depot, etc. have been justifiably criticized for operating their POS devices as if firewalls could possibly be sufficient to protect a large network. Hospitals might consider themselves more noble than mere stores, but it doesn't make a difference to a hacker.

</comment><comment><USER14> Few people care about IT security; it's not just in healthcare. It doesn't matter how high the stakes are, for some reason people just don't feel threatened. To see the pattern think of the attitude in almost every context you can think of:

* Business

* Individual citizens, who seem to care little about the confidentiality of their personal information

* Government

* Developers of most software. Even RSA was hacked.

* Even national security organizations: The OPM hack; Snowden walking out of the NSA with all that secret data; CIA leaders taking home top secret information, etc.

Perhaps it's human nature. On the other hand, when it comes to physical security, people often tend to overreact.

</comment><comment><USER15> Good god that is an ugly article. I thought the page didn't load properly at first.

<comment><USER16> I think it's great.

</comment></comment><comment><USER17> I've been working in this sector for a year and this certainly aligns with everything that I've seen so far.

Luckily some vendors are starting to take security very seriously (by hiring people like me, for example).

</comment><comment><USER18> I think there are two components to this:

First, HIPAA requirements are in part IT requirements. Every single hospital works really hard to comply with these, because there are huge fines if they don't. Some of the problems with hospital IT security might be due to defects in the already quite onerous HIPAA specification.

The second is that hospitals are extremely low-margin institutions. Most hospitals (even the really big ones) just break even, especially if they're teaching hospitals or serve poorer areas. IT security doesn't really produce any revenue.

I agree it's a problem. This needs a systemic solution–who would pay for IT fixes? Reimbursement is declining and government payment sucks. Most hospitals are in crisis mode as it is.

<comment><USER19> Hospitals are low margin/break even because they choose to be - but that's another topic.

>IT security doesn't really produce any revenue.

Hospitals (and the health care industry at large) has been drowning in billions-with-a-B federal and state dollars since ARRA. All in the name of "meaningful use" of health information technology. HIT is very much a revenue model for hospitals.

[http://healthaffairs.org/blog/2015/03/04/where-is- hitechs-35...](http://healthaffairs.org/blog/2015/03/04/where-is- hitechs-35-billion-dollar-investment-going/)

[https://www.health.ny.gov/technology/efficiency_and_affordab...](https://www.health.ny.gov/technology/efficiency_and_affordability_law/)

[http://www.hrsa.gov/ruralhealth/resources/healthit/](http://www.hrsa.gov/ruralhealth/resources/healthit/)

[http://www.ehrinstitute.org/articles.lib/items/Grants-for- EH...](http://www.ehrinstitute.org/articles.lib/items/Grants-for-EHR-Imple)

[http://calhipso.org/news-and-updates/more- than-1-2-million-i...](http://calhipso.org/news-and-updates/more- than-1-2-million-in-affordable-care-act-funds-granted-to-calhipso-partners/)

###

* re: operating margins TIME magazine puts margins at an average operating margin of not-for-profit hospitals is 11.7 percent.

According to the AHA Annual Survey, the average operating margin of all hospitals was 5.5 percent in 2011.

So, the industry themselves declare 5.5% margin for non-profit hospitals, a healthy margin for any non-profit entity.

<comment><USER5> > Hospitals (and the health care industry at large) has been drowning in > billions-with-a-B federal and state dollars since ARRA.

For the US Healthcare industry, billions-with-a-b (for the period since ARRA in 2009) in public funds isn't enough money to drown in. Its not even enough money to get noticeably damp -- its a $3.8 _Trillion_ (annually) industry (something like, IIRC, 40% of which is public funds, so its not even all that big of a delta in _public_ funds.)

</comment></comment></comment><comment><USER20> In a sense the name says it all: HIPAA's about Portability and Accountability, less about security.

I worked on a few security consulting projects in healthcare. The HIPAA security rule is way more vague about actual controls than a rational person would assume; much more than analogous regulations on financial data (e.g. PCI-DSS). The HITECH amendment added a lot of breadth regarding which parties must comply, but did little to proscribe specific controls. Most providers, contractors, etc. use a framework called HITRUST that attempts to identify and map actual security controls to HIPAA, but even that is not super actionable.

One of the hardest problems to solve is the immediate criticality of patient data. You absolutely cannot have someone die because a nurse or doctor forgot their password and couldn't look up medical history. Makes practitioners resist adoption, and you end up with "break the glass" (emergency security bypass) functionality on a lot of sensitive systems/data.

<comment><USER21> HIPAA does require the data to be stored in a secured way. It also requires a certain level of security to get to the data. Don't let the name fool you.

Your second point is extremely valid. You can't really restrict a medical professional from looking up health information. It could cause loss of life. Mostly, a large organization can't be expected to lock down the data of an individual.

What you can do is log the access (GxP regulations). This means that you will know who accessed the data after the fact.

<comment><USER5> > HIPAA does require the data to be stored in a secured way.

But its extremely unspecific about what that means.

> It also requires a certain level of security to get to the data.

Less so than you probably think. It has vague high level standards, under which are lower-level implementation specifications (which _still_ tend to be somewhat vague) which may be required or "addressable", which basically means that organizations are required to review whether they are appropriate; the only technical implementation specifications that are required in the security rule are having unique user IDs and having emergency access procedures.

</comment></comment></comment><comment><USER22> The idea of setting up an open hardware lab for these devices, and some kind of bake-off, is awesome.

Also, I wish someone could do a medical device network security system -- it really isn't the core competency of any of the hardware vendors, and yet is something you can't get wrong. The public protocols (DICOM, HL7, etc.) are at best baroque and don't include the details which matter to security. I wish this didn't have to be a company -- it really could be something funded by NIH or a consortium of device vendors or medical institutions -- but it probably has to be in order to be effective. There's a need for an open standard for medical device security over top of all this, but rather than just publishing a standard, it would be easier to provide working end to end network from device to information system.

</comment><comment><USER23> My university IT (which also runs a huge hospital network) seems to have no idea how to secure their data. Their solution is to encrypt everything, as if disk encryption and VPNs are enough to prevent data theft. They rolled out a csmpus-wide VPN requirement recently based on a Juniper networks system - <USER2> exact same system that led to the Anthem data breach that lost 80 million patient records (because Juniper had a slow patch cycle after Heartbleed). No two-factor auth on the VPN, so any one of 50,000 employees with phished credentials could give an attacker VPN access. Meanwhile all the actual patient databases are old, leaky systems they seem uninterested in upgrading. Sheer lunacy.

<comment><USER24> You don't have to hack the system. You can literally just look at trash cans and you will probably find some medical records. I seriously doubt most people shred the document... criminals can do inside job, and this happens without anyone even knowing. As a nurse you can probably download all patients records. I don't know if anyone is required to scan some temporary access code to get records. I do know there are logs, but they are more for compliance than anything IMO. In fact, in many IT organizations, I seriously doubt anyone even look at logs. They are there for compliance, mostly mean when shit happens, there is evidence. Aftermath. This is why AI can help in intrusion and anomalies detection (understanding context). It is like talking about virus and malware detection...

Also, a lot of the two-auth out there has the option to Remember This Computer so if the computer is hacked you are doom. I am interested in what constitutes frequent-access data access and infrequent-access data because then you can classify behaviors. Logging, encrypt in transits and at rest are required, but I doubt most of the data are encrypted in transit (probably just proxy over 80 and reaches the terminal screen).

</comment></comment><comment><USER25> This is, to a large extent, scaremongering. While there are some valid points made in the article, the article fails to differentiate between security problems that can be exploited by trolls or single, untrained individuals, and ones that take a powerful team working on behalf for a government or other such group to exploit. It's the difference between the hospital being defended against your average thief, and being defended against a strike squad of ninjas. Despite this, the article does make good points when it comes to the lack of worry about the problems they found. Even though these vulnerabilities may be over hyped, they are real and the lack of focus on these vulnerabilities is chilling. The real underlying problems for this stem not from an industry that leaves bugs in applications designed for high security, but in the fact that the industry doesn't realize that security needs to be the default, whether or not you see exploits being used.

</comment><comment><USER26> Medical services is one of the worst sectors with very poor 'right' investments in technology.

There are many gaps while some significantly standout compared to others.

* As highlighted in this article, Security is a huge issue. Given the sensitivity of the data, the sad state of infrastructure does not do any justice.

* A lot of the infrastructure is still paper based. The digital revolution is way behind its time in this sector.

* Medical sciences which is supposed to revolutionize has most of its spend in regulations rather than technology. The advancements in science are excruciatingly slow. Drug discovery has slowed down tremendously.

Not to mention, the poor patient-experience and lack of reach of medicine to the poorest of society.

<comment><USER27> It's pretty funny that on one hand you say security is a big issue but with the other you are frustrated they haven't moved away from paper fast enough. Paper based systems when used correctly can be very secure. That being said they aren't without their issues e.g. [http://www.databreachtoday.com/800000-penalty-for-paper- reco...](http://www.databreachtoday.com/800000-penalty-for-paper-records- breach-a-6982)

<comment><USER26> Security is of paramount importance however never at the cost of digitization.

Imagine two scenarios

1\. Patient diagnosis delayed or incorrect, if doctors cannot view the blood reports for next 21 days or doctor makes mistake since he cannot process data like a computer would.

2\. The icu system got hacked on which someone's life depended.

I don't think you could choose one over the other.

A lot of the time, we trade off between convenience and security. However that is a prudent and deliberate choice.

What I see more and more happening is a reckless and inadvertent choice.

Martin Fowler presented this in his technical debt quadrant. [http://martinfowler.com/bliki/TechnicalDebtQuadrant.html](http://martinfowler.com/bliki/TechnicalDebtQuadrant.html)

</comment></comment></comment><comment><USER28> At one of the hospitals I work at they have thousands of computers still running Windows XP and IE 6 that are insecure. It would be very easy to hack.

<comment><USER29> I work at one of those sites (XP and IE 8). That's the standard for over 100,000 employees in our province.

</comment></comment><comment><USER30> AFAIK drchrono is the only major electronic healthcare record provider that has a bug bounty program.

</comment><comment><USER31> The 'glitch' CSS on this page is a great touch! Good work, Bloomberg!</comment>


Top Republican Steve Scalise wounded in multiple shooting - <AUTHOR> http://www.bbc.com/news/world-us-canada-40275055 <comment><USER2> Some other reports are saying the gunman made sure to ask if they were republicans or democrats. He wanted to kill republicans. [http://www.telegraph.co.uk/news/2017/06/14/shots-fired- repub...](http://www.telegraph.co.uk/news/2017/06/14/shots-fired-republican- party-baseball-practice-near-washington/)

Very disturbing, political violence and violent rhetoric is escalating.

examples: Loretta Lynch calling death and blood in the streets [https://www.youtube.com/watch?v=t9bquunDh1Y](https://www.youtube.com/watch?v=t9bquunDh1Y) is now quickly going viral in various republican circles.

also the trump assassination in the caesar play and kathy griffin trump beheading are awful.

[http://www.realclearlife.com/theater/move-kathy-griffin- watc...](http://www.realclearlife.com/theater/move-kathy-griffin-watch-trump- get-assassinated-reworking-shakespeares-julius-caesar/)</comment>