Insecurities in the Linux /dev/random - <AUTHOR> https://www.schneier.com/blog/archives/2013/10/insecurities_in.html <comment><USER2> This is an interesting paper that was discussed widely on Twitter a few months back. It includes a very useful breakdown of the Linux kernel CSPRNG starting on page 17. The attacks the paper describes start on page 22. The front part of the paper is dominated by a discussion of the theoretical modeling of CSPRNGs, in part because the theoretical foundations for CSPRNGs and their interactions with applications are not well documented.

The most important bit of information you probably want to know about this paper is that it is modeling the security of a CSPRNG when its entropy inputs are entirely controlled by attackers. For instance, one of the attacks involves tricking the entropy estimator into believing it's seeding itself with high-quality random data when that data in fact has no entropy.

This is not a realistic attack scenario for the vast majority (maybe all) of applications.

Having said that, the Linux kernel CSPRNG doesn't (as far as I know) have a particularly well formalized design. There are good CSPRNG designs out there; for instance, the BSDs use Yarrow, and Ferguson followed that design up with Fortuna, which dispenses with the need for entropy estimators altogether.

<comment><USER3> Wouldn't this in fact be completely unrealistic? If attackers have full control of entropy inputs, they can just hook up a very high quality randomness source, but record every single bit before it gets to /dev/random.

Of course, why bother with that if you have that kind of access?

</comment></comment><comment><USER4> So I'm the maintainer for Linux's /dev/random driver. I've only had a chance to look at the paper very quickly, and I will at it more closely when I have more time, but what the authors of this paper seem to be worried about is not even close to the top of my list in terms of things I'm worried about.

First of all, the paper is incorrect in some minor details; the most significant error is its (untrue) claim that we stop gathering entropy when the entropy estimate for a given entropy pool is "full". Before July 2012, we went into a trickle mode where we only took in 1 in 096 values. Since then, the main way that we gather entropy, which is via add_interrupt_randomness(), has no such limit. This means that we will continue to collect entropy even if the input pool is apparently "full".

This is critical, because _secondly_ their hypothetical attacks presume certain input distributions which have an incorrect entropy estimate --- that is, either zero actual entropy but a high entropy estimate, or a high entropy, but a low entropy estimate. There has been no attempt by the paper's authors to determine whether the entropy gathered by Linux meets either of their hypothetical models, and in fact in the "Linux Pseudorandom Number Generator Revisited"[1], the analysis showed that our entropy estimator was actually pretty good, given the real-life inputs that we are able to obtain from an actual running Linux system.

[1] [http://eprint.iacr.org/2012/251.pdf](http://eprint.iacr.org/2012/251.pdf)

The main thing which I am much more worried about is that on various embedded systems, which do not have a fine-grained clock, and which is reading from flash which has a much more deterministic timing for their operations, is that when userspace tries to generate long-term public keys immediately after the machine is taken out of the box and plugged in, that there isn't a sufficient amount of entropy, and since most userspace applications use /dev/urandom since they don't want to block, that they end up with keys that aren't very random. We had some really serious problems with this, which was written up in the "Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices"[2] paper, and the changes made in July 2012 were specifically designed to address these worries.

[2] [https://www.factorable.net/paper.html](https://www.factorable.net/paper.html)

However, it may be that on certain systems, in particular ARM and MIPS based systems, where a long-term public key is generated very shortly after the first power-on, that there's enough randomness that the techniques used in [2] would not find any problems, but that might be not enough randomness to prevent our friends in Fort Meade from being able to brute force guess the possible public-private key pairs.

Speaking more generally, I'm a bit dubious about academic analysis which are primarily worried about recovering from the exposure of the state of the random pool. In practice, if the bad guy can grab the state of random pool, they probably have enough privileged access that they can do much more entertaining things, such as grabbing the user's passphrase or just grabbing their long-term private key. Trying to preserve the amount of entropy in the pool, and making sure that we can extract as much uncertainty from the system as possible, are much higher priority things to worry about.

That's not to say that I might not make changes to /dev/random in reaction to academic analysis; I've made changes in reaction to [2], and I have changes queued for the next major kernel release up to make some changes to address concerns raised in [1]. However, protection against artificially constructed attacks is not the only thing which I am worried about. Things like making sure we have adequate entropy collection on all platforms, especially embedded ones, and adding some conservatism just in case SHA isn't a perfect random function are some of the other things which I am trying to balance as we make changes to /dev/random.

<comment><USER2> Nit: the cold start entropy problem (specifically in the Linux kernel CSPRNG) was published way before Heninger; Zvi Gutterman presented it at Black Hat in 2006. "P's and Q's" got a lot of publicity, but could some of that exposure have been mitigated had earlier reports been acted on? (I seriously have no idea and am just asking).

The term for the "academic analysis" of "recovering from exposure of state" is "forward secrecy", and from what I can tell the whole of the crypto literature that discusses CSPRNGs in any depth seems to be unified on the opinion that forward secrecy is an important property for a CSPRNG to have.

(But that's a reaction to your comment, not your opinion of the paper, because I agree that the attacks here don't seem very practical.)

What do you think of Ferguson's belief that entropy estimators are a flawed design approach for CSPRNGs? FreeBSD uses Yarrow for this, which has two benefits --- first, it loses the silly notion of a "urandom" that is somehow marginally less secure than "random" but is in practice not actually less secure, and second, it comes from a design that has a formal research track record, that people can analyze from the paper and not solely by reversing code.

(I sound snippy but am in fact thrilled that you took the time to comment, and thank you).

<comment><USER4> Yes, I'm aware of the concept of forward secrecy, and the formalism around it. Without intending to sound snippy myself, I think there is a tendency for academicians (whose promotion/tenure prospects are directly related being able to generate papers that get published in high impact journals) to be biased in favor of those things for which formal models can be created. We saw that for example in the academic focus on formal proof of correctness of programs, which at this point is recognized as a blind alley, as opposed to a more engineering approach of using tools like valgrind and lint and static program analysis. So I am a bit unpersuaded regarding the academic focus on forward secrecy. It's something that if we can add to a design, I'll certainly do it --- and indeed there is a Yarrow-style "catastrophic reseeding" in the /dev/random design.

We have been moving away from using entropy estimators in /dev/random, actually. We still use it for certain entropy sources, most notably for the keyboard and mouse inputs, where it is useful for filtering out event timings caused by the user leaning on the key and triggering autorepeat. But these days we have a "fast mix pool" (which is per-CPU) where we sample on every single interrupt, and then down-mix from there to much larger entropy pool, and the bulk of the entropy, especially on servers, comes from the fast mix pool.

I tend to focus much more on engineering/social aspects; for example, the fundamental cause of the failure found by the Mining Your P's and Q's paper (as opposed to the hypothetical failures of things like the forward secrecy papers), was people disabling the entropy collection in many/most device drivers because they thought it was too slow for high speed devices, in particular network devices. They made arguments that it was because an adversary could monitor the packet arrival times on the Ethernet (which is not true in a switched fabric anyway, and if the attacker is sitting at Fort Meade, or even at AT&T's data center, they won't know about your local area network), but that was just an excuse; the main reason was engineers who were worried about performance.

So using a fancy "approved by academics" design which uses crypto hashing to mix entropy into the mixing pools may be pointless, if downstream kernel hackers disable the entropy collection "because it's too slow". We now have something hard-wired into the main interrupt code path (it's now no longer optional, so it can't be configured on or off on an individual device driver basis), and I've gone through a lot of work to make it be extremely fast, including using per-CPU pools, worrying about cache effects, etc. These are concerns that I'm sure would never help a professor achieve tenure, but as a practicing engineer, I've been painfully aware about how important these sorts of concerns really are.

Don't get me wrong; I do read the papers from those academics who try to analyze /dev/random, and I appreciate their attention. But I do come from a someone different perspective than they do, and over the years I've learned that it's not wise to blindly take the advice of every single bug report that you get (and I consider papers to be simply formal bug reports :-) since sometimes you can't satisfy every single user and every single bug report.

<comment><USER5> Oh, cool! Have you considered making changes to the interface that's presented to userspace? As a crypto library author, I have a few gripes about the current interface:

1\. The distinction between /dev/random and /dev/urandom is silly. On a machine that's been been collecting entropy for weeks, /dev/random will still block after reading a few bytes. On the other hand, on an embedded device that's just left the factory, /dev/urandom will happily return "random" bytes that aren't. The result is that /dev/random is unusable for anyone except cipherpunks, and /dev/urandom is unsafe on embedded devices.

2\. /dev/urandom is slow, so libraries (including mine) all end up shipping their own PRNG implementations in userspace, where they're susceptible to threading issues, having their entire state duplicated by fork(), "//MD_Update(&m,buf,j)", etc. It's surprisingly difficult to do this correctly in a user-space library, and I bet the NSA and others are having a lot of fun at the expense of our users.

What I'd like is a single, fast, trustworthy /dev/?random device that is good enough to obsolete user-space PRNGs entirely. This means it would have the following properties:

1\. It blocks until the kernel decides that it can safely generate cryptographically-strong random bytes (i.e. first boot), and never blocks again unless something extraordinary happens (i.e. it's a VM guest that's just been cloned, or something). The idea would be that it never produces output that isn't cryptographically strong, but is otherwise reliable enough that applications can behave as if it never blocks.

2\. It produces output so quickly that userspace programs never have an excuse to use anything else. i.e. Its speed should be comparable to what you get using AES-NI in counter mode (I know you don't like Fortuna's entropy pooling, but its output-side PRNG is exactly what you'd want here.) Ideally, this could be fast enough that developers wouldn't even need to distinguish between "random numbers" and "cryptographically-strong random numbers"\---just use it everywhere, even if you might otherwise use Mersenne Twister.

TL;DR - I want a faster, reliable, trust-inspiring /dev/?random that obsoletes all user-space CSPRNGs and possibly all user-space PRNGs.

I've been tempted to write something like this myself, but from my casual reading of the lkml archives, it hasn't been clear whether you were actually interested in RNG patches like this. Are you?

<comment><USER4> Why do you need so much random numbers such that /dev/urandom is too slow for you?

There are plenty of uses of randomness. Let's look at some of them:

1\. Monte Carlo Simulations

2\. Wiping disk files that might contain sensitive information.

3\. Padding in crypto applications

4\. Initialization Vectors (IV's)

5\. Session keys / D-H key agreement

6\. Long-term keys for users

7\. Country-level TLD keys for things like DNSSEC

These uses have been rank ordered roughly in order of cryptographic strength that might required. Very often, I've found that people who are complaining about the speed of /dev/urandom are using it for something that it wasn't designed for; for example, "dd if=/dev/urandom of=/dev/hda" to wipe a disk.

And similarly, for people who insist that there is no good difference/distinction between /dev/urandom and /dev/random, they are only thinking of their use case, and/or they aren't considering that there might be a difference between generating a long-term public key for GPG (which today tends to use /dev/random for this purpose, and I think rightly so), and generating a one-time session key when encrypting a message using GPG. Since you only do the first once, a bit more inconvenience might be tolerated by the user. (Today this takes about ten minutes on a laptop, and part of the reason for this is that Chrome is positively profligate with how it uses randomness, including a 32k read from /dev/urandom[!] at startup, and this is draining the entropy available for /dev/random, which slows it down significantly. I have a change pending upstream which time-limits the amount of entropy that can be drawn from the input pool to the nonblocking pool to protect our entropy from abusive users of /dev/urandom, and I have on my todo list tracking down some chrome developers to figure out what the heck they are doing with all of their demands on /dev/urandom.)

The reality is that strong random numbers is a precious resource, and you can't use it willy-nilly. Furthermore, the strength of random numbers is a continuum; it is not a binary "strong" vs. "not strong" distinction. I'm sure it would be very convenient for userspace programmers to be able to assume that randomness is always freely available, and that it only comes in two flavors, "insecure" and "secure", but that's not the way the world works.

Even in the case of hardware random number generators, there are tradeoffs. This is why future Intel processors will be making a distinction between RDRAND (for which you can't assume that two 128 bit RDRAND outputs, when put together, will give you 256 bits of entropy), and RDSEED (which does have this guarantee). And of course, there is also the tradeoff between the auditability of /dev/random and the non-auditability of something which is locked in a complex piece of Silicon.

TL;DR. I'd like to have a Personal Gulfstream Jet, and enough money that it's not a big deal to consider a $12 million dollar home in La Jolla to be teardwon fodder. But sometimes reality intrudes on your dreams/fantasies....

<comment><USER2> This is a great comment, but I disagree with it.

The hierarchy of secrets you've come up with sounds useful, but in practice:

* An attack based on entropy on a CSPRNG that ran months or even days ago, barring blatant flaws like zero cold start entropy, isn't realistic†. And, if you're paranoid about your "long term keys", generate them on a different machine than the one on which you serve up disk-wiping entropy. That's what you're supposed to do anyways. But I'm a little concerned that such a suggestion dignifies an unrealistic risk.

* Meanwhile, the notion that "lesser" secrets, like IV and padding, can deal with less randomness doesn't seem to bear empirical scrutiny. The attacks that have tended to matter against cryptosystems in the last few years have, with the exception of the P's and Q's zero-cold-start-entropy issue, not targeted long-term secrets, but rather have hinged on details like padding (random padding in the OAEP/PKCS#1 case, I guess; most crypto padding is deterministic).

* The mentality of "long term secrets" and "short term crypto parameters" that you laid out already missed a doozy: DSA and ECDSA nonces, which people who think like your comment did thought of as "undemanding", but for which it turns out that just being able to predict _a couple of bits_ of that parameter can get you with a few thousand samples all the way back to private keys.

I think you'd be better off, cryptographically and from a software design perspective, with a single CSPRNG that was suitable for all cryptographic use cases, and, if users are paranoid, have them tap a physically different CSPRNG for their "long term keys" \--- which they need to do anyways on the presumption that the systems that they use routinely are also probably owned up.

Also, I have to again point out that the Linux CSPRNG design doesn't handle _any_ of these cases well. Its /dev/random is unusable by demanding applications in steady state, with the possible (terrible) workaround of reimplementing CSPRNGs seeded from small amounts of /dev/random data in userspace (and all the attendant flaws); its /dev/urandom is unsafe at cold start. _Something 's_ gotta give in that design: it's doing extra work internally and inflicting extra work on developers, all for a worse result than FreeBSD.

† _Re: realism: it 's always easy to argue "attacks always get better, we should account for every attack, realistic or not". But engineering is about tradeoffs, and here the tradeoff Linux is making is to service an attack unknown to the literature that is likely precluded by the basic design of a modern refreshing CSPRNG, and doing so at the expense of protecting against very realistic attacks that have been discovered in the wild; it doesn't help that Linux (in general) seems to respond to that point by suggesting that userland devs should have done a better job._

 _Oh, dubiously-informed CSPRNG opinions; I sure do have them._

<comment><USER4> It's true that many of the attacks (such as BEAST) rely on attacks related to the IV. However, look at underlying mechanism of that attack; it requires that the attacker be able to predict the entire IV (which it can do since it can use the CBC residue from the previous packet). If the attacker can predict 64 out of the 128 bits of an IV used for AES, that's less of a disaster than if the attacker can predict 64 out of the 128 bits for an AES key. So there is a difference, although I might agree with you that relying on application developers to understand these distinctions might be unrealistic.

You're right that for DSA nonces, even a partial failure of the RNG is a disaster; to me, that's more of an indictment of DSA as being really extremely fragile.

I agree that making /dev/urandom to be as secure as is possible, as quickly as possible after a cold start, is a good thing, and indeed most of my efforts have been focused in that area. I'm not convinced the FreeBSD approach is a panacea, since that presumes FreeBSD's entropy estimator is sufficiently accurate. And I'll note that even with the Fortuna design, which completely gives up on the entropy estimator, it's still subject to the cold start problem --- you just don't know when Fortuna has accumulated enough entropy such that it is secure. In that regard, it's no better than Linux's /dev/random approach.

I'm not opposed to some adding a cold-start block to /dev/urandom, and ultimately, I might go there just because it's easier than making recommendations that userspace wait until the last possible moment to lazily generate keying materials. However, it's a bit of a bandaid, so I'm more interested in trying to collect as much entropy as possible right after boot, to narrow the window after a cold start.

FreeBSD's approach certainly won't help with the criticism leveled by the "/dev/random is not robust" paper, since it assumes that fundamentally the entropy estimator is broken. But if it's broken, then FreeBSD Yarrow will also not be robust in the face of the cold start problem. So it's certainly not going to help people who are going to kvetch about entropy estimators being hopeless.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> From the abstract: "A pseudo-random number generator (PRNG) is a deterministic algorithm that produces numbers whose distribution is indistinguishable from uniform."

I think this is incorrect, since it would imply that a program that produces the sequence 1,2,1,2,1,2,1.... is a PRNG.

<comment><USER7> No, your sequence IS distinguishable from a uniform sequence. At least it is if I understand what you mean by "...".

If you mean that it generates 1,2,1,2,1,2,1 and then after that generates a mix of different values that include all possible values in approximately equal frequency, then you may have a fairly good PRNG. If you mean that it produces 1,2,1,2,1,2,1 and then after that it continues to alternate between 2 and 1, then this is easily distinguished from uniform.

<comment><USER8> >"No, your sequence IS distinguishable from a uniform sequence." No, it is not distinguishable. The definition according to wikipedia: The _discrete uniform distribution_ is a symmetric probability distribution whereby a finite number of values are equally likely to be observed; every one of n values has equal probability 1/n.

So the distribution is indeed uniform but it fails in being random.

<comment><USER6> The point is that, in the context of the paper, you are supposed to group consecutive sequence elements and find their distribution.

Consider the sequence 1,2,1,2,1,2,1.... When you take elements one at a time, you have a uniform distribution, but the sequence is clearly not random. However, when you take elements two at a time, you have; 12,12,12,12... In this case, the distribution is not uniform, which indicates non-randomness.

The paper's definition implies that you're grouping the sequence elements like this and, for all groupings, you find uniform distributions. This is of course common knowledge to experts, and is made clear in the body of the paper.

<comment><USER9> Actually, it is more general than that. _Any_ polynomial time algorithm that takes as input a sequence and which has access to a unbounded source of uniform random numbers (i.e. a "true" random number generator) should output a _1_ when given a uniform random sequence with "nearly" the same probability as when given the output of a PRNG ("nearly" here means within a negligible amount e.g. the algorithm might just try to guess the PRNG seed). In other words,

      Pr[A(prng(seed, n))] - Pr[A(uniform(n))] < 1/negl(n)

Where for all polynomial functions _p(n)_ , there exists an _N_ such that for all _n > N_, _1 /p(n) > 1/negl(n)_; _uniform(n)_ is an _n_ element long uniform random sequence, and _prng(seed, n)_ is the first _n_ elements of the output of the PRNG for a (uniform) random seed. This is a common definition in cryptography and a variant is mentioned further down in the paper in Section 2.</comment></comment></comment></comment></comment>


YouNoodle Is A Terrible Idea - <AUTHOR> http://www.altgate.com/blog/2008/08/younoodle-is-a.html <comment><USER2> I am naturally skeptical of unknown people asking for details that belong in the business plan. If you're a potential investor, I don't mind sending you the plan, and without an NDA, but for random sites to ask for such details just seems wrong. Moreover, I think that any business owner who gives in to such requests is either desperate or stupid.

I applied to thefunded.com at some point, and they asked for those kinds of details too. I'm not quite sure what they offer in return for all this confidential information, and actually, the fact that they ask for it and that their members have all given it kind of rules them out as a community worth belonging to, imho - full of "entrepreneurs" who are either desperate or stupid.

Would love for someone to contradict me and let me know what I've missed out on by not sending our business plan to be reviewed by unknown parties at thefunded.com.

<comment><USER3> Hey guys, Sam from YouNoodle here. The research and development project behind this was the biggest of its kind ever conducted. If you want to learn more about predictive analytics you can read some of the well-informed recent articles about Startup Predictor.

Harvard Business Publishing: [http://discussionleader.hbsp.com/anthony/2008/08/younoodle_i...](http://discussionleader.hbsp.com/anthony/2008/08/younoodle_innovation_through_a.html)

The Telegraph: [http://www.telegraph.co.uk/money/main.jhtml?xml=/money/2008/...](http://www.telegraph.co.uk/money/main.jhtml?xml=/money/2008/08/07/cnent107.xml)

American National Public Radio: <http://tinyurl.com/625gva>

Venture Beat: [http://venturebeat.com/2008/08/07/younoodles-startup- predict...](http://venturebeat.com/2008/08/07/younoodles-startup-predictor- wants-to-tell-you-how-much-a-company-is-worth/)

We are listening to your privacy concerns and will be making changes to how we convey our measures to protect you. Realize you're giving us sensitive information and we take our role in handling that very seriously. Appreciate any further comments or feedback you guys provide as we are iterating fast on this.

<comment><USER4> From the Harvard Business Publishing Article:

> "Before the 1950s, lending depended on the wisdom and judgment of loan > officers. Then, a company called Fair Isaac developed a way to use four > simple variables to develop a credit score that reliably predicted the risk > of lending to an individual."

That is a very misleading analogy. YouNoodle is not the present-day analog of Fair Issac. This goes back to the idea that while it's very difficult to predict random events individually, you can predict them well _in aggreggate_. Fair Issac isn't really betting on customer X defaulting on a loan -- they're really betting on _a thousand customers like X_. Same with insurance premiums. A model won't be a great predictor of one person, but if you have hundreds of thousands of customers, you can have a much more accurate estimate. This is the law of large numbers. For a simpler example, you wouldn't want to bet on the outcome of a single coin toss, but it's a pretty safe bet that if you toss a (fair) coin a million times, the heads percentage will be _very_ close to 50%.

Fair Issac played the game by lending to lots of customers. _YouNoodle is trying to play this game for each individual case._ They're bold enough to mathematically estimate the value of one individual startup, and say that they have some confidence in it. It's the analog of making a loan to 1 person, insuring 1 person, or betting on a single coin flip. Probability tells you this is very risky. VC don't make thousands of bets like insurers or banks do. For the bank, my individual outcome doesn't really matter to the big picture. VCs on the other hand invest in a very small number of startups - each startup matters.

<comment><USER5> I haven't used their site, and I don't have a startup to use with it (so if this is exactly what they do then I apologize), but a tool that states "20% of startups in your industry with similar circumstances succeeded. Here are some ways you can increase your percentage." and then shows different ways that a startup could increase its chances based on the statistical data would be interesting to me as a startup founder, and I think it would be helpful to VCs and others as a pre-screening tool for their investments.

</comment></comment></comment></comment><comment><USER4> Even as a self-proclaimed math nerd, I'll be the first to admit that certain things just don't lend themselves well to predictive models. You can probably predict success _in aggregate_ , but the individual cases are really tough to predict in situations where a lot of luck is involved (dating, starting a company, etc). Stop trying to find a mathematical formula for the success of a startup. It's hard to find a good one.

I think they're overestimating the valuations. Most startups' valuations will go to ZERO within 2-3 years, and yet YouNoodle tells you anyone is worth millions. I played around with their numbers: a startup that hasn't done anything yet, and that the founder is working on 2 hours/wk gets a valuation of over half a million dollars.

<comment><USER6> Aneesh, it's hard to provide an objective experience if you use fake data. Nevertheles, based on the data we analyzed, a 500k valuation was the most likely outcome for the profiles of entrepreneurs you entered, working on a startup for approx 2 hrs/week. Remember that this is a 3-year prediction and the hours is relevant to that initial timeframe pre-funding. Many of those teams will have increased their hours/week during those three years; and 500k is an indication that they are most likely to achieve an angel round within 3 years, but not much more.

<comment><USER4> > "a 500k valuation was the _most likely_ outcome for the profiles of > entrepreneurs you entered" (emphasis added)

Exactly my point. Given 100 startups with that profile, you can say with some confidence that the _average_ outcome will be 500k. But you're ignoring the distribution! It's very risky to make the bet that _one individual startup_ will be worth 500k.

I'm not saying you should make better predictions. I'm saying that it's a very risky game to make mathematical predictions on individual valuations at all.

Most machine-learned models aren't _better_ than humans, they're just much, much faster than humans. It's a bold bet you're making if you're trying to be better than humans at predicting valuations. Models don't allow for intangibles like "killer sales ability" that may not be reflected in your degree or past job, but that a VC can pick up on 5 minutes after meeting you.

See my reply to Sam's post here: <http://news.ycombinator.com/item?id=272015>

Edit: Someone put in the relevant numbers for WebVan or Pets.com. I think those two failed within ~3 years.

</comment></comment></comment><comment><USER7> I think that if it were this easy to predict the success of a startup, VCs would have figured this out a long time ago. Applying for funding would involve filling out a simple form of variables to be plugged into a magical equation.

I don't think that this site accounts for the high probability of FAIL inherent in any startup. Probably just assumes that the company will continue along the growth path of previous SUCCESSFUL startups that were included in their historic data.

</comment><comment><USER8> YouNoodle failed to use BCC when announcing the site to their beta signup list (I was curious...). There were about 120 other people on the email some of whom immediately started Replying to All. Ugh.

Thankfully, I used my gmail account.

<comment><USER9> Not exactly confidence inspiring.

</comment></comment><comment><USER10> I get the feeling that the startup predictor is just a marketing gimmick to garner some press and that more useful services will be coming... It's certainly not a bad way to get people to talk about their company and register on their site. If / when they do come out with a more useful service they'd likely to get some good press simply because they've already been on the blogosphere radar.

</comment><comment><USER11> Has anyone managed to get a fail out of YouNoodle (whether for a present, past or hypothetical startup)?

</comment><comment><USER12> 100% gimmick. I wouldn't take investment from anyone who used my company's YouNoodle rating as a guide, and I doubt there are any legitimate investors who would ever do so. So what's the point? Entertainment?

</comment><comment><USER13> I would love YouNoodle's startup predictor to work great.

Why not? It'd allow the cream to rise to the surface.

Despite the publicity surrounding startup investment, it can be really hard to secure a first meeting and at least this is another way to attract investors who would otherwise not know about, or look passed someone.</comment>


Dimensional Analysis in Programming Languages (2018) - <AUTHOR> https://gmpreussner.com/research/dimensional-analysis-in-programming-languages <comment><USER2> > An important theorem in dimensional analysis is the Buckingham π theorem, > which states that the laws of physics do not depend on the choice of a > specific system of measurement.

That's not what the Buckinham pi theorem states. The Buckingham pi theorem is a statement about the functional dependencies of dimensionally homogeneous equations. [https://en.wikipedia.org/wiki/Buckingham_%CF%80_theorem](https://en.wikipedia.org/wiki/Buckingham_%CF%80_theorem)

I guess the writer mirrored some language on Wikipedia which indicated that the physical laws being independent of the choice of units is a consequence of the theorem.

Anyway, I don't mean to detract from what otherwise appears to be an interesting and comprehensive summary of dimensional homogeneity checking in programming languages.

</comment><comment><USER3> Java provides exceptional dimensional and unit support via the Manifold framework [1].

        Length distance = 100 mph * 3 hr;
        Force f = 5.2 kg m/s/s; // same as 5.2 N
        Mass infant = 9 lb + 8.71 oz;

[1] [https://github.com/manifold- systems/manifold/tree/master/man...](https://github.com/manifold- systems/manifold/tree/master/manifold-deps-parent/manifold-ext#unit- expressions)

</comment><comment><USER4> I implemented this in C++ for a commercial game engine many years ago. Both internally, and in the API used by games on top.

We used Emacs-Lisp to generate a collection of C++ classes with all of the arithmetic operaters that were allowed, and only those. "friend" is your friend for this in C++.

We mostly used floating point to represent values, but could also use integers with scale factors (automatically applied in the operators), which is nearly equivalent to fixed point.

For things where vectors made sense, 1d, 2d and 3d vector types were available. So Position2d and Position3d.

Absolute and relative values were distinguished: You could substract two absolutes to get a relative, but you couldn't add two absolutes. You could add a relative to an absolute to get an absolute.

And for time intervals we used wraparound arithmetic and comparisons, like the Linux kernel has the time_before() macro, so absolute times could continue "growing" without overflow in a running game.

Using the classes looked like a bit like this:

        Position3d p1, p2;
        Direction3d d = p2 - p1;

        Absolute_Time t1, t2;
        Time_Interval t = t2 - t1;

        Velocity3d v;
        object.set_position(p1 + t * v);

These types were used pervasively throughout all the game engine, gameplay logic, "AI" and so on.

The constraints provided great type-checking and effectively documented a lot of code as well.

This being a game engine, they had to be fast. So they were all inline methods, in classes containing just a number, or up to 3 numbers for vectors.

Using GNU C++ this compiled down to the same machine code as if we hand-coded the arithmetic in the traditional way; we checked. So there was no runtime cost.

It was very satisfying to use.

</comment><comment><USER5> Julia has the Unitful.jl package for handling units: [https://github.com/PainterQubits/Unitful.jl](https://github.com/PainterQubits/Unitful.jl)

<comment><USER6> This looks worse than the Java units:

        julia> 1u"kg" == 1000u"g"             # Equivalence implies        unit conversion
        true

Java:

        Length distance = 100 mph * 3 hr;

<comment><USER7> You can do this:

        julia> using Unitful.DefaultSymbols

        julia> 50m / s
        50 m s^-1

<comment><USER8> And you can manually define them:

      const m = u"m"
      50m

There's actually nothing special in the compiler for unit implementation. This is just using the fact that `2x` is valid Julia code, where now x is something that overloads a dispatch to turn the number into a number with units. By default it uses string macros to keep the namespace clear, but you can fill the namespace with whatever you want.

</comment></comment></comment></comment><comment><USER9> pint wrapper that does fuzzy matching: [https://github.com/jakeogh/unitcalc](https://github.com/jakeogh/unitcalc)

       unitcalc 50stones kg
       unitcalc 1lightyear nm
       unitcalc 7fortnights decades
       unitcalc 99mi/sec fathom/month
       unitcalc 3.14radians/fortnight degrees/ms
       unitcalc 0.2W eV/century
       unitcalc 0.2J/ns ton_TNT/month

Pint is excellent. If you put in units that need a dimension to convert, the exception says what is missing, it could ask for that value, but havent figured it out yet; obviously dont want to parse the exception message.

The framework to tell it physics exists, so stuff like:

       unitcalc 0.2eV femtograms

should be possible.

</comment><comment><USER10> Reynolds Number, Prandtl number, power factor, efficiency, anything that is a fraction of full range, mechanical strain, etc.

There are many terms in an engineering project that are unitless. Having a system to automatically check the units on the remaining scalars is cute, but doesn't do anything to prevent you from improperly performing operations that relate efficiency and power factor by accident, for example.

Multi-input, multi-output control systems regularly assemble state vectors out of terms that have mixed units. You can easily have amps, volts, meters per second, and radians per second in the same mathematical vector.

I have yet to see a compile-time unit-checking scheme that adequately addressed those issues.

<comment><USER3> Can you provide an example involving "operations that relate efficiency and power factor by accident" or similar? I'd like to better understand your problem domain.

<comment><USER10> That's kindof like asking for an example of operations that relate length and speed by accident.

The whole point is that it is an accident. Its exactly the kind of accident that embedding units into your type system is supposed to prevent. I just find that the kind of trivial examples that folks support this way are just that - trivial examples. They don't scale to the kinds of problems that I am faced with solving.

</comment></comment></comment><comment><USER11> I think dimensions in physics serve as some interesting types, with their built-in arithmetics.

I miss them in the languages I use (Python, TypeScript). I would love to have e.g. "percent" or "probability" type. So that when "100 percent === 1 probability", with proper autocasting. Same for quite a few other qualities (e.g. logit -(softmax)-> probabilities).

Before I get "just use Haskell" or something in that line. IMHO for anything practical, ecosystem >>> language syntax and stuff. So the question is: are there any solid Python or TypeScript approaches for these systems?

<comment><USER12> Probability is unitless. Percent is just literally 0.01 . Angle units have a similar problem.

<comment><USER11> I think you missed the point.

Units != dimensions.

E.g. angle in radians, degrees and full rotations differs by a factor. It is a typical, and common, mistake that would benefit from such system.

</comment></comment></comment><comment><USER13> From the Linux command line, you can use units(1):

        $ units "firkin furlong per fortnight"
                Definition: 5.6659503e-06 m^4 / s
        $

</comment><comment><USER14> Also worth mentioning is the Units Checker [1] for Java, which uses Java 8+'s pluggable type systems feature to introduce units as intersection types.

[1]: [https://checkerframework.org/manual/#units- checker](https://checkerframework.org/manual/#units-checker)

</comment><comment><USER15> Since this was written a library proposal to add units to C++ has been submitted to wg21: [http://www.open- std.org/jtc1/sc22/wg21/docs/papers/2019/p193...](http://www.open- std.org/jtc1/sc22/wg21/docs/papers/2019/p1935r0.html)

</comment><comment><USER16> I wonder to what degree dimensional analysis and free theorems are connected. The rabbit out of the hat style reasoning feels very similar to me. I suppose one could use polymorphic type variables as units with the appropriate definitions of arithmetic operations. I don't suppose anyone has a reference on this?

</comment><comment><USER17> Thank you for the pointers.

A system of units is hobbled without including the necessary counts of objects/measurement events, which is open-ended. Mass per person is different than mass per chicken or per 787, for example.

<comment><USER18> I mean, yes. It's also incomplete if it doesn't include a notion of directionality to e.g. distinguish between energy (force and displacement aligned) and torque (force and displacement perpendicular).

The SI system isn't perfect, but expressing at least some dimensional information to be checked by machine feels like a step in the right direction.

<comment><USER17> It certainly is. The more meaning we need to attach to a number, the more expensive it is, and SI is a really good start.

</comment></comment></comment><comment><USER19> Good summary but why Julia is missing?

<comment><USER20> Over the last week it seems Julia has become the new Lisp of HN.

<comment><USER21> We rather do not call Julia a Lisp lest people notice.

</comment></comment></comment><comment><USER22> I believe it's well developed in LabView.

</comment><comment><USER23> > If you've used strongly-typed programming languages before, the relationship > between dimensional analysis and type theory is rather obvious

Author clearly hadn't tried multiplying a user-input time value with a time constant (like milliseconds) in Go, a strongly typed language

<comment><USER6> Also *statically typed.</comment></comment>


The government should decide the future of the Internet - <AUTHOR> http://blogmaverick.com/2010/03/13/dont-waste-the-internet-on-tv-protect-the-future-of-the-internet/

<comment><USER2> Cuban's call for government control of bandwidth and subsequent designation of applications as "transformative" is mind-bogglingly ridiculous. It demonstrates that I guy I thought of as pretty smart doesn't really understand that what makes the internet so amazing is the end-to-end principle. Calling for the government to "set aside" bandwidth and declare winners is mind- bogglingly naive.

All that being said, please edit your title to remove your editorializing, and change it to Cuban's original "Don't Waste the Internet on TV – Protect the Future of the Internet".

</comment><comment><USER3> Cuban thinks the US govt needs to control the Internet more. Run for cover.</comment>


Seesmic Lays Off Half Its Staff As It Pivots Back to Social Cross-Posting - <AUTHOR> http://allthingsd.com/20120322/seesmic-lays-off-half-its-staff-as-it-pivots-back-to-social-cross-posting/

<comment><USER2> Aren't you supposed to keep at least one foot planted when you pivot?

At least when the video comments came out, there was some originality there. Cross-posting is becoming more & more a built-in feature anywhere I'm creating content.</comment>


Congratulations, you're paying Jimmy Cayne's marijuana bills! - <AUTHOR> http://blog.pmarca.com/2008/03/congratulations.html

<comment><USER2> It was an interesting read, but I didn't like the headline, and I'm not sure that it's Hacker News material, so I didn't vote it up.</comment>


Next-Gen OpenGL to Be Shown Off Next Month - <AUTHOR> http://www.phoronix.com/scan.php?page=news_item&px=Next-Gen-OpenGL-GDC15

<comment><USER2> Strange, no one seems to care here. I'm surprised.</comment>


My indie game has appeared on another site without authorization by me. - <AUTHOR> http://www.reddit.com/r/IndieGaming/comments/21lbrp/my_indie_game_has_appeared_on_another_site/

<comment><USER2> I completely agree with the first response you got on Reddit... That's probably the best plan of action you can take at this point.

You could also try contacting Y8.com about taking it down or offer some terms of use, and while they should accept your request, it doesn't mean they will.</comment>


This Resume Does Not Exist - <AUTHOR> https://thisresumedoesnotexist.com <comment><USER2> Too easy. Someone do search engines, but actually prop them up upon creation.</comment>


Life's unfair? Do something Or just get used to it. - <AUTHOR> http://www.bbc.co.uk/news/world-10869722 <comment><USER2> I remember the first time I worked out that life's not fair. There's no over- arching justice to ensure that just because someone beats be at one thing they won't beat me at another. Nature as a whole has no sense of fair play. The best you can do is get on with life.

Having said that, if you treat people well you often find that their sense of fair play gives you a safety net.

But always remember:

        "Life is pain, highness. Anyone who tells you
        differently is selling something."

            — William Goldman (The Princess Bride)

ADDED IN EDIT: I've just been checking - although the line is in the film, it's not in the book.

<comment><USER3> "Fair" is "if you don't work you don't eat" but that isn't what people actually want...

<comment><USER4> Fair is more complicated. Mercy is part of fair. And, of course, treating our young and old in a different way than healthy adults is fair.

<comment><USER3> Mercy is an _exemption_ from fair. Sometimes mercy is right, true. But as often, mercy to one is "unfair" to another.

</comment></comment></comment></comment><comment><USER5> Life is not fair objectively but there is the belief that it _ought_ to be fair. That makes a big difference. It is part of the common sense protocol of interacting with people. _Most_ people will assume that life ought to be fair, they also assume that others assume the same thing.

This belief in fairness can be exploited by sociopaths and those who end up in power. Of course, one can argue they ended up in a position of power because they exploited others' "fairness" expectation.

This probably has implications for how crime and punishment is treated by different cultures. The strong belief in a universal justice often gets used by the penal system to punish criminals in proportion to how much "retribution" the victim (or their family) demands. This is usually veiled in a some kind of a "the victim's family needs closure" type argument.

At the same time, I think, this revenge based justice is a result (and a perversion) of a universal religious justice that many members of the society have (had?). The idea that life is fair even beyond life, and afterlife is a place where retribution and rewards are dealt with.

It is interesting how for such a Christian nation, America has such a harsh penal system -- one would expect all those Christians to just let the criminals be punished in the afterlife.

EDIT: some syntax errors, clarity

<comment><USER6> _It is interesting how for such a Christian nation, America has such a harsh penal system -- one would expect all those Christians to just let the criminals be punished in the afterlife._

It's not really that surprising. If I'm not wrong, the range of offenses in America included "sins" like idolatry, blasphemy and witchcraft. Society reflects on what gets a man into prison. Religious judgment has had something to say and it's not always "turn the other cheek"

Believing that a christian nation wouldn't be able to have such a harsh penal system is naive at its best.

<comment><USER5> I guess the point is that it indirectly reflects the hypocrisy and highlights the lack of faith in the religious beliefs for those who profess them. In other words, the extreme expected outcome would be to either forgive, or to not forgive and let afterlife take care of delivering the just reward or punshment. Neither one of those choices should result in severe punishment for criminals just for the sake of revenge.

> Believing that a christian nation wouldn't be able to have such a harsh > penal system is naive at its best.

I do not actually believe that. I was arguing more as a logic exercize, to highlight the inherent inconsistency and hypocricy in how the judicial and legal system is setup vis-a-vis the prevalent religious beliefs in this country.

</comment></comment></comment><comment><USER7> I think it is just wrong to assume that social security exists because people are so good in their hearts and like being taken advantage of. Probably many (the majority) thinks so, but in reality, it is simply a form of insurance. Also, I pay up to keep the beggars and robbers off the street. That is a purely selfish reason - I think solid political systems should be based on selfishness.

<comment><USER8> " Also, I pay up to keep the beggars and robbers off the street."

More social programs just create a lower class that has a lifetime dependence on the government for money. It also doesn't seem to lower the crime rate. Detroit is a good example of this. There were more social programs and money pumped into that city than any other, yet the murder rate is #2 in the US.

<comment><USER9> _It also doesn't seem to lower the crime rate. [...] There were more social programs and money pumped into that city than any other, yet the murder rate is #2 in the US._

This should be pretty obvious to most HN readers, but I'm reminding people anyway. "Correlation does not imply causation".

</comment></comment></comment><comment><USER3> _The past three years have seen the economies in both countries contract violently because of shenanigans by financial speculators hiding behind the legitimacy of our banking institutions_

Typical BBC revisionism - you would think that the deficit didn't exist prior to 2008. A deficit created by people who believed "fair" meant "some people work and the rest live off them".

<comment><USER10> Or, the deficit created by people who believed financial instruments of service economy is a better route ahead than genuinely productive society.

<comment><USER3> What are you talking about?

The structural deficit in its present form existed prior to 2008, therefore anyone who says it was caused by the bank bailout is trying to pull the wool over your eyes. What was the deficit in 1997?

<comment><USER10> Reliance on the finance sector existed before 2008, how that contradicts what I say?

<comment><USER3> Oh I see, you are asserting that services aren't "real" economic activity. That's not actually true. It is true that the financial services sector accounts for a higher proportion of our economy than it does in other EU countries (still less than 10%). But it's also true that it is far more diverse than just subprime mortgages, and also true that most of its revenues are earned overseas.

<comment><USER10> Sorry for not being clear enough.

No, services are indeed an economic activity. Just that I don't see service reliant economies as sustainable in the long term. They are all in debt, and always were working into debt, unlike traditional industrial societies, which have better track record. And along those lines, it is unfair to complain about high degree of welfare dependency: not everyone can work in the City, and there's only so much pipework to be fixed for plumbers.

<comment><USER11> I'm afraid I don't see where you have successfully linked service-reliant economies with debt. There may be a correlation - I haven't looked at the data, but is A a cause of B?

<comment><USER10> I've seen no half-decent model of wealth creation in service economies. It's the equivalent of dark matter in modern economics, and all attempts at it I've seen end up in explaining away why the accumulating debt is not an issue.

If you know of a good one, please point me to it. I would like to be proven wrong here, and educate myself.

Service economy sounds wrong superficially, and doesn't have clear, satisfactory explanation when you dig into details either. I feel the major reason why it is cited as future is that it's the way society drifts to at the moment. That, coupled with their actual underperformance, is what pushes me to this, apparently unpopular, conclusion.

<comment><USER11> OK, it appears that we both lack any argument to back up our positions, but my position is 'Hmmm. I don't know about that'. I feel like I'm more justified in taking my position than you are in taking yours. :)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> America has better <http://en.wikipedia.org/wiki/Social_mobility>

<comment><USER13> But the article states at the bottom that "the USA fairs very poorly when compared to European countries".

And the Guardian showed the USA does worse than most OECD economies:

[http://www.guardian.co.uk/business/2010/mar/10/oecd-uk- worst...](http://www.guardian.co.uk/business/2010/mar/10/oecd-uk-worst-social- mobility)

<comment><USER14> Isn't it interesting that 'worse' and 'very poorly' imply a negative value judgement?

We seem to (well, at least I seem to) instinctively dislike the child of privilege, but at the same time I'm very interested in passing on whatever success I manage to have in life to my descendants, and systems and societies that make it more difficult for me to do so strike me as completely unfair.

There's a bit of a contradiction here.

<comment><USER15> Indeed, I've become a hypocrite myself - I used to abhor private education when I was younger (although I didn't actually have any contact with anyone who had been privately educated when I was at school). Now that I can afford it and the benefits are obvious I send my son to private school where you _do_ get an "unfair" advantage.

</comment></comment></comment></comment><comment><USER16> Also related: Experimental Economist Bart Wilson on the Meaning of "Fair"

<http://www.youtube.com/watch?v=HaFpB7z5y3Y>

<comment><USER14> Fascinating - the researcher in the video mentioned that 'fair' is an English- language concept without a precise one-to-one translation in other languages.

Briefly messing about with Google Translate seems to bear this out - for many of the other languages I checked, Google suggested one word meaning 'just' and another meaning 'equitable'.

<comment><USER4> Deep down these are philosophical concepts, so it should not be surprising that different natural languages developed words with slightly different shades of meaning.

Language may be misleading too. For example, I think that the fair in "fair game" is different from the fair as in "fair society".

</comment></comment></comment><comment><USER17> > I think history shows Americans want fundamental fairness for all who are > just like them. For everyone else: if life is not fair, that's tough.

If anyone is bored and wants some insight onto the results of political shifts, make a list of your estimates of the most powerful countries in the world in 1700, 1800, 1900, and 2000. Note the positions of European countries on the list, particularly Great Britain, who I'd rate at #1 in 1700, #1 in 1800, #1 in 1900, and in 2000 ... somewhere between #5 and #10? This trend is both fascinating and seems to be accelerating.</comment>


USD$35 single-board x86 computer - <AUTHOR> https://www.youtube.com/watch?v=rywLHa1i9yk <comment><USER2> Out of stock without a waiting list. This beast is gonna rule the world if it stays at $35.</comment>


Ronco Spray-On Usability (2004) - <AUTHOR> http://daringfireball.net/2004/04/spray_on_usability <comment><USER2> Good article with a lot of good points, but I was put off by this quote:

"[UI Design] is not something every programmer can learn. Most programmers don't have any aptitude for UI design whatsoever. It's an art, and like any art, it requires innate ability. You can learn to be a better writer. You can learn to be a better illustrator. But most people can't write and can't draw, and no amount of practice or education is going to make them good at it. Improved, yes; good, no."

I get his point, but saying that everyone who isn't a natural {writer, illustrator, programmer, UI designer} will never be good is a slap in the face to everyone who's ever worked hard enough to get good at something (including the naturals). I think the "naturals" are the people who care enough to work, practice, think, and generally dedicate themself to becoming great.

<comment><USER3> More to the point, the existing UX knowledge out there is so trifling, so paltry, so embarassingly miniscule, that even mere "improvement" could represent a thousandfold boon to the consumer.

<comment><USER2> Exactly. Read Tufte's 4 books, or just Don't Make Me Think, or just read Joel of pg's stuff about usability, and you've gone from extremely sh __ty to mediocre, but you're ahead of 80-85% of everyone else. Throw in a little about typography and color, and you're probably ahead of 95% of developers. You might not be the greatest in the world, but the state of the industry is so bad that you'll have a huge relative advantage.

</comment></comment></comment><comment><USER4> _But do you doubt for a moment that Longhorn will provide more improvements from Windows XP than desktop Linux will gain during the same period?_

Wouldn't have been an unreasonable doubt, in retrospect.

<comment><USER5> Har har, but Vista actually changed a number of fundamental things about XP, including a totally new security model, an overhaul of the graphics system to move it out of the kernel, and a ton of new performance optimizations like SuperFetch. What's changed so much about desktop Linux in the same time? Compiz?

<comment><USER6> You ask whats changed about "desktop Linux". How is the new graphics system an advantage for users of "desktop Windows"?

The problem with this discussion is the choice Linux users have. You can always say Linux has a poor user experience by referring to the software for Linux you hate most. On the other hand Linux users can say: "it is just an operating system" or "you picked the wrong distro" or "don't use fluxbox/emacs/the command line/compiz if you don't like it". You can not not campare apples to oranges when you compare any subset of the GNU/Linux software ecosystem to windows.

That being said, the security model in Vista annoys the hell out of everybody I know who uses Vista. Everytime they interact with this new security model, it interrupts their workflow and makes them a little bit frustrated and angry, quite like a fnord.

</comment></comment></comment><comment><USER7> An oldie, but a goodie.</comment>


OpenAI Invites for It's Scholars Program, It Will Pay $10K per Month - <AUTHOR> https://twitter.com/AnalyticsDrift/status/1289183936162144257 <comment><USER2> Am I the only one who reads "aimed at bringing diversity" as "white males need not apply"?

<comment><USER3> Correct.

Their definition of programs that are 'Inclusive' or have any 'Diversity' means: Everyone, but excluding cis straight white males. Even if they are from a poor or working class background, they still get excluded. Not very "inclusive".

Sounds like George Boole, Micheal Faraday and Nikola Tesla would never be admitted to this program had they have been alive today.</comment></comment>


That naked feeling of leaving the corporate world - <AUTHOR> http://blog.hellasdirect.gr/?p=3108&lang=en

<comment><USER2> My two cents: it's pretty hard to take this seriously when you lead the post with a picture of a naked woman clinging to Richard Branson kite surfing.</comment>


Annotated Version of John Bell's Paper on Einstein Podolsky Rosen Paradox (1964) - <AUTHOR> http://fermatslibrary.com/p/083d72a6 <comment><USER2> This is a great project. There's no reason that any textbook, academic paper, or even a video lecture today shouldn't have a Medium-like comment/question/discussion layer. Academic papers are a natural place to start for obvious reasons (they don't undergo multiple editions once published, for example). Unfortunately, for-profit academic publishers (Elsevier et al.) have little incentive to introduce these innovations, and PLOS seems to have done little beyond allowing people to add comments at the end of an article.

Starting with famous out-of-copyright academic papers is a promising idea -- at the very least, we will hopefully end up with community-annotated versions of classic papers, which would be a great development in its own right. How long does copyright last on academic papers anyway?

Collaborative annotation has to be the future of academic publishing; the more projects push us in that direction, the better.

</comment><comment><USER3> Great quote from a recent post here on HN:

Perhaps the best way to explain local realism is that it's the thing you believe in, if you believe all the physicists babbling about "quantum entanglement" just missed something completely obvious.

[https://news.ycombinator.com/item?id=10269297](https://news.ycombinator.com/item?id=10269297)

</comment><comment><USER4> It's amazing that The ultimate test of quantum mechanics can be explained to aomeone with just general understanding of probabilities and statistics.</comment>


The Programmer's CAD: OpenSCAD - <AUTHOR> https://lwn.net/Articles/829489/ <comment><USER2> OpenSCAD scripting allows for fairly deep customization. Wonder how AutoCAD with AutoLISP feels regarding that.

</comment><comment><USER3> That reminds me of POVray which also rendered 3d objects by compiling a script.</comment>


Google Tried To Buy Color For $200 Million. Color Said No. - <AUTHOR> http://techcrunch.com/2011/07/21/google-tried-to-buy-color-for-200-million-color-said-no <comment><USER4> I might be the only person in the universe who thinks Color is a fantastic idea, but not because it's trying to be an uber-cool new social network.

Location-based photo sharing is an incredible idea. When I'm at an event -- say, a concert -- there are hundreds of people around me taking lots of different pictures. I want those pictures, but I don't know any of those people. Imagine going to a venue, not bringing a camera, but still coming away with awesome, memorable photos of the band, from people that have nice equipment and know how to take photographs.

I'm not sure it justifies the huge valuation, but I can easily see why this product had the potential to be a huge player in the photo-sharing space. I feel like the press from their first round caused such an unnecessary uproar around their brand that coming back and producing a humble, useful app was nearly impossible.

That said, I probably would have taken a $200 mil payoff for an _idea_ for an _iPhone app_.

<comment><USER5> Whether there's good money in solving this sort of problem is another question -- but sorting through shared photos at events is a surprisingly hard problem, as I learned recently.

I attended Anime Expo 2011 in costume. Over the course of the two days I was there, I probably had at least 100 people stop me for photos -- not unexpected with thousands of people walking around carrying cameras. I attended a photo shoot and the whole deal: surely it'd be easy to find at least one of these pictures later, right?

After the event, some friends were curious and wanted to see a photo of me. So I just search through the albums uploaded to Flickr and...

... well, it took days after the event for anyone I knew to find a single photo that even had me in the frame. The volume of uploaded photos was so high that you'd probably have to search for hours to find _anything_ in particular. Nothing was tagged. Want to show your friend a really cool cosplay you saw? _Unless you took a picture of it yourself, with your own camera, the odds of being able to find it are practically zero, even if hundreds of people took pictures of it._

Now I understand the need of so many people to bring cameras with them: it's not necessarily that they need to have their own personal pictures of the things they liked. It's that if they don't take them, _they'll never be able to find anyone else's pictures either_. We're overwhelmed by such a sheer volume of photos and left unable to find what we want.

<comment><USER6> Sounds like a good case for NFC. Put RFIDs in the attendee badges, and a sufficiently-advanced camera app could auto-tag those people as the picture is taken.

<comment><USER5> Does that sort of technology work directionally? Typically the place was so crowded that you'd often have 40 other people within 15 feet when taking a photo, so it'd have to identify exactly the people in front of the camera, and not to your sides or behind you.

<comment><USER7> GP conflated RFID and NFC a bit, at least their colloquially accepted meanings. What we normally call 'NFC' has a range of <20cm, often <<20cm (<http://en.wikipedia.org/wiki/Near_field_communication>). This is what also makes NFC more suitable for mobile payments than RFID.

<comment><USER6> Hmm; true. Maybe just passes with large, simple QR codes on the front of them, then? Then the device taking the picture wouldn't even have to decode them just-in-time; the data would be encapsulated in the picture itself.

<comment><USER8> QR code on a name tag or conference badge would be a great idea.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> For me, the brilliant idea behind Color, (which they did absolutely not realize in their app), is the idea of an elastic social network.

In real like, friendship isn't binary. It's a scale of how close we are, what we talk about, what we share in common, etc. If you came up with a social network that would figure out who your friends are based on how often you talked, hung out, what you talked about etc., I'd call you a genius. A social network where there's no awkward friend requests to accept or reject. A social network that shows me feed items based on how much I _currently_ care about the person and the kind of content...

<comment><USER10> Absolutely, I think this is exactly the _BIG_ idea that the VCs saw that others didn't really get. I would add that I don't even think it's about "friends" in your elastic social network, it is that the social network exists based on the context (where you are, who you're with, what you're doing) regardless of whether the other person knows/friends you or not. There is a shared thread that is tied together by a shared experience and Color was trying to capture that.

</comment></comment><comment><USER11> i feel like HN is fascinated by but has relatively little understanding of how deals work.

companies don't just show up on your doorstep with an acquisition offer and a giant check. many times the deals are staged and dependent on progress. consider google's acquisition of dMarc, the talked about price, and the actual price.

<comment><USER12> I think HN is much better than TechCrunch/Mashable/etc in that regard. The big tech blogs seem to have a vested interest in promoting the idea of huge acquisitions. People here seem genuinely interested in the details and the detailed outcomes.

<comment><USER11> I dunno. It feels like a lot of the comments are either angry/chip on shoulder/etc or are presenting opinions as fact for puffery. Hardly any better.

There's not even a glimmer of doubt in anyone's mind that the reporting might be incorrect, etc.

<comment><USER13> We use the the article as the basis for the debate here. Sometimes that debate stays on topic, sometimes it does not. For the sake of timeliness we mostly have to assume the article is accurate, however sometimes the debate itself is regarding the authenticity of the publisher, author or sources (or lack thereof). The HN system is quite healthy IMHO

</comment></comment></comment></comment><comment><USER14> I feel like I live in a different universe. Can please someone explain to me what rational thinking might be behind such offers?

<comment><USER15> These deals often faul through at the last minute. Much of the time, the company making the offer just wants to get a look 'under the hood' of a potential competitor.

Think of all the companies google has made these offers to and the deal didn't happen. Strategy at this level is kind of like macroeconomics, it just doesn't map to what makes sense on face value.

<comment><USER16> The small guy is sort of at a disadvantage if the big company just tries to jerk around. Is there break-up fee as part of the letter of intent?

<comment><USER17> Depends on the letter.

</comment></comment></comment></comment><comment><USER18> I think that Color is an incredible idea for an application, and when I read their pitch I wanted to bang my head on the desk for not coming up with that concept because it is _so beautifully simple yet obvious yet useful_!

Isn't it obvious that if you are at an event, say, a birthday party, you'd want to see what photographs your friends are taking as they take them? What about at a sports game or concert, can you imagine how amazing that'd be?

Raising $41M, selling for $200M, all irrelevant versus the grand scheme of this idea. I worry that they have this awesome idea, and are poor at actually building the product, and this makes me sad because I really want someone to do it right.

I really do not understand the hate at Color, they have made mis-steps, but their concept is actually a good idea - compared to a lot of stuff that Hacker News thinks is dumb.

<comment><USER19> Doesn't Facebook solve this problem already?

<comment><USER18> no, not at all. Facebook exacerbates this problem if anything.

</comment></comment></comment><comment><USER20> TMZ is to Lindsay Lohan as TechCrunch is to Color. Constantly reporting upon (and clearly enjoying) the precipitous demise.

</comment><comment><USER21> A lot of the comments below are criticizing "irrational investors" that were "duped" or the product as "vaporware."

This is not the case. Color had a very talented team attempting to attack multiple technically challenging problems, that remain unsolved today.

The first is the discovery of your implicit social network, as defined by your virtual and real-world interactions with others. Facebook currently uses this to determine what information is shown in your News Feed and make friend recommendations, but is not using it to its potential. Google Buzz tried to do this directly via your emails and flopped partly since it did not account for the privacy implications. The ability to transform people's natural interactions into strong recommendations of what they should pay attention to and who should meet each other is still an open problem.

The second is the mapping of real-world events (initially defined by the pictures and people) onto the virtual world. There is potentially a lot of value, both to participants and outsiders, to say (1) who came to real world events, (2) how they interacted, and (3) what happened, while properly dealing with the corresponding ethical implications.

For both of these to work, Color needed a viral social product to gain data and users. They failed on product/market side, especially because they did not have enough focus on "what is the experience we want our users to have the first time they launch the application?" The opportunity remains open, for Color to redeem itself, for the big players to improve their products, or for a new startup to come along and show the world how it's done.

<comment><USER22> _Color had a very talented team attempting to attack multiple technically challenging problems, that remain unsolved today._

Sure -- so what? Just because you've got some smart folks trying to solve hard problems doesn't mean you're worth $200 million.

</comment></comment><comment><USER23> More likely: Google offered a few bucks for Color and millions if they met milestones 1, 2, 3...; Color knew they couldn't so they turned it down.

<comment><USER24> Good point. $200 million in cash or stock and how many milestones you have to hit are significant factors.

</comment></comment><comment><USER25> In Groupon's case ($6 bn offer), Twitter's case ($10 bn offer) and now Color, I feel as if Google got _lucky_ those companies didn't want to sell, because it seems they would've been a huge waste of money. Google seems to be pretty happy about over-spending on these companies, but is extremely cautious about over-spending for patents that could save Android in the long term.

<comment><USER26> I guess that with the patent issue, Google evaluated the fact that it will be cheaper to fight them, using lobbying, and licensing, than to pay that much for them.

</comment></comment><comment><USER27> Nobody pays $200MM for nothing. It's exceedingly hard to believe google valued a small pre-funding startup at over low eight figures. While most of the time I look at tech crunch leaks and believe they're real albeit spin infused, this just doesn't pass the wtf test. Arrington has appeared to have a grudge against color in the past based on the tone of the TC coverage. I'm inclined to believe this is entirely made up.

This is why you don't want to get your news and journalism from the people who are also financing deals. Now I'm not sure when to trust them at all.

<comment><USER28> \-->"It's exceedingly hard to believe google valued a small pre-funding startup at over low eight figures." But Sequoia did when they made the $40mm investment. That's what's so odd about it.

<comment><USER29> This "de-bubbles" Color in my mind. Not crazy to get a high valuation when you have Google interested in buying you for significantly more.

<comment><USER28> Maybe I'm missing something, but I'd chalk it up to 2 groups with deep, deep pockets making a long shot bet because they can.

Once Sequoia invested, the acquisition was derisked for someone like Google. Then Google just needed to offer a price of some multiple of the investment ("How about 5x? Not bad for 6 months!"). Conversely, Sequoia might have hoped for a flip knowing Google was so aggressive for social startups at the time and invested accordingly. As far as I can tell, the Color leadership were blinded by their own genius and these early "signals" of success and they screwed up their acquisition, launch, and thus far all meaningful execution.

</comment></comment></comment></comment><comment><USER30> Something must be there in their product that everyone is willing to pay top dollar. And these are all smart people who are ready to pay btw, not any average joe investor

<comment><USER31> If the product was released differently, it very likely could have been successful. It seems to me that once they got all that VC funding, they were desperate to release something to prove their worth. But, since their product depends on tons of people all using it in a geographically tight area, it crashed and burned. I think had they started releasing at events (ala twitter @ sxsw), they could have had some success.

<comment><USER32> Yeah, it could have been a cool thing-- like "This Conference with Color" or at certain trendy clubs. Get some celebs on there too.

<comment><USER33> "SXSW... now in _Color_ "

That sounds like a great co-branding opportunity. Color could also sell/host conference services such as preloading conference-related photos/ads or providing additional Color photographers to "augment" the conference's Color photos when the app's adoption is still low.

</comment></comment></comment></comment><comment><USER34> (Sorry-- Off-topic) HN Powers That Be: How did this get submitted twice? The URL is the same as far as I can tell... except a trailing slash? (see: <http://news.ycombinator.com/item?id=2790700>)

<comment><USER35> And that trailing slash is exactly how it didn't get caught by the dupe filter.

</comment></comment><comment><USER36> i keep reading in the press that color had a "superstar" team and this was a main driver of the massive funding. Yet, I've never seen an explanation - <USER2> are (were?) these guys generally considered "superstars" ?

</comment><comment><USER37> Did Google dupe Sequoia and other VCs into thinking that Color was actually worth investing $40million dollar into even though eventually when they launched it turned out to be vaporware?

</comment><comment><USER38> I guess that explains the valuation.

</comment><comment><USER39> If the average employee of Color didn't already know this... wow, talk about an upsetting topic. Imagine doing the math on your options, seeing that you could have made a killing, then thinking about how the founders said 'no' to the deal, then thinking about how some of the guys who made that choice jumped ship... it all would make for some bad morale.

</comment><comment><USER40> Color's service would be a killer feature for Google+. Color is an excellent idea assuming that there are users who are willing to post pictures and share location data. Unfortunately for Color, it will be a long hard road to get these users. Google, on the other hand, already has a ton of users, the beginning of a social network, and a really strong presence in the phone market. If Color-like functionality was built into Android, Google would find themselves with a very valuable service right from the get-go. A lot of the hard work is behind them.

</comment><comment><USER41> Wouldn't Color be the worst copyright/privacy infringer ever created unless they setup some system to blackout certain areas? Sounds like a nightmare.

What happens when Tool and Madonna don't want photos at their venue?

<http://asmp.org/tutorials/property-and-model-releases.html>

</comment><comment><USER42> Color's elastic network would be if only here were more people in it. I think they suffer with a massive chicken and egg problem. I hope they figure things out.

I am yet to use Color with another person in the same room.

I think Google is after their sound technology.

</comment><comment><USER43> as an outsider, i don't understand the allure behind color at all.

elastic social network? is this something a 16 year really thinks when using facebook? oh i wish it was more elastic? sounds like nerdvana.

proximity photo sharing? why would i want to do that? i am careful about which pics i share with the world. they transmit my persona, so i don't share shots that suck. or maybe i am taking pics no one else is supposed to look at - <USER3> in private. why would you want to look at my kids, perv?

honestly, not all ideas by talented and bright people are good. just look at asana, yet another project tool.

</comment><comment><USER44> $200 million. For the domain!

At the rate the value of that domain was rocketing, seems like a decent investment at the time. Too bad no one's going to want to be associated with it after what team Color did to itself.

<comment><USER45> $200 million for a domain as an investment? Only one domain has ever sold for more than $10 million. You get below the $1 million range before you're even out of the top hundred. Domains are not as valuable as people think they are, and the rules change entirely once the new TLD system hits.

For the record: Color.com was purchased for $350,000

<comment><USER46> Ultimately the most expensive domain ever was broadcast.com, to just be forwarded now...

</comment></comment></comment><comment><USER47> Is this just pure greed? Did Color think they had a billion dollar idea? From my understanding they're a public photo album. What revenue source did they target?

<comment><USER48> The same revenue source all "social" sites target: You.

Okay, maybe not "YOU" you, but the end user. A public photo album where you provide who you are (via registration) and WHERE you are? Real-time targeted ads would be just the tip of the iceberg!

</comment></comment><comment><USER49> $200 million for a start up excluding hard patents is almost always a clear sale. Yeah, it's a good idea but not by any means something completely revolutionizing.

</comment><comment><USER50> Remember Microsoft offering to buy Yahoo for $45 billion back in 2008? It is worth about $18 billion now (less, actually, especially if alipay goes badly)

<comment><USER51> Well, an acquisition would have to be for a premium of Yahoo's publicly-traded market capitalization, so it's tough to say how much they "lost" by scuttling the deal.

<comment><USER50> And there's always the counterexample of Larry + Sergey wanting to sell to Yahoo back in the day for $1mm, and Mark Zuckerberg turning down $1b from Yahoo later. (I sense a theme here...)

</comment></comment></comment><comment><USER52> I didn't try the iPhone application, but it has 1411 ratings with 2 stars. How is this a good idea if people don't actually like it?

<comment><USER53> The idea was good, it was just the execution that was bad. The app itself was really buggy and the proximity-limit for near photoes was way too limited. Even in tech centers like SF it was empty. <http://cinch.fm/scobleizer/194769>

</comment></comment><comment><USER54> $200 million isn't cool. You know what's cool? Uh, $0 million.

</comment><comment><USER55> Maybe this just looked like a good idea to Google at the time. Sometimes you have to make acquisitions to look progressive to your shareholders. Now, I'm betting they're glad they didn't make this purchase.

Look at Google Ventures and you might see some questional investments as well: <http://www.googleventures.com/portfolio.html>

</comment><comment><USER56> I agree with most here that it's a good idea, but it's been out for months, so maybe this idea was another dime in a dozen. I guess Google has lots of cash to spare on a domain name and a hype machine.

</comment><comment><USER57> I have a few rules in life. Somewhere pretty high up there is, "Never turn down a buyout offer for $200 million."</comment>


Google confirms "real" names a requirement for Profiles/Plus … mostly - <AUTHOR> http://dwellonit.taterunino.net/2011/07/11/follow-up-google-confirms-real-names-a-requirement-for-profilesplus-mostly/

<comment><USER2> From the article:

"Legally, in the USA and Australia, it's shaky ground to discriminate on the basis of someone's name, even if that name is a pseudonym, as a pseudonym has the same legal weight as any other name you might have, in those two countries. Both the USA and Australia allow someone to select and use virtually any name 'at will' so long as it is not done with fraudulent intent. You can stick a pseudonym on your tax forms, file a lawsuit with it, register a copyright (although for reduced time-limits of 95/120 years) or trademark with one, or appear in court under one, so long as you're not doing so in order to violate any law or regulation, or to evade any lawful obligation."

That's amazing, and something I would not have guessed. It's hard to believe I could file my taxes as Mickey Mouse and, as long as they're accurate, it wouldn't be considered a problem.</comment>


Dr. TweetLove, or How I Learned to Stop Worrying and Love the @Ev Bomb - <AUTHOR> http://www.techcrunch.com/2009/08/02/dr-tweetlove-or-how-i-learned-to-stop-worrying-and-love-the-ev-bomb/

<comment><USER2> I love the "Guest Author" byline. I guess their software doesn't support having a name unless you are employed by TechCrunch.

I also thought this article was going to be complaining to Ev ("@ev: <whine whine whine>", meaning "at ev: <message for ev>"), but apparently people are using "@foo" to just mean "foo". Good thing they don't use IRC...

<comment><USER3> _I guess their software doesn't support having a name unless you are employed by TechCrunch._

TC runs Wordpress. They could give one time posters their own account, or use a workaround like custom fields. I'm sure they're aware and its intentional. One nice side-effect is that you can easily find all guest posts.

 _apparently people are using "@foo" to just mean "foo"_

@qeorge has become a convention meaning "qeorge on twitter", but it does arise from the @ reply functionality. It became common to link twitter accounts in a message for context, i.e.:

Drinking a @drakesbrewing IPA with @jrockway</comment></comment>


Ask HN: How do I get to that next level of traffic? - <AUTHOR> I run a social music website that is getting a steady stream of visitors (1,000) each day. We've been on the front page of Reddit (several times), featured in newspapers, blogs, podcasts etc. while these help us grow, our growth rate of active users isn't tremendously high.  We have recently created a Facebook app to help spread the word about our site.  Is there anything else that can be done to increase growth other than wait for positive word of mouth? <comment><USER2> I have a few theories and quick ideas on this..

For starters, are you partnering with any other companies? I think the synergy of having working relationships with other companies are a great asset since they will actively promote you while you promote them and so on.

Secondly, do you have any viral aspects / proposition for your site? I haven't seen it so I can't tell.. But if you positioned yourself such that a small niche group must have and use your site then I think that's a great start since the group will be self-replicated the newly spawned groups will self- replicate more, hence viral.

Thirdly, have you looked at the discoverability of your site? Look for patterns of how your users are finding you and how they are not.

Last, SEO is the hot term for these days and I think for a good reason. Imagine if I did a google search for something related to music and your social website always shows up as #1 / #2 in the search results? I have a lot of ideas on how this can be done.. but I guess I'll try it out on our stealthy startup first.. and if it works and we become widly successful then I will defintely blog and share about it. =).

</comment><comment><USER3> I joined and roamed around a bit, its really beautiful. I very much admire the minimalist style. But I think it is possible the very thing that makes the site such a joy is what makes it hard to gain traction, and that is the lack of content/information outside of the actual music. Users need to be getting a constant stream of info to hold their attention. If a site doesn't do this it sends a subliminal message to the user "nothing new here, I'm never coming back"- they may not even be aware of this and they may have nothing but great things to say about your site but they might not return either. I feel you may need more emotional branding of the artists to hold everyones attention, and more intimate connection to the music industry. In a perfect world you would not have to clutter up your site with any of the following suggestions but maybe there is a way to incorporate some new elements without sacrificing the gorgeousness of it all.

1)Video content never fails to resonate with users, it would be great for artists to embed their existing online video content somewhere on your site. 2) Do any of the artists have their own groups on Ning? Can you create a loop somehow? 3)Do the artists have flickr groups? Are they on tour, can you integrate their Dopplr profiles if they have them? 4)Geographical info mashup? Where is the music coming from? Where do the artists live? Can you figure out how to provide information regarding gigs? 5)Take the blog more seriously. Maybe don't hide it? Blog more often, mention music related links and stuff that may not directly concern the site. Maybe you should think of the blog as the marketing? (feedback loop again)

I could continue but I'm not sure if I'm on the right track here. I look at everything with a marketing/social engineering prospective, I don't write code. Let me know HackerNewsCommunity and I'll give it some more thought.

</comment><comment><USER4> This is a post about tracking the increase of active blog readers. I think it can be taken as a broad parallel to active users.

[http://www.kaushik.net/avinash/2007/11/blog-metrics-six- reco...](http://www.kaushik.net/avinash/2007/11/blog-metrics-six- recommendations-for-measuring-your-success.html)

By measuring well you may find some insight that'll help.

The jist of the examples is that readers (apply to users) are acquired one at a time. Digg, stumble & such are not going to give you a massive spike in users. Nothing probably will. Its about momentum.

Anyway, maybe you will find some answers in analytics.

</comment><comment><USER5> I think the question you need to ask yourself before - How can I increase the net traffic to my site? - is: Why do I want to increase traffic?

Building out a customer base for the sake of increasing numbers leaves too many open questions. Building one for a specific purpose, however, (e.g. increase ad revenue, subscriptions, user-relationships) can help shape the direction of the site's development. It is much easier to increase the volume and stickiness of your audience if you can give them a purpose to look forward to.

That said, the nature of your product should dictate this direction. If you are selling a specific product, consider what modifications and accessories will complement the original product, and to what extent that will draw back loyal users.

Why should I buy an iPod? Because I am confident that I will enjoy engaging with it, look forward to the next model, and that I will be able to relate with my friends about it (consequently encouraging friends without one to get one). Engagement is more important than ownership.

In terms of social music networking, consider what ways that you can allow your users to engage with one another through the product, and to give them some agency over the process.

</comment><comment><USER6> Well, if your site is technically solid and you aren't spending a ton of time writing the software any more, you should be spending your time talking about it every chance you get, everywhere you go.

You should start by putting your website in your profile at the very least.

<comment><AUTHOR> It's <http://cherrypeel.com>. I was trying to start a general discussion and not spam HN.

<comment><USER7> I'm cherrypeel.com's developer. thought i should put in a warning that the site plays music immediately.

<comment><USER8> And you wonder why you're losing traffic. As someone who browses the internet, if my computer starts playing music (in this case, loudly) without my consent, I go on safari to hunt and kill the infringing tab. I strongly recommend against this 'feature'. Display something that says "play now!" and even load the song if you want, but don't actually play it until I consent. Please.

</comment></comment></comment></comment><comment><USER9> In some ways, building the product is the easy part. Getting traction is the really dicey problem.

Check out some of the SEO/SEM sites like seomoz. SEO is very important. Link- building is also important. Look at getting some reciprocal links or at focusing on a specific niche within your site and really trying to develop a core audience around a few musicians/genres in order to get that "critical mass" of interest. Contact other sites in your space and figure out how you can get them to write about and/or drive audience to you. Hold contests. Build widgets. There's no silver bullet (for most of us).

Knowing the type of user that is attracted to your site is also very important. That will really help you narrow down what kinds of sites and techniques you should be using to capture more audience. Do you have a lot of kids on your site? If so, seek out affinity sites. It will be much easier for you to convert that audience to your product. Use sites like Quantcast to discover sites like yours that have traffic. Learn from the successful sites and employ their tricks (are you asking every user to invite their friends when they sign up? if not, you might be missing out on new users).

And, as always, be patient. My website is a little more than 2 years old and we've gone from 1000 visitors/day to 100k+/day. And even now it's still one of my primary tasks every day (figuring out new ways to get word out and encourage inbound traffic). You should be spending several hours a day working on this stuff.

<comment><USER10> papa, this is off-topic, but your site's "ajax_updates_iframe" architecture needs some serious attention. As it stands now, each time it's updated (every few seconds) it creates a new entry in the browser's history (at least Firefox 3's... haven't tested others).

This totally mangles a user's history... after just a few minutes, every entry in my history was fanpop, which I was not at all happy about. I'm sure this upsets others too and there are ways around it (iframe within an iframe, for example, which doesn't affect history). Just FYI.

</comment></comment><comment><USER11> Well, I think I know exactly the site you're talking about, but I won't blow your cover for you. I saw it on Reddit just a few days ago and there's a suspicious Facebook icon in the corner that wasn't there a little while ago... so if this is your site, shoot me an email (in my profile) because I found a few small HTML bugs and such. It would probably be to your benefit to share the link here though.

The SEO point is a very a good one, especially for a site that is (probably) very JavaScript-heavy. More than just your site's own tagline, you can optimize for keywords such as "social music," "music sharing," "music community," etc. I just pulled these off the top of my head -- I recommend spending some time with the Google Keyword Tool ( <https://adwords.google.com/select/KeywordToolExternal> ) if you haven't already.

With a social music site that's based on upvoting, you also have a tremendous resource that sites like Last.fm don't have. Beyond just allowing people to friend each other like all the social networking sites do, you could introduce a feature along the lines of "Other people who upvoted this song also liked..." as a good way to add immediate value for a new user who has just joined and voted up a few songs, but hasn't added any friends yet.

<comment><AUTHOR> That's me, cherrypeel.com The icon is fixed;)

</comment></comment><comment><USER12> It sounds like the problem isn't "getting enough traffic", it's getting people to stay, or to come back. Are you focusing on that?

<comment><AUTHOR> We have started to focus on that, trying to get people more involved and giving them reasons to come back to the site. It is a weakness of ours at this point but something that is solvable.

<comment><USER13> Survey your users.

</comment></comment></comment><comment><USER14> _our growth rate of active users isn't tremendously high_

You have two options. Work on more traffic or, and this is FAR easier, work on your _conversion rate._ Get more of those fewer visitors to sign up and you get the same result.

</comment><comment><USER15> You could work on integrating with the twitter api. Look how much linkage blip.fm is getting on twitter: <http://search.twitter.com/search?q=blip.fm>

</comment><comment><USER16> What does your Facebook app do? Does it have a strong viral component? Those almost never are able to direct much traffic back to your site, but they can often do what your site does, possibly better, and spread faster.

<comment><AUTHOR> A user can send a song from Cherrypeel to any friend (on their wall or in a private message) and they can vote on the song directly in facebook. They don't need to sign up for the app to listen to the song but will need to sign up tosend the app on to another friend. <http://apps.facebook.com/cherrypeel/>

<comment><USER16> So is your app meant to be standalone at all? Or just to interface with the site?

This app feels like something I'd just skip by, though maybe the experience would be much better if I were sent a song. But just getting there directly, there isn't much to do. There's one song to play, which is cool, but how do I find more?

<comment><USER16> Ah, I messed with it a bit. Ability to post to walls is pretty sweet. Definite virality there. If only I could find some songs I knew.

</comment></comment></comment></comment><comment><USER17> Can you share the site URL?

<comment><AUTHOR> cherrypeel.com

<comment><USER17> Here is the solution: Organic Traffic. I am not technical so excuse it if I sound naive. Ajax is beautiful, but if you have a content site and want traffic, you are going to hurt your search engine results, and that counts because sooner or later that should be your main traffic source. You need to turn those categories into more pages meaning whenever someone plays a song or creates a list, that becomes a page with a neat URL that the search engine can actually spyde. Think about it, if someone searches on Google for one of the songs you have in your DB your page can actually show up on the first page. Start indexing those playlists/channels/users pages and you will double your traffic.

<comment><USER13> I don't think you want a page for every song played, but you might want to have a detail page about every song in your database, which links to profiles that have played it recently. That's basically the same thing, but not as spammy.

What about band bios, or something similar to increase the amount of unique content?

</comment></comment></comment></comment><comment><USER18> The first thing to do is at least tell us your link here in HN, please.

</comment><comment><USER19> you could try using Google friend connect launched recently. Definitely adds viral functionality as people can invite their friends and you can push their activities on your site to open social containers to which they belong. For example id love if you could push my reviews on your site as my updates on Orkut (sorry am from india not a big FB fam:))

</comment><comment><USER20> What about apps for the iPhone and Android?

<comment><AUTHOR> we were thinking about that to get it out in time for Christmas. Do you think these apps would help us gain traffic or just give our existing users another way to interact with the site?

<comment><USER20> This is anecdotal, but I found out about imeem through their android app. I know Pandora has gained a lot of users through their iPhone app too.</comment></comment></comment>