Qt Licensing Changes - <AUTHOR> http://blog.qt.io/blog/2016/01/13/new-agreement-with-the-kde-free-qt-foundation/ <comment><USER2> Before: LGPLv2.1 or LGPLv3 or GPLv2 or pay for a commercial license

After: LGPLv3 or GPLv2 or pay for a commercial license

"LGPL version 3 differs from version 2.1 in two fundamental aspects. It explicitly protects the right of the end user to not only compile their modifications, but also deploy and run them on the target device. This essentially prevents the creation of fully locked-down devices. Secondly, it explicitly includes a protection against patent claims from the entity distributing code licensed under LGPLv3. These two additions greatly help protect the end users' freedom when using source code licensed under LGPLv3."

<comment><USER3> Plus they're open sourcing the previous commercial-only components:

      Qt Charts
      Qt Data Visualization
      Qt Virtual Keyboard
      QML Profiler
      Clang static analyzer
      Qt Test Integration
      Qt Quick 2D renderer

Also, they're binding to the KDE Qt Free agreement all the editions of Qt, not just the X11 one. This is an important update, especially as Wayland takes off.

<comment><USER4> Wait, the non-OpenGL renderer for Qt Quick was commercial-only? You literally had to pay them $$$ if you wanted to develop a modern Qt app that actually worked if OpenGL wasn't available or functional (which it far too often isn't)? That's ridiculous. And even now it's only available under the GPLv3, which means that if you need to use any non-GPL-compatible code you have to pony up - and also means that distros probably can't safely ship it.

<comment><USER5> Yeah it's really bad. I feel for anyone that has stuck with these old-school 'cross-platform toolkits' over the last few years, they have really been missing out for a while now. On top of this, the whole scene is just stagnant and decades out-of-date from my experience (trying to get into Qt a couple of years ago). There are no devs there, you're basically on your own.

If you want to make cross-platform desktop apps (with opportunities for mobile too), I'd recommend hiring people who know web-dev and start looking at Electron [0] and NW.js [1]. Then you can tap into the web ecosystem with its (enormous, company-backed) massively vibrant frameworks, libraries, tools and communities.

It really doesn't make sense to use things like Qt, wxWidgets, GTK anymore (opinion - willing to be proved wrong).

[0] [http://electron.atom.io/](http://electron.atom.io/) [1] [http://nwjs.io/](http://nwjs.io/)

<comment><USER6> I think you are wrong on pretty much everything you've stated here.

> There are no devs there, you're basically on your own There is an extremely > active mailing list and IRC channel (several official ones actually) where > you can almost always get in touch with the actual Qt devs and others who > use it for support without paying them anything. There are over 500 people > in the IRC room right now.

> If you want to make cross-platform desktop apps (with opportunities for > mobile too), I'd recommend hiring people who know web-dev and start looking > at Electron [0] and NW.js [1].

Maybe when Web Assembly (or whatever its called) becomes a thing performance will be tolerable but I have yet to come across a web application that doesn't run incredibly slowly. I use Atom for a basic code viewer right now and it is pathetically slow compared to any native applications (GEdit, Kate, Geany, etc)... and this is on a desktop machine. I can't imagine anyone creating a remotely complex web application on mobile and expecting any sort of reasonable performance. Text editors should be some of the faster applications -- imagine creating something that's media rich like a music player, a video or photo editor; it would be a disaster.

Also regarding your "with opportunities for mobile too" comment, you know Qt is supported on iOS, Android, WinPho, BlackBerry, Sailfish right?

> massively vibrant frameworks, libraries, tools and communities Yeah, its not > like the native software community doesn't have that or anything. Unlike web > tools, native tools have been developed for far longer and they are more > robust and reliable.

>It really doesn't make sense to use things like Qt, wxWidgets, GTK anymore Yes, if you don't care about performance and all the things web frameworks miss out on (how's that GL support looking? Native is getting ready to support Vulkan -- WebGL is still stuck on the ES2 equivalent) then jump on board the web app hype train.

You're also completely overlooking embedded where Qt specifically is used extensively. Kiosks, IVIs, small displays for smart appliances, etc.

I don't like the Qt model of using the GPL as a way to get people to go for their very expensive commercial offering and I think a model like Unreal Engine's (give us a share of your revenue) makes more sense as an additional option for smaller devs.

</comment></comment></comment></comment></comment><comment><USER7> Whenever I hear about QT licensing changes I can't help but wonder if they had started off with a GPL based license and GTK never happened how the whole "Linux on the Desktop" situation would have panned out. Would open source developers eventually opted to just use QT for GUI applications? Would KDE have become the defacto standard DE across the top 10 Linux distributions? Would there have been a unified installation package allowing cross distribution installation of QT/KDE based applications thereby facilitating commercial software vendors being more open to porting their Windows applications to Linux? I realize it's a moot point but having spent my teen to college years heavily invested in Linux and being frustrated with the lack of standards at the time I can't help going down this thought experiment.

<comment><USER8> It was GPL (or pay license) to start with. I believe you mean you wonder if it had been LGPL to start with. Subtle, yet enormous difference for a library.

As to the speculation, I don't know. Special preprocessing phases to extend C++ are odd. The signals and sockets paradigm is a mixed bag. Plus there are serious trade offs to the entire application framework vs a library choices in the first place. On the other hand, the runtime type system and heavily stylized macro style of GTK's gobject system was certainly an odd duck to say the least.

Personally, between the web, mobile, "modern" UX/UI ideas, desktops that want to be tablets, etc, I think the 20-30 years of GUI exploration is coming up very empty handed. Character cell terminal, and CLI are more popular and mainstream than ever.

Where things are going from here?

<comment><USER9> > Special preprocessing phases to extend C++ are odd.

You should see Unreal Engine, which uses preprocessing to extend C++ with a garbage collector, reflection, interfaces, and runtime class objects.

<comment><USER10> This might be interesting to you: [https://woboq.com/blog/reflection-in-cpp- and-qt-moc.html](https://woboq.com/blog/reflection-in-cpp-and-qt-moc.html)

<comment><USER9> It is - thanks for sharing!

</comment></comment></comment></comment></comment><comment><USER11> I am curious what Richard Stallman (or generally FSF) can say about this, This is clearly one of the best thing happening to FSF. Let be honest, with Gtk's lack of modernity (I don't know what to call it, but despite being gnome guy myself, we should be honest Gtk falls behind very badly these days in almost all category, ease of development is one of the important one), FSF needs a modern Toolkit and Qt can be the one.(Personally, this does not mean I love Qt, no, It designed very tidy, but I hate MOC, changing language is always bad idea in my perspective, you _should_ play by rules, I don't care who does this, Microsoft or anyone else, and MOC does this.)

p.s. yes I know MOC is preprocessor step, but my logic is sound . Programmer does not program in pure C++ when he/she program in Qt. He/She program in Qt version of C++(and compatibility with existing C++ compiler does not change this fact).

<comment><USER12> > we should be honest Gtk falls behind very badly these days in almost all > category

While I agree you'd have to be absolutely nuts to develop an application using GTK+ directly in C (Yes, I think the whole GNOME project is nuts... but it's telling that they adopted Javascript and Vala), the C++ bindings for GTK[0] weren't all that bad when I last looked at them.

Of course, without a MOC equivalent, you can't really beat the slickness of Qt/QML.

[0] [http://www.gtkmm.org/en/](http://www.gtkmm.org/en/)

<comment><USER13> My biggest complaint with GTKmm right now is the lack of composite widget support. It's actually _nice_ to develop a GTK+ application in Vala because composite widgets kick ass and remove a huge pain point for just wanting to throw a window up without all the nasty GTK signal connection maddness. Once GTKmm gets that support I'll probably start using it more.

<comment><USER12> Well I haven't looked at it since Gtk Builder was called Glade, but QML has convinced me that declarative UI markup with sprinklings of code, and custom widgets implemented on the side, is the way to go.

<comment><USER13> Agreed, hence why composite widget support in GTKmm would be really nice. In Vala you just make a normal class inheriting from whatever your base widget is, decorate it with a [GtkTemplate] attribute and whenever you construct that widget it will use the gtkbuilder XML you referenced in the attribute to construct the widget, binding all the callbacks referenced in the XML with the respective methods on the class.

Until recently C++ hasn't even had compile time reflection that would allow this to work very well, now that C++14/C++17 are adding that I think this would be very doable.

</comment></comment></comment></comment></comment><comment><USER14> > The purpose here has been to bring the licensing of Qt more in line with the > philosophy of the Free Software movement.

> In line with this, the new contract with KDE now removes LGPLv2.1 as a > required license for the open source version. Instead, it now requires > LGPLv3

> This means that all parts of Qt for Application Development can be used > under the GPLv3.

Looks like things have just moved to LPLV3 and is compatible with GPLV3. Good stuff here.

<comment><USER15> It is better than that. They've made some modules available to open source users that were only available to their commercial customers before.

      Qt Charts
      Qt Data Visualization
      Qt Virtual Keyboard
      QML Profiler
      Clang static analyzer
      Qt Test Integration
      Qt Quick 2D renderer

</comment></comment><comment><USER16> The same announcement from KDE side: [https://dot.kde.org/2016/01/13/qt- guaranteed-stay-free-and-o...](https://dot.kde.org/2016/01/13/qt-guaranteed- stay-free-and-open-%E2%80%93-legal-update)

Looks good!

</comment><comment><USER17> Licensing has always been one of the reasons I have avoided Qt for some projects, but it looks like these are some major steps in the right direction in this regard. I have a feeling KDE and Waylands future has encouraged this move, but either way I am happy with the direction!

<comment><USER16> I've felt the licensing situation to be good ever since Nokia added LGPL to Qt licensing options. This extension of Free Qt code is of course excellent news anyway!

</comment></comment><comment><USER18> What does this practically mean? One can still write a closed source application and link to Qt right?

<comment><USER19> This might make it more difficult to ship on locked down platforms like iOS -- LGPLv3 means that the end user must be able to install new versions of QT into your closed source app.

<comment><USER20> LGPL version 2.1 is no different. There's no change here in that regard. Locked down platforms are inherently incompatible with the LGPL, whether it's version 2.1 or version 3.

<comment><USER21> Is that really true? As I understand it, anyone can build and put an app on their phone using Xcode, without needing any permissions from Apple. So if an app on the store is LGPL'd, the publisher can make the source available and I can build it and place it on my own phone.

<comment><USER20> (It's not the main point behind your question, but even if you're sideloading through Xcode, you need an Apple ID. AFAIK, jailbreaking remains the only option to install an app without getting Apple's permission.)

In response to your question: Yes. But, again, the same was true of LGPL version 2.1.

<comment><USER21> Ah, I didn't know that. I had heard that Apple had relaxed their restrictions a little, but have not tried it myself yet.

When you speak of an Apple ID, do you mean a free one, or the $99 publish-to- the-appstore type? The difference doesn't matter to the LGPL question, of course...

There's some good discussion about LGPL and app stores at [https://lwn.net/Articles/526355/](https://lwn.net/Articles/526355/) \- the comments give a good explanation about why you could get away with a LGPL app, even though there's no free way to re-link the program.

Now, if you _could_ use Xcode to install an app on your own phone, without any other account or gatekeeper, then presumably (I guess), GPL'd apps could also be allowed on the store?

<comment><USER22> A lot of apps can't effectively be side-loaded and retain their features. Most of these problems stem from not having the real developer's certificates to sign the app with.

For example, you can't get the source for an AppStore app, side-load it, and have it get notifications meant for the original app.

The same applies to IAP purchases made with the original app (they won't be available to the re-created app).

So, in the very least, even if, generally, LGPL with side-loading is ok, there are definitely some apps where it would still be not.

<comment><USER21> Good point about the notifications & IAPs, I hadn't thought of that.

They make the licensing even murkier - you could envisage a situation where even if you had the app source code and the ability to build and install the app on a device, the app is worthless because a key feature depends upon secret keys that you have no access to. That's getting closer and closer to tivo-isation.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> This sounds really good! I don't understand why people would buy the commercial license, though, so I must be missing something. With the LGPL, it seems like you could have closed source and just provide a copy of Qt.

<comment><USER24> > I don't understand why people would buy the commercial license, though, so I > must be missing something

The support. Same reason people pay for RHEL.

</comment></comment><comment><USER25> I'm sad that there isn't a Qt Licensing dance to explain the changes.

<comment><USER26> I believe this is a reference to the Qt4 music video they released to explain the pronunciation: [https://www.youtube.com/watch?v=NbTEVbQLC8s](https://www.youtube.com/watch?v=NbTEVbQLC8s)</comment></comment>


Withdrawing from the Microsoft MVP Program - <AUTHOR> https://www.osr.com/blog/2019/04/08/withdrawing-from-the-microsoft-mvp-program/ <comment><USER2> The MVP program has become a marketing program to encourage becoming unpaid shills of Microsoft and MS products, where the best way in is to evangelize and write articles and tweets promoting Azure. Your social media presence is more of a factor for determining membership than any technical prowess.

They've even used it to encourage members (behind closed doors) to shill Microsoft links [1].

[1] [https://twitter.com/rickasaurus/status/636269822595235840](https://twitter.com/rickasaurus/status/636269822595235840)

<comment><USER3> Well the program was always for helping the broader community, whether by writing tools, or participating in StackOverflow, or whatever... it was never a "Hall of Fame" for the best Windows programmers.

<comment><USER2> It's about helping MS market their products by encouraging devs to pimp their tools/products under the guise of "technical excellence" that everyone used to look up to.

An award for being one of MS's best pimpers just doesn't hold the same level of street cred.

Now whenever I see someone wearing an MVP badge in their twitter bio I immediately discredit their pro-MS "advice" as an MVP shill wanting to score points towards their next renewal.

<comment><USER4> Have you ever applied?

But really, if the MVP program was what it is said to be, people like you'd be in it.

ServiceStack has been a _valuable_ contribution to the .NET community, and your continued development/support of it should defacto make you an MVP.

<comment><USER5> I've been a C# MVP for many years before they didn't renew me because I was too critical towards MS' direction (this was before they OSS-ed .NET). When I was awarded, it felt like I received an award for my position in the .NET community. When I didn't get a renewal years later it felt like I didn't get it because I didn't fit into their marketing machine. It was fine by me btw. The free MSDN universal subscription is nice, but that's about it.

> ServiceStack has been a valuable contribution to the .NET community, and > your continued development/support of it should defacto make you an MVP.

Yes, and back in the days when I received my MVP title, this kind of thinking was part of the criteria. Nowadays... no way. It started 7-8 years ago I think when they decided there couldn't be more than X mvp's for a given category and they wanted at least Y mvp's in a given region. So less in the west, and more in say India. While it's fine to make it a more world-wide program and recognize people in communities which are less known to people in 'the west', the criteria to accomplish this changed with it: if you started a user group somewhere in a region without an mvp and someone nominated you, you had a good chance becoming one.

This is all OK btw, _if_ your criteria is about evangelizing. If your criteria is about 'the people who are the most skilled in ABC' then it's not. So this shift in who would receive the award changed the program.

Nowadays it's rather silly tbh. If you want to get renewed you have to fill in a form where you describe why you want to get renewed. wtf... it's an award you receive. Why would you need to tell MS why you'd want to receive an award you haven't received yet as _they_ decide who gets it...

<comment><USER6> I see the same thing happening with almost all "most valuable" type awards or badges. Every big tech company that has it now uses it almost exclusively as a PR campaign. The MV% roster of some companies looks more like a list of social media influencers than a list of truly most valuable professionals, with the latter losing ground year after year.

</comment></comment></comment></comment></comment></comment><comment><USER7> I have been a Microsoft MVP from 2006-2018. While I was proud to be part of a group of so many smart people at the beginning, my professional and personal life changed over the years and I stopped blogging regularly, never engaged in their new web forums (which replaced the newsgroups – anyone remembers them? ;)) and finally filtered out all of the many emails and newsletters coming to my inbox. So I would say for 10 out of 12 years I have been a ghost. A ghost that has been "re-awarded" every year – for whatever reason. I think that alone tells you something about the value of that "title".

</comment><comment> smith-kyle A few years ago I told my friend "If I ever add 'Microsoft MVP' to my Twitter bio shoot me"

I don't know why seeing this made me cringe so much. Probably because it was so transparently a ploy from Microsoft to make their most loyal devs feel special in hopes that they'd promote Microsoft tools more.

<comment><USER8> Hmm, but you can't say that many people hadn't had great experiences with it.

</comment></comment><comment><USER9> I've seen this first hand at several conferences where Microsoft "MVP"s come on to the stage and try to make Microsoft seem all "hip" and "rad" rather than talking about real engineering and technical improvements, it was not only nauseating - so many people could clearly see right through it.

</comment><comment><USER10> > Where I used to get weekly updates, and focused, useful, invitations to what > are called "Product Group Interactions" — stuff about the new WDK or changes > to OS features — I now get an endless stream of invitations to SQL and > SharePoint events.

If I had to wager why it seems like the MVP program dieing (I have no clue if it is, this is the first post I've ever read about the MVP meta) it has to do with this point the author called out.

I suspect that, at least in its early days, the MVP program help guide product development teams. In return for helping guide development, these MVP's were given preferential treatment over other customers and access to insider information. Now that Microsoft is (at least appearing) more open, they can get their feedback from their open source communities.

<comment><USER11> Even Stackoverflow kills the need for MS MVPs. In the dinosaur days before SO, you'd have MVPs answering questions around the Internet or within their particular community.

<comment><USER12> Before SO you had to scroll down on ExpertSexChange

</comment></comment></comment><comment><USER13> Hi, I'm Lenn from Microsoft, and I have responsibility for the MVP program. I appreciate the feedback, and apologize that we didn't respond to your earlier emails. We will get back to you directly to address your questions and concerns. The MVP program does evolve over time and our goal is to ensure that it stays relevant and meaningful for participants. On behalf of Microsoft, we really appreciate your support of the program and community.

<comment><USER14> What a BS response. Now I don't mean this personally (I'm sure you just wish the best to all of us just like most people here) but it doesn't take anything away from the main point which is that the company can't even be bothered to respond officially and the best this "MVP" can hope for is an unofficial acknowledgement from an employee outside of work time.

<comment><USER13> My team did indeed miss the email from Pete unfortunately, I am not afraid to admit it. We feel bad about it and have sent him a personal apology that he didn't get a reply after 15 years. We are heads down reviewing 3,300 MVP renewal applications until the end of May and his CPM missed it in the flood of emails that comes her way this time of year. Our bad, and we own it and are sorry we made him feel disrespected for his 15 years of contributions to the community and Microsoft.

<comment><USER15> s/email/emails

<comment><USER16> Lenn Pryor did say emails in the parent reply. "Email" is used both as a singular and plural, so I don't think his later reply is wrong, either.

<comment><USER15> > "Email" is used both as a singular and plural

Not in this case:

> My team did indeed miss _the email_ from Pete

The purpose of his comment was to downplay that his team only let 1 of his emails slip through the "flood of emails" they receive. Whereas the whole reason why Pete's resigning his MVP in the first place because he felt he and his deep technical interests were being ignored. Not receiving a courtesy reply after multiple emails and 15 years of Service confirms as such.

and lets be honest, the only reason why he's getting any kind of response now is because it became an open resignation letter that's shining a light on the purpose and current state of the MVP program.

</comment></comment></comment></comment></comment></comment><comment><USER17> Let's face it, MSFT is dropping all of their eggs into the cloud basket and, whilst this isn't necessarily a bad thing, the byproduct is what the MVP sees: Invitations to things like roadmaps for COSMOS DB, which is almost purely an Azure service and has nothing to do with the scope of the MVP's expertise.

Others have suggested that SO and the OSS community, in general, are much wider audiences for MSFT to receive feedback from and that's not, inherently, true. MSFT still avails of things like the BETA program[0], so they still (seemingly) recognise that they have a need for that feedback loop (for the most part).

What seems to happen at Microsoft is constant culture shifts, based purely on who's making the most money at the time. In the previous years, it was Office that was the top dog, now it's Azure and, not surprisingly, things are changing in the company to push the biggest seller.

The byproduct of that, of course, is that everything else gets thrown to the wayside by chasing these new endeavours (by constantly changing directions) and not having a plan to fluidly bring everything forward and inline.

[0] - [https://www.onmsft.com/news/join-microsofts-pre-release- beta...](https://www.onmsft.com/news/join-microsofts-pre-release-beta-program- office-and-help-make-next-version-better)

</comment><comment><USER18> I remember the battle between Jamie Cansdale and Microsoft regarding Jamie's MVP status [1]. The TL;DR was that Jamie developed TestDriven.NET as an add-on to Visual Studio. He released it for the pay versions _and_ the free version: Visual Studio Express. Microsoft wanted him to make it unavailable for Express and decided to kick him out of the MVP program because they didn't want nice features in the free version of Visual Studio. ;)

[1] [https://www.infoq.com/news/2007/06/TestDriven-Express- Emails](https://www.infoq.com/news/2007/06/TestDriven-Express-Emails)

<comment><USER5> They also kicked out Karl Peterson, who designed the first MVP logo (the diamond with the large MVP inside it) and wrote about 3000+ reply posts a year in various visual basic groups. The reason? He was a VB6 MVP and very vocal against VB.NET. Yes, you can't have the spear head of a community you just kicked in the nuts with a 'VB.NET' in the program that is designed to promote that successor tech, now can we...

</comment></comment><comment><USER19> Ten years ago, when I see a MVP give technical advice (they seldom do), they are very helpful.

Now when I see technical advice from mvp, I wonder if they had ever read the manual...

</comment><comment><USER20> What's the practical function of MVP in the era of GitHub and open source where everyone can join discussion with devs and PMs without a need to be part of any elitist group? Just to keep a handful of folks still proud of their MVP badges they earned in 2001?

<comment><USER21> Are you asking why social validation is a useful tool for getting people to be helpful with thorny or esoteric technical questions?

Regardless of whether I think the MVP program was good, your question answers itself.

</comment></comment><comment><USER22> The Windows kernel driver development was one of the most hardcore programming in software development, requiring in depth knowledge of the kernel and a very different mindset. Have to be very defensive and thorough, or things would go badly.

</comment><comment><USER23> This is completely understandable. I've submitted for MVP for a product (not Microsoft, but built on Microsoft technologies) and I never get it due to the fact that I don't re-tweet all day and focus on development.

<comment><USER24> Ditto. I was twice nominated a while back, by existing MVPs, didn't get it, and had the distinct sense it was because I didn't tweet or run webinars or whatever to the glory of MSFT. What I did do was write and release some pretty decent free tools with .NET, and participated extensively on anything to do with Active Directory or ADFS. It was rather demoralizing.

</comment></comment><comment><USER25> Before ASP came out, I wrote a DLL to connect IIS to VB5/6 applications. I was also the VB guide on The Mining Company (which became about.com around 1997). This was enough of a resume that I was awarded the title MVP for IIS/ASP. I got a watch, notepad and pen. Seemed pretty cool for an 18 year old in smalltown Ontario.

Eventually, they announced that VB6 was the end of the line for COM and VB.net was VB in name alone. I was one of about 100 MVPs that signed a petition encouraging MSFT to keep VB moving forward as a parallel product. "No, and stop asking" was the reply.

Fast forward a few years, and I saw the original DHH "Build a blog in 15 minutes with Ruby on Rails" video. What I saw didn't even seem possible. I knew that it was going to be a big deal, and the next day my friends and I cofounded the first Rails consultancy in the world circa Fall 2004. This led to my first Mac Mini, and deploying to Linux. Today I only boot into Windows to do VR and hologram stuff.

I haven't thought about my MVP certificate in over a decade, but I'm confident that it exists in a box. I'm honestly a little shocked to know that it's been going all this time.

</comment><comment><USER26> Writing low-level magic and solving gnarly bugs seems to be linked to making hardware in the first place.

Microsoft MVP is still a very west-centric program. If I had to guess, I'd wager the rising stars of this world are in Asia where the new hardware is being made. Microsoft doesn't really reach out to them, and I guess the feeling of disinterest is mutual.

</comment><comment><USER27> no response from PM, amazing! I've been MVP for (just) 6y, 2012-2016, and probably replaced that many community PMs, and few categories also, that I didn't know where I belong any more. And last year, when I thought I did my biggest contribution by organizing workshops and meetup talks, writing OSS, and finally got great feedback from real people, not just page views of blog or twitter reach, they called me and said its not enough. And that I can apply next year when I do more of the things they measure, whatever that is this year! I just don't care any more.

</comment><comment><USER28> I wasn't aware of the program till recently and just thought it was a marketing gimmick for vaguely technical people who can throw a little open source varnish on the company.

</comment><comment><USER29> Sounds like it is similar to the MSP program now then.

</comment><comment><USER30> I used to aspire to become MVP.</comment>


Ask HN: a business person with reality distortion field wants me as a co-founder - <AUTHOR>

(using a throwaway account)
One can meet business guys willing to enter a technology world at every tech meetup; I've seen plenty of them, but this one (let's call him Sam) stands out. Sam joined the Big Four consultancy right after college, top tier investment bank afterwards, now in his early 30s, seems very energetic, communicative and well-connected. He left his finance job several months ago to do a startup, but got no technical co-founder yet.
I, on the other hand, have been around the block too, can tell gem from egg or jar, seen companies big and small, recently left my job and launched a reasonably successful product of my own. Friends pitch me their ideas periodically, but none of them really stick -- I'm not sure the world needs another to-do list app or "Airbnb for foodies", really.
Unlike them, Sam is very convincing. Every time he approaches me with an idea, I immediately buy it. He's capable of providing a convincing business rationale, a market volume, estimating risks and he claims he got at least some of the connections necessary to get started. I always feel hypnotized. On the meta-level I can see the difference in my perception of him vs. the other guys, but I can't really tell if this is a good thing.
Now he wants me as a co-founder. What should I do? Is this reality distortion field just a sign of business savviness or should I run away? I'm afraid of being manipulated, is there something I can do to have a better hand here? <comment><USER2> I used to work at Microsoft, and there was a few of these type of people you described. My personal feeling is that their up sides usually even out to their downsides. However, there is a chance it really is a good idea, you really can execute on the product vision, and he really can sell it.

The way I think you find out if he is valuable is not is simple (ha, I say this, but I have no experience actually trying this so I could be horribly wrong):

Tell him you will dedicate to X amount of hours to development over Y amounts of weekends to make a prototype. If he can take that prototype do something with it (investment, sell it as is or with little more work required, etc...) then you will join him as a real cofounder. I would suggest something in the range of 30 hours over 4 weekends but it may depend a lot on the idea.

</comment><comment><USER3> If you haven't studied rhetoric, rationality, and statistics, then you'll always be at a disadvantage in a discussion. Ask him to write down the idea, the proposal, and the rational. Once you have it written down, defang the rhetoric and then try to do fair minded due diligence.

<comment><AUTHOR> Not sure writing down will help. His own words: "In the bank, when we were preparing slides for an M&A that buyer will clearly won't benefit from, we were honestly describing all the risks, but for each point there we were able to invent 1000 ways to mitigate it if we wanted to".

I guess, he's similarly convincing in writing as well.

</comment></comment><comment><USER4> Use his skills! Just because it's a tech startup doesn't mean a superb salesman isn't useful. Find an idea that puts both of your skills to work. Most people shy away from products that require cold calling to find customers. You have an open field!

</comment><comment><USER5> Would you both be working full-time on your startup? If that's the case, which shows a complete investment from both parties, I'd suggest giving it a try. His solid background (e.g. Big Four, IB) shows that he is goal oriented, talented, and will definitely be an asset to complement your technical skills.

Also, consultants have the benefit of having been 'dropped' in many different businesses, and learn about their problems/structures. His potential knowledge of those markets would also prove to be valuable.

</comment><comment><USER6> The problem is that you exist to help him succeed.

The second problem is he might not be able to convince people at distance, e.g. B2C scenario.

Third problem is he is not going to be useful for enterprise sales either, since these depend on long lead times.

However, there is one area where he may be useful. If you are doing channel development, he sounds like a great go to person.

</comment><comment><USER7> Big Four Consulting, then Top Tier Investment Bank => Warning Signs galore !!

Maybe your experience didn't cover being on the receiving end of these organisations doing a hard sell to win new business. If they were used car salesmen, you'd pay for a Lear jet (theirs) and end up owning a rust bucket, oil leaking Hyundai to drive to work.

<comment><AUTHOR> My view is that this person is potentially going to be a business side of the venture, which means that selling oil leaking Hyundais to people around is a great skill to have.

<comment><USER8> it does sound like you want to be talked out of something you know is too good to be true. and you know the answer to that one.

on the other hand - get to know him more. meet in person - vet him out.

</comment></comment></comment><comment><USER9> It sounds like you've met someone who is an ace salesman. This can be great if they can really back up their big talk with results. Make sure your equity split is equal and your interests are aligned...in writing.

Before you take him on as a co-founder, test-drive. See if he can deliver some results.

</comment><comment><USER10> sounds convincing. seems you are in love, now start by creating facts. you won't know if you are not trying out.

maybe he is over the top for you. maybe he talks the same to other technically versed like you.

still you would have the chance to work with a seemingly great person. can you ask him for a reference? someone knowing him well?

</comment><comment><USER11> See if you guys can meet in the middle to test your ideas. Now would be a great time to read Eric Ries' The Lean Startup.

</comment><comment><USER12> The fact is that very rarely do you get the sex and the brains in one package, in both women and cofounders. Learn to manage personalities and balance with your own, then go rule the world. Make sure he is committed to seeing this one idea through before hopping off to the next adventure.</comment>


Cirplosion - An HTML5 canvas game - <AUTHOR> https://developer.mozilla.org/en-US/demos/detail/cirplosion/launch

<comment><USER2> neat, although some explanation of strategy about how to deal with the blue dots would be helpful - I couldn't make it past level 5. :(

<comment><AUTHOR> Oh. Right. I'll change it tomorrow. I'd appreciate it if you guys would actually 'Like it' if you liked the game. This is in for a Mozilla's Dev Derby competition.</comment></comment>


GM Israel unveils autonomous car prototype - <AUTHOR> http://www.globes.co.il/en/article-gm-israel-unveils-autonomous-car-prototype-1001192500 <comment><AUTHOR> "The General Motors (GM) research and development center in Herzliya yesterday unveiled the company's first prototype of an autonomous vehicle. The car's systems were developed in Israel."</comment>


Zoom is now critical infrastructure – that's a concern - <AUTHOR> https://www.brookings.edu/blog/techtank/2020/08/27/zoom-is-now-critical-infrastructure-thats-a-concern/ <comment><USER2> I don't buy it. The same factors that made Zoom easy to adopt, make it equally easy to switch to something else.

And "when Zoom goes down, teachers can't teach"? Come on. I am a college professor. In my class this fall I met my students on Blackboard on Day 1 and Zoom on Day 2. If one of them goes down for the day, we'll switch to the other.

<comment><USER3> > And "when Zoom goes down, teachers can't teach"? Come on. I am a college > professor. In my class this fall I met my students on Blackboard on Day 1 > and Zoom on Day 2. If one of them goes down for the day, we'll switch to the > other.

I think it's for real. Think about elementary school instead. The kids are just learning to use computers. Their parents may be also, and if not they may be trying to do their own work from home while the kids are in class. There are many low-income and/or ESL families. Even the teachers aren't tech experts.

In my son's kindergarten class, everyone got school-supplied Chromebooks. They all have Google accounts for Google Classroom. That probably means they could switch to Google Hangouts Meet, but it wouldn't be smooth. They'd at least miss a day, and subsequent days would be rocky. The teacher has invested a lot of effort just in teaching the kids how to mute and unmute themselves without waiting for their grown-up to help, and they'd have to go through that again with a different UI.

<comment><USER4> the kids in elementary schools were born into the digital age. they're digital natives from the get, and are probably more comfortable using digital tools than we are

<comment><USER5> That seems pretty short-sighted. Sure my 1st grader knows his way around an iPad enough to play games and watch Netflix, that doesn't mean he's going to understand installing new software or what it means when Zoom isn't working and they have to switch to Hangouts. Yeah, he'll come ask me and I'll figure it out quickly, but I've interacted with enough other parents to know that being able to do so isn't commonplace. Heck even the teachers get confused just setting that stuff up.

<comment><USER6> They'll figure it out. People always complain about having to learn something new, but they _will learn_ if they have to.

</comment></comment></comment></comment></comment><comment><USER7> > But in many of the verticals in these sectors—such as banking or mobile > phone services—no single company dominates the market.

I don't think that's true of video-conferencing either. Zoom is probably the most popular (and technically superior), but there is also: Microsoft Teams, Webex, Google Meet, Slack, and many others, including open source options like Jitsi. And they all pretty much do the job.

<comment><USER8> And unlike many other services, the network effect is quite low because I can easily install multiple video conferencing software or even run some in the browser. If someone organising a meeting asks to use something unusual, I'm normally not that bothered.

<comment><USER9> My wife sees doctors at four different clinics. Each has chosen a different remote meeting solution. It's non-negotiable - to see your doctor remotely, you need to use their software. And that's just in one field.

I'm not concerned about Zoom monopoly at all.

<comment><USER10> With COVID my grandfather has been doing telepresence visits with his doctors, for COVID among other reasons.

Mostly they were using a 3rd party solution like webx/zoom/etc but one doctor (automated in an online form) noticed his number was tied to iMessage and offered to just FaceTime him at his appointment time. Super easy for him (at 94) to self-manage vs any other solution where we (my mother or myself) need to be around to set things up for him.

Not sure how they are doing this exactly, if this is something Apple specifically enabled for healthcare or whatever, but its a fantastic experience.

Whatever solution they were using did have an "no I have an android and a 'use my computer' option" not sure what path they led down.

<comment><USER11> It's a shame there isn't seamless ability to Facetime with Android users like there is to make a voice call or text with them. We (read: tech community and/or society) should fix this. It'd be in society's interest if a video call between android and Apple was as easy as a voice call is. (and I do think Facetime between Apple users is this easy... I sometimes use Facetime purely because my WiFi is a little better than my cell signal).

<comment><USER12> Isn't Google's Duo available for iOS?

<comment><USER13> It is, and it can work; but it also doesn't typically get the fully blessed experience a first party app does.

<comment><USER14> Duo integrates into the latest Android like FaceTime integrates into iOS, it would be nice if Apple made FaceTime / iMessage available on Android (lol, never gonna happen) or allowed Duo to integrate into iOS like 3rd party apps can in Android (like WhatsApp video calling does). Probably the biggest feature I miss from Android since moving to iOS.

Apple is probably doing more harm than good at this point for themselves by keeping iMessage/FaceTime so locked down to their hardware since their revenue stream is trending more towards services and less weighted in hardware.

<comment><USER15> I'm not sure if Apple ever explained why they didn't open up FaceTime? I seem to remember that when they presented it they said it would become an open standard?

<comment><USER16> There have been persistent rumors of an issue with patents.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> The fact that people are being evicted after not using Zoom [https://www.fsf.org/bulletin/2020/spring/trial-by- proprietar...](https://www.fsf.org/bulletin/2020/spring/trial-by-proprietary- software) is insane.

The industrial revolution and all of its consequences may not have been exclusively a disaster for the human race, and I personally don't share Bill Joy's fears of mass extinction [https://www.wired.com/2000/04/joy-2/](https://www.wired.com/2000/04/joy-2/), but proprietary software can cause serious problems for members of the human race and they should have a right to choose not to "use" it. Doesn't the US Constitution support the Amish's right to abstain from the power grid, etc.?

The Federal Source Code Policy should revert from requiring 20% of software written with forcibly extracted public money to be free to 100% as it was when open for public comment.

Any software that the public is forced to use, fund, or through network effects promote, the public should be able to audit and control. Windows is explicitly banned from the ISS. The lowly common people down here deserve a fraction of that privilege.

<comment><USER18> > The industrial revolution and all of its consequences may not have been > exclusively a disaster for the human race

for those unaware, this is based from the first line from Ted Kaczynski's _" Unabomber Manifesto"_, which starts with "The Industrial Revolution and its consequences have been a disaster for the human race".

It's actually an interesting read, that is... as long as you don't feel hostility towards rebelious literature: [https://www.washingtonpost.com/wp- srv/national/longterm/unab...](https://www.washingtonpost.com/wp- srv/national/longterm/unabomber/manifesto.text.htm)

<comment><USER19> Oh, wow. Starts off fairly innocent then comes in with this craziness -

"Many leftists have an intense identification with the problems of groups that have an image of being weak (women), defeated (American Indians), repellent (homosexuals) or otherwise inferior. The leftists themselves feel that these groups are inferior. They would never admit to themselves that they have such feelings, but it is precisely because they do see these groups as inferior that they identify with their problems. (We do not mean to suggest that women, Indians, etc. ARE inferior; we are only making a point about leftist psychology.)"

<comment><USER20> That pathological contempt for "the left" is how you know you're dealing with a work of true intellectual gravity.

<comment><USER18> There's lots of geniuses who are a little crazy or unhinged. e.g. bobby fischer

<comment><USER21> He was a raging anti-semite, holocaust denier, etc.

<comment><USER18> again, "geniuses who are a little crazy or unhinged".

<comment><USER21> Bigotry is just bigotry not a quirky trait of genius, as much as a one-time chess champion is a 'genius'.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER22> State Courts are too reliant on Zoom and using its breakout rooms for very sensitive communications. This IS infrastructure and should be very concerning. Its an area DHS needs to take a close look at.

<comment><USER23> We interface with courts every day, they pretty much forgot about our direct connections using Polycom VC and went straight to Zoom

</comment></comment><comment><USER24> BS, people use what works, it's just video calls.

What I find most bizarre is why zoom is on top, this is probably a lesson in how powerful marketing and timing can be for some types of products... But as a counter example: everyone at my company has ended up using google meets, just because through trial and error it fails the least and is the easiest for everyone to get into.

The last time I tried zoom for an external meeting and it was a nightmare, it felt like I had to jump through 10 hoops just to get into the frickin meeting, and even then 4/5 people couldn't get it to pick up their microphone through the browser API.

<comment><USER25> > BS, people use what works, it's just video calls.

It's not "just video calls". It's nonfree software belonging to a large for- profit company with huge power of developers over users. It will not end well. It's not the first time it happens. [https://www.gnu.org/philosophy/free- software-even-more-impor...](https://www.gnu.org/philosophy/free-software- even-more-important.html)

<comment><USER26> I think what he meant was that most users of zoom just see it as reasonably easy way to get into a video call with multiple people that just works (for the most part).

If jitsi scaled just as well as zoom and used the same amount of client-side resources, nearly everyone would use that instead. There's nothing to install so people would barely even know hey were using a platform

</comment></comment></comment><comment><USER27> A bit tired of the "critical infrastructure" argument. People are very quick to put all sorts of things into the category. He mentions network effects as the only real moat in the article.

If Zoom fails at being a product, people will move away.

<comment><USER17> > If Zoom fails at being a product, people will move away.

Literally. As in being evicted from their home: [https://www.fsf.org/bulletin/2020/spring/trial-by- proprietar...](https://www.fsf.org/bulletin/2020/spring/trial-by-proprietary- software)

<comment><USER27> Honestly, this one is so strange to me. UK government services somehow generally tend to be total rubbish but one of them is actually top-tier: gov.uk

They have accessibility and access and all these baked into the design AFAIK. I don't understand why American govs have such a hard time on this. Some are larger than the UK and have problems!

<comment><USER28> The UK is a deeply centralized place. There are only a few layers of devolved government, that you may or may not be subject to. There is an ability to set and enforce standards centrally.

The US is not. A federalized system means that various components work mostly separately from one another. A county court has sharply limited resources, and no ability to ask the federal government to send it a cadre of web developers. The state it's in may not provide a ton of resources for such things at the county level either.

The actual question here that may wind up a big deal is if a Zoom hearing is the equivalent of a physical one. If it is, failing to show up means forfeiting the right to be heard. Whether it's Jitsi instead might not be a substantive difference.

</comment></comment></comment></comment><comment><USER29> > _When Zoom goes down...business meetings, conferences, and webinars grind to > a halt._

I mean that's a bit of stretch. I work for a company that uses primarily Cisco Jabber (absolutely god awful, atrocious piece of software), but we also interact with folks using Microsoft Teams, Webex, Slack, Skype, join.me, etc. There are no shortage of video conferencing platforms.

</comment><comment><USER30> Zoom was not critical infrastructure 5 months ago. I think we'd adapt if needed.

</comment><comment><USER31> Is this a submarine written by Microsoft PR? Seems very likely it could be. Seems to boil down to: "Little upstart company can't be trusted with important business, better buy from an established player."

<comment><USER32> My company prohibited and even _remote-force uninstalled_ zoom and mandated Skype or MS Teams right after the last rash of bad zoom PR.

I feel pretty certain there was coordination from our Microsoft account manager and Microsoft's PR team on this front.

The funny part is that Skype is famous for zero days while zoom is famous for people running pseudo public non-password protected conference calls that got invaded by teenagers.

<comment><USER17> The less funny part is that to the HN users who together made [https://news.ycombinator.com/item?id=23555226](https://news.ycombinator.com/item?id=23555226) my current most upvoted comment on HN, Zoom is known for "a history of shadiness (MacOS hidden server to prevent uninstallation), outright lies (E2EE), and attacking the pillars of democracy (censoring Chinese Americans discussing Tienanmen Square)."

Not that MS isn't shady, dishonest, or even a deep state tool of oppression (in light of the Snowden leaks, and at least in some people's view Github's ICE contract).

</comment></comment></comment><comment><USER33> I think Zoom has become critical infrastructure, but not from a technological perspective. As @nicoburns points out in another comment, there are many companies that can do the job (MSFT, Google, Cisco, etc. have perfectly comparable alternatives here), and if you're willing to look outside of the biggest companies explicitly targeting business meetings, you have other companies with working technical infrastructure targeted at a different market (i.e. FB, Appl) and a batch-ful of YC startups trying to provide the same functionality to the same market.

What I think the article is pointing out is that when Zoom goes down, schools can't teach. And that's true. I think this is indicative of a usability / coordination / culture problem of missing fallbacks. For example, when Zoom goes down a teacher (at least to my knowledge) can't/won't quickly email out a "Hey class, Zoom is down so here is the Google meet link for today".

However, this is true of many technologies (if gmail is down I'm not getting email, if slack is down I'm not reading messages, and if Github is down I'm not pushing code). I think the larger problem is HOW MANY institutions it's a critical point of failure for. If Zoom goes down, our courts largely pause, our education largely pauses, our economy largely pauses, etc. The same is not true of Github or Gmail. In this regard it's closer to a powergrid failure.

This should go away as verticalized solutions and fallbacks appear (leading to broader diversity, where not all courts use the same platform), but I think the key things to think about until then are:

1\. Is there anything Zoom could do to create stronger network effects ([https://ayushsood.com/zooms-missing-platform/](https://ayushsood.com/zooms- missing-platform/)) preventing new entrants from entering the market? 2\. If they did those things, how could we respond to ensure Zoom's incumbent position didn't allow them to prevent new entrants? An old-internet answer would be to centralize the key nodes, effectively utilitize them, and then allow anyone to make a platform that connects to them (i.e. AT&T doesn't own telephony, DNS' don't own the internet, Gmail doesn't own email).

I'm not sure how likely this is given (1) we're moving towards centralization generally (2) the importance of performance in video streaming. Any abstraction creates overhead, and that might be a critical failure to open standards in the video streaming space.

</comment><comment><USER34> Is it?

I used like 5 different services in the last 7 months and all worked reasonably well.

<comment><USER35> I use like five different services _every day_ that work about as well as each other. I do happen to think Zoom does the best job out of the set, but it is only a marginal lead. It would be nothing to use something else.

</comment></comment><comment><USER36> Not sure why there isn't more open source alternatives in this realm. Since I only run Linux, I was amazed the first time I used Zoom that it had an actual working linux client. I've always had hopes that webrtc would take over. There's been demo's of video conferencing done over webrtc 5+ years ago and I always hoped it would get more traction. The best I've found lately is "Unamed"[0] but it is the product of one author.

[0]: [https://www.irif.fr/~jch/software/chat/](https://www.irif.fr/~jch/software/chat/)

<comment><USER37> Jitsi is pretty well-known and you can run a server yourself; are there any problems with it?

<comment><USER36> Never heard of it, but I will try it :)

</comment></comment></comment><comment><USER38> Zoom's lack of security focus has been a competitive advantage for them. It's clear that many users don't actually care that much about the confidentiality of their video meetings.

The low-friction nature of jumping on a Zoom call with a meeting code and PIN dominates security concerns. In fact, this phrase I've heard people use, "jump on a Zoom," indicates that the speaker expects it to be easy and fast to start the call.

Hopefully it's still possible to develop something that's both secure and convenient. But I fear there's no economic incentive to do it.

<comment><USER39> Zoom seem to have switched in recent times to using a Meeting ID and password. Most meeting links I get now are very long URLs which seem to hash the meeting ID and password. Hopefully this is a step in the right direction.

</comment></comment><comment><USER40> There are other options though. Things lit jitsi are growing in popularity. Its frustrating that a few "big companies" decided to use these tools so the rest of the world followed suit without doing their own research

</comment><comment><USER41> Like backing up data, having a contingency plan is important. Even if you like zoom because of certain features, having a backup service you can use in case of emergency is important. If everyone knows beforehand "which link to try if zoom is down today", then it is merely an inconvenience instead of an emergency.

<comment><USER42> Umm Slack can be used to coordinate a hop to another channel.

<comment><USER41> Yep, that's what I do, and work is easy to coordinate, but some other social events or organizations with inexperienced non-tech people don't have slack and don't think to check their email. It is easier for them to have a pre- specified backup option.

</comment></comment></comment><comment><USER43> As others have pointed out, it's laughable to consider Zoom to be critical infrastructure when so many alternatives exist.

Moreover, I find it somewhat strange that he's referring to Zoom as "critical infrastructure" instead of the major cloud providers like AWS or Azure. If Zoom goes down, it's an inconvenience to many. If AWS or Azure goes down, many business just stop functioning. Heck, many government departments might stop functioning, given how government infrastructure has been moving to "the cloud".

</comment><comment><USER44> > _But in many of the verticals in these sectors—such as banking or mobile > phone services—no single company dominates the market._

Gmail dominates e-mail in a similar matter.

And remember just a year ago barely anyone had even heard of Zoom -- there's still Google Meet, Microsoft Teams, FaceTime, Skype...

This piece feels like it's trying to stir up worry over nothing. Yes, critical business software tends to have outages once or twice a year. But no, Zoom doesn't appear to be any obviously better or worse than the competition.

</comment><comment><USER45> I work from home for the last 20 years. My clients and my workforce/subcontractors are all over the world. I had to use Zoom only with one particular client as of their insistence. Other then that I do just fine with the Skype. Not sure what is so "critical" about Zoom in particular.

</comment><comment><USER46> I feel like Zoom is the least concern. It is relatively replaceable, unlike providers with significant network effects - payment processors (Visa, Mastercard, Paypal, Stripe), social networks (Facebook, Twitter, Reddit), ad networks (Google, Apple, Facebook) or dominant share (Google search).

</comment><comment><USER47> Zoom is only going to stay widely adopted until an easy, viable alternative comes along and gets in the good graces of people in charge. There are some alternatives now, like Facebook's group calls on WhatsApp but that one's fallen out of favour for obvious reasons.

<comment><USER48> Aren't WhatsApp calls only on the mobile app? I think the desktop only does chats.

<comment><USER39> This rules WhatsApp out for many professional settings.

</comment></comment></comment><comment><USER49> Most of the internet that everyone in the world uses is constructed and maintained by companies that you don't give a single cent to, and who don't owe you anything if it goes down. This applies to a lot (maybe most?) things in the world. Say freight (trucks, trains, ships, etc) stops moving, for example. Within a month or two all the grocery stores would be empty. We'd have Mad Max-style convoys of cars driving around trying to find food and raid stores. It wasn't but a hundred or so years ago that most people survived on local food suppliers, and today almost none of our food is local.

</comment><comment><USER50> When we have trouble connecting with zoom, we just go back to the old school conference call which is pretty smooth. It turns out, you really don't need to see closeups of peoples neck hair to have a functional remote meeting. There are also a dozen other similar popular video chat services that can be step up just as easily as zoom. Zoom isn't a utility, it's just one of the many redundant ways out there that you can use to communicate with people.

</comment><comment><USER51> Zoom is fine, but like everything it will go down now and then. In that case there are alternatives. If it goes down, why not do just that one meeting in Google Meet?

</comment><comment><USER52> Would it be crazy to suggest that the postal service be reabsorbed back into the government and also given the role of managing all government communication channels?

</comment><comment><USER53> The pandemic has increased the load of data collection especially of students in classrooms. Four years ago we were appalled that china was putting cameras in classrooms. Now we are putitng cameras on every individual child with audio and absolutely no regulation or organizaiton structure.

The pandemic has significantly increased an already high level of data collection. Does anyone think government should have a role in regulation?

</comment><comment><USER54> More like "Live video capability on the internet is now critical infrastructure" but even then, phones probably cover 90%+ of use cases

</comment><comment><USER55> I laughed out loud while reading this article. The author sees some things so correctly, while completely missing the forest for the trees.

Author: _A single California-based company, Zoom, is now the foundation for education access from elementary school up through graduate school._

Me: _Hah. The 'foundation' for education for the last 100 years has been the US Government, which exerts so much power over the entire system._

Author: _Another challenge is that Zoom is a relatively young company (founded in 2011) that has experienced some security-related growing pains._

Me: _The US Gov. has experienced security-related growing pains, but at least Zoom doesn 't kill tens of thousands of people around the world every year._

Author: _In March 2020, the company was widely criticized for a dubious claim that it supported end-to-end encryption for videoconferences._

Me: _At least Zoom doesn 't have a track record of spending billions of dollars to subvert encryption technology, wiretap hundreds of millions of people, and then lies about it._

Author: _There are plenty of alternatives to Zoom, including Skype, Webex, and GoToMeeting. The challenge of course, is that Zoom has benefited from an enormous network effect._

Me: _Oh how I wish there were a less-violent alternative to the US Government. At least Zoom cannot enforce it 's monopoly of certain services with violence and billions of dollars of money_

<comment><USER14> The US Government is representative of all voting American citizens, you cannot compare it to a private company that is run by people who are not elected.

<comment><USER55> I agree.

The US Government is pretty impervious to change. For example, people still get arrested for smoking weed. Most o America supports decriminalizing weed.

Why is it still illegal? Shouldn't the government enact policies that most of America agrees with?

I mean... don't most of us agree that if a private company were doing any of this stuff, they would lose all their customers ASAP:

\- [https://arstechnica.com/tech-policy/2016/09/judge-child- porn...](https://arstechnica.com/tech-policy/2016/09/judge-child-porn- evidence-obtained-via-fbis-tor-hack-must-be-suppressed/)

\- [https://www.reddit.com/r/baltimore/comments/5jt6k0/where_the...](https://www.reddit.com/r/baltimore/comments/5jt6k0/where_the_fuck_are_all_of_these_tax_dollars_going/)

\- [https://www.thedenverchannel.com/news/crime/sterling- correct...](https://www.thedenverchannel.com/news/crime/sterling-correctional- facility-guards-gassed-room-full-of-muslims-beat-1-in-retaliation-lawsuit)

\- [https://www.aufamily.com/forums/topic/156988-obama-nsa- discl...](https://www.aufamily.com/forums/topic/156988-obama-nsa-disclosed- years-of-illegal-searches-on-americans/)

\- [https://reason.com/2017/04/25/a-man-died-in-jail-after- getti...](https://reason.com/2017/04/25/a-man-died-in-jail-after-getting-no- wate/)

\- [https://www.washingtonpost.com/lifestyle/magazine/what- happe...](https://www.washingtonpost.com/lifestyle/magazine/what-happens-to- people-who-cant-prove-who-they- are/2017/06/14/fc0aaca2-4215-11e7-adba-394ee67a7582_story.html?utm_term=.8e653e7c2e39)

I believe the burden of proof is on someone who thinks the US Government is a good representative of it's people.

<comment><USER14> I was very careful to word my previous comment to say the US Government represents the voting population. In 2016 there were only 157M registered voters, and only 138M voted in the presidential election that year. The population of the US was 321M in 2016 making the US Government represent approximately 43% of the overall population at best, most elections have a far lower turnout.

I didn't say the system was fair, but it's still not a fair to compare a private company to how a government is supposed to function. Governments enforce laws and provide public services. You want things to change? vote for it.

</comment></comment></comment></comment><comment><USER56> Video over IP has existed forever. Zoom is just one of many companies and services that do it.

</comment><comment><USER57> The navy did a decent job with sqlight and TOR. I'd love to see a video chat app from them.

<comment><USER58> > _The navy did a decent job with sqlight and TOR._

Tell us more?

</comment></comment><comment><USER59> Where I see effort needing to be spent is an easily setup/usable/configurable video-conferencing package of sorts. A good product would have two things: 1) easy to setup and scale video conferencing out of the box (like literally point at an aws account or k8s cluster and hit "go"), and 2) sdks for manipulating server-side rooms and client-side room/video appearance (but still the default rooms and default grids are in the box).

These two things as a common toolkit would accelerate offerings that could decentralize the marketplace. I've seen jitsi offerings (scalable setup isn't as straightforward last I checked which admittedly was a long time ago), twilio (still someone else's servers), etc. I'm sure these toolkits are being worked on (heck I'm working on one), it just takes a bit of time for the players to catch up in a market that exploded overnight.

</comment><comment><USER60> Meh, my kids just used the Google Meet links the teachers sent out when Zoom was down. Meet is even better - no app needed. Schools already have Google Classroom. With Meet you just click the link and it works.

<comment><USER39> Is the quality sufficent for classroom teaching? I use both for work as a teacher and I find Zoom much better than Hangouts. Zoom (when it works) is nearly flawless. Hangouts on the other hand has poor video, limited faciliation functions, limited grid/gallery view (and none at all on the iPad which is what my students use), random problems popping up, etc. Zoom is just much better for educaitonal use.

</comment></comment><comment><USER61> Whoever wrote this didn't live through the rise and demise of Skype.

</comment><comment><USER62> But we still have choices: Microsoft Teams, Rocket.Chat, Google Meet, etc. As long as it's not the only viable option, I don't think there's a need to worry.

</comment><comment><USER63> Nahhhh its just an app nothing to worry about /s

Blows my mind how quickly people accepted the product into their organizations. Zoom Phone... no thank you.

</comment><comment><USER64> Humm critical infrastructure? No alternatives? Has this guy heard of google hangouts, Skype, WhatsApp, FaceTime, Slack...

</comment><comment><USER65> Has the acquisition of Keybase done anything for Zoom yet? What was the purpose--to get engineers that knew about security?

</comment><comment><USER66> We use Google hangouts at work and it.... works just fine. What is the big deal about Zoom?

</comment><comment><USER67> has anyone built something on top of twilio's video offering?

it looks relatively straightforward, and seems to me like most tech companies (and some university IT departments) could pretty easily build internal conferencing stuff on top of it if they cared to.

<comment><USER68> I deployed one of their demo repos [0] and had some medium usage of it in production. It didn't get a lot of use (most use Zoom) and almost always had < 5 participants. It worked well enough. The cost seemed affordable too, though I never looked too closely. It didn't make a dent on our overall Twilio bill.

[0] - [https://github.com/twilio/twilio-video-app- react](https://github.com/twilio/twilio-video-app-react)

</comment></comment><comment><USER69> Really playing fast and loose with the term "critical infrastructure" for clicks.

</comment><comment><USER70> Frankly Zoom (i.e. video conferenceing) has been essentially pointless for K-6 education.

</comment><comment><USER71> next time someone talks about the first mover advantage point to Zoom

its quite funny if you think about it

</comment><comment><USER72> There are a ton of video clients available, it's not that special. It's just popular.

</comment><comment><USER73> This and email should have been what USPS was building over the last 20 years.

</comment><comment><USER74> It's not critical infrastructure: people can easily move to google meet.

</comment><comment><USER75> Not really. If it goes down I can use Hangouts or Slack, for starters.

</comment><comment><USER76> Anyone remember FUD? This is a FUD-piece á la MSFT-style.

</comment><comment><USER77> Honestly what's the worst that could happen?

</comment><comment><USER78> It's not. People always find a way to adapt.

<comment><USER79> It is critical infrastructure if you don't have a backup. I think that it would be easy to have a backup plan to replace Zoom, but this needs to exist.

<comment><USER78> But there are many alternatives - Facetime, Google Meet, Skype, etc;

</comment></comment></comment><comment><USER80> One word: Jitsi.</comment>


Anonymous Ex-Microsoft Employee on Windows Internals - <AUTHOR> https://i.imgur.com/y6clspP.jpg <comment><USER2> This is hilarious.

I especially loved the part where he explains that Metro was/is designed in PowerPoint. I did not expect that, but it makes perfectly sense now.

<comment><USER3> Microsoft's office tooling isn't too bad for doing design work actually

[https://www.youtube.com/watch?v=RZp7BvQJnU8](https://www.youtube.com/watch?v=RZp7BvQJnU8)

<comment><USER2> I am surprised. Its clearly better than paint.

</comment></comment></comment><comment><USER4> The most frightening part for me (if this is indeed real) is that they have no testers.

TBH the lack of testers shows: I used Windows 8.1 since it came out and apart from minor issues at the start (Start 8 is a godsend!), I never once had a BSOD... Win 10 gave me 3 in 3 months so I removed it.

<comment><USER5> They have technical testers, SDETs (or Software Development Engineer in Test) in Microsoft slang.

UX testers on the other hand... not so sure.

</comment></comment><comment><USER6> Doesn't sound unusual for large projects with a long history that had deadlines to meet and a ton of actual users.

</comment><comment><USER7> Sounds like mid 90s style C++ MFC GUI dev with widget IDs in the .h needing to line up with the .rc and all refs in the .cpp.

</comment><comment><USER8> It can't be that bad...can it? Now I wish I could see the source.

</comment><comment><USER9> Morbidly fascinating.... The reference to experimenting with "putting ads into the start menu" makes me wonder what the consumer business model for Windows 10 looks like?

<comment><USER2> You saw that they actually do ads there now (at least on some clients)?

</comment></comment><comment><USER10> This guy sounds childish</comment>


Tiny Wings 1.1.1 update fail - <AUTHOR> http://itunes.apple.com/it/app/tiny-wings/id417817520

<comment><USER2> I updated, I played the game, I kept my scores and achievements. This is on the secret version of the iOS though, maybe it's just a bug that affects 4.* installs?</comment>


ClaimID.com Shutdown - <AUTHOR> http://claimid.com/

<comment><USER2> I wish the major players (Facebook, Google, etc.) would join together to create an independent identity service that we all could use and trust w/o having to be a member of some particular corporate service.</comment>


Cybersecurity Humble Book Bundle - <AUTHOR> https://www.humblebundle.com/books/cybersecurity-wiley?mcID=102:5969310af4ab4ee605cf8d98:ot:57628d3c0dca63f1bd6cacd2:1&utm_source=Humble+Bundle+Newsletter&utm_medium=email&utm_campaign=2017_07_17_wiley_bookbundle&linkID=&utm_content=cta_button <comment><USER2> So, I've read most of these. Here's a tour of what is definitely useful and what you should probably avoid.

_________________

Do Read:

1\. _The Web Application Hacker 's Handbook_ \- It's beginning to show its age, but this is still absolutely the first book I'd point anyone to for learning practical application security.

2\. _Practical Reverse Engineering_ \- Yep, this is great. As the title implies, it's a good practical guide and will teach many of the "heavy" skills instead of just a platform-specific book targeted to something like iOS. Maybe supplement with a tool-specific book like _The IDA Pro Book._

3\. _Security Engineering_ \- You can probably read either this _or_ _The Art of Software Security Assessment._ Both of these are old books, but the core principles are timeless. You absolutely should read one of these, because they are like _The Art of Computer Programming_ for security. Everyone says they have read them, they definitely should read them, and it's evident that almost no one has actually read them.

4\. _Shellcoder 's Handbook_ \- If exploit development if your thing, this will be useful. Use it as a follow-on from a good reverse engineering book.

5\. _Cryptography Engineering_ \- The first and only book you'll really need to understand how cryptography works if you're a developer. If you want to make cryptography a career, you'll need more; this is still the first book basically anyone should pick up to understand a wide breadth of modern crypto.

_________________

You Can Skip:

1\. _Social Engineering: The Art of Human Hacking_ \- It was okay. I am biased against books that don't have a great deal of technical depth. You can learn a lot of this book by reading online resources and by honestly having common sense. A lot of this book is infosec porn, i.e. "Wow I can't believe that happened." It's not a _bad_ book, per se, it's just not particularly helpful for a lot of technical security. If it interests you, read it; if it doesn't, skip it.

2\. _The Art of Memory Forensics_ \- Instead of reading this, consider reading _The Art of Software Security Assessment_ (a more rigorous coverage) or _Practical Malware Analysis._

3\. _The Art of Deception_ \- See above for _Social Engineering._

4\. _Applied Cryptography_ \- _Cryptography Engineering_ supersedes this and makes it obsolete, full stop.

_________________

What's Not Listed That You Should Consider:

1\. _Gray Hat Python_ \- In which you are taught to write debuggers, a skill which is a rite of passage for reverse engineering and much of blackbox security analysis.

2\. _The Art of Software Security Assessment_ \- In which you are taught to find CVEs in rigorous depth. Supplement with resources from the 2010s era.

3\. _The IDA Pro Book_ \- If you do any significant amount of reverse engineering, you will most likely use IDA Pro (although tools like Hopper are maturing fast). This is the book you'll want to pick up after getting your IDA Pro license.

4\. _Practical Malware Analysis_ \- Probably the best single book on malware analysis outside of dedicated reverse engineering manuals. This one will take you about as far as any book reasonably can; beyond that you'll need to practice and read walkthroughs from e.g. The Project Zero team and HackerOne Internet Bug Bounty reports.

5\. _The Tangled Web_ \- Written by Michal Zalewski, Director of Security at Google and author of afl-fuzz. This is the book to read alongside _The Web Application Hacker 's Handbook._ Unlike many of the other books listed here it is a practical _defensive_ book, and it's very actionable. Web developers who want to protect their applications without learning enough to become security consultants should start here.

6\. _The Mobile Application Hacker 's Handbook_ \- The book you'll read after _The Web Application Hacker 's Handbook_ to learn about the application security nuances of iOS and Android as opposed to web applications.

<comment><USER3> How would you suggest approaching these books in order to translate the "reading" into practical/demonstrable skills?

For instance, I'm currently working through _The Web Application Hacker 's Handbook_ and also trying things out with OWASP's Broken Web App VM's. I feel like the book is covering a lot more than the broken web apps do, and the broken webapps don't really give a ton of practice, although so far I've only gotten into the "Training" webapps (Mutillidae, Webgoat, DVWA etc), so maybe just digging into the "realistic" apps more will expose me to more of what's in the book. Just looking for some guidance on how to approach the reading-vs- doing divide.

Thanks for the advice.

<comment><USER2> I'll echo what the sibling comment said about CTFs. Those are a great way of drilling the theory in the same way you need to drill problems to really cement mathematical maturity.

Practically speaking, read through each chapter and then try to find an example of this vulnerability in an existing web application. Try bug bounties as well to get a feel for where real world developers make mistakes. A lot of information security is learning to challenge assumptions.

</comment></comment></comment><comment><USER4> Is there a legal / not crazy expensive way to buy humble bundle books and get them printed on standard 8.5x11, bound in a series of binders / duotangs / twine? I'm going to buy the bundle, but greatly prefer physical pages to reading on a screen.

<comment><USER5> Legal: No. These are copyrighted works after all.

That said, If you have a laser printer it is probably cheapest to print it yourself. Buy paper that already has the three holes in it for the binder.

Still probably near the price of buying the actual books.

Edit: And if you still want to have there be a bit of a charity tie-in, the Amazon smiles program smile.amazon.com has a lot of charitable organizations to choose from.

<comment><USER6> RE AmazonSmile: Be sure that the organization you wish to support is aware of the program and actually registered with Amazon to receive the funds.

The list of charities that Amazon shows are from GuideStar USA which has compiled the information from the IRS, but this includes organizations which may not have registered and thus may never receive the donations.

See the section "Charitable Organizations that Do Not Register" here: [https://smile.amazon.com/gp/chpf/pd/ref=smi_se_saas_lpd_spd](https://smile.amazon.com/gp/chpf/pd/ref=smi_se_saas_lpd_spd)

<comment><USER7> How do you know if your chosen organization is registered? Is there a list somewhere?

<comment><USER6> Good question!

The best way appears to be to pretend you want to register that organization on Amazon's Org Central site[0] which shows which already registered. (An example search for Child's Play[1].)

As a shopper I do not believe Amazon makes this abundantly clear when you're selecting an organization. One thing to look for is the amount of information shown about the organization, specifically the incorporation year, as those that register have to fill out a profile.

According to the FAQ if a shopper selects an organization that is not registered and makes an eligible purchase they will track the donation. If the organization registers they'll get the donation, but if they have not after 2 years then Amazon will contact the shopper and give them 30 days to select a new charity. (I'm not sure if this then resets the 2 year clock or not.) If the shopper does not select a new organization then Amazon reallocates the donation across the registered organizations.

In any case the only way to be 100% sure is to inquire with the organization.

[0]: [https://org.amazon.com/](https://org.amazon.com/)

[1]: [https://org.amazon.com/npo/search?q=Child%27s%20Play&p=1](https://org.amazon.com/npo/search?q=Child%27s%20Play&p=1)

</comment></comment></comment></comment></comment><comment><USER8> I use 2FA on Humble Bundle. In order to log in, I have to solve several captchas. I then have to solve more to buy stuff.

All in all I have to solve the captcha 5 times or so, each time involves marking multiple images.

What sense does this make?

Either they trust the captchas (then they only need one), or they don't (then they should remove them). I've complained about this to them in the past but they haven't changed it.

<comment><USER9> You need a captcha to log in so that it's hard to make multiple fake accounts. You need captchas to buy stuff because otherwise one could make all accounts manually and then use them to quickly buy products to spend some bank account before it's banned.

I think each smallish site would benefit from designing their own captchas because that way the effort to solve for machines would be harder than solving the Google captchas. The effort to solve for humans would be a lot lower. This is perhaps one of the few areas where rolling your own security solution is beneficial by virtue of it being different.

<comment><USER10> I think perhaps you underestimate how hard it is to make a good captcha, that is one that is hard to solve programatically but not too hard to solve for a real person (this second part is often overlooked as easy). I suspect you'll find a lot of the prior techniques work well when applied to someone's hand- rolled version, given that coming up with something unique enough to not have prior work put into solving it (and have enough variation to make learning the entire data-set infeasible) is likely much harder than you think.

<comment><USER9> I don't know.. It seems stupid easy to me. Try something like "Type the third and fifth letters of the word elephant into the box below" with instagram filter applied. A bunch of variations for the first part like "the following word" and "the word in parenthesis".

Basically, I can't think of a way to come up with something ez that defeats it. You would have to train a neural net specifically on these images because normally neural nets are bad at instagram filter removal unless trained on it. Plus you can slow down/ban/mess with requests based on cookies.

There are basically infinite solutions. Would take a couple of days to implement and would be really fun. I guarantee you: if your site gets maybe 30k visitors a week, nobody would bother spending a month cracking your captcha when there are much easier targets out there.

Finally, you can make it super annoying to actually find where the image is by converting to svg and messing with html structure/compose image in JS. Now they're going to be forced to run a headless browser, take screenshots of the captcha page and finding the image within the page.

If they take the pay-per-captcha approach, I don't think anti-captcha and the like would make it too ez. Still days of work to set up something really brittle.

<comment><USER10> > Try something like "Type the third and fifth letters of the word elephant > into the box below" with instagram filter applied.

That was a common captcha technique a decade ago. It didn't last.

> Basically, I can't think of a way to come up with something ez that defeats > it.

You're mistaking your inexperience with the field and its methods for difficulty in solutions.

> Finally, you can make it super annoying to actually find where the image is > by converting to svg and messing with html structure/compose image in JS.

This isn't hard to defeat. SVG is really no harder than PNG or JPEG to deal with, and if you are programatically altering it, it's trivial to figure out the purpose of the JS and re-implement it, and pass in whatever randomized variables change it. Or just use node, and scrape it from the page and run it as delivered.

> Now they're going to be forced to run a headless browser, take screenshots > of the captcha page and finding the image within the page.

That's trivial. Far more trivial now than it was in the past, actually. There's plenty of systems around to run headless browsers. Some are to ease testing for developers, some are specifically designed for and marketed to people that want to do things just like this. Worst case, you use electron and make your own browser to do it.

</comment></comment></comment></comment></comment><comment><USER11> Schneier's "Applied Cryptography" by itself justifies the $15 bundle, IMHO. This is a great deal.

<comment><USER12> Mandatory: [https://www.schneier.com/blog/archives/2009/09/the_cult_of_s...](https://www.schneier.com/blog/archives/2009/09/the_cult_of_sch.html)

 _But in the introduction to Bruce Schneier 's book, Practical Cryptography, he himself says that the world is filled with broken systems built from his earlier book. In fact, he wrote Practical Cryptography in hopes of rectifying the problem._

[https://blog.cryptographyengineering.com/2011/11/07/in- defen...](https://blog.cryptographyengineering.com/2011/11/07/in-defense-of- applied-cryptography/)

<comment><USER11> As someone learning crypto (and slowly joining the Cult of Schneier), this is a valuable caution. Thank you!

</comment></comment></comment><comment><USER13> Security Engineering is free on the author's website :) [http://www.cl.cam.ac.uk/~rja14/book.html](http://www.cl.cam.ac.uk/~rja14/book.html)

<comment><USER14> Shhh, plenty of humble books are easily found, but they do good work and provide quality content.

</comment></comment><comment><USER15> I find this ironic this offering - "Bitcoin payments have been disabled for the Humble Book Bundle"

</comment><comment><USER16> Great, now there's another collection of books which I'll want to read which I'll feel bad about missing the deal for, then kick myself for never actually reading them in-depth.

I think I've bought 50 books from Humble Bundle (spending about $1/book), but I've only cracked open a few of them.

Also thank you dsacco for the recommendations!

</comment><comment><USER17> Remember to choose a charity entity for your donation!

ProTip: entities like the FSF, the EFF, Wikimedia and many others can be helped via the humble bundle!!

</comment><comment><USER14> To download all books at once: [https://gist.github.com/graymouser/a33fbb75f94f08af7e36](https://gist.github.com/graymouser/a33fbb75f94f08af7e36)

Improved *nix version further down the thread

Change "MOBI" to "PDF"/"EPUB" if desired

</comment><comment><USER18> I am interested in learning more about securing web servers (nginx, nodejs). Is there a book in this bundle that could help me? If you know any good books, please recommend me one.

<comment><USER2> Read _The Tangled Web._ It's an excellent book for developers that covers defensive tactics for securing web resources. The beauty is that it approaches the subject with developers in mind, not developers looking to become penetration testers (which is why I wouldn't recommend _The Web Application Hacker 's Handbook_ for your use case).

<comment><USER19> Which chapter(s) of The Tangled Web do you feel would benefit a web server administrator? It is a great book, but it is almost entirely focused on attacking _browsers_. It's not clear to me what changes someone might make to their nginx configuration (for example) in light of the information provided in the book.

<comment><USER2> I didn't read that out of _The Tangled Web._ It did cover attacks, but it was also a solid guide on shoring up defenses for developers.

To circle back to your question - nginx is fairly robust out of the box, but _The Tangled Web_ will cover extra configuration steps. For example - how to securely handle and serve files uploaded by users, including file naming conventions.

Other best practices for configuring things like TLS and CORS will also be covered, which are in the purview of any developer setting up a web server. My interpretation of the book was that it covered attacks that are executed through the browser (especially via user input) insofar as it's instructive for developers to learn how to avoid them.

</comment></comment></comment></comment><comment><USER20> Ironically the Malware Analysts cookbook epub seems to be infected by a trojan. And the Web application hacker handbook also in epub by another one

<comment><USER21> My first thought was: "Not surprising for a book on malware, probably triggered by an example in the book".

I uploaded the file to virustotal.com and malwr.com. VirusTotal has reports from several scanners, so this is not just misreporting from a single scanner. malwr.com opens the file in a sandbox and it says that it makes HTTP connections and installs itself for autorun at Windows startup.

The Web Application Hacker's Handbook is reported by my local ClamAV 0.99.2 with current sigs but not by VirusTotal. malwr.com also reports HTTP connections and autorun.

I uploaded several other EPUB files and none of them was reported to show such behaviour.

Strange...

</comment></comment><comment><USER22> Fantastic, glad to have more reading to prep for defcon!

</comment><comment><USER23> CEH v9 at 15 USD bundle-level is quite a joke, IMHO that should go to the 1 USD level but anyway as someone said Applied Cryptography might be the selling point here.

Personally speaking the only books valuable in this bundle are "Practical Reverse Engineering: x86, x64, ARM, Windows Kernel, Reversing Tools, and Obfuscation" and "Applied Cryptography: Protocols, Algorithms and Source Code in C, 20th Anniversary Edition" the other are either quite outdated, too oversimplified or script-kiddie level stuff.

<comment><USER24> What do you have against CEH v9?

<comment><USER25> Not the original commenter, but just skimmed that book - it's really, really shallow.

It seems well written, and covers a lot of ground, but it's literally introductory in the sense of "hey, ianai, let's introduce you to the concepts. Concepts, this is ianai; ianai, these are the concepts, now wave them goodbye and let's move on to the next topic".

Answering the test questions included (indicative of the actual certification questions?) generally requires being _aware_ of all the concepts - it doesn't require understanding how/why they work; it doesn't require being able to apply them; simply knowing that they exist and how they're named.

It might be a good starter book from someone coming in to the domain, since it would list all the key things that you'd need to know and introduce you to most of the terminology, but in order to actually _learn_ any of these things (and IMHO to be able to pass certification related to any one of these things) you'd need to go _much_ more in depth than this book will allow.

<comment><USER24> Aye, good to know!

</comment></comment></comment></comment><comment><USER26> "Pay what you want^"

^As long as it's at least $15.

It bothers me that Humble Bundle has so heavily embraced this type of marketing.

<comment><USER27> The first tier is not $15, it's $1.

<comment><USER28> and it's only $1 to prevent shills from buying in $0.1 increments and defeating the whole purpose of the service.

<comment><USER29> If I recall correctly, it's a holdover from the video game bundles they offer. Initially you could just plug in $0.01 and get their bundles for a penny each. They naturally would have trouble because of card processing fees, but they allowed it until shortly after they started giving out steam keys for games. A "security" mechanism that steam has in place is they don't allow users who haven't purchased any games to participate in trading items/playing the steam marketplace. Scammers were using humble bundles as a super cheap way of getting tons of keys they could use on fresh accounts so they could be used to scam items from legitimate steam users.</comment></comment></comment></comment>


Awesome Python Applications: 180+ case studies in shipping Python software - <AUTHOR> https://github.com/mahmoud/awesome-python-applications <comment><AUTHOR> Linked the GitHub, but here's a post about why it was worth spending a few weeks compiling this list: [https://sedimental.org/awesome_python_applications.html](https://sedimental.org/awesome_python_applications.html)

</comment><comment><USER2> I like Mayavi, but I wouldn't say it was a 'great' Python application; it's a pain in the install for e.g. Something like NumPy or AstroPy are clearer successful scientific Python projects to my mind.

<comment><AUTHOR> Good to know! It seemed to meet the criteria here: [http://sedimental.org/awesome_python_applications.html](http://sedimental.org/awesome_python_applications.html)

I'm curious if the userbase is overstated, but otherwise it seems to be well- known enough ;)

</comment></comment><comment><USER3> As somebody learning Python right now...Thank You!

</comment><comment><USER4> This is really awesome, thank you for doing this!</comment>


European OS market share: the rise of OSX - <AUTHOR> http://www.tech-no-media.com/2009/10/european-os-market-share-rise-of-osx.html

<comment><USER2> The real story: [http://www.atinternet-institute.com/en-us/internet-users- equ...](http://www.atinternet-institute.com/en-us/internet-users- equipment/operating-systems-august-2009/index-1-2-7-176.html)

The numbers are much less impressive than the blog post would suggest.</comment>