Facebook e-mail mess: Address books altered, e-mail lost - <AUTHOR> http://news.cnet.com/8301-1023_3-57464415-93/facebook-e-mail-mess-address-books-altered-e-mail-lost/?tag=mncol <comment><USER2> Facebook simply doesn't have an ethical central core. They've shown over and over that when user privacy or security conflict with facebook's goals, they'll choose facebook over the user. It's always relatively subtle; they strive to only do what they can get away with...but it's always pushing the line, and is never based on trying to do what's right, merely avoiding backlash. Facebook, the company, is kind of a sociopath.

I wish it weren't this way. I have several friends within facebook whom I like and respect, and they produce a lot of great technology. But, I fear facebook having more power than they already have. It can only end badly for the user.

Facebook really needs a "don't be evil" moment, but I suspect it's too late, and I suspect that Zuckerberg simply doesn't think that way.

<comment><USER3> > _I have several friends within facebook whom I like and respect, and they > produce a lot of great technology._

I find this idea interesting. Can an entity like a corporation have a life beyond that which is given to it by its employees? Like the ship of theseus, can you replace all employees and still have a business that "feels" the same?

<comment><USER4> Of course. Work with any government bureaucracy and you'll notice it pretty quickly. Entire divisions can be filled with good, bright, well-meaning people, yet that division can still churn out crap work product. How is that? An organization's culture and the way incentives are aligned can quickly override any pockets of talented individuals.

<comment><USER3> So the obvious question is: How does one change this from the inside? Does the plan of attack differ if you were a line worker versus a VP?

</comment></comment></comment></comment><comment><USER5> About an year ago, when the story blew up about the Facebook app sneaking through your phone contacts and adding friends numbers' to your Facebook account. I instantly deleted the Facebook app from my Android, and told my friends Facebook was clearly not reliable to have an app privilege on your phone. I called it that they would eventually do even worse, if you let them have an app in your phone. The general consensus was that I was an alarmist doomsayer extremist exaggerating over nothing.

Well, who is crazy now? :) And I repeat what I said before. If you don't delete your Facebook app. They'll keep pulling stunts like these over and over again. It's very clear from their history that they have extremely little care for customer interests.

<comment><USER6> user =/= customer

<comment><USER7> User = product

If x service is making money off their product ( _you_ , user) then you should really have at least some "rights". The key word being _should_.

<comment><USER8> Why should users have rights in this situation, other than the right to stop using the service? I understand why it would be nice if they did, but why _should_ they? Why is it am imperative?

<comment><USER9> It depends where you are but there are certain legal rights that no terms of use can waive.

They're set up as a minimum standard of acceptable behaviour that someone should be able to expect by default and that there is no reason why a company shouldn't / can't adhere to. Generally they're around physical protection from harm, though they do extend to other things (including Data Protection in Europe).

Why should these rights at least exist? Because (a) people can't be expected to take a detailed look at every product and service they might use to assess it fully, that would simply be too time consuming, so you set a basic standard for prevention of harm and (b) can you imagine what the likes of Facebook or Exxon or whoever might do without them.

<comment><USER8> _people can't be expected to take a detailed look at every product and service they might use to assess it fully, that would simply be too time consuming, so you set a basic standard for prevention of harm_

So basically, you're saying people should trade trust in one third party (the service provider) for trust in another third party (whoever sets and enforces the basic standard). I can understand why people may choose to do this (though in many cases I don't think the second third party is any more reliable than the first), but I don't see it as an improvement. I don't think FB cares about whatever legal standards are in place; to them that's just a cost of doing business. But they _do_ care about losing users.

 _can you imagine what the likes of Facebook or Exxon or whoever might do without them._

Sure, and I can also imagine people not using FB or Exxon (many people boycotted Exxon for years after the Valdez spill, IIRC). Also, I can turn the question around: can you imagine what those who are trusted to enforce standards of behavior might do once they know the public trusts them and won't question what they do? How good a job did regulators do at enforcing standards of behavior on investment banks?

And before you ask, I do _not_ use FB, precisely because I don't trust them to take care of my data. And it's not just FB; I don't trust Google to take care of my data, which is why I don't use gmail, for example, or any other Google services except search and maps. I don't expect _anyone_ to take care of my data unless I'm paying them, as a customer, to do that--and even then I watch them.

<comment><USER9> No, that's not what I'm saying. It's not one or the other, these constraints don't prevent the possibility that people may leave if they don't like a service and what it does, they're an additional guard against the very worst potential abuses.

I'm not saying that because company X conforms with the (very light) regulation in place that they're to be trusted, just that I see benefit in having two forms of protection in place.

<comment><USER8> You're assuming that there is an actual net benefit to having the second form of protection. I don't think there is. It may seem like a short-term benefit if some regulator actually catches, say, Facebook in the act of misusing people's data; but the long-term effect is that people believe that they can actually trust a company with their data when they're not a paying customer (or even, beyond a certain point, when the _are_ a paying customer). And since the long-term outcome of _any_ regulatory scheme is regulatory capture, sooner or later FB will just be buying the regulations they want, and the so-called protection won't be there any more. Again, I refer you to the economy since 2008.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Well, this is my gripe with their "go fast and break things" mantra. It works as long as you have such a highly desirable product that your users just don't care if you're doing everything right. (Or maybe you're in a non-mission- critical business, or better yet, your customers are a bunch of kids!)

I'm all for going fast and sincerely believe in "A sense of urgency", but Facebook is really lucky they're not serving more serious/demanding customers.

<comment><USER11> Facebook is serving shareholders now. I'm hoping there are some serious repercussions internally at FB for this, because as a shareholder, I'm pissed they messed this up because the user base is upset and will continue to stop trusting Facebook.

How's the stock supposed to get back to 38 now?

<comment><USER12> _How's the stock supposed to get back to 38 now?_

Sorry to be cynical, but: it was never supposed to be at 38 in the first place. Facebook isn't worth anything close to its nominal market cap, it's just the latest very high profile pyramid scheme, or rather it would have been if they hadn't gone in so absurdly high with the IPO that even the heavyweight investors interested in risky tech stocks have mostly run away.

</comment></comment></comment><comment><USER13> Can any attorneys out there explain how altering computing devices to redirect and intercept email is not a criminal act when done without the knowledge or consent of the owner?

If any of us pulled the same stunt, even if authorized to access the system for other reasons, would we not be subject to prosecution? Hopefully, the same will happen to FB.

In addition to the Federal communications and cybercrime statutes, there is California Penal Code 502:

(c) Except as provided in subdivision (h), any person who commits any of the following acts is guilty of a public offense: (1) Knowingly accesses and without permission alters, damages, deletes, destroys, or otherwise uses any data, computer, computer system, or computer network in order to either (A) devise or execute any scheme or artifice to defraud, deceive, or extort, or (B) wrongfully control or obtain money, property, or data. ... (4) Knowingly accesses and without permission adds, alters, damages, deletes, or destroys any data, computer software, or computer programs which reside or exist internal or external to a computer, computer system, or computer network. (5) Knowingly and without permission disrupts or causes the disruption of computer services or denies or causes the denial of computer services to an authorized user of a computer, computer system, or computer network. ... etc.

It remains to be seen if there is a prosecutor with the backbone to go after this.

<comment><USER14> Well, "Knowingly accesses and without permission... uses any data" would make the accessing and transmission of contacts (a la Path and many other apps) illegal. Except there's probably a clause somewhere that you agreed to without reading which lets them do that, and the same may be true here.

<comment><USER13> While it's probably true that the EULA permits FB to _read_ the contact list, and update it in expected ways, there are many points covered in those statutes: interception and destruction of data, making the system unavailable for its intended use, etc.

Can anyone find language permitting FB to destructively alter the contents in profoundly unusual ways so that email is redirected to FB servers for interception and delivery as FB deems appropriate?

I'd really like to see an informed legal opinion on the possible criminality of their actions.

<comment><USER15> Not sure about criminal charges, but at the very least, it seems like a negligent act resulting in real damages to many people. I don't think a class- action lawsuit is out of the question.

</comment></comment></comment></comment><comment><USER16> As I understand it, when an email address on Facebook gets synced to a phone, that's just a cache. Any updates to the email address on Facebook automatically update the cache. When friends update their email addresses, the cache gets overwritten and you don't have their old addresses anymore.

But now, Facebook changed people's email addresses without their permission. The cache gets updated, and boom, the old address is gone.

But what makes it more scary is that people don't actually remember that they originally got the address from Facebook and they don't understand the caching behavior. All they know is that the old address is gone. So they think that email addresses that they _didn't_ get from Facebook are also at risk.

The workaround is to manually copy email addresses from Facebook to some other system. Any email addresses you get from Facebook by automatically syncing aren't safe.

It's a pity; after all, most of the point of the system is that you shouldn't have to manually update your address book when your friends change their contact info.

<comment><USER17> That's an excellent explanation. It also fits the mold of just about every other "service X broke into service Y and stole my info" story, wherein people forget lots of other plausible explanations.

<comment><USER18> And a good lesson as to why you should never make unannounced changes to your user's data. They will think you "broke" something, even if it never worked the way they thought it did.

</comment></comment></comment><comment><USER19> The more important question is, what are Apple and Google doing allowing apps write access to a user's address book??

I can't believe anyone at Facebook was dumb enough to think this was a good idea. But at the same time, I can't believe some "rogue engineer" did this by accident. I'm curious to see what Facebook says about it.

<comment><USER20> They have to allow write access to _some_ applications otherwise there can be no third-party address book apps. If there was such a permission, you can bet that facebook would have asked for it by default. You can also be sure that hundreds of millions of people would have granted it and we would be seeing the exact same problem.

The root of the problem is facebook. The important questions should be directed at facebook. We can look to Apple or Google for help, but ultimately when we install an application, we grant it our trust and Facebook routinely tramples all over it. Turns out that it's a winning strategy.

<comment><USER21> This is a very good explanation. But it also points out that the permission system is not really helping when you want background info on what's going on - you and I know this info from a background in development. Take a look at the permissions for google maps on android as an illustration.

</comment></comment></comment><comment><USER22> As someone who quit facebook a while back, I can't help but feel that this kind of event vindicates me. Sometimes I'm tempted to re-create a minimal account on the service just for findability, but even that small step would have been enough for facebook to hijack my contact info in a friend's phone. There really is no way to have a facebook account at all, no matter how infrequently you use it, without getting screwed over.

<comment><USER23> How do you know when someone has deleted their Facebook account?

They'll tell you.

<comment><USER24> Too true. It's getting tiring reading the comments of posts like this because I know it's going to be filled with people boasting about how they've already deleted their accounts/just did it. The HN crowd is a tiny, tiny minority in the pool of Facebook users, our actions are hardly representative of sea change.

</comment></comment></comment><comment><USER25> "Everything that has transpired has done so according to my design."—Mark Zuckerberg

<comment><USER26> That doesn't speak too well of his design ability.

<comment><USER27> Just to be clear, that quote is from Emperor Palpatine (Star Wars), not really Zuckerberg

<comment><USER28> They're two separate people?

<comment><USER12> Always two there are, no more, no less: a master and an apprentice.

</comment></comment></comment></comment></comment><comment><USER29> I just deleted the Facebook app from my iPhone. I have no idea if it altered any of my contacts, but this certainly does scare me enough to warrant deletion.

<comment><USER30> I wish I could do that. I wonder if Facebook paid HTC a lot of money to make the Facebook app un-uninstallable.

<comment><USER31> If you go to Settings >> Accounts & Sync, can you at least uncheck "Sync Contacts" for Facebook?

<comment><USER32> Or just remove your Facebook login credentials entirely, thus rendering the app unable to do anything? (I don't have that exact model but I think this should work, no?)

<comment><USER33> I have the Facebook app forced on my Nexus One (thanks, Google!) but I never logged in and it didn't touch my contacts as hoped.

</comment></comment></comment></comment></comment><comment><USER34> I really don't understand this - FB has repeatedly shown they don't give a shit about users' privacy etc. They also don't care about breaking stuff. This is not the first time it is happening, and won't be the last. So, Why are people putting their work email ids on their FB account???

</comment><comment><USER35> I've sent several emails to my Facebook email address just for shits and giggles. I've never gotten a single one to go through.

<comment><USER36> You probably already know this but just to confirm, emails dont show up in messages. Instead they go to 'other' in messages, which no one checks anyways.

<comment><USER37> That's not consistent w/ my testing:

\- email from address associated w/ facebook account goes directly to facebook messages

\- email from address not associated w/ facebook account does not arrive, in neither messages nor 'other'

</comment></comment></comment><comment><USER33> An excellent reason not to give apps write access to your address book willy- nilly. You can't trust them not to screw up.

</comment><comment><USER38> Is it not illegal to intercept private communications without the parties' consent? Seems like this opens them up to a massive lawsuit...

<comment><USER39> I think you'd have to show they accepted the email, then chose not to deliver it to the user.

I think this is just incompetence. hopefully, it's coupled with a little incontinence.

<comment><USER40> But the thing is they're not supposed to get the email at all. The user goes into their contact book and selects the person they want to email, and suddenly Facebook is getting the email instead of it being sent to the person's actual email address.

<comment><USER41> I think Facebook's position on this would be that the user goes into their contact book, selects the @facebook.com email address of the person they want to email, and then Facebook gets the email because it's on their service.

</comment></comment></comment></comment><comment><USER42> I've been complaining for ages that Facebook's contact sync was broken in Ice Cream Sandwich. I only had the app installed so I could sync my friend's contacts details with Facebook anyway, and every update I'd check to see whether they'd fixed it. But it was still broken, even after dozens of updates.

Now I'm glad it's broken!

<comment><USER31> Just in case you were being serious... Facebook sync wasn't broken in ICS. Google intentionally disabled the feature in Gingerbread.

"Google says it is removing Facebook contacts because they are not stored locally on the phone like other contacts. This means that, unlike your Google contacts, the Facebook listings aren't exportable so, if users decide to close their Facebook accounts, those contacts will disappear from the address book, something which violates Google's notions of data portability."

[http://blog.laptopmag.com/google-removes-facebook- contacts-f...](http://blog.laptopmag.com/google-removes-facebook-contacts- from-address-book-on-nexus-s-future-lead-devices)

</comment></comment><comment><USER43> The part that really bothers me - The address books on iOS 6 changed without the user noticing.

</comment><comment> at-fates-hands The funny part is my friends thought I was crazy NOT to sync my Facebook contacts with my gmail contact list.

This is a great example of why I continue to keep my information segregated across different networks. For all of the nonsense Facebook keeps pulling, I continue to have a healthy does of scepticism when allowing them access to ANY of my information - let alone letting these networks interact with each other.

</comment><comment><USER44> Losing emails and user dissatisfaction is just a bug. Making their email addy the primary specifically to seed everyone's contacts with it via sync-enabled apps was the feature.

<comment><USER45> Behaviour awfully similar to that of a virus, or malware.

</comment></comment><comment><USER46> How does this not violate CFAA? This really sounds like a company that believes it is above the law.

<comment><USER47> Uh, how could it violate CFAA? It's their own systems, and their data (they own it all).

<comment><USER48> I have no clue whether this violates CFAA, but arguably they usurped address books and intercepted user's communication.

This was obviously intentional, and the timing makes sense -- Apple is rolling out address book synchronization with Facebook.

I hope this forces Apple to reconsider.

</comment></comment></comment><comment><USER49> I wonder how high up within Facebook that decision originated and was ultimately approved.

</comment><comment><USER50> Amount raised on IPO: $16 Billion

Value of Zuck's shares post-IPO: $19 Billion

Pissing off 800 million users with a forced email change: PRICELESS

There are some things money can't buy. For gut-wrenching invasion of privacy there's Facebook.

</comment><comment><USER51> Quite apart from the ethical ins and outs of this, it's simply a buggy release.

I played around with my new (and unwanted) email address and found the following:

1\. Email sent to the new facebook address from the gmail account associated with my profile gets delivered to my facebook messages.

2\. Email sent to the new facebook address from another gmail account I own is not delivered. It simply disappears.

This is basic stuff. I guess they did like _no_ testing before they released this f __*up to their billion or so users.

</comment><comment><USER52> Bundling things together gives the bundler more leverage. And opens you up to paying more when they make a mistake.

An older German lady I know told me many times growing up that you should not $h|t where you eat. In other words, it pays to keep some things separate from other things.

If you value someone's contact information, keep track of it separately. And have a backup.

</comment><comment><USER53> Facebook managed to remove any opportunity to email me from my Facebook page. I'd previously set my @facebook.com email as visible only to me, so that it wasn't published to the page. They didn't change that, but they did set all of my other email addresses as "hidden from timeline."

</comment><comment><USER54> Here's my fear. I deleted my FBook account a couple years ago. And it seems to be at least inactive, but I assume there is still an entity representing "me" in some state at FBook, because that's how FBook rolls.

As I understand this latest feature, if I am a contact on someone else's phone, and their FBook app notices that I am a FBook user, that person's entry for me get's slammed to now point to me@FBook. So when that person emails me, it no longer goes to email@example.com, it goes to email@example.com. Which is an address that may or may not exist, but I'm gonna go out on a limb here and guess that FBook doesn't respond with a no such address, it just consumes the data. And I'm suddenly unreachable.

</comment><comment><USER55> I wonder if this isn't a breach of the stricter privacy laws we have in Europe. Redirecting the email I send to my frieds to Facebook's servers without asking for my consent looks very suspicious to me.

</comment><comment><USER56> At first I was wondering what Facebook has to do with email.

Then I read this:

"alterations that had begun in their contacts and address books outside Facebook -- valid e-mail addresses were being changed for @Facebook without people's awareness"

WTF?! This sounds like the facebook app has access to modify the contents of a phone's address book without direct user action. Is that what's happening here? I just checked all my contacts and everything seems fine (BB7.1)

</comment><comment> angry-hacker Does anyone know if there is some kind of possibility to copy facebook contacts to my phone? I'm using Android+Facbook sync. Phone is rooted... I have at least 100 people who are facebook contacts and the ones I don't want to loose, but I'm not even able to copy paste their number not to mention copying them to phone/sim card...

I know facebook doesn't want you to do it, but there has to be a way....

<comment><USER57> I just uninstalled facebook from my android phone. The facebook contacts and their information is still being shown in my phone contacts list. I am not sure if it will be deleted in future (during some sync operation). If that happens, I may install it back again. In the latter scenario, merging the contacts however will be a pain.

<comment> angry-hacker I tried the same and contacts disappeared.

<comment><USER57> Okay, I tried to look some more. I discovered that there is a "Facebook" option in the accounts list that I can add on my phone (Motorola Droid Bionic). This facebook account was responsible for the facebook contacts in my address book. So, I went to the facebook website and revoked its permission to access my account.

Its been more than a day now, and the facebook contacts are still there in my phone. May be you want to add the facebook account, and then revoke its permission from the facebook website. I think this will leave your facebook accounts in your phone.

I will update this post if my contacts disappear in near future.

</comment></comment></comment></comment><comment><USER58> OMFG, are they this desperate to fight off Gmail!

People call G+ a desperate attempt, but this is ground-bottom. There's only word to describe this, disaster.

</comment><comment><USER4> Anyone else find it odd that the day the facebook email change scandal broke, they announced Sandberg was their first ever female on the board? Really looked like they had a distraction press release in the pipeline for exactly this scenario, and they popped the top as soon as there was backlash.

</comment><comment><USER59> I feel so sad that there is no competing product out there and thus FB has the balls to repeatedly treat its users insignificantly.

It's even more sad FB is using it (the fact that all of my friends are on FB and hence I wouldn't switch) to take undue advantage in a way that I would not permit had they asked me.

</comment><comment><USER60> The depressing thing about this is that people will notice that email doesn't work and then use fb messages even more. I mean, how many people are still with one of the major banks, only a few years after their greedy behavior caused so much harm?

</comment><comment><USER61> Don't many phone users sync their phone contacts to Outlook and similar? So wouldn't this lead to "work email" contacts being caned by Facebook?

I just checked mine, but seems all my contacts only have phone numbers since I use Gmail and GApps web-only accounts.

</comment><comment><USER62> That is why you need Distributed Social Networking Protocol. [http://en.wikipedia.org/wiki/Distributed_Social_Networking_P...](http://en.wikipedia.org/wiki/Distributed_Social_Networking_Protocol)

</comment><comment><USER63> To be clear, does this affect iOS 5 address books? What if those contacts are pulled from an Exchange account? I sync contacts but thought that only went as far as photographs and putting those silly links to profiles.

<comment><USER64> iOS 5 doesn't have FB integration, so it couldn't happen directly.

I don't know if the FB app can write to your contacts (although it can read them, which caused that dust up earlier in the year). That's where the danger might be for iOS 5 users.

<comment><USER25> The FB app can update your contact photos when your FB friends update their profile pics, I actually like that feature, it's fun and relatively harmless.

<comment><USER64> I didn't know that (I don't log into FB much), that's actually kinda neat. That would be a great way to keep photos for everyone.

</comment></comment></comment></comment><comment><USER39> If you're not capable of actually pinning down the social graph, just cut links until you get to something tractable. Excellent plan.

</comment><comment><USER63> To be clear, does this affect iOS 5 address books?

</comment><comment><USER65> This is why I never upload my pictures or videos on facebook and I have my home town and current city are set to Valhalla and Atlantis.

[http://techcrunch.com/2009/12/15/facebook-lie-terms-of- servi...](http://techcrunch.com/2009/12/15/facebook-lie-terms-of-service/) "Mr. Schnitt suggests that users are free to lie about their hometown or take down their profile picture to protect their privacy..."

The clarification from Barry Schnitt (Facebook's Director of Corporate Communications and Public Policy) was even worse:

"I think WSJ is paraphrasing. What I said is profile picture and current city are optional. You don't have to include a profile picture or you can include a picture of your dog or anything you like. Similarly, you don't have to indicate your current city or you can indicate that your current city is "Atlantis", "Valhalla" or, again, anything you like. We hope people will use accurate information if they are comfortable doing so because that information helps them to be found by their friends, which is part of the point of joining the site."

</comment><comment><USER66> I hope someone chimes up again saying how Facebook has so many smart engineers on staff. This looks like either an intelligence failure, or an ethics failure, or a little of both.

</comment><comment><USER28> God damn facebook. This is why i hate their motherfuckin' asses

<comment><USER36> What? Is this Reddit now?

<comment><USER28> So I hold an opinion and do have substantial intellectual abilities. Does that mean I must be erudite in every post? <\-- rhetorical answer because the answer is an assumed "No."

<comment><USER28> Lolz. Even a reasonable post gets downvoted.

Now I'm just itching for downvotes. GIVE ME THEM.

<comment><USER67> I think you are being downvoted because none of your posts are reasonable or add to the discussion on HN. For example, you asked if all your posts must be erudite, and you believe that the obvious answer to your question is "no".

Basically, when you can't even answer your own rhetorical questions correctly, then it's pretty much all downhill from there.

</comment></comment></comment></comment></comment><comment><USER68> Why would anyone on God's green earth sync their Address book to facebook!?! It's a social network for crying out loud, not a work place! WT..!!

This is what happen's when you mix work and pleasure ha ha, it's a stupid kid's playground to post stupid thing's and do nothing all day! I just can't get past it, why would anyone sync their address book to FB!? ha ha ha

<comment><USER24> Why on earth do you think that everyone's address books are business-only?</comment></comment>


Build2, a Cargo-like dependency and build manager for C/C++ - <AUTHOR> https://build2.org/build2-toolchain/doc/build2-toolchain-intro.xhtml <comment><USER2> The problem with these build tools is never the tool itself (though admittedly I never get far enough to test them). It's the lack of packages in the repositories that back them up. For build2, the central repository is [https://cppget.org/](https://cppget.org/) which has 24 packages. 24!! For comparison, npm has more than 600,000 and PyPI has more than 140,000. Now of course not all of those are great quality, but it does illustrate the scale of the problem.

More concretely: As a go-to example for these repos I always look for Google's protobuf library. Most projects I work on depend on three or four high-level libraries which, in turn, depend on protobuf; if even protobuf isn't there (as is the case at cppget.org) then it's hopeless that those higher-level libraries will be.

So far, the best native package manager I've come across is vcpkg [1]. I hate that it's made by Microsoft, and I hate that it uses CMake, but there is no easier to build and use e.g. gRPC on Windows. They recently added Linux and Mac support (static linking only). Edit: for fair comparison, it has just over 700 packages.

[1] [https://github.com/Microsoft/vcpkg](https://github.com/Microsoft/vcpkg)

<comment><USER3> I don't believe we can get to thousands of packages by packaging a substantial part ourselves -- we will just get bogged down in this instead of building a decent toolchain. Instead, the "secret" I believe is to make creating, testing, and publishing C/C++ packages as easy and frictionless as possible. This is how you get to thousands of packages and this is what we are trying to do.

<comment><USER4> This is exactly what linux distributions do. Big ones with lots of contributors package around 10k libraries themselves. Small one-man shows package at least a few hundred common c / c++ libraries.

This is also why I'm not terribly interested in these language-ecosystem package managers. Good C libraries, such as I use in my own C projects, keep a stable backwards-compatible interface for _years_.

<comment><USER5> Any sufficiently large software project can't rely on the distribution to provide anything for them. The macOS and windows application distribution models are much saner in that regard. The goal should be a self contained, easily reproducible build with minimal external system dependencies. This is why build systems like bazel are so great: They force you to be very explicit about what you depend on and give you a stable and reliable way to reproduce your build once you've specified that.

<comment><USER6> > Any sufficiently large software project can't rely on the distribution to > provide anything for them.

This is factually wrong. I'm able to compile things as complicated as clang/llvm, firefox, and LibreOffice relying mostly on dependencies installed through the distribution's package manager.

<comment><USER7> The distro package manager is there to provide your day to day apps and the libraries to support it.

Sooner or later you will run into an issue where your development work will depend on a (version) of a library that will break an app you depend on.

Or you will need two versions of a library for your previous and next release which both need maintenance.

Nor do they provide reproducible builds and other features that are needed for serious work.

Distro package managers are not suited for development and dependency management. They might work most of the time, but that is not good enough.

<comment><USER8> The distro package manager is there to offer a menu of compatible known-good dependencies that you can readily adopt. It's a ton of work you don't need to do. If instead you bundle random stuff committed last month, you should have a compelling reason for beginning to maintain a half-baked distro all by yourself.

</comment></comment></comment></comment></comment></comment></comment><comment><USER9> The best experience I've had so far with C++ dependency management is with Nix: [https://nixos.org/nix/](https://nixos.org/nix/)

It has a very large collection of packages already available, supports many existing build systems (CMake and autotools work out of the box, but you can hook up anything), and can download binary packages for almost everything.

</comment><comment><USER10> How does one submit a new package to [https://cppget.org](https://cppget.org)? I can find a 'Submit' button or documentation about this.

<comment><USER3> Good question. Currently you will need to email a git repository URL and tag you want published (e.g., [https://git.build2.org/hello/libhello.git#v1.0.0](https://git.build2.org/hello/libhello.git#v1.0.0)) and we will publish it for you (or you can provide a package archive if you prefer).

For the next version we plan to implement a CI/CD bot which will poll your git repository for tagged versions and automatically test and publish them to cppget.org (there will be some sort of a control file that you will be able to use to specify which tags should be published where, etc).

<comment><USER11> > Currently you will need to email

Oh

</comment></comment></comment><comment><USER12> I've been using Conan.io for a bit. I come to c++ from ruby ang golang—both of which have ecosystems with very different dependency management philosophies. It's interesting to see these various tools arrive in the c++ ecosystem. There's clearly not a winner yet.

<comment><USER13> I think vcpkg is the clear winner for people who just want to get started building something. It's the fastest way to get a ton of common packages built and installed.

For more delicate maintenance of stable software (which will often need to depend on specific versions, customize builds, etc), it's still a little hazy. Conan looks ok, but I don't think it clearly beats my current solution of hacking something together from scratch in a couple hundred lines of Python.

<comment><USER14>
        I don't think it clearly beats my current solution of hacking something together from scratch in a couple hundred lines of Python.

I've so thought this more than a few times[0]. Every single time I run into something on my two miserable projects that rely on Hunter, I invariably find myself wondering why I don't just undo all of the bullsh!t and use the zsh scripts I threw together for the two projects that I _never_ have build/build dependency issues with. I believe that, at some point, every native developer writes something like this. It's funny to think that due to this circumstance there are probably more build tools available for C/C++ than there are packages in all of the mainstream C/C++ dependency management systems[1].

[0] Though I tend to use bash (well, more often, zsh), rather than Python.

[1] And probably all of them have a Boost package...

</comment></comment></comment><comment><USER15> I don't like making "X technology sucks" posts, and I'll probably get downvoted to oblivion for this opinion, but I'm really rooting for anything other than CMake.

<comment><USER16> I'm curious if you've ever worked with something like cargo or go build. CMake works well for what it does, but it doesn't do the right things if you've ever seen more modern solutions to the same problem.

<comment><USER17> Could you expand on this a little? I've dabbled with go build, but it didn't make me want to run screaming away from CMake. Where do you think it's not doing the right thing? I really like that it can generate project files that let me use the most useful debuggers on whatever platform I'm targeting. I think some aspects of its scripting language are a challenge to work with, but that has felt like a small price to pay for being able to easily work/debug in VS on Windows, Xcode on Mac, etc.

<comment><USER16> * lack of dependency management

* no concept of versions to declare API compatibility

* no easy way to hook into a central package repository

* source files to build have to be named manually in CMakeLists.txt

* header dependencies can easily be wrongly declared, which is never noticed

* the language is hard to work with

* it's quite slow for large projects (10s of thousands of compilation units)

* cross-language builds are a pain (C++ + JS)

I'm not saying this is all CMake's fault, I really like it for the reasons you outlined. At work, we are transitioning to Bazel to get rid of some of the pain points above, although it has different problems.

Having worked on some larger Go and Rust projects, I find the integration of language and build tools to be fantastic to work with and wish the C++ community would come up with a practical solution (probably involving Modules TS) at some point.

</comment></comment></comment></comment><comment><USER17> Just from a quick read of the page, I couldn't put my finger on why I might choose this over conan + cmake. Could someone who's tried both weigh in on what the relative strengths and weaknesses are?

</comment><comment><USER16> The submission title is strongly misleading. From the page:

      Unlike most other programming languages that encapsulate the
      build system, package dependency manager, and project
      dependency manager into a single tool (such as Rust's cargo
      or Go's go), build2 is a hierarchy of several tools that
      you will be using directly and which together with your
      version control system (VCS) will constitute the core
      of your project management toolset.

<comment><USER18> From the actual home page ([http://build2.org](http://build2.org)):

      Next-generation, Cargo-like integrated build toolchain for
      C++.

<comment><USER16> Thanks for clarifying.

</comment></comment></comment><comment><USER19> Is this related to boost b2 build system?

[https://boostorg.github.io/build/](https://boostorg.github.io/build/)

</comment><comment><USER20> Sounds like what Meson is.

Meson can download other Meson projects. From anywhere (no special repo). And you can use that as a fallback for pkg-config (best of both worlds).</comment>


Review my website (ezalak.com) - <AUTHOR>

Please review my website: ezalak.com App for Online collage creation and sharing..<p>Thanks! <comment><USER2> I didnt sign up for it...it looks like something from the 90s and that automatically makes a user think scam.

If you arent a designer(which it doesnt look like you are) then check out some of the many great resources available like the wonderful <http://twitter.github.com/bootstrap/> Although you should try to make a site look unique this can help you get something nice up and running very quickly.

The other thing I would recommend is watching this keynote <http://www.infoq.com/presentations/From-Crap-to-App>

Also the name is a bit confusing. Its short and simply which is good but is it a word? Is it made up of things that would make sense for the site? ez (easy) a (lak) lack? Thats how I read it and that doesnt make any sense for collages.

</comment><comment><USER3> Not a big fan for the design here. You might want to spend a few hundred bucks to make the homepage modern. Building collages is an interesting idea, but you need to put in the time, effort and resources to make people want to use it. Try 99designs.com for that

You might also want to change the name. It's not fun to pronounce. Just my two cents!</comment>


FAA appeals civil drone case ruling in Huerta v. Pirker - <AUTHOR> http://www.faa.gov/news/press_releases/news_story.cfm?newsId=15894

<comment><AUTHOR> There is a large thread on DIYDrones.com re the ruling and appeal as well if anyone is interested in seeing some community reaction. [http://diydrones.com/profiles/blogs/commercial-drones-are- le...](http://diydrones.com/profiles/blogs/commercial-drones-are-legal-in-the- us-court-roles)</comment>


Steve Jobs Vowed To Patent Everything After Being Stung By $100m iPod Fine - <AUTHOR> http://www.cultofmac.com/194822/steve-jobs-vowed-to-patent-everything-apple-invented-after-being-stung-by-100m-ipod-fine-report/ <comment><USER2> _"In fact, it only began patenting its inventions after years of patent suit losses, one of which saw the company fined $100 million for creating the iPod."_

What about the infamous "overlapping windows" lawsuit against Microsoft, quite a while before that?

<comment><USER3> Copyright suit, not patent.</comment></comment>


DOJ Didn't Need SOPA to Shutdown "rogue site" MegaUpload - <AUTHOR> http://venturebeat.com/2012/01/20/department-of-justice-doj-dept-of-justice-megaupload-piracy-sopa-pipa/

<comment><USER2> They didn't need SOPA because they took the time and effort needed to get a warrant.

The argument against SOPA is not that sites could be shut down, but that there needs to be a very demonstrable reason for it--with warrants and evidence and judges signatures. With SOPA, the site can be shut down based on accusation alone, and THAT is the problem.

<comment><USER3> Well, to be precise, this site was indeed shut down based on accusation alone. The operators of the site have been charged with criminal offenses, but until they're actually convicted in a court of law, they're presumed by U.S. law to be innocent. So what's the justification for shutting down the site before the jury renders a verdict? And if the jury acquits them (we don't know how strong the government's case really is, so it's certainly possible), will the government compensate them for their lost earnings?

<comment><USER4> It was shutdown based on a warrant that was issued based on an accusation (and probably at least some evidence), which makes all the difference.

<comment><USER3> The fact that a warrant and an indictment were issued doesn't mean that these guys did anything wrong. Lots of people who are indicted are later acquitted. The fact that there is evidence doesn't mean that there's enough evidence to convince a jury beyond a reasonable doubt (the standard for conviction in criminal cases) that a crime has been committed. The defendants have a right to present their own evidence to the contrary.

The U.S. Constitution has all these nice phrases like "due process of law" (see 5th Amendment), but they don't really mean anything if the government can take your property away without your having been convicted by a jury in a fair trial where you had adequate legal representation. Nothing terrible would happen if the government were to leave the web site up until a jury convicted these people.

If you were accused of a crime, wouldn't you want to have a chance to defend yourself in court before you had your property taken away?

<comment><USER5> If you are accused of a crime, you are detained. You can get bail, but only if you can convince the judge that you aren't likely to re-offend (or flee) during the bail period.

It's the same basic principle.

The point is, there's stuff like formal charges, warrants, and so on which have to be taken care of. The cops can't just impound your car because someone said you were using it to ship stolen property - they need to get a warrant.

</comment></comment></comment></comment></comment><comment><USER6> I don't think it's an outright error to relate this to SOPA. These latest sets of laws (such as NDAA) seem to be more about legitimizing the recent actions of the Executive Branch (Bradley Manning) than about giving them a significantly larger amount of more power.

</comment><comment><USER7> This further proves that laws against this exact kind of thing have to be created, simply abolishing PIPA / SOPA is NOT by any means enough.

It's not OK to do this. This kind of thing has to stop.

<comment><USER8> > It's not OK to do this. This kind of thing has to stop.

What kind of thing? If even half the things in the indictment are true, MegaUpload was designed and operated specifically to make money off of massive copyright infringement.

<comment><USER3> It's up to a jury to decide whether the prosecution has proven its accusations beyond a reasonable doubt. It's not up to the government or a judge or the media or the readers of HN to decide this.

If the government alleged that your web site (lets assume you have one) was a criminal enterprise designed specifically to make money off copyright infringement, wouldn't you want them to have to prove their case to a jury before shutting you down? If so, you should demand the same right of due process for everyone else.

</comment></comment></comment><comment><USER9> That's because it had servers in the U.S. SOPA is aimed at companies that keep their ops outside the U.S.

<comment><AUTHOR> I see. But the company was based in Hong Kong and the founders in New Zealand. Dutch, German and Slovakians citizens were arrested.

So as long as there are some operations based in U.S., they can get to all these folks?

MegaUpload was cited a number of times during the Judiciary Committee Hearing. But they mispoke more often than not.

<comment><USER10> Yes, if they have operations in the US they can be prosecuted, I believe. What's even worse for Megaupload in this case is that they had started legal proceedings themselves in the US. If they can use the US law, they have to abide them.

<comment><USER11> So if my operations based in another country infringe US laws, they can get me and bring me there to be judged ? What do we call that when North Korea does that again ? Kidnapping.

If every website suddenly has to obey the laws of every country, it will be an interesting time.

<comment><USER12> Please, lets be reasonable here. You're drawing a gigantic false equivalency between the extradition process based on international agreements, and the North Koreans black-bagging someone.

 _If every website suddenly has to obey the laws of every country_

The DMCA was the US implementation of two international treaties.

<comment><USER13> _" You're drawing a gigantic false equivalency between the extradition process based on international agreements, and the North Koreans black-bagging someone."_

I'm sure those kidnapped will be glad to hear this.

</comment></comment></comment></comment></comment></comment><comment><USER14> Megaupload used servers in the USA at Carpathia Hosting. That makes them subject to US law. SOPA/PIPA was for foreign sites that have no servers in the USA.

<comment><USER15> So all I have to do to be exempt from SOPA/PIPA is to host a single server in the US?

<comment><USER14> If you host server in the US, you are not a foreign website. You are a local one. In that situation, a SOPA/PIPA makes little difference. They can shut you down easily with existing laws. Do you understand?

<comment><USER15> _If you host server in the US, you are not a foreign website._

You left out an article there which is significant in this case "a server" or "the server".

If I were a "rogue website", could I host 99 servers in Bananastan and 1 server in the US and gain the benefits of complete SOPA exemption without significant risk to my availability?

I don't really know that this is worth discussing that much now that this particular flavor (SOPA) is off the table. But it may come up again just what the working definition of a "foreign website" is for any given set of considerations.

Usually just accepting payment from someone in the US is enough to bring US laws into it.

<comment><USER14> A "SOPA exemption" isn't going to protect you if you are hosting in the US. You need a DMCA exemption. And if you're reaching audiences the size of YouTube's or Megaupload's, Vivendi will see you in court.

If you have no US-based servers, and if Bananastan has no treaty cooperation with the US on IP infringement and extradition, then shutting you down is not so easy for Vivendi (FBI/DOJ) to accomplish.

For that they need more than what they have now (DMCA) to work with.

</comment></comment></comment></comment></comment><comment><USER16> I like how they quote Hacker News user Kermit the Hermit.

</comment><comment><USER17> Did youtube founders ever get arrested?</comment>


Facebook's Data Center Humidity "Challenge" Was Indoor Rain - <AUTHOR> http://gizmodo.com/facebooks-data-center-humidity-challenge-was-indoor-512173504 <comment><USER2> I first learned this was possible by hearing about rain clouds in NASA's VAB: [http://en.wikipedia.org/wiki/Vehicle_Assembly_Building#Const...](http://en.wikipedia.org/wiki/Vehicle_Assembly_Building#Construction) .</comment>


The true story behind the feature you're building. - <AUTHOR> http://truestoriesofbdd.com/

<comment><AUTHOR> (Just a little site I threw together since I didn't have a religious holiday to celebrate.)</comment>


Nobody in the world knows how to train one hidden layer - <AUTHOR> http://arekpaterek.blogspot.com/2016/03/nobody-in-world-knows-how-to-train-one.html <comment><USER2>
      My publication on the Netflix Prize is now free. Download it here.
      The previous 4-page publication has so far over 450 citations, and the newer publication has 195 pages and 0 citations.

      So read it, cite it. My h-index is 1, and I want to increase it to 2. I don't feel like a real scientist with an h-index 1.

      You have to read it to not stay behind your competition.

This doesn't come off like a researcher dedicated to work, rather a researcher dedicated to being recognized for work.

<comment><USER3> To me it sounds like very dry humor, which would make sense, given he's from Poland.

<comment><USER4> The title is obviously also also a joke so you are probably right.

</comment></comment></comment><comment><AUTHOR> I see that this submission disappeared from the front page, despite having 6 points. I am not sure, why.

<comment><USER3> Both points _and_ time are a factor.

<comment><AUTHOR> It disappeared completely from the first pages just after about 20 minutes after posting it. It remained only on the /new page.</comment></comment></comment>