Advanced programming languages (2009) - <AUTHOR> http://matt.might.net/articles/best-programming-languages/ <comment><USER2> This post is very fortuitous for me. I've been looking to learn a functional language and I had more or less narrowed my options to Haskell, OCaml and Scala. I liked the breakdown between these languages and the resources.

Can anyone who programs in Haskell or OCaml regularly tell me the current state of standard and third party library support? I'm very attracted to Scala because it has JVM support, which sounds fantastic for overall ecosystem maturity.

That said, I come from a C++ and Python background, so do I need to know Java well before learning Scala?

<comment> premium-concern I can recommend Scala:

\- It is mature and rock-solid, but still manages to evolve, fix issues and simplify/remove features. Most other languages are purely additive, meaning you will have to carry on all the baggage since the languages' inception.

\- It is a language which is interested in identifying the best way to solve common programming issues and spares you with all this ideological "OOP/FP is bad" bullshit.

\- It has the largest ecosystem (plus it can use all of Java's, too).

\- It has the best tooling.

\- It has the largest community.

\- It has some great learning resources, like the three (or four?) Coursera courses starting in a few weeks.

\- Its JavaScript backend is stable and production-ready, Scala-Native is being worked on.

> That said, I come from a C++ and Python background, so do I need to know > Java well before learning Scala?

Java knowledge might reduce the amount of learning (as many Java things like the JVM also apply to Scala), but isn't really necessary. You will be fine.

<comment><USER3> Once you have had real Hindley-Milner Scala feels painfully primitive. Just go straight to OCaml.

<comment><USER4> Or go to F# and enjoy the vast universe of .NET.

<comment><USER3> To be fair Scala does have access to the Java ecosystem

</comment></comment></comment></comment></comment><comment><USER5> What's up with functional languages nowadays? The exists since the dawn of humanity, but they are getting very trendy lately. Is it just my perception? Is it a HN thing? (I've been a reader for just some months)

<comment><USER6> 2 things IMO

\- There's a long running pendulum that swings back and forth from FP. We're currently in an FP cycle.

\- Current mainstream computing puts a heavier emphasis on concurrency and distributed computing. FP's focus on immutability and referential transparency makes it easier to reason about these.

<comment><USER7> > There's a long running pendulum that swings back and forth from FP. We're > currently in an FP cycle.

I think this is also happening because Functional Programming can really give us advantages, but also because it is very hard to understand fully (I am looking at you monads). We see how it can reduce: the complexity, the concurrency problems, or how we can code faster with it. But when we try to use it in a production environment, we give up because it's too complex. So you have this back and forth here in the field, between every wow moment with FP being all cool, and then being too hard to "get" or to use in production.

Now I think we are getting there slowly. Trend after trend, we have more and more the main languages that are really incorporating FP principles. And not just as features. Plus many companies are pushing FP languages forward. Swift is a significant push for it that should democratize FP principles to the "masses", rather than a more "academic" crowd.

</comment></comment></comment><comment><USER8> I personally would really hesitate before picking a language that will be hard to hire for to build a business around. Yes, you'll be more productive in the short-term, but a business is more than just code and you will need to wear those hats too before you'll have enough understanding and resources to hire those out.

At this point, I'm fairly certain your first hire should be someone to take the engineering load off of you. Engineering will be the only thing you really, truly understand about your business and so it will be the only thing you'll be able to effectively manage others doing.

<comment><USER2> Jane Street Capital's Yaron Minsky once said that contrary to popular belief hiring for OCaml developers was _easier_ because the signal to noise ratio in the OCaml community is so much better than other, more approachable languages. He would send a job post to the OCaml mailing list, get 15 responses, interview 10 people, bring five onsite and ultimately hire three new people.

I don't have direct experience with this, but it makes sense in theory. PHP is an easy language to find developers for, but it's incredibly annoying to figure out how competent the developers you're interviewing in that ecosystem will be. But languages like Haskell and Scala have a (perceived or real) barrier to entry, so you typically have a higher median ability among developers in those languages.

<comment><USER9> I've got managerial experience hiring (on both ends of the spectrum of talent) and engineering experience in computational finance at a prop firm similar to Jane Street. He has a fast-hire ability and high-signal to noise for sure but _he works at a prop firm_. His hiring practices are a market anomaly simply because he can pay effectively whatever a competent developer wants. Jane Street can basically throw money at the problem. What you have at a 'normal' company is a real difficult time finding someone who can tell me when to use a lens and when to use a zipper in Haskell who are actively looking for employment.

Anecdotal but I casually attend Boston Haskell and I can't remember the last time someone was out of work other than 'funemployment' (e.g. a startup goes bust and they have accrued more than enough money to just sit around, stretch and work on pet projects). The second they 'need' a job, they'll casually mention it and I think ~3 out of the ~7 times this has happened, someone in the crowd went like "oh Bill, yeah come in to <his office> Monday and meet our CTO". No recruiters, no wait. The CTO trusts Joe has heard Todd ask enough insightful questions consistently enough that he's going to be a good hire. Tuesday 9AM HR, 10AM pull the repo down, setup stack, start poking around Haddock and start closing the easy tickets. Good talent (10 of the 15 applicants are quality) might respond to Minsky but those other 9 guys will be picked up almost invariably in well under two weeks

<comment><USER6> OT but how useful would the boston haskell meetups be as an extreme noob? Will the talks be so far over my head that I should learn me a haskell a bit prior to attending or would it make for a good way to start absorbing some knowledge?

<comment><USER10> I haven't gone to the Boston meetup specifically, but my experience with other Haskell meetups is that the level of talks varies significantly, both in how much _Haskell_ you have to know and how much general math/CS knowledge is expected.

If you're a beginner along both fronts (which is great: Haskell is a wonderful place to start), you might need to look at the talk topic ahead of time and choose ones which seem the most accessible.

If you're just a beginner in Haskell but comfortable with general math and CS topics, chances are that many talks won't be too Haskell-specific and you'll learn something interesting even if you don't get all the Haskell details. I've attended talks about things like succinct data structures, concurrency models, FFT algorithms... etc. All of these _used_ Haskell and Haskell concepts, but weren't _just_ about Haskell; you would have gotten something out of them even if you didn't know much about Haskell specifically.

I don't think most of the talks will be great for _learning Haskell_ (unless that's their explicit aim) so if you actually want to learn the language you'll _also_ need to do some reading on your own, but going to the meetups will still be valuable.

</comment></comment></comment></comment></comment><comment><USER11> After walking in the land of functions for a long time I wonder if there are advanced advanced languages.

<comment><USER12> Well, there's:

\- Dependently typed languages (ATS, Agda, Idris)¹ should be fairly familiar if you're a Haskell veteran.

\- Array languages (APL, J, K, and more obscure ones like Nial) are pretty enlightening if you're a functional programmer (at least they are for me). Most of these trace to Ken Iverson and his _Notation as a Tool of Thought_. They are a bit brain-bending at first, largely because of the density, but they're fun to use and the density makes comprehension easier after a while.

\- Function-level languages (FL, FPr, J) – a somewhat obscure and very advanced sister to functional programming. If you're familiar with Haskell Arrows, there are many parallels. They are, essentially, a more convenient point-free style. Most (all?) of these trace to John Backus (of Fortran and Backus-Naur Form fame) and his 1977 Turing Award lecture _Can Programming Be Liberated From the von Neumann Style?_

J ([http://jsoftware.com/](http://jsoftware.com/)) combines array and function-level programming, and IMO is a very good language to learn to expand your horizons if you're a veteran functional programmer.

\--

¹ Coq kinda, but it's more of a theorem prover than a programming language. Agda sort of fits that too.

<comment><USER11> I had gnu apl installed (along with emacs mode:). APL and it's siblings are amazing, tiny, expressive, light.. lot to love. Juts nothing as mind bending as; say lambda calculus.

Didn't know FL/FPr were arrow-like. Didn't even know they were implemented .. I thought Backus quit because of IO.

Lots of people are suggesting the Idris/Agda road .. I guess I have my answer.

<comment><USER12> As far as FL/FP/FPr go, [http://www.call-with-current- continuation.org/fp/](http://www.call-with-current-continuation.org/fp/) is the most mature and complete implementation I'm aware of.

There's #proglangdesign on freenode where a bunch of us have been on an array language/function-level streak lately. Some people there might be aware of more.

<comment><USER11> brilliant , I didn't know about the ccc impl nor the IRC chan. I know some folks that might be interested.

</comment></comment></comment></comment></comment><comment><USER13> what "advanced" even mean? All those languages, they don't do something that others are not capable of(not mention that all the jvm ones just produce bytecode over the same vm)...different development principles is not a reason to call a language advanced.

<comment><USER14> Haskell and ML at least have advanced type systems. Since types are erased during compilation, you can't reason about type systems in terms of their impact on the generated code. An example of a simple type system is C with its structs.

Haskell also has lazy evaluation, which is very difficult to do in C. Obviously you could encode your own trampolines, but at that point you might as well be coding in a Turing tar pit language "where anything is possible but nothing of interest is practical".

Pattern-matching and ADTs are also usually difficult to do in other languages.

Most of the benefits of something like Haskell only show up on larger projects, so it's not meaningful to point to specific language features as a point against it. I can do just about anything in C. The type systems you probably can't do; you'd have to embed a language and that doesn't count.

</comment></comment><comment><USER15> I'm really surprised that "Learn you a Haskell" is not in the Haskell resources list.

<comment><USER14> I've seen people recommending this book more recently: [http://haskellbook.com/](http://haskellbook.com/)

I'm not sure I like LYAH as a practical resource: It's silly and might put people at ease, but I wouldn't feel comfortable writing a database or parsing tool or compiler after reading it.

Real World Haskell is better for these, but is a little dated by now.

<comment><USER16> LYAH is really good for getting you over the first big humps of learning Haskell, if you've never learned a language like Haskell before. I still really like it's explanation of monadic values. It builds up to them in a nice way. If you can pull open a GHCi session while reading that portion of the book and play around on the interpreter while reading it, you'll learn some good stuff. (As with many programming books, it may not seem logical, but I recommend typing out all the examples you find yourself. It works.)

It does not itself teach you much practical stuff. But if you learn what is in LYAH, you'll be pretty close to what you need to pick up most of the practical libraries in Haskell and understand the API level enough to use it, because once you get over that particular difference of Haskell's libraries, you can start working with them like you would any other language's libraries, and incrementally fold in the "Haskell special sauce" as you go, while you are at least learning things instead of stuck adding numbers together and filtering lists and all of the other handful of things you can do without files, network, or anything else you need an IO-based library for.

</comment></comment></comment><comment><USER17> Steele developed the early Scheme language together with Gerald Jay Sussman. Common Lisp wasn't designed by Steele alone, but by a larger group of people, including Steele, Weinreb, Fahlman, Gabriel and Moon.

</comment><comment><USER18> Any reason F# is not in the list?

<comment><USER19> Writing/deploying F# on a non-Windows machine is a huge pain. Been there, won't do that again.

<comment><USER20> It's not. I actively refuse to use Windows and have never had any trouble installing or using F#. I've only really used it in the last 1.5 years or so, so maybe what you claim was true in the past, but it is not true anymore. There are other reasons to not like it though. For me those would be a lack of HKT and functors, and its primitive compiler optimization due to relying heavily on a VM built for a _very_ different language.

<comment><USER19> This was > ~3 years ago, so maybe things have gotten better lately.

</comment></comment></comment></comment><comment><USER21> There have been many discussions of this post: [https://hn.algolia.com/?query=Advanced%20programming%20langu...](https://hn.algolia.com/?query=Advanced%20programming%20languages%20might&sort=byDate&dateRange=all&type=story&storyText=false&prefix&page=0).

I fear that the current one shows signs of HN's inevitable reversion to the mean.

<comment><USER22> Help us break away : nothing is inevitable, the future is unwritten!

</comment></comment><comment><USER23> If you are interested in picking up or dabbling in SML, I recommend checking out the /r/sml wiki [0]. I'll also single out the #sml channel on Freenode as a great place to get help if you get stuck.

[0] [https://www.reddit.com/r/sml/wiki/index](https://www.reddit.com/r/sml/wiki/index)

</comment><comment><USER24> > It's untyped, which makes it ideal for web-based programming and rapid > prototyping. Given its Lisp heritage, Scheme is a natural fit for artificial > intelligence.

Why does being untyped and having a Lisp heritage make Scheme suitable for these three tasks?

<comment><USER25> Web based is because JSON is always easier with dynamic types.

Rapid prototyping is because it requires less explicit up front design due to dynamic types.

Artificial Intelligence is because metaprogramming is easier in homoiconic languages.

<comment><USER26> > because JSON is always easier with dynamic types.

I think you mean JSON where the schema isn't defined. If you have full control over the JSON you're consuming, you control the schema. Typed languages aren't any worse than dynamic languages in this case.

> Rapid prototyping is because it requires less explicit up front design due > to dynamic types.

Many types languages have a REPL environment specifically for this reason. In my experience, it's not any slower.

> Artificial Intelligence is because metaprogramming is easier in homoiconic > languages.

I have no experience here, thus I will assume you are correct.

<comment><USER25> Complex, recursive JSON schemas are much more difficult even when the schema is known in most typed languages. Not impossible but I've definitely found myself changing my schema design because of friction in parsing JSON in Java.

</comment></comment></comment></comment><comment><USER27> He only mentions Clojure in passing. At some point I decided that, were I to learn a functional language, it would be Clojure. How would you say Clojure fits in this comparison? Is it only relevant or interesting for concurrency?

<comment><USER28> The article's 7 years old. Clojure's first stable release (1.0) was released the same year.

<comment><USER27> Thanks, I knew it wasn't new but didn't think it was so old.

</comment></comment></comment><comment><USER29> I don't know much about Scala but Erlang/Elixir fits quite good to the description as well:

> Scala is the programming language I use for tasks like writing web servers > or IRC clients.

<comment><USER30> Scala has a very well-regarded implementation of Erlang's actor system. I have personally seen it handle hundreds of thousands of requests spun off as lightweight threads.

<comment><USER31> I still don't quite understand the point of actor-model concurrency systems running on runtimes that can't perform pre-emptive scheduling, but I guess 80% of a solution is better than none at all.

</comment></comment></comment><comment><USER32> _> In academic research and in entrepreneurship, you need to multiply your effectiveness as a programmer, and since you (probably) won't be working with an entrenched code base, you are free to use whatever language best suits the task at hand._

... with the _extreme_ caveat that your language has bindings to {insert language with libraries that already implement 50-85% of your functionality}.

</comment><comment><USER33> I need a suitable sized project to implement in a niche language I am learning. I used to use tetris but it isn't big enough. It needs to exercise multi threaded updates of some state consisting of many elements and their relationships based on user or file inputs. I think. I want to write it in c++ then learn Haskell and use that. Then use c++ again and look at the differences.

<comment><USER34> multiplayer tetris?

<comment> c-smile "multiplayer tetris" is the game played by UN Security Council, so why not?

</comment></comment></comment><comment><USER35> I would argue that a well-known language is fairly expressive in the sense that it is well-known.

Imagine English itself was a programming language - this is the best. But for now I would recommend using those who are commonly used in the common platforms of interest (Java, javascript, C etc)

<comment><USER36> > Imagine English itself was a programming language

That's a terrible idea.

[https://en.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buffal...](https://en.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buffalo_buffalo_buffalo_Buffalo_buffalo)

<comment><USER35> Yes, but in any language - syntactically valid code is not necessarily good code

</comment></comment></comment><comment><USER37> I once watched this youtube video:[https://www.youtube.com/watch?v=02_H3LjqMr8](https://www.youtube.com/watch?v=02_H3LjqMr8) as the entry to Haskell world.

<comment><USER38> Haha here was my personal intro to the world of haskell: [https://www.youtube.com/watch?v=RqvCNb7fKsg](https://www.youtube.com/watch?v=RqvCNb7fKsg) . Was instantly hooked.

</comment></comment><comment><USER39> I am a bit surprised Clojure and Clojurescript are not in this list. I guess Clojure still was a bit young at the time this article was written. Within past few years Clojure has become extremely popular.

<comment><USER28> Yes, its first stable release (1.0) was around the same year this article was written.

</comment></comment><comment><USER40> For a real world project pick a suitable language that will not only help you to implement whatever you have to implement but also to maintain the project. Also you should be able to find other programmers knowing that language if you need to. Maybe even use the language you already know even if it is not the newest and hottest stuff.

But for private or side projects use whatever enlightens you. Those projects should be fun and it's always good to learn new things on the way. I even think you don't have to learn all new languages in depth but just do a small project and reflect if it is something that gets you somewhere. You probably wont write a big business application in Smalltalk but all that message passing, awesome. Seriously have a look at Smalltalk.

<comment><USER41> Has anyone experience with "Curry" (functional logic programming)? If it has all the advantages of Haskell plus some possibilities of logical languages, it should be really interesting for experimental approaches.

[http://www-ps.informatik.uni-kiel.de/currywiki/](http://www- ps.informatik.uni-kiel.de/currywiki/)

<comment><USER42> GHC is top notch, I wouldn't say any language without a mature compiler "has all the advantages of Haskell".

</comment></comment></comment><comment><USER43> Prediction: APL, J, K, or Q will be on this list soon.

<comment><USER44> idk if you are serious or not but part of me feels like the fact that those languages haven't gained much attention in the last 30 years means that they won't get much attention in the future.

<comment><USER43> I think it's inevitable we'll use some of their toolset. The problems we solve don't get easier so we will reach for more powerful tools.

As an example, just being able to think in terms of a transpose makes many problems trivial: [http://michaelfeathers.silvrback.com/moving-quickly-with- com...](http://michaelfeathers.silvrback.com/moving-quickly-with- compositional-chains)

</comment></comment></comment><comment><USER45> What about javascript? Could that be a decent language to get into functional programming? It's definitely mainstream enough.

<comment><USER46> You're lucky you didn't get voted down -5, with the Type Police out and about.

I like ES5 (would be ES6, but for IE support...) Javascript, but it is a bit light on the immutability aspect, given the environment and problem set it usually runs in.

Check out the "Ramda.js" library for JS ([http://ramdajs.com/0.21.0/index.html](http://ramdajs.com/0.21.0/index.html)). There's some good concepts put to use there. (although I have my own version of "currying" implemented at work, as I like to sometimes have "0 arity" functions for event handlers -- but those types of "functions" aren't particularly "pure")

</comment></comment><comment><USER47> Can someone comment on what it's like building a webapp with Scala/Play?

<comment><USER48> Unlikely you'll be cranking out a Rails style MVP in Scala + Play, but you will produce a robust, blazing fast, scalable application that's a dream to maintain and build upon.

In short, Play is a really, really good MVC framework. For SPAs you can go lightweight with just Play's router and WS api, or try something like http4s for a more FP-based REST api.

Throw Scala.js into the mix and you've a got a fully typed stack across the board.

and then Scala Native on the horizon...things are looking good in Scala land ;-)

<comment><USER49> > you will produce a robust, blazing fast, scalable application that's a dream > to maintain and build upon.

At work I'm working on a scala/play app. It was 2 years old already when I joined, and the first scala/play project for the team. It's not that fast or scalable. That is to say, scala and/or play are not silver bullets that will make your code hyper optimized and scalable.

ATM I'm working on performance. There are a few blocking calls in the API that are used everywhere and they manage to block the various execution contexts (controller, akka, etc.) It's a mistake to use blocking calls when it can be avoided, but it's an easy mistake to make.

So yeah you can write robust / fast / scalable / maintainable apps in Scala but you need to properly learn it first.

</comment></comment></comment><comment><USER50> > _Scala is a rugged, expressive, strictly superior replacement for Java._

Scala is not replacement for Java. It runs on JVM and can invoke java code, but has completely different approach than Java. Use Kotlin if you want Java replacement.

Also I would argue that Scala is much better suited for writing compilers than Haskel.

<comment><USER51> Scala can be a fine Java replacement, if you drop 20% of its features on the floor. As long as you never see a higher-kinded type, I think you are ahead of Kotlin, and the learning curve is not really any different.

The problem with this approach is that 90% of Scala libraries are built by people that live in higher-kinded land, and believe that since they have reached that level of expertise, so should everyone else, the second they start learning the language. For instance, look at SummingBird: The hello world example includes F bounded polymorphism, and path dependent types! Anyone new to the language would run away screaming, and I'd not blame them.

<comment><USER50> Scala compatibility is not so great. It has its own collections and other libraries. And it does not even support java getters and setters.

<comment> premium-concern Why would you create a new language and then keep a huge part of what developers interact with on a daily basis in such a broken shape as in Java? (Or rack up a massive amount of complexity and break your typesystem by trying to put lipstick on the Java collection pig? (Kotlin).)

<comment><USER50> 1 billion lines of code, that is why.

</comment></comment></comment></comment></comment><comment><USER52> I prefer practical programming language extensions, like the new C++ standard which adds useful things, or Hack which makes PHP useful, or the typed extensions to Javascript and Python.

<comment><USER53> Well said!

</comment></comment><comment><USER54> c++ programmer wants to learn scala now :)

</comment><comment><USER55> I am still stuck on why this is titled Advanced Programming Languages. Wait, so anything other than the most widely adopted robust language technologies used in enterprise systems is 'advanced'? Language compilers, interpreters, database engines, and runtime implementations are advanced. Who says, "we need an advanced language for this solution", as opposed to "this problem requires an advanced solution"?

<comment><USER56> OP reeks of subjectivity.

"Scala is a rugged, expressive, strictly superior replacement for Java."

I have nothing for or against Scala, and Java is a popular target. But "strictly superior"? There are critiques of the language and its toolset that contradict the strictness of its superiority. ([https://www.quora.com/What- are-some-criticisms-of-Scala](https://www.quora.com/What-are-some-criticisms- of-Scala))

<comment> premium-concern I think "strictly superior" makes sense in the way that Scala was never designed or intended to be a worse-is-better language like Java and people were willing to make that happen by evolving the language. It was never intended to be a Java-with-more-concise-syntax unlike some other newer languages.

If something was clearly worse, it would have been changed years ago already. That some design is still there might suggest that some people just have a different minority opinion on some aspects. (Assuming that "strictly superior" does not mean "100% of devs agree 100% that this is 100% better than Java".)

</comment></comment></comment><comment><USER57> Datalog for constraint programming, but not Prolog? Oh come on. If you're going to recommend languages, look some up, already.

</comment><comment><USER58> Select the best language for the task in hand.

At the end of the day, they all ultimately control the same instruction sets on the chip's either directly or indirectly through a framework or libray and/or operating system.</comment>


Why not - <AUTHOR> http://www.whynot.net/

<comment><USER2> Odd. The Half Bakery was doing this for years.

<http://www.halfbakery.com/>

One of their best ideas was the Creme Cheese Ring.

[http://www.halfbakery.com/idea/Cream_20Cheese_20Rings#122848...](http://www.halfbakery.com/idea/Cream_20Cheese_20Rings#1228480906)

</comment><comment><USER3> One of the founders, Barry Nalebuff, put his money where his mouth is: he cofounded Honest Tea.

</comment><comment><USER4> Oh man, this is going to kill a good bit of my Sunday morning... (Thanks!)

</comment><comment><USER5> Site is hanging for me...

<comment><USER3> Same. I wonder if it got HN'd.</comment></comment>


Break My Concentration and I Break Your Kneecaps - <AUTHOR> http://teddziuba.com/2010/01/break-my-concentration-and-i-b.html <comment><USER2> Is it possible for this guy to get his point across without sounding like a total douchebag? I guess it worked, though; I read his stupid rant.

Not that I don't agree with what he's saying, of course. I hate getting interrupted when I'm "in the zone." But I don't think it brings out any violent tendencies.

The IRC idea is a good one, though sadly I'm not sure I'd be able to get my team to actively use it.

</comment><comment><USER3> The problem with exaggerating for attention like he is doing (and Giles, and previously Zed, and many others) is that it doesn't scale well. Before long we'll have to write "Break My Concentration and I'll Anally Penetrate You With A Rusty Soldering Iron" to get attention, and who really wants to go there?

The only way to win is to escalate, and that can only lead to mutually assured destruction, unless we can agree to keep things reasonable.</comment>


RegData: A database quantifying federal regulation by industry over time - vezzy-fnord http://regdata.org/ <comment><AUTHOR> I had to read a lot of OSHA regulations for my last job, and now I'm a programmer. I recommend mentally substituting "lines of code" throughout this piece.

There are lots of regulations that could be streamlined, and there also plenty that should exist but don't. But knowing that there are X thousand regulations isn't the most useful information you could have.

</comment><comment><USER2> By industry! I assume that means we've gotten to the bottom of this [http://www.wsj.com/articles/SB100014240527023043198045763896...](http://www.wsj.com/articles/SB10001424052702304319804576389601079728920)

</comment><comment><USER3> This seems to be highly ideology driven, with a bit of cargo-cult science thrown in the mix.

<comment><USER4> How so? I understand that doing research on regulation is by its nature political, but that doesn't mean 'ideology driven'. For instance, you may argue from this data that Obama is the most-regulating president in history. Or, as some researchers have done, you may argue that regulation hasn't killed dynamism (see work by Goldschlag and Tabarrok). Data is data, what you do with it may be ideological or not...

<comment><USER5> Choosing what kind of data to expose or research can be political. Simply releasing data on the # of regulations is helpful for only certain kinds of discussions:

* Who pushed or repealed the most regulations

* Who regulated what

* Correlating # of regulations to market performance

These are not bad discussions to have but has the consequence of shifting the discussion further away from "what makes a good regulation?" towards "how much regulation is too much?".

Data is data but it isn't all the data. What we choose to look at frames the political discussion.

<comment><USER6> A strategy for an executive to control the output of outside consultants is to sponsor a project and provide a filtered list of information sources. So long as the consultants only receive the appropriate data, their conclusions are predetermined. Internally, this creates the illusion of objectivity.</comment></comment></comment></comment>


Five Ways to Spot (and avoid) a Demagogue - <AUTHOR>

 1) Incapable of independent thought. Exercises his/her intellect, such as it is, by sniffing the wind to detect the 'majority view' and to quickly adopt it. Finds it on TV.
2) Denies to ever have held a different view before.
3) Loves to assume 'the moral high ground' and then browbeat and terrorise those slower than him/her to adopt the majority view.
4) Has no real arguments, so uses perjorative, emotionally charged but essentially meaningless labels to attack and judge, such as: 'inappropriate', 'sexist', 'racist', 'unpatriotic', 'shovinist', 'imperialist', 'anti-social', 'extremist', 'heretic', 'terrorist', 'perverted', etc.
5) In all circumstances supports centralised authority and 'order' to enforce and protect the majority view. <comment><USER2> 7) Unabashedly eats the fruit (technology) while denying the existence of the tree (science).

</comment><comment><USER3> 6) Considers "social conservatives" to be lower than dirt, but would like nothing more than to control what everyone does, says, and thinks to make sure that no one's feelings ever get hurt</comment>


This Daniel Guy is Definitely Getting Fired - <AUTHOR> http://uncrunched.com/2012/02/26/this-daniel-guy-is-definitely-getting-fired/

<comment><USER3> Wow, Arrington caught a plane and the dude next to him was talking on the phone .... but he's a better person now and won't drop that bomb.

About halfway down the comments is someone who sums it perfectly - <USER2> commenter reveals that they too have heard other people talk about things, and user "Fuck" posts:

"Nobody cares".

[http://uncrunched.com/2012/02/26/this-daniel-guy-is- definite...](http://uncrunched.com/2012/02/26/this-daniel-guy-is-definitely- getting-fired/#comment-6341)</comment>


Keybase launches encrypted Git - <AUTHOR> https://keybase.io/blog/encrypted-git-for-everyone <comment><USER2> Keybase team member here. Interesting fact: git doesn't check the validity of sha-1 hashes in your commit history. Meaning if someone compromises your hosted origin, they can quietly compromise your history. So even the fears about data leaks aside, this is a big win for safety.

From an entrepreneurial perspective, this is my favorite thing we've done at Keybase. It pushes all the buttons: (1) it's relatively simple, (2) it's filling a void, (3) it's powered by all our existing tech, and (4) it doesn't complicate our product. What I mean by point 4 is that it adds very little extra UX and doesn't change any of the rest of the app. If you don't use git, cool. If you do, it's there for you.

What void does this fill? Previously, I managed some solo repositories of private data in a closet in my apartment. Who does that? It required a mess: uptime of a computer, a good link, and dynamic dns. And even then, I never could break over the hurdle of setting up team repositories with safe credential management...like for any kind of collaboration. With this simple screen, you can grab 5 friends, make a repo in a minute, and all start working on it. With much better data safety than most people can achieve on their own.

<comment><USER3> So I _love_ Keybase unconditionally and if you guys weren't rolling in physical offices (and not one in Boston) I'd have been beating down your door to come work there--I think what Keybase is doing is important and it's something I'd love to work on. But I have a serious question that maybe you can answer, and it's something everybody who I've showed this to has asked me:

How is Keybase gonna make money? How am I assured that this, and everything else in my Keybase storage, is going to be there in six months? Like, I _still_ have a private server in a closet in my apartment that syncs all the stuff I trust Keybase with because I don't know what the business-side failure case is.

You guys should be taking my money, is what I'm saying. Also probably hiring me. But definitely taking my money.

<comment><USER2> We believe the right long-term answer for Keybase is finding a way to charge large corporations and offer pretty much everything else for free. Obviously there would have to be some paid tier if you really wanted 10TB of storage or something, but very few people want that right now. We're still just getting started.

Of course to achieve our goal, we'll also have to find a way to distinguish communities - which we'll want to use Keybase for free - and companies.

Many of us on the team have come from ad-supported businesses and we really, really never want to do that again. I personally guarantee I will never be a "publisher" again. Fortunately that just can't work with Keybase, so no fears there.

But charging for anything on Keybase right now would be a big mistake. We only have ~180,000 users, and we want to bring crypto to _everyone_. That basically means making products we believe are better.

Another way of looking at your concern: I think if we were charging right now, it wouldn't actually _decrease_ the odds we disappeared in a few years. It might distract our attention from working on the best product and cause our bloody demise. So maybe we're not choosing the path that gives you the highest impression of safety, but I think we actually are.

<comment><USER4> Everything you just said makes perfect sense.

That being said, I think Keybase is one of the most important companies around right now. I would gladly pay $10/month, even if literally all it did was put a "Supporter" badge on my profile. I'm sure hundreds of other people agree.

Crypto is far too important for it to remain locked away behind GPG.

<comment><USER2> The outpouring of positive energy (on HN!) is really inspiring. Everyone on the Keybase team is feeling good about our work right now, so thanks!

<comment><USER4> The team seriously deserves it.

For what it's worth, I think my above comment is my highest upvoted comment of all time. There's a lot of people out there who want Keybase to succeed.

<comment><USER3> My comment that started this subthread is in my top ten, and I have been here entirely too long, so, yeah. Keybase is good. It staying around is important. People around here, at least, seem to know it, and that's awesome.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I'm really happy about this. I have private repos for personal information (e.g., tax spreadsheets going back a decade) that I keep synchronized across machines, and have to jump through hoops to get an encrypted authoritative remote source. Right now I do that with an encrypted partition on a private VM.

And, it really sucks that GitHub does not encrypt data at rest:

\--- SNIP from [https://help.github.com/articles/github- security](https://help.github.com/articles/github-security) \---

We do not encrypt repositories on disk because it would not be any more secure: the website and git back-end would need to decrypt the repositories on demand, slowing down response times. Any user with shell access to the file system would have access to the decryption routine, thus negating any security it provides. Therefore, we focus on making our machines and network as secure as possible.

\--- SNIP ---

Encrypted disks are now the norm across various cloud providers, as is HTTPS. The crypto overheads are really low, and their benefits significantly outweigh the risks of leaving clear-text data on disks.

Also, defense-in-depth is always worth pursuing. The claim "it would not be any more secure", is so far from true, it's almost insulting to their target audience.

Keep killin' it, Keybase! Great job!

<comment><USER6> Out of curiosity: why do you keep such documents in repositories instead of simply in a filesystem (on an encrypted volume, backed up and possibly synced across devices)? Tax spreadsheets usually don't change, so there's no need for version history (if anything, new rows for new years are added, but without changing past data).

I ask this because I'm trying to figure out a solution for myself for keeping sensitive personal information and I never thought about storing such documents in a repository. Maybe I am missing something and your use case will open my eyes. Thanks!

<comment><USER7> For me one big benefit is that it's distributed. I like to keep my important documents backed up on all the computers i have, on a USB drive stored in a safe location and also store the data with a cloud provider.

Now, if i update one document on computer A, and another document using computer B, i have to sync it to all other devices which is a PITA without git. You get into the situation where you don't know if the version on the USB drive was newer or older than the one on computer B etc, whereas with git all this is available in the version tree and there are nice merge tools available.

I've been planning to do this even for photos, for all the reasons above, but haven't taken the full step yet.

<comment><USER8> Wouldn't encrypted files with a service like Dropbox help? Containers usually sync well (only syncs changed parts). Only downside is that you can't access files without decryption software.

<comment><USER7> Dropbox, as all other "just-works" sync services, don't handle merge conflicts very good. Suddenly you have thousands of Filename_EditedByX(3).txt in every folder and dont know which one of them is the newest and don't have their most common ancestor version easily available for a 3-way merge.

<comment><USER8> To be fair, they cannot handle merge conflicts with encrypted containers. I find that merge conflicts almost always cause more trouble than the work of avoiding them from the start. As long as you don't share data (with containers unlikely), merge conflicts should be extremely rare (and anticipated).

</comment></comment></comment></comment></comment></comment><comment><USER9> Has anyone seen a security audit of the Keybase platform? I love the product from a usability perspective, but have no idea if it's actually a safe repository for my team's key material.

</comment><comment><USER10> This is exciting, but I'm new to Keybase and don't entirely understand it yet. How can I clone a Keybase-hosted repository on a remote server? Can gpg-agent proxy through ssh similarly to ssh-agent to allow access to GPG keys (and is that what keybase uses?), without having to store my keys on the remote server? Or would I need to create a new Keybase account just for the remote server, with that account's private keys stored on the server but at least segregated from my account's full access to communication, team-management, etc? Or would the best approach be to clone the Keybase-hosted repository locally and then push it to the remote server over SSH?

<comment><USER11> Yes, probably you need a new Keybase account just for that remote server if you want the remote server be able to do git pull after the initial git clone.

If all you need is a single git clone, and you already have a Keybase account, just do a git clone locally, and use rsync to upload the result to the remote server.

</comment></comment><comment><USER12> In case you're wondering...

> ~ Anticipated q's ~

> What if we're living in a simulation?

> Keybase offers no guarantees against sophisticated side-channel attacks by > higher-level entities.

<comment><USER13> It appears that this may no longer be an open question:

[http://www.pbs.org/wgbh/nova/next/physics/physicists- confirm...](http://www.pbs.org/wgbh/nova/next/physics/physicists-confirm-that- were-not-living-in-a-computer-simulation/)

There was a Hacker News post about this a few days ago, likely from a different source, but I can't find it.

<comment><USER14> This only applies to classical computers not quantum, some combination of both, or by some means of computation we haven't discovered yet.

</comment></comment></comment><comment><USER15> Nice to see people work on git remote helpers, a shame that there's already a fine remote helper that is not tied to a specific hosting provider & uses GPG[0] already.

0: [https://spwhitton.name/tech/code/git-remote- gcrypt/](https://spwhitton.name/tech/code/git-remote-gcrypt/)

<comment><USER16> I came here precisely to see how this compares to git-remote-gcrypt (which I use to protect my password-safe filenames).

Anyone from keybase prepared to comment?

<comment><USER11> I'm not a Keybase developer, but I'm a user of Keybase Git, git-remote-gcrypt and git-gpg, and I've just written a comparison of the 3. Here you are:

[http://ptspts.blogspot.com/2017/10/comparison-of- encrypted-g...](http://ptspts.blogspot.com/2017/10/comparison-of-encrypted- git-remote.html)

If I missed some of the aspects, please let me know.

</comment></comment></comment><comment><USER17> For anyone interested in alternatives, we built a utility (creatively named git-gpg) with the same goal: end-to-end encrypted git. It works over ssh, is self-hosted, and requires no additional software on the shared server.

[https://github.com/glassroom/git-gpg](https://github.com/glassroom/git-gpg)

</comment><comment><USER18> This removes the ability for collaborating, browsing online, basically any feature of GitLab/GitHub/BitBucket.

... I think I'm in favor of this. I think of the things that those services provide on top of Git should actually be ported or mapped to Git itself. Branches, pull requests, comments, etc... should all be Git objects of some sort.

<comment><USER19> Branches are Git objects. Incidentally, here's a distributed VCS that includes bug tracking: [https://fossil-scm.org](https://fossil-scm.org)

<comment><USER15> > _Branches are Git objects_

That's not how I understand refs, they don't even live in the .git/objects hierarchy.

<comment><USER18> You're correct, they're just files. To create a new branch off of master you can just...

      cp .git/refs/heads/master .git/refs/heads/WTFFF

... no SHA-1 involved at all, no parent, history, etc.

<comment><USER20> However what they point to are git objects. And being pointed to prevent them from being garbage collected (pruned).

</comment></comment></comment></comment></comment><comment><USER21> _Remember, it is impossible to delete cloud data with any kind of confidence, and your host may already be compromised._

Should be the epitaph of the current era of computing.

</comment><comment><USER22> As an aside, does key base offer tools to encrypt data from code, lets say from Python/Go/Rust/etc, that is moron proof?

I say tools, because while a library would be cool, I'd understand if it was a binary/application to provide the functionality/user-experience that key base is aiming for.

I know this likely doesn't sound like something key base _should_ be aiming for, but to me, programmers need encryption just as much as users. I'd like to write my libraries/programs with encryption, but I also want to be able to trust it and not fear some inherent vulnerability I'm adding.

To me, Keybase is aiming to solve/reduce these complexities for users, and I'm hoping they also aim to solve it for developers to.

Thanks for all the hard work folks @ Keybase, it's definitely appreciated!

<comment><USER23> This is a perfect use case for [https://github.com/ofek/privy](https://github.com/ofek/privy)

</comment></comment><comment><USER24> I have a private repo on GitHub which contains my dotfiles with SSH private keys, tokens, secrets and all kinds of secret stuff. I was uncomfortable storing it there, but my laziness/lack of time kept it there. Finally I will be able to encrypt the entire repo, yay!!

<comment><USER25> if you're uncomfortable storing them there, you're going to rotate all the secrets after you move the repo to keybase, right?

<comment><USER24> Yes, I will. That's a long overdue also :D

</comment></comment></comment><comment><USER26> Keybase has quite a few interesting and unique features. But I'm cautious, because it's not clear to me how they are going to monetize it.

</comment><comment><USER27> My first initial gut thought is, could this be as a good ol cross platform method of password management? I've never been able to properly manage keepass due to syncing between different platforms being a pain.

<comment><USER28> Maybe combine Keybase git with gopass, that one stores data in a git repo:

[https://www.justwatch.com/gopass/#features](https://www.justwatch.com/gopass/#features)

<comment><USER27> That sounds promising. I can't be the only one with this problem. (aka secure cross platform synchronized password management without requiring personal/managing cloud infrastructure.

</comment></comment></comment><comment><USER29> Was expected one question but haven't found one: how it is actually encrypted? Any whitepaper or information how diffs could be handled over encrypted data? Or it is a just encrypted .git folder?

<comment><USER30> Looks like it's built on top of kbfs[1].

[1]: [https://keybase.io/docs/kbfs/understanding_kbfs](https://keybase.io/docs/kbfs/understanding_kbfs)

<comment><USER31> The "actually encrypted" part is NaCL (ED25519 + sha256) as supported by Go [2]. Interestingly, the common way to use NaCL applies Curve25519 to encrypt a symmetric key which is the used for the payload. They don't do that. AFAICT, everything is using the ECC curve.

[2] [https://keybase.io/docs/crypto/kbfs](https://keybase.io/docs/crypto/kbfs)

</comment></comment></comment><comment><USER32> These benefits can be obtained by sharing a remote encrypted _filesystem_ , in which sits an ordinary git repo.

Then simply check out that git repo using a _file: //path/to/repo_ reference, creating a clone on a local drive out of the encrypted volume.

The encrypted filesystem can then reside on an untrusted server in the cloud.

Ultimately, this is a cleaner solution than the whack-a-mole approach of hacking every application one by one to retrofit it with crypto storage capabilities.

<comment><USER33> This question has a FAQ entry near the bottom of TFA:

> Why not just make a bare repo in KBFS?

The Keybase filesystem journals changes and syncs them after writes, kind of like Dropbox. Which means you and another team member could be fighting each other and make a conflicted HEAD, where there'd be 2 copies side by side. Similarly, you shouldn't put git repos in Dropbox.

Keybase's git prevents this by locking.

Also: it's nicer to use the Keybase app to discover and manage your teams' repositories.

</comment></comment><comment><USER34> I really like keybase, and I wish they could issue certs for me to sign PDFs. I would pay for that.

</comment><comment><USER35> This is excellent. I've been looking for practical uses for my Keybase account -- it's been sitting around, verified but idle for years. The chat app is nice, but none of my friends or co-workers use the service (or understand crypto, for that matter).

</comment><comment><USER31> Let me be unoriginal and sing your praises also. I'd LOVE to replace my use of Dropbox with Keybase, but I pretty much use every single feature of the iOS Dropbox App [1] and Keybase really isn't an alternative right now.

Also, one unique design choice of Dropbox is to use the underlying file system which means that working out of a Dropbox folder is native speed, even for high intensity IO. Keybase is a lot better than, say, Wuala was, but it's still noticeable.

[1] In prioritized order: camera uploads, viewing and editing plaintext, show photos, playing music and video, uploading to Dropbox from random other iOS apps, and finally selective offline access.

</comment><comment><USER11> On Linux, you can try this encrypted Git without installing Keybase or using the Keybase GUI. You need the following Go binaries from keybase*.deb: keybase, git-remote-keybase and kbfsfuse.

Start kbfsfuse (specify a directory as a mount point); put get-remote-keybase to your $PATH; run keybase git create myrepo; you can stop kbfsfuse now; then this works (after substituting $KEYBASEUSER):

      git clone keybase://private/$KEYBASEUSER/myrepo

</comment><comment><USER18> Awesome... any plans to support LFS? I know with LFS you can write custom backend handlers.

<comment><USER36> Was just thinking that as well, the hard part about changing GitHub hosts like bitbucket/github is the feature parity between them. This is really enticing though.

</comment></comment><comment><USER37> Nice, this is perfect timing for me to see this actually. I've been slowly building out a little cli tool that I use to track .env files (and other files that you don't want to check into source) in a git repository that is parallel to your project's git repository.

The way it works is you identify a file that you don't want to check into source. The cli moves it to a parallel repo, commits the file to the parallel repo, and symlinks the file back to the original location.

From then on, you get all of the normal source control features like local changes, revision history, etc... that you get with every other file in your project. I basically got fed up with "crap what was that value I was using before? Let me dig through my credentials store" or resorting to commenting out old lines just in case I needed to revert.

So far, I've just been keeping those parallel repositories local for lack of an encrypted remote to push to. Definitely checking this out.

</comment><comment><USER38> It's amazing how many new features and even new complete products Keybase has been able to build on top of their core in such a short span of time. Even more so considering that a large part of that core is "just" a much better UX for a technology (GPG) that has existed for decades.

</comment><comment><USER39> The two most interesting companies in crypto for me right now are KeyBase, and Wire. I kind of wish there was some way for them to interact with each other, because it feels like they each have a piece of some bigger puzzle.

<comment><USER40> Are you not concerned with the data Wire collects?

[https://news.ycombinator.com/item?id=14069674](https://news.ycombinator.com/item?id=14069674)

Versus the data Signal collects:

[https://signal.org/bigbrother/eastern-virginia-grand- jury/](https://signal.org/bigbrother/eastern-virginia-grand-jury/)

Although I agree Wire looks like a much more (visually) polished chat service, it seems like they (Wire) collect more data than is necessary.

<comment><USER39> Wire has open sourced it's server code (gplv3 even) and is working on federation support :

[https://medium.com/@wireapp/wire-server-code-now-100-open- so...](https://medium.com/@wireapp/wire-server-code-now-100-open-source-the- journey-continues-88e24164309c)

So you can run your own copy of it, and be in complete control of any information it collects.

<comment><USER40> That seems really exciting. When that occurs I will most likely switch over. Unfortunately you can't quite host it your self yet: [https://github.com/wireapp/wire- server/issues/2](https://github.com/wireapp/wire-server/issues/2)

</comment></comment></comment></comment><comment><USER41> is there some way to verify what was actually uploaded, and that it was indeed encrypted properly?

<comment><USER11> You can ask the same question about copying the .git directory with rsync over SSH, and the answer for that one applies to your original qustion as well:

* You can take a look at the packets (using e.g. tcpdump). * You can take a look at what the binaries (rsync, ssh vs. keybase and git-remote-keybase) read and write (using e.g. strace). * You can read the source code. * You can read the white papers and other analyses about the crypto used, and decide if you trust it.

The average user probably won't bother with these, because they need time, effort and experience.

If you can imagine a fundamentally better possible way for the average user to verify crypto, please let us know.

</comment></comment><comment><USER42> This is amazing. I've been aware of KeyBase for some time now, but never really explored it. This is the push. Typing this comment as I am setting up my proofs.

</comment><comment><USER43> I made a test repository and proceeded to clone it using the keybase:// uri, expecting it not to work, but by some dark magic, it just did. Impressive!

<comment><USER44> Not in my case.

$:~/projectes$ git clone keybase:// [uri] Cloning into 'something'... fatal: I don't handle protocol 'keybase'

I'm on an ubuntu machine. What can I do to solve the problem? Keybase version 1.0.34-20171006000413+5fe91ae13

<comment><USER43> Have you installed and are you running the keybase client software? I start it on my system (Arch Linux) using the run_keybase command.

</comment></comment></comment><comment><USER45> Some hypothetical questions:

\- How could CI/CD be set up? (Is read-only access possible to the repo? Would Keybase work on a Jenkins box? Could a deploy server verify signatures before deploying?)

\- Could one set up mirroring to GitHub? How would this work? (I could see the signing without encryption as a value-add)

\- What happens in the event of a force push? Could certain users destroy history?

\- Could protected branches eventually be added, eg only certain users can push to master?

<comment><USER46> > \- How could CI/CD be set up? (Is read-only access possible to the repo? > Would Keybase work on a Jenkins box? Could a deploy server verify signatures > before deploying?

You could have a deploy/CI user as a "reader" in your team. But we don't yet support hooks or anything (as that implies running arbitrary code on endhosts without their knowledge), so it would have to pull the repo.

> Could one set up mirroring to GitHub? How would this work? (I could see the > signing without encryption as a value-add)

You can of course continue to use Github as a regular remote, but you'd lose all the encryption and signing unfortunately.

> \- What happens in the event of a force push? Could certain users destroy > history?

We do currently allow force pushes. Being able to turn that off on a repo-by- repo basis is something we'll consider in the future, definitely.

> Could protected branches eventually be added, eg only certain users can push > to master?

Yes, but again, as with any "server"-side feature, this is complicated by the fact that it has to run on the client itself, and thus isn't really strictly enforceable against modified clients.

As we get more experience with people using this, we will definitely be thinking about how to make it better by adding power features like these. Thanks for the feedback!

</comment></comment><comment><USER47> This actually got me to signup for Keybase today.

</comment><comment><USER48> I have a long running vm on Google cloud with only tiny configuration. I communicate to it with strong crypt way to access my 'pass' s git repo. So far so good, but I'm good to see what keybase's good work on how to improve the personal data safety, that's a good choice.

</comment><comment><USER49> I could basically store all my sensitive data there? Passwords, SSNs, private keys of ETH wallets, etc.?

<comment><USER50> Yes

</comment></comment><comment><USER51> Hi security newbie here, I have private bitbucket repo for storing my pass data. One problem is that pass often leaks some metadata like headers of directories. From security standpoint does this mean it is more private to host the git repo on keybase versus bitbucket ?

<comment><USER52> That depends - is that data encrypted on your system? Since git is decentralized, there's a chance that any plain-text copy (such as a clone on your system) could be compromised. Keybase even addresses this in the FAQ, to an extent:

> What if my computer is compromised?

> Your work is only as safe as your endpoints, so we can't help you there.

This applies regardless of host or protocol, BTW, and it isn't even specific to computing. (It doesn't matter how many locks you have on your front door if you leave the back door propped open.)

<comment><USER51> Hi pass uses gpg encryption on the text files my only concern are the file names which can leak meta info, for example just searching GitHub [https://github.com/zurchpet/pass](https://github.com/zurchpet/pass) shows this person has passwords in a public repository but encrypted. Nevertheless I can see that the file names are credit card info and other sensitive info. It's like having a safe with a label "important stuff inside" ! Does keybase solve this problem ?

<comment><USER53> Yes, the contents of the git repository holding your pass files are encrypted, meaning that the file names are not visible to anyone without the private key (you).

You may also want to look at [https://github.com/roddhjav/pass- tomb](https://github.com/roddhjav/pass-tomb)

<comment><USER51> Thanks for that I'll consider it.

</comment></comment></comment></comment></comment><comment><USER54> From the article:

>> _What are the limits?_

> _You can have as many repositories as you want, but the total for your > personal repositories can 't exceed 100GB. Each team also gets 100GB._

Is there anything stopping people from creating team after team just to hoard data in Keybase?

</comment><comment><USER55> This is pretty cool. I've used git-crypt before to encrypt parts of a repo, but this approach seems much easier to manage.

[https://github.com/AGWA/git-crypt](https://github.com/AGWA/git-crypt)

</comment><comment><USER56> I don't really understand how it works. Are the git objects encrypted before being pushed? In that case how are they handled by the server? Does it accept them even though they make no sense? What Github is going to show?

<comment><USER57> Keybase is just another Git remote you can push to, one that transparently encrypts whatever is pushed to that remote.

The Git repo itself is completely normal in every other respect, so if you push to Github, everyone can still see the entire repo.

This is a good design as it lets people move repos easily and avoid too much lock-in, but it may (will...) come back to bite people soon, who push things to Github thinking they were "encrypted by Keybase", which is not what's going on.

</comment></comment><comment><USER58> If only their app did not have so many pages marked writable and executable...

</comment><comment><USER59> Keybase, please just support web of trust already. In _some_ way. Not everyone I want to be able to authenticate necessarily has public social media accounts.

<comment><USER60> Do they have a website/server?

#1. Host a file on your site

You can host a text file, such as yoursite.com/keybase.txt. This is preferred, if you have a website.

#2. Set a DNS TXT record

Instead of hosting a web page, you can place a keybase proof in your DNS records.

<comment><USER59> > Do they have a website/server?

Not necessarily. I'm talking about people who want to remain anonymous (or pseudonymous) and might want to keep as low a public online profile as possible.

</comment></comment></comment><comment><USER61> This is amazing and convinced me to install Keybase on all my comps. I would like the ability to browse the repo in the Keybase app though.

</comment><comment><USER62> My thanks to the keybase crew, I've waited for a practical PGP solution for nearly 20 years. Keybase delivers, thank you!

</comment><comment><USER63> > Keybase team member here. Interesting fact: git doesn't check the validity > of sha-1 hashes in your commit history.

Not sure I understand.

git clone blah

cd blah

git fsck

What am I missing?

</comment><comment><USER64> Does this work for a local repository?

</comment><comment><USER65> I'm confused. Is the entire repo encrypted, or some files only?

If the former, what are case where this is needed?

<comment><USER50> The entire repo is encrypted.

Consider a repo containing passwords. It's easy enough to encrypt the files containing the passwords but the names of the files or even the directories in which they're located are also info you might wish to hide, e.g. that you _have_ an account at some-site-you-do-not-want-anyone-to-know-you-visit.com.

</comment></comment><comment><USER66> This is really friggin' cool! Best of luck to you guys, hope the work continues.

</comment><comment><USER41> is there a way to view / verify that the payload has actually been encrypted?

</comment><comment><USER67> Thanks for nice product. From now on I will move all my git repo into keybase

</comment><comment><USER68> I give gitlab 2 months before they implement and launch encrypted git

</comment><comment><USER69> just to clarify: 1\. Do you need a private git repository? 2\. Is everything really encrypted? 3\. If everything is encrypted how can i access it through Git Desktop?

<comment><USER46> You can have team-based or private repos hosted by Keybase. Everything is encrypted and signed before it leaves your computer, and decrypted and verified when your computer downloads it. But your local checkout of that git repo is unencrypted. It's just a normal repo. So Github Desktop has full access to it, like it does for all files in your local filesystem.

</comment></comment><comment><USER70> This is awesome, thanks for the heads up.

<comment><USER71> Yup!

Definitely not just posting this to verify myself.

</comment></comment><comment><USER72> Just wait til the government bans this because people will store kiddie porn, terrorist communications, and copyrighted media into it.

<comment><USER73> "Just wait til the government bans this because people will store kiddie porn, terrorist communications, and copyrighted media into it."

More precisely, the government will _claim_ that ...

</comment></comment><comment><USER74> Fantastic!

</comment><comment><USER75> Wait, what exactly _is_ keybase?

The home page says:

> Keybase is a new and free security app for mobile phones and computers.

ok, so, what does it do?

> For the geeks among us: it's open source and powered by public-key > cryptography.

Still have no idea what it does ..

> Keybase is for anyone. Imagine a Slack for the whole world, except end-to- > end encrypted across all your devices. Or a Team Dropbox where the server > can't leak your files or be hacked.

ok, so what is it? what does it do?

> [picture that looks like a chat app]

So it's an encrypted chat server?

What is it?

How can you have a homepage for a product that doesn't talk about what the product is and what it does?

Why so obscure? Are you trying to hide something? Is this really a home page for a product aimed at people who care about security?

Compare it to, for example, tarsnap's[0] homepage, which explains exactly what the product does and doesn't leaving you wondering about anything.

[0]: [https://www.tarsnap.com/](https://www.tarsnap.com/)

<comment><USER76> It's a lot, isn't your third quote a pretty good description?

> Keybase is for anyone. Imagine a Slack for the whole world, except end-to- > end encrypted across all your devices. Or a Team Dropbox where the server > can't leak your files or be hacked.

It's not much of a reach to assume familiarity with Slack and Dropbox; the message is clearly that Keybase is those (via Keybase Chat & FS) but encrypted.

For what it's worth, it's also a keyserver, and (now) git remote.

<comment><USER75> > isn't your third quote a pretty good description?

It's not. I think the person who wrote it think it's good marketing, but even that, it is not.

Here, try to see if this makes any sense as a product description:

> FeedHamster is for anyone! Imagine a Yelp that's customized just for you! Or > a YouTube feed that only shows you interesting videos that _you_ would like!

> Install FeedHamster now!

Now, can you guess what FeedHamster does? Maybe it curates content? Honestly I have no idea. I just made it up. It doesn't really say anything useful at all, but I think it makes more sense that that description on Keybase's website.

<comment><USER77> Tarsnap was a good example of a service selling to technically apt customer base. Guys who have years of IT training would love to read about deduplication and picodollars.

Keybase isn't charging money to begin with, so "sales pitches" are not their primary concern.

Also, they are marketing to "the masses" with the idea that more people should have secure e2e encrypted communication and collaboration solutions where identity is cryptographically proven.

But if their welcome page started showing diagrams of encryption pathways and key derivation algorithm names with server client relationship diagrams, I guarantee no one besides people in tech will download it.

I still think they need to do better selling the idea to the masses, I in no way think their current front page is sufficient, but I understand that right now they aren't concentrating on sales pitches.

</comment></comment></comment></comment><comment><USER78> Tried to create an account and no matter what I tried to name my devices all I got was "keybase has reserved this name."

Welp.

<comment><USER79> Ah, it's not the device names that are reserved, it's the username itself.

</comment></comment><comment><USER80> Does it use libgcrypt?

[https://www.theregister.co.uk/2017/07/04/gnupg_crypto_librar...](https://www.theregister.co.uk/2017/07/04/gnupg_crypto_library_cracked_look_for_patches/)

Maybe it only uses the Go crypto libraries?

</comment><comment><USER81> [http://www.aauthespian.news/2017/10/why-are-some-nigerian- mo...](http://www.aauthespian.news/2017/10/why-are-some-nigerian-mothers.html)

</comment><comment><USER82> Sounds intriguing but I'm missing the deep technical info on how it works.

> All data you push is signed by your device's private key, which never leaves > your device.

For the reference git already supports signed pushes (git push --signed): [https://github.com/git/git/commit/a85b377d0419a9dfaca8af2320...](https://github.com/git/git/commit/a85b377d0419a9dfaca8af2320cc33b051cbed04)

<comment><USER83> Signing a commit does not encrypt that commit's contents, just adds a signature to prove you wrote that commit.

From the Keybase FAQ:

> So is this signing my commits?

> No, this is happening at a lower level, (1) to allow encryption, and (2) to > ensure no unsigned or unencrypted data makes it in. Intuitively you can > think of it as you and your teammates using a cryptographic secure storage > layer for your git origin that doesn't really understand git.

> Your commits themselves are untouched from git's perspective, so if you > mirror your repository elsewhere, it'll be a regular checkout.

<comment><USER82> I did not mention signing commits but signing push requests and that was a reference to:

> All data you push is signed by your device's private key, which never leaves > your device.

</comment></comment></comment><comment><USER84> If you go crypto don't use git. It's not designed for cryptography in mind and the Keybase approach looks nice IF I can control every chain or can keep using github (or any other git server) with it. But for the storing part alone I would not trust Keybase. I would even say if you do crypto and need cloud storage then store it in multiple places and avoid git. Better flat file and some daily backup strategy with e.g. encfs as the bottom layer. In worst case you get your data back.

Sorry keybase.... you are not a trustable cloud storage for me.

It feels like betting on your company... I want to bet on your company without feeling dependent on worst case restore scenarios (computer dying while your company dies).

<comment><USER85> > _But for the storing part alone I would not trust Keybase._

Why not? You're making a bunch of claims about this being bad but you're not providing any reasoning for it.

<comment><USER84> It's basically new closed source one bucket crypto on one company which is not known for storage. A little bit too much of uncertainty for my taste.

<comment><USER86> A large portion of their code is open source: [https://github.com/keybase](https://github.com/keybase)

<comment><USER87> How easy is it to build and run my own copy of this code, especially the server side stuff?</comment></comment></comment></comment></comment>


What's missing in reddit/digg:  a way to see which side won an argument in discussions - <AUTHOR>

Although you can vote up/down individual comments, there's no easy way to see which side of an argument won overall.<p>Any ideas on how this could be done? <comment><USER2> Easy. The losers are usually the ones who participate.

<comment><USER3> Wrong.

Plus: You just participated.

<comment><USER2> <q>You just participated.</q>

I did not realize this was an argument. I guess I lost.

Seriously, though, the most interesting arguments don't resolve for quite some time, if ever. For example, who was the winner in the infamous Torvalds v. Tanenbaum argument over monolithic versus micro-kernels? One could say that Torvalds "won," in the sense that Linux became far more successful than Minix. Yet, Windows and Mac OS are both based, in part, on a micro-kernel architecture, and both have a greater share of the market than Linux.

<comment><USER2> I'd like to see a scoring system that evaluates the discussion or thread as a whole, rather than the individual contributions; a metric like a signal-to- noise ratio, where a thread gets a higher score for being on-topic and relevant, or a lower score for degenerating into a pissing match.

</comment></comment></comment></comment><comment><USER4> That erroneously assumes that it is possible to win an argument on the internet.

</comment><comment><USER5> The point of an online discussion is not to win or lose, it's to learn and hopefully educate others.

<comment><AUTHOR> Online discussions can go on forever.

But if you keep score, one side might consider giving up if it is obvious that it is losing.

<comment><USER5> What if the side that's losing is right?

<comment><AUTHOR> They did not make their case well or perhaps the forum is not an appropriate one. They can try again in another debate.

<comment><USER6> So, is it working yet?

</comment></comment></comment></comment></comment><comment><USER7> "Winning an argument is like winning at the Special Olympics. Sure you won, but you're still retarded."

<comment><USER5> This comment is no more funny or insightful than it was 5 years ago. Worse, it discourages positive contributions as well as negative.

<comment><USER8> Positive contributions usually don't spark arguments. Even if they're controversial or unpopular, they tend to spark _discussion_ instead.

<comment><USER5> I disagree, and I also think the line between argument and discussion is rather blurry; especially in text-based communication.

One of the most interesting threads I've read lately was that one where Walter Bright posted a comment about D in a thread bashing C++ programmers. His post was attacked by a few others, and the resulting argument was very interesting.

I think this is the thread: <http://kerneltrap.org/mailarchive/git/2007/9/7/257355>

Though I don't have time to find the specific chain of comments.

</comment></comment></comment></comment><comment><USER9> Personally, I think most online discussions are bankrupt. It's time to scrap the whole approach and start fresh. It's not close to how we share knowledge in the real world and simply stating and reading opinions is nothing more than good entertainment.

</comment><comment><USER10> Perhaps comments could be tagged and any +1 or -1 to a comment would trickle down to all of those tags? Would people take the time to tag comments?

You'd need a way to boil down the answer choices in order to declare a clear cut winner. By boiling it down, you take the personality and shades out gray out of the comment you'd be voting on and therefore much of the value.

Also, if the winning side is a "pro life" tag and you are pro choice, you are unlikely to see much value or be swayed by the vote. I would see such a vote as dumbed down and dig into the comments for the 'real' content.

</comment><comment><USER11> Maybe you should do this in a meta-site like Disqus, that'd be interesting. I could see why a site like Reddit/Digg wouldn't want to add a feature like this, it would probably encourage the wrong sort of behavior.

But human nature is human nature, there's always going to be a market for a pissing contest, why not capture it? :D

</comment><comment><USER12> It can't be done. The truth doesn't become falsehood just because it gets voted down.

<comment><USER13> No one said anything about truth or falsehood. The truth, unfortunately, does not just automatically win in an argument.

<comment><USER14> What?! Who ever knew Truth put to the worse in a free and open encounter?</comment></comment></comment>


Maintenance often matters more than innovation (2016) - <AUTHOR> https://aeon.co/essays/innovation-is-overvalued-maintenance-often-matters-more <comment><USER2> This expose really opened my eyes to how our political system will spend billions for a new station but won't fix broken track signals and chewed out cabling:

[https://www.nytimes.com/2017/11/18/nyregion/new-york- subway-...](https://www.nytimes.com/2017/11/18/nyregion/new-york-subway- system-failure-delays.html)

<comment><AUTHOR> Nice piece of journalism.

Maintenance isn't sexy. It doesn't make for catchy political campaign promises. It's dirty, it's hard, it never ends, and you've succeed best when no one notices.

But we live in a world full of old technologies and old systems that need constant maintenance and repair. Big infrastructure like the NY Subway is a prime example. 'Innovation' is only of marginal help when dealing with a system like that. Sure, if we had a spare ~$200 billion and were willing to completely evacuate New York City for 3 years we could rip everything out and build a new subway system to rival Singapore or Hong Kong. But this is the real world, and we have to rebuild the proverbial ship while it's still at sea. And the degree to which we have the tools and money to do so is a consequence of our political system.

For anyone who found the OP article interesting, and who cares about technology as it really is across the world rather than as it's portrayed by the Silicon Valley hype machine, I highly recommend the book cited at one point in the article: _The Shock of the Old: Technology and Global History since 1900_ , by the historian David Edgerton. It completely changed how I think about technology and the ways people use it.

</comment></comment><comment><USER3> Civilisation is a Red Queen; we must keep running just to stand still. Maintaining and conserving things is the job of conservatives, not entrepreneurs, and conservatives _resist_ change. Indeed most changes are detrimental.

Yet in the long run we absolutely _depend_ on change in order to adapt and survive. Therefore there has to be a rigorous way of reconciling these two principles. Without fudging ('maintenance _often_ matters more...')

Maybe: visionaries will develop new ideas _with no intention to enact them_. Eventually a few will become so well-thought-out, so vivid and so blatantly superior to the incumbent alternatives that they become inevitable. That is, society cannot _help_ but enact them.

This already seems to be happening in some areas:

e.g. moral improvements which come about via fiction, especially fantasy fiction

e.g. individual decision-making (it seems like we deliberate for a while and then actions take place automatically)

e.g. Project Hieroglyph (no idea how this is getting along but what a great idea)

[http://hieroglyph.asu.edu/](http://hieroglyph.asu.edu/)

...and of course all those brilliant videos on YT of engineering schemes for the future, e.g.

[https://www.youtube.com/watch?v=LMbI6sk-62E](https://www.youtube.com/watch?v=LMbI6sk-62E)

<comment><USER4> > Maintaining and conserving things is the job of conservatives, not > entrepreneurs, and conservatives resist change.

I'm mystified by this. Why does maintenance have to be a 'conservative' thing? Probably 70% of software engineering work is maintenance of one kind of or another. Are those engineers conservatives? Do they 'resist change'? Unless you mean 'conversative' in a very restricted sense of that word.

> so well-thought-out, so vivid and so blatantly superior to the incumbent > alternatives that they become inevitable. That is, society cannot help but > enact them.

This is a version of 'technological determinism' (Google it if you need to). If there's any single takeaway from the last 50 years of scholarship on the history of technnology, it's that technological determism is false.

<comment><USER5> > This is a version of 'technological determinism' [...] If there's any single > takeaway from the last 50 years of scholarship on the history of > technnology, it's that technological determism is false.

This kind of thinking is astonishing to me. "Technological determinism" is a historical term--i.e. reified in its era. The arguments ("stirrups enabled feudalism") are dated and simplistic and easily torn down. But to reduce a thought (discovery of technology influences human behavior, and can bring about its own creation) to a label ("technological determinism") and then dismiss it for historical reasons (older versions of that label were insufficient, therefore it is wrong), is sloppy thinking, imo.

<comment><USER6> I agree. It would be inaccurate to say that the invention of the electric guitar was the sufficient cause of rock'n'roll. On the other hand, the electric guitar is clearly a necessary cause. I think the best model for this interaction is a feedback loop (in the systems sense) where technology influence culture which influences technology.

</comment></comment></comment></comment><comment><USER7> How about innovation in system maintenance, or maintenance of innovative streak?

<comment><USER8> Absolutely yes. There is a goldmine there waiting to be found. Most appliances in our modern world are total maintenance disasters, especially compared to pre-industrial civilizations.

<comment><USER9> I never understood why we do not copy paste certain ideas from nature in our infrastructure. Why cant pipe secret a protective film, to avoid clogging and fracturing? Why cant we creat systems that self-repair decently.

</comment></comment></comment><comment><USER10> Is called business continuity.

<comment><USER11> You spelled planned obsolescence wrong.</comment></comment>


Give Me Something To Read - Best of 2010 - <AUTHOR> http://givemesomethingtoread.com/post/1660934095/give-me-something-to-read-best-of-2010 <comment><USER2> I absolutely love _Give Me Something To Read_ and _Longform.org_! There are a lot of great articles that didn't make it to this list, so check out the archives on both websites — the articles are (mostly) timeless.

Instapaper and GMSTR/Longform.org are streets ahead of casual games like Angry Birds for my commute.

<comment><USER3> There's also Longreads.com

</comment></comment><comment><USER4> Am I correct in thinking that this is a spin-off from instapaper.com (they take popular saved pages from instapaper to create the content for gmstr.com )? I cann't recommend Instapaper highly enough as a tool for saving web- articles and sending them to my Kindle for off-line reading.

<comment><USER5> That's what the subtitle says.

</comment></comment><comment><USER6> Is there something similar for german sites?

<comment><USER7> Good question. For my part, I'd be interested in Spanish and French equivalents.

</comment></comment><comment><USER8> Excellent selection of quality articles.</comment>


Your Personalised Course Finder - <AUTHOR> http://signup.knowinger.com

<comment><AUTHOR> We carefully hand-pick the best courses and match them to your current needs and learning style. No more endless searching through the interwebs!</comment>


Bulk Invite Connections to Your LinkedIn Group - <AUTHOR> https://www.linkedin.com/pulse/easily-invite-your-linkedin-connections-group-ahmed-tarek-hasan/ <comment><AUTHOR> Easily Bulk Invite LinkedIn Connections To Your Group With Extended Filtering/Searching Features In Few Clicks

When you are planning to invite some of your LinkedIn connections to your own LinkedIn group, which you manage, you need to have some features which can make the whole process much easier.

Some features like: * Browsing through the full list of your connections * Filtering connections by name * Filtering connections by occupation * Listing already invited connections * Rescinding invited connections * Listing group members who are not 1st degree connections

Unfortunately, the recent "Manage Group" interface lacks these kind of features as currently you can only short list your connections by name through an autocomplete textbox.

But, the good news is that you can have these features and more if you use this tool :)

[https://www.linkedin.com/pulse/easily-invite-your- linkedin-c...](https://www.linkedin.com/pulse/easily-invite-your-linkedin- connections-group-ahmed-tarek-hasan/)</comment>


Equifax Was Warned - <AUTHOR> https://motherboard.vice.com/en_us/article/ne3bv7/equifax-breach-social-security-numbers-researcher-warning <comment><USER2> In other engineering industries, ignoring the heedings of engineers results in charges of criminal negligence and corporate executives spending time in prison. Eventually that will be the case for software engineering as well. But Equifax probably won't tip the scale. My money is on the first company that walks away unscathed after a self-driving car plows through a preschool or something like that.

We already had Toyota following the same abyssmally unsafe (but dirt cheap!) practices that most of the industry does, ignoring 90 of 94 'required or suggested' practices for firmware development the automobile industry recommends, their developers not even having a bug tracker, not using ECC memory while lying and claiming they were, etc resulting in multiple deaths - and an acquittal for criminal negligence. The court pointed out there are no standards that the court could claim they violated. And they're correct. This issue has been debated in the Communications of the ACM for several years now, whether software engineering needs some sort of certification process or regulatory body which can make substantive judgements. Companies don't want it because they're aware of what a laughably cheap resource software engineers are and don't want that price to go up. Software engineers don't want it because any regulatory body is destined to make stupid decisions. But how long will the general public tolerate being ground under the wheels (literally) of bad software before demanding something be done? And just how much worse will those standards be when drafted by committees of lobbyists and bureaucrats?

Good article about the Toyota fiasco: [https://www.edn.com/design/automotive/4423428/Toyota-s- kille...](https://www.edn.com/design/automotive/4423428/Toyota-s-killer- firmware--Bad-design-and-its-consequences)

<comment><USER3> > _Eventually that will be the case for software engineering as well ... My > money is on the first company that walks away unscathed after a self-driving > car plows through a preschool or something like that._

I agree with you that "eventually that will be the case".

I don't think it will happen until some people in government -- politicians who can actually make/change the laws -- are personally impacted or affected in some really major way, though. Until that point, their lobbying friends will persuade them that everything is fine.

It's just like trying to warn management about "bad shit" that could happen. Nothing will change until it actually does happen -- and then you will see a swift, overwhelming response.

</comment></comment><comment><USER4> I think this is to be expected from organizations that don't have software as a core activity. You don't attract the best people, don't motivate the people you have, and don't promote them. It has happened again and again: Target, Equifax, Toyota, Therac-25, etc... The seemingly most effective means of mitigating it appears to be to throw money at people (ex: Wall Street and to a lesser extent biotech) or to be in a really hot field (which basically allows you to throw money at the problem).

<comment><USER4> There are two other ways to solve the problem. Wait for a more software oriented company to eat the existing company's lunch and software as a service. The SAS approach seems to work best for large markets.

</comment></comment><comment><USER5> With such disregard for security it was probably also possible to change data with a simple SQL injection.

If you were a malicious person, imagine the possibilities.</comment>


NASA's $1B Jupiter probe takes mind-bending new photos of the gas giant - <AUTHOR> http://www.sfgate.com/technology/businessinsider/article/NASA-s-1-billion-Jupiter-probe-has-taken-12478909.php <comment><USER2> Oh man, I want to find some High-res versions of these.</comment>


Facebook's 'collateral damage' could be buying opportunity, says Cramer - <AUTHOR> https://www.cnbc.com/video/2018/07/30/facebooks-collateral-damage-could-be-buying-opportunity-says-cramer.html <comment><USER2> Who triggered it?

<comment><USER2> Biggest in the History but who "triggered"? Talking Numbers again. Inquiry in Y20. One night out of blues crash; A major major one. WHO?</comment></comment>


Show HN: Coffee & Domains - domain name registration and management - <AUTHOR> https://www.coffeeanddomains.com

<comment><USER2> What's different about it compared to NameCheap, GoDaddy, iWantMyName, etc?

<comment><AUTHOR> $10 dollar domain names (that holds true for registrations, renewals, and transfers), free private whois, simpler UI, and no upselling.</comment></comment>


Ask HN: Valuing a Social Technology startup using EBITDA makes sense? - <AUTHOR>

originally asked here: http://answers.onstartups.com/questions/49770/valuing-a-social-technology-startup-using-ebitda-makes-sense
We're finalizing the details of a new shareholders agreement but we're stuck at setting the EBITDA multiple that will get used for future valuation of the company.
The agreement was written by one of the new investors (VC). but the other investors commented that EBITDA is the wrong way to calculate the valuation of a social technology startup that has assets like its users, and that should be looking for revenue and market share.
The startup could be not generating high revenues, but the numbers of its users for example could be another thing that should be part of the equation as it represents an opportunity and a market share.
We're confused and don't know what is the right method to use. I hope that there's a standard for something like that. <comment><USER2> A multiple is a benchmark instrument, not a valuation methodology. A business needs to be valued via DCF, using a multiple to value a business is a big mistake.

Let me clarify, e.g. An EBITDA multiple of 8x all it means is that the company's Enterprise Value is 8x the company's (either FY0 or preferably FY+1) EBITDA. But the important number here is not the multiple, it's the Enterprise Value! The multiple is the by-product of the valuation (Enterprise Value/EBITDA = Multiple), and not vice-versa. By using a multiple you are potentially omitting the company's future growth, capital structure, increase in profitability/margins, etc. That is why the smart way of valuing a business is via DCF. By using a DCF you are able to critically test if the operational metrics, implied growth, revenues, costs, profitability, etc assumptions are realistic and achievable. And in the case of a tech companies, one makes sure that growth (where a big chunk of value is) is factored/priced in.

<comment><AUTHOR> As you said, I think DCF would be the right thing to do. we already did the valuation for this round of investment using DCF. so in future calculations of valuation, it would make sense to use DCF again.

The current draft of the Shareholders Agreement currently says that EBITDA should get used if there're revenues, but if there are no revenues, DCF should get used.

I think we will just amend that by removing EBITDA, and forcing the use of DCF in all cases.</comment></comment>


Of Meat and Men: The Story of Two Pitmasters (2012) - <AUTHOR> http://www.texasmonthly.com/food/of-meat-and-men/ <comment><USER2> Really cool to read about Aaron's start. I've just started smoking meat this year and it's a fun hobby. How many other hobbies do you get to eat when you're done!

I'm still trying to get a consistent cook, but I've already found a couple of variables to control for. And I've had one cookout where a couple of people told me they thought it was restaurant quality.

A friend owns a restaurant and said if the laws here weren't overly strict on buyint outside pre-cooked product he would buy from me to sell in his restaurant.

<comment><USER3> You should definitely subscribe to /r/charcuterie.

Why not do a partnership with the friend - do it in/for the restaurant and scale it out to a separate business once you have everybody hooked?

<comment><USER2> I'm subbed to /r/smoking. I'll check out charcuterie

</comment></comment></comment><comment><USER4> Big Central TX BBQ fan here.

For those in Texas, it's not very well known but the family running Kreuz Market (mentioned in the article) opened a new location recently, in Bryan TX, 90mn North west of Houston.

And for the readers in the Seattle area, I recommend Jack's BBQ on Airport Way S. It's owned and operated by a Texan native (former Microsoft employee* ). Their brisket isn't bad!

* for the overlap between tech and BBQ :)</comment>


Death by Caffeine - <AUTHOR> http://www.energyfiend.com/death-by-caffeine <comment><USER2> It's surprisingly easy to overdose on caffeine, regardless of if you kill yourself though. I ended up in the hospital worried about strange heart palpitations once. It was due to too much caffeine. Apparently a litre and a half of pepsi plus a bag of chocolate covered espresso beans is a bad idea.

That being said, I bet almost everyone here has felt the effects of caffeine intoxication before (<http://en.wikipedia.org/wiki/Caffeine#Caffeine_intoxication>). It's pretty easy to hit a level which causes those kind of symptoms.

<comment><USER3> I drank a case of beer and two rockstars. 8 hour later, bam! Pericarditis.

</comment></comment><comment><USER4> Of course, that only takes into account the caffeine content of a beverage divided by the LD50 of caffeine as determined in rats (in mg/Kg)

I'm pretty sure something else would go horribly wrong before I finished off the 150th can of red bull, for example.

<comment><USER5> Shouldn't it then tell you - x cups of coffee and you might be dead? It is only LD50, after all.

<comment><USER6> It's best to be pessimistic in these endeavors.

<comment><USER7> Pessimistic would be LD1.

</comment></comment></comment></comment><comment><USER8> So what this is saying is that its practically impossible to achieve an LD50 dose of caffeine without pills.

<comment><USER9> Yeah, I'd be vomiting it back up long before I got to 113 cups of coffee. I normally run about a half gallon (8 cups) a day.

</comment></comment><comment><USER10> Drinking even a tiny fraction of that much caffeine sounds awful. Caffeine has a terrible body load, and I'm pretty sure I'd want to die after three Red Bulls let alone 150. Coca tea is 1000x better, and they even sell it on Amazon:

[http://www.amazon.com/Coca-Tea-Novoandina-Yungas- Bags/dp/B00...](http://www.amazon.com/Coca-Tea-Novoandina-Yungas- Bags/dp/B000HAAAKI)

<comment><USER11> Bah anything that is legally sold in the US has the cocaine removed. What's the point?

<comment><USER12> Does it? The amount of active ingrdient in your normal coca leaf (which is all tea is) is miniscule - you need hundreds of pounds to make a gram of cocaine. You could suck back 100 bags of tea and soak them all you want and not even come close to getting "high" - you'd just be awake - coffee or regular caffeine-containing tea is more dangerous than that stuff.

<comment><USER10> "you need hundreds of pounds to make a gram of cocaine"

I think it's actually 125 grams of leaf makes one gram of cocaine. And a cup of coca tea is like 8% of a dose of cocaine, though it gets absorbed about twice as slow. So it's actually really not that much different than doing cocaine, in that the difference in dosage is only an order of magnitude, although somehow the difference is enough to make the tea completely safe and harmless as long as it isn't abused.

</comment></comment></comment></comment><comment><USER13> Smallgen, are you a member of heatsync labs or something? I was over there a couple of days ago and we randomly stumbled across this when trying to find out how much Africola somebody could drink without dying.

Although...I did post it to my website too...

Do I actually have people _using_ my site!?!?

/kidding, probably just coincidence.

<comment><AUTHOR> Nope, I actually just googled how much caffeine was in a couple of energy drinks today and I came upon that site and the death by caffeine calculator and thought it was worth sharing.

</comment></comment><comment><USER14> > There's no caffeine in Fresca, so that won't kill you. You can go for death > by sugar intake, though.

I thought Fresca was sugar free... death by sugar substitute?

<comment><USER15> And it thinks there IS caffeine in A&W Cream Soda. Hm.

<comment><USER16> These things usually vary by region or country. For example, in Canada, they only very recently (or will be soon, I can't recall for sure) lifted restrictions on caffeine in non-colas. Previously, things like Mountain Dew, Sprite, 7-up, etc., could not contain caffeine.

<comment><USER15> Mountain Dew without caffeine! I knew the Canadians couldn't be trusted.

</comment></comment></comment></comment><comment><USER17> What about the timeframe.. Is that all at once, or in a day?

<comment><USER18> About page -> What is the time frame of the Death Calculators?

[http://www.energyfiend.com/2006/08/what-time-frame-for- the-d...](http://www.energyfiend.com/2006/08/what-time-frame-for-the-death-by- caffeine-calculator)

<comment><USER19> Summary: all at once. That would be one heckuva bathroom break.</comment></comment></comment>