Nice Try, Groupon - <AUTHOR> http://blogs.wsj.com/venturecapital/2011/01/10/has-a-company-ever-raised-like-1-billion-in-venture-financing/?mod=wsj_share_twitter

<comment><USER2> Article criticises Groupon for claiming to raise $1B. Says much of that is being used for (...).

Who cares how they're spending it? They DID raise $1B. Petty article.

<comment><USER3> The distinction is that the company actually received $600M. The other $350M was really a form of "secondary offering" that let existing shareholders take some chips off the table.

<http://en.wikipedia.org/wiki/Secondary_market_offering></comment></comment>


SSH Handshake Explained - <AUTHOR> https://gravitational.com/blog/ssh-handshake-explained/ <comment><USER2> I wish they had at least made an effort to link to RFCs[0][1][2][3][...] that define SSH2 protocol and that also explain the handshake portion more accurately and in more detail (found one link to rfc4253 from article).

I also hope they didn't decide to roll their own SSH2 stack for their product (article doesn't mention if they did or did not).

Another thing I wish people would do is to include a link to .pcap of the network traffic they are trying to explain. Found one[pcap].

[0] [https://tools.ietf.org/html/rfc4251](https://tools.ietf.org/html/rfc4251) [1] [https://tools.ietf.org/html/rfc4252](https://tools.ietf.org/html/rfc4252) [2] [https://tools.ietf.org/html/rfc4253](https://tools.ietf.org/html/rfc4253) [3] [https://tools.ietf.org/html/rfc4254](https://tools.ietf.org/html/rfc4254) [...] [https://tools.ietf.org/html/rfc4250](https://tools.ietf.org/html/rfc4250) (and others) [pcap] [https://packetlife.net/captures/protocol/ssh/](https://packetlife.net/captures/protocol/ssh/)

</comment><comment><USER3> Also interesting:

[https://tls.ulfheim.net](https://tls.ulfheim.net)

[https://tls13.ulfheim.net](https://tls13.ulfheim.net)

<comment><USER4> This is a wonderful visualization, and up to date too. Thanks for sharing.

</comment></comment><comment><USER5> I found out recently that OpenSSL is not just for securing network connection. It has a whole library of ready made encryption code that can be used for other purposes.

<comment><USER6> Probably best not to do this, OpenSSL has the mindset of a collector. Rather than "Here are six things you might want to actually do" OpenSSL says "Here are four hundred things somebody has at some point proposed to do". This is already bad enough in its core competence where OpenSSL historically made it very easy to do stupid things like forget to check the certificates you were given are for the name of the host you were trying to connect to. It's much worse once you start calling APIs somebody last worked on ten years ago.

Also, since it is thinking like a collector, OpenSSL won't even nudge you if you start trying to do something that is inherently a terrible idea, like using an RSA key for encrypting data. It's possible, OpenSSL can help you do it, but you definitely shouldn't.

Libraries focused around solving real problems, such as Tink are less likely to inadvertently allow you to start doing something that everybody who cares already knew was a bad idea before you even began work.

<comment><USER7> I can't agree with this post enough. Not only does OpenSSL have a grab-bag of ciphers of varying quality, but it also has an exceedingly confusing and under-documented set of APIs to access them. It is far easier to build something insecure on top of the OpenSSL library than it is to build something secure.

If at all possible, you should use something that directly implements the high-level constructs you need. libsodium does a good job here (and has bindings for most languages), but there are other tools for more nuanced requirements (e.g., the noise protocol suite for bi-directional communication).

<comment><USER5> In my experience, OpenSSL's API is not bad. It's overwhelming because it includes a lot, but most people just focus on one or two aspects and that API is pretty simple. E.g. for symmetric encryption, it's just couple functions, with fairly high-level constructs.

In term of using it wrong, I don't find it any worse than other libraries. You have to know what you are doing when using crypto API.

</comment></comment></comment></comment><comment><USER8> This is quite poor article, which you can grasp after reading it. Few examples:

* quote: "generates ___something___ referred to as the exchange hash H" \- in article which tries to sound technical and in fact in some parts goes into much details, this ___something___ is really funny :)

* copy pasta description of forward secrecy, wrongly explaining why it is forwardly secure

* wrong chain of events with lack of important diagram, while adding boilerplate :(

p.s. amount of upvotes shows these days a lot of us click up before reading _whole_ article.

</comment><comment><USER9> Related: The first few milliseconds of an HTTPS connection ([http://www.moserware.com/2009/06/first-few-milliseconds- of-h...](http://www.moserware.com/2009/06/first-few-milliseconds-of- https.html))

</comment><comment><USER6> Not a fan of documents which use a table (rows and columns) to format what is actually just several distinct columns as is done here for the list of primitives in each category.

If the author is reading this, consider how you might make it clear that the rows don't relate things across the columns.

<comment><USER10> That's a shame, I'm pretty sure there are at least a couple nice ways to do columns in modern HTML.</comment></comment>


Facebook Just Patented The Feed - <AUTHOR> http://thenextweb.com/socialmedia/2010/02/26/facebook-patented-feed/

<comment><AUTHOR> Readers should be aware that the article completely misunderstood the patent, as did most of the commenters. I find the misunderstanding much more interesting than the patent itself.

</comment><comment><USER2> I don't think that the patent will have any affect on sites such as Twitter, where it's just a feed of statuses. A site that shows you what's going on with others that are in your social network such as Buzz, etc might be a different story.</comment>


Keep the Cat Out of the Cradle with Arduino - <AUTHOR> http://appdelegateinc.com/blog/2010/11/22/keep-the-cat-out-of-the-cradle-with-arduino/ <comment><USER3> I found that the mere presence of a baby was enough to scare my cats away.

</comment><comment><USER4> I've often wondered about the reasonableness, or otherwise, of the popular fear that one's baby might be smothered by a pet cat. When my daughter was a baby I was careful to keep the cats out of her bedroom, because I wasn't sure, but I suspected the risk to be overblown.

Are there any data on how often this actually happens? This article from the British Medical Journal [http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1499543/pdf/bmjc...](http://www.ncbi.nlm.nih.gov/pmc/articles/PMC1499543/pdf/bmjcred00624-0025a.pdf) suggests it has happened at least twice in recorded history. If that is representative, the real risk is presumably rather small.

<comment><USER5> I thought the concern was more about the cat scratching the baby intentionally or otherwise.

<comment><USER6> i've seen many times toddlers doing various things to cats or dogs - <USER2> animal would never bite/scratch back. It would just get away if it is too much of toddler's "attention"

</comment></comment></comment><comment><USER7> This is great - I've been thinking about building something like this to keep the cat from waking us up in the middle of the night, or off of certain pieces of furniture. It would be better if the tone was in a range above human hearing, though.

<comment><USER8> That's the great part. You have the source code, just change the value of 'freq'!. The piezo should be able to hit high enough frequencies.

<comment><AUTHOR> I was wondering about that. I think I'll try it. You just have to change the second number in the playTone(1000, 500); call.

</comment></comment></comment><comment><USER5> This is a cool DIY project. For those wanting something similar without the DIY, we've used the Tattle Tale to keep our dog off the couch. It costs less than the Aurduino board.

[http://www.amazon.com/Tattle-Tale-Sonic-Training- Alarm/dp/B0...](http://www.amazon.com/Tattle-Tale-Sonic-Training- Alarm/dp/B000ANOT9U)</comment>


A look inside Globalstar's plan to build an exclusive nationwide Wi-Fi network - <AUTHOR> https://gigaom.com/2014/03/17/a-look-inside-globalstars-plan-to-build-an-exclusive-nationwide-wi-fi-network/ <comment><USER2> This story is dated March, 2014</comment>


The Simple, Secret iPhone Tethering Fix - <AUTHOR> http://www.fastcompany.com/blog/chris-dannen/techwatch/simple-secret-iphone-tethering-fix <comment><USER2> I have been using iPhone tethering for almost a month now, and it rocks. I am not going to update to any new iPhone OS unless I am sure I can tether.

Paying $45 for HSI at home and $30 for iPhone is a lot. I am not looking forward to add more to it for tethering.

</comment><comment><USER3> If you are running the 3.1 beta on your phone and you turn on tethering, it kicks you back out and the tethering option is removed :)

</comment><comment><USER4> Beware: You will probably lose your Visual Voicemail.

But that's okay: Try using PhoneGap instead. Works well for me; it sends transcribed voicemail messages to your e-mail.

<comment><USER2> A lot of my friends including me are using iPhone tethering with no loss in visual voicemail.

</comment></comment><comment><USER5> This guy's about four months too late, and despite what he infers all the known tethering workarounds have been patched in 3.1.

<comment><USER6> Including the customized carrier ipcc?

</comment></comment><comment><USER7> 3.1 ?? no work arounds that I know of in a non jail broke phone..</comment>


Ask HN: Hackers on Poetry - <AUTHOR>

I've been toying with the idea of memorizing some poetry. You guys have any favorites? Bonus points for material with a techno-tinge. <comment><USER2> Do you like use warnings and strict?

I do not like use warnings and strict.

Do you like them here or there?

I do not like them here or there?

I do not like them anywhere.

I do not like use warnings and strict.

I will not obey your good coding practice edict.

Could you, would you in your code?

Would you, could you in your PerlMonks node?

I could not, would not in my code.

I would not, could not in my node.

Not in my program.

Not in my script.

Not a one-liner.

Not with shebang.

Say! At night?

Would you, could you at night?

Not at night.

Not in the mornings.

I do not use strict and warnings!

If you do not use warnings and strict.

Then upon your code bugs you'll inflict.

I will not use warnings and strict.

My freedom of coding style they will restrict.

I am too Lazy to declare with my.

I do not need it; I'll get by.

You do not like them.

So you say.

Try them! Try them!

And you may.

Try them and you may, I say.

If you will let me be,

I will try them.

You will see.

        The stubborn hacker finally relents to trying them.

Say, I like warnings and strict!

I do! I like them a little bit.

I will use them in my code.

And I will use them in my node.

And in my programs.

And in my scripts.

warnings and strict are right for me.

They are so good, so good, you see.

(not my writing, just something that fits your request)

</comment><comment><USER3> <http://members.tripod.com/~Sprayberry/poems/howl.txt>

<comment><AUTHOR> I was looking for this; thanks.

</comment></comment><comment><USER4> True ease of writing comes from art, not chance; As he moves best who learns the steps of dance; 'Tis not enough no harshness cause offence; The sound must seem an echo of the sense. Alexander Pope, early hacker & investor (in the south sea bubble)

</comment><comment><USER5> Why would you memorize poetry? Just curious.

One of my favorites: <http://www.cs.rice.edu/~ssiyer/minstrels/poems/57.html>

<comment><AUTHOR> Learning exercise, swoon the opposite sex, personal interest. In order of prevalence.

<comment><USER5> The opposite sex represent a particular problem, I've found. I'm a writer primarily: my plan for a start-up is one that relies on writing, and I think that as much as I like designing sites, my skill currently lies far more in writing. Therefore, I can relate this particular paradox with some confidence:

If you read them poetry that ISN'T by you, they won't get it. Unless you explain it to them first.

If you read them poetry YOU wrote, it ONLY works if it's bad. The minute you write something decent, it doesn't interest them. This is because only in bad writing can you be as bland and generic as you need to be to woo women.

As for learning exercise: makes sense. You can also try writing them. Writing haiku makes for a FASCINATING mental exercise. There's so little room to work in, and so much you can do.

</comment></comment></comment><comment><USER6> Aristotle, by Billy Collins <http://members.cox.net/mppowers1/aristotle.html></comment>


Never Complain. Only Ever Code. - <AUTHOR> http://gilesbowkett.blogspot.com/2008/02/never-complain-only-ever-code.html

<comment><USER2> "Always program first and blog second."

I sure hope that was output, not input.

</comment><comment><USER3> The blog post violates its own thesis.

<comment><USER4>
        if !(your comment was code):
            print "that was a complaint"
        print "by the way this is the new way we apparently have to talk around here"</comment></comment>


RMIScout: Safely and Quickly Brute-Force Java RMI Interfaces for Code Execution - <AUTHOR> https://know.bishopfox.com/research/rmiscout <comment><AUTHOR> [https://www.reddit.com/r/netsec/comments/gqw0e2/rmiscout_saf...](https://www.reddit.com/r/netsec/comments/gqw0e2/rmiscout_safely_and_quickly_bruteforce_java_rmi/)</comment>


Show HN: Create sketchy, hand-drawn version of image in browser with WebAssembly - <AUTHOR> https://pshihn.github.io/rough-draw/ <comment><AUTHOR> Hi, I created rough.js ([https://roughjs.com/](https://roughjs.com/)) earlier this year and was curious if I could use it to turn any image to a hand drawn, sketchy image in the browser.

Using a web assembly build of OpenCV, I extract the shapes out of an image and feed it to rough.js which draws them and fills them with colored hachure lines.

Comments/suggestions welcome. Cheers.

<comment><USER2> This is cool! Is there no way to save the image though?

<comment><AUTHOR> On desktop, right click -> save image</comment></comment></comment>


NoBackend: Front-End First Web Development - <AUTHOR> http://www.infoq.com/news/2013/05/nobackend?utm_source=feedly <comment><USER2> <http://nobackend.org>

<http://nobackend.org/dreamcode> Interesting gists of ideal code:

\- user accounts / authentication <https://gist.github.com/gr2m/5463426>

\- data persistence <https://gist.github.com/gr2m/5463475>

\- data sharing <https://gist.github.com/gr2m/5463525>

\- emails <https://gist.github.com/gr2m/5463552>

\- file conversion <https://gist.github.com/gr2m/5463605>

\- payments <https://gist.github.com/gr2m/5463675>

<http://nobackend.org/examples>

\- <http://css-tricks.com/editable-invoice-v2/>

\- <http://gr2m.github.io/EditableInvoice/>

<http://nobackend.org/solutions> < known live projects

</comment><comment><USER3> > _It's a different approach that especially fits applications that hold most > of its logic in the frontend, where the user experience is the most > important feature._

This is the part I have a bit of an issue with when it comes to all the hype about front-end development. I've been involved in web development since 1994, and software development since the 80's. I've so very, very rarely encountered applications to which this applies.

When I mention this, people come up with examples like GMail or Twitter, obviously not understanding the the front-end part, however impressive in the case of GMail, is just that: a front-end, a client for an application so much more complex.

I sometimes feel front-end experts have no idea about what happens on the back-end. All those API-calls are not being handle by some magic genie.

Or maybe I'm wrong and I've missed something essential.

<comment><USER4> I think that your point of view is actually a really good reason for front- end-first development. As a front-end developer, I accept that the back-end portion of modeling, storing, and scaling the data is a much harder (or at least much different and very hard to me) task that generally requires much more investment before you get much useful feedback.

So when working on a new product, it's worthwhile to build as much of a facade interface as you can to quickly and cheaply explore how it feels to use the product. Then you can iterate rapidly with something concrete in front of your stakeholders, and when they're happy, you can just build the back-end once, from a solid foundation of domain knowledge.

It also works out well socially. Some people (who tend to congregate in front- end) work well with vague ideas about a user experience and instructions to explore the product on their own. Others (who congregate in back-end these days) want firmer ideas about the product and usage so that they can exercise their creativity in solving the technical problem well. Front-end-first is a great way to let everyone do the part of the job that they like.

<comment><USER3> The word you're looking for is "prototyping".

I'm not being sarcastic (well, okay, a little), I pretty much agree with most of what you wrote (of course depending on the project at hand), except the notion that this is something _new_.

Also, just working on the front-end/user experience doesn't give you, and certainly not the back-end developers, a "solid foundation of domain knowledge". That only happens if they are deeply involved in the same process, and front-end- _first_ suggests exactly the opposite. A front-end, no matter how wonderful and detailed, is still way to vague to serve as specs unless the application is very simple.

<comment><USER5> What separates this idea from prototyping in my view is that they are suggesting keeping the "prototyped" UI as the real deal and then building a back-end to support it, rather than re-building the front-end along with the back-end. The back-end is developed using all of the well-documented places where the front-end needs support as a spec.

</comment></comment></comment></comment><comment><USER6> So, I've been working a bit on a simple RSS reader in a spare hour or two over the last few days, just to experiment with some ideas, and one of the things I decided to do at some point was create a small backend service that just generated a gibberish feed -- ordered dates with news item frequency I could set, proper RSS, but nonsense text and a pictures of/links to cats.

This was _after_ I already had a "real" backend (could grab/merge RSS feeds), but I still found it useful in focusing on some front-end features, and I wonder if I might even have been farther along from a prototyping standpoint if I'd made that approach from the start.

If this is true for some problem domains, my guess is that it's possibly more true for those (such as feed gathering) where the backend tech issues are mostly simple or solved problems and most of the novel work to do is in the realm of UX.

<comment><USER7> I think, to generalise a bit, you should probably work on your hardest problem needed to launch. If that's an awesome UX, you should probably make sure that's possible, and especially with front-end stuff validate that it's usable. If your backend has unsolved problems that are needed for launch, you probably want to make sure they're solvable before you spend ages implementing the frontend.

</comment></comment><comment><USER8> I have some validation finally. I have called this approach frontend-first and have evangelized it internally in my teams. But NoBackend is, catchy. Basically, I rally my team to build up as much functionality as they possibly can w/o writing any server side code and demo it to the stakeholders and have their final confirmation before starting to write anything on the server. The demo at this point pretty much resembles the live application!

There are some more innovating ideas listed on the site. This sure looks promising.

</comment><comment><AUTHOR> This is indeed an interesting approach. Backend as a Service usually fixes the problem for the developer. Which is to make it easy on the developer to create distributed systems. BaaS improves UX in a small way by just making things faster and more accessible. But the focus is still the developer.

The no-backend approach removes the backend all toghether, by focusing on UX, basically on the end-user. This is an amazing idea. Not because of how revolutionary the technology is, but mostly because it is a very creative way of improving the user experience.

Obviously not all websites would benefit from this approach, but there is a large application for it. For most application, a hybrid approach would bring the best results.

Zumero (<http://zumero.com/>) for example keeps the data on the user device for mobile applications. It makes sure the application stores everything in the device, so that apps don't require an external backend.

In the case of Websites, ExtJs (<http://www.sencha.com/products/extjs/>) has its store, which represents a local storage for web applications. It is not persistent, but there are ways to keep it in the user machine.

Don't dismiss the idea because it seems radical, try to integrate it into your app and I am sure you will see the advantages.

</comment><comment><USER9> I was first introduced to the "wishful thinking" idea when watching the SICP lectures. It's introduced quite early on in lesson 1 or 2. It really changed how I approach new problems and now I use it all the time. [http://groups.csail.mit.edu/mac/classes/6.001/abelson- sussma...](http://groups.csail.mit.edu/mac/classes/6.001/abelson-sussman- lectures/)

In a way "dreamcode" is basically the same: you determine what you want to build and infer the API dependencies that you will need. It makes sure that all the API that you're going to build are going to be used.

</comment><comment><USER10> These #nobackend folks are late to the game! Rdbhost has provided for no- server-coding web apps since 2010.

See <http://www.rdbhost.com>

</comment><comment><USER11> Form follows function. That said, I find it best to divide the tiers and document where they meet ahead of time. Then develop each tier independently to the spec. That makes it so much easier when it is time to maintain/iterate/swap out one of the parts.

Front end first, back end first... it doesn't really matter. You shouldn't be designing one to the other. Function first :)

</comment><comment><USER12> We're already seeing the rise of backend as a service through products like Disqus, Video/youtube, and google analytics. If you're looking for problems to solve, find something you hate doing as a developer and find a way to jam it into an iframe/javascript snippet.

<comment><AUTHOR> I wouldn't consider any platform that exposes an API a Backend as a Service. I do understand where you are coming from, but Backend as a Service providers are more like iKnode, Parse, Kinvey and Firebase.

<comment><USER13> i found Baas really hard to test , especially when you need to upload some bits of business logic somewhere ... I tried a bit with couchdb and couchapp, but i never figured out how to unit tests attached documents. Parse works a bit the same way. How do you do testing on Baas ?

<comment><AUTHOR> On iKnode you can test your backend with simple Javascript Unit Tests. We have a sample in our Javascript SDK: <https://github.com/Structum/iKnodeSdk/tree/master/Javascript>

What you do is you create your Backend App in iKnode like this one: [https://github.com/Structum/iKnodeSdk/blob/master/Javascript...](https://github.com/Structum/iKnodeSdk/blob/master/Javascript/UserService.cs.txt)

Then you write your Unit Tests in Javascript like in here: [https://github.com/Structum/iKnodeSdk/blob/master/Javascript...](https://github.com/Structum/iKnodeSdk/blob/master/Javascript/UnitTests/iKnodeSdkTest.js)

You can also run any other Unit Test framework against iKnode, for example we have:

\- C# with Microsoft Unit Test:<https://github.com/Structum/iKnodeSdk/tree/master/C%23>

\- Objective-C with Unit Tests: [https://github.com/Structum/iKnodeSdk/tree/master/Objective-...](https://github.com/Structum/iKnodeSdk/tree/master/Objective-C)

</comment></comment></comment></comment><comment><USER14> @aespinoza Check out dreamfactory.com, we just launched an open source backend service platform.

<comment><AUTHOR> Checking it now. I work for a Backend Service platform called iKnode. So I already have a backend for my apps.

<comment><USER14> Great, would love any feedback. We're mainly targeting enterprises. I'll check out iKnode.

<comment><AUTHOR> Definitely. I would value some feedback from you as well.

</comment></comment></comment></comment><comment><USER15> I'm curious. How are user accounts managed? How does authentication work? How are the user data stored and shared on different browser sessions?

<comment><USER16> > "... falling back to using server-side components only to implement the > features the browser does not yet support."

Depending on the problem, that could be a prime candidate for falling back to the backend.

</comment></comment><comment><USER17> The author is taking an existing concept that is not new at all and describing it in a fancy way to make it sound like a great new thing.

This reminds me of how UX designers talk about their job. Their job importance can be measured in X and they are always trying to make it sound important as X squared. Please front end guys, do not do this.

<comment><USER18> They are proud of what they're doing. Please, let people share their ideas and implementations. It's okay to rehash "older" concepts and present them to new audiences (who may not have been exposed to them).

If this isn't new to you, contribute to the conversation with additional examples or insight.

An oldie (but goodie) was on the front page today: <http://www.thingist.com/item/4372/>. There might be some valuable & relevant lessons to glean.

</comment></comment><comment><USER13> i've always been front-end first. creating the html/js first then the server api out of it , then finally chosing the persistance layer.

So nothing new here. that's called building up to bottom . You focus on a few user scenarios and you just make them happen.

then you refactor your obviously nasty code , and thanks to tests , nothing breaks on the client.

That's why i like microframeworks too instead of bloated stuffs. They can grow with your needs instead of having all these unusefully layers of code packaged together, and they are still good enough for team work.

<comment><USER19> What do you prefer in terms of microframeworks?</comment></comment>


TC Disrupt: Grow The Planet - Farmville for real farming - <AUTHOR> http://techcrunch.com/2011/09/13/farmville-for-real-farming-grow-the-planet-launches-social-network-to-teach-you-to-grow-your-own-food/

<comment><AUTHOR> I know them! We used to share workspace at H-Farm (<http://www.h-farmventures.com/>). Great job!</comment>


Zoom needs to clean up its privacy act - <AUTHOR> https://blogs.harvard.edu/doc/2020/03/27/zoom/ <comment><USER2> As other people have stated in this thread everything in Zoom's privacy policy seems to indicate they are sending data to advertisers only as necessary to advertise their own products. They likely:

\- Use the Facebook iOS SDK to measure conversions from app install ads

\- Send a list of hashed email addresses to Facebook or other advertisers to do ad re-targeting

\- Have Google Analytics on their websites to track where people are visiting their website from, i.e. a click on a Google AdWords ad

While these are all not _ideal_ because _yes_, Google and Facebook use this data for their own purposes as well, it's far from _nefarious_. In fact, it's pretty standard fare. Could Zoom go above and beyond and reject these tools? Yes, they could. Does anyone in practice? No.

If Zoom was selling metadata about their calls, leaking contents of their calls, or themselves served ads – then yes, I'd be concerned. But all indications point to them purchasing ads to further the growth of their business.

I think it is perfectly reasonable to seek guarantees around the usage of the above, more sensitive data (contents of video calls, metadata of video calls, etc.) but on the flip side to imply from their privacy policy that they are sending it to Facebook or that they are "in the advertising business" is jumping the gun a little bit.

<comment><USER3> > standard fare

Aka "common sense" aka "anything that will fit within the Overton window"

Not to be confused with "decent, moral behavior"

<comment><USER4> I suppose, but why would you single out Zoom and expect them to act more decent and morally than any other company? Is there any reason you would expect this?

<comment><USER5> Calling out the biggest players is fine. They have the most resources to roll their own or at least shop around, should they value their users privacy.

</comment></comment></comment></comment><comment><USER6> I just downloaded Zoom for Mac, saw that it was a .pkg file. Great, I can see what files it installs before I install it.

I open the .pkg, click Continue so it can run its script, then a second later Installer quits and the app launches. What?!

Turns out, Zoom installs the entire app in the 'preinstall' script of the installer package! Inside there's a copy of '7z', and the app is extracted with that. The preinstall script is littered with typos and poor grammar.

I'm not one of those people who thinks that Apple is going to force all Mac software to come through the App Store, but when I see stuff this stupid...I start to wonder.

<comment><USER7> While I also dislike this type of thing, remember that Zoom's business is built on getting people into calls as quickly as possible. Seconds matter.

So I can totally understand why they would want to use 7zip to shave kilobytes off the download size.

<comment><USER8> 7zip isn't the complaint, it's that the installer installs the app before the user OKs it.

Honestly zoom is something that I would never let near a personal computer. What really surprised me is that there's a "zoomgov." (a friend at a defense contractor showed me) Either our government is enjoying the benefits of being able to force companies to be audited because of defense budgets or things have become way more relaxed than they should be. Judging by our "stockpiles" and inability to get critical equipment I'm guessing the second one.

<comment><USER7> > 7zip isn't the complaint, it's that the installer installs the app before > the user OKs it.

...I was about to write a reply saying "well in that case I don't understand what the GP is complaining about", but then I opened up the installer again.

I didn't fully take in what the parent was saying. Zoom is completely short- circuiting the normal macOS package install flow. You click continue once to acknowledge that "this package will run a program to determine if the software can be installed", and then Zoom is suddenly installed and the installer exits.

I can understand why they did it, but it's not good.

Although, Apple deserves some blame here. Firstly because their non-app-store software install flow has been screwed up since the release of Lion, and secondly because why can't you use Installer's "Show Files" option before the preinstall step?

<comment><USER9> I'm not a MacOS user, but I'm having a really hard time getting my head around this:

1\. You download an installer.

2\. You activate that installer.

3\. Your system tells you that the installer can run some code.

4\. You agree to the installer running some code.

5\. The installer installs some software, via the code that you said the installer could run.

Seems perfectly acceptable to me. If you literally cannot open up the archive file to inspect its contents without running some code inside it, that's not Zoom's problem. It's just a really stupid decision on the part of Apple.

<comment><USER7> > Your system tells you that the installer can run some code.

The message reads "this package will run a program _to determine if the software can be installed_". Old iWork updates used this to see you had a previous version of iWork on your computer. nVidia's Web Drivers used it to check if your Mac had an nVidia card. No other macOS pkg that I'm aware of makes actual changes made to your system during this step. That's not what the user agreed to.

Behind the consent message is a grayed-out "next" button that you never get to click.

I suppose this system was ripe for abuse, but that doesn't excuse the people who abuse it.

</comment></comment></comment></comment></comment></comment><comment><USER10> I have a need for Zoom, virus or no, but the point of the article is why I don't give them money. Give them money, while the company is apparently still going to worry about milking advertising dollars out of me? That's just going to be a strong "no". As the final paragraph of TFA says, either charge more or give away less for free. But if you're selling me out to advertisers after I've given you money, then you're one of "those" companies that I avoid if at all possible. Because they're skeezy. You don't want to appear skeezy, do you, Zoom?

So for now Skype and MS Teams works fine, or at least fine enough that I don't bother with Zoom. Which brings me to a side question: what _is_ the value proposition for Zoom? What does their product do so much better than the others that I'd put up with this shit? Why am I hearing the hell out of it lately? Outstanding PR department?

EDIT: thanks for your answers to "why use it, then?" Because "it just works" seems to be the summary, which hoo boy, one cannot say about a lot of the competition.

<comment><USER11> > What does their product do so much better than the others that I'd put up > with this shit?

I'll share my perspective as an academic. Many of us have adopted Zoom, practically overnight, for our teaching, for one-on-one meetings with students, and even for conferences [1].

The answer is: _It just works_. It's easy. It does what we want it to, with a minimum of fuss.

As someone who now has a whole bunch of unanticipated shit to deal with, this is one less thing to worry about.

I definitely share your objection in principle. If this situation continues long into the future (a terrifying thought), then perhaps I'll revisit my choice of software. But in the short term, to be honest, I don't much care.

[1] [https://www.daniellitt.com/agonize/](https://www.daniellitt.com/agonize/)

<comment><USER12> > The answer is: It just works.

I've actually found the opposite to be true. Google Meet is an example of a product that just works. Zoom, by contrast, pushes you very heavily into downloading and installing an application on every device you want to use it with, and provides a secondary degraded experience in the browser if you find the right link to use it (which you have to do EVERY SINGLE TIME; there doesn't seem to be a way to permanently opt out of the "install this application" nag flow).

<comment><USER13> For _many people_ , the criteria by which to judge VC software might be quality of audio and video, ability to deal with low bandwidth, and the ability to run a functional meeting with it. In fact, for _many people_ , while installing an application might be a one-time pain, if it offers better service in some way, it's probably seen as a benefit, not a drawback.

We have Hangouts Meet free at work, available for every single meeting with a single click. Zoom is also quietly available, but we're disincentivized to use it, because the company has to pay extra. We have to jump through hoops to get access. Yet since the COVID WFH revolution, Zoom is becoming more and more widespread. Because, as a VC solution, it just works, and works noticeably better than Hangouts Meet.

<comment><USER14> I can vouch for this. Organizations are adopting left and right - both in the healthcare and food industry. Why is zoom getting more traction than google hangouts ever had?

</comment></comment></comment></comment></comment><comment><USER15> > As quarantined millions gather virtually on conferencing platforms, the best > of those, Zoom, is doing very well.

Why would Zoom care about their privacy issues if they're doing so well off? Seems like that's a good amount of positive reinforcement that their current approach is the right one to them. Maybe they'll lose a few thousand customers because of it, but given what I'm sure was a huge increase in the past few weeks, why would it be something they're concerned about?

<comment><USER16> The reason Zoom is doing so well is part of its vulnerability. There is very little vendor lock-in with virtual conferencing platforms. If something new/better comes out next month, there isn't much a company will give up by switching vendors. There is little to no infrastructure to setup/maintain. This is the same reason Slack's popularity has skyrocketed. Because of the lack of history and transient nature of the content shared in them, these areas are quick to gain popularity, but also quick to be replaced when a better product emerges.

<comment><USER17> > This is the same reason Slack's popularity has skyrocketed. Because of the > lack of history <snip>

Slack's business model [1] is storing all history and charging for access for it. Nothing transient about that.

[1] [https://en.wikipedia.org/wiki/Slack_(software)#Business_mode...](https://en.wikipedia.org/wiki/Slack_\(software\)#Business_model)

<comment><USER18> Is it common to want to keep all that history? My understanding was it's best practice to delete chats after a certain period to limit the surface area of any potential legal discovery.

<comment><USER19> For a lot of industries, deleting internal communication is illegal. For any publicly traded company in the US, all internal communication needs to be archived for five years.

<comment><USER20> Do you have a source for this? I couldn't find anything regarding the 5 year time frame. I did find [0] which references a few different retention periods, especially at 7 years.

[0] [https://www.intradyn.com/email-retention- laws/](https://www.intradyn.com/email-retention-laws/)

<comment><USER16> It's part of SOX. It actually requires the data be unencrypted, immutable, and available offline. Most corporations (large and small) do not follow this for email, messaging, wikis and many other services.

</comment></comment></comment></comment></comment></comment></comment><comment><USER21> Honest question [not trying to act controversial], especially with all the US- China spat.

Zoom's engineering team is based in China - the product is primarily built out of there. [1]

What guarantee is there that the CCP is not intercepting/backdooring all video communications? Especially in current situations, where so much sensitive information is being discussed via Zoom?

[1] [https://www.cnbc.com/2019/03/26/zoom-key-profit-driver- ahead...](https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead-of-ipo- engineers-in-china.html)

<comment><USER22> I've said this time and again only to get downvotes since there is no proof or substantiation about the CCP surveillance claims. But, it is an important to keep in mind. There are things that I cannot say due to our employment contract and NDA, but to say the least, we are looking into this matter.

Surveillance prospects, doesn't matter where they originate - US or China or Country X - need to be discussed and examined. But apparently, saying anything against China on HN is an automatic ban for creating a flame war. We've become too soft. Obviously personal attacks and racism is not tolerable. But, I would personally (some may disagree) say that we should also criticize bad parts of culture too...that's for another day or a different forum.

Can we just get past the my country your country bullshit on HN and talk about privacy implications especially from the world's largest surveillance network? It is one thing to be spied upon for advertisement tracking, an entirely another to be spied upon by a brutal authoritarian government. Fearlessly criticizing CCP or the NSA, or Israeli intelligence agency or whatever... should be one of the most important things to talk about on "Hacker" news forum.

I am gonna fire off some anon emails to WSJ/NYTimes/WaPo/Guardian to create some awareness and perhaps they can dig further into Chinese influence in using Zoom. I am deeply concerned. The entire world has given up video/audio/screen/application privacy in a snap... for the data might be stored in Tianjin datacenter, needless to say whose keys are in the hands of CCP - I guarantee that but cannot provide proof.

Edit: past comments that were downvoted (and flagged): [https://news.ycombinator.com/item?id=22657794](https://news.ycombinator.com/item?id=22657794)

[https://news.ycombinator.com/item?id=22684767](https://news.ycombinator.com/item?id=22684767)

[https://news.ycombinator.com/item?id=22663295](https://news.ycombinator.com/item?id=22663295)

[https://news.ycombinator.com/item?id=22705960](https://news.ycombinator.com/item?id=22705960)

<comment><USER23> I made a comment a few weeks ago criticizing the Chinese government[1]. No flame war came of it, it wasn't flagged, downvoted to oblivion, or result in an "automatic ban." I'm not sure what you're saying to cause those things to happen, but it doesn't seem to be what you think it is.

[1] [https://news.ycombinator.com/item?id=22490791](https://news.ycombinator.com/item?id=22490791)

<comment><USER22> I am glad to hear. My perception is based on entire posts (not just comments) that were flagged due to extreme polarization of views. I can't find the thread but most comments that were anti-China were downvoted/flagged in that thread. I just have a general feeling, but I am glad to see your concerned voiced.

<comment><USER24> It's possibly just perception, but a week or so ago there seemed to be a mass of China versus US bickering and trolling, then the threads were all deleted. It was really grim. Dang seemed to be moderating it then presumably had to resort to killing the lot. Whoever they are, they do a great job.

<comment><USER22> I think it is probably a perception thing or may be not. Here is my opinion.

Dang is doing his job and it is tough. He is keeping this place sound and clean. Dang - nothing against you but I see some double standards for e.g. criticizing CCP has far more weight than criticizing western governments. No one gets offended for criticizing the UK Govt or the German Govt or the even the Indian Govt - but when it comes to criticizing the Chinese Govt... we can't do that, it is a flame war. If people get offended, so be it. If someone from China or of Chinese ethnicity is reading this criticism and doesn't like it...well, tough luck. The onus is on the person getting offended, not the offender.

This double standard needs to end (or as I see it through my own lens). Infact, we should be criticizing the CCP _even more so_ than democratic governments.

<comment><USER25> You guys need to let me know that you have questions like this, assuming you want an answer. I don't have a mind reader (or even a software alert).

People get moderated here for posting flamebait about western countries and governments all the time. I'd be careful about that feeling that there's a double standard. It's a natural artifact of the well-known cognitive biases that affect these perceptions. You (i.e. everybody) are far more likely to notice, and to weight more strongly, the cases of moderation that you dislike or disagree with. That gives you a generalized image of what goes on here. But that image is just an inverse reflection of your own views. It's not based on the data as a whole. People with opposite views have the opposite image. To take the current topic, for example, they say that HN has an extremely anti- China bias, any comments that try to defend China or Chinese people instantly get downvoted, the mods are in on the racism, and so on. They have the opposite image to yours, but they have it for the same reason you do: they feel very strongly about the issue, and so when they run across instances in the data stream that touch (i.e. hurt) those feelings, it makes a strong impression. Those strong impressions accrue into an image of bias. But the data stream has more than enough data points to make every such impression. That's simply what you get at scale.

More explanation and links in this recent comment: [https://news.ycombinator.com/item?id=22723626](https://news.ycombinator.com/item?id=22723626)

</comment></comment></comment></comment></comment></comment></comment><comment><USER26> One major problem for Zoom is that it cannot merely focus on its core video conferencing competency while achieving the growth objectives of a publicly traded company. A high-quality video conferencing platform is hard to replicate until it isn't. The amount of talent and energy being spent right now on video conferencing, as a result of remote work, is going to amount to commoditization of high-quality video conferencing. Zoom has maybe another 12 months of juice left. As a result, it's advancing into new categories and will compete with customers very soon.

I'd be very cautious about sharing information with Zoom. You may be showing it where to fish.

<comment><USER27> How hard can it possibly be to replicate? Zoom walked into a market packed with established players and now they own the whole thing. That suggests the barriers to entry aren't so great.

<comment><USER28> Own the whole thing? While I used zoom at my last job, I don't at my current one.

What does zoom do that something like Google Hangouts or Slack doesn't?

<comment><USER29> In my experience it has better reliability and quality, to the point where I haven't had to worry about it.

</comment></comment></comment></comment><comment><USER30> The paid version has a feature where the organization admins can listen and watch in conversations without anybody noticing or giving consent. I am quite sure that doing so would be illegal where I live (Germany).

<comment><USER31> Unless you gave "consent" in your employment contract, or agreement to the companies employee handbook, AUP or similar documentation. This sort of "agreement to monitoring" is common in a lot of corporations today.

Please don't use your company issued hardware/software/network for something not-work related ... and something you wouldn't feel comfortable sharing with most of your colleagues. There is already a plethora of monitoring going on out there.

<comment><USER32> Not a lawyer, but being a Washington resident (see WA wiretapping laws) interviewing over Zoom (thus not working for that company and no having signed any forms/NDAs/waivers) I'm pretty sure someone snooping in or recording the interview without my consent is illegal.

</comment></comment></comment><comment><USER33> I've found Jitsi to be more than adequate with no need to download an app onto my computer. Just share the link with my friends!

<comment><USER34> > _I've found Jitsi to be more than adequate_

Just looked it up. Seems to be Chrome only. As a Safari and Firefox user, that ends my decision-making tree with two clicks.

<comment><USER35> They are working on it: [https://github.com/jitsi/jitsi- meet/issues/4758](https://github.com/jitsi/jitsi-meet/issues/4758). Unfortunately, I think WebRTC support is still not 100% uniform across browsers (there seem to be a range of browser-specific behaviour and bugs), making it hard to easily support all browsers. And Chrome appears to be the browser which implements new WebRTC features the fastest, so I can understand Jitsi Meet focusing their efforts on that platform.

You don't need chrome though, chromium should be enough.

</comment></comment></comment><comment><USER36> Yeah I hate ZOOM sooo much.

First there was the issue with them turning on the camera by default. At least you could turn that off. Then there was the spyware they installed on every Mac without even asking for consent. And now this...

Since the spyware thing I refuse to install their crap on my machine, but one of our suppliers still uses it and the web client is very choppy.. But they'll just have to put up with it. I'm never installing it again.

<comment><USER15> I also find their UI to be frustrating, especially the chat part of it. I have yet to find a way to make the chat more dense, every message seems to have an excess of white space. Also, at least with the company that I use it with, there's no obvious way to search message history.

<comment><USER37> Agreed. I find the whole experience to be horrible. Especially having to install some garbage executable rather than using my browser. It does nothing for me that Google Meet doesn't do better.

</comment></comment></comment><comment><USER38> I get that privacy is important but this company has become a household name over night. My mom literally just installed Zoom because her friends were talking about it (eyeroll). The company has obviously helped the global economy work remotely and keep productivity moving over the past few months. First, thank you to Zoom for making a great product and continue to work under ridiculous load. Secondly, I agree that privacy is an issue but can we tone it down a bit considering the global situation at stake.

What am I missing? I'm asking humbly. Because it seems like we are complaining about the food at a homeless shelter?

<comment><USER39> At what time would it be acceptable to critique Zoom's surveillance practices, in your view? We're not allowed to complain when a useful tool also spies on us?

<comment><USER38> Not criticizing the timing. Criticizing the tone. My rule in life is politely ask first, if no response then by all means, bring the wrath. Does anyone know if they've ignored the concern?

Everybody assumes every company is a villain these days. Maybe this was an overlooking and they'll happily fix? Anybody ever think of that?

<comment><USER40> > Does anyone know if they've ignored the concern?

Well yes, an example is their reaction on their Zero Day:

[https://medium.com/bugbountywriteup/zoom-zero- day-4-million-...](https://medium.com/bugbountywriteup/zoom-zero- day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website- ac75c83f4ef5)

> Ultimately, Zoom failed at quickly confirming that the reported > vulnerability actually existed and they failed at having a fix to the issue > delivered to customers in a timely manner. An organization of this profile > and with such a large user base should have been more proactive in > protecting their users from attack.

</comment></comment></comment></comment><comment><USER41> One thing I've noticed about it which rubs me the wrong way is that, on Linux, when I exit the application it keeps running in the background. There's no reason that it advertises why this should be necessary, and I don't see any option to disable it. I shouldn't have to manually kill the process to exit a program.

<comment><USER42> I agree this is annoying, but you can always Exit the program from the icon in the menubar (works for me on both GNOME and xfce).

</comment></comment><comment><USER43> I thought this was going to be about their hilarious CSP, which whitelists the following domains:

        'unsafe-eval'
        'unsafe-inline'
        blob:
        https://*.50million.club
        https://*.adroll.com
        https://*.cloudfront.net
        https://*.google.com
        https://*.hotjar.com
        https://*.zoom.us
        https://*.zoomus.cn
        https://*.zopim.com
        https://ad.lkqd.net
        https://ajax.aspnetcdn.com
        https://apiurl.org
        https://appsforoffice.microsoft.com
        https://assets.zendesk.com
        https://bat.bing.com
        https://cdn.5bong.com
        https://cdn.jsdelivr.net
        https://cdncache-a.akamaihd.net
        https://code.jquery.com
        https://connect.facebook.net
        https://consent.trustarc.com
        https://extnetcool.com
        https://fp166.digitaloptout.com
        https://googleads.g.doubleclick.net
        https://intljs.rmtag.com
        https://pi.pardot.com
        https://px.ads.linkedin.com
        https://ruanshi2.8686c.com
        https://rum-static.pingdom.net
        https://s.dcbap.com
        https://s.yimg.com
        https://s.ytimg.com
        https://s3.amazonaws.com
        https://scout-cdn.salesloft.com
        https://sealserver.trustwave.com
        https://secure-cdn.mplxtms.com
        https://secure.myshopcouponmac.com
        https://snap.licdn.com
        https://sp.analytics.yahoo.com
        https://srvvtrk.com
        https://static.zdassets.com
        https://static2.sharepointonline.com
        https://tag.demandbase.com
        https://tpc.googlesyndication.com
        https://tracking.g2crowd.com
        https://translate.googleapis.com
        https://trk.techtarget.com
        https://unpkg.com
        https://www.comeet.co
        https://www.dropbox.com
        https://www.google-analytics.com
        https://www.googleadservices.com
        https://www.googletagmanager.com
        https://www.gstatic.com
        https://www.youtube.com
        https://d.adroll.mgr.consensu.org
        https://serve2.cheqzone.com
        https://static.ada.support
        'self'

via: [https://twitter.com/jasvir/status/1242518507683639296](https://twitter.com/jasvir/status/1242518507683639296)

<comment><USER44> Yes unpkg and s3, anyone can get content up on them.

</comment></comment><comment><USER45> Zoom have had several controversies with its privacy now and still going strong . Great staying power like Facebook.

The product must be really good. I have never used them more than in couple occasions and found it like any other web conferencing tool in my opinion.

<comment><USER46> Truth is, it has the best video quality I've seen out of any of the video conferencing tools out there by a mile. Only Facetime comes close and it's limited to apple hardware and has more limited screen collaboration tools.

As a result, they're going to have staying power.

<comment><USER47> Maybe I'm biased but video quality doesn't really bother me nearly as much as audio quality, and Zoom kinda sucks there. Part of it is the codec, but their AEC is so godawful we have to force everyone on calls to use headphones.

Video quality is really only necessary when screen sharing, and zoom does OK there.

<comment><USER48> > AEC

I haven't heard this abbreviation before but I assume it means Audio Echoing Cancellation.

<comment><USER47> Usually Acoustic Echo Cancellation but yes. When it's good you don't notice it (several commercial audio installation products do a great job at it) but when it's bad it's _really_ bad. I'm not sure if Zoom even bothers.

</comment></comment></comment></comment></comment><comment><USER49> Did you know they also make a public address book in your entire organization of people on zoom? You can't easily opt out of this. I'm currently contracted at a govt organization which other than mundane conference calls you have to reserve a spot for by email (which nobody does because it's not 1998) doesn't have any remote video/audio infrastructure so basically each team is doing their own thing. Some use zoom, others discord and so forth. A lot of teams started to use zoom and they sign up with their @xyz.gov e-mail. Literally everyone is then public to everyone on @xyz.gov and whether they're currently in a call.

Everyone is still on the free plan and reconnecting after 40 minutes (it's basically standard procedure when the 10 minute countdown starts to rejoin). I bet it won't take long before zoom sales get in touch and you think the person going to approve the tailor-made $$$ contract cares about privacy? Or the 700 people already using it except for a small minority who don't have any influence in this kind of decision making?

</comment><comment><USER50> Is Zoom-dissing just in fashion these days? In the last few days I've seen these on HN:

\- Having the Facebook SDK installed in their iOS app, which sends user data to Facebook even if the user has no Facebook account

\- Having a setting, that's off by default, that lets other callers see whether you have the Zoom app in focus

\- Having a general "accessibility over security" engineering attitude, which led them to eg shipping their desktop apps with a builtin HTTP server (and with it a much bigger security surface area), just to skip one extra step in the join-meeting-via-a-zoom-link-flow. They removed it after a backlash, but the engineering attitude probably didn't change.

Now, I agree that all of these are bad. It's OK for outrage to happen over these things, every single one of them are shit and major companies like Zoom need to get their act together.

But I also think that _many_ apps out there do stuff like this. The majority of popular apps, I'd wager. Why is Zoom being singled out? First Vice, now a Harvard blog, a _bunch_ of unsubstantiated tweet storms.. Is it just, en vogue to diss Zoom somehow?

<comment><USER51> > _Why is Zoom being singled out?_

There is no conspiracy here, calm down. Zoom is popular, therefore people talk about it.

</comment></comment><comment><USER52> Is Zoom the best though? Google Hangouts seems to be just as good.

<comment><USER53> Try it at 12 people.

Try it when you want to control who is speaking and when.

Try it when you want to co-ordinate hundreds of participants and still want to track who has a question so you can hand the virtual mic / airtime to them.

Try it when you want breakout groups and to determine who is in which group, and after a set time for the groups to return to the main space.

What is good enough for 2 people facing each other, and appears to work perfectly well for a group of 5 or 6... doesn't quite scale to a company all- hands, or giving a lecture or seminar.

Tools fit a scale, and Zoom is excessive for the small and simple use-case but excels at the large and complex.

<comment><USER4> Which is a long way of saying that Zoom is one the few companies that has been around long enough to deal with all the edge cases. Throw a few devs in a room for a bit and you'll get a perfectly usable video chat for 1-1 or a small group, but you won't get Zoom.

<comment><USER7> Wikipedia says Zoom was founded in 2011. Google Hangouts has been around for about the same amount of time, and Skype predates them by quite a bit.

I don't quite understand why Hangouts and Skype aren't more robust than they are. I'm sure this is indeed a hard problem, but the utility of getting it right is obvious, and these are massive companies.

</comment></comment></comment></comment><comment><USER54> I am always very hesitant to say anything personal over any video chat medium unless I know it's end to end encrypted. I know that they're not actively watching my video meetings, but it's still causing a chilling effect in how I conduct myself with their service.

<comment><USER55> Zoom works in China, ergo it is being recorded and analyzed. Automatic voice transcription is a thing.

<comment><USER56> I just realized this yesterday when Zooming with someone in China w/o a VPN.

<comment><USER55> And here it is:

[https://citizenlab.ca/2020/04/move-fast-roll-your-own- crypto...](https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a- quick-look-at-the-confidentiality-of-zoom-meetings/)

</comment></comment></comment></comment><comment><USER57> Clearly they don't "need" to do a thing. They were already gaining a ton of market share before COVID19, and this has only cemented their position.

The people who are concerned about privacy aren't really the ones writing them big checks anyway.

</comment><comment><USER58> Title is sort of incorrect: "Zoom needs to clean up its privacy act" should be "Zoom needs not to do stupid shit"...

I'm a fan of the product but this is ridiculous behavior (great Linux support). I have a hard time imagining the product meeting in which "Yes. That's a good idea. Let's do it." was said. I get that FB is big, that Zoom wants the credibility, etc but that's a sign that management is not thinking clearly about their product and should be a red flag to any investor (among the many green flags from current demand)...

<comment><USER59> You realize investors are laughing their way to the bank because of the ease of use focus of zoom? The investors in the fully encrypted privacy based video conferencing platforms (yes, they exist) are broke now.

</comment></comment><comment><USER60> Use case: Mediation

Zoom is the only easy to use videoconferencing tool I have found that can do breakout rooms. Mediation is, by law, a confidential process.

From the ConsumerReports article: "Videos aren't off-limits, according to the document, and neither are transcripts that can be generated automatically, the documents you share on your screen, or the names of everyone on a call."

In recommending that my clients use Zoom, am I violating my ethical and legal requirements? Is Zoom breaking the law?

</comment><comment><USER61> I think people are missing the fact that ZOOM doesn't actually clean up its act. It has lots to profit from selling user data.

</comment><comment><USER62> Note also at least the unwanted/unnecessary facebook connection: [https://www.vice.com/en_us/article/k7e599/zoom-ios-app- sends...](https://www.vice.com/en_us/article/k7e599/zoom-ios-app-sends-data- to-facebook-even-if-you-dont-have-a-facebook-account)

</comment><comment><USER63> I am using zoom for school with 300 students and it works great. My professors who are not tech savvy were able to use it without problem. Zoom makes recording, screen sharing and chatting much easier than other softwares. Also, I like how easy it is to call in.

Also, at my work we use zoom for everything. It is a powerful software that we love.

</comment><comment><USER64> We have been using Zoom four 4 years now. And it has simplified conferences enormously. Sometimes a few of our customers insist on using their own corporate mandated systems. Half of these times there is a struggle to get the meeting going for one reason or the other. We offer to set up a zoom call and, quite literally, the call is back on track within 2 minutes. Regardless of which country the user is in, the device being used, or any other parameter which somehow seems to trip up all the other systems regularly.

I have used Skype, webex, hangout meet, gotomeeting, various other entirely web based ones and none come close to the reliability that Zoom provides. No wonder it's getting adopted like crazy.

Kudos to them for handling this traffic with absolutely no visible hiccups.

</comment><comment><USER65> Zoom should really come out with a public statement (does one exist?). They've been called out a number of times over the past week or few and I think it would be wise for them to clear up any misconceptions (or hide in a turtle shell if they are clearly screwed either way)

</comment><comment><USER66> It's a necessary evil for many of us students. Institutions just aren't willing to deal with compatibility/pricing issues with such short notice. Zoom found its niche as a bootstrap crisis averter, I guess

</comment><comment><USER67> This post inspired me to actually try out Jitsi but was put off by their request for access to my Youtube profile when the prompt was "connect your google calendar". WTF?

Anyone know what that permission is even about?

</comment><comment><USER68> Do Zoom have their own infrastructure or do they run on aws/azure/gcloud?

I think it's amazing how zoom became so popular recently. It's even been approved to be used for Passover Seder dinner by some Rabbis :)

It also very popular in academia and reminds me of Dropbox. When I was a student everyone around me used Dropbox. They developed a great product which competes with Google and other giants. But those were all unpaid users and eventually Dropbox moved their focus to Enterprise. Zoom will soon be in a similar situation.

<comment><USER69> I had the same question... It looks like they use AWS, though this paper I found is dated May 2013...

[https://d24cgw3uvb9a9h.cloudfront.net/static/40580/doc/Zoom-...](https://d24cgw3uvb9a9h.cloudfront.net/static/40580/doc/Zoom- Security-White-Paper.pdf)

</comment></comment><comment><USER70> "the best of those, Zoom, is doing very well"

Is Zoom really the best? No other comparable platform out there?

Anyone know how difficult it would be to build something like it on top of aws or a similar cloud?

<comment><USER71> Web RTC pretty much handles peer to peer video chat. I think you just need a server to organize the call's, provide chat, and login from

<comment><USER72> Peer 2 peer doesn't scale for video conferencing with many users. Jitsi only does it for two participants. Everything larger has to go through the server.

<comment><USER38> Why doesn't it scale? Because for n participants, each would need n-1 connections?

<comment><USER72> Each client has to send n-1 streams and domestic connections usually have quite weak uplink.

<comment><USER73> ISTM there could be some opportunities here? First, not everyone is talking at once (else this is a riot rather than a conference), so many of the uplinks could be "nothing new" packets for much of the time. Second, if any participant(s) (even a dummy participant) has faster uplink, that/those client(s) could forward to the rest of the group, in a fashion somewhat analogous to torrent.

<comment><USER71> You could also do leader election and make that one leader be the sink. Then broadcast to everyone else. However, I'm gonna keep my trap shut because I don't want to get downvoted by this elite squad of video professionals.

</comment></comment></comment></comment></comment></comment></comment><comment><USER74> Can someone explain the advantages of Zoom over a FOSS solution lake Jitsi Meet? [https://meet.jit.si/](https://meet.jit.si/)

<comment><USER75> Institutional buy-in and support. When your 40,000 student university's administration declares "we are using Zoom for online classes and it's been integrated into our class management system by IT", it just gets used.

And that university chooses to use Zoom over another solution for many reason - after-sales support, SLAs for performance and availability, pre-written API integrations for their CMS and student ID system, guarantees from their sales team about regulatory compliance, and the like.

</comment></comment><comment><USER76> I've been using zoom for more than a three years now, and I want to know if Zoom is providing transcripts of private 1 on 1 conversations to the room owner.

Just to clarify - the zoom room is not mine. We are using it across a group of like 10, for a group meetings - sometimes all of us, sometimes subgroups, sometimes one on one.

I can not imagine a world where a company would do that, but given the recent events, I am not ruling out this level of creepines.

Zoom?

</comment><comment><USER77> K-12 education uses zoom because it's HIPAA and FERPA compliant. My understanding is that Skype and Hangouts aren't.

</comment><comment><USER78> The case of #poorjennifer calls for major concerns. Every woman should feel safe using Zoom for work, never worry about privacy violation, such as manager videotaping her without her consent, then saving recordings in zoom cloud without her knowledge. Zoom videotaping goes against Privacy Law in California. Consent is diligently required.

</comment><comment><USER79> > Zoom has an extremely valuable service, which it performs very well—better > than anybody else, apparently.

Objection - best advertised (or should I say "best" advertised) doesn't equal best. I'd be truly surprised if somebody actually presented convincing arguments that Zoom service is better than anybody else.

</comment><comment><USER80> I experienced the switch from Webex to Zoom in a corporate office environment and being able to see your meeting on the iPad and clicking start is a huge win. And if you're in any room you can just connect because it knows where you are.

Webex addresses are stupid by comparison.

I don't like this Facebook crap but otherwise Zoom is pretty slick.

</comment><comment><USER81> Probably ninja'd, but it looks like Zoom cleared this up:

[https://www.vice.com/en_au/article/z3b745/zoom-removes- code-...](https://www.vice.com/en_au/article/z3b745/zoom-removes-code-that- sends-data-to-facebook)

</comment><comment><USER82> I am very curious about Zoom's desktop version as I have seen it used for sensitive telemedicine sessions between doctors and court ordered patients. I think Facebook's response was disgraceful, putting the onus and blame on the developer after FB developed a plug-in which is no different than malware.

</comment><comment><USER83> If anybody else is wondering about alternatives, DHH sourced some ethical options in this Twitter thread: [https://twitter.com/dhh/status/1243248363979419649?s=21](https://twitter.com/dhh/status/1243248363979419649?s=21)

Of those, I tried whereby.com yesterday and was blown away. It just works with zero downloads in any browser, including mobile, and is very high quality. From my brief usage, I highly recommend it for small teams.

</comment><comment><USER84> If your answer to a privacy concern is "use a Google product" you may not quite understand Google's business model.

Zoom is as good as video can be in 2020. Google may be on parity, but tools like WebX are laughably inferior.

</comment><comment><USER85> _Zoom Removes Code That Sends Data to Facebook_ : [https://news.ycombinator.com/item?id=22708233](https://news.ycombinator.com/item?id=22708233)

</comment><comment><USER86> Where did Zoom suddenly come from? I never even heard of it until this quarantine stuff, then all of the sudden everyone is talking about videochat on Zoom.

It's like WTF, another contender for this throne? Sigh.

</comment><comment><USER87> Are there any advantages to Zoom over Jitsi Meet? For most people's use case (a small group of family friends) the simplicity and quality of the Jitsi Meet setup is incredible.

</comment><comment><USER88> As it's beginning to look like my days as a Zoom refusenik are numbered, what is the safest way to use it? Android, iOS, Chomebook, some form of virtualization or container?

<comment><USER37> I run it, along with other sketchy garbage proprietary software for wook, in a QEMU VM. Or I just dial in and let people suffer through me being on a phone connection owing to their choice of software.

</comment></comment><comment><USER89> I don't know if it can. Its always bound by its government. By that measure I am really surprised people in large companies trust it. I really am surprised by its adoption.

</comment><comment><USER90> Does any one have any knowledge at how Zoom is architected? I know they own some datacenters, but so does Microsoft, which has a worse service than Zoom.

<comment><USER35> An overview is given in their blog post: [https://blog.zoom.us/wordpress/2019/06/26/zoom-can- provide-i...](https://blog.zoom.us/wordpress/2019/06/26/zoom-can-provide- increase-industry-leading-video-capacity/)

However, I would also like to know if there's more to it. Do they do any server side transcoding? Do they get an advantage by having multiple backend servers connected through good links, having clients connected to the nearest one and routing efficiently through their network? It appears that they use(d) H264 as their codec, are there some technical tricks they use to cope with variable bandwidth (do they use scalable video coding or simulcast)?

</comment></comment><comment><USER91> For a piece of software that initially made claims to having encryption and privacy concerns, yes, yes they do.

</comment><comment><USER92> Not just Zoom, basically every company.

</comment><comment><USER93> Wow, hackernews is a cesspool of self-serving "intellectuals". We're in the middle of a pandemic, which already killed 27 thousands people. And the #1 post is privacy act? Can't you guys admit that you didn't come up with video calling company worth 37 Billion dollars. Maybe it's worth talking the positive impact on Zoom during this crisis.

<comment><USER94> "This company is doing incredibly shady things and exploiting its sudden boost in popularity, so you guys shouldn't criticise it, because it's made soooo much money and you didn't and it's therefore above criticism "

That's how your comment reads. The fact that it's worth so much is almost completely irrelevant, and if anything, should mean they have more responsibility to do the right thing.

<comment><USER93> It's a matter priority.

If it's a real problem, go sue them. Do you need a Havard op ed to tell you?

</comment></comment></comment><comment><USER95> Coincidentally NextDNS blocked my use of the Harvard site for bad ad tracking. Hmmm.

</comment><comment><USER96> Too little, too late. Corporations cannot be trusted with software.

</comment><comment><USER97> Of all things, lack of trust and transparency from a video platform is pretty scary. Hard to justify using Zoom any longer. Lifesize is a good alternative that a lot of people don't know about (I have no stake in them, but have used it before).

</comment><comment><USER98> I have the feeling that outside of the HN community and other tech communities, most people just don't care about this, which is sad.

</comment><comment><USER99> Where is the Zoom CEO in this thread?

</comment><comment><USER100> broken link?

<comment><USER101> [http://webcache.googleusercontent.com/search?q=cache:RxLbT_L...](http://webcache.googleusercontent.com/search?q=cache:RxLbT_LzyRMJ:https://blogs.harvard.edu/doc/2020/03/27/zoom/&hl=en&gl=ca&strip=1&vwsrc=0)

</comment></comment><comment><USER102> It works really well.

One that has been a total game changer for my company is when I'm hosting a conference call, I can simply "Invite by Phone" my participants. They get a phone call, are prompted to "Press 1 to enter the conference", and boom they're in. It's drastically reduced people fumbling around with phone numbers + participant codes, ending up in the wrong meeting, or getting stuck in some unnecessary software install loop. If someone is more than two minutes late, they're getting a phone call that brings them instantly into the meeting.

Also a really nice feature, again for phone conferences, is when people dial- in I see their phone number handle in the UI. But during the call as they introduce themselves or I look up their number, I can then rename their user to something recognizable. Now if I'm on a call with 5 people at another firm, I appear really impressive because I know who each person is by their name. When someone is speaking on the conference call, their icon lights up. If someone has a ton of background noise I can easily mute them.

Zoom Phone (addl paid feature) is awesome too. Virtual phone numbers, IVR, call routing, busy hours, I can instantly turn a 1:1 conversation into a zoom meeting that other people can join, etc. Zoom Phone works on my iphone like a regular dialer, and I can place/receive fully digital calls on it (pretty similar to how Google Voice works), so it doesn't matter if I have actual cell service.

I've never used Microsoft Teams, and does look really snazzy, but Zoom is an absolute joy to use compared to every single other conferencing software I have ever used. The video chat and screensharing is fast and responsive and just works exactly like you would expect it to.

<comment><USER103> > It works really well.

Does it?

Asking because I just left a zoom meeting with horrible sound quality and extremely bad video quality. Why would anyone prefer that to Teams is beyond me.

Edit: interesting this is _heavily_ downvoted. Can't a person have a bad experience and tell HN about it?

<comment><USER102> I have about a year of near daily anecdotal evidence to the contrary. So, in my experience, yes it works extremely well. I'm not saying it's better than Teams at all, I've never used that, and it looks pretty awesome from their marketing page. Microsoft has _really_ stepped up their software quality game recently.

I _can_ say Zoom is way the hell better than: Slack/Screenhero, TeamViewer, join.me, GoToMeeting, WebEx, Skype, Google Hangouts, BlueJeans, ugh the list goes on over the past years.

<comment><USER103> But your flawless experience does not help me.

I had a horrible meeting today (not the first time, but today was particularly bad).

In fact, I recorded part of it with my phone and tomorrow I Will have a chat with our IT people to ask people to avoid using zoom.

<comment><USER104> "I Will have a chat with our IT people to ask people to avoid using zoom." Foolish. What works better combining VTC and easy join phone calls? Surely not Teams. Was on a 400+ person Zoom call that went great. Problem is likely in your network.

<comment><USER103> out of curiosity, why not Teams?

<comment><USER105> For one, Teams doesn't include dial-in/dial-out, that's another $1.50 per month per line (still cheaper than Zoom if you have Office 365 already).

But another, more important one is: the last time we tried using Teams/S4B meetings, if you are contacting a client where they are in a different Office 365 tenant, and the security settings are turned up on their tenant to not allow logging in as a "guest" to other tenants, they can't join your meeting. (or at least, not without launching an incognito window and reopening the meeting link) Azure AD tries to login as their user account, fails because they aren't allowed, and leaves them on an error message screen without any way for the meeting host to troubleshoot. Zoom, since it's out of band of anything that IT usually touches (unless you turn on the "only allow people in my organization to join this meeting" function), won't have this issue since the outsider will automatically be offered the choice of logging into a Zoom account or just giving a name for this conversation (as far as I've seen).

It's one of those scenarios where Microsoft being so entrenched in the environment actually lessens productivity. You can argue that people shouldn't be blocked from joining outside meetings, or that shadow IT is evil and should never be encouraged, but when security steps in the way of productivity, shadow IT usually naturally results, as so many SaaS vendors (Zoom, Basecamp, Dropbox) rely upon. Zoom acts like malware (to a degree) by installing to user-only directories and working around corporate security to make it easier for the end user to use the product. At a big company, approval for a video conferencing system could take months of PoCs, vendor meetings, implementation, and so on. But if you can just say "Join my Zoom meeting! It takes a minute! It integrates with Outlook so we don't have to even go to another website! And it's cheap!", then all of the corporate BS is cut through, and by time IT finds out, half the company is using it and they'll start paying for it so the enterprise stuff works (i.e. SSO).

(Basecamp is another good example of this. It gets tons of adoption by running in a browser window and only costing $99 per month for unlimited users, so it fits on a manager's expense account and user onboarding is super simple from there. and it's really easy to use.)

<comment><USER59> This exactly.

What's really funny is if a VP says, we should start evaluating enterprise conferencing software, get's down the road with the webex and friends sales teams, and then everyone tells them to go home because it's too late when they finally have the roll-out meeting or the feedback meeting - everyone is using zoom already.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER106> harvard needs to pay their food service workers

</comment><comment><USER107> Think twice before using Zoom. They have a lot of engineers in China developing the core technology. You would be foolish to conduct meetings and share sensitive docs over zoom. Communist party is listening to everything.

[https://www.cnbc.com/2019/03/26/zoom-key-profit-driver- ahead...](https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead-of-ipo- engineers-in-china.html)

<comment><USER108> Zoom was developed in China

Look at the top of page 21 of their sec submission. [https://www.sec.gov/Archives/edgar/data/1585521/000119312519...](https://www.sec.gov/Archives/edgar/data/1585521/000119312519083351/d642624ds1.htm)

</comment></comment><comment><USER109> Zoom needs to fuck off. This is apologism. We need open source and decentralized solution and we need to shut up. I'm tired of this.

<comment><USER110> I've been using Jitsi Meet

[https://jitsi.org/jitsi-meet/](https://jitsi.org/jitsi-meet/)

<comment><USER109> Thx! Heard about it already. I'll do a personal analysis and I'll report.</comment></comment></comment>


Google Has Most of My Email Because It Has All of Yours - <AUTHOR> http://mako.cc/copyrighteous/google-has-most-of-my-email-because-it-has-all-of-yours?pk_campaign=Anuj+Adhiya

<comment><USER2> This has already been submitted with the canonical URL with very active discussion:

[https://news.ycombinator.com/item?id=7731022](https://news.ycombinator.com/item?id=7731022)</comment>


Test Pilot Admits the F-35 Can't Dogfight - <AUTHOR> https://warisboring.com/test-pilot-admits-the-f-35-can-t-dogfight-cdb9d11a875 <comment><USER2> previous: [https://news.ycombinator.com/item?id=9803043](https://news.ycombinator.com/item?id=9803043)

392 comments.

Somewhat debunked since:

[https://theaviationist.com/2016/03/01/heres-what-ive- learned...](https://theaviationist.com/2016/03/01/heres-what-ive-learned-so- far-dogfighting-in-the-f-35-a-jsf-pilot-first-hand-account/)

<comment><USER3> It's not really debunked.

F-35 is not really suitable for combat. Fighter jets are now mostly obsolete, but F-35 is just especially bad.

The stealth features of it dictate much of it's design, but they destroy it's usefulness as a fighter-bomber. Which means that it will never be suitable for a replacement for the A-10.

It vulnerable to IR tracking weapons, which it's stealth features do not address well. IR guided weapons have traditionally been the stuff that shoots down American combat aircaft.

In addition to this the F-35 cross section is not large enough for it's stealth technology to deal with VHF wavelength radar. B-2 bomber can deal with that stuff, but F-35 cannot. This means that American stealth fighters are easy to identify on radar... point a VHF radar at them and get a response and then point a XHF radar at them and get almost nothing. This means that for their stealth to be useful they have to do things like shadow civilian airliners or cargo planes to do any sort of infiltration.

The stealth is also a trade off between 'over the horizon' radar guided weapons and being sneaky. You cannot turn on your radar and detect other aircraft and expect to not be noticed by their radar. Which means that you have to depend on other aircraft or ground stations to coordinate, which means that if you want to use stealth and detect other military aircraft you are going to have to operate in airspace already 'owned' by you.

I expect that F-35 will never be allowed to operate in combat because of these issues and others except in areas were you are only dealing with very technologically limited opponents.

</comment></comment><comment><USER4> For some reason I'd like to share this base64 data: URI. I think it might be a URL to a certain PDF.

data:text/plain;base64,aHR0cDovL2F2aWF0aW9ud2Vlay5jb20vc2l0ZS1maWxlcy9hdmlhdGlvbndlZWsuY29tL2ZpbGVzL3VwbG9hZHMvMjAxNS8wNi9GLTM1JTIwSGlnaCUyMEFvQSUyME1hbmV1dmVycy5wZGYK</comment>


Text analysis of Trump's tweets confirms he writes only the angrier Android half - <AUTHOR> http://varianceexplained.org/r/trump-tweets/ <comment><USER2> > A lot has been written about Trump's mental state. But I'd really rather get > inside the head of this anonymous staffer, whose job is to imitate Trump's > unique cadence ("Very sad!"), or to put a positive spin on it, to millions > of followers. Is he a true believer, or just a cog in a political machine, > mixing whatever mainstream appeal he can into the @realDonaldTrump > concoction?

A large part of data analysis is avoiding bias. This article was written in an abrasive tone with the conclusion decided beforehand, and as a result, doesn't give a neutral perspective of the data. (I'm not a Trump supporter myself, but it's one of the reasons I am avoiding political data analysis if possible)

For example, as noted, there are only 3200 tweets pre-filter. Doing _specific_ log-odd counts of 140 character tweets will lead to overfitting as I do not believe there is sufficient data. (Note how the most frequent words are not present in the log-odds chart)

The methodology is indeed clever, but it is hard for me to _trust_ the results.</comment>


Code 'transplant' could revolutionise programming - <AUTHOR> http://www.wired.co.uk/news/archive/2015-07/30/code-organ-transplant-software-myscalpel

<comment><USER2> I wrote about a similar issue, but with Web Development - a much more routine branch of software development (IMO). Plenty of room for automation here.

My Job Went to GoogleBot (and all I wrote was this lousy article): [https://www.symfony.fi/entry/my-job-went-to-googlebot-and- al...](https://www.symfony.fi/entry/my-job-went-to-googlebot-and-all-i-wrote- was-this-lousy-article)

</comment><comment><USER3> The paper: [http://crest.cs.ucl.ac.uk/autotransplantation/downloads/auto...](http://crest.cs.ucl.ac.uk/autotransplantation/downloads/autotransplantation.pdf)

Interesting, malloc() is an "organ" :-)

<comment><USER4> By any chance, was this paper submitted for review in early April?

</comment></comment><comment><USER5> The Wired article is so superficial as to be practically useless. But a quick read of the paper suggests that there really is something useful in it, although at a very early stage and for C only.</comment>


At Anthem: Where There's Fire, There's Smoke - <AUTHOR> https://digitalguardian.com/blog/anthem-where-theres-fire-theres-smoke

<comment><AUTHOR> The title doesn't really explain what the post is about - basically, Anthem won't allow the U.S. Office of Personnel Management (OPM) do a "standard vulnerability scan" citing

> _"internal policies" that forbid outside access to its network as the reason > for refusing to allow the vulnerability scans._</comment>


The Linotron 303: Typesetter that's part TV set - <AUTHOR> http://laughtonelectronics.com/oldsite/comm_mfg/commercial_linotron%20303.html <comment><USER2> HN discussion of a Bell Labls paper describing the revese engineering of a Linotron 202 machine: [https://news.ycombinator.com/item?id=10505349](https://news.ycombinator.com/item?id=10505349)

There's a good "revisiting" of that paper, too: [http://www.eprg.org/papers/202paper.pdf](http://www.eprg.org/papers/202paper.pdf)

Edit:

The contrast between the Linotron 303 described in this page, and the 202 described in the Bell Labs memo is interesting. The 303 was introduced in 1974 and uses film-based fonts, whereas the 202, introduced in 1978, uses fonts that are stored digitally as vectors. I naively assumed that a "303" would be a newer, more advanced machine than a "202", but that's not the case.

<comment><USER3> I wrote parts of the the hyphenation package used in the H&J version of the L202, there where 3 versions , 202 H&j, just send it Cora 5 marked up text and it would justify, hyphenate and set it. The L 202 slave, which you had to send it xy positions for each line and wordspacing etc. And the VIP emulator slave which emulated the older VIP photosetter. There was also a very rare ELA (exotic language adaptation) version with a large 80gb CDC disk pack on the side which could do Chinese, Japanese, Arabic and Korean. Finally there was the graphics version, which could set embedded pictures but it had to have precision photosetter tube with a clean bond on the faceplate otherwise you got banding.

<comment><USER4> Are you sure that was 80Gb? An 80 Gb disk pack would fill a small room.

<comment><USER5> Almost certainly a typo. The CDC 877 disk pack was 80MB.

</comment></comment></comment></comment><comment><USER6> Amazed you can still buy type scales this century.

[https://www.technicaldrawingequipment.co.uk/Printers-Pica- Ty...](https://www.technicaldrawingequipment.co.uk/Printers-Pica-Type- Scale.html)

Used to be a lot of math involved to figure out how deep copy would run before sending on a motorbike to be typeset. When it returned on another motorbike there would be anxious moments unrolling the typesetting before paste up in case you'd made an expensive mistake. Hard to imagine now how much DTP changed everything

</comment><comment><USER7> Here's a really good video that explains the operating principles of a similar machine, the Linotron 505, and shows it in action.

[https://vimeo.com/75532294](https://vimeo.com/75532294)

</comment><comment><USER8> My Dad left school at 15 to support his family (his dad was Blind) back in the 30s - he got a job as a lino-type operator on one of the wholly mechanical devices - if you ever get a chance to see how one works take a look - especially the type-sorter and the justification hardware</comment>


Show HN: A clutter-free dashboard with a twist - <AUTHOR> http://heimdash.com

<comment><AUTHOR> This is live. Idea is this: Everything represented as text, discovery and interaction/sharing with the content in one place via drag-and-drop. Updates. Night mode. I have a few Invitecodes, if you like. What do you think about the concept? Do you want?</comment>


Ask HN:  Can we end the "anyone who can code has a job waiting for them" meme? - <AUTHOR>

How many of you honestly know of a job available for anyone who can crank out some interpreted code and knows HTML?  Or even positions open to recent college graduates who "only"[1] have a CS degree?
It would seem the actual threshold for a software engineer position, is at least:
* CS degree
* Good knowledge of algorithms and ability to recall and implement them
* GitHub page and some nontrivial tool or open source contributions
A typical non-senior-level job description might call for ruby, javascript, SQL, knowledge of algorithms, and personal projects that would (presumably) impress whoever is hiring you.
I have seen anecdotes recently of liberal arts people learning one language and getting programming jobs, however I have trouble believing that this is very common at all, because I can't imagine where they are finding these "give 'em a chance" jobs.
Let's not confuse competition for mid and senior level software engineers with JOBS FOR EVERYONE.
[1] Even at a state university, its more than possible for an engaged person to work with everything from algorithms to Lisp to robots to compilers and many other things HN holds dear, just from classes. <comment><USER2> I've always assumed when people said "if you can code" they meant, _well_.

From what I've heard/experienced the thinking is there is an overwhelming percentage of software developers who are mediocre. So all that I take your meme to mean is that if you are better than that majority then yes, a job is waiting for you - I agree.

I don't think your average developer knows how to write native, optimized, sql queries. I actually am peeved more and more with rails because you basically spend all your time learning how to be a _rails programmer_. Your world becomes AR voodoo, and you work toward _gem integration_ mastery. It's kind of weird imo. I doubt most rails devs know how to write a gem!

So that's just my take on it from things I've seen and experienced. It's generally good advice to not reinvent the wheel. Well in the rails community I feel they take it too far. How do you expect to get better if you let everyone else program for you? Forcing yourself to build out some of your own components may take a lot more time but those are the things that level you up as a developer.

I can't say this approach is common, and therefore, _good programmers_ are rare.

<comment><USER3> I was noticing this, as I've been trying to learn Rails. I already know some Ruby and I wanted to try to learn the web framework so I just didn't know CakePHP. The gem thing is getting to me. I understand gems as a function of something like user authentication or sending emails. That works great, it's like Perl modules.

Now I wanted a Ruby based shopping cart to make an e-commerce site. From my googling, there pretty much was only spree. It's all voodoo because, no, you're not supposed to modify the source code. You're supposed to use _yet another gem_ to patch the code so you can have your custom additions, or you code based on hooks. But the documentation for this is scarce, especially since it seems they just changed this in one of the latest releases. Drupal, on the other hand, has extensive documentation and random blogs. I don't know if everyone else "just gets it" and I'm just left out here in the cold because I'm new.

I gave up and just worked on the Agile Web Development with Rails shopping cart. I now understand 100% of the code base I'm using and can make it do whatever I want.

I would like to think I'm a decent coder, as I can produce readable code, albeit not at a super fast speed, but I think that's a function of not doing it every day at work since I'm in IT and not web development.

</comment></comment><comment><USER4> Honestly, I would expect someone with the qualifications you listed to be able to easily get a job at a highly desired company (fb, MS, google, fogcreek, etc).

Only having experience with a scripting language can easily land someone a job. I don't know anyone that is good at javascript or PHP that is also out of a job.

I don't know anything about algorithms, how to write a bubble sort, and I refuse to do anything open source. Still, I've always had a good job and even now have a decently successful consulting practice.

</comment><comment><USER5> Anyone who can code, no.

Anyone who can code well while remaining sensitive to business concerns and doing some level of networking? Depending on location, it can be far easier for them to find a job versus the average, even normalizing for factors like level of education. But at this point, we may be talking something like the top 5% of the industry, perhaps less.

</comment><comment><USER6> Less and less web/software development jobs are specifically requiring a CS degree, based on my own observations. The ones that do are typically large companies with codified hiring standards, and governments.

</comment><comment><USER7> That being said, if you find one of those "give 'em a chance" jobs for an iPhone developer, feel free to throw it my way :-)

</comment><comment><USER8> Don't forget about prior work experience. A few of my college classmates did manage to find work after graduation, but that requirement held me back for a long time. I've tried asking companies to offer internships, but most have no concept of hiring below the journeyman level.

The bar has also been rising for entry-level experience in the rare cases these jobs are offered. Back in the 1990s, entry-level programmers were not expected to know SQL, HTML+Javascript, the LAMP stack, or how TCP/IP works. Now it is quietly expected that everybody knows all this, and except for SQL these skills are not taught at university. Students who do not pick up these skills on their own time will face an especially difficult time finding work.

All of the anecdotes I've heard of someone learning one language and getting a job in it involve hard-science postgrads and professors who already had very good analytical skills and were programming something related to their field of interest. It has been at least a decade since you could get a job by "just knowing HTML" -- which was not true at the time, since you were also expected to be an excellent graphic designer -- and fifteen years since I've heard anyone say you could get a programming job by being fairly smart and "good with computers". As for the presence of job opportunities, journeyman and senior positions each easily outnumber entry-level positions. Most companies do not hire at the entry level at all, and it is getting harder to find jobs that are slightly above the entry level in requiring only 2-4 years of experience rather than 4-6. It's a sign of the times.

Employers want experienced coders, and can get them with the economy the way it is, but everybody has to start somewhere. Most people who "can code" could barely code when they got their first jobs, and they got better by facing new challenges and having their code reviewed by more experienced supervisors. The experts-only economy is going to leave a lot of people behind by failing to give them these opportunities.

</comment><comment><USER9> This meme originates in the tech "hotspots" such as silicon valley, nyc, etc. Outside these insular communities, the job market for developers is not nearly as accomodative.

If you live outside these areas, I am guessing you're comparing the kind of things said in the HN echo chamber to your own experiences outside "The Valley", and finding some dissonance as a result.

<comment><USER10> This is what I'm starting to realise. I live in Australia, and, well, it doesn't seem that way.

Either that, or I suck, and aren't a "good developer who can get a job on the basis of having a github account"</comment></comment>


Socialmedian Purchased by Xing - <AUTHOR> http://blog.socialmedian.com/2008/12/socialmedian_inc_purchased_by.html

<comment><USER2> Amazing. Congrats Jason. After getting fed up of the incumbants, I started using two news site searlier this year (SM and NewsCred). Both have made remarkable achievements in short time periods. Now one is acquired already. What recession?

</comment><comment><USER3> Congrats! No surprise-- Jason is an amazing dealmaker and buzz-generator. Great (and quick) exit for a lean startup. Love it!

</comment><comment><USER4> Congratulations, Jason!

<comment><USER5> Thanks!</comment></comment>