Plenty of Fish Hacked - <AUTHOR> http://plentyoffish.wordpress.com/2011/01/31/plentyoffish-hacked/ <comment><USER2> Plenty of Fish? Might as well rename it plenty of passwords.

The worst part is Markus stores his passwords in plaintext, or _slightly_ better reversible encryption.

POF will mail a person their password. This is a security nightmare because basic precautions were not taken.

I just checked and POF is still able to reproduce and email me my password. I also checked the email I use for POF and there is no mention of this in any of their emails. If markus took this seriously at all he'd be resetting everyones password and have instructions to reset their email password.

"We have reset all users passwords and closed the security hole that allowed them to enter." This is a lie, I just logged in with my username and password. I wasn't even asked on login to change it.

<comment><USER3> It's actually worse than that.

I don't know what it's like now, since I haven't used POF since 2008 or so when I met my current girlfriend (though I only remembered to kill the account a few months back), but back then they would actually send you reminders every so often - I want to say once a week - that included your plain text password as a reminder.

I think this is just the kick in the ass I needed to go through all my accounts around the internet and make sure they all have unique, reasonably complex passwords. My email and banking passwords have always been unique, but I know I've been slack elsewhere. I won't let that happen again.

<comment><USER4> If there is an option to use some kind of hardware token with your banking then I would strongly advise you to take that.

Having just a password to protect your bank account sounds pretty scary to me. That's about as juicy as it gets. I'm paranoid enough about my servers having 'just' a password to protect them (oh, and an ACL), if my bank accounts would have only a password I wouldn't sleep.

Every time I log on I have to use my chipcard in a little electronic device with an LCD display and a bunch of buttons on it, the chipcard generates a unique ID every time I log in. When I want to do an actual transaction I have to authorize it using 1, 2 or 3 challenges depending on the amount and destination of the transaction. It's less convenient than a password protected system but it's fairly secure.

It's also protected against the most common form of theft called 'skimming' because it uses the chip and not the magnetic stripe so a thief using the data on a skimmed card could only use that to use an ATM but not to access the internet banking section of the website of my bank.

<comment><USER3> Are you European? I only ask because my friend in London is the only person I've ever heard of using such a device.

Unfortunately, such a thing seems all but unheard of here in Canada.

Our debit and credit cards are being replaced with cards with chips embedded, which could be a sign that such devices are coming, but for now I'm afraid my password is my only real line of defense online. I have noticed that when I login from a new computer (for example, when I visit my parents), the site uses one of my challenge questions to ensure it's really me. I guess that's something, although I really don't know the exact circumstances that trigger the challenge.

<comment><USER5> The weird thing is that Blizzard will cheerfully sell you a $7 hardware token to protect your imaginary WoW gold and equipment, but I don't know of any US banks that offer one to protect your actual money.

<comment><USER6> Paypal will.

Don't quote me on this, but I think banks are starting to lean on "possession of a trusted mobile device" as their two-factor authentication. The basic theory is that I give them a number I can receive SMSes at, and then any time they want to verify that the person operating my web browser is really me, they say "We just sent you a one-time password via SMS. Enter it, resend it, or talk to customer service."

This has significant advantages over dongles from the perspective of the bank: they don't have to get into dongle distribution, and people are probably better at keeping cell phones available than they are at keeping dongles available.

<comment><USER7> My bank in Australia does this (for any transaction to an account I've never sent money to before). Works prettty well.

I click a button, they SMS a 6 digit code, I enter it, money transferred (or bill paid).

<comment><USER8> Which bank?

<comment><USER7> That one. :)

<http://www.commbank.com.au> for those who don't get the joke.

<comment><USER9> They will also issue a token for those of us living outside the country.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> Why does the Hacker "Chris Russo" sound more credible than the guy from Plenty of Fish?

-[http://grumomedia.com/plenty-of-fish-hacked-chris-russos-exp...](http://grumomedia.com/plenty-of-fish-hacked-chris-russos-explains-how-he-did-it/)

1\. He provides emails - I think Mark(Guy from Plenty of Fish), really needs to get those voice recordings of Chris threatening his wife online to be more credible.

2\. Mark tells a complicated story - A story with mafia and all that, really? If we follow Occam razor, Chris story sounds more realistic. He saw a flaw and reported it. Everything was going dandy until he saw ads for Plenty of Fish data. At this point Mark decides to try ruin Chris by fabricating a story, since he believe it is him trying to sell the data. It is a simpler story.

3\. Why isn't Mark contacting the authorities? - A week and Chris is not in jail and responding freely on his blog?

Mark does have some valid points though,he did hack pirate bay: [http://torrentfreak.com/the-pirate-bay-hacked-users- exposed-...](http://torrentfreak.com/the-pirate-bay-hacked-users- exposed-100708/) But Chris claimed again, proof of concept and he has no bad intentions.[What is the appropriate way to expose vulnerabilities?]

In my opinion, he[Mark] should release the voice recording to add more credibility because right now he is sounding shaky.

<comment><USER11> A key point here is that he didn't use a proxy and doesn't seem to hide his identity during the sniffing around, which means he's either: a) stupid. b) not intending to do anything malicious.

I think a. is unlikely, because he did actually manage to break in, although, the hole itself might've been trivial and therefore this might not count. I don't think so, though. Which leaves b.

<comment><USER12> I think it's pretty obvious from both sides of the story that what Chris intended to do was (c) demonstrate the existence of a vulnerability in order to hard-sell his security consultancy.

Reading between the lines, it looks like his sales tactics were heavy on the FUD (he pointedly hasn't denied making any claims about Russian conspiracies), leaving Frind paranoid and angry. And probably also embarrassed if the security flaws were as basic as is being suggested.

</comment></comment></comment><comment><AUTHOR> Just got in contact with Chris Russo who hacked PlentyOfFish His version of the events here -> [http://grumomedia.com/plenty-of-fish-hacked-chris-russos- exp...](http://grumomedia.com/plenty-of-fish-hacked-chris-russos-explains-how- he-did-it/)

<comment><USER13> Mate, before you milk that 'interview' for eye-balls, just go back to the PoF article above and read the new comments.

Chris Russo is there commenting, and it calls your ability to judge character into question. For starters, he has never denied the story about Russians holding his computer hostage and threatening to kill him. He just ignored it. Then he goes for the "race" card and says PoF are suspicious of his intent just because he is in Argentina.

<comment><USER14> Wait, so if I post here that mahmud is on the yakuza payroll and has kidnapped my puppies then people are supposed to believe it until you deny it?

<comment><USER13> They were triads, not yakuza.

I believe the PoF guy simply because he has more to lose. You can already see this Russo character writing his own "If I Did It"[1] account of the tale. Looks like his attempt at getting a gig backfired.

[1] <http://en.wikipedia.org/wiki/If_I_Did_It>

</comment></comment></comment></comment><comment><USER15> The fact that a well known site like POF was hacked is eclipsed by the fact that they both store unencrypted passwords, and the bizarre tone of this article.

I managed to stumble through the first part of the article, but lost interest when Russo claimed that "he can see what the Russians are doing because they took over his computer." This sounds technologically implausible at best.

Maybe the official post in the morning will make more sense.

<comment><USER16> Is it implausible? Could you not set up some kind of honeypot machine and then monitor it's activity once it's been zombie'd? (Genuine question - I'm definitely no expert on the topic).

<comment><USER15> Certainly! That part alone is not only plausible, but also quite common. Antivirus companies, security researchers and various other interested parties have been known to use such tactics.

However, it doesn't make sense then those who hacked his supposed honeypot would be aware of his oversight ("they are trying to kill him"), while still using the honeypot to perform whatever illegal shenanigans they were up to ("they are currently downloading plentyoffish's database").

</comment></comment></comment><comment><USER17> From the TechCrunch article comments:

"Roberto Alsina Just a small clarification about this bit:

"They then start talking about money because they need to incorporate a company that can deal with companies outside of Argentina and that will cost $15,000. They also needed to know if they were going to make over $100k/year or 500k/year as that would require different registrations…"

I am from Argentina, and I own a company. Yes, in order to bill services to foreign customers, you need to register your company as an "exporter of services". And to do that you have to put money on escrow (but not $15000, only $7500), or your company has to demonstrate assets for over $12500.

If Russo has been working without an incorporated company (he could be a "monotributista", which is a way to bill as a physical person). A monotributista can export services, but... he's personally liable, so doing security consulting that way is insane.

That's probably why Russo could be asking for money up-front: if he didn't, he would have been doing business illegally."

<comment><USER18> Many freelancers work as monotributistas or responsables inscriptos, exporting services that way. And it's perfectly legal. For a single person shop this would be the first case I hear of, of an incorporate company setup that way.

<comment><USER19> Yes, it's perfectly legal, but is incredibly stupid in this case because of the liability.

If you work on security this way, you are going to get sued eventually. If you are a monotributista or responsable inscripto, you will lose everything. A SRL (like a LLC) is the logical way to handle this kind of work.

What I meant by illegally is that it would be illegal if he was already incorporated as a SRL and exporting services (he needs to do the escrow to do that legally).

</comment></comment></comment><comment><USER20> I wonder if Markus realizes that e-mails have been going out non-stop to customers lately from spam profiles using their 'wants to meet you' "feature". On the one hand, I feel bad for PoF becoming the target of an attack and drama, but from the tone of the post, it wasn't handled right on their side either. PoF really needs to get its act together on the security side. It's sad to because it was a fairly well executed concept when it first arrived on the scene, and has since just turned into what amounts to a spam/ad farm.

<comment><USER17> As the lead developer on a dating site myself, I can say that it's ridiculously hard to keep out spam profiles. We block by country, Project Honeypot entries, and HTTP header profiling, use captchas, and use other bot- sniffing tricks, but in the end we still have to manually ban IP addresses every day.

We don't store passwords in plaintext though, sheesh.

Edit: I just upgraded the hashing algorithm on the site from SHA1 to Bcrypt. Paranoia for the win.

</comment></comment><comment><USER21> I read "closed the security hole", but I never read "reinstalled everything from scratch using clean data sources" - isn't that what he should have been doing?

I still feel icky because of the sourceforge hack and wonder if I should reinstall everything. I probably should :-(

</comment><comment><USER22> Related, but slightly off-topic.

When I read this post on my iPhone, I saw a match.com ad on the top of the page. match.com competes with Plenty Of Fish.

POF is a multi-million dollar business. I'm surprised that they aren't paying Wordpress to provide an ad-free experience.

<comment><USER23> POF is entirely funded by ads from paid-for dating sites. It's a weird business model, but it seems lucrative.

<comment><USER11> No, it's not. They have a large(ish) self-serve advertising platform like FB with various levels of targeting.

<comment><USER24> A huge percentage of the ads served on the self serve platform are affiliates promoting other dating sites.

</comment></comment></comment></comment><comment><USER25> I'm on plentyoffish and they do weekly send you your password in plaintext (there are plenty of other sites that do this). Thankfully I change my passwords each month to a random string of 12 characters and don't really care. Perhaps if hackers get into my account, my account can finally get a date!

<comment><USER26> > Perhaps if hackers get into my account, my account can finally get a date!

No, you have to wait for OKCupid to get hacked for that to happen.

</comment></comment><comment><USER27> I don't understand why the victim of a crime is being given a hard time.

Scenario: I own a safe with all my personal information locked inside of it; a Safe Cracker (let's call him...Chris) comes along a cracks me safe. Chris call me as says to me 'yeah, I cracked your safe if you don't hire my company to fix you safe's vulnerability maybe your personal information might get out.'

Who is the bad guy in that situation the dope with the safe, with a 1-2-3-4 combination or the guy who takes the dopes information and attempts to use it for his own personal gain.

NOTE: To anyone who still thinks the dope is more to blame; please send me your address i'll rob your apartment/house then sell your things back to you (don't worry I'll also sell you new locks).

</comment><comment><USER28> Chris Russo _says_ he didn't dump any data.

[http://plentyoffish.wordpress.com/2011/01/31/plentyoffish- ha...](http://plentyoffish.wordpress.com/2011/01/31/plentyoffish- hacked/#comment-119001)

</comment><comment><USER29> Wouldn't surprise me one bit if this all came out as a sham and they were all just in it to get some attention...

I mean, who settles things through the blogosphere... come on folks, there is a judicial system!

<comment><USER30> Things can get really stuck - as the protagonistss appear to be on different continents

</comment></comment><comment><AUTHOR> It is mind boggling that the young 23yo Chris Russo was smart enough to hack PlentyOfFish but not make any sense with his crazy requests and compulsive lies. This morning Markus Frind CEO of PlentyOfFish plans to do and official statement about the events.

Fun Fact: Markus Frind graduated the same year as I did from BCIT in Vancouver. I took Mechanical Design and Mark took Computer Science. Do I regret not taking CS, hmm maybe?

<comment><USER2> Grumo media looks pretty cool. Maybe you shouldn't regret it? I'm doing a startup in Vancouver as well. Your videos look awesome but are out of my current budget. :(

<comment><USER31> I just checked your profile, do you also do iPhone apps? We're a cool startup in Vancouver and we're looking for help with our iPhone development, maybe we can chat

<comment><USER2> Yup, definitely do do that. I'll email you right now. team at summify.com?

<comment><USER31> Yes, that's it

</comment></comment></comment></comment></comment><comment><USER13> This is extortion, plain and simple.

<comment><USER32> From Markus' account, it sure looks like that; but note that a "chris russo" says, in the comments, that he's only given a proof of concept and that the web server logs will show that he didn't make a full dump.

Of course, sending a PoC with an offer to fix the security does have a "nice website you have there, it'd be a shame if something happened to it" vibe to it; still, it's factually different from trying to extort money from a company by dangling a dump of their customer database.

<comment><USER4> That's a technicality in my opinion. If the website owner would ask you to fix it that would be one thing, to hack them and then to 'offer to fix it' (presumably for a fee) is across the line. It's a fine one but it's definitely there.

Hacked a site?

Send them a message about it, give them time to respond and time to fix. If they don't respond after a reasonable time has passed go public with it, don't try to translate it in to paid work.

<comment><USER32> Trying to turn a PoC into paid work is indeed sketchy; but I do understand that security researchers/whitehat hackers would like to get paid for their work.

It would be good if more companies set up bug bounties, and even better if they'd set the reward a bit closer to (reputed) black-market prices.

</comment></comment></comment></comment><comment><USER33> I'll ignore the issues with the plaintext/reversible passwords since that's a trope that has been bandied about enough lately and ask if anyone has technical details on the hack itself, I'm quite curious if it was a simple SQL injection or something more artful.

I'd tend to lean towards injection, given that it took Russo (apparently?) 2 days to produce a working exploit with what amounts to fiddling around, but if anyone knows where I can read a write-up on it I'd appreciate it.

(Professional curiosity, I'm a web dev and like to be apprised of what catches the more popular sites. Sometimes you get lucky and it's subtle/neat.)

</comment><comment><USER34> This is why my pof passwords are always some variation of "zachary" (with some numbers appended).

<comment><USER32> You're just _asking_ for a "disregard that, I suck cocks" now.

<comment><USER32> Apparently the above is unpopular - I was just trying to point out that posting your password (or enough of it that one could bruteforce the rest) has its downsides.

</comment></comment></comment><comment><USER35> And then he posts it on HACKER news?</comment>


KaiOS Technologies and Mozilla partner to enhance Gecko engine for KaiOS - <AUTHOR> https://www.kaiostech.com/press/kaios-technologies-and-mozilla-partner-to-enable-a-healthy-mobile-internet-for-everyone/ <comment><USER2> Youtuber 'TechAltar' made a video[1] on March 11 giving his perspective on this.

While I wouldn't normally link to a YouTube video in this context, KaiOS Technologies specifically reached out to TechAltar to provide him with details so he could cover the story.

It's likely that one of the reasons KaiOS decided to reach out was because of his July 2018 video[2] covering KaiOS, which has over a million views.

[1] [https://www.youtube.com/watch?v=_UPk3mpcDP4](https://www.youtube.com/watch?v=_UPk3mpcDP4) [2] [https://www.youtube.com/watch?v=OA_g2bQgOXY](https://www.youtube.com/watch?v=OA_g2bQgOXY)

<comment><USER3> Linked it yesterday (2020-03-11) with very little interest

[https://news.ycombinator.com/item?id=22545721](https://news.ycombinator.com/item?id=22545721)

</comment></comment><comment><USER4> For those who don't know, KaiOS is a closed-source proprietary fork of Mozilla's abandoned FirefoxOS for mobile devices. It's become extremely popular for low-end feature phones in the developing world.

[https://www.androidauthority.com/kaios-phone- review-979286/](https://www.androidauthority.com/kaios-phone-review-979286/)

<comment><USER5> Not sure about closed source part: [https://github.com/kaiostech](https://github.com/kaiostech)

<comment><USER6> Unless I'm missing something, none of KaiOS's UI is there. I see Gecko, the kernel, some hardware enablement bits, and sample apps.

<comment><USER7> it's partially open source, so you don't get the stuff you mentioned.

</comment></comment></comment></comment><comment><USER5> Even most recent version of KaiOS still runs on ancient Linux kernel 3.10.49 (2014) with Firefox 48.0a (2016). Not only lacking in features, but in security updates too. With updated Gecko engine and proper PWA support KaiOS might have a chance to compete with other mobile operating systems. And if somehow this new engine will be released as open source, other projects, like postmarketOS, might be able to use it too.

<comment><USER8> That explains why I was unable to find any secure way to store keys or sensitive data in their API[0] docs.

Which means user authentication apps will not come any time soon, like Authy (Authenticators), Bitwarden (Password Managers) or BankID (Swedish) (Identity Verifiers).

[0] [https://developer.kaiostech.com/api](https://developer.kaiostech.com/api)

<comment><USER7> Yeah, until they can get their act together on the security side this has no chance to become as widely used like androidOS/iOS. For some places this is less important than others. But as countries seem to be looking into digital- only currency this will become more and more of a problem.

</comment></comment></comment><comment><USER9> Please, KaiOS -- make a high end phone and hit the market that Mozilla never did with FFOS -- wealthy developers who want a platform completely unburdened with apple or google.

I'm not sure what's actually interesting about this partnership, it seems obvious, but one thing I think is a huge problem is that they're mentioning Gecko so much -- they should be trying to move to Servo as fast as possible.

There is already a project called servonk[0] that shows this might be very possible.

[0]: [https://github.com/fabricedesre/servonk](https://github.com/fabricedesre/servonk)

<comment><USER10> Why does it have to be a web-browser-based platform?

I've bought a ZTE Open[0] back when FFOS was made since i am in general a fan of Mozilla (despite their missteps now and then) since before Firefox was a thing. The phone was a disaster - applications were very slow, everything was sluggish and in some cases i lost calls because the UI had frozen due to swapping or whatever it was doing.

Now, you might say that it was a low end device, but here is the thing. Years before that i had a Nokia 6600 [1] which has literally less than 10% of the resources ZTE Open has, yet it was able to run multiple applications without a breeze (it was the first time i ran an IRC client on a phone) and even had several 3D games (which, imagine that, used software rendering despite the phone's limited CPU power).

(and of course there were PalmOS devices that were running on even weaker hardware yet they provided UIs so responsive that put even the fastest Android to shame -- but i have very limited exposure to those to judge properly)

Nokia 6600 puts in perspective how awful _Android_ is nowadays, let alone FFOS that couldn't even manage to remain literally usable with more than ten times the resources.

[0] [https://en.wikipedia.org/wiki/ZTE_Open](https://en.wikipedia.org/wiki/ZTE_Open)

[1] [https://en.wikipedia.org/wiki/Nokia_6600](https://en.wikipedia.org/wiki/Nokia_6600)

<comment><USER11> Web-based seems to make a lot of sense. Something like 90% of all apps in both the Apple and Google store are already web apps. WASM makes this idea even more appealing.

webOS in 2009 isn't even a comparison for a few important reasons.

* They were primarily RAM restricted at only 256mb.

* The then new v8 engine was about 4x slower than the current iteration (not to mention using much more RAM). Webkit is also much, much faster today

* They used QtWebkit -- a slow and grossly outdated version of webkit that offered bad performance even back then.

* There team seemed to have zero experience in actually using and optimizing a Linux OS.

A single-core 1GHz A5 chip was a crazy idea. The ZTE Open C came out 6 months later *at the same price8 and had a better screen (480x800 instead of 320x480), twice the RAM (512mb instead of 256mb), and probably close to 4x the CPU power (2x firstname.lastname@example.com instead of 1x A5@1GHz -- for reference, AMD runs an A5 as their security coprocessor on their x86 chips).

The ZTE Open was simply a mistake. It would have been a mistake no matter the OS or native vs web apps.

<comment><USER10> ZTE Open ran Firefox OS, not webOS. Though my point was that a much older an _MUCH_ weaker ARM-based phone that didn't try to pretend the web is a platform but instead used native code managed to both outperform and be a much more usable device.

</comment></comment></comment></comment><comment><USER12> Is there more to this story than a partnership press release? or should we wait until something substantive appears?

[https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20%22no%20harm%20in%20waiting%22&sort=byDate&type=comment)

</comment><comment><USER13> It seems that if you want your app to be available on the KaiOS app store, your app must have ads, and must use KaiOS' platform for those ads:

"Currently, we are prioritizing apps for QA that use KaiAds for monetization. Visit the KaiAds website to learn more.

After you have integrated KaiAds, go through this checklist."

<comment><USER11> They can't really sell the OS, so that makes sense for everyone as devs can offer the app for free too.

I wonder if there's a way to pay to opt out of their ads though...</comment></comment>


DDoSCoin: Cryptocurrency with malicious proof of work - <AUTHOR> https://www.usenix.org/conference/woot16/workshop-program/presentation/wustrow <comment><USER2> Despite this malicious use-case, it's entirely possible that the underlying proof-of-work technique (using the target server's TLS signatures for validation) can inspire some noble applications or smart contracts :)

As a somewhat contrived example, instead of blindly trusting that a certain monitoring system like "Uptime Robot" is checking your servers (or going through an expensive access_log based verification), you could verify their proof-of-connection.

<comment><USER3> That's a nice idea. I think you'd want the opposite though, mostly, proof that the site is down. That's a bit harder.

I guess you could ask someone to provide a TLS-notarized response from a TLS- compatible uptime checker.

<comment><USER4> You could include the hash of the last block in the network as part of your handshake, along with a nonce, and pay out tiny amounts of currency to whoever produces a signed handshake containing that hash (as long as the signed handshake is below a certain number? Not sure if that's useful or not in this situation). But if you want proof of uptime, having a TLS-notarized response with a handshake containing a previous block hash is pretty solid proof.

</comment></comment></comment><comment><USER3> I haven't done a deep dive, but I think this same proof of work could be instrumented in a smart contract to create a DDOS market, without publishing a new blockchain.

Oraclize has already built TLS verification into their solidity contracts for instance. So you could outsource most of the work there, I think.

EDIT: Yes, this would definitely work, and be a lot less effort than the paper.

<comment><USER5> I think you are right. The same techniques could be applied in ethereum to reward ddos attackers.

It's beautiful and terrible at the same time. <3

We may have found a deeper horror than assignation markets.

<comment><USER6> Did you mean assassination markets, or does "assignation" have another meaning I'm not aware of?

<comment><USER5> I meant the former...

<comment><USER7> Assignation markets would probably be an overall societal good, especially if combined with decriminalization.

</comment></comment></comment></comment></comment><comment><USER8> Quite related: [https://tlsnotary.org/](https://tlsnotary.org/) [https://github.com/tlsnotary/tlsnotary](https://github.com/tlsnotary/tlsnotary) TLS notarization is a genius idea, but the UX is what is holding it back. However, I'm sure there's room for innovation in this part, just like DDoSCoin shows.

</comment><comment><USER9> Intriguing concept, but malicious is orthogonal to illegal, although they are often correlated.

Namely, in several jurisdictions, including the one that the paper is presented in, (D)DOS is illegal -- a different point to debate -- making this _particular_ proof-of-work _both_ malicious and illegal.

A more intriguing one would be one that's merely (debatably) malicious but not _per se_ illegal, like, say, password hash cracking, which is similar enough to existing PoW schemes to make feasible.

<comment><USER10> In jurisdictions where it's illegal, would possession of this currency constitute evidence that a person committed a crime?

<comment><USER11> It wouldn't proove that you committed the crime, since you could have gotten the currency through other means. It's also not certain proof that somebody committed a crime, since the currency could have been mined by someone for whoom this was legal.

On the other hand, if the DDoS target is located in a country where DDoS is illegal, then in that jurisdiction possession of the currency is certainly evidence that some unknown party participated in the DDoS. That might give police certain priviledges around confiscating any coins, depending on jurisdiction.

</comment></comment></comment><comment><USER12> Can't the website owner make quite easily as much TLS proofs as he wants?

<comment><USER13> As mentioned it's addressed. But also there's an easy defence of just updating the certificate key if under such attack. With Let's encrypt around, getting a new certificate is not a huge deal anymore. And rekeying is possible with some other services as well.

<comment><USER14> > With Let's encrypt around, getting a new certificate is not a huge deal > anymore.

You'd hit the rate limit pretty quickly, though, if you had to keep doing this repeatedly on the same day!

</comment></comment></comment><comment><USER15> I looked through the paper and couldn't find it, so I'll ask here: what is the motivation behind this? I don't understand the purpose of this system. I understand that some people are paid to perform DDoS attacks against specific targets. I don't understand how a special crypto currency changes this.

        > Miners are incentivized to send and receive
        > large amounts of network traffic to and from the
        > target in order to produce a valid proof-of-work.

No they are not. Just because you create a "crypto currency", which rewards some activity, does not mean people will start performing this activity. Unless they mistakenly believe the tokens they earn somehow have value. A mined crypto currency needs to have value _before_ miners are incentivized to do what it takes to mine coins.

It seems like any paper with the word "Blockchain" in it gets votes to the top regardless of whether or not the system actually provides any additional value. Designing useless systems is not hard.

        > In order to allow victims to be (temporarily) selected for
        > DoS, DDoSCoin allows "bounties" for targeting specific servers. To accomplish this, DDoSCoin
        > introduces a new payment opcode, PAY_TO_DDOS,
        > that can be used in transactions subject to
        > certain constraints.

So miners perform DDoS attacks to earn coins, and then send these coins in a transaction which incentivizes others to perform DDoS attacks? This makes no sense. A group of supposed DDoS attackers "incentivizing" each other to perform attacks to earn tokens they themselves have created.

<comment><USER16> what you are missing is that with this system the miner can prove he performed the attack.

The ability to perform DDoS attacks is already valuable in itself, as you said yourself, but you can't prove who performed the attack or that the attack was performed at all, this system allows miners to create the proof by performing the very act of DDoS.

<comment><USER17> Yes, but that could also be used in just a marketplace, for example, and still does not merit a crypto currency. The neat thing here is that it's programmable and freely accessible to anyone. As others have mentioned, that allows this to be used in smart contracts, etc.

</comment></comment></comment><comment><USER18> Every day we seem to inch our way towads Accelerando...

<comment><USER19> Thank you, this seems like an interesting lecture!

</comment></comment><comment><USER20> A primary feature of OTR-style communication protocols is deniable authentication. If Alice and Bob communicate via OTR, Alice can't can prove (cryptographically) to anyone else that the messages she received were actually from Bob.

Would an OTR-style protocol be immune any type of DOS proof-of-work? Are there disadvantages to having deniable authentication for the kinds of communication that TLS is used for today?

Edit: according to the paper, the attack only works on TLS 1.2+, and only works on the setup phase. Apparently, TLS allows you to forge the contents of the communication. Does OTR allow you to forge the setup phase as well?

</comment><comment><USER21> I had an idea for a cryptocurrency whose PoW would incentivise stealing and erasing files from other computers. I even wrote some code for it, but it seems to have gone missing...

</comment><comment><USER22> I don't see how it is any different than hedging against any real commodity or stock in a traditional banking sense...

</comment><comment><USER23> I would love to see Anonymous flock to an implementation of this. Hacktivism with a reward.

</comment><comment><USER24> Crawlcoin instead? SE's prove due diligence.

<comment><USER3> I think the issue there is getting a scheme that has the asymmetric validation. And you want the results of a crawl.

You could merkle up the different pages you've crawled, and combine with a part of your public key to get a unique hash. But, the question is why would someone pay for it?

</comment></comment><comment><USER25> Finally we can have a fair market for DDoS! This is what will liberate the system from the evil overlords of DDoS corporations!!!</comment>


Non-Convex Optimization for Machine Learning - <AUTHOR> https://arxiv.org/abs/1712.07897 <comment><USER2> From the preface:

> Put a bit more dramatically, [this monograph] will seek to show how problems > that were once avoided, having been shown to be NP-hard to solve, now have > solvers that operate in near-linear time, by carefully analyzing and > exploiting additional task structure!

This is something I've noticed in my own research on inverse problems (signal recovery over the action of compact groups). And it's really quite mind- blowing. What this means is that you can _randomly_ generate problems, and these will be NP-hard to solve. However, assuming the problem is _not_ randomly generated (i.e., there is some regularity in the generative process that produced the data), there often appears to be some inherent structure that can be exploited to solve the problem quickly to its global optimum.

I feel like future research will focus on finding the line that divides the "tractable" problems from the "intractable" ones.

<comment><USER3> A simple example of this that has been shown rigorously is compressed sensing. Finding the sparsest vector, subject to linear constraints Ax = b is NP hard for general matrices, but is solvable in polynomial time if A satisfies the RIP property (e.g. w.h.p if A is generated by randomly sampling gaussians for each entry). Quite surprising!

<comment><USER4> Another example (that may be related to yours) is the general linear programming problem, that is, for vector x,

      max c^T x

      s.t. A x <= b  [component-wise]

If problem instances (A, b) are chosen at random, from a rotationally- symmetric distribution, Borgwardt and others showed that, with high probability, the number of steps of the solution method is bounded by a polynomial in the number of dimensions. But on the other hand, there are explicit constructions of (A, b) that cause an exponential number of solution steps.

The usual interpretation is that "most" problems are friendly to the standard linear programming approach, but a few are not.

</comment></comment></comment><comment><USER5> (Disclaimer: I am an author of the monograph being discussed)

The authors are very glad at the discussion this monograph has generated and would be very happy if this leads to more research and advances in the foundations and applications of non-convex optimization. Solvers for various problems that arise in machine learning and signal processing applications, have seen great improvement in recent years. This includes MILP solvers that are very useful for scheduling and other problems and LASSO-style solvers. This monograph was an attempt to present a concise and lucid introduction to another set of very useful and highly successful algorithmic techniques for machine learning problems.

As one comment below mentioned, the scope of non-convex problems is quite vast as it pretty much includes any problem that is "not convex". However, the non- convexity that arises in machine learning and related areas is often very structured and this monograph was an attempt at collecting our collective knowledge on how to address these specific instances of non-convexity and develop extremely scalable solvers for them. A key component of this effort turns out to be a general avoidance of "relaxations", a common trick used to convert non-convex problems into convex ones so that well-understood techniques can be applied (LASSO techniques fall into this category).

Frequently, these relaxation-based approaches struggle to scale very well. In this monograph we present several algorithmic techniques that avoid relaxations for this reason. These techniques are very intuitive and offer not just excellent performance in practice (much faster than relaxation based techniques), but provably so (the monograph does indulge in formal analyses of the algorithms). This theoretical aspect of the monograph dates back at least a decade, to the initial advances in compressive sensing due to the seminal works of Candes, Tao and Romberg. These initial results were later shown to be a part of a much more general framework, which this monograph also seeks to present, by presenting applications of non-convex optimization techniques to sparse recovery, matrix completion, latent variable models, and robust learning.

We welcome comments and suggestions form all. This monograph is very much a work in progress, especially given the fast pace at which machine learning is moving forward and we wish to keep this text relevant to the community in the future as well, by making relevant updates and additions.

</comment><comment><USER6> Perhaps it's unavoidable, but there are large swaths of relevant literature missing from this survey. In particular there is not a single mention of the non-convex Burer-Monteiro method for solving semidefinite programs, a pretty widely applicable technique.

</comment><comment><USER7> I wonder how the techniques in this monograph stack up against optimization techniques on manifolds ([https://press.princeton.edu/absil](https://press.princeton.edu/absil)). Projected gradient descent seems like an approximation to steepest descent on a suitable manifold, so I would expect conjugate gradient or Newton methods to perform better in practice.

</comment><comment><USER8> Why is this getting so few comments?

<comment><USER9> It's a monograph that is pretty dense with not so trivial math. Maybe there aren't many on HN who fully understand the material or have strong ideas about it.

<comment><USER10> Also, it's not clear to me why this entry makes it to the front page over all the tons of other research paper / monographs. It's significance does not stand out to me, i.e., I cannot grasp why this is something I should look at instead of many other interesting reads from the field.

<comment><USER11> This was just released as part of the now series for machine learning. They usually publish superb reference material. Research that is foundational and/or has become a stable body of work, but is recent enough to be interesting.

Read these and you are on the edge of what is currently happening.

[http://www.nowpublishers.com/MAL](http://www.nowpublishers.com/MAL)</comment></comment></comment></comment>


Fed Up With Android Market, Angry Birds Flies to Carrier Billing - <AUTHOR> http://gigaom.com/2010/12/10/fed-up-with-android-market-angry-birds-flies-to-carrier-billing/

<comment><USER2> Why is Android billing so bad? Don't developers get a larger cut of the sale than in the App Store?

<comment><USER3> Lots of people dont' have a google checkout account. Not very many countries are used on the buyer side, and even few on the seller side. Additionally, its shitty as hell to setup on the phone if you've never heard of it.

</comment></comment><comment><USER4> 200m man hrs/day = 380 man yrs/day. That's cognitive surplus.

<comment><USER5> The game quickly turns into a pachinko machine as the levels get more difficult. I think it takes advantage of pachinko gambling psychology for a lot of its appeal.</comment></comment>


How to lower the draw percentage in chess - <AUTHOR> https://en.chessbase.com/post/vladimir-kramnik-proposes-an-exciting-chess-variant <comment><USER2> This is an interesting idea. Not least since it could be explored well with Leela.</comment>


5 tips to screw up your whole customer acquisition process - <AUTHOR> https://blog.automizy.com/2016/05/5-tips-screw-customer-acquisition-process/ <comment><AUTHOR> Lead generation can be challenging but converting trial users into paying clients is even more challenging! According to MarketingSherpa, 7% conversion rate is avarage in SaaS businesses. But what are the key influencers of that specific number? What are the key parts of a good customer acquisition process? Here are the 4 parts where you can screw up your whole customer acquisition process.</comment>


Docker Stacks and Distributed Application Bundles - <AUTHOR> https://github.com/docker/docker/blob/master/experimental/docker-stacks-and-bundles.md <comment><USER2> I've been using Kubernetes in a ci/test-level capacity (no clearance for prd yet) for about 6 months, and as far as I can tell this doesn't really add anything that you couldn't already achieve pretty easily with Kubernetes, and probably multiple other orchestration platforms. After all, they're all trying to achieve the same goals using the same low-level tech stack.

That said, I think this is going to be a significant contender against existing orchestration platforms, simply because the process and tools will be very familiar, and likely already installed on machines everywhere, only an upgrade away.

To be honest, I hope I don't see another new orchestration platform for a while. If I do, I'm probably going to ignore it unless it's obviously orders- of-magnitude better. There are already a dozen to choose from, and I still can't articulate the differences easily.</comment>


Ask HN: Looking for someone who give startup growth advice, can pay hourly - <AUTHOR> Looking for experts and/or experienced people who can give me advice for a B2B startup specifically looking for growth advice. Open to paying them hourly for the advice/call. Any feedback/suggestions are greatly appreciated. <comment><USER2> Ask WHO would know the individual with the specific experience/expertise I need?

Linkedin and Catalant are good resources to find these people.</comment>


Motorola Superbowl Commercial, parody of Apple's 1984 - <AUTHOR> http://www.youtube.com/watch?v=8BPFODsob1I

<comment><USER2> It's the usual nonsense: people only buy Apple products to be fashionable; if you want to be genuinely different - buy a non-Apple product.

It misses the truth by a mile: Apple products are very, very good at doing what they were designed for.

Make a better product and you won't need a stupid ad like this: we will sing your praises for you.

</comment><comment><USER3> The build up was really great.... the payoff, however, sucked.

<comment><USER4> I don't know about the build-up, but overall, the commercial didn't say anything. I don't know that it showed much promise either. Hopefully the device is more inspired than the ad</comment></comment>


Show HN: SunSprite-A Wearable, Solar-Powered Light Tracker - <AUTHOR> http://www.indiegogo.com/projects/sunsprite-a-wearable-solar-powered-light-tracker

<comment><USER2> Pretty interesting, never thought about how much light I'm getting

<comment><USER3> What's really cool is how bad your eyes are at judging brightness (i.e. how well they adapt to different light levels). So it's not like you can tell just by looking.</comment></comment>


Decline of the Tornado Web Server - What happened? - <AUTHOR> http://www.google.com/url?sa=D&q=https://spreadsheets.google.com/ccc%3Fkey%3D0AhQ6xoOmtiH-dFdGeDE1YUU5dUpId0FUZklYb1hKZnc%26hl%3Den%26authkey%3DCJDyuSk&usg=AFQjCNHJsjiiPX40g56J93zK9I5owIedKQ

<comment><AUTHOR> This graph displays the average requests/second that the python tornado framework can handle graphed over time by commits. Very surprising and also a little concerning since I am relying on Tornado for my current projects. Just wanted to make sure that you all were made aware of this in case you are considering using Tornado for your own projects (although I have had nothing but positive experiences with it).

Source - [http://groups.google.com/group/python- tornado/browse_thread/...](http://groups.google.com/group/python- tornado/browse_thread/thread/94b45e815ac992ac#)

<comment><USER2> thanks for sharing.. its pretty awesome how you automated the test..

i would love to hear more from bitly folks or hipmunk folks about their experience on the performance.

I am big fan of tornado, ben and it's simplicity. I guess i will continue to use my old branch for now.

<comment><USER3> Thanks for mentioning this - I'm talking Steve/Chris into doing a tornado talk at pycon right this moment. This is great ammo.

<comment><USER4> I believe Steve was one of the bigger pushes for the stack context stuff too. Mailing list suggests so anyway.

</comment></comment></comment></comment><comment><USER5> Here we see the movement from "Only 200 lines of code! Does 8 jillion requests per second!" to "Does things correctly, works in the real world!". Welcome to life.

<comment><USER6> Looking at the data, it appears that the performance drops are related to the StackContext feature. This feature is a convenience and not about doing things correctly to work in the real world.

Because the very earliest versions of Tornado were used by real websites, it looks like the code that did 8 jillion requests per second worked well enough in the real world.

</comment></comment><comment><USER7> This was the feedback from the twisted community when it launched. There were lots of issues they found in a cursory glance.

My complaint (and I heard the same complaint from a developer as recently as yesterday) was that they tossed away all compatibility with everything that existed in order to solve one specific problem. Then people tried to use it as a general solution.

I spent an hour or two soon after tornado was released figuring out how to take the good parts of tornado and the good parts of twisted and put them together for this reason: <http://dustin.github.com/2009/09/12/tornado.html> The result (without any attempt to optimize it) was a reducing in raw performance, but the ability to actually do ridiculous numbers of things you can't do in tornado even today.

<comment><USER6> Tornado solves the specific problem of building web applications. What compatibility was tossed in accomplishing this goal? As far as I can tell, Tornado is compatible with HTTP, HTML and other related web standards.

What are some of the things that you can do with your version of Tornado that I cannot do with regular Tornado?

<comment><USER7> * Use relational databases (the mysql samples shipped with tornado blocked _all_ network traffic while mysql was performing a query).

* Use non-relational databases (I have a couchdb interface for twisted, and a blocking one for regular python, nothing for tornado)

* Use memcached (it's fast, but it blocks)

* Make long-lived streaming http requests (cited in my blog post)

* Spawn and communicate with subprocesses that might be not be instant

* Schedule periodic execution of events (including http requests)

* Run efficiently on BSDs and OS X

* Send email

* Do DNS lookups (important part of making service requests)

* Use work queues (beanstalkd, gearman, ampq, etc...)

These are things I do with twisted today (though I've got at least one app I've moved to node.js for small kind of small scripty sorts of thing).

Again, you can run arbitrary python code, but if it blocks, it stops all traffic from flowing and new connections from coming in.

<comment><USER6> All of these things are possible with Tornado by using simple blocking calls and running more than one instance of the Tornado application behind a reverse proxy. If one instance blocks, then there are other instances of the application to handle new requests.

FriendFeed uses Tornado with MySQL (I learned this from Brett Taylor's blog). It seems to work.

</comment></comment></comment></comment><comment><USER8> Wow, didn't expect this to make the front page of HN. There's more context in the groups thread ([http://groups.google.com/group/python- tornado/browse_thread/...](http://groups.google.com/group/python- tornado/browse_thread/thread/94b45e815ac992ac)), but the short version is that a change to abstract away some error handling with the python 'with' statement had a surprising performance impact. When used with the @contextlib.contextmanager decorator, the with statement is more than 25 times as expensive as a try/except statement.

<comment><USER9> It looks like you forgot to call the function in 'simple_catch'. Interestingly, if you do, manual_with_catch will actually be faster in the failing case. (A try:fn() finally: return True beats everything else in the failing case)

<comment><USER8> Ah, that makes a big difference. Thanks for the correction.

</comment></comment></comment><comment><USER10> Very cool. I'm using Tornado for my projects and I gotta say, I'm really enjoying the minimalism and design. I can dive into the source and tweak it fairly easily.

Recently I tweaked the templating engine to accept keyword arguments in a namespace for the {% include %} command. Anyone interested in my patch?

<comment><USER10> ... i don't understand why people downvote sometimes. weird.

let's play a game. why would anyone downvote the parent comment?

<comment><USER11> I didn't down vote your original comment, but my reactions are

1) Off-topic, what does your template patch have to do with the decline in performance?

2) If your patch is useful, submit it back to Tornado, or setup a fork, then just post a link

</comment></comment></comment><comment><USER12> What a cool visualization! Between Github and a continuous integration benchmarking tool, you could generate this for any project. I would pay to have it.

</comment><comment><USER13> glad to see Ben Darnell is on top of it:

[http://groups.google.com/group/python- tornado/msg/681856dbb4...](http://groups.google.com/group/python- tornado/msg/681856dbb421bec7)

<comment><USER14> The fact that Ben jumped on this, made changes, AND commited them in less than a day gives me a lot of confidence as a Tornado user.

</comment></comment><comment><USER15> Don't miss the graph/chart (in the 'Tornado Performance Trend' Google doc). Yet another Tornado (and node.js and Deft) benchmark available on <http://www.deftserver.org>

</comment><comment><USER16> The link takes me to a Google Docs login page

<comment><USER17> In my case (already logged in) it just tells me I "do not have permission to access this spreadsheet".

<comment><USER18> Click on the link twice.

Google docs has some weird bug at the moment afaik which causes this.

(Worked for me the second click, probably some cookie set the first time).

</comment></comment></comment><comment><USER19> Image of the rendered graph (because it was going to raw data view due to how many people were viewing): <http://imgur.com/YhTdg.jpg>

The gray line represents the 2009 year marker.</comment>


Twitter is not public infrastructure - <AUTHOR> http://tumblelog.marco.org/72580346 <comment><USER2> I couldn't agree with this more. It goes back to the "should Twitter be taking usernames from people?" discussion we had here a week or so ago. Twitter is free. You're not paying for it. It doesn't owe you anything. Plan accordingly.

On the flip side, this begs the question "When _is_ Twitter going to start charging to use the API?" It seems clear that there is some demand for it.

<comment><USER3> <http://en.wikipedia.org/wiki/Begging_the_question>

It is a logical fallacy to beg the question.

<comment><USER4> Given the section on colloquial usage,

[http://en.wikipedia.org/wiki/Begging_the_question#Contempora...](http://en.wikipedia.org/wiki/Begging_the_question#Contemporary_usage_and_variations)

I'd say that's rather prescriptive, maybe even SNOOTy.

<http://instruct.westvalley.edu/lafave/DFW_present_tense.html>

<comment><USER5> That's what I said the first time I got zapped for that, but the one said, "'Begs the question' is a technical term with a precise meaning and we need to preserve that precise meaning," and at that point I gave in.

<comment><USER4> Yeah, I agree that it's still at the point where people will look down on you for using it in the colloquial manner.

</comment></comment></comment></comment></comment><comment><USER6> This is something that's been in my head a little while: would there be interest in Wikipedia-style, not-for-profit, in the public interest services? We don't see a lot of this in web stuff - probably because internet has seen a lot of competition and a lot of free stuff. However, maybe there is still demand.

<comment><USER3> Yes - but contemplate trying to get VC for that. Volunteers only, I suspect.

<comment><USER7> i can't come up with much in the way of existing not for profit infrastructure institutions. do these exist in some form i can't think of? the closest i can come up with is a rural electrical co-op but i'm not sure that's quite the same thing.

</comment></comment></comment><comment><USER8> Unless you have a business relationship with whoever you rely upon then you are in trouble. Even then you should be ready to jump ship. Remember when S3 and EC2 went down? If all of those services that rely on it were ready to jump onto another service they wouldn't have gone down as well.

While it's not always possible to replace parts of your infrastructure you rely on, it's common sense to have multiple redundancies for stuff. The problem in the case of Twitter is their offering is users, rather than computing. That's something you can't replace if they pull the plug.

</comment><comment><USER9> Here is an idea for twitter to make money: User pays a small fee for bandwidth and space the more space (and bandwidth; they will have to figure this out) you need the more you must pay.

One more thing (It is an idea derived for my actual stealth app), you get your own space somewhere to store your tweets. Then they will have to store some sort of repository there for you. Bandwidth and size become your business; you deal with the third party.

This way Twitter will somehow become more open for hackers to do stuff on their platform.

</comment><comment><USER10> Great to see them announce OAuth support - though I'd prefer a Gmail labs/iPhone app store approach applied to Twitter (Twitter labs).

I really want to customize my Twitter account and if they had Twitter labs I could customize my account accordingly; add features found in these apps directly into my Twitter account. Though instead of Twitter developing new features take iPhone app store approach and approve/integrate developers programs into Twitter. They could then sell each feature and share revenue with developers!

</comment><comment><USER11> Yeah, because services built on top of another 3rd party product are never successful...

This makes no sense at all. True, your business will fail if the underlying service fails, but Microsoft would fail if all hard drive production suddenly stopped, too. A great many businesses rely on "private 3rd parties". The real concern is "how reliable are they?"

<comment><USER12> > Microsoft would fail if all hard drive production suddenly stopped

The likelihood of "all" hard drive (or PC manufacturing) ceasing is a very different proposition than the likelihood of a single, unprofitable company taking an action that puts you out of business.

Most business rely on private 3rd parties, but there is a reason that companies work hard to have multiple sources of supply for critical goods and services.

</comment></comment><comment><USER13> twitter is like the Internet's syslog to me. ^_^

</comment><comment><USER14> Is there any reason why the whole publish+subscribe Blogs / RSS complex hasn't settled on a reasonably easy to implement standard similar to SMTP that allows organizations to run their own microblog server?

Its really disgusting to think of twitter (or any single vendor) "owning" this kind of function and preventing simple things like allowing text indexing.

<comment><USER15> I believe laconi.ca (<http://laconi.ca/trac/>) provides exactly this kind of functionality. As always, though, it's a chicken-and-egg problem. Look at Jabber and how little it has taken away from the proprietary IM protocols. As long as everybody and their mother is on Skype/Twitter/etc. there's not a big incentive to switch.

<comment><USER14> Yes but there needs to be a protocol not just a competing server.

It seems like the older internet protocol standards like SMTP work better. At least some of this generation of protocols seems to have played out in horrible ways like the IM market where one or at most 4 vendors have walled gardens and an open standard doesn't win. I guess in the early 70s when SMTP was designed there weren't a bunch of big corporations looking to "monetize" every new feature, just some bearded coding gurus in academia who wanted to build something that worked.

<comment><USER16> There is a protocol. The Open Microblogging Specification. It allows different servers to interact!</comment></comment></comment></comment>


The Startup Behind NYC's Plan to Replace Phone Booths with 7500 Connected Kiosks - <AUTHOR> https://www.technologyreview.com/s/608281/the-startup-behind-nycs-plan-to-replace-phone-booths-with-7500-connected-kiosks/ <comment><USER2> The startup behind this is Google.

"Intersection was formed as a merger between Titan, the largest municipal out- of-home company, and Control Group, a leader in technology and design innovation. We are backed by Alphabet through its urban technology company, Sidewalk Labs."[1]

Google actually acquired all of these companies:

"Today Sidewalk revealed its first move: The acquisition of two companies that are working to bring free, public Wi-fi to NYC.

Control Group and Titan Outdoor are both behind an effort called LinkNYC, which aims to put Wi-fi and digital advertising screens in thousands of pay phone booths across the city. The Wi-fi hotspots will also offer charging stations for cell phones and free calls to anywhere in the US."[2]

While there is clear benefit in providing free wifi and emergency services to citizens and tourists, this comes at the cost of even more advertising blight.

I think it opens up some questions like "should out city's be in the advertising business? If so "should New York City be advertising alcohol to its residents"? See the following:

[http://www.adweek.com/digital/coors-light-offering- neighborh...](http://www.adweek.com/digital/coors-light-offering-neighborhood- specific-mobile-music-new-yorkers-169112/)

Also I have to ask do cities really need yet more advertising? This whole thing smacks of little more than a ploy for Google to take a piece of traditional billboard advertising along with some new sources of data collection, under the pretense of "civic improvement."

I was recently struck by kiosk after kiosk along 1st ave advertising Coors Light Beer and yet I saw nobody interacting with the kiosks in any way. Yes I realize this is anecdotal but its also an observation that's been made over the many months since the program's inception.

[1] [http://www.intersection.com/](http://www.intersection.com/)

[2] [http://www.businessinsider.com/google-sidewalk-labs- acquires...](http://www.businessinsider.com/google-sidewalk-labs-acquires- titan-outdoor-and-control-group-2015-6)</comment>


Ben Horowitz on the Skype acquisition - <AUTHOR> http://bhorowitz.com/2011/05/10/microsoft-buys-skype/

<comment><USER2> I'm repeatedly impressed by Andreessen Horowitz. Every person I've met on their team rocks, and now we're starting to see how their investment thesis is panning out.

re: Microsoft + Skype:

Microsoft knows how to make a ton of money.

Microsoft is looking at an explosion of CPU cores on desktop computers. What are we going to be using those cores for? Embarrassingly parallel problems like 3D rendering, OS eye candy and video processing and compression. Multi user HD video chat is going to be happening really soon for really cheap. That's quite disruptive. (See Telepresence systems) [1]

The more peer to peer nodes that are added to the Skype network, the better the product. If Windows ships a Skype client turned on by default with every OS and copy of Office it sells... that peer to peer network starts to look like BitTorrent in size.

Cisco currently charges $300k for a telepresence room. Their 37" telepresence system runs about $50k last I checked. Skype chats just got blessed as an enterprise system. There's a _lot_ of money to be made here.

My nieces and nephews are in 3 different countries and about 6 different states. Every night, they live on Skype, and video chat for free. When I grew up in Central America in the 70's, a phone call to the US was $3/min.

Microsoft no longer has government oversight from the anti-trust settlement... Things might just get interesting.

ref: [1] <http://www.cisco.com/en/US/products/ps7060/index.html>

<comment><USER3> > Microsoft knows how to make a ton of money.

Yes, but only out of Windows & Office. It's been a while since they've been able to expand into other areas.

E.g., their online division typically loses >$500M.

</comment></comment><comment><USER4> "We specifically thought that Niklas and Janus, two of the preeminent technology entrepreneurs of our time, wanted Skype to be a huge success and would do everything in their power to make that happen. As a result, we did not think the doomsday scenario that greatly concerned other investors--that the founders would attempt to shut down the company through the courts--was an actual possibility"

Wow. This and the comments about how much Skype's user base has grown since Google and Apple began competing in the same space are very interesting. Plainly, someone is wrong about the value of Skype (see the other stories submitted to HN about this transaction, for the clash in points of view) but just maybe the investors who just sold Skype to Microsoft are right.

</comment><comment><USER5> Skype fits well into Microsoft's collection of assets. Its stronghold on the enterprise market will make Skype even more dominant. Moreover, this is a piece that might help Windows Phone 7 more competitive with iPhone and Android.

A key determinant of the value of this acquisition is how well they can execute the integration of Skype with their other products.

</comment><comment><USER6> The network effect is the big thing. Free Skype-to-Skype calling is a powerful incentive.

Of course, ultimately exploiting that will depend on people using Skype as their primary way to make calls. And somehow keeping other means of communication from supplanting the phone call.

And since 2010 has been referred to as the year we stopped talking to each other, this investment still may not work out. Even the most basic calling plans give most people way more minutes than they can use.

Will heavy users and international callers spend enough to make it work? Or will international calls one day be as seamlessly made as domestic ones?

<comment><USER7> I think what you will find is a large increase in business users. Many of my friends are using Skype for international calls for their business - the same people who are seemingly locked into using MS Outlook. I use Google Apps myself.

There is a strong small business contingent stuck on Outlook though, and if MS integrates with that, they should have no problem selling lots and lots of paid, higher quality business use minutes.

</comment></comment><comment><USER8> Editorializing in the title. "flip"?

<comment><USER9> Ben is a venture capitalist.. flipping is what he does for a living.

Edit: Down-votes or not, please keep in mind that the business model of a venture capitalist is to make an investment and sell it at a future time for a profit. There seems to be a negative connotation around the term "flip", but the reality is that there is significant risk to being a "flipper." Horowitz took an enormous risk and he was rewarded for his "flip".

<comment><USER8> There were a lot of people in the deal, so it is not like he sold the company himself.

Further, flip is extremely negative. VCs who do this for a living don't get very far.

I remember being lectured repeatedly about this. "are you building a company or a burger?"

Your use of terminology gives me the impression you have gathered your understanding from blog posts.

Standard disclaimer: I am both an investor in a16z and invested in them. Along with a number of other firms on both sides.

<comment><USER9> Flip is not "extremely negative." It is a reality in many business transactions. As I wrote in my parent post the term "flip" carries a negative connotation, but the end result is that someone took on a greater risk than the other guy to buy into a business with the sole purpose to resell their share at a greater value. Anyway you look at it, that is a flip.

And I'm cool with that. Good for Ben.

<comment><USER8> Flip implies selling quickly without adding much value.

Skypr has publically been on an IPO path for a while, and that is no flip.

</comment></comment></comment></comment></comment><comment><USER10> I enjoy Ben's posts a lot, but what has actually happened to Skype since eBay sold it?

IP lawsuit was resolved, the Skype network effects continued to work, the economy changed, is there anything else? It doesn't seem to me like much value was created inside the company for these 18 months, more like the perception of potential buyers changed.

</comment><comment><USER11> You have to give it to Fries and Zennström. They've essentially sold Skype three times, making billions each time.

</comment><comment><USER12> FYI This is what your website looks like to me if you decide to use flash to display plain text. <http://i.imgur.com/vrwUO.png>

</comment><comment><USER13> This guy got really lucky and he's hoping no one will notice.

<comment><USER14> People like people with good luck. Especially when they're handling their money. I'd imagine Ben wants _everyone_ to know how lucky he was.</comment></comment>


Qt 5.15 LTS - <AUTHOR> https://www.qt.io/blog/qt-5.15-released <comment><USER2> _> we have started working on an abstraction layer for [OpenGL/Vulkan/Metal/Direct3D] a bit more than a year ago. It's called the Qt Rendering Hardware Interface (RHI)_

Looks cool, but makes me sad that they have to do it. This industry is so annoying sometimes.

Also, sad to see classic widgets continue to get no love. I know it's a lost cause, I'm just sentimental about it.

<comment><USER3> They don't have to. The universal API is called ANGLE and it will work everywhere soon.

<comment><USER4> You're a funny guy.

</comment></comment></comment><comment><USER5> I'm very nervous about using Qt since they announced they more or less want to get rid of the free edition due to less than expected income.

And their commercial offerings are very pricey indeed ($6000 a year).

I'd recommend users to switch to wxWidgets.

<comment><USER6> It's not 6k a year, there's a cheaper plan now: [https://www.qt.io/en-us/qt- for-small-business](https://www.qt.io/en-us/qt-for-small-business)

<comment><USER7> Yeah, $499 per year is reasonable. It's similar to Adobe Creative Cloud all- apps plan pricing.

<comment><USER8> The main criteria to qualify for that is that your turnover is less than $250,000 per year.

</comment></comment></comment></comment><comment><USER9> LTS releases are very welcome, more open source software should adopt this release style. So far the Linux kernel, NodeJS, LibreOffice, Django have LTS candidates. Would love Python to join that list.

<comment><USER10> What kind of lts term would you expect from python? Django is 3 years, libreoffice I can't find lts, node is 2 years, Linux is 6 years.

Python is supported for ~5 years (closer to 6 in practice) without any promise of an lts release. [https://www.python.org/dev/peps/pep-0537/#lifespan](https://www.python.org/dev/peps/pep-0537/#lifespan) Would you want more than that?

<comment><USER9> Thanks, didn't realise Python releases are supported for so long. For Libreoffice the LTS release is called 'Still': [https://www.libreoffice.org/download/release- notes/](https://www.libreoffice.org/download/release-notes/)

</comment></comment></comment><comment><USER11> Any good alternatives to Qt? I remember looking into the cross-platform desktop development landscape a while ago and being disappointed by the options (Qt, Gtk, Electron).

<comment><USER12> Instead, I'm looking for a static, strongly typed language, that gives me native bindings for each platform's gui. I think I'm fine with doing the abstraction bit myself, where and when needed. Any recommendations?

Last time I had to do a gui, I chose JavaFX, and it was fine. But I'm still looking for native options, even if I have to implement the ui 3 times.

Edit: to clarify, I'm looking for something beyond C/C++

<comment><USER13> I'm amazed that it has been 15 minutes and noone have said Rust yet ;)

It you want to explore the Rust option, here is an overview of the status of GUI toolkits in Rust: [https://areweguiyet.com/](https://areweguiyet.com/)

</comment></comment></comment><comment><USER14> The release looks great. All the 3d stuff is very interesting. I still hope we will soon get a tree view in QtQuick.

<comment><USER15> there is now (Commercial/GPL only): [https://www.reddit.com/r/QtFramework/comments/gfsqzv/qtquick...](https://www.reddit.com/r/QtFramework/comments/gfsqzv/qtquick_now_has_an_official_treeview_that_is/)

</comment></comment><comment><USER16> Hmm. I just started playing with QT and I really like how easy it was to create simple database interface. It may not be pretty, but it is very functional. The change to commercial is a little sad, and I understand the money part. I just wish they did not require an account to do it.

</comment><comment><USER4> The real news is Qt6.

</comment><comment><USER17> QT is so open source unfriendly who cares they released a new version?

<comment><USER18> [https://doc.qt.io/qt-5/lgpl.html](https://doc.qt.io/qt-5/lgpl.html)

> Qt is available under the GNU Lesser General Public License version 3.

<comment><USER19> Qt offering changes 2020 ([https://www.qt.io/blog/qt-offering- changes-2020](https://www.qt.io/blog/qt-offering-changes-2020))

\- Installation of Qt binaries will require a Qt Account

\- Long-term-supported (LTS) releases and the offline installer will become available to commercial licensees only

\---

Starting with Qt 5.15, long term support (LTS) will only be available to commercial customers. This means open-source users will receive patch-level releases of 5.15 until the next minor release will become available. This means that we will handle Qt 5.15 in the same way as e.g. 5.13 or 5.14 for open source users.

<comment><USER20> > Installation of Qt binaries will require a Qt Account

How is this compatible wit the LGPL? Can't I host a compiled copy of Qt and let the world install it?

<comment><USER21> The Qt company owns the copyright to the Qt source code so they can sell (L)GPL exceptions. Bundling LGPL code in a binary, as mobile may require, instead of loading as dynamic library, requires you to get an LGPL exception from the copyright holder (or provide an object file for the user to relink). Other licenses, like Apache and the EPL, do not have this issue.

Companies can do this for open source projects. They require you to sign a contributor agreement handing over over copyright or require you license the code to them under the MIT. For the most part, differs based on region and IANAL.

Edit: corrected in () that you can comply with the LGPL with static binaries with providing an object file to the user to relink with.

<comment><USER20> > Bundling LGPL code in a binary, as mobile may require, instead of loading as > dynamic library, requires you to get an LGPL exception from the copyright > holder.

How come? The LGPL allows people to distribute statically compiled binaries that use Qt, you do not need an exception for that.

<comment><USER21> > The LGPL allows people to distribute statically compiled binaries that use > Qt

Hmmm... you can as long as you provide an object. Learned something new today. I do remember Mike discussing that on Coder Radio that would be an issue in the security industry. I assuming there were some aerospace libraries that are NDAed/restricted by national security laws.

[https://stackoverflow.com/questions/10130143/gpl-lgpl-and- st...](https://stackoverflow.com/questions/10130143/gpl-lgpl-and-static- linking)

[http://www.gnu.org/licenses/gpl- faq.html#LGPLStaticVsDynamic](http://www.gnu.org/licenses/gpl- faq.html#LGPLStaticVsDynamic)

Is this possible on iOS? Not familiar with iOS dev, but I assume Apple may have some TOS problems with that.

<comment><USER18> It is, Cisco does it for one of their apps which uses Gstreamer on iOS.

See the note here at the end: [https://github.com/freedesktop/gstreamer/blob/master/README....](https://github.com/freedesktop/gstreamer/blob/master/README.static- linking)</comment></comment></comment></comment></comment></comment></comment></comment>


A Mozilla Project To Give You Total Control Over Your Contacts - <AUTHOR> http://www.readwriteweb.com/archives/contacts_new_mozilla_labs_project.php?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+readwriteweb+%28ReadWriteWeb%29&utm_content=Google+Reader <comment><USER2> Interesting how the Mozilla Suite split messaging and e-mail out into separate components, and now Firefox is slowly bringing those pieces back into the browser.</comment>