End-To-End – OpenPGP Chrome extension from Google - <AUTHOR> https://code.google.com/p/end-to-end/ <comment><USER2> Notable aspects --

Looks like they're taking it seriously:

"Are End-To-End security bugs eligible for Google's Vulnerability Rewards Program?

Yes, we have specifically expanded the scope of our Vulnerability Rewards Program to include End-To-End. This means that reports of exploitable security bugs within End-To-End are eligible for a reward."

Should be an interesting trove of JS tricks:

"JavaScript crypto has very real risk of side-channel attacks

Since JavaScript code doesn't control the instructions being executed by the CPU — the JavaScript engine can perform optimizations out of the code's control — it creates the risk of security-sensitive information leaks. End-To- End requires user interaction for private operations in normal use, mitigating this risk. Non-user-interaction actions are rate-limited and done in fixed time. End-To-End's crypto operations are performed in a different process from the web apps it interacts with. The End-To-End library is as timing-aware it can be and we've invested effort to mitigate any exploitable risk."

<comment><USER3> Well if you're encrypting your email on your local PC and an attacker can conduct a side-channel attack then you're boned already. Your PC must be secure to begin with otherwise no crypto is going to save you. If an attacker can side-channel this encryption then he can probably just straight-up read your keystrokes or hard drive.

<comment><USER4> Why do you say this? I dont think all side channel attack surfaces require local access to the machine.

<comment><USER3> Can you give me an example that would be relevant here?

<comment><USER5> How about BEAST or CRIME?

<comment><USER6> BEAST is a design bug, insecure use of CBC mode. CRIME is a side channel attack, but the side channel that leaks information (compressed cleartext size) is not related to the language used, but again to the design of the algorithm.

The basic idea is that implementation-related side-channel attacks, such as timing and power draw, are very hard to exploit remotely. I guess you could write a JavaScript implementation of AES that is so bad that key-dependent multimillisecond jitter can be measured remotely. But it's almost impossible to do it by mistake.

The real problems of JavaScript are it's highly malleable runtime that offers no guarantees, everything is writable. So you need to improve browser support before you can write JavaScript crypto, that's why this is a great project: Google has the ability to change Chrome into a secure end-to-end platform, should they want that.

<comment><USER7> Maybe power draw is hard to exploit remotely, but Remote Timing Attacks are Practical (Brumley & Boneh, Stanford, 2003): [http://crypto.stanford.edu/~dabo/papers/ssl- timing.pdf](http://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf)

</comment></comment></comment></comment></comment></comment></comment><comment><USER8> Regarding JavaScript crypto:

      We hold ourselves to a higher standard; we started from scratch
      and created a testable, modern, cryptographic library.

That is awesome. So's this:

      Chrome's design means that extensions should be safe against
      other extensions.

And this:

      End-To-End uses Content Security Policy as well as inherently
      safe APIs in frameworks (strict Closure Templates). End-To-End
      doesn't trust any website's DOM or context with unencrypted data.

<comment><USER9> I had a slightly different reaction to the "high standard" bit. I always thought Prof. Boneh was a high standard. Does anyone know if there were any obvious reasons to exclude SJCL?

<comment><USER10> Disclaimer: I contribute to the core crypto library in Google End-To-End.

I was also a student of Prof. Boneh. I took his CS255, and became a TA for his infamous's Crypto I class on Coursera. So I guess at the end of the day it's still Boneh's teaching that has helped my colleagues and me create this library ;-).

SJCL is a great library, but it didn't quite work for us because:

* It isn't a Closure library. We want to use Closure because it supports types, which in turn make it easier and less error-prone to develop crypto code.

* It doesn't support typed arrays. We don't have typed arrays in End-To-End yet, but we're working on that.

* It doesn't support all the curves we want, and it seems that the main developer isn't interested in adding new curves, e.g., Curve25519.

* It doesn't have ciphers or signature schemes that we need such as RSA, Ed25519, deterministic ECDSA, etc.

<comment><USER11> Have you guys took a look at [https://github.com/indutny/elliptic](https://github.com/indutny/elliptic) ?

<comment><USER10> Oh we haven't. Looks like it's a nice library. One question: it seems that you use the message directly, instead of its hash, in ECDSA? [1].

[1] [https://github.com/indutny/elliptic/blob/master/lib/elliptic...](https://github.com/indutny/elliptic/blob/master/lib/elliptic/ec/index.js#L110)

PS: were you the guy that won the CloudFlare's HeartBleed challenge? great work :-).

<comment><USER11> I do expect users to hash the message before passing it to ECDSA, this way you could use any hashing library with it. Though, elliptic.js does actually depends on hash.js to seed it's PRNG.

Thank you!

<comment><USER10> > I do expect users to hash the message before passing it to ECDSA, this way > you could use any hashing library with it. Though, elliptic.js does actually > depends on hash.js to seed it's PRNG.

I think this isn't a good design because most people won't know that they must hash the message before passing it to the ECDSA. People will misuse it, and open themselves to attacks.

What you can do instead is to pick the right hash based on the curve, like what we did in End-To-End: [https://code.google.com/p/end-to- end/source/browse/javascrip...](https://code.google.com/p/end-to- end/source/browse/javascript/crypto/e2e/ecc/ecdsa.js#43).

<comment><USER11> Anyway, it would be interesting to compare speeds of our implementations. I'm really obsessed with try to reach 1ms verification, but so far only got to 4ms.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER12> "Please note that enabling Chrome's "Automatically send usage statistics and crash reports to Google" means that, in the event of a crash, parts of memory containing private key material might be sent to Google."

I hope that has more than a FAQ warning when they release it to the Chrome Store. Otherwise....:/

It isn't perfect but it is probably the best in-browser option given the constraints available.

<comment><USER13> Does this also mean parts of memory containing, say, passwords could be send to Google?

<comment><USER14> This "end to end" encryption happens in the browser. Google is the browser. Google dont need your keys, they have the plain text.

<comment><USER15> Also, other browser extensions may be able to access what is going on in the browser. So Google and (insert list of other parties.)

<comment><USER16> Other software on your computer might as well. Or people walking by in the hallway. So Google and (insert everyone in the world).

</comment></comment></comment></comment></comment><comment><USER17> Just tried this out and it works great! Had to build it using the instructions on the wiki, but nothing too painful. It doesn't just integrate with gmail, but more with all textarea's around the web. When you are typing in a textarea and press the extension icon next to the hamburger menu it will pop open a menu containing the text that you were typing on the site, and are given the options to encrypt/sign a message. When done it replaces the contents of the textarea on the site with the signed/encrypted message.

It works quite nicely, and I like it. I would like to see some kind of keybase integration, though it's not hard to import my tracked users into the extension by exporting my gpg keyring and importing it again.

edit: It seems that the keybase website does not like messages created by this extension. [https://github.com/keybase/keybase- issues/issues/752](https://github.com/keybase/keybase-issues/issues/752)

<comment><USER18> But as I'm typing, Gmail is saving my draft automatically to Google servers. Normally, at least. This means Google would have a copy of my email as it existed before I encrypted it.

In your testing, do you see any evidence that this extension prevents Gmail's automatic draft saving?

<comment><USER19> In the FAQ they mention _" End-To-End doesn't trust any website's DOM or context with unencrypted data. We have tried to ensure that the interaction between the extension and websites is minimal and does not reveal secrets to the website."_

I'm curious about this too. Does that mean they somehow insert a textbox that the host page can't see? I didn't realize extensions could do that.

Edit: ah, this appears to be where it happens. They insert an iframe the extension owns, so the host page won't be able to see what's in it:

[https://code.google.com/p/end-to- end/source/browse/javascrip...](https://code.google.com/p/end-to- end/source/browse/javascript/crypto/e2e/extension/ui/glass/glasswrapper.js#68)

<comment><USER20> But when displaying the cleartext of a previously sent email or received email... they must be able to decipher the encrypted text in order to display it to the viewer, no?

<comment><USER21> Sure, the extension can read the encrypted text from the DOM. But it then displays it in an iframe which the original site doesn't have access to.

</comment></comment></comment></comment></comment><comment><USER22> If it is a chrome extension and is installed via the Chrome Web Store, it can be updated silently in the background if I'm not mistaken. So in theory, wouldn't it be possible to serve Google with a NSL and force them to silently push a modified update to a targeted user that reveals the private key?

<comment><USER23> This scenario has been reported to Google as a "bug". Google's response, as of the time of this writing, is:

      I don't have further comment for now, but we hear you :)

</comment></comment><comment><USER9> The FAQ states:

      > Only the body of the message. Please note that, as with all OpenPGP
      > messages, the email subject line and list of recipients remain
      > unencrypted.

Hopefully attachments are considered part of the body?

<comment><USER24> Why would attachments be considered part of the body?

Encrypt them before uploading them, and send the decrypting key in the body.

<comment><USER13> Because as far as the email protocol is concerned attachments _are_ part of the body, just wrapped in a multipart MIME message along with text body.

But Gmail itself may handle attachments differently.

<comment><USER25> > But Gmail itself may handle attachments differently.

AFAIK, Gmail handles attachments the same.

<comment><USER13> When it sends them, yes, but this is more what I was referring to: [https://news.ycombinator.com/item?id=7842868](https://news.ycombinator.com/item?id=7842868)

</comment></comment></comment></comment></comment><comment><USER26> "Please note that EC support was added to GnuPG 2.1 beta in 2010, but it hasn't been released as a stable version yet. To communicate with other people that don't use End-To-End, you will need to either generate a key in GnuPG and then import it, or build GnuPG 2.1 yourself."

So basically, out the box this doesn't interoperate well with non-beta versions of GnuPG which are what everyone else is using for end-to-end e-mail encryption. That's annoying.

<comment><USER27> "We're releasing this code to enable community review; it is not yet ready for general use."

<comment><USER26> I don't think they're planning on changing that, according to later FAQ entries generating non-EC private keys is just too slow and it's the use of EC keys that causes the problem.

<comment><USER28> s/causes/solves/

</comment></comment></comment></comment><comment><USER29> Isn't this contrary to Google's goals as an advertising business? If people are using end-to-end encryption, they won't have cleartext emails to mine, &c. I need to wonder what the catch is, because there is definitely one: does Google own all the keys, or does Google secretly own all the keys?

<comment><USER30> > does Google own all the keys, or does Google secretly own all the keys

The keys are generated by you, stored on your browser's localStorage, preferably encrypted (their words, not mine). Since it's open source _and_ distributed by Google, I bet many eyeballs will look for bugs, much more than alternatives such as Mailvelope or WebPG. So, no, I don't think Google will ever have access to your private key through this mean.

My theory:

\- We're talking about PGP. This will only impact geeks.

\- Google prefers keeping the trust of said geeks by willingly revoking its capability to read their conversations. One of the primary support of Google success is said geeks, and it wants to keep it that way.

\- PGP only encrypts the body of an email. The header (ie the metadata) is still here for Google to collect, in plaintext

<comment><USER31> > This will only impact geeks.

Geeks email non-geeks. If the non-geeks don't decrypt the messages it's going to be all greek to them.

So the more easy they make it for geeks, the more they are pushing non-geeks to adopt as well.

<comment><USER32> It's not really possible to send encrypted messages to people who aren't already using OpenPGP, since you need to get their public key, before you can encrypt the message. You could presumably encrypt it with some symmetric cipher ahead of time, then send them the encrypted junk and say, "Send me a PGP key and I'll send you the passphrase for the message!", but I dunno that anyone's going to do that.

That said, pretty much every message I send to someone who doesn't have a key on the keyservers includes, "Hey, send me your PGP key, I don't do plaintext."

</comment></comment></comment></comment><comment><USER33> Unless I'm mistaken, the author appears to be implementing OpenPGP in javascript. This has already been done by OpenPGP.js. That project is several years old, is active, and has been independently audited.

Is this simply reinventing the wheel? OpenPGP.js can easily be used in an arbitrary browser extension.

I have no affiliation with the OpenPGP.js project besides working on a small project for personal use.

<comment><USER34> Google's posting today addresses this point, I think:

[https://code.google.com/p/end-to-end/](https://code.google.com/p/end-to-end/) "When we started work on End-To-End, there was no JavaScript crypto library that met our needs, so we built our own. During development we took into consideration all the criticisms and risks that we are aware of, and invested effort to mitigate these risks as much as possible... We hold ourselves to a higher standard; we started from scratch and created a testable, modern, cryptographic library. We created this new core library for End-To-End with support for BigInteger, modular arithmetic, Elliptic Curve, as well as symmetric and public-key encryption. Having done that, we then developed an OpenPGP implementation on top of it..."

<comment><USER33> That sounds like NIH syndrome.

<comment><USER34> It's possible, but from my conversations with Google engineers in the past I'd guess (with no inside knowledge) that it was the result of a serious security evaluation of existing code.

Especially post-Snowden, Google is taking this very seriously. See these posts, for instance, about TLS weaknesses and implementation of ChaCha20 and Poly1305 in OpenSSL -- a non-trivial task: [http://googleonlinesecurity.blogspot.com/2013/11/a-roster- of...](http://googleonlinesecurity.blogspot.com/2013/11/a-roster-of-tls- cipher-suites-weaknesses.html) [http://googleonlinesecurity.blogspot.com/2014/04/speeding- up...](http://googleonlinesecurity.blogspot.com/2014/04/speeding-up-and- strengthening-https.html)

Also, the account you're posting from was created 22 minutes ago and has done nothing but post criticisms of today's announcement. Coincidence? :)

<comment><USER35> > Also, the account you're posting from was created 22 minutes ago and has > done nothing but post criticisms of today's announcement. Coincidence? :)

Declan, nothing but respect for all your writings but he's got to make an account one day and if he's critical but otherwise polite and seems to be willing to concede the point why attack like that? It might be an account created specifically to protect a reputation. As far as I can see his concerns are valid and the answers are to the point. I'd rather see someone be extra critical when it comes to new crypto stuff than too lax.

<comment><USER34> You're right. In retrospect I was a little too suspicious, and <1345>'s subsequent comment was perfectly fair.

</comment></comment></comment></comment></comment></comment><comment><USER36> This is a push in a great direction. I really do hope it catches on and will leave to more and more users adopting strong crypto on all ends. One can hope...

</comment><comment><USER37> There are javascript implementations of aes, cbc, pkcs7 and more, all released with Apache 2.0 license. If the quality is what you'd expect from Google they could become valid alternatives to the other implementations out there.

</comment><comment><USER38> This is really great news. But even better would it be if they'd incorporate it directly in gmail with a polished user interface.

<comment><USER39> No it wouldn't be better. You'd just have yet another LavaBit that claims ultimate security but has no teeth. The private keys must _never_ touch the DOM, whether it comes from Google's servers or put there by an extension, otherwise it's vulnerable to someone hijacking/NSL-ing the gmail session.

Therefore something _must_ be installed on the local computer, whether that means a Chrome extension that has access to localStorage (like this project) or some standalone app.

If you're worried about UX, it looks like this project is meant to interface with gmail specifically, and extensions are able to alter the experience so I imagine it will be reasonably easy to use.

<comment><USER38> Well the threat model would rather be that Google is forced to serve a version of JavaScript to you that leaks your private key. Which is a concern and a reason why you should rather use a self hosted email client like Mailpile.

If you are concerned about someone hijacking the gmail session you have lost anyway, as the decrypted (or not-yet-encrypted) text surely has to hit the dom at some point.

<comment><USER34> <infogulch> is correct. I wrote about this in 2007:

[http://news.cnet.com/Will-security-firms-detect-police- spywa...](http://news.cnet.com/Will-security-firms-detect-police-spyware--- page-2/2100-7348_3-6197020-2.html) "In theory, government agencies could even seek a court order requiring security companies to deliver spyware to their customers as part of an auto-update feature. Most modern security companies, including operating system makers such as Microsoft and Apple, offer regular patches and bug fixes. Although it would be technically tricky, it would be possible to send an infected update to a customer if the vendor were ordered to do so."

Countermeasures to autoupdates include: (a) disabling them; (b) verifying that the checksum you receive is the same as posted on a number of different sites unlikely to be coerced into delivering FedGov malware; (c) only downloading autoupdates from a non-U.S. repository unlikely to be coerced into delivering malware. And probably many others I'm not thinking of offhand.

But in reality if your threat model is that the NSA/FedGov/FBI/GCHQ/CIA are already targeting YOU SPECIFICALLY, you probably already have a few dozen physical bugs that were concealed in your home placed via a sneak and peak Scarfoesque black bag job the last time you went out for pizza. A hypothetical court order to force FedGov malware on you specifically via autoupdates can be contested by the provider (I was the first to report last May that Google was litigating two non-malware NSL cases pre-Snowden) and in any case is not bulk surveillance.

<comment><USER40> I agree that such a thread model makes things difficult, however I'd like to believe that it can be solved for. Regardless, there is value in hiding your communications from mass, non-targeted surveillance.

<comment><USER34> If you're able to completely "solve for" the threat model of NSA/FBI/GCHQ/CIA/etc. having a serious and persistent interest in you, and knowing where you sleep at night, my hat's off to you. Few people are that confident.

<comment><USER40> I never implied that _I_ could! Anyway, my comment was concerning communications. Physical security is another matter. I must have missed that portion of your OP.

</comment></comment></comment></comment></comment></comment></comment><comment><USER41> With the risk of sounding fanboy, this is really fantastic! This could actually be a viable, secure answer to mail encryption.

And this is aawesome too: "we have specifically expanded the scope of our Vulnerability Rewards Program to include End-To-End. This means that reports of exploitable security bugs within End-To-End are eligible for a reward."

<comment><USER42> This seems like a fantastic idea. We currently use Syncdocs [1] to encrypt our Google Drive folders. It is also end-to-end encryption, but it uses AES, not PGP, which means the key exchange is separate.

If the email is drafted online, do the drafts get deleted and wiped after encryption on the Gmail server?

[1] [http://www.syncdocs.com/google-drive-encryption- faq/](http://www.syncdocs.com/google-drive-encryption-faq/)

</comment></comment><comment><USER43> Between all the build tools that are available -- one would think that'd they'd been able to settle on one (or at least supply a shell script) rather than having us cut and paste?

[https://code.google.com/p/end-to- end/wiki/BuildInstructions](https://code.google.com/p/end-to- end/wiki/BuildInstructions)

Still, that aside, really exited about this project.

Disappointed with the secondary support for RSA/DSA (ie: pretty much all existing keys) -- sadly Google never were very good at interop with others :-/

As I understand it, everyone _not_ using this/gmail now have the option of not being able to communicate securely with the people that start using this; or running unsupported versions of GnuPG :-/ (Or trying to explain how to securely generate, export and import RSA/DSA keys into end-to-end -- somewhat defeating the whole usability benefit...)

</comment><comment><USER44> What about search and indexing?

Will GMail be able to find those encrypted e-mails when I search for them?

<comment><USER45> Google _is not_ a privacy company. How can they show you context relevant ads if they can't read your email? So this will probably never happen within Google for political reasons.

But even for technical reasons, it's probably a ways off. Doing encrypted search is a whole other problem on top of encryption. You can't just apply standard search out of the box. Given that Google is just now unveiling an encryption solution, I would not expect GMail (or any google service) to release services built on top of them for a while, even if they wanted to (which they don't).

Unless you are doing hashing and comparing a specific value exactly (e.g. how you would securely store a password hash in a DB) there is no general purpose text indexing package that I know of.

There is some academic momentum on encrypted search: [http://www.cs.berkeley.edu/~dawnsong/papers/se.pdf](http://www.cs.berkeley.edu/~dawnsong/papers/se.pdf)

<comment><USER35> > Google is not a privacy company.

Well... they are and they aren't.

Google has a real interest in protecting the privacy of their users _from anybody but Google_.

</comment></comment></comment><comment><USER46> Kudos to them for doing it even though it goes directly against their business model (mining your information). I guess they're betting that the vast majority of people won't use this.

</comment><comment><USER47> how is this different from Mailvelope?

</comment><comment><USER48> This is Open Source and will get lots of peer review. Chrome isn't.

Is there any security advantage in End-to-End bring Open Source when Chrome isn't? To assume this is secure, you have to trust Google's software isn't vulnerable or compromised in any way.

Note: I guess this extension will run on Chromium too, which is Open Source.

</comment><comment><USER49> Eleanor Saitta (@Dymaxion) had a few things to say about this on Twitter:

On the one hand, I'm happy Google is trying to make GPG usable within GMail: [https://code.google.com/p/end-to-end/](https://code.google.com/p/end-to-end/) . On the other hand, this leaves many ?s It sounds like all you get from "end- to-end", other than a name that's going to cause horrible confusion, is a bare mininum of GPG functions. No TOFU, no pushing users to encrypt by default, no better management of keys, no attempt to stop metadata surveillance. It's good GMail users will have an easier time with GPG, but if it keeps them on a broken-by-architecture centralized service, we all lose. This doesn't seem to go far enough in making crypto usable (no indexing solution, for instance) but it will slow development of alternatives. I admit Google is kind of in a bind here - if they want to help GMail users, they're also necessarily slowing the evolution of a safe net. Mostly I wish they hadn't called it "end-to-end". Because, you know, words mean things, and like "Off the record", that means something else. I'm surprised Google weren't willing to spend the internal security resources on end-to-end to be able to stand behind it at time of release. All told, it pretty much smells like "keep engineers happy" \+ "win points with the net freedom community as cheaply as possible." Google, if they wanted to, could do some pretty revolutionary stuff in the secure comms space, but that would cost actual cash. Ssh, no one wants to talk about how Silicon Valley business models depend on surveillance.

[https://twitter.com/Dymaxion](https://twitter.com/Dymaxion)

</comment><comment><USER50> Nice. While they're at it, maybe they'll revive gpgAuth, so maybe we'll eventually have a sane and useable PKI-based auth on the web?

Oh, and maybe having PGP's WOT for use by the websites would be nice too. Could provide distributed "likes" by PGP-signing, without any central authorities.

</comment><comment><USER5> A current real alternative that uses native binaries to avoid the JS issues is WebPG[1]. I've been using it for about a year and while it has its rough edges, it's a pretty solid tool (and approach).

1\. [https://webpg.org/](https://webpg.org/)

</comment><comment> mike-cardwell Can anyone tell if this addon has been built in a suitably abstract enough manner such that the core can be used to build similar extensions for other browsers? I.e, would it be possible to take this code and wrap it in a Firefox extension?

<comment><USER51> Seeing that you haven't got a reply in three hours here's what I found:

There is mentions of using Closure which is a google JavaScript technology. I think however it is cross browser.

</comment></comment><comment><USER52> Very cool! I'm assuming this is not just for sending PGP mail, but also for decrypting PGP-encrypted mail that the user receives.

Has anyone been able to tell how they protect against the server grabbing the plaintext after it's been decrypted?

</comment><comment><USER53> I worked at a company who has a very similar product,

[https://www.penango.com/products/penango-for- webmail](https://www.penango.com/products/penango-for-webmail)

</comment><comment><USER54> Someone should try using it with this: [http://sicomail.com;](http://sicomail.com;) automatically encrypts all of your incoming email.

<comment><USER43> I'm not entirely clear on why it's better that sicomail (potentially) has your unencrypted emails, than that google has them?

I've thought about setting up something similar as an incoming mail filter on my imap server; encrypting and signing unencrypted mail to myself -- just to have data at rest encrypted, and as a motivator for myself to use gpg more regularly -- but having a third party do it seems a little silly?

</comment></comment><comment><USER55> Take a look at [http://openpgpjs.org/](http://openpgpjs.org/) OpenPGP JavaScript Implementation.

</comment><comment><USER56> If you want to build the extension and your aliases don't work add "shopt -s expand_aliases" to the compile.sh file.

</comment><comment><USER57> itd be cool to have this like [http://www.monkeysphere.info/](http://www.monkeysphere.info/) between browser and server, and not rely on CAs.

</comment><comment><USER58> It doesn't support only NIST curves, does it?

<comment><USER10> It supports Curve25519 and Ed25519: [https://code.google.com/p/end-to- end/source/browse/javascrip...](https://code.google.com/p/end-to- end/source/browse/javascript/crypto/e2e/ecc/curve_curve25519.js) and [https://code.google.com/p/end-to- end/source/browse/javascrip...](https://code.google.com/p/end-to- end/source/browse/javascript/crypto/e2e/ecc/curve_ed25519.js)

</comment></comment><comment><USER59> What is the difference between GnuPG and OpenPGP?

<comment><USER60> OpenPGP is a standard, GnuPG is one implementation of it.

</comment></comment><comment><USER61> Encryption. Google. Okay.

No thanks.

</comment><comment><USER62> So End-To-End utilizes Elliptic Curve-based keys

Could someone better across current cryptographic trends than I comment on that choice? We know the NSA has found weaknesses in certain implementations of elliptic-curve based cryptography in the past, and I was under the impression there was a preference in the community to move away from them in general given the unknown extent of the integrity concerns.

<comment><USER10> > We know the NSA has found weaknesses in certain implementations of elliptic- > curve based cryptography in the past

No, we don't.

Even djb wants people to use ECC. Note that End-To-End supports not only NIST's curves but also djb's.</comment></comment>


They Should Paint the Bay Bridge Gold - <AUTHOR> https://medium.com/i-m-h-o/they-should-paint-the-bay-bridge-gold-49fdff0416e8

<comment><AUTHOR> I painted the Bay Bridge Gold, here's what it might look like:

[https://www.dropbox.com/s/5rs6cgoh271w6s5/gold-bay- bridge.jp...](https://www.dropbox.com/s/5rs6cgoh271w6s5/gold-bay- bridge.jpg?dl=0)</comment>


Scientists find key to unwanted thoughts - <AUTHOR> http://www.bbc.com/news/health-41847030 <comment><USER2> Early empiricists find naturally-occurring GABAergic substance effective in preventing unwanted thoughts; advise "Drown your sorrows."</comment>


Wh.gov/obama is 404, but guess what isn't? - <AUTHOR> http://wh.gov/jerk Someone is making some interesting short URLs: http://wh.gov/poop http://wh.gov/dude http://wh.gov/dick http://wh.gov/bush
These two go to the same picture of Biden, so it's not just random 4 letter assignments: http://wh.gov/cunt http://wh.gov/wank
See what you can find =X <comment><AUTHOR> Someone is making some interesting short URLs: <http://wh.gov/poop> <http://wh.gov/dude> <http://wh.gov/dick> <http://wh.gov/bush>

These two go to the same picture of Biden, so it's not just random 4 letter assignments: <http://wh.gov/cunt> <http://wh.gov/wank>

See what you can find =X

<comment><USER2> Why would you just dump a ton of html into a json string like that? That's weird....

<comment><USER3> serverside templating

</comment></comment></comment><comment><USER4> Did clicking this link just sign some poor soul onto a mailing list?

If so, why was this link posted to HN?

<comment><USER5> I don't know why it was posted to HN, but wget shows a redirect to [http://www.whitehouse.gov/jerk?utm_source=wh.gov&utm_med...](http://www.whitehouse.gov/jerk?utm_source=wh.gov&utm_medium=shorturl&utm_campaign=shorturl) and then to [http://www.whitehouse.gov/organization-thank- you?sid=1849320...](http://www.whitehouse.gov/organization-thank- you?sid=18493201&utm_source=wh.gov&utm_medium=shorturl&utm_campaign=shorturl), so probably not signing anyone up for a mailing list.</comment></comment>


For Canada and U.S., 'That Relationship Is Gone' After Bitter Nafta Talks - <AUTHOR> https://www.nytimes.com/2018/10/03/world/canada/trudeau-trump-nafta.html <comment><USER2> Other countries know that we lost our mind as a country and we'll revert to the mean after 4 or 8 years of living down by the river in a van, right? I hope that myself :-) We'll go back to believing in calm international relations based on respect, not whats on tv shows or helps a politician in certain state. We'll go back to being a normal democracy, assuming that our former close allies haven't been destroyed or anything. It'll be ok with our buddy Canada, right?

<comment><USER3> People also thought there was no way Trump would be elected. It's not just the US, but Hungary, Poland, the UK (Brexit), and many, many countries with problems with right-wing populist nationalists. Imagining it will fix itself seems pretty dangerous. Either diagnose the problem, organize and act, or it will get worse. Much of the Internet and many people I know won't even discuss it, which puts us a long way from what needs to be done.</comment></comment>


The iPad Literally Breaks Every Use Case I Had For It - <AUTHOR> http://layeredbyte.com/2010/01/30/the-ipad-literally-breaks-every-use-case-i-had-for-it/

<comment><USER3> Well, the browser has tabs (at least, the iPhone Mobile Safari does, so it's no stretch to think this does as well). The lack of a camera is, I agree, silly.

Rather than rebut the rest of his "points" directly, I'll focus on "multitasking". Frankly, the iPhone and iPad _do_ multitask, in the ways that are important to (most) people. Multitasking in an end user product really means "I can do more than one thing at once", not "The computer runs many processes". The iPhone OS currently accomplishes exactly this, via saved state.

In any well behaved iPhone app, if you quit, the state of the UI and your data is persisted, so that when you return, it's like you never left. The UI for this multitasking is a bit clunky - hit "Home" then pick the app - but for most people, this works fine. There are only two situations when this doesn't - when the app does something interesting in the background, and when the "stack" of application interactions collapses - if I click a mailto: link to open Mail, quitting that doesn't return me to Safari - I have to go there again manually.

The two cases of "Does something interesting in the background" that really people want are audio streaming and notification of some event, and they're real problems. However, Apple's persistently said they're trying to protect the user experience (stability, battery life etc) by denying background apps. I've no reason to believe this isn't the case (I'm mean really, what are they gaining except geek ire by restricting this?). The audio case is annoying and needs a solution - the notification case is slightly better since push was rolled out.

Outside of these cases, the iPhone multitasks well enough for 99% of the world. His reading case, catching up on the news etc all are handled - <USER2> just have a slightly painful app switch process (i.e. you press two buttons rather than just one). The only case that isn't is background movies/music from 3rd party apps - and really, the only sensible case out of that is music (Do you really watch a movie _and_ browse at the same time on a 10" screen?). Regardless, I suspect the point will be moot soon enough - OS 4.0 seems very likely to bring some notion of background processes.

The geek anti-iPad ire really confuses me. What did we expect, other than what we got? It was _never_ going to run OS X - the user experience would have been awful without major changes that broke all 3rd party OS X apps (and then, what's the point?). The hardware, modulo camera, seems entirely reasonable at a price that's damn good - who realistically expected anything more from an affordable tablet machine at this point in technology? The "walled garden" is a real issue, but I think we have, as a group, gained far more than we've lost with the App store. All these people saying "I could never have been a tinkerer with an iPad" - poppycock. Download the SDK for free, develop all you want. Pay a nominal fee to deploy to 100 other devices without ever giving Apple a look at your app. Or hell, just jailbreak it if the limits of the SDK are so onerous.

Alternatively, just don't buy it. Having chosen this please, stop filling up HN/Reddit/The Internet with "The iPad doesn't raise the dead, make me a billionaire and cure cancer, so all my dreams are shattered and Apple is awful".

<comment><USER4> Develop all you want for free: as long as you only want to run your application on a simulated iPhone. You can't load apps onto your own device without paying $100/year or jailbreaking. Heck, you can't even use XCode to compile an app for the iPhone (not simulator) without a license.

Anyway, an additional multitasking use-case is IRC and other apps where you're in constant contact with a server. With Colloquy, for instance, right now you need to setup a server to bounce off of or else you leave all channels every time you switch apps. Of course, this class of uses is one that you don't want running when the device is off or else the battery drains quickly.

I've always felt that Apple was waiting both for their hardware to become powerful enough (the original iPod touch consistently ran out of RAM with 2 open webpages + music for instance, and page rendering wasn't exactly snappy) and also to come up with a good way of limiting the number of background processes without user involvement. You don't want every other app you launch hanging around so that when you run out of resources, the OS kills the music player which you actually wanted open.

</comment></comment><comment><USER5> I don't understand why this individual is so angry. If it doesn't meet your needs don't buy it. What's the problem? I always feel like people who write this type of stuff just have a really bad attitude because they get so upset over something so unimportant. It's like they're just trying to find things to be upset about.

<comment><USER6> No one complains about something that they have no interest at all in -- it's not a rant about how IBM's newest z/OS mainframe has poor support for browsing websites that use Flash.

Much more frustrating is something that looks like it could be just exactly perfect for you, but is for some reason fatally flawed, or just out of reach.

<comment><USER7> z/OS doesn't ship with Flash because Adobe's runtime burns MIPs like nobody's business. Data Center Operations does NOT like having to bring additional capacity online because the Southeastern Division discovered Farmville in the middle of year-end batch.

</comment></comment></comment><comment><USER8> I was looking forward to a humorous example of even a single use case being literally broken, since I don't know how to literally break a use case. Alas, it's just a list of use cases the iPad doesn't meet.

<comment><USER7> ...and use cases the iPad DOES meet, but which the poster doesn't realize it meets. Like "tabbed" browsing, listening to music while running another app, and playing free casual games.

</comment></comment><comment><USER9> "Even past the fact that the iPad does not have a camera, it cannot run two applications at the same time. Meaning: talking to my girlfriend, I could not look up a train time while we talked. Result: have to use my iPhone while we video chat. All that in a device that commands a price premium."

How do you video chat using an iPhone, which has a camera on the back?

"Again, we run into a software problem. From what I have seen in images surrounding the iPad, you can only have one tab open at a time. Excellent, if this was 1996. Hell, even Internet Explorer 7 had multitab browsing. Oh, and if that Apple sourced processor is so fast, why the hell can I not use it? Single tabbed browsing is just a plain deal killer for content consumption, period."

The button to switch windows or tabs is located between the forward and bookmarks button. It is located in the bottom right on the iPhone.

"Apple almost got there with this one, copying someone else's interface for iBooks. But then it hit me again, only one app at a time! I listen to music while I read. And Gmail is never closed. Blast, there goes that."

If you're using the iPod and Mail applications, this isn't an issue, as both of these applications can run in the background.

"Again, when are we going to see HTML5 casual gaming? I love the game "desktop tower defense," which is flash based. iPad? No."

There are many casual games in the App Store, including many tower defence games (my favourite is Star Defence, but there are plenty of good free ones, if 99c is too dear). This is only going to increase with Flash CS5.

<comment><USER10> > There are many casual games in the App Store, including many tower defence > games (my favourite is Star Defence, but there are plenty of good free ones, > if 99c is too dear). This is only going to increase with Flash CS5.

Why make people pay when there's FREE games out there online if only flash were supported. Flash support means opening up to a whole world of preexisting games, rich internet applications, and porn sites.

But not allowing flash creates an artificial monopoly that is the app store.

<comment><USER11> The argument against using Flash is that it's not suitable for a low-powered, long battery-life hand held device. My guess is that Jobs is worried that if Flash were enabled, the average consumer would notice a much shorter battery life. The consumer won't understand that Flash is to blame, and will end up blaming the iPad instead.

>Why make people pay when there's FREE games out there online if only flash were supported.

There are also many free games on the App store. Also, with the new version of Adobe Flash, it's a relatively trivial process to turn a Flash game into a native iPhone app.

<comment><USER12> The application you have just started uses 'flash' content, this will adversely affect your battery life.

Click <ok to continue> or <cancel to save your battery>

edit: way to go downmodder, getting modded down for presenting a possible solution to an issue is a new low for HN.

Congratulations. Now if you'd be so kind as to explain why you thought that was not a viable solution?

<comment><USER11> By removing Flash altogether, Apple is encouraging web developers to upgrade to new web technologies (HTML 5). If the iPhone/iPad had the option of using Flash, then web developers wouldn't have an incentive to produce non-Flash content. I'm guessing that had the iPhone come with Flash at launch, Youtube would never have implemented MP4 and HTML 5 video tags.

<comment><USER12> Ggp mentioned battery life explicitly, that's why I addressed that.

I'm probably one of the largest flash haters on the planet, it took me all of 7 years to convert our video to flash, because I simply can't stand it that for basic functionality like that we need a plug-in.

That said, that particular plug in is now so widespread that even people that can't stand it also can't really get around it.

HTML5 is not here yet, flash is here today. So, for live content, where downloading and converting is not possible this move by apple limits their users uses of the web.

The best way imo would be to show side-by-side the same functionality, have a period of cross-over, dual implementation and to deprecate flash.

To simply not support it is not going to convince any developers to make HTML5 content, it's simply going to frustrate a lot of end users.

I just got an angry email from some guy ranting at me that since I won't support the iphone he will no longer be frequenting my site. I sympathize, my budget is limited, both in time as well as in funds so he'll have to go his way.

I don't like it when choices are forced, choices ought to be free. HTML5 video capable deployment still sucks, flash is, as annoying as it is, at this moment in time the only viable way of getting good coverage on the majority of platforms.

Battery life decisions should be up to the user, not up to the manufacturer. If you need or want to see that video and there is no very good technical reason why you can't (and shortening battery life is not a good enough reason, if that were a prime decision factor the display in the iPad would have been a more economical model) then you should simply be able to.

</comment></comment></comment></comment></comment></comment><comment><USER13> I don't really get why everyone is talking about Flash and its relation to porn. If the the number of non-Flash playing devices grows, couldn't these porn sites just go to HTML5?(this applies to all other video sites, actually)

<comment><USER14> Well, he could also be talking about no flash memory card slot. If you were to watch non-streaming porn on the device, I doubt that you would want it to be in the same place on the device as your regular movies (lest you hand the iPad to someone else that stumbles across them). You would probably want to have your porn on a memory card that you could remove when you are no longer using it.

<comment><USER7> Or in a locked "porn vault" on the device. Which there are already apps for.

</comment></comment></comment><comment><USER15> I read the article and it seems like flamebait to me.

The iPhone has what is essentially 8 tabs for browsing. Music is able to be played in the background. Gmail will have push email so how is that different than running in the background from a use-case perspective?

This post does not deserve to make it such a high spot on HN. Not even on the weekend.

</comment><comment><USER16> This guy is a complete idiot, and has obviously never even used and iPhone or iPod Touch.

 _Apple almost got there with this one, copying someone else's interface for iBooks. But then it hit me again, only one app at a time! I listen to music while I read._

<comment><USER17> Unless he's talking about using Pandora while reading, I'm pretty sure you can use the music app in the background

</comment></comment><comment><USER18> You can't convince fanboys that lack of features will eventually lead to pain for the users.

<comment><USER19> You also can't convince nerds that excessive degrees of freedom are a serious usability problem.

After all, doing six things at once while remembering the state of a bunch of invisible stateful objects -- tabs, background apps, file hierarchies -- is the nerd core skill.

Meanwhile, I would note that Apple has apparently sold about 35 million iPod Touches:

[http://theappleblog.com/2010/01/28/ipod-touch-now- outselling...](http://theappleblog.com/2010/01/28/ipod-touch-now-outselling- iphone/)

... which exhibit the exact same set of "missing features" as the iPad.

<comment><USER12> But they exhibit at least two features the ipad lacks:

        - sub $300 pricing

        - fit in pockets

<comment><USER19> Pricing is a question of time. The iPod Touch launched at $300 and $400 price points. Now it starts at $199.

You're right about the pocket factor: The iPad is a gamble, of course, which is what makes it interesting. It's hard to know, without trying, how many people will trade the inconvenience of a larger device for much more screen real estate, higher performance, and optional 3G networking. All we know is that there's a market for netbooks, a market for Kindles, and a market for iPod Touches, which seems to suggest that the potential market for the iPad -- which is both like and not like each of these things -- is worth sampling.

<comment><USER12> The problem I see with that is if you're going to lug something that size around a macbook air is 3 times as expensive, but a run-of-the-mill netbook is more powerful _and_ a lot cheaper.

<comment><USER20> The problem I see is that any netbook I lug around is going to be less useful than an iPad. The netbook screen is short and you pretty much have to use it in landscape orientation. The keyboard and trackpad are small and cramped.

Also, I question "a lot more powerful." if you mean powerful in terms of range of apps or peripherals, then I see your point. If you are talking about raw performance, you are probably right, but I doubt the difference is going to be that significant.

I have access to a netbook, but I almost never use it. There aren't many situations that I'd choose it over either my iPhone or my laptop. The size, runtime and interaction model of the iPad, on the other hand, suggests advantages over both a laptop and my iPhone for situations I'm in every day (not that I won't have me iPhone with me a. The same time).

</comment></comment></comment></comment></comment></comment><comment><USER21> > _The Daily Show, Castle, The Big Bang Theory, How I Met Your Mother:_

Annoying workaround, but Air Video can stream from your desktop.

<comment><USER10> I've always envisioned watching TV on a TV while I have the iPad on the couch doing other stuff.

<comment><USER14> That may be, but in the Keynote they did push the 'you can watch 10 hours of video on a single charge' so they _are_ pushing this as a device to watch video on. If it fails at video, then it's a failure of the device if that is one of its goals.

<comment><USER10> They also pushed YouTube on the iPhone and video on the iPhone. Both features have been unpractical for me (converting videos, tiny screen, battery drain with 3G video) and the Youtube feature just seems to have been a selling point tacked on.

<comment><USER7> The Youtube feature was Apple laying the groundwork for H.264 displacing FLV on the web as a whole.

</comment></comment></comment></comment></comment><comment><USER22> The Axitron looks pretty sweet, it's a Macbook modded by Axiotron to become a real Mac tablet computer, the Modbook.

Woz is on the board of advisors.

<http://www.axiotron.com>

</comment><comment><USER23> No tabbed browsing in _Safari_. I'm guessing dozens of tabbed browsers will pop up in the App store almost immediately. Unless Apple rejects them of course.

<comment><USER24> Last I checked, Apple rejects anything that duplicates the core functions included on the device. Those include web browsing, media playing and email.

<comment><USER11> <http://www.macworld.com/appguide/article.html?article=138409>

Apple doesn't have a problem with third-party web browsers as long as they use the WebKit engine. Otherwise, the app would be implementing its own language interpreter and therefore be against the developer agreement.

<comment><USER25> wait did i hear you right -- apple prohibits interpreters?? that would be truly sad. i was thinking of making a graphical programming language for kids.

</comment></comment></comment></comment><comment><USER10> iPad is really good at doing what it's designed to do, and really bad otherwise. It's not a satisfy all device, as we've seen in the response to it so far.

<comment><USER26> Really? What the fuck was it supposed to be really good at doing? Running the iphone OS?

<comment><USER11> Yep, exactly.

A lot of tech nerds don't understand just how unnecessarily complex computers are today. Watch a 60 year old try and use a PC for the first time and you'll realise how non-intuitive the modern desktop OS is today.

The iPhone OS moves away from antiquated input devices (mice and keyboards with cursor keys and function buttons) and towards a touch interface that is simple and intuitive.

The other benefit is the sandboxed limited nature of the native apps. The average user is tired of having to do a clean wipe of their computer every couple of years because the software they've installed has slowed down the OS. I think that in the future, apps won't be allowed to make changes to the underlying OS. If you want to do something complicated, you'll need offload your app to the cloud.

<comment><USER12> Watch anybody use _any_ piece of advanced technology for the first time and realize how non-intuitive technology really is.

But after a little bit of practice just about anybody can use a PC, or a Mac (or a linux box) for that matter.

<comment><USER27> I watched both of my non-techie parents use my iPhone two years ago when I brought my family home for Xmas and by new years day they both had shiny new iPhones. They hardly ever used the computers I set up for them and would routinely update/replace whenever I returned over two decades but they dived right into the iPhone. My mom had a 3GS before I did.

The learning curve was not as steep and the rewards for learning the device were more direct and obvious. Anyone can eventually learn to use a computer running Linux, OS X, or Windows if they really have to, but there is a big difference between needing to learn how to use something and getting past that initial hump so quickly that you don't even notice it.

</comment></comment></comment></comment></comment><comment><USER28> Is it really single tab browsing? Ugh.

<comment><USER29> It allows for multiple windows, which is somewhat similar.

<comment><USER30> I didn't understand his objection here. Is it the inconvenience of hitting the "windows" button?

With the iphone's touch interface this is painless and I can't imagine it'll be any worse for the ipad.

<comment><USER26> Well, for starters, any inconvenience sucks. Glad I got that out of the way =]

His example of having (AT LEAST) 8 tabs open is not the same as eight windows. Searching through all of them can be quite the inconvenience. I, for example, currently have 14 tabs open, and six applications running. I do not want to search through all of those to get to what should be "another tab." I understand what he's talking about...

<comment><USER11> Well, I don't think we've seen yet how the iPad will manage browser windows. Perhaps when you click on windows, it will be be able to display all of the open windows at the same time in a grid view.

<comment><USER31> _There's also a thumbnail view that shows all your open pages in a grid, to let you quickly move from one page to the next._ \-- <http://www.apple.com/ipad/features/></comment></comment></comment></comment></comment></comment>


Dylanaraps/pash: A simple password manager using GPG written in Posix sh - <AUTHOR> https://github.com/dylanaraps/pash <comment><USER2> This is really nice, and it runs on Termux. And your code is like poetry.

<comment><USER3> Thanks, I'm glad you find it useful!</comment></comment>


Ask HN: If I only learn one static typed language, which one should I learn? - <AUTHOR> I am proficient with PHP and Node.js. Which static language would be most useful to learn? <comment><USER2> What are you trying to achieve?

Change the way you think about programming problems: Haskell

Enterprise Development: Java. Maybe Scala?

Apple Ecosystem: Swift (and actually, it seems like a kind-of pleasant language for general server-side use).

Low-level: C++. Or maybe Rust (although not yet given that a serious whirl)

Edit: oh, if you're broadly happy with JS, Typescript is worth a look and might (depending on your circumstances) be something you can start using day- to-day fairly easily.

<comment><USER3> C# is definitely more prevalent than Scala in Enterprise environment. In my experience even between Java and C# it's close to a 55/45 split in Java's favor. Most of the OG Enterprise jobs that people think of like banking will be Java, most of the rest will be C#.

<comment><USER4> Plus, since 1 or 2 more won't hurt, you can give F# a try for the ML goodness. This may help a progression towards Haskell - found it much easier to grok once I had a bit more playtime with other functional languages.

I personally think, given Node and PHP proficiency, a static functional language may provide more growth in skill. It's a new paradigm as well as typing discipline.

<comment><USER3> I haven't had a need for it yet professionally but there are a good number of blog posts I've seen extolling the virtues of doing your unit tests in F# (even for a C# application).

</comment></comment></comment></comment><comment><USER5> c# is really slick. It really is java without the suck, and with dotnet core / roslyn / azure / asp.net, it's increasingly viable as a cross-platform and web language (with the caveat that the only decent native UI toolkit is windows only). AWS lambdas support C#, as does Unity for game development.

<comment><USER6> I second this. The whole .Net ecosystem is built really well on object- oriented design principles and I've learned a ton about how DI/IoC and SRP/ISP designs get implemented since switching to C#. Additionally Code Contracts are really fun to experiment with to help you be more thoughtful in learning design by contract. If design skills are important C# is a great language to use for it. The only thing that bothered me at first when I switched to C# was the use of PascalCase member methods, outside of that one nitpick I've been very satisfied, C# is a solid language.

</comment></comment><comment><USER7> OCaml or Haskell. They will teach you concepts you can take back into PHP or Node.js to make your code better. And in my frank, unbiased opinion: sound type systems and pure functional programming is the future of the industry.

If you're a pragmatist it's still a good choice. You can bring FP concepts to C, Java, whatever later on too.

<comment><USER8> > They will teach you concepts you can take back into PHP or Node.js

Curious what these are. The only thing I retain back in dynamically-typed land is "argh I wish this was statically typed!"

<comment><USER7> A monad is a mathematical abstraction. There's nothing special about Haskell that makes it work with monads. They work great in Javascript, C, Python... the syntax of those languages don't make it terribly easy to work with them but it's still available. You have to be disciplined since you don't have the type system checking your work for you but you still get the benefits of the abstraction.

I'm presently trying to make this a little better in my own team's codebase by trying to introduce Flow [0]. There are a lack of definitions for the monadic libraries we use which I'm presently remedying. It's not pretty -- and my kingdom for OCaml or GHC! -- but it's better than not having it.

Knowing the fundamentals will help you learn to structure code and think clearly about abstractions. It's the difference between merely using something and understanding how it works. In the latter case you have the power to exploit it.

<comment><USER4> The syntactic sugar is perhaps what's special. Code without that isn't so pretty. I do find it impressive, however, because it's based on an abstract, wide-ranging and extremely useful concept that can actually be expressed in the language without it. It follows the pattern that much syntactic sugar we take for granted has followed e.g a while loop is sugar on top of jumps and branching.

</comment></comment></comment></comment><comment><USER9> Practically speaking, Java or C#, purely for the job prospects.

C / C++ if you're looking for something with wide applicability to learning other languages more quickly.

<comment><USER10> > C / C++ if you're looking for something with wide applicability to learning > other languages more quickly.

I came here looking for this. I learned C as my first language [1]. And I learned an immense amount about how things like memory management and type casting and things like that work. It is a foundation that has helped me learn other languages much more quickly.

Although the question is for learning "only one" and I'm not sure C or C++ is a great "only" static typed language.

[1] using "Sams Teach Yourself C in 24 Hours" which I got in an actual bookstore and came with a copy of the Borland C compiler :)... ah the memories.

<comment><USER9> C was my first "real" language (BASIC was the one before it). I learned using the great C for Dummies by Dan Gookin[1], which at the time consisted of two massive volumes comprising over 1000 pages. Good times.

Nowadays most of my work is PHP and Node.js, but if you know C, you will have _no problems_ learning PHP.

1\. [https://www.amazon.com/All-One-Desk-Reference- Dummies/dp/076...](https://www.amazon.com/All-One-Desk-Reference- Dummies/dp/0764570692)

<comment><USER10> PHP is a very close cousin of C. Up until it became Object Oriented it was pretty much a cross between C and Perl.

</comment></comment></comment></comment><comment><USER11> If you want to really focus on the frontend, I suggest Typescript.

If you want to focus on backend technologies, I suggest Java.

If you have other goals, I think there are a lot of other great answers. :)

<comment><USER12> Honest question, why would you rather choose Java over C#?

<comment><USER13> C# is a much better language and has better stewardship but Java has extremely broad usage.

Plus, speaking from personal experience, learning Java first and then learning C# is probably going to be a positive experience, whereas doing it the other way around feels like going back ten years in time.

<comment><USER12> I personally learned Java before C#, and totally agree with that sentiment :D

</comment></comment></comment></comment><comment><USER14> This really depends on the reason you want to learn.

For _back-end development_ I would orient towards Golang. Its approach to concurrency makes efficiently utilizing multiple cores a breeze; something that is not quite so simple in Node/PHP. As well, it's common that you'll find yourself able to get more out of individual machines - this will allow you to get more money out of said machines and, as a second-order effect, can delay the onset of scaling concerns. As an aside, as a primarily JavaScript developer, I do have to admit Go has a very impressive stdlib.

For _taming your tools but not changing ecosystems_ I would recommend looking into TypeScript. It just being a superset of JavaScript means you can do incremental adoption while still enjoying all of the JS knowledge you've built to date.

For _learning new paradigms_ I would either recommend Haskell for a "strict functional" path or Rust for an "immutable/non-racy" approach. Both languages take the concepts to a pretty extreme level and may feel overwhelming at first, but they can be brought back to your existing back-end development skills to help enhance the maintainability of your code.

For something between concurrency and functional programming I would recommend Erlang/Elixir - though I do so only from recommendations and not from any meaningful experience with either. Might be up your alley and definitely worth at least considering for your "one language".

</comment><comment><USER15> I'd suggest you check out both Golang and Rust. Being comfortable with both won't hurt - but if you _had_ to choose just one, I'd say play with them both and then make an informed choice.

</comment><comment><USER16> What are your goals?

If your goal is getting a job, looking around in your technical and geographical area and see which languages are used most, which pay the most, which will result in the most interesting jobs.

If your goal is purely educational, try Haskell: you'll learn about functional programming and use a much more powerful typing system than most languages provide.

</comment><comment> jimmy-dick I've been doing this for 20 years and professionally used all the major languages and all the major paradigms.

C.

C is high level assembler and manipulating assembly is the foundation of computer science.

What C provides over assembly is...type safety. Why is type safety useful and important? Bad assembly.

Why is a compiler useful and how do you use a compiler to prevent bugs? C compilers make understandable and idiomatic assembly and strong types make it easy to prevent lots of defects that are caused by imprecision and ambiguity.

From an employment perspective, data structures and many algorithms are easiest to grok and express with pointers. Most of the major programming companies will ask whiteboard questions in interviews and many of those questions test for proficiency with pointers.

Much of the key open source systems works are implemented in...C.

The other languages may give you a temporary advantage but I think only C gives a coder the foundational work for a long and successful programming career.

</comment><comment><USER17> Assuming you are in web development, I would say Java. People have strong opinions regarding languages. Java may sound relatively old school, but it is in use in many places, and once you are familiar with one language, it is comparatively easier to pick others.

</comment><comment><USER18> You will maximize your job opportunities with Java.

</comment><comment><USER19> Actually, I would suggest typescript and c# .

C# because I love it after experimenting with a lot of languages ( VB.net the first and c# second though, I'm a bit biased) and typescript because it will improve your current nodejs writing.

Both are closely aligned and I think it's perfect in your case. Start the next project with typescript and change to c# later for another project.

Also, there are a ton of projects to learn from. But other than that ( a lot of languages have great examples), there is a lot of employment in c# and it seems to be a sure bet future-wise.

Ps. CMS -> Umbraco. Webshop -> Merchello. It's like woocommerce and WordPress but easier and cleaner

</comment><comment><USER20> I think it really depends on what you want to build with it.

Are you planning on making an IOS app?

Do you want to make a back end server?

I picked up Go for my side project for the server side, and it has been a great learning experience.

I think if I were to do a mobile app, I might try Swift.

</comment><comment><USER21> I found Golang a pleasure to learn and use. Its minimalism allowed me to pick it up fairly quickly, and features like its baked in documentation allow you to build your libraries as a seeming extension of the language.

<comment><AUTHOR> If I only learn one right now will I regret choosing Golang over Java?

<comment><USER22> Golang is focused on scaling/concurrency, is very compact and fairly quick to learn. You can compile a single binary and deploy it anywhere. You can build a web server in a few lines of code. It's really strong for processing tons of requests, web API's and backend code.

Java requires a whole app server which is more of a pain to setup. (generally speaking for web dev, think Tomcat, JBoss). It's way more verbose and you really need to rely on the power of an IDE to help code for you, importing class libraries, etc.

Spend a few hours with each, they're very different. Coming from Node/PHP you should be able to pickup Golang faster.

<comment><USER23> In the JVM ecosystem you can use Jetty and have a simple embedded App Server. No need to install or configure Tomcat/JBoss, etc.

Spring Boot and Dropwizard makes this dead simple, a single .jar file with everything you need to run your app.

</comment></comment></comment></comment><comment><USER24> Most useful in what context?

If you want to pick up a language as quick as possible then C# or Java. Either choice is fine.

C# has a lot of potential in the future now Microsoft are making it more open with multi-platform .NET but it is still a way off IMHO.

Java is used everywhere and while it isn't all that "cool" it does work well, is easy to write, debug and maintain. Plus I actually quite like JavaFX. It allows me to make a nice looking UI very easily. As great as C#/.NET is you can't use C# for any decent GUI stuff outside of Windows just yet.

If you want to get a job then look at what jobs in your area are using.

</comment><comment><USER25> Useful for writing front-ends? Typescript.

Useful for writing back-ends? Java. (Maybe Go.)

Useful for learning about type theory? Haskell.

</comment><comment><USER26> Java, especially with the astounding improvements in JDK 1.8, and the new JEE specifications like CDI, and some of the incredible things coming out in JDK 1.9.

Great language that has stood the test of time and runs on Windows, Linux, OSX, and sometimes Android and IOS.

</comment><comment><USER27> C#. It's used from the web (ASP.NET) to gamedev (Unity), and has an excellent implementation of most mainstream view on statically, strongly typed OOP. In my opinion, the best language to write usual business logic heavy projects, that don't need dynamic metaprogramming trickery on one hand and manual memory and cpu cycle management on another.

There are many other languages that will teach you valuable things; buy if you're asking about one, or at least the first one, C# is definetly the best choice. When you'll come from it to Haskell or Rust, you will already be equipped with a habit for OOP and static typing, and will not face a frustrating cognitive overload.

</comment><comment><USER28> You could try Flow ([https://flow.org](https://flow.org)) as you're already familiar with JavaScript. I've been using it after primarily using static languages and it's been great so far.

</comment><comment><USER29> I would raise a humble Kotlin instead of Java for backend and Android work. It is quite simpler than Java and allows a little bit of functional coding, while also being fully interoperable with it.

</comment><comment><USER30> For what purpose? My favourite language is haskell, but it may or may not be suited to your goals. It sure as hell won't get you a job easy.

</comment><comment><USER31> Practicality-wise, I'd suggest Javascript because you learn it once and you can use it for frontend (DOM, angular, react, etc) and backend (node.js), all of which are very popular and highly-demanded. For learning-wise, it's not the best language to learn about language concept though..

</comment><comment><USER32> Another vote for Typescript here. For one because it's a really nice modern type system that doesn't get in your way too much. Also because if you're already familiar with node, you'll be able to focus on the language rather than new libraries/tooling/ecosystem.

</comment><comment><USER33> Swift is a fantastic language with an excellent type system. It can go all the way from writing scripts to building a whole OS and it's about as performance as C/C++. Plus you have a great app ecosystem to build apps for, iOS, TVOS, etc... but it's also open source.

</comment><comment><USER34> I would strongly recommend C. You will learn a lot about computers, rather than computer science.

If you want to stay in the computer science realm, I would recommend C#, C++, or Go. All three have the critical mass to be dominant languages in the next decade.

<comment> jimmy-dick I'm not sure what CS means in this context but my experience has been that C is the language of choice when doing "real CS" \- which I'd define as the analysis, use and invention of data structures and algorithms on Turing machines.

If you mean the engineering practice of turning specifications into machines then there are definitely better languages for that.

</comment></comment><comment><USER35> A lot of people here say C#. Well, that is a decent option, but I think F# is overall better (however, obviously C# have a bigger job market).

F# is similar to oCalm, still can do the things C# do, still you can use C#, still you are using .NET.

That is a lot of plus!

The main downside is the smaller job market.

\----

BTW if you use PHP/JS, C# will _not teach you much_. Is also "OO" and much code around, specially old or coming from the corporate world is not eye opener.

PHP/Js are _less well designed_ languages, that encourage and celebrate bad practices... but most decent developers learn to workaround that and coming to other languages will look at first like "same".

Require some study and effort to see how much C# is better.

In contrast, F#, Pascal, oCalm, Haskell, Rust, etc will open your mind and increase your skills, because will move you out the comfort zone.

</comment><comment><USER36> I currently use Go, but recently have found C# to be very nice to work with.

</comment><comment><USER37> If you're interested in iOS/Cocoa development, Swift is a top-notch statically typed language with lots of paradigm flexibility. Unfortunately, it isn't used as much outside of that domain.

</comment><comment><USER38> Go with Swift, it can be used everywhere and it is in high demand right now. Server, desktop, mobile, watch, tv, you name it.

Kotlin comes in second place if you like Android and their mobile ecosystem.

</comment><comment><USER39> Elm, it's a lot simpler than any other statically typed language, and compiles to JS. You can run it on node.js with various tricks.

</comment><comment><USER40> [https://kotlinlang.org](https://kotlinlang.org) might be worth trying too

</comment><comment><USER41> Go is fantastic

</comment><comment><USER42> You Go

</comment><comment><USER43> I am still facing dilemma Java vs C#. I have to say I like C# more but there seems to be many more Java jobs than C#.

<comment><USER27> There are so many jobs in both of them that if you're having trouble getting hired, you probably should learn a little bit more.

<comment><USER43> Right. But location matters and in smaller parts of the world it is difficult to be picky.

</comment></comment></comment><comment><USER44> That's a context-dependent question. If you want to do systems-level stuff that's safe, concurrent, and fast, then learn Rust! I'm having lots of fun with Rust. :-)

If you don't want some of those attributes, then Rust probably isn't the best answer for you.</comment>


Scoop: A Glimpse into the NYTimes CMS - <AUTHOR> http://open.blogs.nytimes.com/2014/06/17/scoop-a-glimpse-into-the-nytimes-cms/?_php=true&_type=blogs&_r=0 <comment><USER2> Good find. The background on how we got to this point is really interesting. I think it's fascinating how use cases and the functionality evolve over time.

Really puts a stake in the heart of the idea of the magical unicorn visionary product manager who automatically knows the right answer at all times. It's more trial and error than people admit.</comment>


Most Expressive General-purpose Languages - Clojure, CoffeeScript and Haskell  - <AUTHOR> http://www.infoq.com/news/2013/03/Language-Expressiveness

<comment><USER2> Clojure is awesome, its community is awesome, I think it's an awesome thing to learn if you can take the time. I put together some tutorials on it for any learners out there. [http://www.verious.com/board/AKumar/improving- performance-wi...](http://www.verious.com/board/AKumar/improving-performance- with-clojure/)</comment>


U of Waterloo: All intro CS courses use Scheme (for Math students too!) - <AUTHOR> http://compsci.ca/blog/computer-science-at-waterloo-the-new-scheme-of-things/

<comment> a-priori I actually just presented an argument to the U of Guelph CS department a few months ago saying that, among other things, they should do this (Guelph is about 40km NE of Waterloo). It was remarkably well-received.

</comment><comment><USER2> Back in 1972, @ Univeristy of Toronto, Engineering Science we took PL/C. Most of us used APL (A Programming Language) to write quick and fast code on the fly. Where did that language go ? Remember I.P.Sharpe Associates? Time- sharing? Ouch, this dates me. I'm running an ISP in Toronto now and hiring graduates, but find many think they can programme, but they cannot "problem- solve"! Too bad most of the Universities are giving us programmers but no network ip people. (They seem to be self-taught, like the best ones...!) My son currently in second year Chemical Engineering is just using some C++ and MathLAB. My younger son will be entering UofT for Engineering Science in FALL 2008, and they are asking all students to enroll in a summer class for programming if they wish to be accepted into EngSci. I'm hoping that the Universities keep up the push to stay-up-to-date with the current programming languages. Good luck to all you new noobs.

</comment><comment><USER3> I took the Java route @ Waterloo.

I would have to defend CS 133/134 in the Java days by saying that that they always emphasized the data structures and OO components and downplayed anything language specific. The only language specific components really were how you expressed the general concepts. For this reason, I don't feel the switch will make a huge impact on a lot of students.

However, I do think it is a good thing, too many students focused on memorizing the Java aspects like what a main definition looks like (memorizing public static void main... instead of understanding what public meant, what static meant, and so on).

<comment><USER4> "... they always emphasized the data structures and OO components and downplayed anything language specific."

How can you use Java for OO and not have it skewed by language specifics?

</comment></comment><comment><USER5> Alas, I was a year too early and thus doomed to take the CS 133/134 sequence. It was terrible. (The day our professor suggested Java had operator overloading I stopped going to class.) By all accounts the CS 135/6/45 sequence is excellent; kudos to Prabhakar Ragde for pioneering it. Waterloo's first-year CS sequence has been in a constant state of flux for quite a while now so with any luck this change will provide some stability.

</comment><comment><USER6> Same here at IU, but what do you expect when Dan Friedman and Kent Dybvig are faculty. Unfortunately my undergraduate school was yet another java school.

</comment><comment><USER7> When I was at GT all freshmen had to take CS1321, which was taught in Scheme. (ahem, well, the lectures were in English . . .)

</comment><comment><USER8> the Northwestern University CS department has been teaching Scheme in its intro course since the beginning of time. its kind of a weed-out class. theres been a lot of talk about teaching a more 'useful' language like python, but its probably never going to happen.

as for me, im glad i learned it and saw the light!

</comment><comment><USER9> I was one of the students to take the first version of the course :) Funtimes :)

<comment><USER10> I was one of the students to take the Java-y CS134. One cup of coffee I could have done without.

</comment></comment><comment><USER11> At Bowling Green, the introductory class for the CS major is based around C++.

<comment><AUTHOR> Egad. What was the attrition rate?

</comment></comment><comment><USER12> Ah, but I believe MIT's intro CS course stopped using Scheme a few years ago.

<comment><AUTHOR> That's why I thought Waterloo's switch _to Scheme_ was noteworthy. MIT's 6.001 was the prototypical Scheme class and now it's Python (w/robots).

<comment><USER13> Keep in mind that MIT doesn't have a CS department. Course 6 is EECS.

<comment><USER14> Not really that important to note. Basically all of the scheme instruction (short of two classes taught by Sussman) has been removed from the curriculum.

<comment><USER13> When I took 6.001 (SICP) in Spring 1987 there weren't a lot of classes using Scheme either. I think the main difference is that SICP is no longer required for all of course 6.

<comment><USER14> 6.034 was the Scheme follow-on, and it's now Python, too.

</comment></comment></comment></comment></comment></comment><comment><USER15> my uncle is a prof there. I guess they partner with MS.</comment>


I was Jordan Peterson's strongest supporter. Now I think he's dangerous - <AUTHOR> https://www.thestar.com/opinion/2018/05/25/i-was-jordan-petersons-strongest-supporter-now-i-think-hes-dangerous.html <comment><USER2> He writes "His (Peterson's) output is voluminous and filled with oversimplifications". So why not offer one just one example that demonstrates the nature of this "danger"?

Having watched a lot of JP's Youtube output especially his debates with detractors I'm interested to know what this danger is supposed to be. I'm not arguing he isn't but I'd like to see the argument.

</comment><comment><USER3> I have read this yesterday. I am personally sympathetic to JP but very apathetic to the entire situation.

He has built a large following for a variety of reasons and is attempting to do _something_ which neither the author, nor myself can even guess. Let him have a shot at it, no point in these articles, they will never persuade his followers.

He has made it clear that he is more than willing to become a martyr and as such, nothing can stop him except himself. I truly wonder how far all of this will go.

</comment><comment><USER4> Tiresome slog to find any factual criticisms of the subject.

</comment><comment><USER5> After watching the Munk Debate on Political Correctness I don't think Jordan Peterson is the dangerous one.

[https://youtu.be/rT_FnwVFuYw?t=1h9m15s](https://youtu.be/rT_FnwVFuYw?t=1h9m15s)</comment>


Urgent, need your opinion on a job interview situation - <AUTHOR> 1. Had an in-person meeting with a CEO of a start-up. We spoke for 2.5 hours in total. He offered an interesting job proposition - to lead a new project from scratch. And asked me to speak to his Director for Product Strategy - who was originally hired for the same role and has run some pilots for the same.
2. The Director of Product Strategy insisted for a telephonic interview. Asked few questions and I answered all questions. This interview lasted for 20 minutes. He advised me to followup with CEO.
3. Followed up with CEO and he said maybe you are not a good fit for this role and we can explore some other roles for you in alignment with your past experiences. Introduces me to VP of Sales.
4. Meanwhile, I request for another meeting for the original job proposition and send across a presentation for the  project. CEO likes the presentation and agrees for a meeting later in the week.
4. VP of Sales calls me the same evening - interviews me - and concludes that I am overqualified to become a Account Development Manager, lack identical experience of a Account Manager, finds me to be a good fit for a Partnerships role but he doesn't have a job opening at the moment. Concludes the call saying, let's keep in touch and see if we can have you on-board in a couple of months.
I am nervous and confused. I want the original job and I could turn the tables in getting another meeting with the CEO, hopefully. Will this rejection from the VP of Sales create a negative bias in the CEO's mind? Can I still expect to meet him? And secure the job regardless? Please advise. (Email: email@example.com) <comment><USER2> From my point of view, it looks like the Sales VP is correct, you are overqualified for his team since you likely are better qualified than the Product Strategy guy himself and they both know it.

Especially if the CEO had anything good to say to these guys about you after your lengthy 2.5 hour powwow that resulted in the desired offer.

Product Strategy and Sales don't want the internal competition from someone else with a direct line to the CEO who is capable of the New Project which no one else has been able to move forward on.

Those two guys don't want you, I would never work under them. But if I was completely confident I could do the Project from Scratch, I would emphasize that to the CEO, agree to report directly to him, plan to outlast the flunkies, and hire their replacements later on.

Be prepared for back-stabbing, and if the CEO ever drops his complete support, be ready to leave at any time.</comment>


All Ears: Always-On Listening Devices Could Soon Be Everywhere - <AUTHOR> https://www.wsj.com/articles/all-ears-always-on-listening-devices-could-soon-be-everywhere-1531411250 <comment><USER2> Right after you empty the dishwasher, put in soap. Then if the soap is still there, the dishes haven't yet been run. So easy, maybe you don't need to even consider buying that overpriced gimmicky crap that's just going to surveil you for its brief software-truncated lifespan.

Who the heck would want to always being turning down the music to utilize these devices anyway?

... I've been pondering the idea of a generalized replacement control board for say washers/dryers, with the primary goal to reestablish the expectation of user control over these things (and perhaps enable sane IoT rather than gimmick-based). Faced with the prospect of needing a new microwave and remembering how my blood boils when using the ones that can't even get the basic #-#-#-Go keypattern right, I'm seeing the angle there too. Perhaps in the future we'll just have to physically gut the control boards of appliances immediately after purchase similar to how we presently have to gut the software of new phones.

</comment><comment><AUTHOR> Outline: [https://outline.com/bdekKs](https://outline.com/bdekKs)

</comment><comment><USER3> How would this work legally in a two party consent state? Can a house guest sue for being recorded?

<comment><USER4> Maybe you would have to post a sign on the door saying "by entering this location you are hereby consenting to Amazoogapple recording you; If you disagree, please leave".

</comment></comment><comment><USER5> Big brother is listening... spooky thought, but definitely a possibility in the near future</comment>


Pynh – Console Hacker News Client - <AUTHOR> https://zaplanincan.wordpress.com/2015/01/13/pyhn-console-hacker-news-client/

<comment><USER2> Does it support comments/commenting?</comment>


German Supreme court: Adblocking and taxing advertisers for unblocking, legal - <AUTHOR> https://techcrunch.com/2018/04/20/adblock-plus-v-axel-springer/ <comment><USER2> The headline is completely wrong. Bundesgerichtshof is not the German Supreme court. It's the second highest court.

<comment><USER3> I was curious about this and did a little research. It seems like the higher court (Bundesverfassungsgericht) can't be appealed to for this case; it has authority to rule on the matter, but only as a result of the law being found unconstitutional.

Easiest citation for this would be from [https://en.wikipedia.org/wiki/Supreme_court#Germany](https://en.wikipedia.org/wiki/Supreme_court#Germany)

> When it comes to civil and criminal cases, the Bundesgerichtshof (Federal > Court of Justice) is at the top of the hierarchy of courts.

<comment><USER4> > result of the law being found unconstitutional

To explain: this means in many cases the Federal Court of Justice is the last court to which can be appealed. Axel Springer has already declared that they will try to appeal, but this will be difficult. To appeal they have to show that their constitutional rights _might_ have been violated.

Another note: Then there is the European Court of Human Rights in Strasbourg. In exceptional cases this court can be appealed to, for example if a national court's decision has violated a human right. Germany has ratified the European Human Rights and declared that they accept rulings of the European Court of Human Rights. However it is extremely dubious that a company could ever appeal to this court.

(A side note to give an example what this Court decides: A Swiss case has been ruled: A Filipina mother with children in Switzerland divorced from her Swiss father tried to enter Switzerland. The denial was deemed to violate the human right to have a family and Switzerland was ordered to let the woman enter the country.)

<comment><USER5> I guess you mean in exceptional cases you can _successfully_ appeal to to the ECHR, or is there some special rules that mean Germans have particularly restricted appeal rights to the ECHR?

<comment><USER6> Axel Springer is a company, not a person or persons. Companies don't have human rights, so they obviously cannot appeal to the ECHR.

As for exceptional cases, I think the gist is any case that can involve human rights violations is exceptional, as the majority of cases don't even get into the territory of potentially violating the European Convention on Human Rights.

<comment><USER4> It's a bit complicated. In civil law jurisdictions a company can be a «person». As such the company can file complaints or be accused of something. The law defines whether an organisation can be viewed as a person. For example in Switzerland associations are legal persons as long as their organs are operative. Organs of a legal person are for example the board, the general assembly and others.

This means, a company can suffer from a violation of protected rights. An example is the right for information (a form of free speech).

Whether the ECHR would ever accept or has already accepted a complaint from a company I don't know. After all companies aren't really humans.

</comment></comment></comment></comment></comment></comment><comment><USER7> > "an attack on the heart of the free media"

in most contexts this is 'free' as in 'freedom' whereas here [perhaps coincidentally] it's 'free' as in 'free beer'

<comment><USER8> Fortunately in German we have two different words for "free as in freedom" ("frei") and "free as in free beer" ("kostenlos"), so it's completely unambiguous that the publishers were talking about freedom.

<comment><USER9> "freie Medien" et al are idiomatic. "frei" still subsumes "kostenlos" in the general case (e.g. free entry). English has "gratis" or "free of charge", too.

<comment><USER10> Wait is "gratis" an actual, common English word? As a Spaniard I thought it was a joke kind of thing or used in extreme cases to differentiate, but that it was not really used in English (it _is_ a common word in Spanish).

Similar to "libre".

<comment><USER11> Its not uncommon in my experience as a native speaker. I feel like the context of gratis is more transactional than the context of free; eg. "Its a free country" makes more sense than "Its a gratis country".

<comment><USER10> Yeah, "gratis" literaly means "free of charge". If you ever see a "gratis country" let me know (;

</comment></comment></comment></comment></comment></comment><comment><USER12> I wonder if adblockers can charge advertisers for unblocking and give half of that money to users who opt-in respecting those who don't.

That's a billion dollar market waiting for disruption.

<comment><USER13> I think all the "paying the users" schemes are bullshit. I've heard these ideas for a decade or more, and can't think of a successful implementation.

I don't want to get paid breadcrumbs for my time or attention.

</comment></comment><comment><USER14> So if Axel Springer ultimately prevails won't people just switch to ad- blockers without white-lists? I can't see this changing the financial condition of Axel Springer but it does remove the appearance of an ad publisher paying "protection money".

<comment><USER15> This just another failed juristical attempt of the private media corporations here in Germany to hold onto a world that won't come back again. Just with this, they drew an immense amount of attention to the possibilities of AdBlocking. Articles now explain how they work, where you can get it or what harm may come from ads, making it available and desirable to people who never bothered before.

Their other big war is on the public broadcasting system. Making it more popular. This time for the younger audience.

</comment></comment><comment><USER16> There is way too much taxpayer's money wasted on this dispute.

<comment><USER17> There is absolutely no taxpayer money wasted, because civil trials are paid for by the losing party.

<comment><USER18> Those costs aren't nearly covering the real costs, because otherwise justice would be really expensive.

<comment><USER17> In this case, costs for the first trial alone are 45000 euros. Appeals are twice that. That should be plenty to cover the judge's salary.

Try it yourself: [https://www.foris.com/en/service-center/litigation-costs- cal...](https://www.foris.com/en/service-center/litigation-costs- calculator.html?tx_datamintsforiscalc_pi1%5Baction%5D=index&tx_datamintsforiscalc_pi1%5Bcontroller%5D=ProcessCost)

I used a million as the disputed amount, which is within the usual range for such trials.

</comment></comment></comment></comment><comment><USER19> Nice ads you're running there. Would be a shame if something were to block them.

<comment><USER20> Since neither the blocking functionality nor the actual blocking rules are shipped with any browser, that's somewhat hyperbolic.

Users can still decide which code and data ends up on their computer. If they trust Eyeo more than Axel Springer Verlag, that's their decision to make. Axel Springer is free to refuse serving those users.</comment></comment>


Who designed the WikiLeaks logo? – Design history - <AUTHOR> http://mthvn.tumblr.com/post/44663892003/wikileaksemblemandvoid <comment><AUTHOR> Also have a look at the second part of this article, where early versions of the WikiLeaks logo are shown:

[http://mthvn.tumblr.com/post/44775649723/wikileaksintervieww...](http://mthvn.tumblr.com/post/44775649723/wikileaksinterviewwithaska)</comment>


Rethink your Startup Website: Make a Net, not a Funnel - <AUTHOR> http://www.whattofix.com/blog/archives/2012/04/build-a-net-not.php

<comment><USER2> This is actually quite a useful technique yet equally unknown method of figuring out product viability from your own user cohort.

The overall concept...

\- Not sure if a some FizzBuzz feature is required on your site?

\- Not sure if people are interested in your awesome newsletter series on Blue Widgets?

\- And in any event, after you've created FooBar... What will the take up be if you add it to your site?

Well, before you spend 4 days coding your new and exciting product, only to find out that no one actually wants to use it... do some market research on your own visitors!

How?

Easy... put the feature on some of your sites pages and purposefully 404 it, and when they click through, record the event.

Just provide some message saying "Ooopsey, looks like we are having some problems!".

Run the test until you are sure that either: it's working, or it's a total flop.

Guess who's already doing this? TripAdvisor. Listen to Kaufer explaining how at TripAdvisor they purposefully 404 their users into figuring out if something is worth doing.

[http://techcrunch.com/2011/12/22/founder-stories- tripadvisor...](http://techcrunch.com/2011/12/22/founder-stories-tripadvisors- kaufer-discusses-the-logic-behind-running-404-tests/)

</comment><comment><USER3> This isn't an either / or decision for a company. It makes sense to create a net if you're early in the lifecycle of a company or product—before it's reached product/market fit. Once a startup has reached product/market fit, however, creating a funnel and A/B testing the hell out of it is probably a good idea.

To use an example from your post, now that you know what people are looking for (and how they're behaving) on your paystub page, you can begin to tweak the design, layout, and flow of that page to optimize whatever it is you want to optimize.

With the above in mind, "make a net, not a funnel" is another way of saying "don't optimize prematurely".

</comment><comment><USER4> >> Confused about how so many people could visit and still I was clueless about what they wanted, I logged on to the Hacker News IRC channel and asked the room "Can anybody help? I have a site I don't know what to do with."

There is a Hacker News IRC channel? Anyone know the details?

<comment><USER5> Google suggests it is #startups on irc.freenode.net

</comment></comment><comment><USER6> How do people react to fake buttons? I'd suppose it makes them more annoyed. Isn't that counter-productive? Or is it worth the risk?

</comment><comment><USER7> In the article, OP wrote about Facebook: "They didn't want you to do anything but what you wanted to do naturally, they just wanted to pay close attention and help." Does OP or anyone else have specific examples of what Facebook did in their early days?

</comment><comment><USER8> Traditional A/B testing assumes that there is one goal, conversion, and you tweak one thing at a time to reach that goal.

This has the same end-point, make something people want, but the methodology is completely backwards. Cover all the bases, provide all kinds of chances for users to do stuff, then figure out what your goal should be.

Interesting to see what some more experienced start-up guys think of this.

<comment><USER9> I've most often seen this tactic in secondary products, with the goal of learning from (hopefully) representative visitors in a way that doesn't risk presenting an unfocussed core offering.

This sort of safety-zone data mining doesn't have to be limited to perfecting your pitch, either. I don't have any inside info, but Massive Health's The Eatery struck me as a very clever way to learn an awful lot about their potential users for whatever they're really working on behind the scenes.</comment></comment>