Show HN: An animated graphing calculator implemented in a pixel shader - <AUTHOR> https://fofpx.com/?pid=graphingcalculator <comment><USER2> Neat!

Some context would be helpful. Is this a commercial product? Open source? For kids? For adults? I'm not quite sure what I'm looking at, except that I've got a neat thing to do with my kid that will take up a few hours, at least, and a superior competitor to Desmos for kids who like coding.

Assuming it's up tomorrow, not behind a $10,000 paywall, etc. That's why context would be helpful.

Seems similar to p5.js in spirit, but focused on a different type of problem. With p5.js, I can build from what I wrote, and toss it up on my own web site.

<comment><USER3> Why the extensive questioning? It's really just an example of how to do a graph in a pixel shader using the [https://fofpx.com](https://fofpx.com) platform. It seems to be similar to ShaderToy but with a different language (JS).

<comment><USER2> Because:

1) I think what's being shown IS the fofpx.com platform. This platform has four demos, of which this is one. The others look neat too!

2) The platform looks awesome, and I'd like to use it myself for things I'm doing with kids learning math.

3) To do that, I'd need to have some basic, minimal background. For example, if I plan an activity for next week, will the web page still be up and work the same? Without that, it's not really practical to use.

4) The point of a Show HN is exactly to solicit feedback. I think any serious potential user would have the same sorts of questions. Tossing an FAQ or similar up of fofpx.com would be quick-and-easy.

5) The next step beyond that would be accounts, so people can save their work and come back to it.

<comment><USER4> It's a toy demo.

If you want a full featured product, use Processing or Mathematica.

[https://processing.org/examples/](https://processing.org/examples/)

<comment><USER2> I use processing all the time.

This is different. I don't see this replacing processing, but it'd be a good supplement.

</comment></comment></comment></comment></comment><comment><USER5> It's interesting how different solving issues in a pixel sharer is.

</comment><comment><USER6> This is cool! The Y axis seems flipped, however.

<comment><USER7> yes, I get this too.

</comment></comment><comment><USER8> Webm is not compatible with iPhone. Can't you make it output standard mp4 files?

<comment><USER2> Animated GIFs are supported by iPhone. This outputs animated gifs. Animated gifs are the standard cross-platform format.

webm is no less standard than mp4. The battle of webm versus ogg versus mp4 (which refers to h.263 and successors) is mostly a question of technical communities (and Apple versus Google versus Firefox). Each platform supports their own subset, based on what they value. At this point, as far as marketshare, Chrome is in the lead.

Apple is throwing its weight behind mp4/h.263 mostly to keep open standards from raining on their proprietary, closed garden. There's no technical reason for it.

Most of my pages have videos transcoded to all three, but I think if they're going to output just one, webm is probably the best format to go with. Most users won't download all three; they'll download one and share it. For that, webm is the right choice. Otherwise, you'll run into more problems when Apple users try to share patent-encumbered MP4 files and have others not be able to view them. Outside animated gifs, someone needs to break; might as well be iPhone.

If you have a problem with that, complain to Apple; they could include webm and off cost-free. They choose to strip it out in order to screw you over.

<comment><USER9> The reasoning I've seen for iOS/Safari not supporting webm: there isn't hardware support on the iPhone, which would hurt battery life. See: [https://news.ycombinator.com/item?id=16319651](https://news.ycombinator.com/item?id=16319651)

However, I think that would be poor judgement on Apple's part. I mean, sure, preventing someone from watching a webm might preserve battery life, but why stop there: imagine the savings if they were to strip iOS down to merely being able to make phone calls!

Let the user consume whatever media they want, and if that media drains battery, that's on the user for making that choice. I can see that Apple wouldn't want people to complain about iPhone battery life if webm took over the web, but then I wouldn't mind some minor nag at the beginning of playback to the effect of "hey, this video you're playing may drain your battery faster than you might otherwise expect, so take it up with whoever is serving this content to provide an alternative encoding for iOS".

<comment><USER2> That was fascinating, not so much for the technical discussion, as the presumptions behind it. That discussion views users as pure consumers, and doesn't even contemplate a human being might want to make a video, a web page, or share a video file (except through Youtube).</comment></comment></comment></comment>


housewives with a start up-applying to yc, feedback please - <AUTHOR>

Hello hackers! My best friend/business partner and I are applying for this session of Y combinator... We have a truly phenomenal start up idea, not trying to sound obnoxious, but it's a goodie ;). The thing is, we are not technical really at all. Our parent company is called "Ambitious Housewives" because that's what we are. We're 30, married, and we have kids (she has a 7 year old, and I have a 6 year old and a 4 month old...) BUT we both have built home based businesses, and we are entrepreneurs! We have been hard at work trying to raise capital, but it is difficult in Calgary, everyone is SO oil and gas focused. We want to get in to YC SO much, where people will TRULY understand our vision... Just wondering, what do you think our chances are of being selected, given that we are not in tech? <comment><AUTHOR> I know, I am hoping to get some input. I notice that there are a lot of responses to "tacocopter" and none to my post, and I want it to get noticed. In answer to your question, I don't really have any feeling about spam. It used to annoy me years ago, but now I think I am immune, I barely notice it. If you're comparing my post to spam, so be it.

<comment><USER2> The Tacocopter post is something that appeals to a lot of hackers. It's a wicked cool and potentially super dangerous idea. It intrigues people on HN. Hence it is discussed to the death.

Your post is titled 'feedback please', and yet you have not really mentioned what you want feedback on. Is it your business idea? Is it your YC application? Neither of these are mentioned here. Even if they were, the most that HN users could give you would be something along the lines of 'I'm sure YC is not averse to funding non-tech people.'

<comment><AUTHOR> Well, see, now we are getting somewhere. I agree, tacocopter is super awesome, I wasn't trying to imply it wasn't. At least now I am getting some kind of responses. I suppose I should make a new title, more specific to what I am looking for. I am really looking for responses from previous YCs that started out as we did, or know others who did.

</comment></comment></comment><comment><USER3> I do believe this was posted already at least once within the last 48 hours.

How do you feel about spam?</comment>


Divide Between Venture 'Haves' and 'Have-Nots' Gets Bigger - <AUTHOR> http://www.pehub.com/111562/divide-between-venture-%E2%80%98haves%E2%80%99-and-%E2%80%98have-nots%E2%80%99-gets-bigger/ <comment><USER2> Needs an account to view. Is there any other way to see this article?</comment>


Most Requested Languages for Games - kris-master https://www.gamedev.net/tutorials/business/production-and-management/the-top-ten-languages-for-game-localization-r5255/ <comment><AUTHOR> That website looks horrible on mobile, I can barely even see the content behind the banner and navbars. "Let's make games" is such an unintuitive button to dismiss the banner as well, it looks like it would jump to a sign-up page.</comment>


Apple becomes the most valuable company of all time - <AUTHOR> http://www.bbc.co.uk/news/business-19325913

<comment><USER2> Adjusting for inflation[1], MSFT at the peak in 1999 would be worth over $800B today (AAPL hit $623B today).

[1]: <http://www.westegg.com/inflation/>

<comment><USER3> $856 bn, to be precise. Meaning Apple will have to appreciate by an additional ~38% before it actually takes the record.

</comment></comment><comment><USER4> Not adjusted for inflation</comment>


Die, VPN: We're all "telecommuters" now—and IT must adjust - <AUTHOR> http://arstechnica.com/business/consumerization-of-it/2011/10/die-vpn-were-all-telecommuters-nowand-it-must-adjust.ars

<comment><USER2> I'm not sure I see what the big issue is with VPN access.

The author complains that VPN connections choke the user's bandwidth, but I am not sure I know many examples of this. Typically through a VPN connection I will see higher latency to external internet point if the company does not allow split-tunnel routing. However, decreases in the user's bandwidth only occur if the company does not have the appropriate bandwidth available for the number of VPN users logged in. Perhaps I am just lucky, but I've never had this problem.

Regarding the pain of logging in, Cisco's new Cisco AnyConnect VPN automatically re-authenticates you to the VPN session so you don't need to keep signing in as you shift locations. Microsoft's DirectAccess allows you to have a VPN session automatically established with no additional authentication necessary whenever it finds a network connection available.

The author proposes cloud services? Those don't work too well for large companies in my opinion. In fact, I don't think they work well for small companies yet either. Google Docs just doesn't have the functionality required and STILL lacks the idea of having centralized repositories of information. If you want to share a document with your entire Google Apps organization, you can "share it" but the people in your organization must know to search for it in order to discover it. There is no way to browse "All Documents in My Company" which creates a huge pain.

Most companies and their employees, especially Fortune 100 companies, utilize "Network Volumes". Go into one of these company's and talk to the employees. "Oh, that is on my U drive, and the other documents, those are in the company wide public share on my P drive". They browse to these files seamlessly over the VPN, edit them, and they are updated on the remote server.

VPNs also HELP ensure compliance (though they definitely don't guarantee it). You no longer need to worry whether every single cloud service you are using has the proper security configuration. There may be some wiggle room here, but I know that with Active Directory Group Policies, I can really lock things down on users through one centralized management interface. If I have 10 cloud services, I have 10 different things I need to worry about locking down.

<comment><USER3> The problems I've had with VPNs are probably down to misconfiguration, but the primary one was limited bandwidth over the VPN, not limited bandwidth to the internet. Living in Europe, but connecting to a VPN server in California, reduced a 4Mbit connection to something closer to 64kbit - I hypothesized that whatever corresponds to the TCP window on the VPN was configured with too low a size, and the latency was killing stream throughput.

<comment><USER4> Same problem, same numbers. (China -> Atlanta). Is your VPN Juniper IVE by any chance?

<comment><USER3> The only non-generic client is Nortel, I'm not sure what's at the other end (but I'd guess Nortel).

</comment></comment></comment></comment><comment><USER5> This reads as a very ignorant article and doesn't even come close to addressing the issues that are faced by enterprise IT teams. As soon as you let users bring their own devices (whatever they are) onto your corporate network your security concerns now include those devices. Who knows what Bob in accounting is letting his kid do with his laptop when he gets home at night. All the sudden your entire network is compromised or infected because using a VPN or employer provided devices is "hard".

The bandwidth argument is really not valid anymore. Just about everyone can get broadband at home and most sensible organizations will allow split tunneling so your non-work related traffic can go out whatever local connection you're on.

<comment><USER3> I think that's a problem with enterprise IT mindset, rather; this idea that there's a binary distinction between inside and outside, trusted and untrusted, and therefore whatever you connect to the network must be vetted because it suddenly has all this trust by default.

I think it's pretty inevitable that the evolution will be in the direction of distrust by default, and internal apps will slowly require more secure programming models, incrementally becoming more like ordinary public-facing sites. The reason is that the trust-by-default (once you're on the "inside") model is too centralized and can't scale to the increased number of devices. Employee devices will need hardening against intrusion from the corporate network just as much as the network needs hardening against intrusion from Bob from accounting; because you stop infections spreading by stopping the vectors for transmission, and that works from both ends.

<comment><USER5> There is a distinction of trusted and untrusted, but I wasn't implying a trust by default method because that's not good either. I also wasn't trying to imply that a vetted device is necessarily a trusted device. For example, we allow Blackberry, Apple and Android devices on our network as "officially supported" mobile devices. We don't trust them but we know if something goes wrong we can issue a single command and wipe the device which effectively ends all access that device had/has to our network resources.

The point is, and you hit on it, that you have to prevent intrusion, compromise or infection from all places and allowing people to work on their own hardware or without a VPN means that job becomes exponentially more difficult.

</comment></comment></comment><comment><USER6> I'm curious about the part about no one liking dealing with VPNs. I have only used an OpenVPN network for my private use, not any entreprise-class system, but I don't have much to complain about. Once I got how it worked, it was pretty painless to use.

Is it due to the policies and the way they are applied in big companies ? The tools ?

<comment><USER7> Enterprise-class systems are far worse. If you know what you're doing, you can tune any IP tunneling solution into something the coexists nicely with your native network. That's not how any corporate VPN that I've seen works. They all hijack your box, sending all traffic down the pipe to the company firewalls and killing latency. Sometimes it's worse: they try to be smart, and send local traffic locally, but they still try to use their own DNS servers, thus breaking local addresses from e.g. the DHCP server at your local coffee house.

It's just a disaster. And the problem that it's intended to solve isn't actually solved by pretending that data "inside" the corporate network is safe. Sane IT strategies always need authentication and encryption inside the wall too. So why bother with the VPN?

</comment></comment><comment><USER8> This doesn't strike me as very realistic. Aside from the issue of token-based security vs. other auth mechanisms, how else are you going to establish a secure connection to a private network aside from a VPN-like tunnel?

<comment><USER9> The point seems to be that if you move most of your IT onto the public Internet aka cloud (with SSL + passwords) then employees don't need to access any secure network.

</comment></comment><comment><USER10> This article really comes off as a prima donna developer, who may understand how infrastructure works, but not why strategic decisions are made.

Security is the primary driver for VPNs, and a significant driver for IT- controlled devices. Maintainability of the infrastructure is another large drivers for devices. And finally, cost control of your support organization is easier when they have a limited scope to what devices and configurations they will support.

It isn't that his points are incorrect -- They are just pretty minor compared to the actual business drivers of Enterprise IT.

</comment><comment><USER11> VPNs these days are one-click to establish and can be setup to use the same credentials as a work machine's login. You can often have them remember your credentials too so that there's no extra work involved, though this should be limited to situations where employees encrypt their file systems a la FileVault or BitLocker.

I agree that it's becoming less necessary as more and more services use strong, end-to-end encryption. However, using a VPN reduces the attack surface area of a network. SSL guarantees that nobody can eavesdrop on the communication but it doesn't guarantee who you're communicating with. Restricting access to the VPN and internal networks means that any 0-day bugs have little impact on your security as less services need to be public-facing.

The biggest threat with telecommuters is that you leave security up to them and who knows what trojans/rootkits lurk undetected on their machine to your antivirus/antimalware software.

<comment><USER12> > VPNs these days are one-click to establish

DirectAccess is a zero click connection where the company network and resources are available any time you want it. I tried it for a few months and it works like a magic.

For things like security and data protection, you always have bitlocker

</comment></comment><comment><USER13> If BYOD and telecommuting was just held up by "security" it would've been steamrolled a long time ago. Very few organizations take security that seriously. Articles like these frame IT strategy about as accurately as a courtroom drama depicts the legal process.

100% of IT decisions you'd probably disagree with are driven by responsibility and/or costs.

</comment><comment><USER14> A fairly narrow set of applications listed on the 2nd page of the article. I think an important reason promoting the use of VPN services is not that you are protecting yourself from your users, you are protecting yourself against poorly written 3rd-party or in-house applications.

There are a lot of companies that are forced to use really large, complex applications that combine a myriad of different technologies. It's one thing to patch servers, it's another task altogether to try and maintain and update applications that stretch across mainframes, various database and mid-tier applications, with mixed-web/thick client access. The dependencies alone are a nightmare to try and manage.

To me, this is the most important reason for securing remote users. I want to protect them, and the company, from the medusas.

</comment><comment><USER15> This is pretty bad advice for most companies.

It's undeniable that people are moving to Bring Your Own Device for mobile, and that with third-party hosted cloud apps, VPNs are less meaningful. However, in a lot of cases, you have SOME applications which aren't secure enough to put on the Internet bare, and also having a central point for compliance makes a lot of sense.

While it would be nice to think phones/tablets are more secure due to having passcodes, unfortunately, Apple and Android don't actually have reasonable device security to protect from brute force against a password. You can easily image even a LOCKED device, then brute force it offline). Only blackberry seems to have hardware security in place to protect against this.

</comment><comment><USER16> Also let's not forget SSL is kinda a mess. Not to say that VPNs aren't either though. It's tough out there. :)

I'll be using sshuttle once I get our external ssh gateway up.</comment>


Show HN: my weekend project, Swapshot! - <AUTHOR> http://itunes.com/apps/swapshot/

<comment><USER2> _We are unable to find iTunes on your computer._

Could someone post a summary for us Linux users?

<comment><USER3> This link leads to a summary page if you don't have iTunes installed:

<http://itunes.apple.com/us/app/swapshot/id432027349?mt=8>

</comment></comment><comment><USER4> Wasn't Photoswap the next big thing in 2008? <http://www.wired.com/gadgetlab/2008/09/photoswap-bring/>

<comment><USER5> I used to have that app. I had a couple fun interactions using the reply feature.

</comment></comment><comment><USER6> This is cooler than color. And im willing to bet it took 41 million dollars less...

</comment><comment><USER7> So, it's an automated way of showing me strange men's penises?

<comment><AUTHOR> No penises yet!

<comment><USER7> Sorry, I'm trying to take them as quick as I can, but the camera on my phone is slow. :)

Anyway, me neither - mostly people that look like they're trying it out by taking a picture of whatever's nearest.

</comment></comment></comment><comment><USER8> Your description is a bit lacking - what does this do?

<comment><AUTHOR> You take a picture, and it returns you another picture taken by another Swapshot user.

Just an MVP, if it gets a little bit of traction I'll see what I can add to it (e.g. "taken 5 miles away, 4 minutes ago"). :)

<comment><USER9> I had the same question. You should probably explain a little more in the app's description at the very least.

Like other social media type products, I think people want to see that other people are using it before using it themselves. You don't have any signs of life when opening the app to let the user know if anyone's home. No counter of photos uploaded, no number of "online" users, no stream of incoming pictures.

I guess further down the line it would be nice to know if the images you get are somehow more interesting than just randomly scraping images.google.com. Voting, being either close of far geographically, color similarity, temporal locality. Anything.

<comment><AUTHOR> Agreed, will add more stuff to it if it has some legs.

<comment><USER9> I would probably not give up if this version of your app fails to take off. Instead I would be looking for feedback and acting on it. It will probably take a few iterations to prove to users this is a real product that's worth taking seriously.

</comment></comment></comment></comment></comment><comment><AUTHOR> Check out pictures taken with Swapshot here: <http://swapshotapp.appspot.com/random.png>

</comment><comment><USER10> Cool stuff. Will check it out. Did you do the graphics and icons yourself? What framework did you use to manage the backend exchanging of photos?

<comment><AUTHOR> A little API on App Engine is the backend (Python). Yeah, did the graphics stuff myself.

</comment></comment><comment><USER11> I uploaded multiple photos but always get the same photo back. Is this a bug?</comment>


A thing that keeps me up at night - <AUTHOR> https://twitter.com/patio11/status/1192006436852645888 <comment><USER2> Looking at the previous tweet in the thread this one quotes, it talks about trying to get a £600 donation.

But that was in 1938. Using the Bank of England's inflation calculator[0] that works out to be £39,671 in 2018 prices.

£1,150 (the total in the tweet) works out to be £76,037 in 2018 prices.

Though not a _huge_ amount by modern fundraising standards, that's hardly "really sweating the next thousand dollars"

[0] [https://www.bankofengland.co.uk/monetary- policy/inflation/in...](https://www.bankofengland.co.uk/monetary- policy/inflation/inflation-calculator)</comment>


The Unbundling of Excel - <AUTHOR> http://tomtunguz.com/unbundling-of-excel/ <comment><USER2> Earlier: [https://news.ycombinator.com/item?id=14411624](https://news.ycombinator.com/item?id=14411624)

<comment><AUTHOR> Thanks for the heads up, essayist. Will be much more careful not to flood the forum with duplicates next time.</comment></comment>


Ask HN: How would you leverage a network that doesn't know what you do? - <AUTHOR> As in, to obtain a job through someone in that network. That's my situation at the moment. I'm a software engineer who doesn't have any peers that work a similar job. I also lost my job, and socially I mostly keep to myself as an introvert. Also, I am not entry-level in this. I have been in the field since 2007.
I was laid off from my last job and my ex-employer doesn't know anyone else that is looking to hire a software engineer. He just sometimes messages me saying "I might have some work for you to do" as short term gigs but it's nothing full-time and not sustainable at all to make a living of.
With that said, I started submitting job applications as a total stranger, but also tried hitting up the people I already know. It is then that I realized none of my local  friends are in software engineering.
I posted an announcement on my Facebook wall saying I'm currently in the market and that if anyone knows anyone that's hiring for a SWE to send me a message.
I didn't get replies from the post (have 120 or so FB friends). One of my friends re-posted it with similar wording, but he didn't get any replies either.
So now I'm thinking that I'm approaching my network wrong. There has to be a better way to find the diamonds in the rough. If you had to find a new job and don't have one, in what way would you approach a network if it was like mine? <comment><USER2> I think you may be confusing friend network and business network. After 10 years in the field, it is _inacceptable_ that you don't have at least a dozen of past colleagues to call to get an internal referral. I personally don't use Facebook but it doesn't strike me as the best platform for that. Your buddies and college friends are one thing, your ex coworkers/reports/managers are another.

TBH, it should be easy to find a gig simply by applying to open positions that you find on interesting companies websites. However, I strongly recommend that you start working more seriously on your professional network in the future. Make sure you keep in touch with good colleagues, make sure you remain in good terms with everybody, etc.

<comment><AUTHOR> I have a couple of work colleagues. I don't know if it makes a dozen. All but two of them have left the state since I've worked with them, so I can't meet most of them face to face anymore. They all do seem to have better careers than I do, though, so the potential to find a good position through them seems high. I have them on LinkedIn and have let several of them know that I'm currently looking for software engineer work. Currently they just don't know of any open positions.

</comment></comment><comment><USER3> Have you tried: angel.co triplebyte.com

they are both great resources for software engineers looking for jobs!

angle.co is a great place for finding a job in a startup (of all shapes and sizes).

I have personally never tried triplebyte.com, but I have head good things about it.

Also, go to meetups (meetup.com) around your area and start networking, it's never too late to start networking and meetups are a great place to start networking if you are new to it...

You can also start a blog+portfolio and go freelancing for a while. Most times freelancers get hired as full-time employees if they are working on large projects and the client recognizes the value you bring to the table and wants to retain you.

</comment><comment><USER4> Type up your CV and find recruiters.

They sometimes get a bad name, but that's also sometimes undeserved, and the good ones are like gold; they will often know people in their clients' business well. That's your pre-made network.

No need to show loyalty to one recruiter at the start. Get in touch with a few, and continue with the ones you like. You'll also be in their rollerdex forever more.

As you're still on good terms with your former employer, mention, emphasise this - you're laid off because of circumstances out of your control, not performance related.

</comment><comment><USER5> Play the numbers game. You definitely have software development experience so apply 'as total stranger' to as many places as you can through their jobs section. With the giants (Google, FB, Amzn, etc) it may be harder to hear back from this way, but mid-sized and smaller companies are more likely to respond to you. While applying for internships and new grad positions, overall I applied to more places 'as total stranger' as opposed to via referrals from friends and received responses.

<comment><AUTHOR> Oh I'm playing the numbers game. Hitting up companies of all sizes. But I don't think it's something I should be doing for all your career.

>While applying for internships and new grad positions, overall I applied to more places 'as total stranger' as opposed to via referrals from friends and received responses.

I'm not a fresher, though. I have been working in the industry since '07\. And yes this is how my network looks like. Zero fellow programmers, zero leads (apparently) to get work.

I never thought of the career as a chain of jobs where one job leads to recognition that helps you more easily get the next job. I thought one could do fine just looking for work in a vacuum every single time. But guess I was wrong...

<comment><USER6> Have you tried to ask previous coworkers maybe they know somebody? There are certainly some programmers in your network. but mybe not on first "node".

<comment><AUTHOR> Yeah. I usually ask if they also know anyone that is hiring. So getting into second-degree connections. It's weird considering I live in a big city. I felt like I was dealt a bad hand, but just made it worse.

</comment></comment></comment></comment><comment><USER7> Maybe you're looking at it a little wrong. Maybe some of your friend run a business and need some IT help, maybe they need a website?

Try reframing it from their perspective, not what they can do for you (tell you if people are hiring) but what you can do for them (make them a website, sort out their IT etc)

<comment><AUTHOR> Well, I did already post an announcement on Facebook saying that I'm looking for web development/software engineering work, and it got reposted by a friend. It didn't get any replies.

I also occasionally PM some of my friends on Facebook and on Hangouts if they are hiring or looking for web development help. None of them have any idea. I've been going on regular rotation with the PM's for about a year (I've been unemployed that long) and they always say sorry, they don't know anything about jobs for me.</comment></comment>


Federal appeals court upholds ban on gay marriage - <AUTHOR> http://www.latimes.com/nation/la-na-court-same-sex-ban-20141106-story.html

<comment><AUTHOR> Here's a PDF of the actual court opinion: [http://cases.justia.com/federal/appellate- courts/ca6/14-5818...](http://cases.justia.com/federal/appellate- courts/ca6/14-5818/14-5818-2014-11-06.pdf). It includes the dissenting opinion by the third member of that panel as well, and makes for an interesting read.</comment>


High Frequency Traders Fall on Hard Times - <AUTHOR> https://www.wsj.com/articles/high-frequency-traders-fall-on-hard-times-1490092200 <comment><AUTHOR> They money quote here:

>> _Revenues at HFT firms from US equities trading were an estimated $1.1 billion last year, down from $7.2 billion in 2009, according to research firm Tabb Group._

It's interesting that 1) that such a comparatively small portion of Wall Street came under political fire (whether or not it was justified) and 2) that the race to the bottom has slowly eroded profits across the industry, as it becomes more and more expensive to compete.

I've heard anecdotally from past and current members of the HFT industry that it's long past its glory days, but those figures are really telling.</comment>


California Threatening Developers: $2500 Fine/Download For Privacy Violations - <AUTHOR> http://techcrunch.com/2012/11/01/california-threatening-developers-with-2500-fine-per-download-for-privacy-violations/

<comment><USER2> The article doesn't mention jurisdiction.

I don't think that the nightmare of having local governments pass legislation binding creators of things that can be downloaded in their jurisdiction is fully appreciated.

<comment><USER3> Do you think they can fine developers outside of CA?</comment></comment>


Ask HN: Can you create a "hacker news" email alert for defined keyword(s)? - <AUTHOR> For example, I would like "new" posts with the keyword "spatial" to be sent to my email. I usually search through HN Search to do this. Here is an example:<p>https://hn.algolia.com/?sort=byPopularity&prefix=false&page=0&dateRange=all&type=story&query=spatial <comment><USER2> Markrankin, I understand that everyone has very different knowledge/experience levels, but please research and become resourceful prior to posting a generic "Can you create 'x'".

Think about the small pieces required to build what you want and then research how to create those small pieces.

As an example since you want to pull specific pieces of information from this site, research API tools. This process of investigation/creating a solution will help you.

API Example: [http://hn.algolia.com/api/v1/search_by_date?tags=story](http://hn.algolia.com/api/v1/search_by_date?tags=story)

Best of luck.

<comment><AUTHOR> Thanks for your help.

</comment></comment><comment><USER3> F5Bot can do this easily.

[https://f5bot.com](https://f5bot.com)

</comment><comment><USER4> [https://www.hnwatcher.com/](https://www.hnwatcher.com/) (found via google, not a user myself)

<comment><USER5> Been using this for the past couple years and it's a great service.</comment></comment>


Parallel Programming with Microsoft Visual C++ (2011) - <AUTHOR> https://docs.microsoft.com/en-us/previous-versions/msp-n-p/gg675934(v%3dpandp.10) <comment><AUTHOR> Although this book is from 2011, it is a very forward looking book. It describes Microsoft's C++ PPL library, which has a large number of similarities to Intel's Thread Building Blocks library. In fact, Intel's TBB includes a PPL compatibility level.

Overall, this book and the PPL library is an excellent example of C++11 code. Lambdas are used to describe tasks (which are kinda like threads but different). An overall runtime prevents "oversubscription" of parallel loops, and also provides a background "Resource Manager" which helps perform work- stealing when a core runs out of stuff to do. As such, this methodology allegedly scales well into NUMA architectures.

OpenMP is probably what more people are familiar with, but the task- decompositions of this library seem to be way more flexible and has a much lower chance of oversubscription and/or undersubscription.

In short: PPL and TBB are "highly advanced thread pools". With cooperative multitasking and better overall resource management. And this book seems to serve as a good introduction to this methodology.

\</comment><comment></comment><comment>-

I'd love to compare TBB and PPL one day. For now, I think PPL is more convenient since I'm writing a Windows program. But TBB would basically be the "Linux" version of this library and methodology.</comment>


There Is No Difference Between Male and Female Brains - <AUTHOR> https://www.theatlantic.com/science/archive/2018/06/there-is-no-biological-difference-between-male-and-female-brains/563702/?single_page=true <comment><USER2> The brains of men contain stronger front-to-rear connections while those of women are better connected from left to right.

[https://www.the-scientist.com](https://www.the-scientist.com) /the- nutshell/male-and-female-brains-wired-differently-38304

<comment><USER3> Yup. This OP article is PC pseudoequality BS trying to force an agenda rather than look at the data. There are far more numerous genius men than women because of the wider variance (not expectation) of intelligence in men vs. women; and there's also more intellectually-challenged men than women. Furthermore, testosterone, regardless of gender, is related to increased facial hair, wider jaw, bigger genital bits (female roids users' external clitoris tends to grow), more aggression and more sexual contact. Furthermore, there are definitely changes in fetal brain development from testosterone exposure via PTT: [https://en.wikipedia.org/wiki/Prenatal_testosterone_transfer](https://en.wikipedia.org/wiki/Prenatal_testosterone_transfer)

</comment></comment><comment><USER4> Is there a way to filter out articles from The Atlantic when reading HN so that I don't see them?

Edit: Actually, this is not even the title of the article, I expected it to be way stupider. Could you please correct it?</comment>


Ask HN: large system monitoring - <AUTHOR>

I'm an admin at a fairly large company with plenty of database servers, virtual machines and all kinds of custom distributed software that processes a lot of data. I'm interested to hear what others are using for monitoring large systems. What kind of system did you put in place? How do you process logs, events, hardware and software failures etc. Do you use a proprietary system or something you have built yourself? <comment><USER2> While working as a web developer at a Fortune 500, we had these same sort of issues. Web sites would go down and we'd get a call from someone trying to use it. This was 10 years ago...

To learn about and fix these problems before the customer, some interns built a scheduled web site poller that would check the response for error codes and timeouts, push the status to a database and send an email to subscribers.

They built it, knowing very little about programming or anything, in just a few weeks and reduced our customer calls dramatically. We were aware of the problem and resolved it reducing customer complaints substantially!

Anyway, that kind of thing is very easy to build, just go do it. Monitor at the application level for failures, most errors at the infrastructure level bubble up anyway so you can catch them at the end point.

Now, if you want to do scalability projections or monitoring of non-web apps, this won't help...

</comment><comment> patrickg-zill What kind of monitoring are you looking for?

Generally what is out there is either

a) long term graphing and trend analysis (that lets you determine that you will need more disk space in 3 months) or

b) watching for a service to go down, in which case you send an email or SMS.

<comment><AUTHOR> I am after both of these but also I need a way to aggregate a lot of log files and perform actions like "If there was no log entry X in the last N days send an email" or "If system A wrote N entries to database and system B did not process any in time T perform some action or raise an alarm". I would guess a kind of aggregating of events and running scripts based on what happened. All the systems could be modified to log to an additional place if needed.

<comment><USER3> I can't say I've used it, but this sort of sounds similar to what splunk (<http://www.splunk.com/>) does.

</comment></comment></comment><comment><USER4> We have lots of people who use Paglo to monitor data center infrastructures. In fact we use Paglo extensively to monitor itself. The best thing is that it is easy to feed in custom data into Paglo and trend that alongside other information about the infrastructure. For example, I watch the side of queues in our messaging system together with the load averages, memory and bandwidth usage of key servers.

We also use monit to monitor and restart processes under Linux. It is great for handling a couple of services which leak memory and need to be restarted periodically.

</comment><comment><USER5> Ganglia <http://ganglia.info> is pretty easy to setup and is good for charting simple machine statistics.

</comment><comment><USER6> Would love to hear as well, as I'm thinking about how to do the same on a much smaller scale. Nagios/SNMP seems like a good infrastructure to build on.

<comment><USER7> Nagios is OK for "is X > Y?" type alerting, but it's very poor at "has X changed since T?" and forget "is X greater than it was 24 hours ago AND greater than it was 1 week ago and is Y as well, then page me".

<comment><USER8> Apparently it also has scalability problems with very large networks - ask the Facebook Site Reliability team. They have 20,000 servers and tried to make Nagios work repeatedly before writing their own tools

</comment></comment></comment><comment><USER9> monit & munin are of great help to me.

<comment><USER10> Monit has been very useful to me as well.

I also use capistrano's command: "cap shell" to easily type the same command on all the servers.

<comment><USER11> I use monit and munin with capistrano tasks to install, update and configure them. Right now I'm monitoring a couple hundred of containers and hosts at work, mostly mail servers.

</comment></comment></comment><comment><USER12> cacti is pretty useful for graphing, just pings snmpd on each server, and can do cool custom stuff</comment>


A look inside the Tesla Motors factory at their holiday party - <AUTHOR> http://dan-menard.tumblr.com/post/41055781741/tesla-factory

<comment><USER2> This is so cool. Does anyone know how to set up an official factory tour? I didn't see it on their website.</comment>


Ask HN: Which is your favorite business credit card and why? - <AUTHOR> My cofounders and I have gotten to the point where we don't want to use our personal cards for the business anymore, so we're trying to select a business card, but there are so many choices.
Some give airline miles, some points, some cash back, some have fees after the first year, etc.
Anyone have a favorite they like or any warnings of what we should stay away from?  Anyone know of a good web site to help us compare, or any cards that are geared specifically towards up and coming tech companies?
Thanks! <comment><USER2> Good question. I'd like to know if going with AMEX is still as limiting as it used to be. I recall many restaurants not accepting it and only VISA and Mastercard.

<comment><USER3> AMEX has much broader acceptance than it used to, given that more retailers are going to CC services that accept all. In fact, of those places that accept only 3 cards, Discover was left out more than AMEX.

One of the few that don't accept AMEX but do Discover is the San Francisco Giants (for tickets).

</comment></comment><comment><USER4> You should certainly not use your main personal cards on the behalf of the business, simply for segregation of accounts to assist bookkeeping. (This goes for all founders from day one. Credit cards are available like candy; get one for business use and business use only early, early early.)

Whether you get a "business card" is less important; for many founders/companies they're substantially harder to get than personal cards. You'd think this distinction would matter a lot, but practically speaking the principals of most small companies will be asked for a personal guarantee on any card issued to the business anyhow, so that's a distinction mostly without a difference. _Typically_ they also come with worse protections and terms than consumer cards. (e.g. I have two cards from BoA, one in the name of the business with a personal guarantee and one issued to myself as a natural person. The business card has 1000 basis points higher APR, worse protections, lower limit, and an equivalent rewards program.)

As to which card you pick: there exist copious websites which will attempt to sway your opinion on this, mostly to earn an affiliate commission. There also exist a lot of people with strange hobbies online, and maximizing the value of CCs/reward points/etc is a hobby which is quite well-represented. I'll save you a few hours: the SPG (Starwood Preferred Guest) Amex almost always wins. Personal favorite perks: bonus points awarded for Uber trips during hotel stays (i.e. business travel, when I consume a _lot_ of Uber), free Wifi at SPG properties and Boingo (sadly not Gogo), and a very favorable SPG-points-to- dollars-saved-on-hotels ratio. (I recently took a free night in Austin for 16k points; due to it being a high-demand weekend the hotel was quoting about $500 for a cash stay. This implies a 3.1 cents a point valuation, which is much, much higher than points are typically worth -- Delta miles and IHG points, for example, are a lot closer to a penny apiece.)

Obligatory maximization advice:

1) The most important thing you can do with business credit card statements is _make sure you do not forget to get them entered into your books_. Your tax rate on the marginal dollar of profit is likely to be 30%+ -- this totally swamps the value of your points/saved interest if you screw up even a page worth of CC statements once a year. (Ask me about the time I almost had $14k of marginal income imputed due to a page which fell on the floor at tax time, for a $5k extra tax bill.)

2) Selling more software is a much, much faster way to make money than exploiting the difference between a 1% cash back (trivial) and the Optimal Possible Business Travel Planning. The people who invest a lot of themselves into travel hacking largely do it because it's a fun, somewhat intellectually engaging hobby.

Websites to read on this topic (and, like mentioned, they make their money when they get you to apply for a credit card):

ThePointsGuy.com Ramit Sethi @ iwillteachyoutoberich.com

Google for their most recent stuff. The best promotion changes on a week-to- week basis. It's, again, really, really not worth your time to chase it given that you could be running a software business instead.

<comment><AUTHOR> Thanks for the great info.

Totally agree with you about spending time building a company instead of chasing rewards. Basically my goal is to find a card where I just spend normally and then magic rewards happen, without any sort of planning (since as you said it's mostly a waste of time).

I'll check out those sites and the Starwood Amex.

Thanks!</comment></comment>


Root Insurance raises $100M for a $1B valuation - <AUTHOR> https://techcrunch.com/2018/08/22/a-new-unicorn-is-born-root-insurance-raises-100-million-for-a-1-billion-valuation/ <comment><USER2> Looks like another "cherry-pick your customer" fin-tech startup. They do extremely well in the first stages of growth, but exhaust the potential market pretty fast and then go into turmoil when the VC's rightfully demand growth. With CAC in hundreds of dollars, the well dries up fast. I would be delighted to see them break this barrier and flourish.

</comment><comment><USER3> So drive slow for 1-3 weeks every time you want a new discount and then drive normal. If this literally dropped my insurance by $600+/yr (I pay over $1200/yr for one car) then I'm totally down... I wonder how they determine your risk. Mainly speed and g-forces I'd guess. So just use typical efficient driving techniques (large buffer in front of you to avoid using the brakes, accelerate slowly, prefer constant speed vs varying) and then go slow through turns while observing all speed limits.

Kind of doubt they do this discount for certain cars or demographics tho. Young men, basically.

God I'd love this for motorcycle insurance. S1000RR goes from $4k+/yr to insure to 2k. Woo!

<comment><USER4> I wouldn't be surprised if the most useful features were things like time of day driven, total time driving, locations driven to, etc. Those are also more annoying to game than g-force etc. Of course, using some of those might be a recipe for a discrimination lawsuit.

</comment></comment><comment><USER5> Aviva here has it's Drive App, you need to drive 200 miles to get a score from 1 to 10 which discounts your premium, though they only go up to 28% discount vs. 50% from Root.

[https://www.aviva.co.uk/car-insurance/drive/](https://www.aviva.co.uk/car- insurance/drive/)

</comment><comment><USER6> meta note: this is one of the worst written articles on techcrunch I've ever seen.

I visit the site only through random links from HN, but if this is the median article quality these days...

</comment><comment><USER7> Anyone know how this compares to Metromile? I see a lot of my friends who have cars in San Francisco switching to that and saving money.

Aside: I thought this was going to be about cybersecurity insurance. Root insurance would be a great name, and I think that's an industry that should see a huge amount of growth in the near future.

</comment><comment><USER8> Oops, I thought it said Robot Insurance raises $100M.

[https://www.youtube.com/watch?v=KXnL7sdElno](https://www.youtube.com/watch?v=KXnL7sdElno)

</comment><comment><USER9> Does anyone use Root? Do you need to leave the app on constantly while you drive?

<comment><USER10> I interviewed there in 2016 and you only needed to have the app on while driving for a week or two before you got a quote. After you got the quote you didn't need to have the app on. It's possible this has changed since then; but back when I spoke with them they were clearly trying to balance collecting the telemetry needed to give good discounts with the natural privacy concerns.

<comment><USER11> Hey Lionel! I bet they have a lot of Braintree alums interviewing there. Dan is great to work with.

Also, we should catch up!

</comment></comment></comment><comment><USER12> inb4 RootInsuranceDiscountGuide.com and the value proposition diminishes to 0</comment>


Sans Forgetica – A font designed to help you remember study notes - <AUTHOR> http://www.sansforgetica.rmit <comment><USER2> See [https://news.ycombinator.com/item?id=18129075](https://news.ycombinator.com/item?id=18129075) for last week's discussion. Great name for a typeface though.</comment>


How can I dilute a partner that has added absolutely no value to my company? - <AUTHOR>

At the very early stages my company we joined an "incubator" that has proven completely worthless over time. Now that I have new investors coming in, they are questioning that incubator's worth and its complicating negotiations with them. Is there a way in which that incubator can be diluted down or to have them grant part of their shares to new investors? <comment><USER2> I wonder if you could simply ask them to sell the shares back to you at a fair price? Diluting a stakeholder purposefully can have unintended consequences (on your reputation, on employee and investor morale, etc). Maybe best to handle it gentlemanly, so that nobody else starts fearing that they're next.

As a personal example, Ive walked away from job offers when I found out the founders squeezed out an early developer's equity. All things being equal, why would I assume Id get any better treatment? This situation isn't quite the same, but you get my drift.

<comment><AUTHOR> Thanks I had not seen that unintended consequence.

</comment></comment><comment><USER3> They're not new investors until the check clears. Complicating negotiations in ways that are not reasonably solved is probably a way of saying "no". Stop wasting time. If they want to invest they will based on the prospect of a big upside not over a minor shareholder's equity.

Normally I say "good luck" here. Don't do the wrong thing because when you lose you'll not just have lost but done wrong while trying to stave off defeat.

</comment><comment><USER4> To get some ideas, watch The Social Network.

</comment><comment><USER5> dissolve the corporation - rebrand and start a new one. Hollywood use to do this in the 80's to avoid residual payments.

<comment><USER6> That approach will have consequences: If new brand will greatly succeed - leftover previous shareholder can easily prove that it was done to defraud him and leave him out of the game.

If it will flop - then of course no one will have problems with it.

</comment></comment><comment><USER7> Assuming you have control or influence over 51% of the shareholding, then why not just issue more shares?

<comment><USER8> Beware - fiduciary issues may abound if you're a majority shareholder.

</comment></comment><comment><USER9> Which incubator is it?

</comment><comment><USER10> Talk to a lawyer.

<comment><AUTHOR> Thanks, doing that already... Just wanted to hear from people who have experienced this problem to learn how they managed it if at all.</comment></comment>


Ask HN: Best Noise Canceling Headphones - <AUTHOR> Hi all, I have Bose Quiet Comfort nc headphones from 2004. I loved them. Electronically, they still work great, but mechanically they are on their last legs.
I've had a hard time finding what seem like good reviews online.
My use case is primarily for airline flights.
Can anyone make any suggestions? Any thoughts about in ear vs over ear? <comment><USER2> I've had Sony WH-1000XM2 for two years now.

Bought it just before boarding for a 7-hour flight, and it was great. Even after a dozen flights since then, I'd still recommend it anytime. Its noise cancelling is amazing (source: I've tested it in comparison with Bose QC35, everyday in the shop before going for this one).

The XM3 has been released a while ago (minor update IMHO), has good reviews and is regularly discounted. With Black Friday almost there, you should get good deals on it.

I personally don't feel the need to buy it since I have the XM2, but I could get it for my wife.

<comment><USER3> I've had the XM3 for a year. It's a great set of headphones and the noise canceling works great. It does have a few peculiarities to be aware of.

My biggest issue is you can't use the noise cancelling or the bluetooth connectivity while it's charging. You either have to wait for it to charge (which is absurdly fast. 10m will give you at least 4-6 hours) or you have to plug in an 1/8th inch audio cable.

The touch controls are kind of odd. If the headphones are tilted slightly forward or backward and you try to increase the volume, you can accidentally trigger backward or forward. It also doesn't trigger consistently. Sometimes, I have to try once or twice before it recognizes the gesture. However, Cupping the hand over the right headphone to hear what's going on around you works every time and is priceless in an office environment.

The built in microphone is terrible. Don't use it. I use either the built in microphone in my 2015 macbook pro or the Antlion ModMic Wireless.

If you live in an area where winter is a thing and like going for walks while listening to podcasts, then don't use the gestures at all. Once the temperature dips below 32F, touching the touch-sensitive controls even once will cause the headphones to switch to "ambient sound" mode, where it pipes in the sounds around you. You can't switch it off and you can barely hear the podcast. To sony's credit, this isn't permanent. You can reboot the headphones and it works perfectly again, provided you avoid those touch controls.

All that said, I don't regret my purchase in the least. They're great headphones and I'll use them until they die on me.

<comment><USER2> Hey, thank you for the extended review. I agree on all the points you've made.

Concerning the microphone, yes it's terrible enough for me to avoid taking my calls with it. So whenever I have a incoming call in the middle of my music/podcast, I have to take off the XM2 and put on a tiny bluetooth earset (both connected to the phone). A bit cumbersome and not great.

For the touch controls, I live in a very hot (tropical) area, so no chance of having winter here ^^

</comment></comment></comment><comment><USER4> I've had:

1\. Bose QC-15

2\. Bose QC-25

3\. Bose QC-35

4\. Bose QC-35 ii

5\. Bose 700

6\. Apple AirPods Pro

Far and away my choice now is AirPods Pro. They are comfortable to wear whilst sleeping on a flight (over ear can't be worn comfortably), and the noise canceling is significantly better than the Bose.

The only downside for me is battery life (I get about 5hrs out of them).

<comment><USER5> For sleeping on a flight, you can switch to a $0.25 pair of earplugs. Today's technology consumer seems to forget about the simple and obvious things.

<comment><USER6> Earplugs are great, but they can't play the podcast I use to fall asleep (Sleep With Me).

Without it, it's hard to quiet the racing thoughts in my mind that keep me up for hours.

</comment></comment></comment><comment> q-base I have tried quite a few different as I value th sound quality as high as the noise cancelling.

I originally had Sennheiser Momentum Wireless 2. They had amazing sound, connected quickly and quite good battery life. They were however not that comfortable for long durations as the headband lacks padding.

I then bought B&O H9 which was almost as good sound quality wise but a lot more comfortable. They however ended up having problems with bluetooth and I had to switch them.

Both Sony MX3 and Bose QC35 have a way too synthetic sound to them for my taste. I then tried the third gen H9 but they did not sound as good as my old ones for some reason. I then tried the new Sennheiser Momentum 3 which sounded quite good, with really good deep bass, but it lacked some control at places and was just a very large headset.

Then finally B&W came out with the PX7 recently and once I tried those I just had to have them. Their sound is almost bar none - at least to my taste, and their noise cancelling is exceptional on par with MX3 to my ears and finally they have extremely long battery life.

So 4 weeks in or something like that, I am really loving my PX7's and would recommend giving them a listen.

</comment><comment><USER7> I have the QC35 and the WH-1000XM3.

The Sony have punchy sound. If you're a bass head, you are going to love them. The application that goes with them also gives you a lot of control. However, after playing with all the settings for a few days, I found myself not touching them ever again.

For noise cancellation on airline flights, the Bose do a better job. Even after adjusting the Sony to the aircraft pressure level. Maybe the Sony are better at canceling other people's voice, but they are not as good as the Bose to cancel the noise of the aircraft engine.

The Airpods Pro also do a surprisingly good job at canceling the noise of the engine. During my last flight, I used the Airpods Pro _and_ the Sony on top of them. Not very comfortable, but noise cancellation was amazing :)

When it comes to comfort, the Sony tend to hurt the top of my head after a while. The Bose are more comfortable.

<comment><USER8> I have experience with both WH-1000XM3 and Bose QC35 II and I must say, your description is spot on for both headphones. Bose QC35 II has a very balanced sound spectrum and I like them a lot when I am listening relaxing music and everything. Sony WH-1000XM3 has great bass and the noise cancelling is really good but I like balanced headphones more, so I just go with my Bose instead.

<comment><USER9> This is contrary to my personal experience so I would recommend people test it for themselves. The Sony to me sound far more balanced compared to the muddy, bass-heavy Bose.

I love the Sonys, with a couple caveats that have been mentioned: hand gestures are a gimmick (sometimes skips a track if you remove your headphones the "wrong" way), default charging cable is too short, and my number 1 pet peeve, the announcer voice (for low battery, changing NC modes) mutes the sound, and those announcements are slooooow, which means you sometimes have to skip back if you miss something you were listening to. All minor annoyances compared to the great experience of using the product, though.

<comment><USER10> Although it's definitely subjective whether or not you like them, I can objectively say that the Sonys are more bass heavy than the Boses [1]. I've tried both of them extensively and I also found that to be the case subjectively. The Sonys do offer some ways to adjust this, but in the end I went for the out of the box sound of the Boses.

[https://www.rtings.com/headphones/tools/compare/bose- quietco...](https://www.rtings.com/headphones/tools/compare/bose- quietcomfort-35-ii-vs-sony-wh-1000xm3/565/678)

<comment><USER9> Interesting data! I wonder what explains my perception.

</comment></comment></comment></comment></comment><comment><USER11> I purchased the BOSE QuietComfort 35's - and they felt nice, were lightweight, cancelled noise well. They did not give me a headache, etc. For my personal taste, I found the bass lacking. I like to listen to dubstep when it gets noisy at work (something that I can just zone out to and not have lyrics to listen to, etc). And the lows just didn't hit hard enough for me.

Shortly after, I returned them and got Sony WH-XB900N -- after reading many reviews on both headsets. They are also lightweight, do not give me a headache, and were easy to set up / pair. The bass in them is amazing. If I'm ever distracted, throw them on, turn on some dubstep and just _feel_ the music. It's a totally different experience. I feel much more immersed in the sound with them.

I should say that prior to purchasing either of the above, I only used the stock earbuds that come with the iphones. They weren't so compatible with the shape of my ear canal though, and my ears would start to hurt around the 30 minute mark.

<comment><USER12> Is the headache concern something you've dealt with from using tight/heavy headphones or is that something to do with noise canceling?

<comment><USER11> Yes. I haven't found over the ear gaming headphones that I can wear. I've tried countless sets, and all result in a headache after about 30 minutes. My preferred gaming headset is a behind the neck style.

I think the headaches (for me) result from pressure (clamping force), not necessarily the noise-cancelling. The Sony's and the Bose were both light enough that there isn't much of a clamping force from left to right on my head. I do not get a headache from the Sony's and did not from the Bose either.

</comment></comment></comment><comment><USER13> [https://www.reddit.com/r/headphones/](https://www.reddit.com/r/headphones/) and [https://www.reddit.com/r/HeadphoneAdvice/](https://www.reddit.com/r/HeadphoneAdvice/) are much better source for this kind of info than HN.

Apart from Bose the other popular choice is Sony.

I wound not underestimate normal headphones as well.

Senheiser HD280 for example are very good with passive isolation at a really low price.

I personally use PXC 550 Wireless which can connect to two devices at the same time (a feature not always present to NR headphones)

</comment><comment><USER14> Bowers & Wilkins PX are a solid alternative to Bose/Sony and similar price range.

If you want to listen to silence or audiobooks then the others have a stronger cancelling effect and will probably suit better. But if you enjoy listening to music I found the PX is more subtle, with 'just enough' NC that it does not compromise on sound quality but still removes annoying environment noise.

I have flown with them a few times now as well as the QC35 and prefer the PX. The build feels better (a little heavier) and has the same nice features like fold flat and removable cups. I think they will hold up well with travel abuse.

<comment><USER15> The new B&W PX7 actually has much improved ANC and is getting very close to the QC35.

</comment></comment><comment><USER16> I think the new benchmark seems to be the Sony WH-1000XM3. I was lucky enough to be able to try these and the Bose QC35II and for me the Sony just edged it. They are over ear, have extraordinary battery life and are very comfortable. They can even hold their own on the London Underground which is saying something. Highly recommended!

</comment><comment><USER17> Everyone seems to talk about noise cancellation as it relates to wearing them on an _airplane_.

Airplanes are an easy problem to solve for because the engine noise is loud and of a constant tone.

The problem I need to solve for is random noises found in the workplace like people talking, printers printing, and other _inconsistent_ tones that's happen throughout the day.

Has anyone found a good pair of noise cancelling headphones that work in an office environment?

<comment><USER18> I'm not sure if any products like that exist. The problem is twofold:

1\. Noise cancellation works best for consistent noises

2\. Noise cancellation doesn't really work for high frequencies (in headphones, at least)

[https://www.rtings.com/headphones/1-2/graph#678/2090](https://www.rtings.com/headphones/1-2/graph#678/2090)

Your best bet is just to get some closed-back headphones with good noise isolation, like the:

* Sennheiser HD280 Pros

* Beyerdynamic DT770 Pros.

<comment><USER19> I second the Beyerdynamic DT770 Pros. I've been using them for the past 3 years in the workplace and they work wonders. If you really want to go overboard with them, and care about excellent sound quality, I suggest getting a DAC and tube eventually.

</comment></comment></comment><comment><USER20> Sorry, not trying to spread FUD but is nobody worried about the fact that new findings [1] have put a questionmark behind the safety of bluetooth headphones? I use my QC35 only in wired mode nowadays anymore.

[1] [https://qz.com/1572885/the-truth-behind-claims-airpods- cause...](https://qz.com/1572885/the-truth-behind-claims-airpods-cause- cancer/)

</comment><comment><USER21> I really like the performance of my Bose QC-35. The problem is the slide switch: it broke with days left on the one year warranty so I called Bose expecting an ordeal but within five minutes a "new or refurbished" QC-35 unit was on the way — with the warranty extended out another year - along with a return shipping label to send back the broken pair. It's been a couple years since the warranty swap and the slide switch on the replacement QC-35 has also broken. I simply set the auto-time-off to five minutes and use the pause/play button to turn them on after auto shutoff. The only problem is pairing the headset with another/new device as the slide switch needs to be gingerly manipulated in just the perfect manner, something you're not going to do while driving.

All of that to say that when I saw the details on the model 700 I smiled when I saw there was no more slide switch on the device. I'm patiently waiting for my QC-35 to die completely before buying the model 700 as a replacement.

</comment><comment><USER22> Wirecutter[0] always has the best in-depth reviews for headphones (of every type). I have the Bose QC35's (older generation, they were just refreshed) and they are great. I would recommend over the ear, especially if you are using them on flights or a noisy office.

[0] [https://thewirecutter.com](https://thewirecutter.com)

<comment><USER23> I'll echo on the older pair of QC35s. They still work great. I bet you could find a screaming deal on eBay. I've refreshed mine with new pads and a bluetooth adapter.

At the time, the Beats noise cancellation was considered sub-par compared to the Bose. That may have changed.

I haven't tried the new AirPods, but I do very much like an over-the-ear form factor for long sessions. (I have "regular" AirPods, too.) Anything in or on my ear get uncomfortable after a while for me.

</comment></comment><comment><USER24> Sony WH-1000XM3: I've used several ANC headphones before. None of those come close to this. Sound quality is extremely good too. Good battery life. A 15 minutes charge gives me 5 hours of playback. On the negatives: A bit heavier than Bose headphones but not by much. The "touch control" is sometimes annoying to use.

</comment><comment><USER25> I had to return by Bose because the NC gave me a weird pressure like feeling and it was uncomfortable to listen for more than 20 minutes at a time. Funny enough, the Sony 1000XM3 don't give me that feeling at all, I can listen to it all day no problem. I highly recommend the Sonys.

</comment><comment><USER26> Just start reading at the Wirecutter:

[https://thewirecutter.com/reviews/best-noise-cancelling- head...](https://thewirecutter.com/reviews/best-noise-cancelling-headphones/)

</comment><comment><USER27> If you're after a very good set of budget noise canceling headphones, I would recommend Plantronics BackBeat PRO 2.

</comment><comment><USER28> Over hear are the best in my opinion, but now that it's winter I regret that it's difficult to use a hat and over hear headphones at the same time.

I have a pair of Bose QuietComfort 32 II, which are quite lightweight and absolutely love them. However before the new 700 model came out, Bose released a firmware that reduced the noise cancelling impact on the QuietComfort 32 II (although they swear that the firmware upgrade shouldn't change impact noise cancelling it was measured by independent parties and it is indeed reduced).

</comment><comment><USER29> As far as noise cancelling goes, there's really only 3 phones that are worth considering:

WH-1000XM3

QC35

Bose 700

As a side note, I use a pair of beyerdynamics DT770 80 ohm headphones, and they have positively excellent isolation. With music on, I can't hear anything outside, and nobody can hear anything I'm hearing at all. Have you tried to see if closed, isolated headphones fit your use case? There's way more options in that space, so you're more likely to find something comfortable and with a sound signature you really like.

</comment><comment><USER30> Apparently in tests the new Sony's are slightly better NC than the Bose, but I tested them in a store and preferred the audio quality of my Bose QCs and couldn't personally tell a difference in NC.

I couldn't live without my Bose QCs and they go everywhere with me. You don't realise how much noise there is in day to day life until you've worn some good NC headphones around for a while then forgotten to take them with you one day.

<comment><USER31> I'm the same. I kind leave the house without my BOSE headphones. THey make just walking about outside, or the office or public transport bareable.

I don't know what I'm going to do when they break as they don't make spare parts for my model anymore. I tried their wireless equivalent and just wasn't that impressed with the audio quality compared to my wired ones.

</comment></comment><comment><USER32> I can't believe no one else has mentioned the Audio-Technica ATH-ANC9 headphones. They are $139 the last time I checked and they blow the doors off of any Bose noise-cancelling headphones I've tried. They are great for flights. I've had mine for years and bought several pairs for friends and family, and everyone I've gotten them for loves them.

</comment><comment><USER33> I use Nuraphones at work. Their main advantages are a gel-based ear surround and in-ear deliver of most non-bass sound, combined with environmental filtering and pass-through option if you need to hear around you.

Also, they detect your hearing range though some sort of auditory feedback they're sensitive to, and are really clear as a result.

</comment><comment><USER34> Beoplay H9. Had QC35 for years until they broke and have tried Sony's, but like H9 the best so far.

Cost a few dollars more though.

</comment><comment><USER35> I'm using the Bose QuietComfort 25 wired headphones right now. I've been using them for years. Every time an ear cushion wears out or falls off, I buy new ear cushions and replace the old ones. I've now resorted to even using Gorilla glue to keep them attached (because the base isn't in good shape any more). They're still perfect in sound quality and really, really comfortable.

I tried buying beyerdynamic headphones a couple weeks ago, but the comfort didn't compare - at all. They were too tight and the cushion wasn't nearly as soft.

I'd strongly consider comfort as one of your metrics. There are a lot of nice over-ear headphones with good sound quality, but the cushion padding and stretch of the bridge matters too. Bose uses really nice cushions. I've heard good things about Sony's as well.

</comment><comment><USER36> I bought a pair of Sony MX3 earlier this year, or maybe late 2018 and at the time I did a lot of research on them. I think it boils down to a choice between the MX and the QC and the best option for you is probably going to be a tad personal. I know people who swear by the the QC, my wife included, but the MX fit me (and my rather sturdy glasses) much better.

There may be a few technical favours either way as far as version goes, the MX3 has an advantage when I bought them, but having tried my wife's QC for a week they certainly do the job as well.

The hand control features/gestures on the MX suck by the way, so don't take those as a selling point. Solely go for long term comfort.

</comment><comment><USER37> I also have a pair of QuietComforts that are over a decade old. I recently bought replacement ear covers from Bose, and an aftermarket cable on Amazon, and after using them all day yesterday, can report that they seem to be good as new!

<comment><AUTHOR> Yeah, I've already replaced the ear covers once. Now the head band broke. I'm limping along with electrical tape repair. I think 14+ years is reasonable life expectancy though l!

</comment></comment><comment><USER38> I've been using the same set of parrot zik v1's for about 7 years. Cons: heavy, 6 hour battery life Pros: good sound, comfortable (for all day wear), over ear - so good for blocking out the extraneous noise, funky design

I quite often check mixes I'm working on from home while day jobbing on them and they are not studio grade, but they are good clear revealing without too much hype in any of the frequency ranges - they are a little 'smooth' compared to studio quality, but that seems good in a set of headphones that are primarily for blocking out noise.

I replaced the ear pads for the first time this year - now good as new.

</comment><comment><USER39> On a plane, I double up. Either my Shure in-ear (noise-insolation) or my Bose QC30 in-ear (noise-cancellation) with my older Bose QC15 (noise-cancellation) over-ear on top. Seems to work really well for me. Obviously, if I have any music/film on then the in-ear are the ones plugged in.

For my commute (train+tube/bus+walk) I use my Bose QC30. Full-on noise cancellation on the train/tube, then I dial it down to 50/50 on the noise passthrough when walking in London to avoid being crushed by a bus or cyclist. (And also in-ears are harder for moped based thieves to steal off your head)

</comment><comment><USER40> Audiophile perspective: Even though i like the idea of ANC , it can fail in so many places. If you want something that can block noises, i would consider going for noise isolation instead. Shure earbuds offer great isolation. But they tend to have flatter bass. Shure SE535 is a great balanced one but expensive a little.

Sony's ANC is your bet if you are looking for ANC headphones. Any of their line has a good implementation.

For overly expensive ANC, you can try the AKG noise cancellation headphones. They are extremely expensive to the point i don't recommend them

</comment><comment><USER41> I don't have much experience from a NC perspective, but I recently got the Sony WH-1000X MK3 for office & travel and I greatly enjoy them. From a an amateur audiophile perspective, they sound pretty good, they're pretty comfy, and the touch controls are pretty nice.

One nice feature that I found out about digging around the manual is that if you touch your whole palm to the right side (the touch control side) the sound quiets and the ambient noise is amplified, kinda like taking one ear out. It's a nice little touch.

</comment><comment><USER42> Not exactly to the question, but for reference in an office environment (where the noise is more intermittent): several years ago my Bose headphones weren't helping me for that, and I found the best combo for me was industrial earmuffs (like 3M, blocking maybe 30 decibels), combined with foam (or noise-blocking) ear buds placed underneath, and a white noise or similar app (like chroma doze off the f-droid.org app store). If there is better general noise blocking for offices, I'd like to know.

</comment><comment><USER43> While I know this post is specifically about Noise Cancelling Headphones, Let me introduce you to a combination of Noise Cancelling, Personalized Sound Profiles, and Bass that you can adjust and feel:

[https://www.skullcandy.com/shop/headphones/bluetooth- headpho...](https://www.skullcandy.com/shop/headphones/bluetooth- headphones/crusher-anc)

</comment><comment><USER44> Hey,

I'm using WH-1000XM3. I bought it couple of months ago. I think it is good. But, it also depends on your music taste. I mean if you are bass-heavy, WH-1000XM3 might not be enough for you.

<comment><USER45> that's interesting. if you read reviews about Bose (qc35 ou bose 700) they say to go to XM3 of you want more bass power. maybe you have a faulty unity?

<comment><USER44> I would prefer sony wh-xb900n extra bass model for better bass experience.

</comment></comment></comment><comment><USER46> I have a pair of Bose QC 25. I don't know whether they're the best in terms of noise cancellation (certainly good enough for listening to music or watching movies at a comfortable volume on a flight), but they are the most comfortable headphones I've ever owned, which is an important factor if you intend to wear them for long stretches of time. They are literally the only pair of over-ear headphones I can wear for a workday without my outer ears hurting.

</comment><comment><USER47> I have the Bose QC 25s and the Sony WH-H900N headphones.

I am not an ANC expert and it is subjective, but they're both great, but if I had to pick one, I'd say the Sonys edge it out for sound isolation and noise- cancelling.

The QC 25s are nice, because they use a AAA battery, and not a sealed, lithium ion battery. So, with proper care, they should last a while and aren't obsoleted by a bad, sealed battery.

</comment><comment><USER48> I have an old wired Bose QC25 which still works great.

Although I have taken it to many flights, I recently bought the Bose QC20 wired because headphones are harder to sleep in especially if you sleep on the side. I would recommend the old Bose QC20. I wish Bose would update this and still keep it wired, it's great.

</comment><comment><USER49> Not one Sennheiser post here? I have the Momentum 2.0 and have found them to be very comparable to Bose in noise cancelation, and better for music.

<comment><USER50> Right?? Bose is fine but Sennheiser makes fantastic stuff. I have the PXC 550s and they are excellent. Well worth it, especially now you can get them for ~$200.

<comment><USER51> Strongly agree. I have had my PXC 550s for about 2 years now, and they have held together very well. In my opinion, they are comparable with the Bose and Sony flagship NC headphones.

</comment></comment></comment><comment><USER52> I have a pair of 2004-era QC and they're super nice, but I found that the Beats Studio Wireless noise cancellation was as good as theirs and have been happy.

I can't use the modern Bose QC because they cancel so strongly that it makes me want to vomit, so apparently there's a limit somewhere.

I haven't had a chance to try the AirPods Pro in an airplane yet, but their noise cancelling seems equivalent to the other two so far.

<comment><USER53> For what it's worth, I have the QC35 II and they do have a "low cancellation" setting. It's not the default though, which would be annoying to change every time you turned the 'phones on.

<comment><USER52> Valid, but: "Annoying" is a significant understatement in my personal context - what for others might be annoying inconvenience is, for me, "remember to flip this switch every time you use this device or you'll hurl" - making the device unsafe to use.

<comment><USER13> Senheiser PXC 550 Wireless have a setting from 0 to 100% for Noise Reduction.

The setting persists everytime you power the headphones, so if you set it once there is nothing to remember.

You can change it on the fly with the mobile app.

<comment><USER52> Thanks, good to know. Does it persist across 0% battery remaining events?

</comment></comment></comment></comment></comment><comment><USER54> I use both inner ear and over ear Bose. I find noise cancellation feeling is more prominent to the point of distraction on the inner ear QC 30s. I find the QC 35 over ear provide better experience. Sony's 1000 seems to edge Bose out in noise cancellation. However I have been impressed with the 700, and I think Bose is now back on top. Either of them are cracking noise cancellation headsets.

<comment><USER55> QC35 is the reason I still haven't quit my noisy open office job

</comment></comment><comment><USER56> If you are looking for Noise Cancellation, there's just ONE answer: Bose. In my experience, no other brand provides a better active noise cancellation. Bose is still king (and by far). I've tried Sony, Schneider and others that I forgot. The QC35 were by far the best ones. I have not tried the latest Bose version tho, so I don't know if they are worth it or not.

<comment><USER57> Bose QC 35 ii is not worth the money. They are overpriced and have bunch of problems:

* QA seems lacking. Our whole team has company sponsored QC 35 ii's and one came as DOA, couple of them have suffered the same fate within a year * Noice-cancellation is good. It's so good that I can't keep it fully on for more than 15 minutes and the lower cancellation level leaks more sound. Maybe personal problem but annoying still * Audio quality through bluetooth is lacking. The integrated amp doesn't have the oomph for the elements and the sound sounds a bit muddy * AQ problem can be remedied with the provided cable which is short. And what's the point of wireless headphones if it lacks on that side? * In the plane I have bunch of other stuff with me so I don't want to reserve so much of space for the headphones

I like my own AKG NC60 sound quality, size and the noise cancellation is usually enough (although not so all encompassing as the Bose's) but AKG's problem is really bad mechanic quality. With even lightweight usage they end up breaking badly, so I'm going to need to buy a ned headphones and for that I'm looking forward for Sennheiser's and Sony's. Stay away from AKG and Bose ;)

</comment></comment><comment><USER58> I'm using Sony WH-1000XM3 and I'm extremely satisfied. Before I was using some JBL in ear. Expecially in an open office, the additional passive noise cancellation of good over ear headphones is important for me. I find the Bose QC 35II at the same level (and now cheaper) but the Sony look better :)

</comment><comment> sh-run If anyone has issues with ANC, I suggest giving Etymotic IEMs a shot. I have ER2XRs, they provide a quoted 34-42dB of isolation. I never had a problem with the deep insertion, they sound great and are relatively cheap.

This isn't necessarily directed at OP since he's been using Bose since 2004

</comment><comment><USER59> For whatever it's worth, I've had the same pair of Bose QC-15's for many years. I have replaced the cable twice and the ear pads twice. They are comfortable and have decent noise cancelling. I won't use wireless anything if I can avoid it, but I am weird that way.

</comment><comment><USER60> In terms of reliability and support I would say whatever Bose's latest NC headphone is in the QC line.

<comment><AUTHOR> Have you had recent interactions with Bose? I've heard they've gone downhill over the past few years. Any thoughts?

<comment><USER61> I bought Bose QC 35 last year and they are great, definitely my personal favorite of the ones I sampled or tried by borrowing from friends. I would disagree with any claims Bose NC models are dropping in quality.

<comment><AUTHOR> Thanks for the follow up!

</comment></comment></comment></comment><comment><USER45> I owned a few (sony, beats, Samsung, and others - all over the ear) and settled with Bose. My QC35 was great and worked for years, but recently I upgraded to a Bose 700 and can say that, if you're looking specifically for Noise Cancellation, you can't go wrong with it.

</comment><comment><USER62> Slightly ot.

For sound quality, go for B&O Beoplay h9i.

Worse ANC than Sony XM3s or Bose, but the sound is so nice. I tried Bose QC35, bought and returned Sony XM3. For flights, as others have said, bose or sonys (maybe airpods pro?). But for music listening in the office, can't recommend h9i enough.

</comment><comment><USER42> Somewhat related, current discussion: "Why office noise bothers some people more than others." [https://news.ycombinator.com/item?id=21565841](https://news.ycombinator.com/item?id=21565841)

</comment><comment><USER63> The QCs are unbeatable for noise cancelling. My QC15s are my best friend at school, or, at least they were until I got the new AirPods. If you're using them on a plane, I doubt anything could beat the QC35s.

</comment><comment><USER64> Can I crash your topic ?

I'm looking for a similar recommendation but with one additional requirement - minimal latency, as one of my use cases will be watching movies. Any ideas ?

</comment><comment><USER65> Sony XM3, Bose QC 35 or Bose 700 - try them all and pick whatever is most comfortable. Noise cancelling in all 3 is good enough that you're unlikely to be able to tell the difference.

</comment><comment><USER66> Sony WH-1000XM2 can be had for a steal occasionally - given that it's last gen model.

Definitely over ear for flights. Combined with foam plugs you can pretty much sleep in silence on overnight flights

<comment><USER67> Don't buy the 1000XM2's. Although cheaper, there's lots of reports that the XM1's (and 1st gen) have cracking issues on the headband portion. XM3 appears to have fixed that. XM3's go on sale for high $200s often, so it's not much of a stretch to get XM3's.

</comment></comment><comment><USER68> Edifier W860NB. I never wore anything more comfortable on my head. It's half as cheap as the popular mentions here (bose and sony), but the sound quality is miles better.

</comment><comment><USER69> If you're going for Bose, their latest Headphones (NC 700) is something you should look at. Sony came a close second, but that was before Bose updated the QC35.

</comment><comment> Pete-Codes I just returned the Bose QC35 - was worsening my tinnitus, they are really flat and uncomfortable to wear around neck.

Sticking with Sennheiser HD25s

</comment><comment><USER70> Piggy-backing this question: does anyone knows good noise cancelling headphones that are wired?

</comment><comment><USER71> I have done extensive testing and review reading. You have two options: sony xm3 or bose 700.

</comment><comment><USER72> I love my PSB M4U 8s. Great sound, replaceable batteries. Been using them for about a year.

</comment><comment><USER73> Any of these in budget range?

<comment><USER74> I have a pair of cheap (£30), Chinese Bose knock-offs. In terms of performance they're pretty much indistinguishable from a pair of genuine Bose I tried, but to my tastes not quite as good as a pair of recent Sonys. I strongly suspect that they're almost identical internally to Bose.

Mine are unbranded, but search for "JH-ANC804" and you'll find them.

</comment></comment><comment><USER75> I've had Bose QC-35, one word: amazing! Extremely recommended.

</comment><comment><USER76> QC35 ll best there is.</comment>


Signal-desktop HTML tag injection advisory - <AUTHOR> https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injection/advisory/ <comment><USER2> Is this a joke?

>Solution/Vendor Information/Workaround

>For safer communications on desktop systems, please consider the use of a safer end-point client like PGP or GnuPG instead.

\---

Meanwhile, regarding yesterday's PGP flaw:

[https://www.eff.org/deeplinks/2018/05/not-so-pretty-what- you...](https://www.eff.org/deeplinks/2018/05/not-so-pretty-what-you-need- know-about-e-fail-and-pgp-flaw-0)

>EFF's recommendations: Disable or uninstall PGP email plugins for now. Do not decrypt encrypted PGP messages that you receive. Instead, use non-email based messaging platforms, like Signal, for your encrypted messaging needs.

<comment><USER3> Please do not quote with codeblocks as it is unreadble on mobile.

</comment></comment><comment><USER4> I know that an unsanitized HTML input is a stupid issue to begin with, but update issued within 24 hours of _discovery_ (and within 5 hours from disclosure)? That's really impressive.

<comment><USER5> > I know that an unsanitized HTML input is a stupid issue to begin with

Input is never the issue, output is: you don't know how the input will be used/rendered, so it should be messed with as little as possible.

<comment><USER6> Depends entirely on your application. Often you know, or are willing to constrain, the uses of an input.

<comment><USER7> And for encryption, absolutely should when in doubt.

The HTML tag attack on PGP works by mixing plain and cipher text, which is a thing people might genuinely want to do. But the safer clients still interfered with it by re-encrypting anything which didn't begin with a PGP signature, for the very good reason that they couldn't trust mixed messages. The clients which mildly constrained inputs prevented the entire attack vector, and it looks a very good tradeoff right now.

</comment></comment></comment></comment><comment><USER8> Just one additional note that might not be immediately clear from the advisory: Exploiting this requires the attacker to first manually place malware (a malicious JavaScript file) on your computer or on a Samba network share that your computer is already connected to.

<comment><USER9> Yeah. That fact seems pretty hidden in the reports. Due to proper CSP only local files will be executed.

If you are who I think you are, maybe you could speculate if there is actually any use for this other than loading local files (local file execution) and crashing signal?

<comment><USER10> If a .js file is redirected to from a web page, with a Content-Disposition header marking it as a download, and (as is common) the browser downloads automatically to ~/Downloads, doesn't that leave the .js file in a predictable place that can then be used by an attack on Electron?

<comment><USER9> that could probably.be answered by jlund. Electron downloading things by default seems like a pretty bad thing to do.

</comment></comment></comment></comment><comment><USER11> Ah, Electron /sigh.

Luckily this is fixed in the latest version (v1.11.0), so if you're a Signal user (you should be!) and you haven't upgraded already, you should upgrade immediately.

<comment><USER12> > (you should be!)

I don't see how going from one IM silo to another just because it's encrypted is going to help with anything. Especially one that's hostile towards alternative clients. I'm using XMPP with OMEMO, as I should be :P

<comment><USER11> OMEMO actually implemented the double-ratchet algorithm developed as part of the Signal Protocol. Signal, in my eyes, is still the benchmark for balance between usability and security. That's fine if you prefer XMPP w/ OMEMO, and it's arguably just as secure.

...but it's unfair to call Signal another IM silo that's "hostile" towards other clients. Signal is 100% open source, along with the Signal Protocol which powers it all. It is community supported and wholly dedicated to brining cryptography to everybody. The latest implementation of OMEMO as it exists today would not be what it is without Signal.

<comment><USER12> Sure, Signal contributed back to the whole IM scene some very useful things, I'm grateful for that. That still won't make me use or recommend their network, as they actively request alternative clients to stop using their servers and are just yet another, centralized network that can just go away at any moment.

In Poland I don't see many people using Signal yet. I'm recommending Conversations to anyone who asks, which doesn't seem far away in terms of usability. On desktop it's a bit worse (I mean, I'm very comfy with my Psi, but wouldn't recommend it to a random person on the street), however Dino looks very promising and might fill that niche soon.

<comment><USER13> A relevant blogpost by Moxie about why the Signal app uses a centralized model (and thus doesn't allow other apps to connect to their servers): [https://signal.org/blog/the-ecosystem-is- moving/](https://signal.org/blog/the-ecosystem-is-moving/)

Still all code is open source and Signal's code does support federation. Moxie stated before that you can take the code and start a federated version of Signal if you want.

<comment><USER12> Of course you can. That won't be Signal though, just an another network using its code, and there's already XMPP, so there's no need for that.

> (and thus doesn't allow other apps to connect to their servers)

"thus"? You can easily use centralized model and allow the client ecosystem to thrive. You don't have to do much, just don't actively prohibit them.

And I know the blog post, it isn't very convincing.

</comment></comment></comment></comment></comment></comment><comment><USER14> SIGFAIL? Where's the vanity domain and whitepaper?

<comment><USER15> Or SIGINT, would be a good NSA joke. [https://en.wikipedia.org/wiki/SIGINT](https://en.wikipedia.org/wiki/SIGINT)

</comment></comment><comment><USER16> If you're interested in the how, who, what and where, there's a more chatty account of how this vulnerability was discovered, reported, fixed and disclosed here: [https://ivan.barreraoro.com.ar/signal-desktop-html-tag- injec...](https://ivan.barreraoro.com.ar/signal-desktop-html-tag-injection/)

(submitted yesterday at [https://news.ycombinator.com/item?id=17070032](https://news.ycombinator.com/item?id=17070032))

</comment><comment><USER17> Good old unsanitized HTML. Brings memories of the first bulletin boards.

<comment><USER18> It should have been done via DOM manipulation in the first place. What Signal developers did can be compared to constructing raw SQL requests where parameterized queries suffice. Thankfully, it was just fixed: [https://github.com/signalapp/Signal- Desktop/commit/4e5c8965f...](https://github.com/signalapp/Signal- Desktop/commit/4e5c8965ff72576a9e20850dd30d9985f4073192)

<comment><USER19> Frankly, I'm not to eager to trust people writing commit messages like this and then OK that during peer review:

[https://github.com/signalapp/Signal- Desktop/commit/9d41b8616...](https://github.com/signalapp/Signal- Desktop/commit/9d41b8616296f1b328aa864e0114b99d7f11ca06)

> Remove escaping from `linkText` > We leverage jQuery's HTML escaping in > `$.html(…)`.

ummm.... wat

</comment></comment></comment><comment><USER20> Electron wouldn't be needed if browsers provided controlled access to a small selection of local resources like filesystems.

Why don't developers who think they need Electron instead just run as standalone browser windows with controlled resource access as suggested? Answer: because browsers haven't done the work required to provide the stuff that people think they need from electron.

The core idea that is flawed with Electron is that there really shouldn't be any context in which an application needs unrestricted access to the underlying OS - what application needs that? Electrons combines such unrestricted access with the ability to download and run code from the web which is a recipe for disaster. The effort being put into Electron should instead go instead putting controlled access to local resources into browsers.

</comment><comment><USER21> Just another day in Electron land.

It used to be that XSS is was only an issue on the web, but thanks to Electron it is now everywhere, including desktop and mobile apps.

</comment><comment><USER22> In the future, I believe that we're going to consider using Electron to create pseudo-native applications a code smell.

<comment><USER23> I think that future is already here. I'm seeing a lot of development of desktop Matrix clients, which to some extent has to be driven by desktop Riot being an Electron app.

</comment></comment><comment><USER24> > For safer communications on desktop systems, please consider the use of a > safer end-point client like PGP or GnuPG instead.

It seems like rather poor timing to make such a derogatory comment.

</comment><comment><USER25> Dat timeline.</comment>


Atlanta HackerNews Meetup #2: Thursday Mar 11th 7pm at Rira Pub - <AUTHOR> http://www.facebook.com/event.php?eid=376015031398

<comment><USER2> Just in time for St. Patricks. Awesome :)

</comment><comment><USER3> Would you mind making this a facebook group or find some other subscription notice mechanism? I can't make Thursday's meetup but would like an easy way to get notice of future ones. The chance of me missing a notice on HN is high.

Also per a comment below that there is a python meetup at the same time. Maybe these notices/calendars can be consolidated for IT meetups in Atlanta?

<comment><AUTHOR> A facebook group was created <http://www.facebook.com/group.php?gid=354809954022>

</comment></comment><comment><USER4> How regular are HackerNews meetups in Atlanta? Is there a calendar for future ones? I'd like to go, but I'll be out of town this Thursday :|.

<comment><AUTHOR> A facebook group was created <http://www.facebook.com/group.php?gid=354809954022>

</comment></comment><comment><USER5> this is @ the same time (7:30pm) as the python-atlanta monthly meetup

<http://www.meetup.com/python-atlanta/calendar/12579189/>

<comment><USER6> @rranshous

Both of these events look great, so it's a shame they're scheduled at the same time. I'm sure this wasn't done on purpose, but now I have a tough decision to make...</comment></comment>