New Tools for Detecting HTTPS Interception - <AUTHOR> https://blog.cloudflare.com/monsters-in-the-middleboxes/ <comment><USER2> > When a proxy root certificate is installed, Internet browsers lose the > ability to validate the connection end-to-end, and must trust the proxy to > maintain the security of the connection to ensure that sensitive data is > protected.

Sort of like how CloudFlare does with their "Flexible SSL". As an end user, I have no way of knowing if CloudFlare is proxying my credit card information over clear-text to an insecure origin server.

<comment><USER3> > Sort of like how CloudFlare does with their "Flexible SSL". As an end user, > I have no way of knowing if CloudFlare is proxying my credit card > information over clear-text to an insecure origin server.

Cloudflare should really message if this is the case when using their gateway. Small UI changes to note this would likely go a long way toward coercing better overall security.

When I use Cloudflare as a proxy, I also configure authenticated origin pulls[1] for better endpoint hardening. This makes it a bit more difficult to find a way to bypass the CF proxy, since hunting around on shodan etc. to find the server in the IPv4 space echoing the same content will not work.

[1] [https://blog.cloudflare.com/protecting-the-origin-with- tls-a...](https://blog.cloudflare.com/protecting-the-origin-with-tls- authenticated-origin-pulls/)

<comment><USER4> Just a note, unless you're also validating the Host: header (and possibly even then), Authenticated Origin Pull can be bypassed if someone does find the right server:

[https://medium.com/@ss23/leveraging-cloudflares- authenticate...](https://medium.com/@ss23/leveraging-cloudflares- authenticated-origin-pulls-for-pentesting-565c562ef1bb)

(Could have been fixed in the past couple months, but I doubt it.)

Same for Access, by the way.

<comment><USER5> Sometime in 2Q you'll be able to upload your own client certificate (issued under your own CA if you like) to be used with Authenticated Origin Pulls.

<comment><USER3> Note: This user is a (the?) Director of Product at Cloudflare.

</comment></comment></comment></comment></comment><comment><USER6> I like how this is published by Cloudflare, who is literally the biggest TLS interceptor in history -- their entire business model is based around MITMing connections.

If I was a group who needed to get eyes on TLS traffic without it looking too suspicious, offering free reverse-proxy services would be the way to go (for attack protection and CDN-like features, of course).

<comment><USER7> > If I was a group who needed to get eyes on TLS traffic without it looking > too suspicious, offering free reverse-proxy services would be the way to go

that's a pretty over the top accusation to make without citing evidence

<comment><USER6> Not really accusing them of anything, but CF is a giant vuln in how you'd expect TLS to work. TLS is supposed to guarantee that data between your browser and the web server is encrypted in transit, but with the CF business model there's a very convenient decryption/re-encryption step right in the middle of that.

Infiltrating CF is far, far easier than any of the other TLS-snooping methods (breaking the encryption, generating a fake cert via bad CA and intercepting, etc); it's not ridiculous to think the bogeyman-du-jour probably has fingers in CF (with their knowlege or not, doesn't really matter), and it'd be irresponsible to assume that TLS traffic going through CF is any more secure plaintext.

<comment><USER8> If you rely on any third-party for data processing/storage, you're accepting some risk of them being compromised.

If you use CloudFlare/Akamai/Cloudfront/etc. as a CDN, a hacker could view your site's traffic.

If you use G Suite/Microsoft 365/etc. for email or document storage, a hacker could access your corporate documents and communications.

If you use EC2, Azure, or GCE, a hacker could access your storage buckets or dump your VM's RAM.

It all comes down to your threat model. Is your threat model such that you absolutely can't trust any third party with your data? If the answer is "yes" then you should completely self-host and not use a CDN or anything similar. (I.E. an email provider that specializes in providing services to whistleblowers/political dissidents should definitely not use CDNs or public cloud providers.)

But for most businesses it's an acceptable risk, especially since these giant tech companies probably have better security than they do themselves.

</comment></comment></comment></comment><comment><USER9> A lot of our clients use proxies, and they sometimes have terrible bugs that cause connection problems. E.g. the other day we detected an obsolete Cisco device that was leaking memory from one HTTPS session into another (a government department too!).

We now log whether HTTP2 or HTTP1.1 is used by the browser by using JavaScript: `window.performance.getEntries()[0].nextHopProtocol` which is supported by most modern browsers.

This works because we use CloudFlare, so most of our users get HTTP2, unless they are using a corporate proxiy, which often downgrade the browser connection to HTTP1.1. e.g. Cisco WSA doesn't support HTTP/2 yet[1].

We also log response headers on XMLHTTPRequests that fail, because sometimes the proxy inserts a header with its name and version (however headers sometimes get stripped for security reasons by the browser e.g. CORS, and timeouts usually have no response header).

1\. [https://quickview.cloudapps.cisco.com/quickview/bug/CSCuv329...](https://quickview.cloudapps.cisco.com/quickview/bug/CSCuv32968)

<comment><USER10> One other handy tool can be [https://badssl.com/dashboard/](https://badssl.com/dashboard/) for doing a quick scan for surprises — this is especially useful if you're testing managed workstations and want to confirm that someone hasn't "fixed" a problem by deploying a group-policy update which breaks TLS security.

</comment></comment><comment><USER11> I dislike this as a user, but like it as a security professional. It is critical to data loss prevention (sending SSNs to a HTTPS site could be hidden otherwise) but is rarely done well.

The ability to degrade encryption cipher suites and inability of most of these boxes to invalidate certificates results in lower security for most users. I have seen sites with expired certs be passed to users since the interception replaces the site's cert with the root cert. This means the browser ends up trusting this cert and showing content that would normally be blocked. This is an interesting mess we have gotten ourselves into. Also interesting when taken in light of the BITS/ Andrew Kennedy comments on TLS 1.3 that directly impacts this ability.

<comment><USER12> [https://badssl.com/](https://badssl.com/) is a great way to test how much your MITM proxy is masking insecure HTTPS comms. If a test passes that shouldn't, ship an email to your proxy team.

</comment></comment><comment><USER13> I think the next logical step is to give those of us who care on the desktop more info about what certs/chains are being used. While FF has extension support for viewing cert info, Chrome does not yet[0]. Once there, it would be reasonable to be able to easily pull up my root CA list and see which ones are queried by my browser and how often (I'd love to trim up my list if mostly unused). Of course this does nothing for a process using its own HTTP client, hence the MITM checking.

0 - [https://bugs.chromium.org/p/chromium/issues/detail?id=628819](https://bugs.chromium.org/p/chromium/issues/detail?id=628819)

<comment><USER14> I'd like to associate my own protections into a given root. I'm happy for my company's root certificate to identify as *.company.com, I don't want it identifying as www.mybank.com, have it as an option under "edit trust". Same goes for root certs -- if I choose to disallow "China Financial Certification Authority" as a normal root cert, and I go to "chinabank.com" or wherever, I should have a message pop up saying "this site isn't allowed", and allow me to tag an exception for that specific certificate to China Financial Certification Authority (although not if it's MITMed)

These settings should persist through browser upgrades too.

</comment></comment><comment><USER15> This is rather ironic coming from Cloudflare given that their main product is a TLS proxy which essentially has man-in-the-middle access to all https requests running through their systems.

<comment><USER10> "interception" implies that this is being done without your knowledge and permission. That isn't a useful way to talk about a common class of service which you explicitly opt-in to use with a contract.

<comment><USER15> Website owners may have knowledge that Cloudflare sits between their users and their site. But the end users generally do not. They think they have an encrypted connection directly to the website. They would be surprised to learn that a third party has eavesdropping capabilities.

<comment><USER10> Ultimately you're trusting the site owner to be responsible and almost never have the ability to audit them. Using CloudFlare is another trust point, just like using shared hosting. If you don't complain about using AWS, Digital Ocean, etc. in the same way that's just saying you need to think about the threat model more.

</comment></comment></comment></comment><comment><USER16> There is a public dashboard: [https://malcolm.cloudflare.com](https://malcolm.cloudflare.com)

</comment><comment><USER17> They hate on TLS-terminating proxies, and are jubliant about TLS-terminating reverse proxies.

That is: Clients don't get to decide about encryption only servers do.

And partially, this makes technical sense. There are fewer servers, and the chance that they get it right is a lot higher. On the other hand, this is nothing more than the platforms pulling all power towards themselves. Getting users used to the paradigm 'we will decide what kind of encryption you get'.

</comment><comment><USER18> WTF, the rate of interception is so high. (search for "prevalence of HTTPS interception")

I think browsers are way too friendly to this practice. IT departments & oppressive governments are the main culprits obviously, but the browser and the TLS impl is supposed to be on the user's side.

</comment><comment><USER19> I wonder if Cloudflare interprets our connections as MITMed or not. We have group policies, configuring hosts to have specific cipher suite order and disabling weaker ones. So basically adjusting TLS settings, but not actually MITMing.

</comment><comment><USER20> While I'm sure a lot of people read this and think "awesome, more security", I think "no, another hurdle in the DRM-ish battle to keep control over what the devices on your network are doing"; especially after seeing some comments here stating the logging (and potentially acting on) of the results from these fingerprinting techniques.

I MITM my network so I can filter out ads and other crap, inject custom stylesheets, and otherwise modify pages so that I can maintain a sane browsing experience even on devices with severely castrated browsers. Need to control JS on something that can't even let you turn it off? What better than _stripping out the <script> tags completely_ before it even gets there. Want to see the full version of the page instead of some mobile portal? I can change the user agent and other headers on-the-fly. I can also check if something is phoning home, and what exactly its communication is:

[https://news.ycombinator.com/item?id=6759426](https://news.ycombinator.com/item?id=6759426)

Given the situation with IoT and other "smart" things these days, along with the trend of walled garden ecosystems and HTTPS Everywhere (even for DNS!), I would almost consider an HTTPS intercepting proxy essential for security and privacy purposes. Funny that the article makes no mention of this, but only the usual "evil corporate proxies" scaremongering... then again, it wouldn't fit in their narrative. Proxomitron, Proxydomo, Proxymodo(!), Adsubtract, Admuncher, and the list goes on. These were quite popular a decade ago, and would've remained so had the "security-cult" not driven them into obscurity.

This feels like just another one of those "we want to ensure we force all our content down your throat and make you powerless to stop it" schemes, and I'm pretty confident that I'm already seeing it in action. The previous technique was running JS on the page to detect modifications (including those produced by adblockers), now they're moving that war deeper.

edit: Wow, downvoted already.

tl;dr: My network, my traffic. Piss off with your nannying!!!

<comment><USER14> You're right. Many tech people today tend to be hostile about the sort of freedom and hacking that geeks used to have.

There are ways around this - the detection seems to work by investigating what TLS ciphers are supported, and comparing with what the username should do.

A MITM proxy could easily implement this. On the flip side cloudfare could easilly get false positives for people with non-default settings (which I suspect is measured in the <0.0001% range, so websites won't really care)

These are the default firefox cipher settings on Firefox 65

[http://imgur.com/fVvUBdUl.png](http://imgur.com/fVvUBdUl.png)

And here's my desktop's current settings

[http://imgur.com/A72WA2hl.png](http://imgur.com/A72WA2hl.png)

(which disabled ciphers without and dh key exchange - I also block TLS 1.0)

</comment></comment><comment><USER21> > a "monster-in-the-middle" or MITM

What happened to man-in-the-middle?

<comment><USER22> Eaten by the monster, probably.

First time i heard this and i already prefer it to man-in-the-middle as it sounds funnier :-).</comment></comment>


Twitter Uses BitTorrent For Server Deployment - <AUTHOR> http://torrentfreak.com/twitter-uses-bittorrent-for-server-deployment-100210/ <comment><USER2> Actual link to code + detailed description that doesn't spend 3/4 the post describing what bittorrent is and instead discusses what the project is: <http://github.com/lg/murder#readme></comment>


Google agrees to pay $8.5 million to make Buzz privacy lawsuits go away - <AUTHOR> http://www.engadget.com/2010/09/04/google-agrees-to-pay-8-5-million-to-make-buzz-privacy-lawsuits/

<comment><USER2> That's an extremely cheap agreement. Probably because statements like this:

> _Remember back when Google's Buzz social networking app shared user's > private information without their consent?_

Are based on complete FUD. They _had_ no privacy violations, just UI snafus. Getting rid of the persistent annoyances surrounding things like that is probably worth at least 8.5 million.

</comment><comment><USER3> Can any attorneys here tell us how much of this settlement would likely have gone to the winning lawyers?

<comment><USER4> according to this article, 30%: [http://www.google.com/hostednews/afp/article/ALeqM5g3yF0MKx3...](http://www.google.com/hostednews/afp/article/ALeqM5g3yF0MKx3iORpW3tEYx7UuIhSoVw)</comment></comment>


U.S. Supreme Court will hear Apple's appeal of App Store class-action lawsuit - <AUTHOR> https://www.reuters.com/article/us-usa-court-apple/us-top-court-mulls-apples-app-store-commissions-in-antitrust-case-idUSKBN1JE1JH <comment><USER2> The issue here is very different than people seem to think.

The supreme court granted cert on one question:

"Whether consumers may sue for antitrust damages anyone who delivers goods to them, even where they seek damages based on prices set by third parties who would be the immediate victims of the alleged offense."

(This is apple's statement of the question, and thus necessarily is tilted in how they see things)

The petition summary has more details and is quite short: [http://www.scotusblog.com/wp- content/uploads/2017/10/17-204-...](http://www.scotusblog.com/wp- content/uploads/2017/10/17-204-petition.pdf)

There is a circuit split on this issue, which is likely why the supreme court took it. It's mostly about indirect purchasers vs direct purchasers. Indirect purchasers cannot sue, only direct purchasers can, mainly because it's really hard to apportion damages properly.

The previous major case on distribution monopolization was an eight circuit case about ticketmaster, Campos v. Ticketmaster Corp, [https://caselaw.findlaw.com/us-8th- circuit/1097030.html](https://caselaw.findlaw.com/us-8th- circuit/1097030.html). Section II of that opinion is a fairly readable rundown of the issue of direct vs indirect purchasing and who gets to sue.

Ticketmaster held that people paying greater distribution fees to ticketmaster as a result of their monopoly could not sue, as they are indirect purchasers.

The ninth circuit, in the apple case, held differently, holding that apple was selling directly to consumers, regardless of whether app developers got to set price. The opinion, which is also quite readable, is here: [https://www.leagle.com/decision/infco20170112133](https://www.leagle.com/decision/infco20170112133). Again, i'd just read the part starting with "plaintiffs are direct purchasers"

Personally, i think the dissent in ticketmaster (and the ninth circuit) got it right. This is also what the ninth circuit explicitly says. In these models, only the people at the bottom make sense as the people to sue, as when you control distribution carefully like this, they are the only injured party.

<comment><USER3> > only the people at the bottom make sense as the people > to sue, as when you > control distribution carefully like > this, they are the only injured party.

Here's the case for manufacturer's standing: the manufacturer (app developer) might argue that the distributor's (Apple's) monopoly on distribution hurts them just as much if not more since the inflated price means they're selling less quantity than they would in a non-monopolized marketplace. Even though they technically set the price, having to pay Apple's rake on the App Store means that they must inflate their prices by at least 30% to bring them back to the price they'd otherwise sell at in the absence of the distributor.

In any event, I thought the case was a dog on the merits. How can Apple possibly be a monopolist, despite their 100% share of application sales on iOS, since the relevant market is for app-capable cell phones -- not iOS. Plenty of folks, the majority in fact, vote with their dollars by buying Android devices.

<comment><USER2> App developers definitely have standing here (and the 9th circuit opinion says so). They just have a much harder time showing injury (and thus standing) because they are not paying the fees :)

Instead, they have to make the indirect argument you do, and it's unclear what the _harm_ is. They are not paying 30% more, the consumer is. There's no data to suggest they are selling less. Who is really injured?

The same issue arose in ticketmaster - outside of consumers, everyone else has a really hard time showing injury.

Meanwhile, the consumers, who directly pay the monopoly fee, are directly injured.

<comment><USER4> They could always drop their price to the amount they could charge without the 30%, and get supply/demand price sensitivity curves. If a bunch of apps did this, you could get statistically significant data.

A law firm could easily pay a number of app makers to try this out in exchange for the data, and then make a huge class action out of this.

I think the big challenge is that there are a number of confounding factors, like Apple's ranking algorithms.

<comment><USER5> Wouldn't that "test" imply that Apple isn't doing any kind of marketing/promotions through the 30% cut? At least here in Germany, discounts and boni of 10-15% when buying iTunes gift cards are quite frequent. And these discounts influence at least my app buying behavior. In addition, these discount offers are advertised and so indirectly promote the App Store to millions of people. Developers profit from this in one way or the other.

In your test just cutting the 30% "Apple tax", the developer would still profit from these discounted gift cards. But it's not the developer giving the discount from his cut, but Apple from the 30%. Moreover, the 30% covers not only handling and processing App Store Infrastructure and sales, but as well the editorial sections of the App Store promoting news apps daily. There already exist reports on how this editorial content boosts app sales.

So, your test would still take all this for granted and therefore would be highly skewed. The data would not be "statistically significant" at all.

<comment><USER4> I never said Apple doesn't do anything for their 30%, and I make no judgements about whether it's warranted. My comment was just a thought experiment about how a law firm might approach making a case for damages, given the conversation people were having.

You may buy iTunes cards. I've never bought them, nor even looked at them. I don't know which of us is more representative, but I don't think that invalidates the broad strokes of a test like I describe.

</comment></comment></comment></comment></comment></comment><comment><USER6> > its phones' ecosystems are closed for security reasons since it can vet App > Store apps for malicious code and other dangers.

I'm not saying that this is not true, but given that Apple's app store revenue will probably be greater than global movie ticket revenue in 2018, I suspect that "security precaution" is perhaps not 100% of the motivation behind blocking all competition.

<comment><USER7> That's some fucked-up mental gymnastics of an excuse to explain the existence of the app-store. It's like having your refrigerator manufacturer enforce purchasing of groceries that he's vetted to save you from a salmonella infection, where the manufacturer keeps 30% of the grocery revenues, and arbitrarily controls what groceries can be purchased in the first place

Outside of apple, software is bought and sold in a secure manner without forking 30% to Apple, or having Apple mark you as a threat and toy-fuck you out of business [1].

[1]: [https://www.macrumors.com/2018/05/24/apple-rejects-valve- ste...](https://www.macrumors.com/2018/05/24/apple-rejects-valve-steam-link- app/)

<comment><USER8> And you do have the ability to purchase phones which use those other channels.

<comment><USER7> Doesn't have ANY bearing on the fact that Apple is anti-competitive. No excuse for one company to break the just because others follow the law

<comment><USER8> But the point is that Apple is not breaking the law. This is not an anti- competitive move by them.

<comment><USER7> And by what legal authority did you just state that?

Microsoft was forced to ship competitive browsers in the OS to avoid monopoly claims, but Apple - unlike Microsft, they won't even allow 'un-blessed' apps to RUN on the phone. Seems patently illegal

<comment><USER9> Microsoft did a lot of shit to warrant their anti-trust suit. The browser thing was one bit.

How about how they spent $1 billion to market IE (a _free_ product) in order to cut into a potential (though indirect) competitor's product (Netscape). Netscape's browser was reaching the point (as early as this was in the WWW days) of being a potential host for cross-platform software applications. This terrified MS as it would eliminate a lot of their foothold in the business market, in particular.

How about how when Compaq and others wanted to sell non-Windows OSes, Microsoft threatened them with increased Windows licensing fees. They had access to OEM rates which meant they could participate in the cut-throat and very low margin PC business. Without those rates, they would _have_ to raise their prices. Even an extra $100-200 would price them above their competitors. This was done to eliminate the OS competition (or constrain it).

What has Apple done that is equivalent to these actions? And how has Apple's (minority) marketshare enabled them to do these things?

<comment><USER7> All you've started here is that you dislike Microsoft. There's zero moral difference in Apple's actions on the app store and Microsoft from yesteryears

<comment><USER9> Moral and legal are different things and you keep conflating the two. Additionally, you're the one that brought up Microsoft's anti-trust issues. If you're going to make a comparison, make it correctly. And if you're going to talk about moral and legal, make sure you distinguish between the two concepts.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> The Supreme Court isn't ruling on if the App Store is legal, they're ruling on if the class has grounds to sue correct?

<comment><USER11> Correct

 _> The U.S. Supreme Court on Monday agreed to take up Apple Inc's bid to escape a lawsuit accusing it of breaking federal antitrust laws_

[https://ca.reuters.com/article/businessNews/idCAKBN1JE1JH- OC...](https://ca.reuters.com/article/businessNews/idCAKBN1JE1JH-OCABS)

</comment></comment><comment><USER12> > Businesses that potentially could be threatened by such consumer litigation > are electronic marketplaces like the App Store, ticket site StubHub, > Amazon's Marketplace and eBay where individual sellers set prices.

I don't think the important fact of the case is the fact that sellers can set their own prices, but the fact that a single entity has total control over the distribution of a broad category of 3rd-party consumer good. So it's not Amazon and StubHub that should be worried, but groups like Nintendo, Microsoft's Xbox division, Sony, or The Blu-ray Disc Association.

<comment><USER13> > I don't think the important fact of the case is the fact that sellers can > set their own prices

This is actually an important fact of the case. The case isn't about Apple's total control over the App Store, it's about whether end-users can sue.

</comment></comment><comment><USER14> Apps are extremely tricky. The 30% does seem like a lot but if you consider a few things:

 _Apple is providing an instantaneous, global distribution network._

Save your ability to market the app, you can effectively guarantee the same experience across billions of disparate devices. The open web can not provide the same piece of mind in terms of security to the end user.

 _The app vetting process isn 't free._

Apple is ensuring quality within the App Store. Bad apps still get past Apple's vetting rules and are retroactively denied all the time. This creates extremely a strong sense of trust between the customer and Apple. Consumers become less and less risk-averse when it comes to downloading new apps from the App Store. Again, I'd argue this runs counter to the open web due to its long history of leaks, hacks, privacy violations, phishing attempts, etc. The Apple App Store currently has the highest bar for an "open" ecosystem of independently-developed software.

 _Apple provides the service of the App Store at its own expense._

The App Store has pulled in $100BB over 10 years which is great, but I'm sure they'd turn it off in a heartbeat if it consistently caused serious security breaches within the phone.

Tim Cook has gone on record so many times about the personal and private nature of the phone. Whether it's possible or not for a rogue app to circumvent Apple's numerous security safeguards is irrelevant as security is a policy Apple takes extremely seriousl; maybe to their own detriment.

 _Apple has a history of providing basic, free alternatives to apps that monopolize particular verticals within the App Store._

Calculator, Flashlight, the various flavors of Timer functionality, the new ARKit Ruler app, etc. I don't view these Apple-provided apps as akin to drug stores offering basic alternatives to things like Tylenol etc. it's good for the overall App market economy as it should stem the rise of local monopolies.

Ironically, the only app in which Apple does not offer an alternative is the App Store. The App Store isn't an alternative, it's simply the only way to download apps.

I do see a future where phones will have a heavily-reduced version of iOS that offers a small subset of Apple-created apps without the App Store. The numbers don't lie, most iPhone users do not download apps, or only download less than 10 apps over the lifetime of the phone.

At the end of the day, apps must be vetted for quality because Apple has a brand to maintain. They simply can't allow apps that seriously compromise the performance of the phone or the privacy of the data on it. It's not within the realm of an allowable reality as per Apple policy.

The 30% taken by Apple may be eclipsed by the App Store ad revenue. I assume they'll greatly reduce the 30% cut moving forward as the App Store ad revenue increases.

<comment><USER15> Something else which can't be overlooked.... Apple developed iOS, and extremely extensive APIs and documentation to go along with them which enable these apps to exist in the first place.

In many cases Apple has done the R&D and then productized entirely new hardware and software interfaces which apps leverage. When you develop on iOS you stand on the shoulder of a giant who has enabled, through extraordinary investment of labor and capital, a significant portion of the actual end-user experience of running any given app.

One might even say about 30% of that overall experience is Apple's own work product in the first place.

All that is before you even get to the extremely valuable services actually provided by the small piece of the puzzle which is itself called the "App Store".

</comment></comment><comment><USER16> Url changed from [https://www.theverge.com/2018/6/18/17474760/apple-app- store-...](https://www.theverge.com/2018/6/18/17474760/apple-app-store-ios- supreme-court-lawsuit-hearing-pepper), which points to this.

</comment><comment><USER17> It's hard to even characterize the level of impact a case like this could have. For years, the tech industry has understood that the key to success is to control the platform, and then get other developers building on and generating income for your platform. Imagine the sheer number of businesses that may have their business model blown apart by this.

If a company is ruled against on having their own app store on their own OS on their own devices, when they aren't even a monopoly-level player in the larger market, this will blow apart nearly any app store model out there.

I'll, uh, get my popcorn ready.

<comment><USER18> > this will blow apart nearly any app store model out there. But on OSX you > have an app store and you can side load applications, so you can have them > both.

<comment><USER17> OS X and Windows will probably be okay because the "default" is to install outside the store. It's not really considered "sideloading". But most other platforms with single-source app stores will be in trouble.

<comment><USER18> Why the default is important in this case, if the device owner can enable side loading in an easy way then I am okay with a secure default. Hopefully some progress is made and OSX and Windows remain unlocked even if MS and Apple are slowly pushing in the other direction.

</comment></comment></comment></comment><comment><USER7> This kind of behavior - where whole swaths of consumers pay inflated prices, and have choice severely restricted, but the company enforcing such monopoly gets away on a ludicrous technicality, needs to end.

However you look at it, completely locking down hardware owned by the user, to apps blessed by the manufacturer is the text-book definition of anti- competitive, and lest we forget, didn't exist before Apple's false "but it's all for the consumer's good" marketing blitzkrieg. Regardless of the B.S. mental gymnastics employed by Apple and it's shills, it is unfairly placed as a kingmaker in a $60B app-store market - and it's app store is designed to place it as a monopoly controller of software running on it's phones.

<comment><USER19> > However you look at it, completely locking down hardware owned by the user, > to apps blessed by the manufacturer is the text-book definition of anti- > competitive

[https://www.ftc.gov/enforcement/anticompetitive- practices](https://www.ftc.gov/enforcement/anticompetitive-practices)

[https://en.wikipedia.org/wiki/Anti- competitive_practices](https://en.wikipedia.org/wiki/Anti- competitive_practices)

The practice of locking down hardware is many things, but textbook anticompetitive it does not seem to be. Apple isn't working with other vendors to fix prices (cheap Android devices are far more common), reduce quality, or innovation.

<comment><USER7> From the wiki link: "Protectionism, tariffs and quotas which give firms insulation from competitive forces"

This is indeed text-book protectionism

<comment><USER19> How does the level of locking of the Apple App store on iOS or Mac OS insulate Apple from outside competition the likes of Samsung, Google, Huawei, etc?

Edit: In fact, doesn't the locked-down state of the hardware actually encourage competitors to release their own products? Anti-consumer could be valid here, but anti-competitive just doesn't seem correct.

<comment><USER7> Who's arguing the app store inhibits handset competition? Did you even read the article?

The argument is that Apple chokes app developers ON THE APP STORE. The existence of other handset manufactures is irrelevant

<comment><USER20> Gillette Razor Blades are not a monopoly. They are simply part of a product which is in a highly competitive market.

Talking about a monopoly within an ecosystem misses what a monopoly means in economic terms. It's a question of consumer choice and leverage.

</comment></comment></comment></comment></comment></comment><comment><USER21> If the Apple app store isn't a monopoly I don't know what is. These kind of practices make Microsoft's anti trust practices from the 90's look like child's play. I hope the Supreme Court doesn't fall for their bullshit lies about security being the reason for this setup but I doubt any of the justices will even understand the case properly, let alone make intelligent decisions.

<comment><USER9> Microsoft had something like a 97% marketshare. Apple is nowhere near that. They spent $1 billion to market a free product in order to eliminate or undermine a competitor (Netscape). They threatened hardware vendors with increased licensing fees if they sold non-Windows PCs (this helped kill BeOS and held back some efforts on selling Linux to consumers as well). MS did all of this and got away with it because of their marketshare. Without it, they wouldn't have gotten nearly as far as they did in these behaviors.

Apple isn't in the same position, at all.

<comment><USER22> >> If the Apple app store isn't a monopoly I don't know what is.

> Microsoft had something like a 97% marketshare. Apple is nowhere near that.

Whether a company is a monopoly or not seems to depend a lot how the market in question is defined, for instance:

Apple has a 100% marketshare in the distribution of iOS apps. Monopoly-era AT&T had far less than a 100% marketshare in electricity-powered devices.

<comment><USER9> That is a fair statement, but as far as the FTC is concerned that's probably not enough. The fact is that there are alternatives (for both consumers and developers) to the iOS app store. They don't get products from or on iOS, but they can still buy and sell comparable products.

By the reasoning of your statement, all that's needed to establish a 100% monopoly is a sufficiently narrow definition of market. Walmart has a 100% monopoly on products (legally/officially) sold in Walmart stores. Do they have a monopoly as far as the FTC and courts are concerned?

[https://www.ftc.gov/tips-advice/competition- guidance/guide-a...](https://www.ftc.gov/tips-advice/competition- guidance/guide-antitrust-laws/single-firm-conduct/monopolization-defined)

EDIT: Fixed typo

<comment><USER22> > The fact is that there are alternatives (for both consumers and developers) > to the iOS app store. They don't get products from or on iOS, but they can > still buy and sell comparable products.

But that's usually always true: 90s era Windows users had alternatives in the Macintosh and Sun workstations, and Monopoly-era AT&T users had alternatives in CB radios, etc.

That explainer you linked even uses language that excludes some competitor products: "Microsoft was found to have a monopoly over operating systems software for _IBM-compatible_ personal computers" [emphasis mine].

That is a fair statement, but as far as the FTC is concerned that's probably not enough....

> By the reasoning of your stament [sic], all that's needed to establish a > 100% monopoly is a sufficiently narrow definition of market.

I don't think the reasoning in my statement is sufficient to identify a monopoly, and it wasn't indented to be such. What I was trying to communicate is that you can't _disprove_ a monopoly based on comparing marketshare numbers, and the actual determination is probably rather complicated and requires a lot of expert judgement.

I think Apple's business practices warrant careful and continuous antitrust scrutiny. If they're a monopoly, the form that takes will probably be significantly different than the one taken by 90s-era Microsoft.

<comment><USER9> There were alternatives to Windows on IBM-compatible PCs, but MS actively worked to block them in the marketplace. MS also actively worked to block competitors who would break platform-centric software via things like (as Netscape was after) creating a platform-agnostic software delivery platform.

It's also important to note that the FTC doesn't actually care about monopolies in all cases. They care about monopolies that arise from abuse and anti-competitive behavior or that are used to abuse consumers and competitors.

Show that Apple is in a monopoly position (as a player in the mobile hardware/software business space) and that they got there by way of anti- competitive behavior. Or that they've abused this position to artificially control pricing and other things. That's what needs to happen to establish an anti-trust case against them.</comment></comment></comment></comment></comment></comment>


Where You Live Is Who You Are - <AUTHOR> https://mythirdbrain.substack.com/p/where-you-live-is-who-you-are <comment><USER2> No. Just no.</comment>


Fuck This Site - <AUTHOR> http://www.fuckthissite.com/

<comment><USER2> Ironic that I struggle to read the text on this page due to the horrendous colour contrast. I give you the middle finger, fuckthissite.com.

</comment><comment><USER3> As my little side project with a friend - glad to see not only did it get reposted on HN but also the code fucked with :)

</comment><comment><USER4> Seems broken/spammed. I doubt the homepage for some random local German soccer team is annoying that many people.</comment>


#SilkRoad #Bitcoin "Senators Target Website That Sells Narcotics" - <AUTHOR> http://www.npr.org/2011/06/05/136971766/senators-target-website-that-sells-narcotics

<comment><USER2> In about 48 hours, Silk Road will get used to justify the PROTECT-IP act that Sen Wyden of Oregon just put a hold on.

"Intellectual Property" is not yet one of the Horsemen of the Internet Apocalypse, but Drugs still is.

<comment><USER3> Just because they seize their domain, doesn't mean those guys will stop selling drugs, or that their "business" will be affected for too long by a domain seizure. Obviously they need to catch them and arrest them.

Seizing the domain doesn't help at all, and the fact that they are using bitcoin is pretty irrelevant.

<comment><AUTHOR> It's not a website, it's a Tor Hidden Service.

[https://secure.wikimedia.org/wikipedia/en/wiki/Tor_%28anonym...](https://secure.wikimedia.org/wikipedia/en/wiki/Tor_%28anonymity_network%29#Hidden_services)

</comment></comment></comment><comment><AUTHOR> To paraphrase the Beastie Boys [1], "You gotta fight / for your right / to barter!"

[1] <http://www.youtube.com/watch?v=eBShN8qT4lk></comment>


Get Facebook Likes in Excel - <AUTHOR> http://www.seerinteractive.com/blog/get-facebook-likes-in-excel-using-datanitro

<comment><USER2> Is it just me or is the recent surge of DataNitro scripts just proof of concepts? I don't really want to do get Facebook Likes in Excel or play Blackjack. They added a Python handler in Excel to do this, it isn't native.

My question is, why is this interesting?

<comment><USER3> My guess is advertising. HN is their exact demographic / target users, and if you check the front page of "classic" HN where only old accounts can vote: <http://news.ycombinator.org/classic> It's gone. Someone gamed this to the front page

<comment><USER4> What's the threshold for an "old account"?

<comment><USER3> Joined in the first year of HN

</comment></comment></comment></comment><comment><USER5> Competitor analysis with simple Excel tools. Hm.. I like that ! I wonder if you could build a whole Excel application for social media tracking. There are companies out there that are very successful in this space. Perhaps with your superior technology you could outdo them!

<comment><USER6> Here are some tools you might like! :)

A blog post I wrote on getting Facebook Likes/Shares, Tweets and Google +1s in Google Docs:

[http://www.distilled.net/blog/social-media/3-quick-ways- to-c...](http://www.distilled.net/blog/social-media/3-quick-ways-to-check- social-metrics/)

An awesome set of SEO tools for Excel:

<http://nielsbosma.se/projects/seotools/>

A great new tool for getting competitor backlink data in Excel:

<https://seogadget.co.uk/mozscape-api-extension-for-excel/>

</comment></comment><comment><USER7> The script is not getting 'likes,' it's pulling the number of 'shares' for a particular URL.

If you want to get to a brand's like-count, you'll need to feed the Graph API with either the Facebook Username of the account (e.g. "nike", not "<http://www.nike.com> "), or with the Facebook ID# of the brand (e.g. "15087023444").

<comment><USER6> This can be misleading though. This script does get the count you will see on a Facebook 'Like' button which is actually the sum of the 'like','share', and 'comment' counts.

For example, the script gets a count of 1,257,333 for www.apple.com:

<https://graph.facebook.com/?ids=http://www.apple.com>

Which from here we can see is the sum of the 3 values:

[http://api.facebook.com/restserver.php?method=links.getStats...](http://api.facebook.com/restserver.php?method=links.getStats&format=json&urls=http://www.apple.com)

And by entering www.apple.com as the URL here we can confirm is exactly the figure the Like button shows:

<http://developers.facebook.com/docs/reference/plugins/like/>

So whilst maybe not 100% accurate in some regards, it is certainly what many people would refer to as the 'like' count (and they'd be confused if you gave a lower number which isn't what the like button on the page showed). This tool is aimed more at URLs than brands.

</comment></comment><comment><USER8> Is there a version of DataNitro for Office for Mac?

<comment><USER9> Nope. I'll keep dreaming too. ;)

</comment></comment><comment><USER10> Some poor schmuck is wrangling excel spreadsheets with facebook integration for clueless twits, somewhere.

Glad it's not me.

</comment><comment><USER11> Python is awesome.</comment>


Why Should You Use Plain Language? - <AUTHOR> http://www.hsph.harvard.edu/healthliteracy/how_to/clear.html

<comment><USER2> Whilst we're on the topic, here is a quote from Yes Minister (<http://en.wikipedia.org/wiki/Yes_minister>):

 _"The identity of the official whose alleged responsibility for this hypothetical oversight has been the subject of recent discussion is not shrouded in quite such impenetrable obscurity as certain previous disclosures may have led you to assume, but, not to put too fine a point on it, the individual in question is, it may surprise you to learn, one whom your present interlocutor is in the habit of defining by means of the perpendicular pronoun."_

<comment><USER3> Translation: "It's me."

</comment></comment><comment><USER4> I highly recommend this read. Among the examples, you'll see plenty of (sadly) typical, overcomplicated phrases, that can often be replaced with a single word. The article also goes into presentation, such as the use of tables.

I hope many people take this to heart, because I've seen a lot of despicable writing over the years. I'd love to see more simple, direct language.

</comment><comment><USER5> "You do not really understand something unless you can explain it to your grandmother."

– Albert Einstein

<comment><USER6> My grandmother is dead, you insensitive clod!

</comment></comment><comment><AUTHOR> I have a dream. It is a dream that one day EULA will be written in a plain language.

<comment><USER7> The problem is that plain language is full of loopholes and double meanings. Legalese is hard to understand, but it tries to be precise and loophole-free.

<comment><AUTHOR> Yeah it's true generally. However, check the EULA of Google Desktop: <http://desktop.google.com/eula.html>

The word "shall" in it can be replaced with "must" to make it more plain.

Edit: This is some of the advice from the article: The use of "shall" creates confusion. To impose a legal obligation, use "must." To predict future action, use "will."

</comment></comment></comment><comment><USER8> All good advice, except:

f) Avoid using gender-specific terminology

The convoluted language necessary to do this can make things worse. This sounds more like being politically correct than anything else.

Also, I personally _hate_ chapter headings stated in the form of questions. Whenever I see that, I know the next section will be full of useless "don't worry" platitudes.

<comment><USER9> A lot of the convolution goes away if you embrace the third-person singular "they". It sounds odd at first but I'm slowly adjusting to it as I hear it more and more.

</comment></comment><comment><USER10> <http://www.bartleby.com/141/>, III especially.</comment>


Hacking "exchange rates" to an indication in "democracy term" - <AUTHOR> https://medium.com/@foreverfree_33821/hacking-exchange-rates-to-an-indication-in-democracy-term-ac03dd56c2cc <comment><AUTHOR> Let me draw a future, in which you vote hundred times in a single day, and your vote impacts immediately. You are not limited to vote only for a person or for a vague plan of a party, instead you can vote for every single decision and upvote it or defiance it immediately. And most importantly this voting doesn't take your time or energy.</comment>


Ebay password compromised? - <AUTHOR> https://www.paypal-community.com/t5/PayPal-Forward/eBay-To-Ask-Users-to-Change-Their-Passwords-No-Evidence-PayPal/ba-p/815612

<comment><USER2> No evidence that they haven't either .. eBay + PayPal > changed.</comment>


Show HN: Reddit Digest - <AUTHOR> http://digestreddit.net/ <comment><USER2> Bookmarked. Shared with a few of my friends who frequent Reddit. Definitely ranks up with ReadSpike in order to save some time and just get a gist of things on the Internet, or in this case, on Reddit. Don't want you to feel your work has gone unnoticed... as I have 3 tabs that open automatically to give me updates on technology and all that good stuff, your site has become my 4th. Thanks for sharing your project!

<comment><AUTHOR> Haha really happy to hear it. Glad that it's of use to someone other than me!

</comment></comment><comment><AUTHOR> Hi everyone, for my first post I thought I'd show something that I've been working on to kill the time over the summer between university terms. Any feedback would be greatly appreciated. Thanks.</comment>


The Sex Tape Litmus Test - <AUTHOR> http://laverick.org/blog/2012/12/23/the-sex-tape-litmus-test/ <comment><USER3> The primary function of a legal department is to provide advice that prevents legally actionable mistakes.

This advice does not have to be sane, or efficient, or indeed have any consideration towards the interests of the company other than "prevents legally actionable mistakes". A few days ago HN saw an article about setting goals and perverse incentives. This is a simple example.

Hypothetically, someone was reviewing the Sony USA employment contract and saw that there were, perhaps, non-video-game related developments which might be valuable. Then they asked the legal department "Please supply contract terms that give us as much as possible." And after an hour or two of research, they did.

The surprising thing to me is that they tried to change language for existing employees out of cycle. If they did it during a regular review cycle, even fewer people would have noticed.

<comment><USER4> _> The primary function of a legal department is to provide advice that prevents legally actionable mistakes. This advice does not have to be sane, or efficient, (...)_

Strong disagreement. As a counterport, would you agree to the following: ``the primary function of a programming department is to crank out code. the code doesn't have to run predictably, nor be maintainable nor indeed have any business requirements. KLOC is the king.''?

When I'm programming privately in my spare time, my code doesn't need to run, be maintainable or useful or anything. But as long as I'm clocked in during office hours, my work should further company's goals, in harmony with other teams and projects. And just as much with legal departments: those should consider the overall effects of advice they give out. If not them, who else is to do such analysis -- some meta-legal department?

Been there just recently; an employment contract template prepared for my company by a lawyer was so one-sided and full of risks for potential employees, I stood up to the CEO and voiced against its proposed form. I've warned the CEO a lot of self-respecting hackers would rather give up offer than work on such conditions. The contract, while legally covering the company, would have detrimental effect on our ability to hire good hackers in the first place.

<comment><USER5> It seems like a lot of engineers, both here and elsewhere, have a very simplistic view of what other departments do. I've seen similar simplistic statements about design and management. I guess that's just part of human nature, to develop the view that only _your_ work is complex or nuanced.

<comment><USER6> In this particular case though, there's not a lot of complexity or nuance, is there? It's a blanket "We own all your IP" clause in a contract.

<comment><USER5> Maybe . . . are you OK with the legal department assuming you are a lazy simpleton if you launch software with any bugs? Especially considering any misfeatures may have been implemented under management's direction?

<comment><USER6> I'm not sure that I see your point. Adding extra bits is more work for the legal team, and might lead to 'bugs', but a clause like this is going to lead to pissed off engineers who might leave.

To further mangle the analogy, what if I release bug free code that doesn't do what it's supposed to do?

</comment></comment></comment></comment></comment></comment><comment><USER7> California has a nice law that says that the employee owns IP created on his own time, unrelated to work, etc. This is a reason I moved to CA: the state I was in lacked such a law, and all the tech companies had contracts that failed the sex tape test. I suspect that for a place to flourish like Silicon Valley, it needs a law that protects self bootstrapping startups.

<comment><USER8> I guess the "unrelated to work" might be a point of debate once you create IP of high value.

In fact, in Germany we have the "Arbeitnehmererfindungsgesetz (ARBNERFG)" [1] which stipulates that your employer has first right to all patents and inventions related to your work, even if you create them in your spare time. The basic reasoning is that your employer supplies you with all tools and ressources required for the invention in question. It would be way too easy to just clock out, return to your desk and a minute later write down the world formula and sell it for billions. You're entitled to a compensation though.

The law looks a little stupid when applied to computer science but makes much more sense in a research or engineering context.

[1] I just adore german legal terms.

<comment><USER9> It's also ridiculously outdated. It's from 1957 and based on an outdated, traditional understanding of "big" industrial/engineering companies and their employees ("the little guys"). Also, it protects the companies' interests to the detriment of the employees' interests, which is understandable given that it is based on a war-time law (WWII) which was supposed to support German war engineering.

<comment><USER8> I'm not so sure that it's ridiculously outdated. Sure, it could use a brush-up but it acknowledges the basic fact that your employer often spends time educating you and allows access to ressources in your line of work that form the basis of your inventions - hence the requirement that the invention be related to your work. Fact is that inventions are rarely a stroke of genius that happens instantly in vacuum. They're often refinements and improvements of readily known things. Quite often they're obvious and simple in hindsight. It's a hard balance to strike, but just giving the option of moving all "inventions" to after-hours so that the employee gets all benefits won't cut it either, especially with modern work-time models such as flex-time or home office. I don't have a perfect solution, but giving the employer first-buy rights seems like a reasonable starting point for a compromise. The law stipulates a reasonable and fair compensation for the work provided.

</comment></comment></comment></comment><comment><USER10> I've brought this up as the "child porn" clause, and had brought it up in an employment contract once many years ago. Basic language was "we own anything you create". I said "I don't really think you want that - if I create some child porn, you're the owners". I seem to remember I had some less restrictive language placed in my contract vs that one, but I don't think it made a change to anyone else's contracts.

Yes, it felt a bit 'nuclear' dropping such a charged statement like that, and even when I bring it up as an example in conversation, some people cringe - <USER2> 'sex tape' analogy might be less offensive to some, but the basic premise still stands. Any company that wants to claim ownership of every piece of content or code I 'create' needs to understand what that _really_ entails. It might actually give some people license to work on legally questionable stuff (not child porn so much as, say, banned crypto), knowing that they don't really 'own' it and thinking someone else might be responsible for the consequences.

<comment><USER11> IANAL , but I believe in this case the offence would be in the creation and distribution of this content not necessarily in owning the IP.

Otherwise you could technically make the same argument about instagram for example.

<comment><USER10> nothing said about distributing it, although I see your point on the creation of it. But I'm not sure I'd be able to make that distinction about anything else valuable - "well, company x, you might 'own' this, but I created it and can do whatever I want with it". They want the benefits without any risks - ain't gonna happen.

Well... I say that, but I think everyone might have their price. I've got mine, and yes, sure, would I sign away all my IP created during employment for $x? yes, but no one has yet come close to that $x in job offers I get.

<comment><USER11> Employment contracts are almost always written to supply as many benefits to the employer and mitigate as many risks as possible.

The worst case scenario for them is that they find out that certain clauses are not enforceable. In reality I imagine it is often known that some may be unenforceable but they are added anyway on the basis that the employee doesn't know this.

<comment><USER10> One of the few things I've learned over the last 10 years or so is to be much bolder in work/job relationships. If I see something in a contract that is too one-sided, I strike it out and bring it up and say "I'm not agreeing to that". Will I sign a contract with, say, a 5 year non-compete (even assuming the non- compete is enforceable)? Generally no, unless there's a huge compensation package tied to make up for the time when I can't use my knowledge in the market. Would I sign one with a 3-6 month non-compete? Probably.

15 years ago I'd sign anything. Today, not so much.

<comment><USER11> This is true, many people don't realise that contract terms are technically negotiable in the same way that salary and things are.

</comment></comment></comment></comment></comment></comment><comment> guard-of-terra I think that any funny clauses in the contracts should be abolished and the worker/employer relations should only be regulated by law.

This makes me pro-regulation and anti-market, but unfortunately I see exactly zero ways in which market can make contracts better. What are you expected to do in this situation - quit?

<comment><USER12> Yes, you can quit and work somewhere else. Also you can read about what Sony does on Hacker News and decide not to apply there for a job in the first place.

I really hope you are not actually against customized employment contracts- there are a lot of cases where they can be useful. What might be better is prohibiting instances of terms you find offensive. For example, California's moonlighting law, which effectively voids such clauses in employment contracts: [http://www.quora.com/Legal-Issues/Which-California-laws- prot...](http://www.quora.com/Legal-Issues/Which-California-laws-protect- moonlighting)

<comment><USER13> I think for many people it's going to be hard to fulfill the following:

> ... except for those inventions that either: (1) relate at the time of > conception or reduction to practice of the invention to the employer's > business, or actual or demonstrably anticipated research or development of > the employer ...

As a programmer, there's not a lot I can do that is going to be considered wholly unrelated to what I'm employed for... at least it would be murky enough that the employer would have a good court case. This is infinitely more so for anyone working with Google, Apple, or any other company that has got their fingers in everything.

<comment><USER13> xugle, it seems your account got caught by the reapers. I found your comment to be informative, so it must have been some sort of mistake.

</comment></comment></comment></comment><comment><USER14> IP assignment is the only thing I really negotiate when I take on a new position. I had one company back-pedal as they were trying to change their terms from _nothing_ to _we own anything you make, any time_. I had the CEO/CTO of another company write in plain English that anything done in my free time and without using company-owned facilities/hardware was my own IP (their legal bla-bla was unclear).

In the first case, the corrected terms got applied to everybody in the company but in the second, I believe I'm the only one who is protected thank to that written note.

I always use the analogy of an English teacher writing a book on his spare time. How he would actually be encouraged to do so, weighting how this would reflect nicely on the school he works at etc..

<comment><USER15> > I always use the analogy of an English teacher writing a book on his spare > time. How he would actually be encouraged to do so, weighting how this would > reflect nicely on the school he works at etc..

I think limiting IP ownership to right of first refusal is important for the same reasons. If I'm guaranteed that _either_ the company will use the IP I developed, and I will (presumably) be rewarded for it or at least be able to include it on my resumé, _or_ that I can own the IP myself, it is worthwhile to me to work on projects in my spare time.

However, without that guarantee, it's entirely likely that works I produce which are significant to _me_ but not to my company will end up gathering dust on a shelf. Hence I'm disincentivized to work on such (potentially enriching) spare-time projects.

</comment></comment><comment><USER16> In case anyone is in a position to hire programmers and cares about treating creative people fairly, we have an open source Hacker Employment Contract: <https://www.docracy.com/hackercontract> that tries to fairly handle stuff like IP created after hours.

<comment><AUTHOR> Thanks for posting this. Standard documents are great. Even if you don't get to use them they provide a point of reference for negotiating terms.

</comment></comment><comment><USER17> While I was working at Earthlink in 1999, they had a similar clause and I had a similar thought.

Although not around a sex tape, I though about a computer virus released from my Earthlink corporate email account. If I sent it out the virus technically belonged to Earthlink and not me. However, after talking to a lawyer about it years later, he explained there is ways the corporation could get out of the clause.

</comment><comment><USER18> Every time I've gotten one of these documents I've amended it to "any IP for aspect foo of business bar." Example: video training software, or freemium mobile games. My employers have not objected, and it's a restriction I cane live with.

Honest employers want to keep you from competing with them while on the payroll, and want to avoid any claims that company IP belongs to you. Amend the document to address that and they may agree.

</comment><comment><USER19> IANAL, but I have heard of something called the Reasonable Person Standard. Since the US is based on Common Law, I believe this standard could be used if this were really tested in court:

``The reasonable person (historically reasonable man) is one of many tools for explaining the law to a jury.[1] The "reasonable person" is an emergent concept of common law.[2] While there is (loose) consensus in black letter law, there is no universally accepted, technical definition. As a legal fiction,[2] the "reasonable person" is not an average person or a typical person. Instead, the "reasonable person" is a composite of a relevant community's judgment as to how a typical member of said community should behave in situations that might pose a threat of harm (through action or inaction) to the public.[3] The standard also holds that each person owes a duty to behave as a reasonable person would under the same or similar circumstances.[4][5] While the specific circumstances of each case will require varying kinds of conduct and degrees of care, the reasonable person standard undergoes no variation itself.[6][7] The "reasonable person" construct can be found applied in many areas of the law. The standard performs a crucial role in determining negligence in both criminal law—that is, criminal negligence—and tort law. The standard also has a presence in contract law, though its use there is substantially different.[8] It is used to determine contractual intent, or if a breach of the standard of care has occurred, provided a duty of care can be proven. The intent of a party can be determined by examining the understanding of a reasonable person, after consideration is given to all relevant circumstances of the case including the negotiations, any practices the parties have established between themselves, usages and any subsequent conduct of the parties.[9]"

</comment><comment><USER20> Note. The contract, as described , would not hold for California employees.

See [http://www.leginfo.ca.gov/cgi- bin/displaycode?section=lab...](http://www.leginfo.ca.gov/cgi- bin/displaycode?section=lab&group=02001-03000&file=2870-2872) if you don't know what I'm talking about.

(That said, Sony probably does enough different things that the difference does not matter much to most people.)

<comment><USER21> In California the contract is often modified to include something like "except where prohibited by law" which means that the company gets IP assignment any time that 2870 doesn't apply.

</comment></comment><comment><USER22> (tl;dr: in California, such agreements are unenforceable)

I don't know what state the author was in when he was working for Sony, but California State law prohibits such arrangements in employer agreements (Labor code section 2870):

[http://www.leginfo.ca.gov/cgi- bin/displaycode?section=lab...](http://www.leginfo.ca.gov/cgi- bin/displaycode?section=lab&group=02001-03000&file=2870-2872)

2870\. (a) Any provision in an employment agreement which provides that an employee shall assign, or offer to assign, any of his or her rights in an invention to his or her employer shall not apply to an invention that the employee developed entirely on his or her own time without using the employer's equipment, supplies, facilities, or trade secret information except for those inventions that either: (1) Relate at the time of conception or reduction to practice of the invention to the employer's business, or actual or demonstrably anticipated research or development of the employer; or (2) Result from any work performed by the employee for the employer. (b) To the extent a provision in an employment agreement purports to require an employee to assign an invention otherwise excluded from being required to be assigned under subdivision (a), the provision is against the public policy of this state and is unenforceable.

</comment><comment> at-fates-hands The interesting thing to me is how is this even enforceable? Most of my friends keep a tight lid on all their freelance work - how would they even know someone had broken this contract?

</comment><comment><USER23> My current employment contract says that even IP /related/ to my employer's business, as long as it is done on my own equipment and my own time, is mine.

It's an enlightened place.

I expect to have to prove it, to some extent, if it ever came up. Which is one of the reasons I have a private github account; commit logs on machines not controlled by me might be useful.

</comment><comment><USER24> I think my Sony (Sony Europe not SCE) contract said "in the course of employment" which I went back to HR for clarification that it meant things related to or done for work. The in/during difference being very key. I seem to recall that I got the necessary clarifications and I've left now so no need to worry.

</comment><comment><USER25> I'd love to know of any instances of this (work done in personal time being legally given to the company person worked for at the time) going to court.

Sounds like a non-compete clause to me; ie. basically unenforceable.

</comment><comment><USER26> This story is missing the best part, which is where the compliance officer bluescreens after being asked about whether the sex tape would be owned by Sony.</comment>


Ask HN: What is the best developer conference talk you saw in 2011? - <AUTHOR> What is the best developer conference talk you saw (in person or on video) in 2011?  What taught you or inspired you the most? <comment><USER2> Strangeloop - great speakers (including my favorite keynote in years by Rich Hickey <http://www.infoq.com/presentations/Simple-Made-Easy>) and great variety (<https://thestrangeloop.com/sessions>). I'm also happy that all of the presentations will (eventually) be available on the web ([https://thestrangeloop.com/news/strange-loop-2011-video- sche...](https://thestrangeloop.com/news/strange-loop-2011-video-schedule)).

I'll definitely be attending in 2012.

</comment><comment><USER3> Strange Loop 2011, "We really don't know how to compute", Gerald Sussman ([http://www.infoq.com/presentations/We-Really-Dont-Know- How-T...](http://www.infoq.com/presentations/We-Really-Dont-Know-How-To- Compute)).

That's not entirely fair though, insofar as I'm a sucker for a Sussman talk.

Beyond that, I'd have to say Sam Aaron's Overtone presentation @ Clojure Conj 2011.

At the moment, it strikes me that the obvious common element of both talks and speakers are their absolutely infectious enthusiasm for their respective specialties.

<comment><USER4> Sam is a complete rock star. One of the few people I know who can get showstopper applause in the middle of a talk.

</comment></comment><comment><USER5> Being in Aus we don't get to see many live and rely on the videos being made available. Of those I particularly liked Daniel Spiewak's "Extreme Cleverness: Functional Data Structures" and Rich Hickey's "Simple Made Easy".

We were fortunate enough though to have the excellent YOW conference with many excellent talks, particular stand-outs coming from Simon Peyton-Jones and Mike Lee, but the absolute best talk (not necessarily the best tech, it is Perl after all) was Damian Conway's flabbergasting "Temporally Quaquaversal Virtual Nanomachine Programming In Multiple Topologically Connected Quantum- Relativistic Parallel Timespaces...Made Easy!"[1]

[1] [http://www.yowconference.com.au/YOW2011/general/workshopDeta...](http://www.yowconference.com.au/YOW2011/general/workshopDetails.html?eventId=3496)

</comment><comment><USER6> Coincidentally I was asked I put together one of those "top 15 of 2011" lists for .NET magazine on more or less this topic, you might find these of interest: [http://www.netmagazine.com/features/2011-review-15-web- confe...](http://www.netmagazine.com/features/2011-review-15-web-conference- talks-you-need-watch)

</comment><comment><USER7> "Extreme Cleverness: Functional Data Structures in Scala" at Strange Loop.

[http://www.infoq.com/presentations/Functional-Data- Structure...](http://www.infoq.com/presentations/Functional-Data-Structures- in-Scala)

</comment><comment><USER8> Strangeloop 2011 - Bryan O'Sullivan

Running a Startup On Haskell: [http://www.infoq.com/presentations/Running-a- Startup-on-Hask...](http://www.infoq.com/presentations/Running-a-Startup-on- Haskell)

<comment><USER9> _transcribed_

[https://docs.google.com/document/pub?id=1eQiXRyStqCVVlp6cMuc...](https://docs.google.com/document/pub?id=1eQiXRyStqCVVlp6cMucQZ6K3nX4eeaPOkzzgOJRSc7w&pli=1)

</comment></comment><comment><USER10> Simple made Easy by Rich Hickey by several miles.

Also "Hammock Driven Development" by the same gentleman.

</comment><comment><USER11> That's easy : Simple made easy by Rich Hickey

<comment><AUTHOR> Video for "Simple Made Easy" from Strange Loop: <http://www.infoq.com/presentations/Simple-Made-Easy>

<comment><USER12> Thanks for the link, and to the others, for the recommendation. What a great talk!

</comment></comment></comment><comment><USER13> Theo Schlossnagle's "Career Development" (Velocity 2011 Keynote):

<http://www.youtube.com/watch?v=y0mHo7SMCQk>

</comment><comment><AUTHOR> One of the most inspiring talks I saw this year was Sarah Allen's talk about teaching programming to kids: "Easy as Pie" ([http://www.infoq.com/presentations/Easy-as-Pie-Teaching- Code...](http://www.infoq.com/presentations/Easy-as-Pie-Teaching-Code- Literacy)). A month later I found myself teaching my first programming class to kids and I'm hoping to do some more early next year.

</comment><comment><USER14> Of course. Strange Loop 2011.

</comment><comment><USER15> Glyph's keynote at Djangocon was hilarious and accurate. It also immediately sparked some wonderful and deep discussions about the future of Django.

<http://blip.tv/djangocon/keynote-glyph-lefkowitz-5573264>

</comment><comment><USER16> Business of Software 2011 in Boston was great as usual. 300+ people that actually run software companies getting together to learn from each other. The most targeted conference for software entrepreneurs that I've seen.

</comment><comment><USER17> Microconf 2011 by a few hundred country miles.

I have never had my head crushed by so much actionable info in 1-2 days. The entire conference was worth it by the time the first speaker had done his session and it kept getting better.

<comment><USER16> I'll second you on Microconf. Rob and Mike have announced they will be having a 2012 conference to. This conference focuses on individuals who want to create and run software companies without outside funding.

</comment></comment><comment><USER18> Sounds cliche and possibly like I'm pandering to the HN crowd, but Startup School. I quote it constantly - almost on a daily basis. It wasnt way more about soft skills than actual code, of course, but I find that to be more important.

Also, my best advice at any conference is to take notes. I took comprehensive Startup School notes, and reviewed them later. I never would have gotten so much out of it if I hadn't.

</comment><comment><USER19> I like Mike Lee's talk 'Product Engineering' at SL2011 <http://www.infoq.com/presentations/Product-Engineering> as well as DHH's Railsconf 2011 Keynote speech on Asset Pipeline.

Learnt quite a bit from these two talks.

</comment><comment><USER20> There was a Ruby talk the guys at Nulayer did in Toronto that showed that Ruby can be nearly as fast as NodeJS. I wasn't fully convinced but I learned a ton of useful things.

</comment><comment><USER21> Two of the lunchtime sessions at WWDC really inspired me as did much of the entire conference.

Morten Lunds talk at the Power of 1 conference in Battersea powerstation

</comment><comment><USER22> Design in the Land of Sharp Pointy Technologies, at Twiliocon

</comment><comment><USER23> I liked the WWDC talks and Chris Liscio's talk at Çingleton.

<comment><USER6> Chris' talk is available as a video <http://lanyrd.com/2011/cingleton- symposium/smfww/>

</comment></comment><comment><USER24> Josh Bloch's talks at Devoxx alone were worth the trip.</comment>


South Korea's education system: The great decompression - <AUTHOR> http://www.economist.com/news/leaders/21588373-there-are-perils-country-having-all-your-children-working-too-hard-one-big-exam?fsrc=scn/tw/te/pe/thegreatdecompression

<comment><USER2> Sounds like an opportunity for someone with a different perspective to hire all the late blossomers...</comment>


Show HN: A new tab page that shows tech/news headlines - <AUTHOR> https://www.ctrltab.io <comment><AUTHOR> Hello everyone!

First, a little background: 4 years ago, I found a chrome extension called Tabbie ([https://github.com/jariz/tabbie](https://github.com/jariz/tabbie)) and instantly fell in love. However over the years, bits and pieces of the underlying stack started deprecating, and eventually, it stopped working entirely. For the past year or so I couldn't find any comparable chrome extension that worked equally as well, and so I set out to create my own.

Thus I created ctrl-tab. ctrl-tab is an open source Chrome and Firefox extension (powered by Vue.js) which lets you customize your new tab page with feeds from the most popular tech and news sources, including Hacker News! (For the full list of supported data feeds, check the website.) You can add/remove tiles via the menu and drag and drop them to make it look like how want.

Currently, the Chrome extension supports logging into Todoist (very BETA), and I plan on adding many more login options, starting with (Reddit). In addition, I am working on supporting custom RSS feeds to allow you to add any sites that the extension doesn't already cover.

Please report any bugs you encounter, as well as any providers you would like to see added here: [https://github.com/ludicrousxyz/ctrl- tab](https://github.com/ludicrousxyz/ctrl-tab)! I would love to hear your thoughts and answer any questions you may have!

Thank you!

</comment><comment><USER2> You may check out Panda, it allows you to add custom RSS feeds. [https://chrome.google.com/webstore/detail/panda-5-news- inspi...](https://chrome.google.com/webstore/detail/panda-5-news- inspiration/haafibkemckmbknhfkiiniobjpgkebko?hl=en)</comment>


Reddit: I drove my Jeep right around Africa. AMA - <AUTHOR> https://www.reddit.com/r/IAmA/comments/brhbst/i_drove_my_jeep_around_africa_reddit_said_i_would/ <comment><USER2> > Personally, I'm very tempted to live in Zimbabwe. Although the government is > in utter shambles - and has been for decades - the people there are > phenominal. They have every right in the world to complain about basically > everything, and yet I never heard a single person complain in my 6 weeks all > over the country.

A country whose government is in shambles but whose people learned over time not to care, sounds depressing.

That mixed with your definition of what it means to _truly live_ :

> living in the now, and not giving up enjoyment today for some chance at a > possibly happy future.

Those bits together paint kind of a dystopian picture, IMO.

</comment><comment><AUTHOR> I post here fairly often, and people have been interested in what I'm doing with my life.

I was a Software Engineer. I sold all my stuff, and went out and lived my dream.

<comment><USER3> I don't have a reddit but while I can ask you... what do you think of the 4Runner? Could it do the same journey?

<comment><AUTHOR> They're great, and yes, I think it absolutely could. It's more about the determination of the driver than the vehicle, IMO</comment></comment></comment>


Congrats, you have an all male panel - <AUTHOR> http://allmalepanels.tumblr.com/ <comment><USER2> I'm sure that a lot of these conferences had speakers by invitation and that the only people that applied to speak were 'white males'. It's sad to see that a more diverse speaker group didn't step up to the plate here.

I wholly support getting more women into technical fields (because we know they are underrepresented as a population) but no one is going to force them to do it. I'm not sure what the best way to do this is.

<comment><USER3> > I'm sure that a lot of these conferences had speakers by invitation and that > the only people that applied to speak were 'white males'.

How are 'speakers by invitation' and '[people] applied to speak' compatible?

</comment></comment><comment><USER4> More SJW nonsense. Moving on.</comment>


Ask HN: From programmer to painter - <AUTHOR>

I'm finishing comp. sci this year, still young(22) and what really got me into programming(perl, about 12 years ago) were making pages. In that time people used to "webmaster", I probably went the programming/developer route due the fact that "programming is more important" and also, before you know a lot, it's... really awesome.
But... that passion to art is still in me, I feel that is something that my mind tells me that "I should also be good in it before dieing".
I can study visual arts in a public(free) university here(Brazil, public > private here).
Do you guys think that it's a good idea to just study it? By the time I finish it I will be around ~27 and I can dedicate the rest of my time to startups and even drop out if I want to. I'm always looking at paitings and art and I feel that I have to do something about it.
Does anybody here have experience into getting 2 degrees in different areas and can give me some advice into it? What about the new perspectives that you get from studying it? Is it good?
Thanks in advance, you guys rock! <comment><USER2> Olá. Brazilian here.

You don't need a degree in order to paint. Just enroll in a private art school (not college) or "ateliê". If you live in a capital I'm sure you'll find plenty.

As you know, very few people can make a living by painting. Why not make a career in programming and paint as a hobby? You could even teach part time at a private college and still have plenty of time to learn how to paint.

</comment><comment><USER3> You're just finishing one (useful) degree and you're considering doing a second (useless) one? This sounds to me like typical end-of-university doldrums with a bit of quarter-life-crisis thrown in.

My advice would be to give the whole full time work thing a try for a couple of years. It may be that your desire to go back to university will abate. Then again, maybe it won't, and at least you'll have some more money saved up.

Four years is a lot of your life to invest in learning to paint, so I advise being _really_ sure about it before you do it. And if you were _really_ sure you wouldn't even be asking.

<comment><USER4> To you it's useless, to others it's a form of creativity - why diss it? I wouldn't say art is a useless degree. It's all about what you do with it. Comp Sci is useless if you don't use it for interesting projects.

</comment></comment><comment><USER5> Yes!

1\. Steve Jobs studied calligraphy. At the Stanford commencement address he said:

"I decided to take a calligraphy class to learn how to do this. I learned about serif and sans serif typefaces, about varying the amount of space between different letter combinations, about what makes great typography great. It was beautiful, historical, artistically subtle in a way that science can't capture, and I found it fascinating.

None of this had even a hope of any practical application in my life. But ten years later, when we were designing the first Macintosh computer, it all came back to me. And we designed it all into the Mac. It was the first computer with beautiful typography. If I had never dropped in on that single course in college, the Mac would have never had multiple typefaces or proportionally spaced fonts."

(Reference <http://news.stanford.edu/news/2005/june15/jobs-061505.html> )

2\. Paul Graham studied painting at RISD

(He writes about art here: <http://www.paulgraham.com/goodart.html> )

3\. And, closer to home for me: my co-founder's first degree was in economics, but he still felt something missing, so he got a second degree which started in painting but ended up in design. He ended up with a completely unique ability to think in a both left- and right-brained way simultaneously.

So, if you feel that both programming and painting reside within you, then you are rare, and my evidence strongly suggests that you find some way to nurture these parts of yourself.

</comment><comment><USER6> I worked as a graphic designer and digital painter before getting a degree in film editing. I've ended up as a programmer making software tools for artists (and affiliated people in production environments).

If you have a passion for art, don't ignore it. The beauty here is that it's possible and useful to combine your software expertise with almost any other field. You don't have to decide now to go down that route; the opportunities will present themselves eventually. If you're going to do a startup later, the ideas worth exploring will almost certainly stem from experience you have outside of the programming domain. (The world has enough bug trackers and JavaScript frameworks; you'll have better luck making an impact with something else.)

</comment><comment><USER7> i studied fine arts majoring in painting. i love the arts in general, but somehow i also got discontented by doing things that does nothing but hang there. and that's why i ended up as a programmer now, to do stuff that works. i still continue doing art-related stuff though.

</comment><comment><USER8> well, every degree is a plus. with a programming and an art degree, you're sure more welcome to the game developer scene, than with just your programming degree.</comment>


A Week With Uber And This Blogger Is Totally Hooked - <AUTHOR> http://techcrunch.com/2011/03/02/a-week-with-uber-and-this-blogger-is-totally-hooked/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29 <comment><USER2> I LOVE UBER. A nice touch (one of many) is how they always say "Nice to see you again, David" whenever I'm with a girl.

</comment><comment><USER3> How does Uber get away with having people pay with credit cards, rather than Apple's in app payments? They seem to be a good example of the "can't (easily) afford to have Apple skim 30% off the top" category

<comment><USER4> Apple specifically forbids in-app payments for non-digital goods/services.

</comment></comment><comment><USER5> I've heard that there are non-uber cabs in San Francisco, but I've yet to successfully ride in one.

</comment><comment><USER6> How many people are willing to pay twice the price of regular cabs - it's not really something I'm interested in splurging for unless it's extremely inconvenient to get a cab where I am.

<comment><USER7> i'm unsure how the cabs are in san fransisco, but this is a valid concern in nyc where cabs are abundant. i wouldn't pay twice as much when waits are usually nothing to complain about.

<comment><USER8> @catshirt, what would you pay? how price sensitive do you believe new yorkers are?

</comment></comment></comment><comment><USER9> Did their Google v. Facebook challenge go away? The leaderboard is still there (<http://www.uber.com/smackdown-leaderboard>) but the blog post is not (<http://blog.uber.com/2011/02/28/uber-tech-smackdown/>)

<comment><USER10> <http://blog.uber.com/2011/03/01/uber-tech-smackdown/>

</comment></comment><comment><USER11> A bit of an aside: nowadays, there will be 2-3 Techcrunch stories on the front page of HN at any given time of day.

Is Techcrunch content really that appealing to the HN crowd? Why not just visit TC?

P.S. I also see ReadWriteWeb gaming the site hard.</comment>


Overrun With Messaging Apps  - <AUTHOR> http://techcrunch.com/2013/12/06/overrun-with-messaging-apps/?ncid=twittersocialshare <comment><USER2> What really disappoints me about the current crop of VC funded messaging apps is that none of them care very strongly about user privacy. Even apps that claim to keep your messages "encrypted" are closed source and don't include details about their encryption techniques.

There are open source encrypted messaging apps like ChatSecure [1][2], and TextSecure [3] but they lack some of the modern vanity features that users expect and they can seem difficult to setup for an average user.

1\. [https://github.com/chrisballinger/Off-the-Record- iOS](https://github.com/chrisballinger/Off-the-Record-iOS)

2\. [https://github.com/guardianproject/ChatSecureAndroid](https://github.com/guardianproject/ChatSecureAndroid)

3\. [https://github.com/WhisperSystems/TextSecure/](https://github.com/WhisperSystems/TextSecure/)

<comment><USER3> It's amazing the most crucial applications in our day to day lives are absolutely awful. Why is there not a great messenger application available, that's simple, well designed, and secures our data? Why is there not a proper alternative to Skype, offering free group video calling, while protecting our privacy? Why does e-mail feel so dated and sloppy? I sent out a handful of e-mails last week, my mail server said they were sent, but none of the recipients received them. I sent another message to a friend the other month, and she missed it because it went to her spam folder. Why do I even receive spam? I know you can setup a whitelist only, but why isn't this more of a standard, where I build a contact list with friends, and we can leave messages back and forth, receive proper confirmation they're received, read, etc. It would be nice if I could login to my e-mail, and see I have 20 friends, 10 sites that are able to message me, and then manage that list by adding or removing.

We have some incredible apps and software out there, but the most important ones are those lacking the most.

<comment><USER4> > I know you can setup a whitelist only, but why isn't this more of a > standard, where I build a contact list with friends, and we can leave > messages back and forth, receive proper confirmation they're received, read, > etc. It would be nice if I could login to my e-mail, and see I have 20 > friends, 10 sites that are able to message me, and then manage that list by > adding or removing.

This actually is pretty much how Facebook messaging works.

</comment></comment></comment><comment><USER5> A pretty relevant article about what myself and temas are working on now: [http://www.theverge.com/2013/12/4/5173726/you-have-too- many-...](http://www.theverge.com/2013/12/4/5173726/you-have-too-many-chat- apps-can-layer-connect-them)

IMO, interop/federation is going to be a tremendous long-term effort and include many standards, but is definitely feasible, inevitable even. There's a lot of innovation happening in messaging again thanks to mobile, we just need to start taking the best of what we've all learned already and work together to improve everyone's stack collectively.

<comment><USER2> Layer seems interesting but I think the reason XMPP ultimately succeeded was because of federation and a healthy open source ecosystem. We are drafting a federated, minimal knowledge push server design for privacy-minded chat apps: [https://github.com/ChatSecure/ChatSecure-Push- Server/tree/ma...](https://github.com/ChatSecure/ChatSecure-Push- Server/tree/master/docs/v3) (a little out of date)

</comment></comment><comment><USER6> Everythign old is new again. Remember the days of MSN vs ICQ vs AIM etc etc etc?

<comment><USER7> Yes... Why can't people just download Trillian and stop giving Snapchat and Whatsapp billions of dollars. le sigh

<comment><USER6> SnapChat makes sense because it's got the whole deletion-driven ephemral images model. That doesn't really require its own protocol, though.

Now I'm fantasizing about some kind of extensible system that allows that kind of special messaging. Making a cross-platform system for that would be _hard_. HTML5+JS message bodies (omg security!)? Plugin architecture? Idunno.

<comment><USER8> [http://en.wikipedia.org/wiki/Extensible_Messaging_and_Presen...](http://en.wikipedia.org/wiki/Extensible_Messaging_and_Presence_Protocol)

<comment><USER6> TIL what XMPP stands for. Neat! I thought Google said they dropped it because they had trouble extending it to do the things they wanted with Hangouts... when the whole point of the protocol was extensibility? That's unfortunate.

</comment></comment></comment></comment></comment><comment><USER9> All of these apps are essentially doing the same things - sending text, pictures, and status notifications. It's a hard sell, but we really need a standard like email or xmpp to allow interoperability.

<comment><USER10> Google killed Talk (XMPP), replaced it with hangouts, and is suddenly offering to replace my SMS app and send them all through hangouts. I get that this works as a direct competitor to Messages, but I'd really rather just see Jabber or something like it here.

<comment><USER9> I agree. I'm pretty much okay with any standard, as long as it's, well 'standard'. It just seems a bit ridiculous to have all these different apps essentially doing the same thing, but with different front end interfaces, and unable to communicate with each other.

<comment><USER11> XMPP _is_ standard. Grab a client for the platform of your choice [0], open an account on ddg.gg (duckduckgo's xmpp server), and you're done. I personnally use pidgin on the desktop and chatsecure on Android.

The only thing XMPP is lacking is marketing. Multi-billion-dollars-level marketing; shouldn't be too hard to do, right ?

[0] [http://xmpp.org/xmpp-software/clients/](http://xmpp.org/xmpp- software/clients/)

<comment><USER12> XMPP is not technically well-suited to mobile devices. It was designed with a base-level assumption that any client will maintain a constant TCP connection in order to receive messages. This doesn't fit well with mobile devices, which spend most of their time 'off' and try to have as little software running concurrently as possible in order to save battery life. Some mobile XMPP clients have come up with various clever workarounds, but all of them are hacks. For example, by keeping the 'real' XMPP connection open indefinitely on a remote, third-party server, and then communicating with the mobile app using a custom proprietary protocol that doesn't have this assumption.

A new protocol is needed. In fact, just the other day there was a story on HN where the original creator of XMPP said the same thing: [https://news.ycombinator.com/item?id=6849755](https://news.ycombinator.com/item?id=6849755) The merits of his proposed solution are another matter, though.

<comment><USER11> So, BOSH [0], aka XMPP-over-HTTP ? Originally intended to allow XMPP in the browser, it turned out [1] to be solving a lot of other problems, including the frequent disconnections of a smartphone.

[0] [http://xmpp.org/extensions/xep-0206.html](http://xmpp.org/extensions/xep-0206.html) [1] [https://metajack.wordpress.com/2008/07/02/xmpp-is-better- wit...](https://metajack.wordpress.com/2008/07/02/xmpp-is-better-with-bosh/)

</comment></comment></comment></comment></comment></comment><comment><USER13> For a while I was heavily using Adium, with many extensions, theme packs, and Whatsapp. I'm now just using Messages on mac/iphone and much prefer it. Bells and whistles are only interesting for so long. Text and emails, on computer and phone beats any long feature list.

Same for music, I had customised Winamp and another one I can't remember the name of, but now I'm back to iTunes. I do need a new podcast client now that iTunes makes it difficult to know which episodes are downloaded. Any suggestions?

</comment><comment><USER14> Oh where or where is the IETF. This is the kind of thing that needs a standard for the message content in a way that is extensible. Maybe plain HTML/CSS is sufficient for most stuff. Does anything from the Jabber world work for this?

I hate the million inboxes I have. It would be nice if you could at least use one application to manage all the inboxes of all the devices.

Seems like Google Wave was a good first attempt at an open-source standard that could have worked here.

</comment><comment><USER15> Google is making a play too, with Hangouts now handling SMS. Although the people I've talked to who try that hate it, because it often sends a chat message when they wanted to text the person. Texts are just seen as much more personal and immediate where are chat texts aren't much different from email.

<comment><USER16> Maybe they should put a big SMS label on it so you know, or put "SMS 000-000-0000" at the top to signify it's an SMS chat rather than the Hangout. (This is how it is today, btw)

<comment><USER17> There's a toggle at the top of the app that lets you choose whether you want to send your contacts an SMS or an IM.

I've been using the Hangouts app for a few weeks now and am pretty impressed with it so far. It's become my go-to messenger. All of my friends usually keep their Gchat open during work, so switching seamlessly between chat and SMS has been a pretty good experience so far.

The app, though, is a little slow to load and send SMS's, but not enough to warrant disuse.

</comment></comment></comment><comment><USER18> It's sad none of them offers anything interesting. Snapchat was novel for 5 seconds, and now it's just old and stupid...</comment>


Tire: Lightweight JavaScript library for modern browsers - <AUTHOR> http://tirejs.com

<comment><USER2> Any size or performance benchmarks vs Zepto?</comment>


US accuses China of pointing lasers at its pilots from Djibouti base - <AUTHOR> http://www.bbc.com/news/world-asia-china-43999502 <comment><USER2> The NOTAM (Notice To Airmen) that a lot of this reporting originated from:

[https://pilotweb.nas.faa.gov/PilotWeb/notamRetrievalByICAOAc...](https://pilotweb.nas.faa.gov/PilotWeb/notamRetrievalByICAOAction.do?method=displayByICAOs&reportType=RAW&formatType=DOMESTIC&retrieveLocId=HDAM&actionType=notamRetrievalByICAOs)

Scroll to the bottom.

</comment><comment> tushar-r Sounds like something out of Tom Clancy's "Debt of Honour" : [https://en.wikipedia.org/wiki/Debt_of_Honor](https://en.wikipedia.org/wiki/Debt_of_Honor)

</comment><comment><USER3> It surprises me that an attack as simple as this is effective against a military aircraft. Wouldn't this be an ideal tactic for low technology insurgents to use as a counter against attack helicopters?

<comment><USER4> I think that depends on the willingness of the attack copter "to attack". In this case they are not in a war, thus unwilling to escalate, in a war sitch, I'm sure they'd fire back. (Neutralize the source, in parlance).

<comment><USER5> And there's no better way to give away your position than to display a beam of light emanating from it.

<comment><USER6> This would be pretty easy to automate so you could turn it on and off remotely.

</comment></comment></comment></comment><comment><USER7> Seems like a simple mirror coating (or gold foil) on the pilot's visor could mitigate. Or, if pilots don't have visor, make each aircraft have a few pairs of anti-laser sunglasses if they are being bothered.

</comment><comment><USER8> Chinese dictatorship is panicking; it's economy is en route to a crash, sped up by tariffs and trade restrictions coming from US and Europe. It will be interesting if their people wake up to their dystopia filled with pollution, random house arrests, disappearances, censorship, higher prices for consumer goods, and jobs disappearing.

<comment><USER9> "Wake up to" May not be the right phrase when many of those things are the normal that many have known their whole lives.

<comment><USER10> One could also phrase such a dystopia like this about western civs.

<comment><USER11> How would one phrase it?

People will wake up and realize they are debt slaves to an elite few, with livelihoods being made obsolete by tech, with privacy becoming a luxury, with media being used to focus public rage at any particular target?

<comment><USER10> Yep</comment></comment></comment></comment></comment>