Ask HN: Pro bono work needed to offer free showers for the homeless - <AUTHOR>

There are a few threads here asking about pro bono work, and I'm developing a project in London, UK to offer a free hot shower and clean towel for the homeless.
We are a team of 11 volunteers, with a sponsor for the first 100 showers to test our system, so I'm looking for help.
If you'd like to help, it'd be great if you could join our next meeting 9th July in Soho to discuss the project as a whole and be a part of it. We already have UX and design covered.
What we need? If you are homeless, a website so you can find us, and see where the showers are. If you are a donor, a payment gateway and real time visualisation of our finances, see where every penny is going.
Ideally, you'd have an interest in homelessness and keen to go meet some folks to understand how they use tech and what we can do to make our system work best for them. Can we reply to a text message with the nearest shower?
Please reach me at firstname.lastname@example.com <comment><USER2> _If you are homeless, a website so you can find us, and see where the showers are_

Do most homeless people have access to the internet?

<comment><USER3> To a large degree, yes.

A post-paid cellphone 4G unlimited data plan with a monthly fee may be out of reach, but many, if not most coffee shops, cafes, libraries, malls all have free wifi - and the homeless in your area probably have a better than you as to where theres free wifi.

Your local public library likely has a few computers with internet access, but many homeless people have smartphones or tablets or laptops. Maybe not the very newest, but a smartphone from 3 generations ago can be had for very cheap, and will still do enough to send emails and apply for jobs, housing, and welfare, as well as reconnect with family and friends.

<comment><AUTHOR> Correct. And it's easy to verify, just go to a food bank, shelter or centre and ask around how they found the place, pretty much everyone I've asked has said they searched online, so the website is actually pretty important.</comment></comment></comment>


Building an LTE Access Point with OpenWRT Rooter - <AUTHOR> https://snikt.net/blog/2019/05/30/building-an-lte-access-point-with-openwrt-rooter/ <comment><USER2> Currently, my ideal setup is GLinet Spitz X750, with the LTE modem swapped out to a MC7455 for maximum compatibility (for mpcie slotted cards) with the world's LTE bands. Then run GoldenOrb's ROOter. The x750 has integrated dual band simu WiFi, and has an integrated slot and pigtails for the modem. Since I travel a lot, I can power this entire thing off of an Anker USB power bank.

Today, you can go the route of: 1) OpenWRT with ModemManager, 2) WiFix's ROOter, or 3) GoldenOrb's ROOter. Personally I like GoldenOrb's ROOter because it has a nicer UI interface that I can access from my phone. You can SSH into it and hack the scripts to get things to work exactly how you want to as well.

Shoutout to the GLinet team, they actually listen to feedback.

<comment><USER3> Curious how you use this on the road. Is it basically a hotspot?

</comment></comment><comment><USER4> I believe GL iNET already sells something similar too: [https://www.gl- inet.com/](https://www.gl-inet.com/)

<comment><USER5> I love this, but I found their web pages confusing and with too many products.

I think they need someone to look at how they express themselves. Can't believe I'm saying this, but it's in need of some simpler, clearer marketing.

<comment><USER6> Jesus, you ain't kidding. A carousel with 8 slides, each a different product. I'm just starting to absorb what the difference is between the product on tab 3 and the products on 1 & 2 and then I'm looking at product #4.

And if you look at their product page they actually have _11_ products and a discontinued section _with 10 more products in it_.

Half the time I think I want to work for a company of nerds, by nerds, and for nerds.

The other half the time I remember what we think 'marketing material' and 'documentation' looks like and get a little scared about my own judgement.

</comment></comment></comment><comment><USER7> It acts as a hotspot, not a base station. The title doesn't make that clear.

</comment><comment><USER8> If you have time to spare this is a nice option to have. However,I didn't so after looking up reviews online I got a TPLink Archer MR200 LTE/4G router that you can simply plug a sim card in and it provides both wired and 2.4/5GHz WiFi. As the thing sits in the attic next to a diy dual biquad lte antenna its Wifi doesn't cover lower floors of the house so I have two of Fritz Wlan Repeater 1750E.

Now the TPLink router is not cheap. The US price is around $300, but in my opinion is well worth it as it gives me the ability to connect my DIY antennas and up to now it has been working almost flawlessly (barring a restart every few months) for 3 years. There are probably other routers that are equally good, but my experience is with this one.

Regarding the WLAN repeater, it is also an expensive one at around $100, but it is the only reliable WLAN repeater I found. I started with a cheap D-Link, returned it to the store after a day, tried another one etc. I went through 5 or 6 repeaters until I found this model that actually works with multiple devices, is fast etc.

Also, on the subject of LTE, I had real trouble finding a directional antenna I could purchase that would have at least 10dB gain at 800MHz (that's the LTE frequency my local tower uses) and wouldn't cost more than the router itself. So I ended up making two of them(as the router supports multi paths). At the end of the day it is only a bit of sheet steel and wire. I don't get why good lte antennas costs as much as they do.

</comment><comment><USER9> Having played with all of this before I have some opinions on a few of these things.

I have half a dozen of those TP-Link routers in a drawer, they're fun to play with and ok for on the go. For traveling I'd stick with one off those over a Raspberry Pi, or better yet, for a nice little upgrade I'd go with one of the GL.INet routers, I have a few of those too and they all support OpenWRT/LEDE. They come with it out of the box (albeit with their GUI on top).

RPi is sensitive to power fluctuations and note great for travelling because pulling the plug a couple of times will likely destroy your micro SD. If you were to use one for travel I'd suggest mounting your microSD read-only for maximum safety. I've been through a dozen or so cards in a static Pi before I switched to ramdisks and read-only root.

Currently I only use my mobile as a hotspot because it's inconvenient and extra cost to have additional SIM/data when my mobile contract offers plenty.

</comment><comment><USER10> Another more powerful device is the NanoPI R1 which packs WiFi, BT and two Ethernet ports (one through USB) in a form factor comparable to that small TP- Link router. The second Ethernet and bigger hardware specs could be handy to set up a VPN to a safe network when connecting from untrusted places. [https://www.friendlyarm.com/index.php?route=product/product&...](https://www.friendlyarm.com/index.php?route=product/product&product_id=248) Currently not listed among Rooter compatible devices, but the Orange PI zero plus is (both use Allwinner CPUs), so porting shouldn't be that hard.

</comment><comment><USER11> ROOTer is awesome. I used the Golden Orb release a couple of years ago for something similar (hooked up to a phone).

It got us through a couple of months when we couldn't get a wired connection.

</comment><comment><USER12> The drop in download speed is quite disappointing in my opinion. Possibly this can be solved by using more powerful hardware for the WiFi router, of course, but not being able to handle 70mbps can indicate possible bottlenecks on the future.

I'd be interested in seeing the difference between connecting the 4G stick to a PC instead of to the OpenWRT modem to see if the real bottleneck isn't actually in the receiver.

<comment> 867-5309 the dongle should be able to handle 75Mbps (searched for some speed tests), which leads me to believe the problem could be a) position of the 4G antenna - it is internal so not as powerful as their previous router which had external - have they tried placing the dongle on the top floor of his house near a window facing the nearest 4G mast? not a lot is explained about the testing process b) the mini router consumes 0.5W power! could the USB 2.0 port even provide the standard 2.5W, or anywhere near it for that matter? c) a combination of both

<comment><USER13> 150 Mbit/s are also not a problem.

I had a similar setup, also with an E3372 for a few years (before switching to a EM7455 and then a Huawei B618) and never had USB power issues on a TP-Link router.

</comment></comment></comment><comment><USER14> If one needs something more "pro" for LTE routers there's Peplink ([https://www.peplink.com/](https://www.peplink.com/)) and Cradlepoint ([https://cradlepoint.com/](https://cradlepoint.com/))

</comment><comment><USER15> Noob question: why would you ever want to use this instead of Wifi?

<comment><USER16> This isn't in lieu of WiFi - it's just a DIY WiFi hotspot with an LTE modem attached to it. The title could be read to misleadingly make the device sound like an LTE base station.

<comment><USER17> As a former engineer building LTE base stations - the title is extremely misleading.</comment></comment></comment>


It Started as an Online Gaming Prank. Then It Turned Deadly - <AUTHOR> https://www.wired.com/story/swatting-deadly-online-gaming-prank/ <comment><AUTHOR> What's even more disturbing is that this "gamer" who never worked a day in his life was able to collect government benefits from the Feds and the State of California and live in Section-8 housing while at the same time earning money with swats-for-hire.

The Wichita police are also awful.</comment>


A Quantum Theory That Peels Away the Mystery of Measurement - <AUTHOR> http://nautil.us/blog/the-quantum-theory-that-peels-away-the-mystery-of-measurement <comment><USER2> There was a nice thread about these discoveries on physics stack exchange [https://physics.stackexchange.com/questions/484675/does- the-...](https://physics.stackexchange.com/questions/484675/does-the-new- finding-on-reversing-a-quantum-jump-mid-flight-rule-out-any-inter/)

</comment><comment> ainar-g Very interesting. Funnily enough, Wikipedia doesn't seem to know anything about quantum trajectory theory. It's always amusing to find something that _isn 't_ on Wikipedia.

<comment><USER3> It would appear to be very similar to the Bohmian interpretation. [https://en.m.wikipedia.org/wiki/De_Broglie%E2%80%93Bohm_theo...](https://en.m.wikipedia.org/wiki/De_Broglie%E2%80%93Bohm_theory)

There have been some nice papers on this. See "Experimental nonlocal and surreal Bohmian trajectories" [https://advances.sciencemag.org/content/2/2/e1501466.abstrac...](https://advances.sciencemag.org/content/2/2/e1501466.abstract). They use weak measurements to make inferences about particle trajectories (ala QTT).

Maybe the authors feel that they are working from a different theoretical foundation. The foundational argument, that quantum systems have specific but unobservable states, is the same in QTT and DeBroglie/Bohm models.

</comment></comment><comment><USER4> The article notes: "Achieving this degree of control and information capture is very challenging."

This is an extreme understatement: for anything but the simplest quantum systems in the simplest, most tightly controlled configurations, it's practically impossible. That's not to say that the QTT experiments described aren't impressive achievements; they are. But they should not be oversold either.

<comment><USER5> I think it's more than that. If I understand correctly (and I may well not), this kind of thing isn't possible within classical QM, _even in principle_. The fact that we can do it at all, even in perfect circumstances, is enough.

<comment><USER4> _> classical QM_

There is no such thing as "classical QM". If you mean pre-quantum classical physics, this kind of "information capture" certainly _is_ possible in classical physics, regardless of how complicated the system is. It's only in quantum physics that it becomes an issue.

<comment><USER5> Yes, I know that QM is not "classical". By "classical QM", I meant regular, Schrodinger-equation QM, not "quantum trajectory theory" QM.

<comment><USER4> _> By "classical QM", I meant regular, Schrodinger-equation QM, not "quantum trajectory theory" QM._

"Regular" QM is not limited to the Schrodinger Equation. You also have to use the collapse postulate and the Born Rule where appropriate, i.e., whenever measurements are made. QTT is basically just a reformulation that makes it easier to see how to make use of the information revealed by measurements.

The "Schrodinger" viewpoint referred to in the article is not the Schrodinger Equation, but Schrodinger's personal take on QM.

<comment><USER5> Are you saying that the Schrodinger Equation, the collapse postulate, and the Born Rule are mathematically equivalent to QTT?

<comment><USER4> _> Are you saying that the Schrodinger Equation, the collapse postulate, and the Born Rule are mathematically equivalent to QTT?_

Yes.

</comment></comment></comment></comment></comment></comment></comment><comment><USER6> wait, but doesn't typical qm operate off of integrating over every possible quantum trajectory, including relativity-prohibited ones where particles take superluminal velocities? so if qtt is valid and otherwise compatible with vanilla qm, how does it address that discrepancy?

<comment><USER7> You're confusing quantum trajectories for classical ones. The latter are what we use in path-integral formulations, and constitute a single path through spacetime. No such path exists for quantum states, since that would be a local hidden-variable theory (which has been experimentally ruled-out).

Trajectories of quantum states are well described here: [https://arxiv.org/abs/quant-ph/0302080](https://arxiv.org/abs/quant- ph/0302080)

<comment><USER6> ah right, thanks. been a few years since I did any qm work last

</comment></comment></comment><comment><USER8> This is just reversible computation, isn't it?

</comment><comment><USER9> This is very similar to my algorithm I have been working on. It's an connection of past and future states. It provides a translational symmetry between the events. That symmetry creates a unique pattern of the connected events. It's principal is on the banach Tarski paradox and specifically the axiom of choice. That coupled with unique constraints solves the information entropy issue. Essentially using 4/pi. ++,+-,--,-+.

<comment><USER9> If you think I'm crazy.

Phys.Org: A connection between quantum correlations and spacetime geometry. [https://phys.org/news/2019-07-quantum-spacetime- geometry.htm...](https://phys.org/news/2019-07-quantum-spacetime- geometry.html)

</comment></comment><comment><USER10> I don't have time to waste wading through what is inevitably going to be a watered down and screwed up lay person's interpretation of some paper they don't understand that got some hype. I scanned the article but didn't see any scholarly citations. What's the real research behind this?

<comment><USER11> I directly found a completely wrong description of the Heisenberg uncertainty relation and stopped reading after that. But yes, the underlying research probably has some interesting stuff!

<comment><USER7> You probably mean:

"A quantum measurement influences the system being observed: The act of observation injects a kind of random noise into the system. This is ultimately the source of Heisenberg's famous uncertainty principle."

I'd agree that's an inaccurate description of the uncertainty principle, but then the following sentences are:

"The uncertainty in a measurement is not, as Heisenberg initially thought, an effect of clumsy intervention in a delicate quantum system—a photon striking a particle and pushing it off course, say. Rather, it's an unavoidable outcome of the intrinsically randomizing effect of observation itself."

I'm not sure I could explain it better at this level...

<comment><USER12> Well, it has to be reminded that the uncertainty principle and the randomness of the outcome of a measurement are two different things. The former involves _two observables_ which cannot be measured _simultaneously_ with an arbitrary precision whereas the latter is the result of an observable having more than one eigenvalue.

<comment><USER13> I have not thought this through, but it seems to me that if all observables commuted there would be no randomness and if there was no randomness all observables would commute. Does anyone see an obvious flaw on this?</comment></comment></comment></comment></comment>


Ruby interactive dependency graph visualizer - <AUTHOR> https://github.com/blazeeboy/rubrowser <comment><AUTHOR> I have lots of things to do with it, like releasing it as a gem, zooming, panning, writing some tests...etc

it's a prototype that just works :)</comment>


Elite social media - <AUTHOR> http://www.theverge.com/2017/4/26/15407144/exclusive-social-media-the-league-best-of-all-worlds-rich-kids <comment><USER2> If you have a Bloomberg terminal, you get access to a message board much like Craigslist. If you want to rent out your yacht, that's the place to go.

<comment><USER3> I want to believe that board is sub-4chan levels of relentless shitposting.

<comment><USER4> Petition to add /b/ to the bloomberg panel. Might improve things. Or just crash the rare pepe market.

<comment><USER5> It's so odd to see mentions of Internet memes and casual cyberculture on HN of all places.

<comment><USER6> It shouldn't be, it's obvious whenever a story about 4chan or Reddit (or even Voat or 8chan) come up, that there's a significant overlap in the membership. Hacker News doesn't exist in a vacuum.

Yes there are a few erudite intellectuals, brilliant greybeards, and SV millionaires knocking about, but there are plenty of scrubs here as well (present company included.)

<comment><USER7> > Yes there are a few erudite intellectuals, brilliant greybeards, and SV > millionaires knocking about, but there are plenty of scrubs here as well > (present company included.)

Nor are those categories mutually exclusive...

</comment></comment></comment></comment></comment></comment><comment><USER8> I belong to some of the services listed, including ASW and BOAW and haven't logged on in forever because they're boring. Despite all the hype, these services are ultimately no different from other social clubs and most people have sufficient avenues for socializing with and keeping in touch with people on diverse bases (interest/activity, work, school, family, etc).

They proclaim exclusivity but are often trying to grow their user base (including stealth advertising via article mentions/placement) and monetize. When they focus on the latter is when they realize that their service isn't that useful because their members clearly aren't interested in paying. Exclusivity or not, a network is useless without X critical mass of users and Y minimum activity level.

<comment><USER9> _> including stealth advertising via article mentions_

Yes, like the convenient timing of this Verge article coming out mere weeks before BOAW releases a new iOS app, and the founder's availability for multiple comments despite their focus on discretion...

</comment></comment><comment><USER10> Hacker News is the only elite organization I like hanging out at!!

All things aside, HN always seems to be so serious in its discussion about content, and I never get the opportunity to say how much I appreciate this place.

<comment><USER11> Have you seen many of the discussions around tools like Javascript, Golang, Django, Docker? Quite often they devolve into tiny opinionated nuances and you have to pull your head out of your laptop and ask yourself "what year is it??"

<comment><USER12> What does the year have to do with it? Given any geeky subject there are going to be strong opinions, always has been that way and always will be, we just couldn't see the artifacts of it as easily before the internet.

Not all the discussion on HN will be useful, but it's the highest signal to noise I've found in 30 years of participating in internet fora, at least for a group of this size.

<comment><USER11> I meant it in the sense of "oh god I just spent 40 minutes reading a circular argument".

</comment></comment></comment></comment><comment><USER13> Reminds me of the 'I Am Rich' app launched back in '08\. It was just an app that says 'I am Rich' and cost $999.99 ([https://en.wikipedia.org/wiki/I_Am_Rich](https://en.wikipedia.org/wiki/I_Am_Rich))

Moral of the story: rich people will always want to show off that they are rich.

<comment><USER14> > Moral of the story: rich people will always want to show off that they are > rich.

I think you mean, "Some rich people are insecure enough that they want to show off that they are rich."

Amex caters to this very well: they play the whole "prestige" thing but if you have a "higher-level" card for the benefits (platinum, black) they are happy to issue you an ordinary green one you can use so people won't guess your wealth.

<comment><USER9> You really don't need to be wealthy to get a platinum card. You don't even need to be breaking six figures. You just need a good credit score. That perception is all hype.

<comment><USER15> You don't actually need that good a credit score, since it's a charge card, not credit. You mainly just need the >$500/yr membership fee.

<comment><USER16> >it's a charge card, not credit.

What is the difference? I have always believed the terms to be synonyms, and the Wikipedia article for "charge card" does nothing to change that impression.

</comment></comment></comment></comment></comment><comment><USER17> Articles subheadline: "On the internet, no one can see your Rolex" Perhaps they're on a different internet where pictures and video aren't popular.

I met some pretty cool people at the last ASMallWorld event I went to in Gstaad. Like any social event, some people will be interesting, some will be pompous, some both. You need to sort the wheat from the chaff on your own.

I'd much rather associate with great minds behind a common goal, than by status of wealth. Wealth isn't that great of a filter by which to group peoples' interests.

That being said, success leaves clues, and people who've earned their success financially often have lots of interests stories to tell and lessons to teach. Those that inherit their wealth, it seems, are soon to be parted from it.

There's a place for networking, and there's a place for networking with people similar to you. That being said, I think you're better off focusing on your mission, and letting people attract to you, than you are doing the jetset thing.

Remember these "clubs" are businesses, and they're there to make money on you.

</comment><comment><USER18> It's not quite 'elite' but The Well is a fairly exclusive and well-connected social network, which has been running online for over 30 years now:

[https://www.well.com/join.html](https://www.well.com/join.html)

I dabbled in it a couple of decades ago when there was a special-offer for a month's membership, it was certainly highbrow compared to Usenet at the time.

$150 is a fair chunk of cash for a year's membership, but does keep the rabble out whilst not being much of a road-bump to those who are keen.

<comment><USER19> Yeah I used to be a member there too, was an amazing community. Jaron Lanier used to hang out there plus a bunch of other cool people.

It had a very interesting commenting system which was non threaded. Instead you referenced the number of the post you were responding to.

It gave some very interesting dynamics in the conversation, something I have never experienced since and I have often thought about doing some exploration around the non-threaded discussion forum.

<comment><USER20> Non-threaded as in there being exactly one global stream of comments? Or were there separate threads, each of which was a linear stream within which comments reference each other by number? 4chan and such have the latter.

<comment><USER19> Separate threads and channels. But it also had some other interesting features in the HTML version based on picospan the underlying discussion forum software.

</comment></comment></comment></comment><comment><USER21> BOAWs website doesn't look all that great + their iOS apps haven't been updated in 2+ years. I'm not saying it couldn't be an amazing community, but unless someone jumps in here and tells me they're a user and it's amazing, I'd be suspicious.

<comment><USER14> > BOAWs website doesn't look all that great + their iOS apps haven't been > updated in 2+ years. I'm not saying it couldn't be an amazing community, but > unless someone jumps in here and tells me they're a user and it's amazing, > I'd be suspicious.

I agree, but consider the Vertu phones: really shitty old Nokias caked in diamonds. Even once modern smartphones came out they continued to sell $20K feature phones -- and some clowns bought them.

Personally, whenever I hear the words "prestige" or "luxury" I turn away.

<comment><USER22> The stereotype has always been that you can tell the _nouveau riche_ by the sheer volume of gaudy "luxury" goods they drape themselves in, while old money prefers pedigree to ostentation.

<comment><USER14> Or plenty of well of people just don't care (and lack a "pedigree"). But your point is correct.

My GF had a visitor from Hollywood during the Super Bowl week end. Said friend was shocked that nobody had bodyguards or drove those fancy looking cars like they have in Hollywood. She was shocked when I introduced her to a couple of billionaires at the sports bar during the game: they were wearing basically the same clothes as everybody else.

(I was shocked that they were there too -- I would have no interest in a sports bar during the Super Bowl except for the entertainment of said house guest).

</comment></comment></comment></comment><comment><USER23> I had a brush with Ivy.com at one point. It was an art show. It was an interesting experience, but mostly it was full of the kind of socialite-types I am not particularly interested in associating with.

The problem with elite social events is that they're full of the kind of people who value being at elite social events.

</comment><comment><USER19> I am a member of Erik Wachtmeister first company A Small World I haven't logged in for ages heard they now charge.

This sounds exactly the same and will probably fail for exactly the same issues. A lot of the people aren't really "1 percenters" at all but rather people who live of the "1 percenters" and so the benefits one ends up getting unless they are trying to make money on these people are easy to overlook.

A much better example of a 1 percenter community is Angellist's syndicates. I got a lot of connections that way.

<comment><USER24> Are 1%ers really that rare or special?

There are 3 million of them in the US.

<comment><USER19> Well that depends whether you think 1% is rare or not.

</comment></comment></comment><comment><USER25> I wonder how much of the ticket-selling success of the Fyre Festival debacle was attributable to postings on these networks. I had never heard about it until it fell apart.

</comment><comment><USER26> half way through the article the writers let drop that the founder of BOAW's previous attempt was A small world. Which failed as it became commoditized.

</comment><comment><USER27> Is my memory corrupted, or didn't Facebook also pretend to be reserved for the "elite" in its infancy? I remember several newspaper articles describing Facebook as the "secret" website where "important" people stays in touch with each others, with some celebrity names listed as reputed users.

<comment><USER28> I joined pretty early when it was still invite only and mostly university population. Perhaps it was described that way because of being invite only but the membership has always been normal, non-elite people (like me).

<comment><USER29> > mostly "Ivy League" university population.

From wikipedia:

> The founders had initially limited the website's membership to Harvard > students; however, later they expanded it to higher education institutions > in the Boston area, the Ivy League schools, and Stanford University.

~ [https://en.wikipedia.org/wiki/Facebook](https://en.wikipedia.org/wiki/Facebook)

</comment></comment></comment><comment><USER30> Poor, poor Sartre.</comment>


My startup latest project: qwili.com - <AUTHOR> http://www.qwili.com

<comment><USER2> How am I supposed to pronounce the name? Like "cool"? :p

I think this is interesting but the search results are off, at least for "little penguin". It only looks up the word "little".

It's pretty useful. I looked up "California" and I learned that there are champagnes made there. Weird.

But I don't buy wines, so this site isn't really for me :S

</comment><comment><AUTHOR> We wanted to build a concept around our custom search engine solution for a potential client; one suggested the idea of a search engine for wine and liquor. That's how qwili.com came to life. We started using it ourselves and share it with friends.

The question is how useful is a product specific (real) search engine?

Any input is welcome.

</comment><comment><USER3> Pretty cool but I think most liquor stores have the same capability.

I found a bug though: when I search for sherry it shows that there are 4 results but when I click on "Sherry" on the left hand menu I still get the original 7 results.</comment>


I made a website that rates the latest movies by analyzing social media - <AUTHOR> http://www.buzzscale.com Let me know what you think.  I'd like to expand it to more data sources and also start analyzing other products such as tv shows, books, video games, phones, cars etc... <comment><USER2> Interesting idea; I'd be interested to see a full correlation between Buzzscale scores and other ratings sites (IMDB, Rotten Tomatoes). Based on a quick analysis of the top movies on the front page (vs. Rotten Tomatoes user ratings) it seems to be pretty well correlated. It seems to do a bad job identifying "eh" movies (e.g., Gangster Squad: BS-80 RT-64 and Hansel & Gretel: BS-76 RT-64). Buzzscale scores also seem to be more uniform in nature: pretty much everything is 70-85.

Any thoughts on "ratings effects"? E.g., proportionality to either gush about a movie or pan it, exclusively? Lack of nuanced reviews? (No one goes on Twitter to say, "It was whatever.")

<comment><USER3> It does seem like "gushers" and "panners" tend to overcrowd reviews, but I was curious enough to do a quick Twitter search. About half of these results are "ok" tweets about movies/TV shows, so maybe there _are_ enough people going to Twitter to say "whatever": <https://twitter.com/search?q=watched%20was%20ok>

</comment></comment><comment><USER4> Looks interesting. fflick.com did this sometime back and were acquired by Google.

A feature suggestion - "Enter your email to get weekly notification for movies with more than 80 buzzscore" (where 80 is editable.) An extension to this could be email me movies that are popular for their comedy, acting or the story.

</comment><comment><USER5> Look good, but it needs to assess sentiment rather than just buzz (and it needs to grade buzz a lot better).

Gangster Squad for example has a 80 buzz score, but it got between terrible and mediocre reviews. Django has an 85 buzz score, but got almost universally great reviews. Django will make roughly 4 to 5 times as much money as Gangster Squad, and was just about blanket everywhere in the media 24/7, so it's very unlikely Ganster has anywhere close to as much actual buzz as Django.

<comment><USER6> You're right, but your comment made me think of something Andy Warhol once said:

 _"Don't pay any attention to what they write about you, just measure it in inches"_

</comment></comment><comment><USER7> I am not sure if this site provides an accurate aggregate view of public opinion on movies, but if it does then I have no desire to know what the public likes. I also don't know how this is better than other "what does everyone think?" ratings available on IMDB or rotten tomatoes.

The real beauty of all the social data now available is that a service like this could theoretically provide ratings based on the sentiment of people who's opinions _I_ follow or who are have similar tastes to me. I don't care how much the average person loves Pitch Perfect, its just not something want on my list of potential movies. If I were matched through my social iterations to people who's ratings are relevant that would likely be obvious.

I love seeing new software in this space and I hope you develop it further, but you're going to need to dive much deeper into the social data available if you want to really make a disruption.

<comment><USER8> I had an idea about this recently, and would love for someone to further develop it. I already implemented a proof of concept, but won't have time to build it to a complete product any time soon.

The (simplified) idea for recommending movies was:

1\. Crawl a torrent site (say, the pirate bay) for as many torrents you can find. Extract the title, description, magnet link and category for each torrent. 2\. Use the DHT network to find out which IP addresses are downloading what torrents 3\. Use these (torrent, ip) tuples to build a recommendation based on "People who download X also download Y"

This way you can try to find movies that are liked (or actually, downloaded) by people with similar taste to you. The quality of this recommender is quite impressive in my opinion.

Email me at arno at vanlumig dot com if you want to see the proof of concept, I won't post a link here because the performance is quite bad and I'm sure the server won't be able to handle any significant load.

I will make the data (torrent metadata and data about who downloaded what) available as soon as I've anonymised the IP addresses, also mail me if you're interested in that data.

</comment></comment><comment><USER9> Looks great, and useful, wanted to share, but you are missing open graph tags so facebook share just includes your link, please add meta tags / og tags (like description, title, image etc) to make easy sharing, this is pretty important...

see here for more details: <http://ogp.me>

</comment><comment><USER10> I haven't seen Billy Crystal's _Parental Guidance_ , but I am surprised that the film is ranked #8 for "Best Special Effects".

</comment><comment><USER11> You should also display the avg. buzz per week for lets say the first 5 weeks. You could also display how many weeks movies held a certain buzz level (i.e. 5000 mentions). It seems the way it is currently movies that have been out longer are going to have a higher buzz than the brand spanking new releases.

</comment><comment><USER12> It seems to me that what you are measuring is how well marketed a movie is, not how good it is on any scale. Interesting point, compare your results against box office results.

Also: the hottest and sexiest movies #6: Ice Age??? :)

<http://www.buzzscale.com/?page_id=4134#62458>

</comment><comment><USER13> This looks like a great way to find movies. I was a bit confused at first about what the different colors (blue, red, grey) meant. After looking at the markup I came to the conclusion that blue meant positive and red meant negative. A bit later I found the explanation hidden behind the "Click to Learn More". There's no visual indication that this is a link, so I found it easy to miss. Perhaps it would be good to move the explanations somewhere not hidden behind a click, or make the place to click more obvious.

<comment><USER14> I'd also recommend choosing different colors. When scanning the list, I want the hottest movies to jump out, while the less-good movies fade into oblivion. As it stands now, red is the dominating color, and my eyes are naturally drawn to the _worst_ movies. If you want to stick with the blue, I'd recommend the same dark blue for "hot" movies, a lighter blue for mediocre movies, and the gray for the worst movies.

Nice idea, though; seems to work impressively well.

</comment></comment><comment><USER15> Care to share technical implementation?

</comment><comment><USER16> I feel like I've read the comment I'm about to make somewhere else about something, so this isn't necessarily my original idea: the buzz is from social media currently, yes? And it works as a great indicator after the movie comes out, as people are tweeting/facebooking/etc. about it. But what happens in a little while when the "buzz" dies down? Or is the idea to just give you a quick glimpse of currently releasing movies, and not to be a ranking database of all movies ever made.

</comment><comment><USER17> Just FYI, you're violating Twitter's API display guidelines. <https://dev.twitter.com/docs/embedded-tweets>

<comment><USER18> I'm curious, what Twitter display guidelines is the author breaking?

<comment><USER17> When you display a tweet embedded in your page, you have to display it exactly as they do, which takes up a truly ridiculous amount of space and is intentionally prohibitive.

And as a sidenote, Twitter would very much prefer if the API would just disappear, as they get non-linear benefits from users going to twitter.com instead of accessing its services through a third party. Internally, it is spoken of as a liability.

<comment><USER19> _Internally, it is spoken of as a liability_

I doubt that their API is spoken of as a liability internally because, if it was spoken of as a liability then Twitter.com itself is a liability. Why? Twitter.com itself is powered by their API[1]

[1] [http://engineering.twitter.com/2010/09/tech-behind-new- twitt...](http://engineering.twitter.com/2010/09/tech-behind-new- twittercom.html)

<comment><USER17> It is spoken of internally as a liability, and the executives want nothing more than to get rid of it for many reasons, not the least of which being their current investors care only about user numbers, and don't seem to count third-party users.

Trust me on this.

</comment></comment></comment></comment></comment><comment><USER20> Nice! I just had a conversation with a friend about what new game he should play. Perhaps a nice extension of your platform is to get social media buzz ratings for games.

<comment><AUTHOR> I want to do this if I am successful in marketing this website and people enjoy using it. Once I've perfected the scoring algorithm, classification, website design/UI and data sourcing (to incorporate reviews & forums), I plan on expanding to video games, tv shows and books.

Eventually it would be cool to do stuff like material goods (cellphones, appliances, etc...) so that consumers have another users to leverage when trying to find something to buy. Imagine being able to compare cars based on what people are writing across the web about the cars durability, performance, comfort when shopping for a car!

But right now I'm working on the website by myself and have a ton of work to do.

</comment></comment><comment><USER21> This is great. My wife and I are always trying to decide what is worth watching on Amazon, Netflix, etc. Added to my bookmarks.

<comment><USER10> You might like Rotten Tomatoes' RSS feeds for new and "Certified Fresh" DVD releases:

<https://www.rottentomatoes.com/help_desk/syndication_rss.php>

</comment></comment><comment><USER22> Nice! I've been wanting to do something similar for a while but have been busy working on other side projects, glad you got to ship it! Out of curiosity, what apis are you using?

<comment><AUTHOR> I use the rotten tomatoes API to get the movies and automatically create them as blogs in Wordpress using the wordpress xmlrpc interface. I use the Clarabridge API for classification and sentiment. Facebook's graph search API & Twitter API for the data. And duct tape to hold it all together :).

<comment><USER22> hahaha love it! Just like Macgyver :)

</comment></comment></comment><comment><USER23> This is great. Already bookmarked.

One little thing though: please add the fullscreen button on these trailers, it would be much more enjoyable to watch them.

</comment><comment><USER24> Excellent idea. I'm already telling people about it.

</comment><comment><USER25> Great job. Any plans to open it up as a web API?

</comment><comment><USER26> Awesome idea, the best place to know the best movies.</comment>


Show HN: Biogra.Me – Tell your life story - <AUTHOR> https://biogra.me <comment><USER2> I like the idea but that seems like the kind of service that should have a clear section on data export and how data will be accessible after (hopefully not) ending up on [http://ourincrediblejourney.tumblr.com/](http://ourincrediblejourney.tumblr.com/)

Any info on that? Couldn't find it in the FAQ.

<comment><AUTHOR> That's a great question, and something we'll work on adding to the site, in the short term, your stories are your stories, and while we don't have a formal process in place quite yet, there would certainly be a simple easy way to get things out of the system. Thanks for the question.</comment></comment>


New Hampshire, Maine and Vermont are struggling with a worker shortage - <AUTHOR> https://www.wsj.com/articles/northern-new-englands-good-jobless-numbers-theyre-bad-1492786479 <comment><USER2> Story is also on Fox Business: [http://www.foxbusiness.com/features/2017/04/21/northern- new-...](http://www.foxbusiness.com/features/2017/04/21/northern-new-englands- good-jobless-numbers-theyre-bad-update.html)

This is not a new issue, the states have aging demographics and now are looking at visa related problems as well for seasonal workers. Maine and Vermont also don't have a big city like Boston to draw on.</comment>


Ask HN: How we can improve landing page for upcoming Kickstarter - <AUTHOR> http://themarkhor.com/kickstarter

<comment><AUTHOR> Guys, we are launching our handcrafted shoes on Kickstarter and are trying to build a pre-existing community to get backers. Our team worked hard to build this page, but conversion rate is quite low. Only 5% visitors signed up to get engaged, while in survey we had over 95% people admiring the quality of the craftsmanship and shoe designs.

Would really appreciate if you could give feedback on how to improve it or what hacks we may use to improve the conversion rate. Thank you.</comment>


Show HN: a hash-based Lua code snippet store - <AUTHOR>

http://www.luabits.com:7777/help - a key-value store with a naive editor on top, which allows you to reduce your app to a single SHA-1 hash value if the app is pure Lua - the hash for the initial snippet that you can retrieve from the web.
e.g. if I tell you to give a shot to 5f564ee0eca0ce524ea094e73c3056454948fa37 I can with some level of confidence say that if you run it, it will do what I expect it will do - print a string, call another bit, which in turn will print a string and grab another bit, which in turn print "hello world".
One other idea is that if this were to talk with a DHT, one could run a "web of code" - where deploying the code would mean just distributing a SHA-256/SHA-512 hash to the target that will run the code...
Will appreciate any feedback.
p.s. the idea is obviously not unique to Lua - you can do the same way with any other dynamic language, just that I personally prefer Lua.
p.p.s. The stack is mongrel2 + lua + redis running on a VPS, so I am very curious how it performs performance-wise. <comment><USER2> Great idea! I think the idea of building distributed systems using cryptographic hashes to navigate the universe of available code (and other information) is very powerful. I've spent some time prototyping systems with a similar concept using the sha1 indexed Venti deduplicative data server created for Plan 9. One challenge for the acceptance of such systems is building a web of trust so that a given hash-referenced object can be relied upon to do what it is described as doing.

<comment><AUTHOR> Thanks a lot! My thinking was that it would be the same as now we rely on e.g. jquery website that the code is working as advertized. The key in my case is that the code is available in the form ready for inspection - so that rather just trust, one can verify.

Another application of this would be to take the backend redis data file and use it as an "image" (somewhat similar to Lisp/Smalltalk approach).

The biggest problem I thought of would be the pollution of the "start" page and the management of the links between as well as hiding the unused files from navigation. That's still an area for experimentation.

</comment></comment><comment><AUTHOR> <http://www.luabits.com:7777/help> \- a clickable link.</comment>


Renowned reverse engineer Fravia says goodbye - <AUTHOR> http://fravia.com/swansong.htm <comment><USER2> I find it regrettable that Wikipedia, which has lengthy pages on cartoon and soap opera characters, feels the need to save bytes by deleting a page about a real person who publicly contributed knowledge to the community.

(Google cache still has it, as of today)

<comment><USER3> The standard for inclusion in Wikipedia isn't "contributions to the community", or else everybody who had ever worked on an open source project would have a Wikipedia article. Wikipedia articles aren't lifetime achievement awards.

The standard for inclusion is notability.

This argument is a tempest in a teacup. Either there are reliable independent sources establishing that Fravia is notable, or there aren't. If there are, you will have no real trouble getting and keeping an article. If there aren't, the article will be repeatedly deleted, by people who don't know anything about reverse engineering and thus won't care at all about your arguments.

When this exact topic came up yesterday, I spent 3-4 minutes looking for a reliable source that established notability for Fravia, and I came up blank. Who has written about him, outside of blogs? Surely, given how important he was to reverse engineering, somebody has mentioned him, or he's been published somewhere.

<comment><USER2> I half-regret bringing up the issue. I had wanted to know more, and was sad the info had been deleted.

The half I don't regret is that maybe someone here can contribute better to Wikipedia. Reverse engineering guys are mostly tight-lipped, but they're family ...

</comment></comment></comment><comment><USER4> I find it strange how the imminent demise of another makes me reflect upon myself: I found myself wondering what I would write in the same situation, and then realizing that this is a fate that I cannot escape.

I like to watch Steve Jobs' Stanford commencement speech, every now and again, to remind me of that fact:

<http://www.youtube.com/watch?v=D1R-jKKp3NA>

Transcribed: <http://news.stanford.edu/news/2005/june15/jobs-061505.html>

<comment><AUTHOR> > imminent demise

Just in case some people don't know, Fravia passed away 2 days ago (2009/05/03)

</comment></comment><comment><USER5> > Yet my most cherished advice to all friends is the following: learn to enjoy > your contingent present, don't be obsessed by the future. Carpe diem, and > enjoy the current emotions: a starry sky, a fresh wind, the shells on the > seashore, your love at your side in the night, a long talk in the evening > twilight with a friend, the smile of your kids. Substituting _that_ with a > TV -or a computer screen- is a very poor bargain... that is one of the few > things I am now pretty sure of.

Gobsmacked by this. I've been starting to apply Stoicism towards my life and I'm speechless.

Stoicism: This has been posted on News.YC before but this might impact you:

[http://www.fourhourworkweek.com/blog/2009/04/13/stoicism-101...](http://www.fourhourworkweek.com/blog/2009/04/13/stoicism-101-a-practical- guide-for-entrepreneurs/)

</comment><comment><USER6> Redirecting Fravia page to reverse engineering is unacceptable.

He had been an expert in software reversing (which is related to software reverse engineering) and in the last 10 years devoted a considerable amount of efforts to the field Internet Information Searching.

I was a personal friend of mr Ravia, and knew him for more than 10 years. He was able to build a considerable community of experts in the field around him. The article will definitely be improved now, after is untimely death.

Revert back the redirect.

Regards, Marco Guardigli Technical Director TomWare Group

</comment><comment><USER7> fravia's writings were a big part of my motivation to learn how computers work when I was just a fledgling programmer.

So long and thanks for all the info!

<comment><USER8> I remember when I was a kid and didn't have a very reliable internet connection I mirrored fravia.org to make sure that I could read it when I wanted to. I was fascinated with all his writings on reverse engineering and learned a lot from him...

So thanks to Fravia and sorry to see him go...

</comment></comment><comment><USER9> Wow, I just got heavy nostalgia after going through the mirrors of his site.

His pages on reverse-engineering were my earliest findings on the internet. When it used to take days to download a 20mb file.

</comment><comment><USER10> goodbye fravia. We will miss you. I will catch you in the next life and use what you taught us to not get lost in this one.

</comment><comment><USER6> I managed to find some more information sources about fravia (pictures of him and RMS, and a blog entry by Tommaso Dorigo, a scientist and a friend of him, and updated my own version of WP page ([http://en.wikipedia.org/w/index.php?title=Fravia&oldid=2...](http://en.wikipedia.org/w/index.php?title=Fravia&oldid=288959514)) . I also refined language separated facts from opinions and tried to be more objective, but it is not easy. WP Admin Matt_Crypto re-trashed again the page while I was working on it, giving a very poor explanation. I think that a better page will never come out if they dont allow community to work on it. I am available to critics and I am not hiding my identity. I am a middle age respected professional working and consulting internationally. I owe a lot to mr. Fravia, for what I learned from him since 1996. By the way I was hacking and cracking since the eighties.

Given the inadequate page on WP while he was alive, I felt the need and urge of updating it, then this hell begun. I am registered in WP since 2005, and seldom made some little contributes.

Seems that many of you benefited from Fravia's writings.

Yesterday, at Fravia's final burial, i was blowing a dandelion in the wind. Tiny seeds flowing in the sky in the beautiful green valley. Those flying little seeds were like the many teaching he left inside many of us. a suitable picture could be this: [http://photos.jibble.org/albums/Dandelions/dandelion_seeds_b...](http://photos.jibble.org/albums/Dandelions/dandelion_seeds_being_blown.jpg)

Please help me in fixing this Fravia Wikipedia Entry. I simply think he deserves it.

\--Marco Guardigli

</comment><comment><USER11> as i understand it, the issue with the wikipedia article was that it [the article] was badly put together, and had no citations.

rather than reverting the changes, try creating a better article from scratch. (of course, its locked until the 12th to prevent a flood of people trying to revert it, but just wait until the 13th)

</comment><comment><USER12> Ahhh fravia.com...

One of the first things I found when joing the brave new world with my 28.8. The first thing i found on that new "www" thing that made me realize its potential, back in the bad old days when searching/finding anything on it was a bit of a black art. We'll miss you.

 _"So long, and thanks for all the fish."_

</comment><comment><USER13> there are a series of videos of him speaking available at the internet archive: <http://www.archive.org/search.php?query=fravia>

</comment><comment><USER14> I am jahan_26. I'm really sad that you're gone. I'm gonna to follow your way and make your name big. R.I.P

</comment><comment><USER15> May $DEITY present Fravia with all the bounties $AFTERLIFE may offer him. You will be missed.

</comment><comment><USER16> fravia, ORC+, +HCU I guess that was my awakening in critical thinking. forever grateful...

</comment><comment><USER17> Such sensationalist headlines should not be encouraged on HN.</comment>


Ask HN: Anyone making living writing Linux desktop applications? - <AUTHOR>

I'm an indie developer who has developed several desktop applications for Windows. I'm thinking to port them (or develop something) for Linux. Anyone here making a living(or even close) writing desktop applications for Linux? <comment><USER2> As a long time Linux user, I think this would be very tough.

Linux users are used to free software and having everything available through our package managers. We generally don't purchase and download software, mess with serial numbers, licenses, copy protection, drm, etc. There is no standard method for delivering software outside a package manager. Anything you do will likely be somewhat hackish and will not work on everyone's system.

I rarely ever stumble on Linux software that must be paid for. Off the top of my head I can think of: Mathematica, Sublime Text 2, IntelliJ, and, perhaps soon, the Steam client. These are all obviously multi-platform projects that also happen to be available on Linux (which is nice but probably not wildly profitable).

It would help if there were a Linux app-store, but there is not. I think there may be something for Ubuntu along those lines, but the fact that it is only for Ubuntu seriously limits the number of potential customers you have in an already shallow pool. And since Linux desktop users are spread over a wide variety of distros and configurations, a general Linux app-store is unlikely to ever exist.

<comment><USER3> I think Ubuntu's package manager gui-frontend brands itself as a store (granted most entries are labeled as free). Also, you could always give a _.deb installer as a download (and the relevent format for whatever distribution you want to support). Installing from these works just as well as_.msi does in windows.

</comment></comment><comment><USER4> The consumer market for GNU/Linux desktop application is tough, although there are some niche markets that can be viable. Wikipedia has a list of proprietary GNU/Linux applications that provides several examples[0]. If you want to charge in the consumer market and aren't interested in game development, solving boring, but relatively complicated problems (e.g. tax software) seems like a good bet financially. Open source developers are less likely to sustainably work on boring applications. People that generally prefer free software are also more likely to set aside their principles if you can somehow lessen some kind of significant pain for them (again, like doing taxes).

The business market is much more viable. There all sorts of viable markets, like:

\- compatibility glue for either server-side or client-side open source alternatives to the Microsoft stack that solves certain headaches (e.g. arcane file formats, better conversion for scripted Excel sheets),

\- GUI (system) management tools (such as CPanel and Plesk for budget webhosting, but for less saturated markets like managing thin-clients or virtual machines that are still a moving target),

\- hardware + software (e.g. building things like portable barcode scanners for inventory management, security/surveillance hardware or VoIP boxes using the Raspberry Pi),

\- et cetera.

If you target business users open source or dual licensing becomes much more viable too. It isn't economical for most companies to dedicate a lot of resources to IT internally, so they will still pay for e.g. support, training or a managed version of your application. The latter is especially attractive with web applications, of course, because you can sell a managed SaaS version of your application (this is exactly my business model with <http://www.vixu.com> [1]).

0: [http://en.wikipedia.org/wiki/List_of_proprietary_software_fo...](http://en.wikipedia.org/wiki/List_of_proprietary_software_for_Linux)

1: Based on an Apache licensed application you can find at <https://github.com/fmw/vix>).

</comment><comment><USER5> Many paid applications in the visual effects industry are primarily run on Linux.

</comment><comment><USER6> this question is better then my question . i hope it will be longer as im big linux fan . linux game makers also included i guess</comment>


Iota cryptocurrency shuts down entire network after wallet hack - <AUTHOR> https://www.zdnet.com/article/iota-cryptocurrency-shuts-down-entire-network-after-wallet-hack/ <comment><USER2> I knew this coin would be a disaster, especially after the "tangle" issues and home-grown hash function[1].

Iota also relies on a central server[2]. So many others[3] have criticized it too.

[1] [https://medium.com/@neha/cryptographic-vulnerabilities-in- io...](https://medium.com/@neha/cryptographic-vulnerabilities-in- iota-9a6a9ddc4367)

[2] [https://domschiener.gitbooks.io/iota- guide/content/chapter1/...](https://domschiener.gitbooks.io/iota- guide/content/chapter1/current-role-of-the-coordinator.html)

[3] [https://medium.com/@thedrbits/why-i-also-find-iota-deeply- al...](https://medium.com/@thedrbits/why-i-also-find-iota-deeply- alarming-99d4f2da3282)

<comment><USER3> It doesn't matter. IOTA isn't a cryptocurrency, but a decentralized messaging platform. Coin is a funding mechanism, it's more like matrix.org on financial steroids, rather than bitcoin.

<comment><USER4> Can you name any applications that are using this "decentralized messaging platform"? Or point to any technical demonstrations of its capabilities?

</comment></comment></comment><comment><USER5> The hack was apparently exploiting a vulnerability in a third-party dependency in the wallet app, which is built on node.js. All these dependencies that is used in the majority of modern apps seems like a huge security risk to me. They make rapid cross-platform development possible, but at what cost?

Anyway; the network itself was not hacked, which is good I guess. And the coordinator (centralized node) is said to be the training wheels which will be removed at some point, but it still seems to be quite far of into the future.

<comment><USER6> I am somewhat pleased to see JS dependencies causing real-world problems and losses. I was so fed-up with the dependency hell, I switched to native programming. Especially programming for iOS using Swift is such a pleasure, we still have the concept of dependencies and external libraries but the Apple provided libraries are very rich so you would seldom need to import anything from the wild.

After seeing the other side of the fence, I am quite surprised that anyone would make native apps with Node.JS. In the time you set up your dependencies for your Electron, ReactNative or whatever you can have your native macOS or iOS app UI running. Also, wouldn't spin the fan when running.

<comment><USER7> The biggest problem as a desktop app developer is that all the good UI libraries are barely maintained, obscure, questionably licensed or have limited 3rd party compatibility meaning you have to build too much from scratch yourself. This is why Electron has taken off so much lately for desktop development.

<comment><USER8> > questionably licensed

People don't want to pay for anything, therefore we get...

> barely maintained, obscure, ... have limited 3rd party compatibility

Building anything really polished that isn't those things is a huge undertaking that someone would have to pay for.

Electron piggybacks on the massive web ecosystem which is funded by SaaS, advertising, and surveillance so it lacks the abandonware problem. Unfortunately it's also not really built for the role of desktop or mobile UI layer and so you get a bloated, insecure, slow mess when you try to shoehorn it in there.

We don't get what we won't pay for.

</comment></comment></comment></comment><comment><USER9> For those who haven't been following the previous episodes, IOTA is the cryptocurrency that uses ternary logic because it supposedly makes it more efficient (it very much remains to be proven). The idea is to bring cryptocurrencies to embedded devices, which IMO like much of the cryptocurrency space is very much a solution in search of a problem. Didn't stop them from making a fortune with pre-mined coins during the cryptocurrency boom.

I remember that a few years ago there was a lot of debate about whether IOTA was truly decentralized. Advocates were arguing basically that "it's not completely decentralized now but it will be soon". Well I guess we know were we're at right now.

<comment><USER10> Yeah the pre-mined coins were sketchy, and the ternary was dubious.

I don't want the innovation to get lost in the bathwater though: the tangle datastructure was novel. Not an expert, but it was designed to allow for minimal proof of work while retaining some hashed auditability and tamper resistance. I think the key idea would be that you help hash several other blocks into transactions and then your transaction will get hashed by a few other workers. It didn't require heavy POW so it was more suitable for an embedded device to perform on the edge.

<comment><USER8> The tangle is a DAG (directed acyclic graph). A DAG is a viable data structure for a distributed database, but it has issues for a cryptocurrency where you want to maintain consensus on a single objective global ledger.

<comment><USER11> A DAG describes a wide variety of data structures and choices. Bitcoin is a DAG.

Actually wouldn't any sort of structure that prevents double spending have to be a dag? In order to prevent double spending you need to put transactions in topological order (to know how much money the account has). If you can do that your data structure is a DAG.

<comment><USER8> A block chain is a special sub-type of DAG in which (1) there is only one edge from each node to a predecessor, and (2) there is only one canonical path through the DAG at any given time and there exists an objective set of rules for selecting this path. Usually nodes that are not part of this path are eventually forgotten in a block chain.

</comment></comment></comment></comment></comment><comment><USER12> Good thing there is a centralised node controlled by a single authority

Facepalm

<comment><USER13> It has been known for years that it was not a truely decentralised currency, ironically enough, they probably had some good foresight to retain that auth node.

<comment><USER12> NO! Absolutely not! They should let the network govern itself because thats one of the main differentiators (for better or worse) of crypto.

This _always_ happens with crypto - there's a hack, some people lose money and then the community vibe goes out the window and there's software patches, transactional rollback attempts, network forks, and so on.

Part of the risk of a decentralised autonomous system is that it's DECENTRALISED AND AUTONOMOUS. If you lose money because of a hack THATS PART OF YOUR RISK PROFILE. DEAL WITH IT.

Having a centralized node with a single authority mitigates some of the uncomfortableness of the original hack, and might get some or all of the money back - but the cost of that is undermining the entire network ethos. This currency is a single issuing authority who can dictate the rules when it suits them and pull the plug if things get uncomfortable.

<comment><USER14> "THATS PART OF YOUR RISK PROFILE. DEAL WITH IT"

If you set up a libertarian community in which everything is privatized, and then one day your home catches on fire, but you don't pay for firefighting service, it sucks to be you, but is your neighbor* going to just say "that's part of your risk profile, deal with it"? Laws and philosophies are one thing, but there are predictions you can make about the actions of people separate from that, and so your rules and abstractions have to be compatible.

*who shares a wall

<comment><USER15> It's almost like cryptocurrency advocates are starting to discover the benefits of fiat currency and modern financial regulation one at a time.

<comment><USER14> I mean, governments can collapse, fiat currency can fail, financial regulation can be corrupted, so it's entirely possible in ten years everybody _will_ be using cryptocurrency, because everything else has gone to hell.

In general I don't believe in trying to hedge against _everything_ going wrong. I want to be rich in the future where money can buy, say, immortality or space travel, not in the Mad Max future where money just makes you a target.

<comment><USER16> It's especially dumb when your "everything goes wrong" system requires power and the internet.

<comment><USER14> I think this criticism is a bit off. We can see that there are places in the world today where the government and financial systems are really fucked, but people do use crypto, so it is conceivable that sort of situation will spread and take over the developed world. But it would be the new dark ages, not a glorious future. If it did happen, my hope is that like everything these days it would happen faster and be over sooner.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER17> Is this the correct diff for the patch that tries to fix the wallet exploit?

[https://github.com/iotaledger/trinity- wallet/pull/2565/files...](https://github.com/iotaledger/trinity- wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38)

The commit removes these lines:

        - const script = document.createElement('script');
        - script.src = 'https://cdn.moonpay.io/moonpay-sdk.js';
        -
        - document.write(script.outerHTML);

</comment><comment><USER11> Everyone concentrating on iota being a bs cryptocurrency. Which fair enough but i think that kind of burries the actual story:

People trying to make a currency involving large sums of money don't even have the security controls to check they are not loading malicous dependencies from npm! This is not some fancy crypto hack, this is plain old boring compromised dependency from an ecosystem with a reputation for high profile compromises.

<comment><USER18> Actually, it's way worse than that. They were directly loading code from someone's CDN: [https://github.com/iotaledger/trinity- wallet/pull/2565/files...](https://github.com/iotaledger/trinity- wallet/pull/2565/files#diff-bafa027c31caffa28093844213af12a7L38)

<comment><USER19> It really can't get any dumber than that

</comment></comment></comment><comment><USER20> It's not a real cryptocurrency if someone can shut the whole network down.

<comment><USER13> If you read the article, you would see that just the node with signs the transaction as legit was taken offline for the moment while they work on it.

Your definition of crypto currency and decentralised currency is conflated too.

<comment><USER21> The very existence of "the node" makes it not a cryptocurrency

<comment><USER22> It's a cryptocurrency, just not decentralized.

<comment><USER23> I would have agreed with you but after checking wikipedia, decentralization is actually the first requirement for it to be called a cryptocurrency.

> 1\. The system does not require a central authority, its state is maintained > through distributed consensus.

[https://en.wikipedia.org/wiki/Cryptocurrency#Formal_definiti...](https://en.wikipedia.org/wiki/Cryptocurrency#Formal_definition)

[https://www.merriam- webster.com/dictionary/cryptocurrency](https://www.merriam- webster.com/dictionary/cryptocurrency)

<comment><USER24> The codebase doesn't require a central authority, but in practice all keys for top level auth are held by the same entity.

<comment><USER11> Sort of like how society doesn't require me to not be a billionaire, but in practise i'm not a billionaire.

Code not deployed and probably never tested (perhaps never even worked) does not count.

</comment></comment></comment></comment></comment></comment></comment><comment><USER25> It was always a scam for gullible fools

<comment><USER25> Beautiful website though. All these ICOs have nice marketing

<comment><USER26> Well yeah, how else are you going to get investors past your hand-wavey technical-sounding nonsense? You could sell homeopathy to investors these days as long as it had a nice enough marketing website (see Goop).

<comment><USER14> I think you are downplaying how mainstream homeopathy is. I believe CVS has carried homeopathic OTC products for years. And I don't get the impression it particularly bothers most people. If you think the "placebo effect" is a thing, then homeopathy is justified even if the only person who believes in it is the patient. Someone _might_ see this as moral/intellectual rot and corruption, but that seems kind of like a fringe, wild-eyed/haired attitude.

<comment><USER26> If homeopathy consisted of selling tubes of plain water with a label of "may help the common cold", I wouldn't really have a problem with it.

Instead recommending people to take crazy doses of supplements, making entirely crazy claims like "cures strep throat" or "can prevent infections" or generally pushing unregulated supplements is absolutely preying upon the weak, weakening the ability of medical providers to actually do their job and is nothing more than naked profiteering by private companies. Anybody supporting or pushing homeopathy is immoral.

<comment><USER27> >selling tubes of plain water with a label of "may help the common cold", I wouldn't really have a problem with it.

AFAIK they would also need the standard FDA disclaimer of

>This/these statement(s) have not been evaluated by the Food and Drug Administration. This product is not intended to diagnose, treat, cure or prevent any disease.

edit: apparently there's an exemption for homeopathic medicine, so they don't need it. That's a shame. [https://rationalwiki.org/wiki/Quack_Miranda_Warning#Homeopat...](https://rationalwiki.org/wiki/Quack_Miranda_Warning#Homeopathic_exception)

<comment><USER14> I thought the products I've seen in mainstream stores have the disclaimer. But maybe I should look again.

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> For those who are wondering what happened, an attacker loaded malicious JavaScript through some compromised third party library.

This isn't unique to cryptocurrency, although the permanence of crypto transactions makes it pretty concerning there. Similar Magecart type attacks have been stealing credit card numbers from websites including British Airways, Ticketmaster, or Macy's, right off the checkout page.

Most sites still would have no idea if this were to happen to them today.

That's why I've developed Enchanted Security ([https://enchantedsecurity.com/](https://enchantedsecurity.com/)) - a client- side firewall that tracks the network requests and even blocks malicious ones. It's like a network firewall but running on your users' browsers. It can run on other JS platforms too, like Electron or React Native, which are commonly used for crypto wallets. Get in touch if you're interested in learning more.

<comment><USER11> Bit of an unfair comparison there with csp on your website there. You cite the article that most csp policies are ineffective at preventing xss, but xss and data exfilitration are different things, and csp policies that are ineffective at blocking xss are often effective at blocking data exfiltration.

</comment></comment><comment><USER29> 5 days of downtime and counting: [https://status.iota.org/](https://status.iota.org/)

</comment><comment><USER30> Funny how even terrible, existential news barely affects the price of a cryptocurrency.

<comment><USER31> Since the network is down, can this still be traded?

I know exchanges use 1 big wallet, and internally keep track of who owns what. So in practice you would still be able to trade, just not able to add or request funds.

But if all exchanges block trading, nothing can happen to the price can it?

<comment><USER32> > _Since the network is down, can this still be traded?_

Yes. Trading generally happens off-chain, simply by changing account balances in exchange's database. Actual on-chain transactions don't take place until funds are withdrawn from the exchange (which is why they should not be kept there for long - obvious hacking risk).

</comment></comment></comment><comment><USER33> Trust is a big part of a credible cryptocurrency. Can you really trust a currency that the vast majority of people don't understand?

I don't think cryptos will ever take off without widespread institutional and gubernatorial support. Governments will probably issue cryptos themselves eventually. They are an opportunity for the government to create a centralized Federal Retail Bank that reduces the amount of rents and subsidies captured by commercial banks. Every citizen would have a free digital checking account, fully backed by the issuing government. When someone wants a loan, commercial banks and fintech companies would get temporary access to user data to compete on providing that loan. The data would only be used for that loan in particular, and it would be illegal to use it for any other purposes, or to retain it after the loan is done.

The government cryptos would have to be as impermeable to hackers as your current digital bank account with (insert Big Bank here). Obviously, while such a system has tangible consumer benefits, it wouldn't be nearly as libertarian as Bitcoin.

<comment><USER34> I don't think your argument makes sense. People use things that they don't understand every day. Do you understand how a plane works? Or how the current banking system works? Or even how HTTPS and the CA system work?

<comment><USER33> People generally know how dollars work. They don't know much about the monetary system from a macro standpoint, but a dollar is a dollar.

There's no wallet code on a flash drive that you can lose. There's no weird pseudo-bank. There's no mining (which adds huge transaction costs to the network).

If a new VC-backed company called Mt. Zox said "keep your cryptos with us, we have the latest in crypto security. Here are all the virtually incomprehensible protections we have. Trust us, we're better than the Other Guys" how can you fully evaluate them? Even if they have great standards on paper, how do you know that they will be upheld in practice? How do you know that there's no backdoor for hackers or company founders to use? Even if you do all your research before investing, you're still a sitting duck with the tail risk of capricious losses.

My point isn't that full understanding is a prerequisite for widespread crypto adoption. However, there is a "tangibility-trust" axis with currencies. The less tangible the currency is, the more trust is required in the issuing institution.

Gold is more tangible than dollars. Physical dollars are more tangible than digital dollars. Digital dollars are more tangible than cryptos. _Bitcoin took a step down in both intangibility and institutional trust_. It is, essentially, a currency backed by full faith in speculation, illicit activity, asset hiding, and under the radar transactions.

Side note: I changed "trust something" to "trust a currency" in my OP to be more specific.

<comment><USER34> People understand dollar bills, but they don't understand their credit card and the visa/mastercard network.

You're making the error of talking about cryptocurrency from the network perspective instead of the ecosystem perspective. You can compare a cryptocurrency with a financial backbone. A bank/credit card/any financial service can be sitting in front of both a cryptocurrency network or the current financial network and users wouldn't see a difference (well except lower fees)

<comment><USER33> Theoretically, what's going on behind the scenes shouldn't matter. However, you could only trust the system to properly implement this extremely intangible technology if you fundamentally trust the organizations involved. Again, how do you know that their representations regarding the currency are true? How do you know that the amount of crypto withheld for the founding organization is fair or won't overly dilute the network? How do you know there are no backdoors? If the crypto is pegged to another currency/commodity/crypto, how do you know that the peg will work in practice (this is very hard)? How do you know that the organization is actually holding the pegged currency in reserve, like they said they would? Even if the currency is perfect, how do you know that your wallet provider is safe/not inadvertently malicious? What recourse will you have if you get hacked? (none, and if someone says "that's not fair, Chase can be hacked too" - sure, but that's less likely, and the U.S. will step in to help, which gets back to my point about institutional backing) Some of these concerns exist with large established banks, but we don't really care because 1. They have a great history of keeping your assets safe 2. They have the backing of the government. 3. The Federal Reserve is in charge of our monetary system, and whatever beef one may have with them, they are far, far better than a small group of friends who wrote a white paper somewhere.

Don't forget the massive cost to compensate miners for all the time, electricity, and computing power that they use. If you amortize those costs, they far surpass even Amex's credit card fees. Also, what's with the whole >50% control condition? So now I have to worry about a top secret Russian organization with dozens of 160 IQ scientists racing to create a quantum computer that can overwhelm some/all cryptos and bring wealth to the motherland? I'm half-joking, but that's the kind of technological weirdness that I'm not comfortable with, much less the average person.

</comment></comment></comment></comment></comment><comment><USER35> > _the IOTA Foundation shut down "Coordinator," a node in the IOTA network > that puts the final seal of approval on any IOTA currency transactions._

Wait a minute... I thought cryptocurrencies were immune to manipulation, and decentralized?! /s

</comment><comment><USER36> If you don't mind lots of cursing, I think I sum up IOTA pretty well here. [https://www.youtube.com/watch?v=h6C5DJGg4Lg](https://www.youtube.com/watch?v=h6C5DJGg4Lg)

</comment><comment><USER37> > the IOTA Foundation shut down "Coordinator,"

If a single org can shut down a cryptocurrency, you might as well use PayPal.

</comment><comment><USER38> What was the purpose of iota anyways, last I looked I couldn't get past the marketing speak.

</comment><comment><USER39> It's a good thing cryptocurrencies aren't used for anything important.

</comment><comment><USER40> And this right here is why the very basic principle of a cryptocurrency is a terrible idea.

You _don 't_ want decentralized anonymous immutable transactions for your money.

You really, _really_ don't.

<comment><USER13> > Don't want

Thats not really an argument to make. Maybe you can say you "don't need" and make some arguments for that, but telling people what they don't want.. Doesn't seem helpful .

Also

> very basic principle of a cryptocurrency The BlockChain is a very good > principle. But again I don't think you're sure the difference.

<comment><USER40> > Thats not really an argument to make. Maybe you can say you "don't need" and > make some arguments for that, but telling people what they don't want.. > Doesn't seem helpful.

I stand by my statement. People certainly _think_ they want those things, but they're wrong. Because they want them only until something like this happens and their money is gone because of an error someone else made. Then they suddenly want a way to get back their money a whole lot more, but it's impossible because of exactly those things they thought they wanted.

> The BlockChain is a very good principle.

It's a good principle for getting distributed, (possibly anonymous) immutable transactions. It's an absolutely terrible idea to apply that to money. I don't think anyone has yet found a practical application it's better suited for than all the alternatives.

> But again I don't think you're sure the difference.

I'm sure I understand the difference better than you.

</comment></comment></comment><comment><USER41> People tend to forget that this is alpha software - bugs happen. And re: centralization, decentralizing something too fast is the dumbest thing to do. Easier said than done, but it's something they've been working on for a while from what I've read.

Last time this happened with Ethereum for example, they split the chain in Ethereum Classic and the "New" Ethereum. Also not an ideal scenario. At least they are transparent/actively working on fixing this issue.

<comment><USER42> > alpha software

That they have been encouraging people to invest in and speculate on for years now.

</comment></comment><comment><USER43> This seems like fake news because there is no significant crash in the price.

<comment><USER44> _" within 25 minutes of receiving reports that hackers were stealing funds from user wallets, the IOTA Foundation shut down "Coordinator," a node in the IOTA network that puts the final seal of approval on any IOTA currency transactions."_

Hard for the price to crash when they shut down the network 25 minutes after the hack.

<comment><USER45> Trading on exchanges can still theoretically continue, it's just deposits and withdrawals that won't work.

<comment><USER46> You must understand that people holding IOTA after the last network halt (which was ~45 days ago), aren't very bright.</comment></comment></comment></comment>


KGraft: Live Kernel Patching - <AUTHOR> https://www.suse.com/communities/conversations/kgraft-live-kernel-patching/

<comment><USER2> How does it compare to KSplice?

<comment><USER3> Infinitely better simply because it's not Oracle</comment></comment>


ProtonMail: End-to-end encrypted email - <AUTHOR> https://protonmail.ch/ A secure mail startup founded by CERN and MIT scientists in 2013. <comment><USER2> > [https://protonmail.ch/blog/protonmail-threat- > model/](https://protonmail.ch/blog/protonmail-threat-model/)

I'm always skeptical of browser/JS based crypto, but it is nice to see that they're at least upfront with the risks involved in doing such a thing.

They probably downplay the risk of a MITM attack a little much, but otherwise I'm glad to see they're realistic about possible weaknesses of the platform.

<comment><USER3> Yes, but they are clearly playing a bit fast-and-loose with things here. The whole point of end-to-end encryption is that it's a "trust no third parties" model (other than whoever provided your crypto software, which you can verify anyway). This is slightly better than Lavabit, but you're still trusting ProtonMail, who are providing the crypto implementation to your browser every time you use it. Depending on how it's implemented, they could potentially unilaterally revoke all your past secrecy by changing the Javascript code to capture your private keys.

Plus, they're offering self-destructing e-mails, which is impossible to provide, so already there's a bit of snake oil there. If they said, "It's not possible to provide real self-destructing e-mails, but you can set it up so that (assuming you trust us), we'll delete the messages from our servers after a certain amount of time, which is the best anyone can do." Instead they say that they are "more ephemeral than SnapChat."

<comment><USER4> Do you trust OpenSSL?

<comment><USER5> > Do you trust OpenSSL?

Good question, but one with no influence on whether I trust protonmail. The threat model is different: Openssl is so widely deployed that all is lost for me if it's broken. I'd assume protonmail uses it for it's SSL connections (the webserver pretends to be an apache). If there's an exploit, the attacker can at any time MITM my connection to protonmail and at his discretion inject javascript that captures my decryption password or message.

</comment></comment></comment></comment><comment><USER6> This sounds really good. The only disappointment is that it seems there is no business model that allows email providers and services like this to provide Unlimited encrypted email (no limitations i.e. Gmail-esque) absolutely free to all users. I'd be willing to gamble that if anyone could sustain this for a couple years, people would leave Gmail in droves, no one I know likes having to use the USA/NSA/google/big brother tagteam, but they still don't value the invasion of privacy enough to pay for it.

<comment><USER7> I also was confused about the free forever part until I found they actually have a tiered pricing model.

Edit: here is what they say: "Forever Free

We believe privacy is a fundamental human right and should be available for everyone. That's why we offer multi-tiered pricing including a free version that anyone can use. Let's bring privacy back to the people!"

</comment></comment><comment><USER5> From reading the service description, this is an encrypted messaging service that happens to have email notifications.

I can't write messages with my preferred mail client, can't read messages with my preferred mail client and I can't access my (old) messages while offline. non-protonmail-users will receive a notification with a link that they received a message, not the actual message that they can keep for archiving purposes, offline use etc. I wonder if and how they handle searching mailboxes.

Neat, but not mail.

edit: typo. darn.

<comment><USER4> If you used your preferred mail client, it wouldn't be encrypted end to end. This isn't a resolvable difference without running a local mail server decrypting the messages.

<comment><USER8> Virtru integrates with your existing email client so that you can send end-to- end encrypted email from your existing email account: [https://www.virtru.com/other-platforms](https://www.virtru.com/other- platforms)

disclaimer: I am a software engineer at Virtru. Happy to address any questions/comments!

<comment><USER5> That sounds awfully like a DRM wrapper around the content. What happens if the virtru keystore goes down or is unreachable (temporarily or permanently). Do I have access to the messages I sent/received?

Can the sender retroactively change access to the content?

</comment></comment></comment></comment><comment><USER9> And none of the employees are US citizens that can be compelled by the US government in a way that they're not allowed to talk about it (even to other employees) to compromise the security of the service?

I'm not sure that having a Swiss company makes any difference in a case where people have ties to the US. Does anyone else know better than me on this topic?

edit: It looks like the goal is that you don't even have to trust protonmail: "For this reason, we are also unable to do password recovery. If you forget your decryption password, we cannot recover your data." [https://protonmail.ch/pages/security_details.php](https://protonmail.ch/pages/security_details.php)

<comment><USER7> There are some clues to be found on the page: "ProtonMail is developed both at CERN and MIT and is headquartered in Geneva, Switzerland. We were semifinalists in 2014 MIT 100K startup launch competition and are advised by the MIT Venture Mentoring Service." ProtonMail is developed both at CERN and MIT and is headquartered in Geneva, Switzerland. We were semifinalists in 2014 MIT 100K startup launch competition and are advised by the MIT Venture Mentoring Service.

</comment></comment><comment><USER10> It appears they silently closed a critical vulnerability recently [0]

[0] [https://twitter.com/StackSmashing/status/474214532114812928](https://twitter.com/StackSmashing/status/474214532114812928)

<comment> mike-cardwell My name is on [https://protonmail.ch/blog/protonmail-security- contributors/](https://protonmail.ch/blog/protonmail-security-contributors/) because I reported a critical XSS vulnerability to them when they were previously mentioned on here.

All you needed to do was send an email which contained a From header with script embedded in the name part:

      From: "<script>Do evil</script>" <firstname.lastname@example.com>

All I did to find this vulnerability was sign up for an account and then plonk the email address they gave me into [https://emailprivacytester.com/](https://emailprivacytester.com/) (of which I am the author)

</comment></comment><comment><USER11> The security details page[1] makes for interesting reading. Hopefully the new norm is 'E2E' encryption. It's actually starting to feel inevitable, and the hopelessness that followed in the wake of the 'Summer of Security' is perhaps evaporating bit by bit, through universal encryption, bit by bit.

-

[1] [https://protonmail.ch/pages/security_details.php](https://protonmail.ch/pages/security_details.php)

<comment><USER12> > Messages are stored on ProtonMail servers in encrypted format. They are also > transmitted in encrypted format _between our server and users' browsers_. > Messages between ProtonMail users are transmitted in encrypted form > completely _within our secured server network_. Because they never leave our > _secured environment_ , there is no possibility to intercept the encrypted > messages enroute.

Emphasis mine. That doesn't sound like E2E encryption to me. End to end means it's encrypted user-to-user, not server to user, or user to server to user. It sounds more like they have something slightly more secure than an e-mail service like Gmail, but still very vulnerable to subpoenas, backdoors and so on.

<comment><USER11> Read on. It goes on to advise how they allow encrypted mail being sent to external providers, as well as self-destructing messages. The blurb also discusses the limitations of the system quite openly.

This part is only noting that inter-user messages never even leave their 'secured environment'. By all accounts it does seem as well secured as any other provider I've looked into.

<comment><USER12> My point is that it's not end to end encryption. Everyone keeps promoting it like that when it's not, and like they finally solved the compromise between E2E and user convenience, when in fact they didn't.

Basically, it's Lavabit, but perhaps a little more secure than that in terms of regular threats. But an order like the one Lavabit obtained would force them to shut down, too (unless they agree to provide the backdoor), because it;s _not E2E_. If it was, such an order wouldn't have any power over them.

tl;dr ProtonMail is a competitor to Lavabit and Hushmail, not PGP.

</comment></comment></comment></comment><comment><USER13> This made me chuckle...

From the threat model article here: [https://protonmail.ch/blog/protonmail- threat-model/](https://protonmail.ch/blog/protonmail-threat-model/)

"NOT RECOMMENDED:

Edward Snowden – If you are Edward Snowden, or the next Edward Snowden, we would not recommend that you use ProtonMail. And in case Mr. Snowden was foolish enough to try, we have already blocked the username email@example.com"

</comment><comment><USER14> Wonder what the cost is going to be when it goes live.

Running infrastructure in those DC's can't be cheap (compared to regular co-lo facilities). Thats on top of probably having to deploy more gear (or higher perf gear than a regular email provider) since the work load is probably CPU heavy.

</comment><comment><USER15> Looks interesting, but I think if you trust non-open source encryption, you are basically a knave. Even with really smart people behind it, unless it's completely open, they could be compelled to put backdoors into it.

</comment><comment><USER16> So, if I send an ecrypted protonmail to someone else's yahoo mail, what happens? Is it only encrypted in the protonmail ecosystem?

True end to end encryption would mean everything is transferred as an encypted thing, and only people with a key can open it. If any email you send out ultimately is unencrypted so that the other side can read it, we aren't much closer than where we started are we?

If an email ends up in an unencrypted IMAP mailbox on a server somewhere, how is that more secure than what happens now?

<comment><USER3> I think it sends them a note that says, "Someone at ProtonMail sent you a message - click this link and enter the password they gave you to open it!"

Presumably they'll have some way to distribute the password in some ephemeral or slightly out-of-band way. It's probably less secure than messages within their environment, but it _shouldn 't_ ever hit another mailserver in plaintext (ideally ProtonMail wouldn't even have the plaintext anyway).

</comment></comment><comment><USER17> What a great project with what looks like 3 really talented guys. My one gripe is the @protonmail.ch domain requirement.

</comment><comment><USER18> I wonder how they will stand up against requests from the swiss government regarding lawful intercept access. Which, for larger providers is mandatory to participate in.

<comment><USER3> In true end-to-end encryption, this would probably not matter, since you can hand over all the encrypted e-mails you want and no one's going to be reading them unless they have your private keys. That said, the nature of in-browser crypto is such that they (or anyone who controls their servers) could intermittently change the JS code they are serving in such a way that it captures your private keys and decrypt all your e-mails.

So it really depends on your threat model. This service is somewhat more secure than Lavabit, but incrementally and not by leaps and bounds. It also constrains the attack model (in the Lavabit model they could be coerced to give the plaintext directly, in this case they would need to be coerced to actively steal their users' private keys).

<comment><USER18> There is no true E2E if you run it inside a browser.

And even if it would be application based (PGP, S/MIME), it would still leak metadata like crazy.

With all the threat models, I come to the conclusion, that there is no real E2E possible _at_all. All known platforms have been compromised, either by lawful interception/state trojan means or by direct hacking.

</comment></comment></comment><comment><USER19> This is a dupe of [https://news.ycombinator.com/item?id=7757420](https://news.ycombinator.com/item?id=7757420).

</comment><comment><USER20> Lavaboom.com has similar goals but is based in Germany. It's also webmail. I'm one of the co-founders if you have any queries.

</comment><comment><USER21> > "we plan to open-source key parts of our code as well later on."

Great!

<comment><USER22> Why not open source all of it? I find it hard to trust a closed service especially after what happened with gmail.

<comment><USER23> Curious, what happened with gmail?

<comment><USER22> Because of their little suicidal robots that scan the email and then go boom (targeted advertising), i keep getting viagra ads everywhere. Plus there's the whole NSA thing as well...

EDIT: Of course there's adblock and i dont see the ads on my main browser but when logging in on another computer in a public space... BAM, penis pills

</comment></comment></comment></comment><comment><USER24> Anybody know when this is finally opening up for more sign ups??

</comment><comment><USER25> The site uses Google Analytics. Easy to deduce the service's usefulness in a critical situation from there…

<comment><USER11> TOR?

EDIT: Just to expand on that a little. For as long as Snowden sports a TOR sticker on his laptop, or until I hear otherwise, I'll continue recommend its use for basic privacy needs. And as mikegioia notes, it is only used on the front page. You could also block the script, failing that!</comment></comment>


Running Mac OS 7.5.5 on Apple Watch - <AUTHOR> https://www.youtube.com/watch?v=R1xJxS_kr-M&feature=youtu.be

<comment><AUTHOR> He did it using the Mini vMac emulator. I would love to see more details about this.

[http://www.gryphel.com/c/minivmac/](http://www.gryphel.com/c/minivmac/)</comment>