Why Men's Friendships Are Different - <AUTHOR> http://online.wsj.com/article/SB20001424052702304620304575166090090482912.html <comment><USER2> I am not sure how I feel about this article. Either this article is way off base, or I am just an odd duck. Perhaps there is a cultural bias too (I am Indian).

Regardless, almost all of my close friends happen to be female, and I love the conversations! I love the discussions about their lives, about what's going on, how they are reacting to it. Not to mention that they think I have an empathetic ear, and occasionally come to me just to talk, if not to get some advice.

Even my conversations with my male friends almost never leads to sports or go off-base from the topic at hand. I prefer to listen to find out the crux of the issue, and never stop at the "Oh! That's too bad" as the article explains. If a friend of mine had lost a job or was having expecting a baby, assuming they are willing, I _want_ to know how they are approaching it, what about it scares/motivates them the most, if they need some help etc.

That's not to say that there is no place to sit and talk technology or world politics with a couple of friends over a few beers, but that's not all I do. I agree with tokenadult - this article bears no semblance to me or most of my male friends.

Could be just me though ;-)

<comment><USER3> Thank you for the perspective from a different culture.

I was struck by the articles "Oh! That's too bad" part too. If a close friend told me they were having a problem, I would want to know how I could help. If they were having serious health problems they may need some extra help with their "honey-do" list or someone to watch the kids so they can take their wife with them to the hospital. If they lost a job, maybe I know someone who is hiring. Etc...

Yes, if it is something I can't do anything about than offer sympathy, then they probably won't get too much more than a "that's too bad" from me and they may be better off talking to women close to them. But you often don't know what kind of advice or direct support your friend is capable of offering until you make your friends aware you have a problem. That is often why men I know share their problems, they are hoping for something useful even if they know the odds are low.

<comment><USER4> I would have to disagree with the other repliers that this is cultural. I was born and raised in the US (assuming that is the culture the article was working from), and I very much agree with a lot of what you said.

I have a decent number of healthy friendships, where I cherish and seek out those deeper conversations, where we both goof off, or nerd out or something or whatever. Some of those friends are girls and some of them are dudes. Sure the female friendships are more likely to end up that way, but I would argue that the length of the friendship and time you put in are bigger factors in terms of getting to the "My girlfriend just left, holy fuck what happens now" kind of conversations.

</comment></comment></comment><comment><USER5> This article seems like it belongs on some sleazy askmen.com type of site rather than the WSJ.

There are a number of things wrong with the logic here. These are sweeping generalizations that in my experience don't come close to reality. If there is any truth to this, I could see it only existing in select situations as described in the article like poker night or going to a football game with a group of men. People behave differently in groups than they do in one on one situations.

Also, as raju mentioned, I'm sure that a good amount of this is cultural. Even within western culture there are vastly differing cultural groups. Generalizations like this simply don't work, and I think it's harmful to entertain "stories" like this.

<comment><USER6> "This article seems like it belongs on some sleazy askmen.com type of site rather than the WSJ."

Hit the nail on the head...to even be having comparisons on the level of men vs. women is showing a shocking lack of nuance for WSJ...

</comment></comment><comment><USER7> It seems the article misses the point of outings with the boys. Men tend not to bring things up unless there is some discussion about how to fix it. 4 dudes can't fix someone's health problems, but they can go fishing, which at least makes the now pretty good, even though the immediate future might not be. Having good people around you reminds you that if you did come across something that could be fixed, the guy next to you in the fishing boat would help out.

<comment><USER8> Exactly! If the wife in the story wanted to know why her husband didn't talk about any of the various men's problems on their fishing trip, she could have just asked the rhetorical question "how would talking about the problem while fishing make the problem go away?"

I will talk to a friend about a problem only if they can help solve it. I have absolutely no desire to try to get empathy or sympathy.

<comment><USER9> _I will talk to a friend about a problem only if they can help solve it._

Huh. I find that talking to many and sundry friends about problems helps me to understand the problem. Something about refining how I articulate the issue helps me organize it in my mind, which in turn informs any action I may take.

<comment><USER10> Wouldn't that qualify as "only if they can help solve it?"

<comment><USER11> Exactly. If its "I'm trying to find a new job but I don't get past the resume point" your friends can help.

If its "I have bone cancer and I'm doing to die in a few years" there's nothing your friends can do to solve the problem.

<comment><USER12> They can't solve the cancer, but there are a plethora of other problems they can help solve on the way. Having a terminal illness introduces a great number of issues, and sometimes just talking helps determine the problem space.

</comment></comment></comment></comment></comment></comment><comment><USER13> There's not a single statistic in this entire article. I'm left with the conclusion that it's nothing except anecdotal sexist rambling.

<comment><AUTHOR> _There's not a single statistic in this entire article._

True that. This is a very common shortcoming of many blog posts, but that doesn't keep those from being submitted to HN in great number.

</comment></comment><comment><USER14> less "why" and more "how". Which is a shame, because "why" would be interesting.

<comment><USER15> The sexist-yet-probably-true answer: because women are emotionally weak creatures who get upset over minor things and feel the need to share. Men are better at stoically shrugging off the minor problems of life.

Also, men are better at nonverbal communication. If a friend has good news or bad news it's sufficient for me to say "Hey, congrats!" or "Bummer, that sucks dude", and we both know exactly where we stand. There's no need to spend several thousand words on agreeing with each other on exactly how good or bad the news is.

edit: Also, men and women find different things interesting. Women are far more interested in "feelings" and "relationships" as complicated objects worthy of discussion, whereas men see them as simple things unworthy of too much brainpower and would much rather think about "things" or "ideas". This explains why groups of men and groups of women will choose to talk about the things they find interesting, and why many man-woman conversations are doomed to be deathly boring to one partner or the other.

<comment><USER3> I must respectfully beg to differ.

Few the women I know are "emotionally weak." They do tend to be less stoic than men, but that is very different from weak, and I suspect that is at least partially cultural. I do think men are more stoic about dealing with minor problems in life (in general), but that has to do with how they express it, not how well they actually deal with it.

I also tend to find that men, in general, are less wordy, especially about emotional topic, but I think that is less about men being better at nonverbal communication. In fact, I find in general, the women I know are stronger in that area. The difference is that women tend to spend a lot of words agreeing as a cultural means of bonding, where men don't. This doesn't mean they do it for communication, they do it for affirmation of the relationship.

I will agree that, in general, women are more interested in feelings and relationships then men, but not because these are simple things or unimportant, or even that most men see them that way. It is simply a difference of focus. For instance, I do not find medicine "a simple thing unworthy of too much brainpower", I rather find that it is outside my domain and I let doctors worry about that while I worry about normalization and effecient storage structures...

<comment><USER16> Emotional weakness is probably too general of a term. Two things seem to be true: men are better at pushing aside their emotions to achieve their goals, and women are better at not making irrational decisions based on things like egoism and vengeance.

</comment></comment></comment></comment><comment><USER17> "I've played poker with the same guys every Thursday night for 18 years. _We rarely talk about our lives._ We talk about cards, betting, bluffing."

The author obviously hasn't experienced a real close friendship with another male.

My close friends and I share a lot of our thoughts on life, our feelings, aspirations, we talk to each other about it, give each other advice, suggestions & support.

I feel bad for the author for not having experienced a true close friendship. He wanted an explanation why he didn't have a true close friend(s) like women do, but just couldn't admit it was him not having found a true friend; so he writes this article generalizing his situation to be a problem experienced by all males.

</comment><comment><USER18> okay, sure, but my relationship with a girlfriend IS face-to-face (not side- by-side). it's not that we don't want intimacy, its just that if we're merely drinking buddies, I don't care. Maybe women have social pressure and upbringing that prompts them to pretend to care, or need to care out of being a socialite, and men don't face those pressures so just don't bother.

<comment><USER19> It's an obviously complicated question.

Men and women are different. They are, and there's nothing wrong with that. Different people fall at different points along their stereotype lines.

Where the difference can lead to conflict is when people on opposite sides of that difference don't notice or acknowledge it, and/or don't accept it. "How could you possibly think different from me?"

Anecdote of one: When my kid was four in pre-school their class played a game where they threw water balloons out on a measured field. Each time the balloon didn't break you threw again.

When the balloon broke you were to go stand at the side of the field, at the distance where your balloon broke, to mark your score.

All the boys stood proudly by their distances. All the girls clustered with the first girl at her score point.

There may be social pressure for men and women to act as their stereotypes, but I think it comes in part from actual differences.

<comment><USER20> I really doubt this is the case at the age of four. Before puberty, it is almost certainly all social differences.

</comment></comment></comment><comment><USER21> I'm pretty terrified if there are men who only have shallow friendships like in the poker night example. It's true that probably only men are capable of such relationships, though.

Yes, I have those shallow friendships too but their purpose is _to have fun_. We talk about computers, photography, cars, stuff like that, and usually while doing something. However, if those were all I had I would feel _really_ lonely.

For me, it's absolutely essential to have few (male) friends who are close and with whom I can talk about and reflect my life. I share things with my wife too but you can't share everything with one close person and you shouldn't. A wife equals not an amateur friend therapist. You might want to mention your fears and problems to her but you don't want to dwell in them with her.

I have a feminine side like every person, male or female, and I think it's hugely valuable to have a male guy or two who can respond to that, too. The feminine side is a much smaller part of me than my masculine side but it's still there and if I were to only acknowledge the latter, I would be missing quite a lot in life.

Life can rarely be solved, in the masculine problem-solving way; you can only live it. Pretty much all you can "solve" in your life is change your attitude, and in order to do that you have to recognize and acknowledge what part of you feels bad. Talking helps in that; in fact, trying to consider it a solvable problem and fix myself would only drive me further from the change I'm eventually going after.

But I sure like going karting racing with my friends or having beers and a few good problems to solve: that's fun! I just also acknowledge that it's only one part of me.

</comment><comment><USER22> "'I wouldn't talk about my insecurities with the guys,' says Mr. Schulsinger, a consultant. 'All my real insecurities about work, finances, the kids those I share with my wife.'" - i.e., the wife bears it all, and the guys just have fun. Of course, the wife is usually uncredited for this work.

<comment><USER23> The wife probably shares everything with her husband AND her girlfriends.

</comment></comment><comment><USER24> Suddenly all those answer sites like Yahoo Answers, Answers.com, Mahalo Answers etc. seem very male oriented.

Though someone posting that their computer is broken only to receive answers like "yes, I'm listening" and "I understand" is probably not be that useful.

</comment><comment><USER25> >Researchers say women's friendships are face to face: They talk, cry together, share secrets. Men's friendships are side by side: We play golf. We go to football games.

That mode of friendship sounds terrible to me. I'm male and I like to be active with my friends (biking, hiking, going to shows, etc...). However, talking about the important pieces of your life (the happy stuff, anxieties, depressing things, etc...) atop a mountain or over a beer are absolutely essential. I feel like the author is foolishly generalizing from his own social life. I would probably feel alienated and unsupported if I had friends like his.

</comment><comment><USER11> There might be some good research behind this article, but the way the author says things destroys the point. He takes things to extremes (maybe to get a laugh?) which makes the whole article silly.</comment>


Ask HN: How to become a more useful person? - <AUTHOR> Every day I come home after work and kind of just sit here, maybe watch a movie or TV or play games, until it's time to sleep and repeat. It's agonizing on the weekends. <comment><USER2> School season is upon us. Consider tutoring or coaching. Helping kids succeed can be quite rewarding (for both of you!).

</comment><comment><USER3> Volunteer your time for a non-profit that you feel is awesome, or build some FLOSS software in your spare time!</comment>


Experience with Alibaba.com - <AUTHOR>

I have an online brand that I'm looking to sell some cheap tshirts with a simple logo for a small revenue stream to complement my site.
Has anyone used alibaba.com to order any such items?  I've never done anythign like order 2000 shirts from china, hah.
thanks. <comment><USER2> We used alibaba to order foam surfboards from china. Even with proper design specs, it still took 3 shipments before they got it right. Things just get lost in translation sometimes. Finally got it in the end though. I guess tshirts will be simpler.</comment>


The Future of Crime-Fighting Is Family Tree Forensics - <AUTHOR> https://www.wired.com/story/the-future-of-crime-fighting-is-family-tree-forensics/ <comment><USER2> The Bear Brook Podcast from NH Public Radio covers an early case solved via family tree forensics. An excellent listen. [https://www.bearbrookpodcast.com](https://www.bearbrookpodcast.com)</comment>


Automatically subtitling the 31C3 - <AUTHOR> http://events.ccc.de/congress/2014/Fahrplan/events/6554.html

<comment><AUTHOR> So many great talks at 31C3 this year, but particularly looking forward to this one, especially given the previous discussion at [https://news.ycombinator.com/item?id=7829357](https://news.ycombinator.com/item?id=7829357)

It does look like some of the talks at 31C3 are being subtitled in near-real time, it's evident in some cutaways showing a slightly delayed text feed underneath the presentation slides. Really nice to see.</comment>


What does product/market fit mean in the large enterprise software market? - <AUTHOR> <comment><AUTHOR> A few great sources:

[http://www.feld.com/archives/2015/01/illusion-product- market...](http://www.feld.com/archives/2015/01/illusion-product-market-fit- saas-companies.html)</comment>


TreeSheets: Free-Form Data Organizer - <AUTHOR> http://strlen.com/treesheets/ <comment><USER2> I really like these sorts of tools, but the file format[1] is a bit of a con for me. Being binary/proprietary, it makes it difficult to integrate other tools or feed the data into other systems.

[1] [https://github.com/aardappel/treesheets/tree/master/TS/examp...](https://github.com/aardappel/treesheets/tree/master/TS/examples)

<comment><USER3> (disclaimer: I wrote the program).

The binary format is open source and documented, that doesn't fit the term "proprietary" to me.

It exports to text, html, xml, csv and more.

The reason it doesn't use any of that as its main storage format is that it tracks a lot of attributes that do not fit those formats naturally (I suppose you can store it all in xml, but I went for speed of loading/saving and smaller storage sizes).

<comment><USER2> I strongly suspected it was a performance and necessity thing. Not many text- based formats would have easily supported e.g. embedding images, as this tool does.

I do think it looks pretty great, though, and congratulations on the open source launch!

<comment><USER3> Thanks! It was open sourced.. 2.5 years ago? I'm not sure what motivated this HN post, but it is all good to me :)

<comment><AUTHOR> I rediscovered TreeSheets from another thread about visual programming:

[https://news.ycombinator.com/item?id=11244558](https://news.ycombinator.com/item?id=11244558)

[http://blog.interfacevision.com/design/design-visual- progarm...](http://blog.interfacevision.com/design/design-visual-progarmming- languages-snapshots/)

[http://strlen.com/aardappel-language](http://strlen.com/aardappel-language)

<comment><USER3> Thanks, hadn't spotted that thread yet :)

<comment><AUTHOR> Thanks to you!

Your languages are great (aardappel, Amiga E...).

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> I have been using this for the last 6 months or so. It is clean, efficient, and flexible. The UI is spartan, but it is also orthogonal.

<comment><USER5> Can I ask a few questions?

* Do you share the data with others?

* Can you give an example how you use this as a "go to" tool?

* Do you keep separate files for the data you are using or most things in one file?

The tool looks pretty interesting, but I'm look at the friction to move from other tools.

Thanks for your time

<comment><USER3> (disclaimer: I wrote the program).

* It's a traditional desktop app, so to share you'd save your files in dropbox or similar. It detects when the file has changed outside the app.

* Not sure what you mean by "go to" tool.

* Whichever you prefer. It can certainly handle large amounts of data in a single file efficiently.

* Importing from other tools: if the other tool (mindmapper/outliner) can save as indented text, this can then import that same structure. It can also read .csv files from excel etc.

<comment><USER5> I was hoping from a response from the poster that said he worked with the program for the last 6 months.

* The question about sharing wasn't really directed at how to share, but if he used this program to share with other users. So rather than it being a group of one, there were others passing data around.

* "Go to Tool" is along the line of my tool chest has all of these tools, and I pull out what the best one is. Since this is a multi purpose tool it get's pulled out more often, it becomes your "go to tool". Like people's leathermen tools become their "go to tool" for everything but fine dining.

The first may answer the need to be able to import in and out. If the group is using it, then less data transformations are needed.

The go to answers how useful it really is. In it all day doing things is a bonus, only using it for mind mapping not as helpful.

Thanks!

</comment></comment></comment></comment><comment><USER6> Startup idea: make same app controlled by voice and sell to tech & consulting businesses as a whiteboard that you talk to.

Over time it learns not about your business and it's processes so can correct itself & so on.

</comment><comment><USER7> This is really cool, and very similar to a hierarchical note taking app idea I've been kicking around. Kudos to Aardappel.

</comment><comment> noir-york Great work! I've been looking for something like this for ages.

</comment><comment><USER8> the idea is interesting, but I guess it need to be better designed. the ui does not look that good

<comment><USER3> (disclaimer: I wrote the program).

This has been a hobby open source project for a long time. It is built on the aging wxWidgets UI toolkit. I don't make money with it (this is not a startup, like everything else on HN ;), so, yeah, contributions to make it prettier welcome :)

</comment></comment><comment><USER9> Can a child node have multiple parents?

<comment><USER3> (disclaimer: I wrote the program).

No, it is strictly a tree, it derives its compact representation, automatic layout and quick manipulation from that limitation. There's a few ways around that, by tagging cells you can easily hop around cross-links.

<comment><USER10> Cell tags is exactly what I did to solve the lack of 'multiple inheritance' issue. Thanks for this product, I've been using it for almost a decade and it's all kinds of brilliant.

<comment><USER3> Thanks!

</comment></comment></comment></comment><comment><USER11> Why build this as a desktop app instead of a SaaS? Not a snark, seriously why this design decision?

<comment><USER3> (disclaimer: I wrote the program). I started this in 2008 initially simply to scratch an itch I had myself. I guess back then desktop apps still ruled? I also wanted it be very fast on large documents, which back then didn't seem possible with web-apps yet. Today that's maybe different, but a SaaS version is almost starting from scratch given the tech it is built on (C++ and wxWidgets with only local file storage).

<comment><USER12> This is just my personal opinion, but I really appreciate it when things like this are desktop apps.

I like having my data stored locally and having full control over what's going on and who has what. I don't want to have to worry about whether or not someone's service will be there a few years down the line, or what their uptime is.

I also like that older desktop apps feel really snappy on modern hardware. Usually, depending on the file format, it's not too hard to work out my own sync'ing setup. If I'm the only one using it, dropbox or something like that normally works.

Of course there are also online apps I really like, such as trello etc. I realize I'm giving those short shrift, with my quick list, and that there are really established apps out there with great guarantees that sure don't look like they're going anywhere, but I think you can get a vague idea as to my preference from it.

I'll definitely check out TreeSheets tonight. Appreciate the work you've done on it.

</comment></comment></comment><comment><USER13> This really is a great app IMHO, a compact mind map.</comment>


Ask HN: Any alternative to JavaScript in sight?  - <AUTHOR>

I see people are writing mp3 decoders in JavaScript and what not. Javascript is probably lingua de franca of web (quoted Jeff Atwood). And in last 2 years we have used JS in ways like never before.
Does anyone feel that sooner or later JS will probably turn out to be not-so-suitable for stuff we want to do ?
Are there any attempts being made to provide an reliable alternative or can JS itself evolve ? <comment><USER2> I think JavaScript will stick around for quite awhile. However, the viability and popularity of languages that compile to JavaScript will probably continue to increase.

Besides CoffeeScript, which mostly only offers syntactic improvements to JavaScript, there are several projects which compile very different languages to JS, including:

* Emscripten (<http://emscripten.org/>) compiles arbitrary LLVM bitcode to JavaScript. Since clang and GCC can both target LLVM, a whole lot can be compiled to JavaScript. The Python interpreter (<http://syntensity.com/static/python.html>) and the Bullet physics engine (<http://www.syntensity.com/static/bullet.html>) are both particularly impressive.

* Google Web Toolkit (<http://code.google.com/webtoolkit/>) compiles Java to JavaScript. It's used in many real projects. Scala+GWT (<http://scalagwt.gogoego.com/>) aims to use this toolchain to compile Scala code, though it's not yet production-ready.

* The reductio ad absurdum of this approach is <http://bellard.org/jslinux/>, a x86 PC emulator written in JavaScript. You can run almost any language in the web browser with that!

See [https://github.com/jashkenas/coffee-script/wiki/List-of- lang...](https://github.com/jashkenas/coffee-script/wiki/List-of-languages- that-compile-to-JS) for a (possibly exhaustive) list of languages like this.

Whether these approaches can deliver passable performance for legacy browsers is an open question. However, for newer browsers it's safe to assume this general approach holds a lot of promise.

<comment><USER3> Since all of these compile down to javascript, they all suffer from at least some limitations of javascript -- the main one being performance. Yes, all browser manufacturers are trying to make it as fast as they can, but I sincerely doubt I will see the day javascript can run as fast as a statically typed and (jit) compiled language that isn't being executed by the browser. And when I say that, I don't mean little synthetic scenarios where some piece of javascript manages to be faster than something gcc spit out. I've already seen those, and they don't impress me any more so than a hummer being able to look like a ferrari if you get the angle and lights just right.

I'm a fan of P/NaCl for this reason. Their approach goes directly at the problem instead of banging on a square peg for years and years until it barely manages to fit through a round hole. By the way, that is the only way I can describe using html/js/css for application development at this point. If it makes me sound bitter/angry, it's probably because I've been doing it for too long and grown tired of how tedious and limited it is.

</comment></comment><comment><USER4> Google's Native Client [1] is one answer. It allows you to run native code safely in the browser. It's goal is also to support LLVM IL to run safely in the browser. This way you could potentially use all your favorite languages at nearly full speed, and also have access to the DOM and other browser APIs.

Another answer is to compile your favorite language down to Javascript. This gets you the expressiveness at the cost of a slowdown in runtime speed. Languages like Coffeescript are very close to Javascript so they don't incur much overhead by doing this, but even this approach can't go as fast as code running on Native Client.

[1] <http://code.google.com/p/nativeclient/>

</comment><comment><USER5> While server-side JS such as Node.js might be a fad, client-side JS is firmly entrenched. Given the speed at which the browser developers and standards groups agree on implementing new standards (read: slow), client-side Javascript is here to stay.

However, CoffeeScript provides an interesting look into the future of Javascript. I also see a similar thing happening with CSS and Less, where people are no longer waiting for browsers to support features developers want.

And lastly, I personally really enjoy coding in Javascript. The ugliest part about it is the DOM and Jquery successfully hides that. I think part of the reason Node.js is so popular because of the strength and programmer joy of the language.

</comment><comment><USER6> Mozilla is working on Rust <https://github.com/graydon/rust/wiki/Language- FAQ>. Google has Go <http://golang.org/>.

To run compiled binaries from such languages you'll use Native Client <http://code.google.com/p/nativeclient/> and Pepper APIs which let you access HTML5.

Go gets rid of some insecure low level things like pointers, keeps such things in an unsafe package to discourage its use. They intend to make it seamlessly compatible with NaCl. C/C++ code needs to be modified to work there.

JS is already not suitable for lots of stuff. Vendors are stretching its capabilities with big teams of fancy programmers implementing fancy VMs with big chunks written in assembler. At Google I/O they mentioned V8 is about as fast as it will get. Then bigger teams are writing massive APIs because even with fast VMs the language isn't fast enough to roll your own CSS/XAML/MXML/HTML parsers or 2D rendering contexts. So you're forced to wait or hack together things like LESS, CoffeeScript, Stylus in an attempt to communicate with the overlords.

With the browsers becoming the operating system for many users, you need a runtime that's as powerful as a regular operating system. Google and Mozilla are major players and it's nice to see them exploring alternatives.

But even if NaCl/Go is superior technologically, it may not overcome JavaScript's business and political momentum. As usual, technology is not chosen based on technological merit, but business considerations like legacy, lock in, etc. Perhaps NaCl/Go approach will succeed but it will be too little too late. Kinda feels that way with Flash and Browsers, they're finally serious platforms but might be too far behind Objective-C, C# and Java on mobiles.

</comment><comment><USER7> Well there's always been interesting talk about getting LLVM to run in browsers, which would be wicked cool, and open up a lot of different programming languages.

That said, JavaScript really is an awesome language to use, if you can get over the syntax. So i really can't see how JS would be unsuitable for future use, especially in light of the changes that have happened and continue to come down the pipeline in newer versions of JS.

Coffeescript is a fantastic view of the power and capabilities of JavaScript packaged in a way that is considerably more elegant to look at and use on a daily basis. Check out the talk that Brendan Eich and Jeremy Ashkenas did at JSConf (<http://news.ycombinator.com/item?id=2662846> ).

Javascript really is going to be a development powerhouse for the foreseeable future. And i'm actually happy about that.

<comment><USER8> No one language can meet every need. Even if it has been done, Javascript is a terrible language to write an MP3 decoder in, relative to more suitable languages. So if we're continuing to expand what the browser can do, shouldn't we expand what languages we can express them in? Why do we have to write our WebGL programs in Javascript? Javascript isn't a terribly great bytecode language, either, unless you're basically just writing a thin skin over Javascript.

The logical conclusion of this line of argument is pretty much NaCL: <http://code.google.com/p/nativeclient/> Is that the anwser? Is there some intermediate where Javascript isn't the only choice for everything but we don't go to the other extreme?

Beats me, but we'll all find out together. But my main point is that it definitely is not the case that Javascript is just the answer to everything and the situation is just peachy keen as it is. It isn't the answer to everything. No one language is. Either we get something else into the client, or we face some combination of wasted effort jamming programs into a language that doesn't really want them and applications simply never written because they don't work well with Javascript's abstractions. Maybe that's OK too, maybe we want a distinction between "native" and "web" app.

<comment><USER7> So i'm curious what you mean by "more suitable languages" for writing an mp3 decoder. Also which of Javascript's abstractions are do you think are so inherently unsuitable?

As far as general purpose programming languages Javscript does pretty well with regard to object semantics. That's why things like Coffeescript are as powerful as they are. Javascript certainly doesn't have the elegance that say Ruby or Python has built in, but thanks to JavaScript's powerful and flexible nature, a lot of those capabilities are possible to build on top of JS's core.

<http://documentcloud.github.com/underscore/> (which was also written by jashkenas and others) is a great example of this.

On the performance front, given all of the work that's gone into the various browser implementations of JS, that you could call it unsuitable from a performance standpoint. Could perhaps elaborate on this further?

<comment><USER8> "Also which of Javascript's abstractions are do you think are so inherently unsuitable?"

No, that's the wrong way of thinking about it entirely.

When you create a language, you must unavoidably privilege some ways of thinking and working above others. You must make some things easier, at the expense of making some things harder. There's no one set of answers that works universally.

Suppose I want to make an immutable language. Can I program Javascript purely immutably? Well... sort of. You can try, anyhow, but you'll get no help from the compiler, and any existing libraries will be all but useless, it's really a new language. Suppose I want to prove things in Javascript; with both mutable values and object prototypes that can be freely rewritten at any time, it's infeasible. Suppose I need C++; where's my private variables? Expressable? Sure. Useful? No; Javascript has made them much harder while working on making its object system powerful in different ways. That's not a criticism; a language _has_ to make some things harder when it makes some things easier, to be a criticism I'd have to be calling it a "bad tradeoff", which in most cases it isn't.

It's not whether a thing can be done, it's how well it can be done, and Javascript isn't the best at everything. And "how well" something can be done matters, because the harder you make it, the less likely someone is to do it. No amount of theorizing how that doesn't have to be the case will change that.

There's nothing that any Turing Complete language can't do (with the proper hooks into the machine it's running on, anyhow), but no one language can be the best choice for everything. I wouldn't want to try to make an OS out of Javascript. Now, I personally wouldn't want to try to make one out of C particularly either, but Javascript would be even worse.

So either we lock all those apps out of the browser, or we make them much harder to write than they would be in a language actually suited to them. There's a time for C and a time for assembler and a time for Haskell and a time for C# etc. etc. Languages profoundly affect what gets written in them.

<comment><USER7> The two things i have to say in reply to that. First, i think there's a lot of bunk common wisdom about tradeoffs as well. Scala's a great example of a coherent merger of object oriented programming and functional program, two paradigms that have for whatever reason been typically seen as oppositional (please note, i'm not accusing you of that, but i think it's reasonable to ask _which_ things you think are unsuitable, understanding that there are tradeoffs). Second, when you're talking about suitability, i have to ask about what your constraints are. If all languages have their tradeoffs, then i don't see the problem with saying that JavaScript is as good a general purpose programming language as any other. Sure it's got tradeoffs, but JS as a language and as a programming platform has really hit a firm stride, and clearly has at least a couple years of solid growth ahead of it. Yes, JS like any other programming language, isn't perfect, but it is going to continue getting better and growing into new niches.

</comment></comment></comment></comment></comment><comment><USER9> Nitpick: "Lingua franca", not "lingua de franca"

<http://en.wikipedia.org/wiki/Lingua_franca>

Also: no, probably not. We're still dealing with browsers that are 10 years old, so even if you were to release a browser, with, say, Tcl as the default language, it'd be years before it was something you could count on being everywhere.

See: positive network externalities, and "lock in".

</comment><comment><USER10> I'd like to see a statically typed language available. There is relatively little I do that requires dynamic typing, but so much of my experience would be better with static typing.

I'm not saying to get rid of JS, but it would be nice to have a first class alternative.

<comment><USER11> JS is adding limited static typing in typed arrays: <https://developer.mozilla.org/en/javascript_typed_arrays>

<comment><USER12> Nothing about Typed Arrays is static typing.

</comment></comment></comment><comment><USER13> Some effort is being made to bring other languages to the web. Emscripten is a backend for LLVM to produce javascript code (should work with any LLVM frontend). NACL (native client) is a project by google to allow code to be compile for a more secure subset of x86 and to run on a browser safely. I'm not sure on the stability or use of either. GWT (google web toolkit) is a project that compiles java to javascript. This one should be fairly stable and seems to be well supported.

</comment><comment><USER14> What, specifically, would you like to see changed?

It _is_ evolving: Coffeescript, node, npm, and V8 are four examples. It can feel good to code in JS, just like it can in Python or Ruby (or Scheme :-) ).

</comment><comment><USER15> No? It's only important because everyone has a javascript interpreter. The point will become moot as Javascript interpreters get good enough to allow us to run with languages that compile down to Javascript and enable more optimizations like typed arrays.

</comment><comment><USER16> While I realize that Flash is no longer in vogue these days, ActionScript 3 is a really nice language and I'm surprised nobody else has mentioned it. It provides things like optional static typing for speed improvements, code clarity, and improved tooling/refactoring, as well as classes and packages for organizing larger code bases. It's more of what Brendan Eich envisioned JavaScript 2 to be.

That said, Apple is making it really hard for developers to choose it for all but intranet apps (for which it's really well suited).

I second GWT and the responses here have prompted me to look into CoffeeScript, so thanks for asking this!

</comment><comment><USER17> The number of new features added to JavaScript in the past year is substantial. Between Canvas, WebGL, WebSockets, WebWorkers, Audio Data, TouchEvents, the number of permutations of new kinds of browser-based apps you can build will keep anyone busy for years. Then add NodeJS, and CouchDB, and the use of JSON as a data interchange and there are things you can do entirely in JavaScript that no other language can do.

If JavaScript continues to be improved (Harmony, V8/Spidermonkey engines, etc) then I see no other language on the horizon that will replace it.

<comment><USER18> Everything you listed actually has nothing to do with Javascript as a language. These are new frameworks for the and clientside APIs, not language features.

<comment><USER17> That's like saying the addition of the DOM did not improve Javascript. Standardized API's do matter, and do improve programming languages.

</comment></comment></comment><comment><USER19> Frankly I really like JavaScript. I don't want the language to change, even though it has its flaws. I just love the ability to have data-structures as simple as objects and arrays which have evolved into a standard data exchange format (JSON). Then you can also have functions inside objects and everything becomes really flexible and really easy to design.

I've tried _many_ different languages, including the real pretty ones such as Ruby and Python, and I just have more fun using JavaScript because of how free-form it is.

<comment><USER20> That flexibility is indeed useful for scripts and adding minor interactivity to an otherwise static web page.

However, people are now using JavaScript for development that far exceeds those uses. JavaScript is just not suitable for larger applications.

Once your application starts exceeding a few thousands of lines of code, the problems become very clear. You soon wish you were using a language like C++, Java, C#, Python, or Ruby. Toss in a development team made up of at least several people, if not more, and the pain becomes far greater.

<comment><USER19> I was never able to personally judge that statement. My experiences show that the flexibility of JavaScript only improved maintainability of the software written in it.

<http://npmjs.org/> is a list of solid software (also large software) written in JavaScript.

So I don't think your statement, about maintainability being connected with how flexible a language is, can be proven to be true.

<comment><USER20> By "larger applications", I wasn't talking about jQuery, Node.js or anything built upon them.

I'm talking about real software systems with, at a very minimum, tens of thousands of lines of code. More realistically, we're talking systems with hundreds of thousands, if not several million, lines of code.

C++ can scale up to codebases that large. Java and C# can handle it, as well. Even Python and Ruby can, if care is taken. JavaScript cannot. You'll be hitting numerous maintenance barriers far before then, when you're still well under 10,000 lines of code.

<comment><USER19> Why do you think JavaScript cannot handle it? If you reach the million lines of code you probably have a really modular application, otherwise it's unmaintainable in any language. Being modular it can be sub-divided in many small layers which are the size of a jQuery library.

I think your experience with JavaScript comes from reading code made by bad developers. If your software is written by good people it will be maintainable even in JavaScript.

<comment><USER3> I've worked on some larger applications in javascript (though nothing incredibly large), and I can tell you if I had the choice of using any language that offered static and strong typing I'd take it in a heart beat. A small change in one place often means an error in some part of your code you didn't even think would be affected. I've loaded 65k LOC JS files in firebug and webkit's debugger chasing some error down that was happening in some piece of code that I've never seen before. All because that's how far my screw up managed to travel when there is no type checking or strong typing. In that particular case I had set a string value to something that was supposed to have been an array. Something like that would never have happen in, lets say C#, but "crap"[0] or "crap".indexOf("c") or ["c", "r"].indexOf("c") are all valid JS.

<comment><USER19> Dynamically typed languages offer a lot of benefits and a lot of burdens. Only you can judge whether you're willing to take those risks. Personally I am more comfortable with dynamically typed languages as they feel more _natural_ and less programmatic, but this is just personal taste.

Nothing of this is related to the free-formness of JavaScript. Python and Ruby are also dynamically typed.

<comment><USER3> I have no experience with ruby, but python's advantage is in strong typing. Try and add an int and a string and you'll get a type error, JavaScript on the other hand will do it though. While maybe allowing you to write more expressive code, it does mean that errors become harder to locate, and when dealing with larger applications, I prefer being able to locate errors quickly.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> coffeescript - it's just javascript, but with a touch of awesomeness.

<comment><USER22> And without proper stack traces.

Don't get me wrong, I love coffescript, but it clearly is a hack.

The internet landscape would look very different if browsers had a standardized bytecode interpreter.

<comment><USER23> Not just a hack. Recognized developers such as Brendan Eich (creator of javascript) or Douglas Crockford (author of Javascript: The Good Parts) say that Coffeescript is good stuff. Coffeescript is a "transpiler", a source-to- source compiler wich translates a high level, very flexible and powerfull language such as coffeescript into plain old javascript. It doesn't change the underlying language at all, it keeps its object model and its data types. It just adds a more expressive and succinct syntax, inspired in python and ruby (and these languages have a very well deserved reputation for expressiveness and joy amongst programmers for a reason).

</comment></comment></comment><comment><USER24> I don't think that the problem is that javascript is bad, but that it will kill most other scripting languages just by being in the right place at the right time.

It will be harder and harder for ruby/python/perl/x to compete with js in the future just because people know js and because it essentially runs everywhere fast.

WebCL, WebGL and friends will cover anything with extreme computational needs, and that will be everything you need to learn to write applications in the future, unfortunatly.

</comment><comment><USER25> I think the execution of native code from the browser is slowly creeping in, in such a way that you'll be free to choose your language as you are in non- browser areas. Google native client, webGL and the ultra-new webCL are glimpses into the future. Javascript has served us well, but if we can avoid unnecessary computation as well as make use of existing code bases, then I am sure we will, eventually.

</comment><comment><USER26> > Does anyone feel that sooner or later JS will probably turn out to be not- > so-suitable for stuff we want to do ?

Be more specific. Every programming language is not-so-suitable for stuff we want to do.

> Are there any attempts being made to provide an reliable alternative or can > JS itself evolve ?

What's "unreliable" about JS? The lack of standardization in available features among browsers? That's an issue, but it will be dealt with, one way or another. C gained a huge infrastructure of tools and standards to make it more portable, and platforms that didn't or couldn't keep up are no longer used.

This presentation from Velocity 2011 shows just how far JS has come. The author suggests that in the next iteration will be type inference in JS engines and/or optional explicit typing in the language.

[http://www.slideshare.net/newmovie/know-yourengines- velocity...](http://www.slideshare.net/newmovie/know-yourengines-velocity2011)

</comment><comment><USER27> What do you think it might turn out to be unsuitable for?

Just like some languages have tools to translate them to C, there's no reason why you wouldn't use a tool to compile from a language more appropriate to your task, into javascript.

</comment><comment><USER28> Why is JS not "reliable"? Any language can be a JS alternative. Do you mean you want an alternative language that runs natively in browsers?

<comment><USER29> "alternative language that runs natively in browsers"

That's already been done: <http://code.google.com/chrome/nativeclient/>

<comment><USER30> That doesn't run in _browsers_ , it runs in _one browser_ — Chrome.

</comment></comment></comment><comment><USER31> Check out <http://runrev.com/>

</comment><comment><USER32> <http://altjs.org/>

</comment><comment><USER33> I would like to see an alternative to the WWW altogether. WWW is no longer a collection of hyperlinked documents, which was its initial purpose but a multitude of technologies running on browsers that use HTTP in nonstandard ways because it's ubiquitous. HTML is getting obsolete, with the most popular websites being essentially javascript apps. Maybe it's time for a new system like Java to create cross platform GUI apps from the cloud, that is not constrained by the browser and HTTP's limitations.

<comment><USER34> I believe the most popular website is essentially an interface for this collection of hyperlinked documents. Document browsing is still one of the killer features of web.

HTML is not a bad layout engine for GUI apps. It may not have been initially been designed as one, but after 15 years of development it seems to be pretty pleasant to work with as there are people who want to build their desktop apps with HTML.

Obviously, the standard request-response model of HTTP is limiting for interactive apps. Bi-directional communication within request isn't possible and handshaking is a bit too expensive. But hey, this problem is actually solved: <http://dev.w3.org/html5/websockets/>.

</comment></comment><comment><USER35> JavaScript will be superseded by, what else, C/C++. Right now there are no JavaScript killer applications on the web. Adobe and Microsoft tried with their respective wares, but Apple interceded and stopped both.

It's hard to imagine now, but something will come along that, like web services, finds a slick way to give the folks what they want, performance.

And that innovation will be written in C.</comment>


Do Pivots Matter? - <AUTHOR> http://steveblank.com/2014/01/14/whats-a-pivot/

<comment><USER2> Steve makes a good point, substantial change can come anywhere in your business model, not just in the product.</comment>


Kids say e-mail is, like, soooo dead - <AUTHOR> http://news.com.com/Kids+say+e-mail+is%2C+like%2C+soooo+dead/2009-1032_3-6197242.html?tag=nefd.top <comment><USER2> The nature of email is certainly shifting towards business dealings, as this article states. However, it's more than that: traditional email is also becoming a message aggregator. As social utilities, such as Facebook, MySpace, etc continue to utilize their own messaging systems, email acts as a feed reader to notify you when you have a message in any of your more specialized systems. So rather than it being the message itself, it becomes the messenger of a message.

<comment><USER3> > So rather than it being the message itself, it becomes the messenger of a > message.

Which is ridiculous. Facebook and MySpace can still get hits on their webpage by forcing you to reply by going to the page but having to go to a different site to read a message is _annoying_.

</comment></comment><comment><USER4> Very popular BS these days. facebooks, myspaces, linkedins and friendsters come and go, but nobody has suggested anything even _remotely_ close to power of email.

Spam, along with viruses, spyware and adware (IMHO) is mostly a problem for computer illiterate: those users will be gradually dying off.

</comment><comment><USER5> The only substantial difference between facebook and traditional email is the restriction on who can send you mail. If all of the people you interact with are all on facebook already and use it often, it doesn't make sense to use anything else.

The fact that you can't get email directly forwarded to you is very annoying, however it is a bit more secure.

(edit there are other differences of course, but they are "non-substantial." The restriction of in-network sending is the only thing that makes it not "email" already as far as this discussion is concerned. If you could message email@example.com then it would be email.)

</comment><comment><USER6> I hope not ;)

After graduating college I think most people would disagree.

<comment><USER7> Agreed. It's logical too. Most high schoolers and college students have a very small network of friends, acquaintances, family, etc. (in relative terms).

Once you get into the real world, you have to deal with people all over the place, oftentimes whom you've never met before. That's when email becomes truly useful.

Alternative hypothesis: after college, people aren't as concerned with appearing "cool," so Facebook Wall Posts really don't matter much anymore.

</comment></comment><comment><USER8> For me, instance messaging has replaced the telephone. It is, frankly, better in every way when discussing technical matters.

Email is better when you need to make a more elaborate statement that doesn't require back-and-forth communications.

I have had business email written in the style of text messages. To me, this is offensive, and it's a trend I hope ends.

</comment><comment><USER9> reports of my death have been greatly exaggerated

</comment><comment><USER10> Old news, but I'm sure that it's just sinking in for older people.

Has any site ever proven every guideline that site designers have held strong to be entirely false like myspace did? I think that's the cause of most of the contempt they receive to this day. Entertaining, it is.

</comment><comment><USER11> Spam spoiled email for my family. We now rely on IM for communication.

<comment><USER12> get a gmail account

</comment></comment><comment><USER13> Kids these days, with their hair and their twitters...</comment>


UK Broadcaster Allegedly Hacked Rivals' Access Technology To Bankrupt Them - <AUTHOR> http://www.guardian.co.uk/media/2012/mar/26/news-corp-ondigital-paytv-panorama

<comment><USER2> Looks like Murdoch may have been up to some pretty dark and grizzly business with ONDigital.</comment>


Jakob Nielsen on 30 years of computing: "I wanted to ... put humans back in control ..." - <AUTHOR> http://www.useit.com/alertbox/20040524.html

<comment><AUTHOR> The full excerpt I pasted a snippet of above is:

"For me personally, the experience of moving from a small, relatively transparent computer to an oppressively large and opaque one marked the start of my passion for usability. I knew that it could feel good to use computers, and I wanted to recapture that sense of empowerment and put humans back in control of the machines."

It's nice to see him not act like a curmudgeon once in a while.</comment>


RailsNew – Access most of the command line switches quickly - <AUTHOR> https://railsnew.app/ <comment><AUTHOR> I grew tired of having to scroll through the list of options in `rails new --help` to bootstrap a new app, so I made a quickie react page to make it a bit easier.</comment>


'Warrant canaries': a subtle hint that your email provider is compromised - <AUTHOR> http://www.theguardian.com/technology/2015/aug/20/warrant-canaries-a-subtle-hint-that-your-email-provider-is-compromised

<comment><USER2> So does that AussieNanny law apply only when the canary is present on a server actually based in Australia or having a .AU domain?

Seems like this is a great op for someone to setup a canary system in Belize or, even better, a canary system on a .onion domain. I would check there before visiting a sensitive site if there were such a system.</comment>


Where does your plastic go? Revealing America's dirty secret - <AUTHOR> https://www.theguardian.com/us-news/2019/jun/21/us-plastic-recycling-landfills <comment><USER2> > "We created the notion that this stuff was being recycled, so the public > kept buying it," he said. "But most mixed plastics are simply not being > recycled."

Quite a con job. WHO made money on this?</comment>


A crazy summer project to reinvent desktop human-computer interaction - <AUTHOR> http://10gui.com/video/

<comment><USER2> previous posting has some good discussion on this:

<http://news.ycombinator.com/item?id=877535>

</comment><comment><USER3> They lost me when they pronounced that multiple scattered windows are a bad UI. I couldn't live without them. And their stacked windows cover up the clock. And you still have to switch back and forth between pointing and keyboard.

But it looks sweet anyway. I want one.

</comment><comment><USER4> Argh. Well, if you get past the wall of Future Tech buzzwords they've got some great ideas. These come later in the video though, as the first portion is basically:

"Mouses aren't enough, we need [what equates to large ipad screen, AKA tablet, AKA nothing really new here]"

<comment><USER5> This site is almost 6 months old, before we knew anything real about the iPad. And it is about using a touch surface to control a separate screen, not touching a screen.

<comment><USER4> So what if it's older than the public release of the iPad? The design is still the same.

But like I said: <http://www.wacom.com/cintiq/cintiq-21ux.php> Not really anything new on that portion of the video.

</comment></comment></comment><comment><USER6> Most Annoying Voiceover in Lame Marketing Video, 2010.</comment>


Space Highway – the Interplanetary Transport Network - <AUTHOR> http://spaceindustrynews.com/space-highway-the-interplanetary-transport-network/

<comment><USER2> Does anyone want to fund a startup called Gate Corporation? [http://scifi.stackexchange.com/questions/3067/what-is-the- st...](http://scifi.stackexchange.com/questions/3067/what-is-the-story-behind- the-warp-gates-in-cowboy-bebop)</comment>


Cataphracts: Armored Warriors and Their Horses of War (2015) - <AUTHOR> http://www.ancient-origins.net/history/cataphracts-armored-warriors-and-their-horses-war-003361?nopaging=1 <comment><USER2> Modern steel can be used to create bullet proof body armour.[1]

A frontal plate costs $65 and weighs 4kg.

[1] [http://www.ar500armor.com/ar500-armor-trauma-plate- advanced-...](http://www.ar500armor.com/ar500-armor-trauma-plate-advanced- shooters-cut-asc-10x12.html#.VwNBlhG5KrI)</comment>


HyperLogLog in Presto: Faster cardinality estimation - <AUTHOR> https://code.fb.com/data-infrastructure/hyperloglog/ <comment><AUTHOR> HyperLogLog is a really interesting and powerful data type.

Though a few things seem missed in the article. HyperLogLog has been around I believe over 10 years now. It's been supported for Postgres for over 5 years [1] now as an extension[2]. It is great to see it growing further with Facebook adding support for it for Presto.

[1]. [https://research.neustar.biz/2012/10/25/sketch-of-the-day- hy...](https://research.neustar.biz/2012/10/25/sketch-of-the-day-hyperloglog- cornerstone-of-a-big-data-infrastructure/)

[2]. [https://www.citusdata.com/blog/2017/06/30/efficient- rollup-w...](https://www.citusdata.com/blog/2017/06/30/efficient-rollup-with- hyperloglog-on-postgres/)

<comment><USER2> I was first aware of it being used in redis

<comment><USER3> Same here. And Salvatore's blog post about hll is pretty nice:

[http://antirez.com/news/75](http://antirez.com/news/75)

</comment></comment></comment><comment><USER4> Original HLL paper from 2007: [http://algo.inria.fr/flajolet/Publications/FlFuGaMe07.pdf](http://algo.inria.fr/flajolet/Publications/FlFuGaMe07.pdf)

<comment><USER5> One of the key quality that hyperloglog relies on is that the action of hash distributes any input to any output with equal probability (eg. any input have 1/m chance to be in a particular point in output space where m is the cardinality of the output space)

I can't seem to prove this rigorously, am I understanding the paper correclty?

<comment><USER4> I think it's more a practical concern than something that can be proven conclusively; the behavior characteristics (e.g., collision probability) are known for a given hash function, and if you're implementing HLL, you choose an appropriate one based on your use case (expected cardinality, etc.)

Redis uses a modified 64-bit MurmurHash2, for example.

</comment></comment></comment><comment><USER6> Awesome! Now that we have union, implementing intersect[1] would be killer.

[1] [https://github.com/axiomhq/hyperminhash/tree/master](https://github.com/axiomhq/hyperminhash/tree/master)

</comment><comment><USER7> This is so cool to have the raw data type becoming accessible in Presto. Testing it out, it is interesting to see the HEX of the data type as one increases the count of elements!</comment>


Four firms to control nearly the entire Bitcoin mining industry - <AUTHOR> https://decrypt.co/18719/four-firms-to-control-nearly-the-entire-bitcoin-mining-industry <comment><USER2> There is an ongoing concentration of power - as seen on many other networks too. This is a worrying sign.</comment>


Power outages and low internet bandwidth, still manages to build tech company - <AUTHOR> https://stories.devacademy.la/against-all-odds-building-a-tech-company-outside-of-a-tech-mecca-e9599d0d691e#.uocbdhpoi <comment></comment>


Mindbot – Your Virtual Problem Solver - <AUTHOR> http://www.mindbot.co <comment><USER2> From the page:

        Your data collected through this
        form will not be shared ...

OK.

        ... and will be deleted at least
        three months after the completion
        of this form.

So that means that the data will be retained for a minimum of three months, and there is no time limit set on when it will actually be deleted.

I'm not sure it's useful, I'm sure it might be an interesting diversion, but I'm absolutely not going to provide a real email address. I'd be interested to hear others' takes on the whole idea of providing email addresses to random "services" like this.

<comment><USER3> Panhandling is one idiom. Just trying to get something for nothing.

Begging is another. Maybe 1000 email address will attract venture capital.

Busking is a good idiom. Set the case on the ground. Leave it open. Create a bit of value to attract a crowd. Keep your mouth shut and focus on the value creation.

Most people don't have the faith to busk. We're taught it's better to fail behind a paywall than be the kind of fool who just gives stuff away. Adulting is making money not music.

Most email collections are panhandling. It's the Forbes reading MBA version of "build something people love." Figure out what people love then build it. It's not that that won't work. It's that it probably won't work without busking.

Patio11 went door to door for appointment reminder before building it. Proctor and Gambel sent engineers into the field to figure out the Swiffer.

The Swiffer origin myth is useful. What the buskers busked was just listening. They busked their time and attention to people who would feel better from some simple time and attention. Patio11's story is useful because he asked for money before building the product and built it because he got money.

Buskers open with "I trust you." Already half way to mutual trust.</comment></comment>


The web's new Fetch API introduces low-level streaming - <AUTHOR> http://jakearchibald.com/2015/thats-so-fetch/

<comment><USER2> > _One particular high-profile JavaScript community member was unconvinced…_

For context:

[https://twitter.com/substack/status/577760404987777024](https://twitter.com/substack/status/577760404987777024)

[https://twitter.com/substack/status/577974462550704129](https://twitter.com/substack/status/577974462550704129)</comment>


Nothing Kills Startups faster than these 2 things - <AUTHOR> http://startupiceland.com/2014/11/24/nothing-kills-a-startup-faster-than-these-2-things/

<comment><USER2> Nonsense. Legals and accounting should definitely be done properly, but they're things that can be fixed later if you get them wrong. Also, killing a startup with bad legals takes _months_. Running out of cash can kill a startup in _days_. Getting the team wrong can kill a startup in _hours_.</comment>


Starting with No - <AUTHOR> http://jonsteinberg.com/2010/04/starting-with-no/ <comment><USER2> This is why it's important to actually know things, i.e., how things work.

As long as you keep the article's context in mind (how to deal with people who aren't motivated enough to find obvious solutions), it's not bad advice.</comment>


Feds put heat on Web firms for master encryption keys - <AUTHOR> http://m.cnet.com/news/feds-put-heat-on-web-firms-for-master-encryption-keys/57595202 <comment><USER2> I'm ambivalent about NSA's need to request potentially large amounts of data from Google about broadly targeted foreign intelligence targets. I see the long term sinister possibilities while generally believing that the data isn't being misused today, and what immediate problems I see have more to do with ineptitude and laziness than with the belief that Internet surveillance is fundamentally evil.

But coercing Google into handing over TLS keys is unequivocally bad; indefensible, I think. It's one thing to legally compel Google to grant access to data, but another thing entirely to rewire Google itself:

* It provides NSA with a technical capability they do not currently have, enabling them to shoot first and answer questions for a court later, and eliminates a due process element that other providers (notably Yahoo) have been able to avail themselves of.

* If provides the USG with capabilities beyond simple surveillance, for instance by allowing them to spoof Google pages. There can't be any legitimate reason to provide them that blanket authority.

I appreciate the effort and expense it must take for companies like Google to resist these requests.

<comment><USER3> > It provides the USG with capabilities beyond simple surveillance, for > instance by allowing them to spoof Google pages. There can't be any > legitimate reason to provide them that blanket authority.

The US government already has at least Verisign under their belt. They can already MITM just about any SSL connection they could ever want to.

I would wager that they have a large number of private keys anyway. It's not like datacenters would be able to do much when the NSA rocks up with a NSL.

<comment><USER4> Would that mean that self-signed SSL/TLS certificates are safer than certificate-authority-issued certificates?

<comment><USER5> Neither is inherently safer than the other, certificates are about trust, SSL/TLS gives you encryption regardless of where the certificate comes from. If you control both ends of a connection or know the person who signed the self-signed cert and trust him more than someone like Verisign, then yes, self-signed is just as good or better.

In the case of an organisation like Google, I don't see why the US government would even need the keys for Googles SSL certificates. Google have all the data they could ever want stored unencrypted anyway (or at least have the ability to decrypt). If they had any legal reason for wanting the content of my gmail account, they could just get the courts to subpoena Google for the data.

<comment><USER6> > they could just get the courts to subpoena Google for the data

I think that's one of the motivations right there. Even if FISA generally gives the government what it wants, it's still a process that the government appears to regard as a hassle to be eliminated.

I think the second reason is that google is a sophisticated enough company that they could perhaps infer things from the data request patterns that the requesting agencies would prefer secret.

</comment></comment></comment></comment></comment><comment><USER7> I think there needs to be an acknowledgement that the NSA, the FBI, and the government in general are not staffed by angels or robots, but by human beings, and that some of these human beings are criminals. The very fact that Snowden got all that data means that, regardless of whether or not he's a criminal or a whistleblower, _the humans in government_ cannot be trusted with this data. "The FBI" may have a need for this data but the humans in the FBI are too great a risk. I find it absurd that we are even having to have this conversation with an organization that has to deal with operational security.

<comment><USER8> Few men could be moral when offered the combination of unrestricted power over others, total secrecy, and lack of consequences for actions, that is so often the state of these agencies.

That's why we need their power to be limited and defined, as open as possible, and have legitimate avenues of redress for grievances. They are supposed to be public servants, not rogues.

</comment></comment><comment><USER9> I am always reminded of a quote from Arthur C. Clarke I was made aware of through Bill Joys "Why the future doesen't need us." [http://www.wired.com/wired/archive/8.04/joy.html](http://www.wired.com/wired/archive/8.04/joy.html) (Still a classic piece)

"Another idea is to erect a series of shields to defend against each of the dangerous technologies. The Strategic Defense Initiative, proposed by the Reagan administration, was an attempt to design such a shield against the threat of a nuclear attack from the Soviet Union. But as Arthur C. Clarke, who was privy to discussions about the project, observed: "Though it might be possible, at vast expense, to construct local defense systems that would 'only' let through a few percent of ballistic missiles, the much touted idea of a national umbrella was nonsense. Luis Alvarez, perhaps the greatest experimental physicist of this century, remarked to me that the advocates of such schemes were 'very bright guys with no common sense.'" Clarke continued: "Looking into my often cloudy crystal ball, I suspect that a total defense might indeed be possible in a century or so. But the technology involved would produce, as a by-product, weapons so terrible that no one would bother with anything as primitive as ballistic missiles.""

The threat of terrorism is greatly overplayed by various interest groups. I wonder if the accumulated effect of this attempt to oust terrorists is creating more harm than it's hindering.

More people die in a year on the US roads than have died from all terrorist attacks accumulated.

Some of those that died on the roads most probably chose a car instead of the tediousness that is airports.

If the US government truly where interested in hindering terrorists and saving lives, they wouldn't hide the fact that they are eavesdropping, they would make it obvious and transparent, and possible for each individual citizen to know what they know about you.

I just don't get their logic.

<comment><USER10> > More people die in a year on the US roads than have died from all terrorist > attacks accumulated.

I'm a little tired of this argument. "Only" 3000 people died in 9/11\. Yet look at the effect that 9/11 had on the world, versus 100 times that many automobile deaths.

As much as we'd like to think the only bad outcome of a terrorist attack is loss of life, that's not really the biggest outcome. It is the impact on society, like it or not.

At the end of the day, terrorism is primarily a tool to affect _political_ situations, their effect on public health situations is not really the point; it is that political damage that is worrying to governments.

<comment><USER11> 99.99% of the impact of 9/11 was due to the reaction, not the initial action.

Using the vast impact of 9/11 as an argument for further reaction _is getting everything backwards_.

We would have been vastly better off following 9/11 if the government had gone with a "keep calm and carry on" mentality rather than the "everybody panic and start invading things" reaction they actually had.

Terrorism is like a bee sting, and our reaction to terror attacks in the US is like an allergic reaction. The difference is that the US has control over its own immune system, and could choose not to be allergic if it wished.

That "political damage" is almost all _caused by_ the government, and can't be treated like an independent entity. The excessive impact of terrorism cannot be used to argue that the government needs to pay attention to terrorism, because it is that paying attention which _causes_ the excessive impact in the first place.

<comment><USER10> certainly if politicians felt it was feasible to allow terrorist attacks to occur without mass hysteria resulting, they'd be doing that? Perhaps if all the media in the country were state run, and the government simply suppressed reporting of incidents like that in Boston, they'd be able to contain the hysteria. But as it stands, we have a free press, and on 9/11 as well as in Boston, the government _did absolutely nothing_ in the _immediate_ sense to cause the resulting hysteria; the 24/7 media did that all by themselves. The government's overreaction to all of it was only after the populace collectively freaked out (which you can argue, they could have downplayed, but again the government is extremely politically reactive - which is likely better than them not giving a shit about political opinion); this because they were informed by the media, which itself is an institution resulting from what the populace wants, as the media is a for-profit, market driven entity.

<comment><USER12> > and on 9/11 as well as in Boston, the government did absolutely nothing in > the immediate sense to cause the resulting hysteria

I don't recall hysteria in Boston. There was more hysteria over the Moonites than bombings. But I don't think anyone has the bar so low to say that it's all good as long as gov't doesn't create the hysteria. The gov't should be able to dampen hysteria rather than swing it higher.

<comment><USER11> I'd say that attempting to shut down the _entire city_ while they searched for the surviving bomber would qualify as hysteria.

<comment><USER12> Was there anyone hysterical over that? They prevented him from easily fleeing. I mean they had a dead police officer and a shootout where multiple very loud bombs went off.

<comment><USER11> Worse crimes happen with some frequency yet the response is never nearly that large. Boston is the only time I have ever heard of an entire major American city being shut down on order to chase a single criminal. His crime was not exceptional, aside from the "terrorism" angle. Such a massive overreaction is hysteria.

<comment><USER12> Worse crimes than injuring 246 people and killing 5? The only reason it might not be "exception" is the number of heroes that prevented victims from bleeding out. Without immediate aid, nearly everyone that lost a limb would be on the deceased list.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> I can't help wondering if this is what prompted Google to adopt perfect forward secrecy in November 2011, and for Facebook to say last month it would follow suit, which I wrote about here: [http://news.cnet.com/8301-13578_3-57591179-38/data-meet- spie...](http://news.cnet.com/8301-13578_3-57591179-38/data-meet-spies-the- unfinished-state-of-web-crypto/)

Note I have no direct knowledge that this is the motivation, but it strikes me that PFS is a solution to a specific threat model of an eavesdropper having passive access to the network. I'd be eager to hear more from people who are more familiar with the issue than I am.

<comment><USER14> At the very least, if some judge in [rural county where Google has a datacenter] issues a subpoena for the keys necessary to decrypt a packet capture obtained by the Sheriff's Office in the course of investigating a local crime

A: They can credibly argue that they don't have that information, and it won't trigger an avalanche of copycat subpoenas.

B: The crypto key being sought by the subpoena is not one that would enable decryption of all Google, but rather one specific to the connection.

<comment><USER13> It's true that there are more Title III intercept orders targeting Internet providers and companies that come from states vs. the Feds. Note these stats do not include Foreign Intelligence Surveillance Act eavesdropping.

But because Google can be compelled to divulge the plaintext of, say, email messages or G+ posts if subject to a lawful court order, there's no need to perform a more difficult and expensive Title III wiretap. Real-time services like Hangouts are an exception, but it's still easier to serve a Title III order on Google than try to install a box on a rural ISP in Georgia and try to intercept and decode the stream.

Re: your point B, PFS would protect against passive attacks even if the master SSL key is known to Eve, and a subpoena would be insufficient legal process to obtain an ephemeral session key.

</comment></comment></comment><comment><USER15> "The government's view is that anything we can think of, we can compel you to do."

Which pretty much in a nutshell encapsulates what's wrong with the U.S. security state we've built. Terrorism is the trump card, the thing that compels/allows the state to take anything it needs. As one official put it recently "We're not trying to spy on you, we're trying to find those among you who are trying to kill you" And anything they do in order to prevent that from happening is fair game. It's a perpetual state of war.

Having said that, this is kind of a good news/bad news situation. The good news? Looks like most of the secret back door rumors, at least when it comes to TLS, were wrong. The bad news? It doesn't matter. If the government can try compel you to release the secret password for millions of users -- and then forbid you even to talk about it in the open -- then there truly is no limit to the monitoring and control they can exert. Whatever they get away with this year, there'll be more to come next year. Fake out https websites, play MITM games with data providers -- if you've got the keys, the world is your oyster.

Back around the turn of the century, I worked on several government projects. Aside from the usual deadwood workers, there are folks that are really eager to push the technology and create as much automation and storage as possible. This is because they like to hack, just like the rest of us. I used to say, jokingly, that the only reason we didn't live in a dystopian security state was that the government was too inept to actually create one.

Looks like the joke was on me. They're pretty fast learners. Make the national transaction and storage system totally secure, then lean on the in-country tech community to give you the keys to all of it. What a terrible way to destroy the national tech economy.

</comment><comment><USER16> It has been interesting, over the past some years, as a client just to observe the ongoing changes Google has been making to the nature of HTTPS connections to its properties.

Reporting like this appears[1], and -- coincidence or not -- those observations fit into place.

\----

[1] Whether regarding three letter acronyms or protocol weaknesses or whatnot

P.S. I'm not sure why the downvotes. TLS renegotiation weakness. Perfect forward security. Even earlier, nascent deployment of their own intermediate certificate authority -- which disappeared after some months, only to reappear again more recently (at least, in my Gmail connections). More recently, in addition to maintaining perfect forward security, now also replacing the underlying certificates every three weeks or so -- at least, as based upon the changing validity dates that are easier/quicker to compare in/via the browser interface.

I continue to "wonder" where Google comes down in all this... "security/authoritarianism" fracas. If there is a single "Google position". Regardless, they appear to be one of the most proactive parties, from a technical perspective. And politics aside, I continue to think that behind the scenes, there are a lot of people there behind the scenes who want to "do the right thing" and who work hard, within their responsibilities and areas of expertise, to "make it so".

<comment><USER13> I agree. The most obvious explanation (which may not be correct, of course) for these engineering changes is that Google is trying to armor its network against state-sponsored surveillance.

BTW it's every two weeks: [http://news.cnet.com/8301-13578_3-57591560-38/facebooks- outm...](http://news.cnet.com/8301-13578_3-57591560-38/facebooks-outmoded-web- crypto-opens-door-to-nsa-spying/) Langley added: "We would have totally eaten the cost and the speed years ago -- if we could have done it without worries." As an additional precaution, Langley said, Google usually rotates its RSA keys every two weeks.

</comment></comment><comment><USER17> The cypherpunks were right, but we've lost.

This is worse than key-escrow and clipper chips and all the other nonsense we fought in the past.

<comment><USER14> Yes, we've lost everything encrypted with single DES, PPTP, SSL less than 1024 (?) bit keys, Debian Etch, and so on.

But on the other hand: Snowden was successfully able to evade Boundless Informant and conduct a confidential conversation with Greenwald and Laura Poitras (certainly already an active surveillance target for her film of William Binney).

So the crypto wars are not yet lost.

<comment><USER13> And even 1024-bit SSL, unless you believe the NSA can't afford to devote <$1M per year per key to the effort:

[http://news.cnet.com/8301-13578_3-57591560-38/facebooks- outm...](http://news.cnet.com/8301-13578_3-57591560-38/facebooks-outmoded-web- crypto-opens-door-to-nsa-spying/) Eran Tromer, an assistant professor of computer science at Tel Aviv University who wrote his 2007 dissertation on custom code-breaking hardware, said it's now "feasible to build dedicated hardware devices that can break 1024-bit RSA keys at a cost of under $1 million per device." Each dedicated device would be able to break a 1,024-bit key in one year, he said.

<comment><USER18> Then use 2048. Each additional bit doubles the effort required.

<comment><USER14> No, asymmetric crypto keys don't work that way.

<comment><USER13> Yup. Brute-forcing a 1,024-bit key is about a thousand times as difficult as a 768-bit key, not 2^256 as hard.

In any case, major Internet companies have either moved to longer SSL keys or have announced plans to do so.

</comment></comment></comment></comment></comment></comment><comment><USER19> I wish cnet didn't write this article like they thought they were CNN or USA Today. What are we supposed to make of the phrase "master keys"? It doesn't seem like they are talking about root ca's. Is it really practical to try to collect and use all of the multitude of last link in the chain endpoint certificate keys? Those seem to change quite often and can be quite numerous. Demanding sub-ca or company wide middle chain keys would seem to be more manageable, but that would suggest that both they're really worried about people watching for signing chain anomalies since presumably they have at least a few root ca privates and that they are willing to sit in the middle rewriting traffic.

Perhaps this is a response to growing use of certificate pinning? Facebook apparently has joined google in using pins, and I was recently told that microsoft is enabling pinning as an option in EMET4. But if that was the issue, that would tend to suggest they had been previously accustomed to rewriting some of these providers traffic with unlikely root ca's, something which people have been keeping an eye out for and to my knowledge has never been caught in the wild.

</comment><comment><USER20> Didn't we already go through this in the mid/late 1990s?

(I'd personally have a really hard time giving them a polite multi-page legal letter saying "sorry, we are unable to comply, and we don't have to, due to x, y, z" \-- either a single "No." or perhaps "Nuts!", or trolling them with ASCII art or a return letter demanding NSA turn over their keys. Which is why I'm not a lawyer.)

</comment><comment><USER21> What if a company is storing its keys on a smartcard/cryptographic module that cannot export the key? I guess the FBI just asks for backdoor access to the company's servers, or maybe just follows the standard "we need to take your systems and shut down your business" approach?

<comment><USER22> So there's no disaster recovery for the company if their hardware breaks? There should be an offline backup thats N-way encrypted (secret sharing).

I've had to think about that case myself.

<comment><USER21> Do you commonly store all TLS traffic somewhere? I may have misunderstood the article, but I had thought this was about TLS secret keys, not keys used internally for secure storage.

</comment></comment></comment><comment><USER23> There has been some speculation that the NSA is focusing on bad RNGs now. I wonder what the quality (overall) are of the RNGs in the servers using these keys. I also am pretty curious how such a widely needed key is protected at the scale of tens to hundreds of thousands of devices.

</comment><comment><USER24> Any ideas why my submission of this same link (and title!) went dead even though it was posted two hours before this one and had attracted up votes?

[https://news.ycombinator.com/item?id=6096229](https://news.ycombinator.com/item?id=6096229)

</comment><comment><USER25> I'm willing to bet, the feds already have the master encryption keys and just want to make the companies give up the keys willingly so it sheds some of the blame onto them rather than all on government at once.

</comment><comment><USER26> > Facebook enabled encryption by default in 2012.

Kinda off-topic but this statement is false. Facebook HTTPS is not enabled by default, it's opt-in.

<comment><USER27> I tried in 3 browsers (2 which I haven't gone to Facebook before), and Facebook didn't load over HTTP. Facebook sent HTTP STS headers, too. I believe you are incorrect.

<comment><USER26> I _used_ to be correct. You are right now, though.

They started rolling out HTTPS for everyone on November, 2012 ([http://webcache.googleusercontent.com/search?q=cache:develop...](http://webcache.googleusercontent.com/search?q=cache:developers.facebook.com/blog/post/2012/11/14/platform- updates--operation-developer-love/))

But since I don't live in the US, it must have taken Facebook a long time to get to my country. I still remember telling all my friends to opt-in to HTTPS in 2012.

</comment></comment></comment><comment><USER28> Am I the only that's skeptical of any news story that is based off one anonymous person's statement?

</comment><comment><USER29> Plot twist: This is the _real_ reason Apple's developer site is down</comment>