Ask HN: Found an identical product to mine. Should I double down or refocus? - <AUTHOR> Long time lurker, first time poster here - I hope this is not a stupid question.
I have been working on a SaaS B2B MVP for a few months, however I am self-taught and it's taking some time. Initial feedback from potential customers has been very very encouraging, and am considering investing my savings into this, leaving my well paying job in finance and building a company around this product.
Unfortunately, I have recently discovered that this product exists already in the US, has raised a few million in financing and has 10,000 paying customers. I have tried their product, and it's very, very, very similar to what I am building, just generally better and more polished. It was a great feeling to see that my idea has market following, and equally crushing to know that someone is executing it way faster than me.
I am now uncertain on whether I should go ahead and risk being branded "The USCompanyProduct of Europe", a copycat, or worse, or if I should refocus on changing my product. I have great conviction in the current product and I think it addresses a big market, but I don't want to be seen as someone who "stole" the idea of a VC funded startup.
Is it even possible to focus on Europe whilst the US company (hopefully) focuses on the US (for now)? Am I being silly in worrying about the US company? Am I being silly in even considering building something which already exists in a different market (for now)?
Thanks! <comment><USER2> Congratulations! Your competitor just validated your idea for you. Now you know the idea is worth pursuing.

And if USCo has 10,000 paying customers, you know the market is big. Big enough that you can make a nice living there even if you aren't the dominant player.

The question is, can you become a significant player in Europe before USCo gets there? Local knowledge is a big edge for you; sometimes US companies find it difficult crossing cultures. That gives you time to get established, at least in your own country, and maybe in all of Europe.

To me, it sounds like you need outside money to scale quickly. If you can get it, definitely double down. If you can't, though... sooner or later USCo is going to show up in force. If you haven't grown by then, it's going to be difficult to get any more customers, and you'll probably slowly lose the customers you have, and your company will die. So if you can't get the funding to scale (or can't do it self-funded), then I'd consider refocusing.

</comment><comment><USER3> Competition happens. Sometimes it shows up early. Before being able to give a good answer to your questions, to be honest I think you are asking the wrong questions in this situation.

How have you been building something for months and only recently discovered an identical competitor with millions in funding and 10k in paying customers?

Surely you did research before starting and after starting have been keeping an eye on developments in the industry? Or no? Without understanding how you operate, it is hard to understand whether to recommend a double down or pivot. Thanks.

</comment><comment><USER4> Are there geographical differences in customer requirements that would allow you to differentiate your solution based on your local market knowledge?

The existence of the US company reduces your market risk. If you have a handle on technical execution, then technical risk is also low. That leaves sales and scaling. If you can grow quickly in the European market, you could even be acquired by the US company for customers rather than technology. Or vice- versa. VC funding is no guarantee of long-term success or healthy management teams.

<comment><AUTHOR> That's a good point, thank you for the explanation. I suspect customer requirements will be very, very similar, so don't think there is much scope for product differentiation.

I now really do think this will be a "sell fast and scale fast" play on our end, tech execution should not be an issue.

<comment><USER5> There is always some scope for product differentiation and a lot of scope for marketing differentiation. There are hundred(s) of different CRM products on the market and some differentiate themselves on features (specific features/workflows for particular industries) and some trumpet their lack of features as the "simple crm" or "lightweight crm".

Another example is that there are dozens of customer service software products across all price ranges and target business sizes.

</comment></comment></comment><comment><USER6> Gitlab and GitHub tackle same issues and have the same market. As someone said, if you are not violating copyright or patent law, you're good. Ideas are worthless, it's the execution part that matters... If you are better at it you'll win. If the market is big enough for both of you, you won't have problems. Imagine if McDonalds didn't start when they saw KFC was already into fast food business? Or burger king, or if we only had one pizza business. Competition pushes companies forward, having a monopoly is only good for the business, not the users.

</comment><comment><USER7> First of all, unless you're violating copyright or patent law, I wouldn't waste 2 seconds worrying about being seen as having "stolen" an "idea".

With that said, consider this: your product is not the sole basis for competition in the market. Your product is also not (hopefully) static and unchanging. And also, "the market" for your product can most likely be segmented in many ways, some of which would likely allow you to avoid head to head competition with this other company.

My recommendation is that you read the book _The Discipline of Market Leaders_ which does a good job of explaining the ideas behind different vectors of competition: product, price, operational efficiency, customer intimacy, etc.

 _Is it even possible to focus on Europe whilst the US company (hopefully) focuses on the US (for now)?_

Absolutely. In fact, if the other company focuses on the US to exclusion, you could focus on Europe, Asia, Africa, South America, etc. and "encircle" them. One of the big Japanese heavy equipment manufacturers famously did something like that to Caterpillar. For more on that, see:

[https://www.google.com/search?num=30&q=komatsu+encircle+cate...](https://www.google.com/search?num=30&q=komatsu+encircle+caterpillar&)

<comment> dnt404-1 I posted a question in the vein of "unless you're violating copyright or patent law".

How do you know if you are breaking copyright or patent law? How do you figure out the jungle of patents? or patents that are too general and thus similar?

If the competitor is using PHP, and I use Python is that a different product in the view of the "patent"?

<comment><USER7> _How do you know if you are breaking copyright or patent law?_

Well, copyright law is easy... if you haven't seen or copied the code of your competitor's product, there's no way you could be violating your copyright. Presumably you know if you've done that or not.

Patent is different, and I don't know that there's any easy answer to that one. But realistically speaking, _anything_ you do has the _potential_ to be a violation of someone's existing patent, so if you try for 100% upfront assurance that you're not violating any patents, you'd have to constrain yourself from ever building anything.

If you're really interested, you can search the various patent databases for patents owned by known competitors, but a lot of people avoid doing this because of the rules that make damages for "knowing patent infringement" stiffer than the ones for "accidental" (not a legal term, but you get the idea) patent infringement.

 _If the competitor is using PHP, and I use Python is that a different product in the view of the "patent"?_

IANAL, but as I understand it, the answer is "not necessarily". I think if possible patent violations are a big concern, you have to just bite the bullet, hire patent attorneys, have them research the existing body of patents, and give you an opinion. I've never done it, but I'm guessing that doing that is not cheap. :-(

</comment></comment></comment><comment><USER8> I've freelanced on projects before where this has happened. It's just validation of the idea.

In my, admittedly limited, experience, when a project carries on regardless, usually it means the project managers can use weaknesses of the new competitor to further improve their product.

In my one experience where they canned the project as someone had already beaten them, I remember noticing some time after that the competition were no longer operating.

On a side note, I'm working on some smaller scale SaaS side project pieces, I have no idea if I have any skills that could be of use but let me know if some assistance could help you out.

</comment><comment><USER9> Not a stupid question at all!

First, forget about being "branded", "labeled", "be seen as", etc. These things are totally irrelevant for your business success.

Now, I would keep building on your current product, without radical pivots. But would not keep building the exact same product. A company with 10,000 paying customers and millions in financing will most certainly alienate some segment of their customers. While this might be rational for them from a cost/benefit point of view, it might be rational for you to target that exact segment they are alienating and build a successful and very profitable bootstrapped business.

If you need some help figuring out what segments they are alienating and would be a better target for you, email me (email on my profile). I have good experience in this kind of strategic analysis.

Good luck!

</comment><comment><USER10> Double down. I can't think of any product category for which there's only space for one competitor on the market. There are plenty of competitors for pretty much every product out there. Why should your software have to be a unique snowflake?

I wouldn't care about "copycat" criticism either. Is Sainsbury's a copycat of Tesco (or vice versa)? Is Toyota a copycat of BMW?

Of course not. There are virtually limitless angles for differentiation, one of which is geographic. Do you know why there are so-called "European copycats" of US startups? Because those US startups can't focus on every market at once and focussing on the home market at first totally makes sense. Just as it then makes sense for other companies in these regional markets to try and fill that gap.

</comment><comment><USER11> You haven't mentioned this as an option - but food for thought. Have you considered some kind of partnership? Your competitor may have plans for Europe, in the future, and buying you out may save them hassle later on.

Furthermore, if you have something they don't have in terms of feature set or can demonstrate an ability to innovate they could make a job for you. Perhaps, 'Head of EU xxx'.

</comment><comment><USER12> One thing to keep in mind:

The problem with VC-funded competitors is that they can afford to lose money on every customer and live off investor money (for a while, anyway). You can't afford that.

Doesn't mean you shouldn't do it, especially if you can do it in market they're not actually doing anything about. Just something to keep in mind.

</comment><comment><USER13> Go for it! Competition drives innovation on all sides, and the world is big.</comment>


Ask HN: Why did you buy a home, and how did you finance it? - <AUTHOR> I read a lot of buy vs. rent articles, and people seem to have vastly different opinions and motivations on why to buy a home. If you bought a house or a condo, what was the motivation to do so? And how did you finance it? <comment><USER2> Why: No available home offered the amenities that I wanted. Home architecture seems to focus on increasingly elaborate variations on the 3 bedroom 2 bath conventional home at higher and higher densities.

How: After designing a home following "A Pattern language" by Christopher Alexander and taking a course in owner-built homes multiple times, I got a construction loan at an exorbitant rate from private money (brokered by a specialist in private money). Then, I served as my own general contractor using conventional project management methods. Once the house was finished, it was easy to get a conventional home mortgage.</comment>


FundaMine: Get Medium style annotations on your site - <AUTHOR> https://www.producthunt.com/tech/fundamine?ref=hn <comment><USER2> This is really cool stuff! Especially the tweetshots :)

<comment><AUTHOR> Thank you :)

</comment></comment><comment><USER3> wish you luck with your project guys!

<comment><AUTHOR> Thanks a lot! :) Would love to know your feedback on the product!</comment></comment>


Methane gas trapped underground in Siberia causes earth's surface to wobble - <AUTHOR> http://www.independent.co.uk/news/science/gas-siberia-underground-earth-bounce-climate-change-siberia-global-warming-a7153486.html <comment><USER2> Definitely not a good spot to have a smoke.

PS: The article reads 'And when a scientist digs their heel into the earth, the methane gas is audibly released through the tear in the grass.'. Which scientists? They are clearly hunters.</comment>


Yahoo Wishlist opens for name reservations - <AUTHOR> https://wishlist.yahoo.com/ more info on this can be read here http://yahoo.tumblr.com/post/55535441138/get-your-yahoo-username-wish-list-ready <comment><AUTHOR> More info on this can be read here [http://yahoo.tumblr.com/post/55535441138/get-your-yahoo- user...](http://yahoo.tumblr.com/post/55535441138/get-your-yahoo-username- wish-list-ready) . Right now the service has just started throwing a 999 error for some reason.</comment>


iOS: Universal Links - <AUTHOR> https://developer.apple.com/library/archive/documentation/General/Conceptual/AppSearch/UniversalLinks.html <comment><USER2> I stumbled on how universal links in iOS and Android cause accidental Zoom bombing. I reported it to Zoom but no response.

I had people in upper management always getting random emails from Zoom that guests are waiting for their meeting to start (waiting in the waiting room). But it's not any meeting they had scheduled or were expecting.

Randomly one day I wanted to check a FedEx tracking number from my iPhone. I tapped on it from Firefox and my Zoom app opened and dropped me into a random Zoom meeting. The meeting number matched my FedEx tracking number.

It seems that Zoom's meeting numbering scheme for meeting IDs is somewhat similar to FedEx tracking numbers. UPS uses alphanumeric, FedEx uses numbers. Somehow universal links in iOS and Android pick up FedEx tracking numbers in email and web pages as Zoom meeting IDs.</comment>


Lilium unveils five seater flying taxi after successful maiden flight - <AUTHOR> https://www.designboom.com/technology/lilium-flying-car-air-taxi-successful-maiden-flight-05-16-2019/ <comment><USER2> Might say 'first hover'.</comment>


Red-R: Visual programming for R - <AUTHOR> http://www.red-r.org/

<comment><USER2> Very interesting and ambitious project.

A few notes when testing it:

\- Uses PyQt/RPy and bundles it's own R instance, but the R instance is quite old and people don't usually like having two entire R installs (twice the maintenance of their favorite packages etc).

\- Why RPy and not RPy2?

\- Why not have a R shell that can play with the data objects created?

\- It's obviously very beta right now, some things just don't work like setting font colors on R graphs

Good start and great to see a working windows installer of something with so many dependencies. From experience I know that's half the battle :)

<comment><USER3> Thanks for the feedback.

\- the next version of Red-R will use RPy2. We are still benchmarking and improving RPy2 performance.

\- Red-R has a widget called R-Executor which is a R shell. Can execute any R code and interact with the R session.

Creating and testing installers is a major issue. I have tested in windows xp, vista and 7, both 32 and 64 bit. But as another comment mentioned, there are plenty of issues we haven't tested. Please report any errors to firstname.lastname@example.com and we will try to fix as quick as possible.

</comment></comment><comment><USER4> I was curious so tried an install but it gave me an error. Shall check the log later, but will mention that two others in this vein are Knime and Rapidminer. Both have R integrated now but appear rather similar to the cursory glance I took at the Red-R site.

Did note that Red-R uses Rpy so those benchmarks are worth noting. Often much room for error when dealing with blocks alone and its best to learn at least some of the language concurrently.</comment>


World's Central Bank: Crypto Could Risk Bank Runs - <AUTHOR> http://www.darkwebguide.net/worlds-central-bank-crypto-could-risk-bank-runs/ <comment><USER2> Here's the paragraph the title refers to:

"Arguably, the most significant and plausible financial stability risk of a general purpose CBDC is that it can facilitate a flight away from private financial institutions and markets towards the central bank. Faced with systemic financial stress, households and other agents in both advanced and emerging market economies tend to suddenly shift their deposits towards financial institutions perceived to be safer and/or into government securities. Of course, agents could always flee towards the central bank by holding more cash. But a CBDC could allow for "digital runs" towards the central bank with unprecedented speed and scale. Even in the presence of deposit insurance, the stability of retail funding could weaken because a risk-free CBDC provides a very safe alternative."

</comment><comment><USER3> The Bank for International Settlements (BIS) [1] is not the "world's central bank." It isn't even a central bank. It has no monopoly on any monetary base and does not act as a lender of last resort [2].

[1] [https://en.wikipedia.org/wiki/Bank_for_International_Settlem...](https://en.wikipedia.org/wiki/Bank_for_International_Settlements)

[2] [https://en.wikipedia.org/wiki/Central_bank](https://en.wikipedia.org/wiki/Central_bank)

<comment><USER4> I agree, and I'm flagging this post as this user has spammed the same website repeatedly all day.

</comment></comment><comment><USER5> Is this even a legit reporting site?

HN user only posts articles from that site:

[https://news.ycombinator.com/from?site=darkwebguide.net](https://news.ycombinator.com/from?site=darkwebguide.net)

[https://news.ycombinator.com/submitted?id=cech](https://news.ycombinator.com/submitted?id=cech)

Looks most likely a bot posting.

</comment><comment><USER6> The reason why Bitcoin will cause the mother of all bank runs is because Bitcoin will eat up banks' liquidity that is desperately needed to keep the leverage ratios in check. Rather simply, because banks take in deposits and then generate revenue, by extracting the value of your capital, by lending it out to other people at interest. This is the most common form of money creation in the economy (with other people focusing on T Bills, quantitative easing, etc) If people continue to dump dollars/fiat (which are only liquid if your bank doesn't screw up and over leverage themselves) for money that is always liquid (Bitcoin) then essentially the liquidity that banks rely on dries up, their leveraging goes up, and the slightest market hiccup causes an intra/inter-bank liquidity-failure cascade. [2]

Given that typical leverage ratios are ~3-5%[1] (or banks only have 1 dollar for ever 33 dollars they say they have) and that the total supply of M1 is ~4 Trillion [3], the balance they have available (5%*2e12=$200 billion) is hitting the first threshold of concern because Bitcoin's market cap is ~$150 billion and cryptocurrencies in total are $360 Billion[4] (though volume would be a better indication of flows). No wonder central banks are literally conspiring to smear Bitcoin[5] rather than admit their own incompetence. Once the Bitcoin/cryptocurrency market caps approach ~$800 billion (equivalent liquidity of M2 leverage) the sparks are really going to fly in liquidity problems with banks.

Will banks avoid this? My guess is no, because such a CBDC won't allow the squish that banks need to cook books or mask liquidity problems as "Crises of confidence" and the competitive forces demand higher and higher amounts of leverage and that the government has colluded with the banking industry to constantly socialize their losses, while the banking sector privatizes gains. For more reading check out, The End of Alchemy [7]

Which do you think is more likely Bitcoin is going to stop working or banks will under-engineer their financial safety factors and fail (like they've habitually done)? Hopefully you have your skin in the game your gut tells you is going to happen.

[1] [http://www.businessinsider.com/fdic-report-on-leverage- ratio...](http://www.businessinsider.com/fdic-report-on-leverage-ratio-names- deutsche-bank-as-riskiest-2016-9)

[2] [http://nakamotoinstitute.org/mempool/hyperbitcoinization/](http://nakamotoinstitute.org/mempool/hyperbitcoinization/)

[3] [https://fred.stlouisfed.org/series/M1](https://fred.stlouisfed.org/series/M1)

[4] [https://coinmarketcap.com](https://coinmarketcap.com)

[5] [https://cointelegraph.com/news/polish-central-bank- secretly-...](https://cointelegraph.com/news/polish-central-bank-secretly- funds-anti-crypto-youtube-propaganda-videos)

[6] [https://fred.stlouisfed.org/series/M2](https://fred.stlouisfed.org/series/M2)

[7] [https://www.goodreads.com/book/show/30231791-the-end-of- alch...](https://www.goodreads.com/book/show/30231791-the-end-of-alchemy)

</comment><comment><USER7> If the coin is run by the central bank then they could put up >50% of the mining capacity. Then if there was a run, just ignore transactions.

<comment><USER8> Why would anyone choose to hold a coin controlled by the central banks if it's the system created by the central banks they're trying to escape? The safest and most proven cryptocurrency is Bitcoin - and that's where the flight to safety would be.

<comment><USER7> If your chequing / savings bank uses the CBDC like they do currently with CB issued fiat, you may not have a choice.

If the central bank regulates that they must use it for bank to bank non-forex transfers, you may have even less of a choice.

Think of the CBDC as a replacement for the current fiat transfer mechanisms and less of a bitcoin decentralisation project.

On the other side, a CB backed currency does have it's advantages. Stability and security being the biggest (perceived).

<comment><USER8> We don't have a stable CB backed currency today though. The USD loses, at best, 2% of its value a year. That's not stable.

<comment><USER9> Bitcoin frequently changes in value by more than 2% every single day. Sometimes within the 15 minute confirmation window.

Price stability has very little to do with money supply and more to do with the wider economy.

</comment></comment></comment></comment></comment><comment><USER10> title: "World's Central Bank: Crypto Could Risk Bank Runs"

0 mention of "Bank Runs" in the article.

flagged.

<comment><USER2> It is a click-bait title, but the phrase "digital run" does appear on page 22 of the paper.

[https://www.bis.org/cpmi/publ/d174.pdf](https://www.bis.org/cpmi/publ/d174.pdf)

</comment></comment><comment><USER11> Anyone caught in a bank run only has themselves to blame. It's their responsibility to not deposit their money in an over-leveraged bank. Unfortunately due to FDIC insurance, consumers now spend more time researching the quality of the LCD monitors on the market, when deciding which one to buy, than the future financial solvency of banks, when deciding which one to trust their money to.

<comment><USER12> It is not an unfortunate fact -- civilization moves forward when we increase the number of things we can do without thinking.

FDIC, as the underwriter, has the power _not_ to insure a manifestly poorly- run bank. Thus, the FDIC mark is a defacto sign that a bank can be trusted by a consumer.

I would much rather have FDIC (or a system of robust private bank insurance) than need to vet each prospective bank's balance sheet, employees, and loans when choosing to open a personal checking account.

<comment><USER11> Being responsible for yourself doesn't mean you don't delegate. It means you have to stay on top of who your delegate is. FDIC means you simply tax others when you screw up. The insurance premium has no relationship with your risk profile.

Responding to below:

>>Successfully rescuing a bank from a run is not only a benefit to society as a whole but often makes a small net profit.

This is the free lunch fallacy used to justify involuntary income redistribution. If it were indeed profitable on average, the market would do the bailing out.

Bailing out the irresponsible prevents the evolutionary process of weeding out reckless and incompetent business models and behavioural patterns from working, while unfairly burdening those who are competent in their management of capital, which inhibits the expansion of their influence.

<comment><USER9> Successfully rescuing a bank from a run is not only a benefit to society as a whole but often makes a small net profit.</comment></comment></comment></comment>


Netflix Raises Price of Most Popular Plan by $1 per Month - <AUTHOR> https://finance.yahoo.com/news/netflix-said-raise-price-most-170000624.html <comment><USER2> I am not surprised that Netflix decided to raise the price by $1.00. The success is incredible; I will do the same as well.</comment>


Remembering Joe, a Quarter of a Century of Inspiration and Friendship - <AUTHOR> https://www.erlang-solutions.com/blog/remembering-joe-a-quarter-of-a-century-of-inspiration-and-friendship.html <comment><USER2> Watching Joe's talks on various topics (usually related to Erlang but also usually applicable to other programming languages) has definitely shown me some new perspectives and made me a much better problem solver.

On top of that he just seemed like a genuinely pleasant person. I hope he enjoyed his life as much as he seemed to. Rest in peace.

<comment><USER3> Joe somehow combined genius with a intellectual curiosity and a fantastic ability to explain and hold people's attention. On top of that, he was an incredibly pleasant person--down to Earth, funny, perceptive, genuinely kind. The whole package.

It's a heavy loss. I wish I had written him while I could have to tell him what a great presence he was...

Goodbye, Joe.

</comment></comment><comment><USER4> People say that it was the combination of people with different skills that made CS Lab special. For example, Joe used to say that the critical part of system design is to identify the "error kernel" that has to be correct and then make sure that some specific person (Magnus Fröberg? Per Hedeland?) is the one who writes all of that code. Some people just have a different knack and can do things that other people can't.

Great that Francesco has the special skill to capture the spirit of those times so well as a blogging ambassador to the rest of us now so many years in the future. I bet nobody was conscious that they needed this particular skill at the time.

<comment><USER5> Appreciate your kind words Luke.

</comment></comment><comment><USER6> Joe changed the way I think about software, and made me a better programmer through his talks and blog posts. He will be missed.

</comment><comment><USER3> That is a great tribute to Joe. Thank you.</comment>


Why Bitcoin Is Booming - <AUTHOR> https://www.wsj.com/articles/why-bitcoin-is-booming-1499638932# <comment><USER2> In my opinion, these subscription-only articles are not helpful to Hacker News community. This is what I learned from this one: Bitcoin is booming because it....</comment>


The zero-day exploit market is bad for security - <AUTHOR> http://www.schneier.com/blog/archives/2012/06/the_vulnerabili.html

<comment><USER2> First, it's actually not true at all that Schneier has "long argued that the process of finding vulnerabilities in software system increases overall security". For a good long chunk of time in the not-so-distant-past, he had exactly the opposite perspective. For instance, when the Code Red worm was released, Schneier blamed the team that found the vulnerability:

        We shouldn't lose sight of who is really to blame for this problem.
        It's not the system administrators who didn't install the patch in time,
        or the firewall and IDS vendors whose products didn't catch the problem.
        It's the authors of the worm and its variants, eEye for publicizing the
        vulnerability, and especially Microsoft for selling a product with this
        security problem.

Note the language: finding the _vulnerability_.

There's an insidious pattern among security pundits regarding disclosure. Disclosure tends to be A-O.K. when it's done by friends, or friends of friends. So, for instance, no vulnerability blessed by Elias Levy (Bugtraq) was ever going to be criticized, because Elias is the nicest guy and lots of people had met him and liked him. But when the scruffy-haired kids at eEye published advisories, look out! Schneier is far from the only person to turn the disclosure debate into a clique defense mechanism, but it's good to recognize that his ethics in this case are situational.

Second: while I (a) agree with Schneier's take on vulnerability markets and (b) have written about it in many places including here, I'm not sure what the point of harping on it is. There is nothing you can do about vulnerability markets except to compete with them. It is after all very easy for Schneier, who does not do vulnerability research, to suggest that there's something sleazy about taking money in exchange for vulnerabilities. But researchers rightly think there's something sleazy about the demand that they work for free. The researchers will win this argument.

"The whole point of disclosing security vulnerabilities is to put pressure on vendors to release more secure software". No. That's what we _want_ the point to be. But as adults, and, clearly, businesspeople, we should be able to evaluate the world for what it actually is. Vulnerability markets are a problem, but they're a problem created by insecure software, not by researchers. We're not going to solve the problem by moralizing.

<comment><USER3> > Note the language: finding the vulnerability.

You're probably referring to <http://www.schneier.com/crypto-gram-0108.html#1> where Schneier criticizes eEye for publishing (not finding) a vulnerability with potential for a large-scale worm outbreak while selling a product that protects against that vulnerability. The blame is for leaving everyone but their own customers out in the cold, not for finding the vulnerability. The blame for the flaw gets directed to MS, where it deserves.

This quote from The Register sheds some light on this:

> eEye makes several good security products for Windows and IIS, and has been > responsible for finding and aggressively publicizing a number of holes in > Microsoft products, especially IIS.

> But the business of searching for and publicizing security holes while at > the same time selling the solutions is a tricky and controversial business, > not unlike the model pursued by anti-virus companies. We note, for example, > that eEye has yet to publicize an IIS hole that its SecureIIS product won't > defeat. Their discoveries inevitably support the claim that SecureIIS is a > very wise investment.

(from [http://www.theregister.co.uk/2001/07/20/internet_survives_co...](http://www.theregister.co.uk/2001/07/20/internet_survives_code_red/))

IMHO the chide is well deserved. They could have handled that better.

<comment><USER2> eEye _discovered_ MS01-033 (the flaw later used by Code Red) and was thanked by Microsoft in their advisory for it. Schneier, in the very post we're responding to here, claims to stick up for publishing vulnerabilities; it was "the only way" to handle them.

But of course, Schneier didn't come to his current opinion easily; no, he detoured through a prolonged period of using his status in the industry to slander companies who handled the vulnerabilities they found with their own labor in ways he disapproved of.

The Register piece you cited doesn't even make logical sense. "Oh ho!", it trumpets. "I see eEye has yet to release a bug their own product doesn't defend against! Surely, if they were ethical, they would cripple their own product to give competing products a fighting chance!"

People who don't practice vulnerability research have a very had habit of incorrectly attributing vulnerabilities. _Vulnerability researchers don't create them._

<comment><USER4> _People who don't practice vulnerability research have a very had habit of incorrectly attributing vulnerabilities. Vulnerability researchers don't create them._

Historically true, but will it remain so?

Schneier's point is that the existence of vulnerability markets means that there are incentives for there to be "vulnerability researchers" who are selling the bugs that they themselves created.

It is the security version of, "I'm gonna code me up a minivan!"

<comment><USER2> The Venn diagram of vulnerability researchers and product developers has only a sliver of overlap. Most researchers are not professional developers.

No vulnerability that anyone knows about has ever been attributed to product sabotage.

If there exists an incentive to sabotage products on behalf of governments or organized crime, that incentive exists with or without formal vulnerability markets.

Markets allow vendors to participate and discover vulnerabilities. They are in that sense a uniquely bad setting for internal saboteurs to sell access to code; there is a non-negligible chance that the organization who ends up with your work will be able to "git blame" you.

I'm not a supporter of vulnerability markets, but this strikes me as a particularly dumb argument against them.

<comment><USER4> Chicken, meet egg. Egg meet chicken.

Historically economic incentives did not encourage the selling of vulnerabilities that you created. And we have no demonstrated history of the creation of vulnerabilities for sale. Not surprising with the lack of incentives, and not evidence that it won't happen in the future.

But disgruntled IT people do all sorts of remarkable stuff. Take the case of Terry Childs, who locked everyone else out of San Francisco's network. Or a friend of a friend of mine who took out his frustration at a previous company by translating a chunk of their code to Latin and then implementing his project in Latin. (Yes, there is a Perl module that lets you program in Latin. No, this is not recommended in production code...)

There are a lot of IT people. And some do stupid things. Or interesting things. For instance there is a persistent rumor that <http://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html> was not hypothetical, and that Thompson was actually observed using it in the wild. Really cool security hole. (And good luck doing a "git blame" for a bug that appears nowhere in your source code.)

But you're right that it is not the best argument against vulnerability markets. Given the quality of most company's code bases, there is no need to add security holes. It is easy and much safer to find the ones that are already there. However when you leak source code for private analysis, then don't report the bugs you find, the result is more 0-days and bugs not getting fixed. This makes us all less secure.

Of course with the increasing interest in compromising systems, this is happening regardless of whether or not there is a formal market for them. The present is insecure, and the future is guaranteed to be less so.

<comment><USER2> Vulnerability researchers in the 00's have not been particularly hindered by lack of access to source code. It turns out that when you actually start tooling up, having access only to compiled C code isn't much of an impediment.

</comment></comment></comment></comment></comment></comment></comment><comment><USER5> I thought I'd do one comment per subject. So, to take this apart (and bear in mind I'm referring to personal experience or the experience of people I know):

> Recently, there have been several articles about the new market in zero-day > exploits: new and unpatched computer vulnerabilities.

It's not a new market. Exploits have been bought and sold (as far as I'm aware) going back into the 90s. My visibility of the market ends there, but it may well go back further. Companies like ZDI, Immunity and Rapid 7 have been in this market for a long time (doing different things), but it shows that there has been a market for a while.

> This market is larger than most people realize, and it's becoming even > larger.

I suspect that the impression of the market becoming larger is due to more of the market being publicly visible, which in turn may generate more interest and growth, or may not.

> In fact, it took years for our industry to move from a norm of full- > disclosure -- announcing the vulnerability publicly and damn the > consequences -- to something called "responsible disclosure": giving the > software vendor a head start in fixing the vulnerability.

This is quite a shocking statement for me to see. The industry (if you want to call it that) didn't push for "responsible disclosure", the vendors did. "Responsible disclosure" was nothing more than a marketing statement to shift the blame from the origin of a software defect to the person disclosing it if they didn't toe the vendor line on waiting months or years for a fix and keeping shtum at the time.

> This is why the new market for vulnerabilities is so dangerous; it results > in vulnerabilities remaining secret and unpatched.

This assumes that software security is a zero sum game, which it isn't. Just because a bug exists and a zero day exploit exists, doesn't mean that you'll be exploited. A zero day exploit in VLC doesn't automatically result in compromising your system if your usage pattern for VLC doesn't intersect with the exploit pattern.

> No commercial vendors perform the level of code review that would be > necessary to detect, and prove mal-intent for, this kind of sabotage.

> And unlike the previous reward of notoriety and consulting gigs, it gives > software programmers within a company the incentive to deliberately create > vulnerabilities in the products they're working on -- and then secretly sell > them to some government agency.

> No commercial vendors perform the level of code review that would be > necessary to detect, and prove mal-intent for, this kind of sabotage.

This is utter FUD. Vendors like Microsoft routinely work with governments directly to provide secure products, while the governments in question have their own teams to spot vulnerabilities and develop their own bugs. They don't need a vendor programmer putting bugs in for them, it would massively damage the relationship if they were caught.

> With the rise of these new pressures to keep zero-day exploits secret, and > to sell them for exploitation, there will be even less incentive on software > vendors to ensure the security of their products.

Except for the fact that we have legislation and regulation at the end-user side that makes software security a requirement for a vendor, something we didn't have 20 years ago. Many larger vendors already have a fully integrated process for security management. Companies like Microsoft have even gone public with the Security Development Lifecycle.

I would make the counterpoint that the disclosure that the market exists makes responsible vendors even more determined to build more secure code. A vendor without a software security capability is no different whether or not there's a public market as the bugs will still exist and going from bug to exploit isn't necessarily hard when the vendor hasn't considered security. A vendor with a mature software security capability will build in layered defences to ensure that the cost of exploit development grows higher.

<comment><USER6> You write "It's not a new market".

Schnier writes "This is very different than in 2007, when researcher Charlie Miller wrote about his attempts to sell zero-day exploits; and a 2010 survey implied that there wasn't much money in selling zero days. The market has matured substantially in the past few years."

I believe Schnier's point is that it's now an active market where it's much easier for buyers and sellers to meet, not that this is the first time exploits were for sale.

To think that Schneier believes that there was no market would be to think that Schneier did not accept the reported prices listed in the linked-to PDF by Miller.

<comment><USER5> He uses the words new market to describe the thing four times in the article. It's very clear that to him it's a new market. Having said that his definition of new may be different to yours or mine. 5 years may still be new if you've been in an industry for several decades.

Immunity Canvas has been on sale since the early 2000s, same with Core Impact. A lot of their marketing went into releasing 0day exploits. Exploit trading is as old as the exploits themselves. The value of an exploit is based on it's utility and effectiveness. A remote code execution in Windows is worth a fortune because Microsoft's strategy has been specifically to increase the cost and effort required to develop a reliable exploit.

<comment><USER2> And of course, 0-day exploit trading isn't news to Schneier; in the early-to- mid '90s, many serious Unix vulnerabilities were traded _among vendors and admins_ on secret mailing lists.

Of course, those lists were the laughingstock of the hack scene, and posted to tfile BBS's right next to cDc zine issues. They made the list participants feel a little more special, though, and they did keep vulnerabilities from being disseminated... to the majority of system operators.

</comment></comment></comment></comment><comment><USER5> I hate it when Schneier talks about things he knows very little about, because he tends to be listened to and treated as an expert when he might not really know much. This is one of those cases. A lot of what he describes are clearly assumptions and it's hard to get facts, but because he hasn't described them as so, many people will accept them as a primary source because of who he is. I don't blame Schneier for this, but it's important to remember he's just a guy with a blog writing an article about his thoughts. He doesn't sell vulnerabilities, he's not active in the marketplace.

<comment><USER7> Are you disagreeing with his assertion that the 0day market creates an incentive for internal code sabotage?

I agree that that part is speculative, but I think his major point (as I read it) is that the monetization of exploits by third parties (bad guys, govts, etc) is predicated on the value of keeping the software exploitable, to the detriment of all but those on the high side of the informational disparity curve.

I agree with him that that is unfortunate, but it seems like business as usual to me, in every industry everywhere.

<comment><USER5> > Are you disagreeing with his assertion that the 0day market creates an > incentive for internal code sabotage?

No. I'm disagreeing with his speculation being stated as fact with nothing to back it up. This is something he does a lot. I realise he's not the most technical author, but a link would go a long way.

The monetization of exploits has been around for a long time, a lot longer than OWASP and longer than people had mature software security programmes. Whatever incentive there is, so far hasn't resulted in a public incident that I can clearly think of, so I would say that while the incentive may exist, the relationship damage between the governments in question buying an exploit of a deliberately introduced bug and getting caught doing so would be too high risk for the government in question to buy it. I admit that there may be more look in finding a private sector customer, or even some intermediary, but again, we're not aware of this ever happening, this market has existed for a long time and if it was a real incentive I would have expected something high profile by now.

I am happy to be proven wrong on this one, so if anyone has any examples please do call me out on this.

</comment></comment></comment><comment><USER8> > "security for the 1%." And it makes the rest of us less safe.

Actually it seems like the opposite. The chances that the government or other entity with a purchased exploit is going to hack you is very small. The targets there are the 1%.

If instead of being sold on the black market, the exploit is disclosed to the public. Worms can be written, your grandparent's unpatched computer could be taken down, and the overall impact on the average Joe will be much higher.

<comment><USER9> .. and the hole can be eventually fixed. Sorry but you'll have a hard time convincing me that full disclosure is the wrong way to go.

</comment></comment><comment><USER10> If he's right about the incentive for internal code sabotage, I wonder if this will strengthen the security perceptions of open source software. Particularly strongly curated open source software.

He somewhat alludes to this with his comment:

"No commercial vendors perform the level of code review that would be necessary to detect, and prove mal-intent for, this kind of sabotage."

<comment><USER11> Have a look at the Underhanded C contest[1] and see which of those entries (suitably scaled up, possibly spread over several commits by different people) would be likely to be spotted by OSS maintainers or contributors.

I'm not sure the 'all bugs are shallow...' applies to actively malicious contributions.

In some sense, proprietary software might be _more_ secure, exactly because it doesn't accept contributions from anyone, and can much more easily background- check the people who do work on it. I'm not sure how common OSS projects that don't accept contributions are, but I'm sure they exist.

[1] <http://underhanded.xcott.com/>

</comment></comment><comment><USER12> Why not sell zero-day exploits to security vendors? Working in network/information security, I don't know how often we're hit by a virus days before McAfee et al had definitions for them. While I'm all for disclosure and making the developers patch their code, it's really quite irritating how long it takes before AVs have caught up.

<comment><USER2> Easy: because vendors won't buy them.

<comment><USER13> Well then maybe they should. Vendors are complaining that they aren't getting disclosures for free anymore. maybe they need to start being the highest bidder, so that exploit hunters get paid.

</comment></comment></comment><comment><USER14> _...a disclosed vulnerability is one that -- at least in most cases -- is patched. And a patched vulnerability makes us all more secure.

This is why the new market for vulnerabilities is so dangerous; it results in vulnerabilities remaining secret and unpatched. That it's even more lucrative than the public vulnerabilities market means that more hackers will choose this path. And unlike the previous reward of notoriety and consulting gigs, it gives software programmers within a company the incentive to deliberately create vulnerabilities in the products they're working on -- and then secretly sell them to some government agency._

When market forces are working against your interests, it's the worst kind of news. For a business, it means bankruptcy. For a nation or empire, it means decline and dissolution.

</comment><comment><USER15> What is kinda hilariously terrifying about the legitimization and anonymous nature of selling 0days is that it provides a venue for creators of software that people rarely pay for and that have few contributors (free tweet or voip clients, say) to purposely build in mistakes, get traction and then sell the exploits.

</comment><comment><USER16> It would be a lot easier to agree that security researchers shouldn't be selling vulnerabilities to the highest bidder if, say, they were offered $250k to $1mm each from the vendors involved. Baring that, it's hard not to think this is mostly very wealthy companies bitching that researchers are declining to work for free to fix the companies' inability or lack of desire to write secure code.

It feels like the companies first tried to hold a bulwark and claim that vulnerabilities are worth nothing. Now that fb, google, and mozilla offer bug bounties, we're starting to establish a market price. Like the old joke apocryphally attributed to Churchill:

       "Churchill: "Madam, would you sleep with me for five million pounds?"

       Socialite: "My goodness, Mr. Churchill... Well, I suppose... we would
       have to discuss terms, of course... "

       Churchill: "Would you sleep with me for five pounds?"

       Socialite: "Mr. Churchill, what kind of woman do you think I am?!"

       Churchill: "Madam, we've already established that. Now we are haggling
       about the price"</comment>


Show HN: Fromlatest.io – An opinionated Dockerfile linter - <AUTHOR> https://fromlatest.io <comment><AUTHOR> We just released a Dockerfile linter at [https://fromlatest.io](https://fromlatest.io). If you paste a Dockerfile in, it will lint it and show you some best practices and feedback on your Dockerfile. Feedback welcome!</comment>


4chan's /soc/: Test Your Traction. - <AUTHOR> https://boards.4chan.org/soc/res/11341655

<comment><USER2> Not that this sort of thing should really be encouraged, but this type of verbose/laboured parody/troll/nonsense would probably be more appreciated by /prog/.

<comment><AUTHOR> How was it any of the things you mentioned? You are trolling ME now.</comment></comment>


Blockchain – The revolution that hasn't quite happened - dynamite-ready https://www.bbc.co.uk/news/business-51281233 <comment><AUTHOR> Like most other articles on this topic, this article too fails to make a strong case for an application where blockchain would really be useful.</comment>


The crowdfunding bubble of 2013 - <AUTHOR> http://www.cringely.com/2012/06/05/the-crowdfunding-bubble-of-2013/

<comment><USER2> I agree with alot of what Cringely is implying, because current VC funding at _every level_ (including YC) has been very cliquey. You simply _can not_ with a straight face say that the only insanely great technology business ideas come out of four places (Harvard, MIT, Stanford, Berkeley) and basically nowhere else. For example, two cities that have the highest concentrations of baccalaureate degree holders in the US are Seattle, WA and Raleigh, NC. Now pop quiz: Name a YCombinator company in either of those cities.

Oh, I know, it doesn't really mean anything. I just find it interesting that two otherwise academically talented areas are burgeoning hotbeds of neither startups nor even talent for said startups. I guess we can further break down what _kind_ of degrees the citizens of these two Rodney Dangerfield of academic and tech hubs have. I mean, for all we know, they could be in philosophy or advanced basket weaving or, worse, __gasp __, English.

But the rise of crowdfunding couldn't come at a better time, in my opinion. It's high time the silo gets drained for a more swampy, organic, bubbling ooze sort of scattershot approach of crowdfunding. It'll be spendy, it'll be risky, it'll make outside observers think it's all _at best_ a big gamble and at worst a big liberal boondoggle that will further weaken our country like everything else democrats come up with that dilutes and distributes power into the hands of "the masses".

Further, it'll make professional VCs cringe when successes actually start coming out of these crowdsourced ventures, as they talk of "amateur hour" money crowding out their world of term sheets and share dilution calculations over tapas in Menlo off Sand Hill Rd.

Whatever is going to happen, things like kickstarter and indiegogo and JOBS et al. are going to shake the status quo up big time. In my neohippie indie-and- proud idealistic head, it's not only exciting, it's necessary.

<comment><USER3> "I just find it interesting that two otherwise academically talented areas are burgeoning hotbeds of neither startups nor even talent for said startups."

FWIW, there are half a dozen YC startups in Seattle that are doing well. And there are dozens more that have people who came from Seattle.

Also, companies are opening up engineering offices in Seattle pretty rapidly (Twitter, most recently, but also Facebook, Hulu, Google, Jawbone, Zynga, etc).

The reason you don't seem more startup activity in Seattle is that many are lured down to the Valley.

To one of your other points-- UW graduated 23 comp-sci students this year.

<comment><USER4> Only 23?! UVic across the gulf graduates more than that.

<comment><USER5> UW has historically capped its CS program at what seems like an absurdly low number of students. When I was there, they accepted only 80 students per year (40 more for computer engineering). The stated reason for this is to keep the student/faculty ratio low, and to maintain a sense of community in the department.

Also, I know quite a lot of UW CS graduates who headed down to the valley to do startups. While they could have conceivably found the talent to do it in Seattle, they perceived the environment as better down South. It's not that students from other schools don't do startups, it's just that they go to the Bay area in order to do them, and the culture perpetuates itself.

</comment></comment></comment></comment><comment><USER6> As someone actively trying to help shape the crowdfunding space, I personally think it really is the next big thing and not just a bubble. As Tim Brown puts it, big design used to be big companies making solutions for little people, then little companies making solutions, now it's people making solutions for themselves.

I don't think crowdfunding will be another venture-infused flash in the pan. As long as the regulatory framework and the tools continue to make proress for the end user, then the potential for crowdfunding to become a huge engine for disruption is unknown. We have to make sure we treat crowdfunding with the patience and respect of a new idea. It's not going anywhere, especially as people start to see the power of leveraging it in yet unseen ways.

<comment><USER7> There will be tremendous recoil though when layman VC's realize their investments are so very risky. It won't be so much a bubble, because the real artificial force here is the monopoly marketplace of shares being on wallstreet. It is a positive move, but all economic shifts like this will produce excessive momentum with some recoil effects.

It is good in the long haul though. The easier it is for normal people to own stake in business the sooner we can close the tremendous gaps in socioeconomic status between the elites and common folk.

<comment><USER8> > There will be tremendous recoil though when layman VC's realize their > investments are so very risky.

Do you really think laymen _understand_ risk, though? Casinos make billions of dollars each year off people who can't correctly model risk even after risking, and losing, large sums of money. Of course, VCs wouldn't put their money on black at the Roulette table--but VCs (and stock-brokers, and investment-bankers) model risk for a living, whereas the median layman micro- investor will have given their one or two investments maybe five cumulative minutes of thought in their lifetime.

To put it another way: there's a sucker born every minute--but no-one stays a sucker for very long, once they've been burned. This means that, when there is friction to investment, the suckers will slowly drain from the pool until only the sharks are left; whereas, when fiction is low, each sucker leaving the game will be replaced by a new sucker joining in, fresh and naive. When 90% of your revenue comes from people who have never invested in anything before, you can build your business model on the mob's irrational overconfidence in your ability to deliver.

<comment><USER2> So, the masses are stupid, VCs are smart. Stock brokers and investment bankers are the ones who _truly_ caused every recession and the Great Depression. Oh, sure, poor and dumb people getting mortgages wasn't a very good idea, I totally agree. But it would've been a drop in the bucket compared to tarring and gzipping said mortgages into 30:1-leveraged bundles (laughably underwritten by AIG) created by Wall St. They _knew_ they were unsustainable, but pressed on, some not even taking the "five cumulative minutes" of thought to what they were investing in or how much of not-their-own-money they were putting into it, until it burst.

So, you're saying we should _still_ keep all the money in that silo? That we should keep letting "risk modelers" who have exacerbated every speculative bubble since the Great Depression keep investing in Color and Groupon and boo.com and flooz because the masses are too stupid to do it for themselves?

Well, okay. But, I disagree.

<comment><USER8> Er, no, no I'm not; you're reading moralizing from what was supposed to be a purely phenomenological description.

Personally, I think it's _okay_ that regular people risk ( _extremely_ small, in relative terms) money and, more often than not (in the long term), lose it. It's _okay_ to build businesses that only profit because of human irrationality. It's their money to spend (or lose) as they please--and, in aggregate, as businesses, it's our profit. Just so long as nothing's coercing anyone into doing this--like, say, a gambling addiction--we have no reason to feel bad for allowing people to bet on us and then, potentially, flopping.

</comment></comment></comment></comment></comment><comment><USER9> Worse than even the expected "Cringely level" of analysis. Bubbles (despite appearances) aren't pushed by inputs; they're pulled by expectation of outputs. That's why, roughly, the pace of VC dollar inputs is a lagged dependent variable on recent M&A and IPO volumes.

(If you don't believe me check out the MoneyTree historicals at [https://www.pwcmoneytree.com/MTPublic/ns/nav.jsp?page=histor...](https://www.pwcmoneytree.com/MTPublic/ns/nav.jsp?page=historical) Notice that the deal volume roughly matches a 1-2 quarter lag on the stock market's performance.)

Crowdfunding has _no exit mechanism_. There will be no bubble because there's no "pull" effect.

The critique "derefr" provides below is more apt. There will be fraudsters who will try to prey on the fact that nobody can afford to do much diligence on a $1000 investment.

<comment><USER10> There are expectations that these projects actually deliver their stated goals, including the 'rewards', when they receive the requested funding.

It's still a new experiment overall that can be innovated upon, but it's not immune to a crash in people willing to throw their money at random pet projects.

Even if the reality is that most projects deliver, having enough bad apples or outright frauds can be enough to hurt progress.

I read a recent piece talking about how many game projects seem to terribly underestimate the amount of money required to fund a game. Enough people who are terrible at estimating their financial needs can also hurt everyone. It's not like this problem can't be solved, but it shouldn't be ignored if you want crowdfunding to succeed.

</comment></comment><comment><USER11> I see that the bubble bubble of 2012 continues unabated.

<comment><USER12> We were talking about bubbles in 2011 too <http://news.ycombinator.com/item?id=2231352> .

</comment></comment><comment><USER13> I'm not really sure what is being said here.

<comment><USER14> I actually wondered the same thing so I came to the comments to try to figure it out. I think it was up voted due to the fact the word bubble was in the title.

</comment></comment><comment><USER15> Crowdfunding would have worked for many of the best startups. Dropbox absolutely could have been funded by HN/Digg/Reddit users.

</comment><comment><USER16> I think the term 'bubble' is sensationalist. The author is trying to say that crowdfunding is not a panacea and can do things the normal paradigm wouldn't support, but at one point people may do something stupid and back projects that shouldn't be backed. There's no reason to believe that the community can't select for the best projects (I'd say there's a bubble when every garbage project gets funded)

<comment><USER17> There is going to be a bubble: it is a natural, necessary stage that comes with enthusiastically exploring a new space. (If there isn't a bubble, some people aren't trying hard enough.)

People are going to be ripped off. People are going to lose a lot of money in ventures that aren't rip-offs, but still just fail, because that's the nature of new things. (Because the expectations will be so high, and the investor understanding of the downside risk so low, lots of these people will loudly complain and allege wrongdoing where there is none.) Some bad actors will enrich themselves.

And yet, crowdfunding will still be a rich new source of innovation and wealth, even with the growing/learning pains.

</comment></comment><comment><USER18> When the housing bubble started, everyone was like, "We just had a bubble. This can't be another one. Nobody sees TWO bubbles in one lifetime."

But then it became clear that there had, indeed, been two bubbles.

Now everyone sees bubbles everywhere.

</comment><comment><USER19> "and for real entrepreneurs there are some things even worse than failure, like boredom or just being like everyone else."

Zing...</comment>


[New data] Kanye West's fleeting impact on TIDAL - <AUTHOR> https://www.surveymonkey.com/business/intelligence/kanye-wests-tidal-flop/ <comment><USER2> So this data was apparently gathered by Survey Monkey Intelligence, which claims to be able to gather in-depth metrics about your competitors' apps, like weekly active users and session time.

How can Survey Monkey possibly know this information? Do they have an analogue of Alexa Toolbar spying on users to get data?</comment>


WebP – A new image format for the Web - <AUTHOR> https://developers.google.com/speed/webp/?csw=1 <comment><USER2> I sense another flame war. Unless there is new data from a new set of image quality/compression tests, I would urge people to just look up the old threads instead of rehashing the arguments again.

Note: Although YouTube announced a switch, Google+ has long been using WebP to serve up images in the stream with substantial savings, so the usage of it by Google on their services is not new.

</comment><comment> workhere-io Things to consider: WebP browser support is currently terrible ([http://caniuse.com/webp](http://caniuse.com/webp)), and it seems the solution to make WebP images display in non-supported browsers is through the help of a rather large JS file ([http://webpjs.appspot.com/](http://webpjs.appspot.com/)).

<comment><USER3> Actually it is Google Pagespeed where the magic happens. You serve jpg, gif, png, pcx^H^H^H and then your nginx/Apache converts them to webp for you, on the fly, cached. If the person requesting your page runs chrome they get webp.

So that means everyone else gets a slow image format? Yes, but you have saved bandwidth and your pages have loaded quickly for ~50% of your users.

I don't think webp is really a source image format, more something that is browser and Pagespeed specific. Try it, you will be impressed.

<comment><USER4> There is a big problem with auto-converting images, and its with HTTP caching.

Consider this: I have page.html, with an  tag. If I'm using Chrome and I request logo.jpg PageSpeed/the web server detects that I support WebP via the Accept header. It sends WebP image for the URL logo.jpg.

And that's a problem. Because the content for logo.jpg is no longer dependent entirely on the URL. It the URL, and the values of the User-Agent or the Accept headers, which determine the response.

This is called content negotiation and it utterly nullifies shared HTTP caching. This is bad because shared HTTP caching can be a huge performance win.

The right way to serve WebP images is to change the URL. The application logic that generates the HTML should detect that browser support webp and rewrite the image tag accordingly. In other words, page.html should include a  tag.

This means that browsers that support webp get it, browsers that only support JPEG get it, and shared HTTP caches can be used without polluting the cache.

Sadly, PageSpeed and other technologies like it aren't currently smart enough to re-write the URL in the base HTML page. As always, technology that "automatically fixes problem X" rarely is the best solution.

<comment><USER5> Isn't the caching issue trivially fixable with "Vary: Accept" header? (No idea whenever PageSpeed adds that or not.) Content negotiation shouldn't interfere with caching, if both are done properly.

Also, if you respond with different HTML, you still get the caching issue, because you may mistakenly serve cached HTML linking to WebP images to non- capable client. So the cache should still consider Vary and Pragma headers (or it's broken).

The only thing I don't really fancy about "/cute/kitten.jpg" serving a WebP image is ".jpg" part. If content-type may vary, the "extension" part of the "filename" should be generic ("/cute/kitten.image") or missing ("/cute/kitten"). That's for saving pics, when URLs transform into filenames.

<comment><USER4> 2 things:

First, "Vary:Accept" and Vary:User-Agent effectively nullifies shared caches. Because instead of saving 1 copy of a response for a URL, and serving it to all requests, a shared cache has to save 1 copy per unique combination of URL and the Accept request header and/or the User-Agent header sent by the browser.

Browsers send wildly different Accept header values, not only across browser vendors but across versions as well. And the User-Agent string has insane variation since OS, CPU, language, and more can be included.

The net result is that all these unique request header values fragment the shared cache so much that you don't get any cache hits. The shared cache has been nullified.

Second, if the HTML is a static file, yes you have the same problem. However, in the modern age of web publishing, the HTML is almost always being dynamically generated by some application logic/CMS/something. This means that it is rarely is ever cached or marked as cachable to shared caches.

More about Vary and shared caching: [http://zoompf.com/blog/2010/03/the-big- performance-improveme...](http://zoompf.com/blog/2010/03/the-big-performance- improvement-in-ie9-no-one-is-talking-about)

[http://blogs.msdn.com/b/ieinternals/archive/2009/06/17/vary-...](http://blogs.msdn.com/b/ieinternals/archive/2009/06/17/vary- header-prevents-caching-in-ie.aspx?Redirected=true)

</comment></comment></comment></comment></comment><comment><USER6> Interestingly enough, WebP is a great format to use if you don't want users saving your images.

More than once I've right-clicked an image to save it to disk, only later to discover I have no program on my computer which can open or view it, except for Chrome! No thumbnails, no previews, no Photoshop, nothing. (I know there are plug-ins, if I really wanted to.)

</comment><comment><USER7> If anyone is interested, the discussion on implementing WebP support in Firefox has recently moved from Bugzilla ([https://bugzilla.mozilla.org/show_bug.cgi?id=856375](https://bugzilla.mozilla.org/show_bug.cgi?id=856375)) to mozilla.dev.media ([https://groups.google.com/forum/#!topic/mozilla.dev.media/qM...](https://groups.google.com/forum/#!topic/mozilla.dev.media/qMtHAyn2clI)).

<comment><USER8> Found this comment interesting... > What about a deal: if Google implements APNG, we implement WebP ? ;)

</comment></comment><comment><USER9> Transparency on lossy compressed images is something that I really crave.

<comment><USER10> WebP's support for animation is also great. Like animated GIFs, but in true colour with VP8 compression _and_ optional transparency!

<comment> TD-Linux It's not really VP8 compression, as in the full video codec. But it's neat regardless.

</comment></comment></comment><comment><USER11> Why is this up here? Anything changed about WebP recently? Any news I might have missed?

</comment><comment><USER12> [http://caniuse.com/webp](http://caniuse.com/webp) Webp support in other browsers than Chrome is virtually nonexistent. However if a big chunk of your audience browses from Chrome, you could serve Webp today. It can be done in a browser neutral manner by looking at the Accept header.

<comment><USER13> For IE you can serve JPEG-XR [http://caniuse.com/jpegxr](http://caniuse.com/jpegxr) and for Safari JPEG 2000.

</comment></comment><comment><USER14> We've been using WebP in production in our chrome-only web application for over a year now, works well but not sure why it's on the front page of HN!

Google announcement about YouTube supporting it?

[http://www.engadget.com/2014/03/23/google-webp-youtube- thumb...](http://www.engadget.com/2014/03/23/google-webp-youtube-thumbnails)

</comment><comment><USER15> this seems rather prescient:

[https://xkcd.com/927/](https://xkcd.com/927/)

<comment><USER8> How is that prescient? Standards can get replaced when something better comes along. The question is whether WebP will be compelling enough to overtake what came before. It looks promising at first glance.

If anyone at a browser development company is reading this, vector image formats are more in need of disruption than raster image formats, SVG is versatile but it's bulky, a more compact vector image format would be welcome, especially in the age of responsive design.

That said, some technology standards can stick around far beyond what they should. MP3 is a classic example, there are far better music formats than MP3 (you'd be hard pressed to find a worse one that's still supported), but because of the sheer volume of music in that format, the 'good enough' status, and the limited abilities of some of the hardware players to handle better formats, we're stuck with it. This isn't something we should seek to encourage, but it does happen.

<comment><USER16> > a more compact vector image format would be welcome

SWF. It's more than just a vector image format, but it is far better than SVG in terms of both filesize and resources required to render. Too bad for the "Flash hater's stigma" and the direction Adobe took their player after the acquistion... although there are now a few other alternatives including Mozilla's Shumway.

<comment><USER17> SWF as an image format also requires a client side runtime be installed. A runtime with spotty cross platform performance and a poor security track record at that. The distaste for Flash is pretty well justified, I'll take the larger and slower SVGs over Flash any day.

<comment><USER16> There's this: [http://mozilla.github.io/shumway/](http://mozilla.github.io/shumway/)

Also, since Adobe removed the restrictions on creating programs to display Flash content a few years ago, there's nothing stopping others from writing a minimal, image-only SWF plugin.</comment></comment></comment></comment></comment>


Ask HN: Is telekinesis inside the international space station feasible? [idea] - <AUTHOR>

The idea is to implement telekinesis inside the international space station by adding vents on the walls to push objects around based on directions from mind readers worn by the astronauts. Is this feasible? <comment><USER2> Both current stage of development and accuracy of "mind reading" technology and the price of equipment used on ISS would prevent this from happening. That, combined with high cost of failure (possible damage to life-supporting systems), make me believe that such a system would be infeasible.

On the other hand, NASA experimented with volleyball-sized self-propelled semi-autonomous robots, called Personal Satellite Assistants. More on the program here, but no info about what happened to the prototypes: [http://psa.arc.nasa.gov/](http://psa.arc.nasa.gov/)

<comment><USER3> As far as cost factor, I imagine James Randi's circle might be of assistance:

[http://web.randi.org/the-million-dollar- challenge.html](http://web.randi.org/the-million-dollar-challenge.html)</comment></comment>


How Nike Capitulated to Amazon After Years of Resistance - <AUTHOR> https://www.wsj.com/articles/how-nike-resisted-amazons-dominance-for-years-and-finally-capitulated-1498662435 <comment><AUTHOR> [https://outline.com/pd3YTK](https://outline.com/pd3YTK)</comment>


Zynga might file for IPO as early as Wednesday - <AUTHOR> http://venturebeat.com/2011/06/28/zynga-ipo-wall-street-journal/

<comment><USER2> At a proposed valuation of $15+bn I really really hope they are doing something like $1bn in revenue or this is just not going to end well.

</comment><comment><USER3> This just seems surreal to me. It's nothing more but a gut feeling, but isn't it likely there will come a time when the novelty of playing "social games" wears off and people just leave them en masse? I've gone through this years ago, before there even was Facebook. But literally hundreds of millions of casual gamers still have to learn this lesson. And they just might.

<comment><USER4> I'm guessing you're a neophile (as most people on HN are): you tried casual games _because_ there was some sort of novelty to them, then quit. Most people don't share this motivation; they find it hard to understand why, say, you would sell your perfectly-fine year-old phone to buy the newer one. This isn't how social games have managed to attract the userbase they currently hold.

Instead, people play casual games for the same reason they, e.g., smoke cigarettes: because their friends are doing it—so there's social proof that it's something interesting to try—but once you as an individual try it, you're hooked into a "fun loop" [[http://www.eldergame.com/2011/06/world-vs-game- emergent-game...](http://www.eldergame.com/2011/06/world-vs-game-emergent- gameplay-and-the-fun-loop/)] of instant, small rewards, that invokes peer- pressure to rejoin whenever you try to leave (taking a smoke break at work with friends :: being sent an double-incentivized bale of hay.) This isn't really something that can "wear off" over time; rather, it becomes an increasingly _strong_ bond as you begin to base parts of your life around it (smoking when you go out for a walk after dinner :: checking on your virtual pets on your break between classes.)</comment></comment>


Why Didn't Plan 9 Succeed? - <AUTHOR> What prevented Plan 9 from Bell Labs from becoming a widely-used operating system? Does it have a major flaw? <comment><USER2> Tons of reasons, really.

Unix was originally given away, but then it got wildly popular and Bell Labs regretted they couldn't capture much of the value it created. When Plan 9 came around, they were much, much stricter about it, and so it was much less accessible.

Unix was possibly the first widely-available operating system with its particular ethos - frustratingly simple and hackable. Plan 9 has much the same ethos, but wound up having to compete with Unix, which had a decades-long head-start.

Possibly the biggest problem Plan 9 has, though, is how well-designed it is. Unix was probably well-designed in its early days, but by the early 90s when Plan 9 came around, it'd been hacked up and contorted to all sorts of use- cases the designers never intended, like networking and graphical terminals. Plan 9 re-unified all these use-cases into a small set of elegant, orthogonal features... but it made anything outside those features even more awkward and difficult. For example, a web-browser doesn't make much sense in a Plan 9 world - you'd just run remote applications and have them display locally, rather than having a special local application that all remote applications must run inside. But it's hard to do anything in the modern world without a web-browser, so Plan 9 isn't a practical alternative for most people.

<comment><USER3> This. Do you currently use Plan 9 for your operating system at home?

By not making the operating system abstractions similar to other existing operating systems all popular applications had to be rewritten for Plan 9. There was a network effect of existing apps that worked well enough and developers were already familiar with the existing systems which made it hard for users to switch over.Plan 9 was a better operating system technically but it didn't have the utility that existing operating systems already provided to users.

Non-computer people would also probably just use whatever OS the computer they bought had. Using something outside of MacOS or Windows was not normal for a non-technical person in the mid 90s.

</comment></comment><comment><USER4> The same people built Plan 9 and learned from their experience building Unix to make an operating system that was like Unix, only more so.

But Unix was originally built under the Bell System monopoly and they were restricted from selling it, and it wasn't developed as an actual product anyway (Ken was basically disobeying his manager in developing it) so they gave it away free, with source code, to whoever requested it (mostly universities. Early distributions on magtape reportedly included the note "Love, from Ken.")

Plan 9 was post-monopoly, so it was a "PRODUCT" and marketed with various licensing restrictions and you had to pay for it (with maybe a by-seat pricing? Can't remember.) And by then it was competing with all kinds of OFFICIAL Unix variants with real support offered, plus MS-DOS and the first Windows, and also Apple was in the mix.

People didn't get the point of an operating system that made good use of a network that most people didn't use at that time. And compute servers? What is that all about? It just didn't resonate with anybody at the time, although it provided all the abstractions we tend to care about more now.

<comment><USER5> Sounds a lot like the PS/2.

IBM developed the PC with an open architecture and it took off.

IBM realized it didn't control things enough, so it released the PS/2 with the microchannel bus and OS/2 and...

nobody cared.

</comment></comment><comment><USER6> I have tinkered with Plan 9 on several occasions. I keep coming back to it because I appreciate its technical and architectural elegance. It is somewhat like yet another example of the VHS vs Betamax situation.

Some things that stop me from using it more widely are:

The GUI: I just can't relate to the aesthetics nor the heavy dependence on the mouse. Granted that I have used it from the shell, but then I also miss out on some niceties and conveniences.

The security mechanism: I understand the intent of the security mechanisms, but have have difficulty in understanding it sufficiently to configure a cluster of Plan 9 systems using some old HP ePCs.

Device drivers: This is a common problem with most non-mainstream OSes. There are too many incompatible devices out there and thus device drivers are either written for some limited common denominator, e.g. VGA and its variants, or simply for what the developers had on hand. We only need to look at the Linux kernel to see that a substantial part of its development is devoted to supporting the widest variety of devices.

I think that the Plan 9 experiment could be re-positioned as an IoT OS. That is an area that I am very interested in.

BTW: check out Russ Cox's implementation of Plan 9 using the vx32 sandboxing on Linux and OS X ([https://swtch.com/9vx](https://swtch.com/9vx)).

</comment><comment><USER7> I think it was the restrictive licenses. They made certain that no company could invest in it, give it a good GUI.

Most companies can't survive/thrive the way that RedHat did. Not saying it can't ever work, but it definitely was a factor in keeping plan9 from getting popular.

</comment><comment><USER8> Many would argue Plan 9 did succeed -- as a research OS. Many of its ideas and concepts trickled into other OSes.

There are many reasons for it's failure to gain traction as a general purpose OS, but one major one is that it was never marketed as a general use OS. It was always in the realm of a research OS. So that all but "doomed" it from the start.

</comment><comment><USER9> A lot of concepts that originated in plan 9 have been widely adopted by modern unix-like operating systems, most notably the /proc file system, so in a certain sense I would say that it was a successful project.

Lack of applications, drivers and compelling use cases ultimately caused the project itself to fail. It was also competing against operating systems with huge commercial backing that already had deeply entrenched market share.

<comment><USER10> procfs predates Plan 9: [http://lucasvr.gobolinux.org/etc/Killian84-Procfs- USENIX.pdf](http://lucasvr.gobolinux.org/etc/Killian84-Procfs-USENIX.pdf)

<comment><USER11> Meh. That is research from the same group that was thinking about the problems with Unix and could be argued is an early expression of some of the ideas that became plan9. Seems a little like saying Linux predates Linux since the terminal code that Linus based his first release on existed before he trashed his FS.</comment></comment></comment>


Apple's abacus emoji is wrong - <AUTHOR> https://www.theverge.com/tldr/2019/5/26/18639006/apple-abacus-emoji-wrong-historically-inaccurate-math <comment><USER2> I don't know whether Apple picked this variant on purpose, but it _is_ culturally neutral. It doesn't make the Chinese complain "why did they pick a Japanese abacus" and vice versa.

I also somewhat fear Unicode 17 or thereabouts will allow users to pick the variant they want.</comment>


Sacked IT guy annihilates 23 of his ex-employer's AWS servers - <AUTHOR> https://www.mirror.co.uk/news/uk-news/computer-geek-nicknamed-speedy-accused-13893130 <comment><USER2> Source: [https://www.mirror.co.uk/news/uk-news/computer-geek- nickname...](https://www.mirror.co.uk/news/uk-news/computer-geek-nicknamed- speedy-accused-13893130)

Sophos is just re-hashing the DM report. I hate blog spam.

<comment><USER3> Ok, we changed to that from [http://nakedsecurity.sophos.com/2019/03/22/sacked-it-guy- ann...](http://nakedsecurity.sophos.com/2019/03/22/sacked-it-guy- annihilates-23-of-his-ex-employers-aws-servers/), in keeping with the guidelines' call for original sources ([https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)).

</comment></comment><comment><USER4> AWS have services to back up your data. Anything that a human or automation can touch can be obliterated instantly. This includes your live, staging and disaster recovery sites.

Important data must be backed up where humans and automation can't remove it. A vaulting policy / data retention policy is also useful.

<comment><USER5> does aws actually have that. everythings an API on aws right? so couldnt someone just send the delete backup command to whatever backup service aws has?

<comment><USER6> You send your backups to another AWS account, that has distinct access credentials another responsible party holds (separation of duties), and policies that inhibit the backup source account from deleting or modifying the backups in the target account.

You should practice restores. You should be able to stand your infra back up from anywhere with an Internet connection.

<comment><USER7> Data protection account is a good idea, but if your main IT person is malicious before such an account gets implemented it won't matter.

<comment><USER6> Trust but verify. Having a third party audit and provide findings (if you're not technically capable as an owner) is cheaper than going out of business.

</comment></comment></comment></comment></comment><comment><USER8> No 2FA? Totally Incompetent.

<comment><USER9> He just used his account ¯\\_(ツ)\\_/¯</comment></comment>


Google Alerts go real-time with pubsubhubbub - <AUTHOR> http://www.louisgray.com/live/2009/08/google-alerts-gets-pubsubhubbub-and.html

<comment><USER2> when I tried Google alerts (asking it for references to my name), it would alert me to pages published (by me, which is how I am sure when they were published) months ago, so the signal was drowned in noise.</comment>


The Fall of Pancho Villa (a metaphoric warning for cowboy hackers...) - <AUTHOR> http://www.exile.ru/2006-June-29/celaya_machismo_vs_overlapping_fields_of_fire.html

<comment><AUTHOR> The most interesting lesson of this story is the purpose of reserves. I feel like ---especially here at YC news--- the attitude is always "charge full strength ahead! Work 80 hours a week and just release something as soon as possible!"

The problem with this tactic is that when you need reserves to seize some unforeseen opportunity, you don't have any. For a startup, "reserves" could be something as simple as extra cash, employees not already committed to an 80 hour crunch, or your own health and morale.

</comment><comment><USER2> "That's a real un-Mexican thing to do, accusing yourself like that."

What a moron... the whole piece is full of nonsense like this.

<comment><AUTHOR> It's a joke. Come on: War Nerd? It's his writing character. But that doesn't change the substance of the essay.</comment></comment>


Microsoft open-sources PowerShell and extends it to Linux - <AUTHOR> http://venturebeat.com/2016/08/18/microsoft-open-sources-powershell-and-extends-it-to-linux/ <comment><USER2> [https://news.ycombinator.com/item?id=12313179](https://news.ycombinator.com/item?id=12313179)

</comment><comment><USER3> Maybe PowerShell will finally get some traction :)</comment>


How to Make a Quick Buck - <AUTHOR> http://jacquesmattheij.com/how-to-make-a-quick-buck/ <comment><USER2> "Getting a fresh pair of eyes" is a great time-tested way to get ahead in solving a problem you and your team is stuck on.

What's underappreciated, is becoming those fresh pair of eyes yourselves from time to time, to help others with ideas they can readily use. It hones own skills too.</comment>


Rnp: An OpenPGP Library in C++ - <AUTHOR> https://www.rnpgp.com/ <comment><USER2> Can we stop with PGP please? It has served its purpose.

<comment><USER3> Any good alternatives?

<comment><USER4> Standard S/MIME for e-mail, minisign for signing software, standard ASICE for encrypted containers

<comment><USER5> Never heard of ASCIE, I assume you're referring to [https://en.wikipedia.org/wiki/Associated_Signature_Container...](https://en.wikipedia.org/wiki/Associated_Signature_Containers#ASiC_Extended_\(ASiC-E\))

<comment><USER4> Indeed. It's an EU standard, [http://www.etsi.org/deliver/etsi_en/319100_319199/31916201/0...](http://www.etsi.org/deliver/etsi_en/319100_319199/31916201/01.01.01_60/en_31916201v010101p.pdf)

</comment></comment></comment></comment></comment><comment><USER6> Why C++? Why not Rust? maybe already exists. Would make a lot more sense.

<comment><USER7> [https://sequoia-pgp.org/](https://sequoia-pgp.org/)</comment></comment>