C/C++ facts we learned before going ahead with CLion - <AUTHOR> http://blog.jetbrains.com/clion/2015/07/infographics-cpp-facts-before-clion/ <comment><USER2> Also, if 39% of all developers work on Windows, and 36% of windows developers work on Visual C++ compiler (sic!), it means that 14% of all developers use Visual C++ compiler. This is higher than 12% of "other" compilers overall, but, paradoxically, Visual C++ is supposedly somewhere inside that category.

How does that work?

<comment><USER3> Listing GCC usage essentially at parity with Visual C++ on Windows (34% vs 36%) is also _ridiculous_.

<comment><USER4> I know the Pidgin project used to build their windows version on Linux using GCC and setting the make target.

You get a constantly up to date compiler (because of the system package management) and you don't need a MS license for your buildbot. It's a win win.

</comment></comment></comment><comment><USER5> I was surprised of the amount of Linux devs using C++ compared to the number of Windows devs (given the desktop marketshare). Also the fact that finance was leading sector using C++ - and by such a high margin - was unexpected to me.

<comment><USER6> I'm guessing that it's the finance industry itself which accounts for a high Linux usage, since they mostly need C++ for server-side use.

Another surprising number was that Windows users use GCC almost as often as Visual Studio. GCC on Windows is kind of a PITA, and the VS toolchain is really pretty good. Maybe people go with GCC because they need proper C99/C11 support.

</comment></comment><comment><USER7> I hadn't expected the dominance of Java in the "programmers per language"; I should have, but didn't. I also hadn't expected the disparity between Python and Ruby numbers.

I'm looking forward to digging into this further; it's a really useful and interesting dataset!

<comment><USER8> > useful and interesting dataset

I think the usefulness is limited by the fact that they haven't explained how they gathered this data. At first glance, the data looks to have some specific quirks (44% Linux users, overwhelmingly in the Finance industry) – you'd have to wonder it that's due to how the survey was conducted.

<comment><USER9> There are a couple of resources listed in the end. So we've gathered the information from reddit surveys, stackoverflow, our own surveys (with more than 5000 respondents), job ads, various language popularity indexes like Tiobe.

</comment></comment></comment><comment><USER10> I really doubt #10, there is no way that they number of people using gcc and the number of people using VSC++ are even close. The only time I've seen someone use gcc on windows is to test some cross compiler errors.

<comment><USER11> It does seem odd. Then again, don't underestimate the amount of people developing for embedded devices on windows - which is often done with a gcc toolchain supplied by the chip or rtos vendor.

</comment></comment><comment><USER12> To be honest i'm surprised with the adoption of C++11, i know the toolchain supports C++11 since some time but still i can imagine there's lots of legacy code using C++03 or older.

<comment><USER13> C++11 compiler will compile C++03 code just fine, AFAIK.

<comment><USER14> There were a handful of breaking changes in C++11, but nothing that takes any meaningful amount of time to resolve. IME the only source of porting pain is libraries which conditionally use C++11 features where the C++03 and C++11 versions aren't semantically equivalent.

</comment></comment></comment><comment><USER15> Semi-OT: i would love to see a Go IDE from Jetbrains

</comment><comment><USER2> C11 is C++ version? "Embedded" is C++ version?

<comment><USER16> C11 is not C++. That's not what JetBrains is saying, so I'm not sure what the nitpick is about.

The webpage is clearly about C/C++ ... that's the title of page ... in other words... "C Language" _and_ "C++ Language".

Both languages were included in their surveys and market research.

<comment><USER17> I really wish people would stop lumping C and C++ together. They are two separate language that have a common lineage, but neither is a subset of the other. The people who write C well do not generally write C++ well, and vice versa. It's a pretty different development community between the two languages. Bjarne Stroustrup, also thinks that treating the two language as if they were one is kind of silly.

Saying "C/C++" is like saying "ML/Haskell".

<comment><USER18> They are separate languages, but it is definitely not like saying ML/Haskell. Most C code can be converted in C++ without too much work. In fact, that is what GCC did:

[https://lwn.net/Articles/542457/](https://lwn.net/Articles/542457/)

You cannot easily do that with a multi-million SLOC ML project.

<comment><USER2> > Most C code can be converted in C++

That is bad, and is ripe to create a lot of errors.

C programmer who tries to write C code in C++ has the worst problem ever, IMO: he doesn't know that he's wrong. Everything compiles, everything works, and he goes home happy after a productive day of laying mines for future maintainers.

<comment><USER19> This is an opinion that I see a lot and it's very overstated IMO. If you write good C code, I'm perfectly happy to see it in C++.

In fact, you could _almost_ say it's a relief, largely because it tends to be impossible to write any overly-clever template-inspired madness that will be hard to understand and drag down compile times for a small benefit.

Additionally, when it comes time to optimize code (assuming this block is worth optimizing, and already is using the optimal algorithm), the C code tends to be closer to what you want to optimize than the C++ code. With the C++ code, you typically have to spend more time removing abstractions before you can start actually tuning it.

That said, while bad code in either is bad (obviously), someone could probably make the argument that bad C++ code is easier to fix than bad C code. I might be able to be convinced of this.</comment></comment></comment></comment></comment></comment>


Going to America: A Ponzi scheme that works - <AUTHOR> http://www.economist.com/world/unitedstates/displayStory.cfm?story_id=15108634 <comment><AUTHOR> Just to add some rationale.. this is probably the coolest Economist article I've read in the last few months. It highlights some of the greatest aspects of brand America and why opening the immigration floodgates would be no bad thing.

I think encouraging a policy of significantly increasing US immigration to people unlikely to cause a drain on the public system should override more selective policies like the "startup visa," as further general immigration can only continue to help America's cause.

<comment><USER2> I disagree that this article highlights "why opening the immigration floodgates would be no bad thing." The article strongly supports immigration, which is to be expected from the economist, but I'd say it expresses no opinion on unlimited immigration, other than to mention that "No rich country allows unlimited immigration".

I find it frustrating that a country that admits 1.2 million immigrants a year is so often accused of being "anti-immigrant" because it does not adopt the unique policy of unlimited immigration.

I'm also a little surprised to see the economist describing immigration as a ponzi scheme, even if they do call it one that works. Ponzi schemes always appear to work for the first few iterations.

<comment><USER3> > I find it frustrating that a country that admits 1.2 million immigrants a > year is so often accused of being "anti-immigrant"

The USA _is_ anti-immigrant, not because it doesn't open the floodgates, but because it has zero organized system with which to import foreign talent that is needed domestically. You have policies to allow existing immigrants to sponsor family members, and a myriad of other methods by which people _that the country has no dire need for_ get in, while talented people demanded by local industries are locked out.

In this way the US is far, far, far behind every other developed western nation.

<comment><USER4> Or, depending on your viewpoint, the US is far, far, far ahead of every other developed western nation. What makes it right for skilled people to get into a country more easily than unskilled?

<comment><USER5> This seems really obvious, but I'll bite. Maybe this is some sort of socratic exercise.

>"What makes it right for skilled people to get into a country more easily than unskilled?"

Prudence. Theoretically, skilled immigrants can create a positive economic externality. Through enterprise and innovation, they can add more value to the national economy than what they consume. Current US residents benefit from skilled immigration along with the immigrant. Since the immigrants may not have had an opportunity to produce this value in their home country, the whole world may experience a net benefit as well.

On the other hand, the act of importing unskilled immigrants is unlikely to generate such positive externalities. To the extent they depend on public welfare or bring with them social problems associated with poverty, unskilled immigrants may even function as a negative externality on our society. It is unlikely that an unskilled worker will generate much more value than what is necessary for subsistence.

The average wealth of a society correlates highly with how pleasant it is to live there. As an experiment, I suggest the author spend two weeks living in the impoverished southeast side of Washington DC along the green metro line. If he survives, I then suggest he spend two weeks living on the well-to-do west side along the orange line. At the conclusion of the experiment, the author should report to us which lifestyle he prefers. It is likely that this experiment will have shaken the author's expressed egalitarianism.

To some extent, we are choosing between these two societies when we frame our immigration policies.

<comment><USER2> I think you've misinterpreted what shrughes meant by "right". I agree with a lot of what you've written, but you'd be refuting someone who said "what makes it _smart_ ", not "what makes it _right_ ".

Keep in mind when shrughes wrote "what makes it right", he was responding to someone who called the USA "anti-immigrant" because it doesn't prefer highly educated and skilled immigrants over low skilled, low educated immigrants. I find that argument strange too - it's a basis for claiming the US is kinda dumb about immigration, but taking 1.2 million immigrants a year that most other nations don't really want is definitely not "anti-immigrant", it's immensely pro-immigrant.

</comment></comment></comment></comment></comment></comment><comment><USER6> Random fact - Canada and Australia both have higher foreign born proportions - [http://www.statcan.gc.ca/daily- quotidien/071204/dq071204a-en...](http://www.statcan.gc.ca/daily- quotidien/071204/dq071204a-eng.htm). The article seems to phrase things specifically to not mention them.

<comment><USER7> Neither Canada nor Australia have as much population as Mexico _City_. The article author could be forgiven for overlooking them.

Edit: actually, it appears that the official figure for the Mexico City metro is 21M; I'd thought it was over 30M. Still true for Australia, though. :)

<comment><USER6> It still weakens the author's thesis, and the paragraph talking about the comparison to other major countries doesn't read like he overlooked them, more like he deliberately omitted them.

EDIT: I actually read the whole article now, and he actually mentions Canada and Australia as threats to the US near the end.

</comment></comment></comment><comment><USER8> The best extended treatment, still, 170 years later, is Tocqueville's _Democracy in America_.

<comment><USER9> While I'm sure I can look that up on wikipedia and get some idea as to what that article is, can you give some examples as to why?

The economist article did a good job of showing that an open and tolerant America is good at getting people to come to the US and eventually blend in. It was also very relevant to the America of today, and suggested that despite some of the bad sides of America that are often amplified in the foreign press, because people have to work they're more likely to blend in.

From what I read on wikipedia the 170 text does a very good job of explaining the nature of democracy in the US, and makes a number of predictions that pan out regarding party politics, but in your view is it still relevant for the America of the 21st century?

I guess the angle I'm tacking from is the cultural aspects of integration versus what imo appears to be a treatise just about democracy (albeit what appears to be a classic).

<comment><USER8> It's several hundred pages and packed with insight – my copy probably has five or ten thousand words of my marginal notes in it – so it's a bit hard to summarize in this little box.

Basically, it describes how the American society and political system arose, and how they function. It analyses all of these seeming contradictions between freedom and dogmatic moralizing, etc. I think it's probably the best book I've read about how popular government operates, and how it differs from exclusive elite government.

Also, many of the differences Tocqueville finds between European and American society are still relevant today. If you want to know how the conditions described in this Economist article arose, and how these various features interact – what the "character" of (even contemporary) America is – in a deep way, I can't think of a better book.

</comment></comment></comment><comment><USER10> If I were to migrate somewhere, I'd migrate to an emerging country rather than one currently being looted by massive funneling of currency towards finance industry insiders, HMOs, and defense contractors. The Economist can act as cheerleader all it wants, but the US debt has risen to dangerous levels.

</comment><comment><USER11> Great article, stupid title. They don't explain why immigration is a ponzi scheme "that works".

</comment><comment><USER12> When is the country full? The US is arguably overpopulated by 100 million. It is not possible to be an environmentalist and favor continued high immigration rates.

All this talk about importing "talent" is highly disingenuous. The bulk of current immigration is low skill and puts pressure on low-end wages, and many government services budgets.

The history of immigration in America is a handful of waves interspersed by much longer periods of assimilation with close to zero immigration. The current wave, beginning in 1968, is absolutely unprecedented in volume and length.

<comment><AUTHOR> How is the US "full?" Its population density is through the floor compared to almost every EU country and Japan. Further, it has a significant amount of natural resources and spare capacity right now.

By your yardstick, the UK should be considered to be positive heaving, yet immigrants currently make up a majority of the population increase. I'm not going to complain - it keeps my house value up :-)

<comment><USER12> > it keeps my house value up

On a regular working man's salary my grandfather could rent a house on a pristine, practically undeveloped beach for a month a summer a short drive from a major east coast city. You are arguing it's a good thing that population growth has made this no longer possible.

<comment><AUTHOR> _on a pristine, practically undeveloped beach_

In your grandfather's time - let's assume 50 years ago - living in such a place wouldn't even be comparable to now. Most likely no convenient place to buy groceries, poor communications, poor amenities generally. The value of that land is significantly improved now - not just because of evil moneygrabbing property owners like myself, but because it's significant better to live in remote places thanks to _modern technology_ , so it's under heavier demand.

I could argue that in your grandfather's time, you could have bought land at bargain rates in Orlando or Las Vegas whereas now the prices suck.. but it's not comparing two compatible realities.

<comment><USER13> I disagree. People populate areas and the technology follows them, not the other way around.

One example of this is a place my family has vacationed since I was an infant: Crosslake, MN. Crosslake started as a small, sleepy fishing town with gorgeous views, nice people, lots of fish, and lots of wilderness--basically heaven for a Minnesotan. Because it was heaven, people started moving there in droves and drove the property prices to absolutely absurd levels. It went from a place where your grandfather might own a little fishing cabin, to a place littered with multi-million dollar estates that have $250,000+ boats parked in front of them.

This had nothing to do with technology. Only recently (within the last decade or so) has the town started getting "modern". This didn't prevent people from flocking there.

<comment><USER14> I think the relationship is more symbiotic. The technology that enables more remote living includes : better cars, roads, communications, food storage. While none of this probably appealed to your grandfather, it does appeal to today's families. In addition, you can overlay two trends : a trend toward environmentalism and 'enjoying nature' and a trend towards increasing amounts of leisure time. Even the expensive boats you talk about are part of the scenario. Boats that are reliable, easy to use and run, and built primarily for pleasure are a relatively recent invention. Because of the boats, the lakes are more enjoyable, hence more people want to enjoy. They have more time, more money and it's easier for them to do so - and they probably would rather now spend the money on a pleasure boat and holiday cottage than on other forms of consumption, simply because that's the current trend of what you do with spare time and money.

And don't forget that other technological trend : the camera. Ever since a photo could show the beauty of a natural place, the visitors followed. Arguably it was the photos of Yosemite that sparked the initial nationwide interest in visiting such a place. I could theorise that this same trend has worked it's way through into every beautiful piece of wilderness - many people will visit a place simply because they've seen a picture of it. Some of those visitors will choose to stay as residents.

So my theory is that because of the technology and the demographic trends, people populate areas that were once considered remote, and it was increasing awareness of the beauty of remote places that drove the visits in the first place.

</comment></comment></comment></comment></comment></comment><comment><USER15> "[america ranking low in tolerance] is a mistake. Some religious countries are indeed intolerant, but America is not one of them"

this seems to be a good ecnomist article, but its filled with propagada.

america ranks below for tolerance not because of religious reasons, but because its a police state where the people have no means of contesting acts and policies of some obscure gov branchs.

right now im on the verge of moving to there, but im scared as shit of the random people dispearing for ties with terrorism. Fair its still a small number, and they even might be terrorists, and more importantly its no one you know. But that there are cases, that are.

<comment><USER8> > [ _this article is_ ] _filled with propagada._ [sic] [... _America is_ ] _a > police state._

Give me a break. People in America have all kinds of "means of contesting acts and policies." There are problems with the justice system, as anywhere, but the courts and the political system are more accessible in America than anywhere I know.

<comment><USER15> You know very few places.

but i agree that i got the most difficult, and extreme, example of the dozen i could have used.

<comment><USER16> And where are _you_ from?

As far as I know, America invented the modern incarnation of a country with "means of contesting acts and policies of...govt."

The fact that America's faults are bandied about for all the world to discuss, dispute and analyze just goes to show how good of a government it is. It's like an open source version of government.

<comment><USER17> I was born in the USA and currently work here. I am fully aware of what the Constitution says and how it has been subverted.

For example consider the 4th amendment protecting us from unreasonable search and seizure. As [http://www.aclu.org/national-security_technology-and- liberty...](http://www.aclu.org/national-security_technology-and-liberty/are- you-living-constitution-free-zone) points out, 2/3 of the country lives within areas where the border patrol both can _and sometimes does_ periodically set up spots where they randomly stop and search whoever they want. In pursuit of the "war on drugs" courts have come to accept that if your belongings are directly sued that you personally have no standing to contest the lawsuit, and _your_ protections against unreasonable seizure is null and void. Telecom companies at the request of the Bush government made virtually everything tappable with no oversight. This activity has continued, and telecom companies have by special act of Congress (the current President voted ye on this) been given immunity for their violation of our privacy.

We are not an extreme police state. But we are well on our way. As a random example, in the last several years at every job I have worked at I was unable to enter or leave my place of employment without a security badge. Just 30 years ago this kind of widespread use of pervasive security systems was considered unthinkable in this country, and people were _proud_ of it.

<comment><USER15> Exactly. And You talk about the future but you also forget that in the recent california past decent people had to put "armed response" signs on their backyards.</comment></comment></comment></comment></comment></comment>


Tech Startups Come Up with Some Creative Definitions for 'Profitable' - <AUTHOR> http://www.bloomberg.com/news/articles/2016-05-16/tech-startups-come-up-with-some-creative-definitions-for-profitable <comment><USER4> GAAP or go home.

There are Generally Accepted Accounting Principles. Lots of startups whine that GAAP accounting doesn't represent their coolness, disruption, clicks, and general greatness. In hindsight, the GAAP numbers usually mean more than the vaporware numbers used for PR purposes.

If you go public, you have to show GAAP numbers in your financial statements. While private, you can sell to "sophisticated investors". These are like "whales" in the gambling industry; it means they can afford to lose money, not that they have a clue.

Most of the trouble comes not from companies that need a long period to do R&D or build up manufacturing capacity, like Space-X. It comes from companies that are losing money by buying market share, hoping that, in the end, they achieve a monopoly position and can make it back. Like Uber.

Funny accounting anecdote of the past: remember AOL disks, given out in vast quantities for free? AOL treated those as a _capital expense_ and depreciated them. AOL was losing money for most of a decade while showing numbers that indicated profitability.

<comment><USER5> GAAP can be deceptive. Take Amazon for example which hasn't reported much profits, probably less than $2bn over 20 years, but is now worth $331bn.

<comment><USER6> Why does that make GAAP deceptive?

<comment><USER5> It makes the company look like they are doing poorly when they are not recording GAAP profits but are increasing things like their user base and intellectual capital which are not reflected in the GAAP profits and losses. Say you start from nothing and get a million users paying you $10 each for some info service and you spend $10m in advertising to get there which you expense. That will show, roughly speaking, a GAAP profit of zero but your user base of 1m people paying $10 will be worth ~100m ($100/paying user) so you really will be wealthier by nearer $100m than $0.

Basically change in intrinsic value of the business is often a more useful measure than GAAP profits (or EBITA or all the other stuff). It's what counts to a business owner. GAAP profits are what the government forces you to declare so they can charge corporation tax on them and smart CEOs like Bezos will often try to keep the GAAP profits down so as to pay less tax while maximising the intrinsic value of the business which is what makes you rich.

</comment></comment></comment></comment><comment><USER7> This goes under the name of "Unit Economics" and is reasonable for small startups to use. It's VERY hard for a potentially high growth startup to cover their overhead costs. (If they were already cash flow positive, most likely they wouldn't be talking much to VCs anyway)

Companies go through stages:

1 - "Can we build something"

2 - "Will anyone pay for it?"

3 - "Can we turn a profit on each unit?"

4 - "Can we grow profitably and eventually cover our fixed costs?"

Generally you want to know #3 before tossing bags and bags of money at a company, but it's ok for startups to ask for money without having it answered. It's also ok for companies to ask for money without having covered their fixed costs yet.

To oversimplify...

Let's say my fixed costs are $10mm. Let's say each delivery I make turns a profit of a dollar, and each customer uses me for 20 deliveries over the course of 4 years. (Lifetime value of $20, which I get $5 per year) Let's say that it costs me $10 to acquire a company. (Customer acquisition cost)

Then in year 1 I'm $5 behind on each customer, but by year 4 I'm $10 ahead.

If I'm reasonably confident of these #s, then it pays for me to get as much investment money as possible to invest in customer acquisition. From a current cash flow (and potntialy from GAAP [0] earnings too) perspective I am losing money, but this will maximize the long term value of the firm.

[0] [https://en.wikipedia.org/wiki/Generally_accepted_accounting_...](https://en.wikipedia.org/wiki/Generally_accepted_accounting_principles)

<comment><USER8> _This goes under the name of "Unit Economics" and is reasonable for small startups to use._

That's fine. But I think the meat of the article is that there are startups/businesses out there that are using so much smoke and mirrors with financial reporting that it has become a ridiculous process to read a "we are profitable!" press release.

I get it - there is an arms race out there to get funding for the "next big thing" which will require hundreds of millions of dollars to get off the ground. But whatever happened to a sound business plan, an experienced team, and a sound business idea? And the "next big thing" is now so saturated by so many players that the arms race seems to be exponentially increased for any possible idea that might have some traction. It is a race to the bottom.

Facebook and Google are such outliers that VC has resorted to throwing cash at the next 1,000 Mark Zuckerbergs, which only one or two probably exist in the next 10 years.

Capital is chasing returns that are not sustainable.

<comment><USER9> Well put. That is one of the fundamental problems with the economy of the current tech startup boom. There is too much of a winner-take-all dynamic. From the VC's perspective, it doesn't matter whether the portfolio is 10 or 1000 companies, as long as you get that home run. But to each individual founder, it's the difference between a 1/10 and 1/1000 shot at success.

Staying at Facebook/Google/etc seems to be the way to go these days...

<comment><USER7> The other alternative is to come up with an idea that doesn't require scale, that can become cashflow positive more quickly.

You can do this in software by attacking a very narrow niche, or by doing a services-heavy business. Neither creates a unicorn, but both can be stable.

<comment><USER9> Yes but good luck competing with the big VC funded companies for publicity!

</comment></comment></comment></comment></comment><comment><USER10> The fact that they opened the article with the example that they did is absolutely ridiculous, considering there are significantly better examples that didn't even receive their own complete sentence. Contribution Margin is a metric that _all_ VCs should keep an eye on. It is a scalability metric: before CM positivity, you are lose money with every unit sold. After you are CM positive, growing sales will only ever help you. The only mistake the SpoonRocket management made (at least as far as referenced in the article) was trying to expand to new cities _before_ they were CM positive.

The absolutely moronic-bordering-on-Bernie-Madoff example was Instacart. _Instacart told Bloomberg in February that it was profitable in its biggest markets and that 40 percent of its volume was profitable. The company later clarified that it meant gross margin profitable, which is usually limited to direct costs such as supplies and delivery labor. Instacart 's calculation leaves out other costs, such as customer service, central office salaries, rent, and the cost of acquiring its workers. Instacart also said it is gross margin profitable, on average, across all its markets._

I certainly hope the Bloomberg writers actually clarified (and just made it sound like they were assuming) how Instacart is calculating Gross Margin, because delivery costs are typically only included on the inbound side, which is a cost that Instacart doesn't manage. Outbound delivery costs are very rarely included, and that is Instacart's whole fucking business. It would be like a grocery store claiming profitability as long as you exclude COGS.

In other words, if Instacart is including their delivery costs in their GM calculation, they might have a sustainable business (they'll never be as profitable as their valuation assumes, but at least they could stick around after the VC dries up). If they _aren 't_ including delivery costs in their GM calculation, then Instacart is so laughably unprofitable that they don't have a snowball's chance in hell.

</comment><comment><USER8> "Profitable profitable" \- I, I just can't even understand why someone would say something like this.

What's next? "We're negatively profitable right now but hope to swing to an evenly profitable state and then turn positively profitable profitable in Q2 2017"

SMH...

<comment><USER11> Our profitability is currently in stealth mode.

</comment></comment><comment><USER12> Ah! reminds me of the dot com bubble where everyone was profitable! ... uh by EBITDA [0]. A measure that caused all sorts of problems since a bunch of companies also manipulated their Earnings [1]. For every cycle, the line swings back and forward between "grow at all costs" and "profit, profit, profit", with the associated attempts to create "silk purses out of a sow's ear" by using bad definitions. Not that this fools VC's or investor high-net- worths, since they know (and create) many of these games themselves.

Every business should know profit by product/shipping-unit, line of business/division and overall (gross/net). If we don't know them, we're not running a business, we're running an experiment.

Though I much prefer the phase when the industry is talking about "profit" at some level, rather than just buying temporary growth and selling it as "innovation".

[0] [https://en.wikipedia.org/wiki/Earnings_before_interest,_taxe...](https://en.wikipedia.org/wiki/Earnings_before_interest,_taxes,_depreciation,_and_amortization)

[1] [https://hbr.org/2009/11/how-ebidta-can- mislead/](https://hbr.org/2009/11/how-ebidta-can-mislead/)

<comment><USER13> > _A measure that caused all sorts of problems since a bunch of companies also > manipulated their Earnings_

Just to be clear. EBITDA itself is not the problem, but rather the calculation companies themselves use to derive it. EBITDA is generally regarded as a very good metric to value a company (with a multiple of course). Any smart investor who gives a damn about their private company investment sniff shady EBITDA numbers out pretty quickly. The problem is, very few VCs actually go through this scrutiny or have incentives to provide a true indication of EBITDA. On the other hand, PE firms, who take a large stake in a business, typically do.

<comment><USER12> > EBITDA itself is not the problem, but rather the calculation companies > themselves use to derive it.

Heh, I find it a bit difficult to consider it a useful measure, when (as you point out) you have to immediately clarify _how_ it's calculated. It's like me saying "I'm a world champion sprinter" and then mumbling "as measured by positions in races between my desk and the downstairs loo". There are contexts for specialist use, but overall I'd avoid it.

The article was referring to more general business use - PR & investment - <USER2> guess another situation where profitability comes up is candidates discussing whether an organisation they might join is profitable. I would argue that if someone uses EBITDA then it indicates that you should be asking lot more hard questions. Not that it's even the worse, as the article points out - <USER3> broader point is that every era comes up with new pet terms and ways of manipulating them for PR.

<comment><USER14> Take two identical companies in the same business line in the same jurisdiction. One got a less favorable interest rate on the same amount of debt, and also has a higher effective tax rate.

On a GAAP basis, these companies look very different. They should. They are.

But, to someone trying to compare different companies for purposes of M&A, EBITDA can provide a nice way to normalize these factors. Debt can be refinanced. Effective tax rate != current tax rate. And that's just the EBIT part of EBITDA.

You can't say EBITDA itself is not a useful measure. It is, when it's used properly and understood. However, I do agree with your overall sentiment re: manipulation. It's misused and misunderstood.

</comment></comment></comment></comment><comment><USER15> A big company that is profitable is invariably found to have evolved from a small company that was profitable. A big company created from scratch is never profitable and cannot be patched up to become profitable. You have to start over with a profitable small company.

With apologies to John Gall ;) I feel there's some truth to it.

<comment><USER16> Amazon?

<comment><USER15> Amazon is one of the most frugal companies I know, penny-pinching is built into their DNA and one of the reasons IMO they're not a pleasant place to work. Amazon actively chooses to invest every cent they make into expansion (with great results) instead of hoarding profit.

That's a huge difference to most companies mentioned in the article that essentially sell $10 bills on the street corner for $9: "Oh, another flyer for a free meal delivery service, why thank you VC-man for paying for my lunch once again. No, I will not ever pay for your service."

<comment><USER17> But the point is that at the very beginning of their company, Amazon was most definitely NOT profitable. They took in a huge amount of investment money to be able to grow their business quickly - exactly what all these other companies are trying to do.

<comment><USER18> Amazon used to (circa 2000) report pro-forma (non GAAP) profit/losses.

</comment></comment></comment></comment></comment><comment><USER19> An an European startup I had a bright smile when reading this article. Always fun to see how out of touch can startup founders be too often led believing that VC money without balanced revenue/expenses is "normal".

They'd certainly be quick to get some cold shower around here. Too often a startup already needs to be profitable in most cases and have some heavy references before even getting 500k of funding, if at all.

<comment><USER20> Is this why we aren't getting Google's and Facebook's and Twitter's out of Europe though?

<comment><USER21> It might also be why the US had the dot com and unicorn bubble.

And note that Twitter is not, and has never been, profitable.

<comment><USER22> I think I would take the bubbles over relative stagnation.

<comment><USER19> I would like to disagree with that thought because neither are good options, but regrettably agree.

Would kind of prefer to see more bubbles because then at least you increase the odds of more companies/people to deliver innovation (in the true and non- cliché meaning of the word).

</comment></comment></comment></comment></comment><comment><USER23> Did I read the article correctly that uber, lyft are not profitable yet? That's news to me as I thought they were very profitable given the amount of media attention and visibililty they gave got. Are companies like say slack and github profitable? They also get so much attention (atleast here on HN).

<comment><USER5> Github interestingly used to be profitable "We bootstrapped the company on a few thousand dollars and became profitable the day we opened to the public and started charging for subscriptions."

They seem to have ditched that for the VC funded, hire loads of people, swing for the fences model.

[http://tom.preston-werner.com/2011/03/29/ten-lessons-from- gi...](http://tom.preston-werner.com/2011/03/29/ten-lessons-from-githubs- first-year.html)

</comment></comment><comment><USER24> To be fair, so do "real" companies like Tesla, which like to use alternate accounting systems to report profitability while being unprofitable in accordance with GAAP. I like to think that investors who actually do their homework can see through the nonsense in both cases.

<comment><USER25> Or maybe the investors are part of the problem.

<comment><USER26> You can't really just drop a statement like that and walk off. No one knows what you're talking about.

<comment><USER25> Investors change the game theory in company's model. A company without VC doing the exact same thing as with VC will perform and act differently. Pretty much all we hear about in the news is that VC money is good for startups, founders, employees, the scene in general here and the tech economy. In reality, I doubt that's true long term. My rationale is that the WHOLE game is significantly altered when people who have stored trust get involved in a big way. Stored trust being capital, money or stored work. The game being the market we entrepreneurs look to game in moving forward.

The effects of these consolidated investment cycles result in bubbles. The more stored trust involved, and the more systems put in place to bring more stored trust to bear on an idea, market, company, etc., the more disruption there will be on the changes in the cycles. Cycles are a thing with technology, probably due to the discovery phases of market bubbles. All theory, of course. I'd like to see it put to analysis though.

Better?

</comment></comment></comment></comment><comment><USER27> > (...) Venture capitalists had begun to prioritize profit over growth.

What about "startup == growth"?

</comment><comment><USER28> Well, a focus on profitably is much better than a focus on becoming a unicorn (no matter how bad the terms)

</comment><comment><USER29> profit's an opinion, cash (flow) is king.

</comment><comment><USER30> One way for companies to game the system is to be late in paying their employees & contractors. If these expenses don't show up in the books, then the company can appear to be in a better financial situation.

<comment><USER31> I believe that GAAP requires accounting for work expenses at the time when the work is performed - e.g. the salary due for last week of March _must_ be counted in March, no matter if you issued a paycheck right at the end of week or haven't paid it yet for whatever reasons.

Though, one way for companies to game the system in GAAP is to be late in paying their employees & contractors by having part of their renumeration be in stock options - people perceive it as compensation, but it can be excluded from GAAP since the value technically doesn't come from "within the company" but from reducing the value of other shareholders.</comment></comment>


Apple is building organ donation into iOS 10 - <AUTHOR> https://techcrunch.com/2016/07/05/apple-organ-donation/ <comment><USER2> Watch out, knowing Apple you'll be able to pay for the new iPhone with a kidney soon...</comment>


StateFace: A font you can use when you want tiny state shapes as design elements - <AUTHOR> http://propublica.github.io/stateface/ <comment><USER2> This is over-engineering to use a specific technology even when it makes no sense what-so-ever.

A bunch of small image files would have been easier to implement and easier to use, and wouldn't require a stupid letter -> state mapping like this has.  is obviously New York - h is not.

<comment><USER3> There is an alternate stylesheet that uses more semantic class names and allows for replacing text, so literal state names and abbreviations can be used in the markup. [http://propublica.github.io/stateface/reference/cssclass.htm...](http://propublica.github.io/stateface/reference/cssclass.html)

</comment></comment><comment><USER4> This sort of thing, minus the propensity for screwing up screen-reader progeams, is what SVG is for. Normally, I wouldn't complain about someone's project like this, but we as an industry really need to start treating the handicapped better.

<comment><USER5> You are assuming the Web as the only medium. Content is also produced for other media, such as print.

<comment><USER4> It's a pretty good assumption, considering this is implemented in techs that are almost exclusively used on the Web and not in print. Regardless, SVG works in print, too. We have moved way past the period where printing required physically movable type.

I mean, they even went so far as to create an SVG _font_. Why bother going through all that? Just make them icons.

</comment></comment></comment><comment><USER6> american states</comment>


Fuck the Fortune 500, It's All About the Fortune 5,000,000 - <AUTHOR> http://www.quicksprout.com/2009/08/24/fuck-the-fortune-500-its-all-about-the-fortune-5000000/

<comment><USER2> I like Neil, but there was no reason to use "fuck" when "forget" would work just as well.

<comment><USER3> It's a syllable shorter and places emphasis on the statement?

"Forget that" versus "Fuck that", beyond adding a swear, adds some energy to the sentence, which isn't a bad thing. Mind you, this was stated more eloquently (and in 2005) by 37signals, who this post is rather paraphrasing, who put it as:

"Who cares about the Fortune 500? It's time to care about the Fortune 5,000,000."

[http://37signals.com/svn/archives2/sidebusiness_software_the...](http://37signals.com/svn/archives2/sidebusiness_software_the_neglected_software_market.php)

Nicer, also, because it doesn't use the obnoxious phrase "all about".

<comment><USER4> DHH's great talk at startup school also covers this: [http://37signals.com/svn/posts/981-the-secret-to-making- mone...](http://37signals.com/svn/posts/981-the-secret-to-making-money-online)

</comment></comment></comment><comment><USER5> One of my companies works with sports franchises--not Fortune 500, but pretty substantial operations. This really hit home for me:

"You'll be a bitch – whether you end up getting paid a lot or a little from a big company, you'll be their bitch. They'll expect a lot from you, and in most cases you'll end up doing more work than what was listed out in your contract."

Now, if you stand up for yourself from the get-go, you can avoid that last part most of the time. But certainly, you can be treated differently than larger operations. They get the benefit of dealing with decision-makers (me) instead of some lackey, and they will often take advantage of that.

(But...not only YMMV, but MyMMV. I've got clients who try to make me their bitch, and I've got clients who worship the ground I walk on.)

<comment><USER6> I think if your client relationship is something like "either I'm a bitch or the client is my bitch" then you have a ego issue.

<comment><USER5> Is it necessary to mention that some client relationships fall into neither category?

<comment><USER6> I was trying to imply that all should fall in bewteen (I.e. mutually beneficial)

</comment></comment></comment></comment><comment><USER7> Gross generalizations supported with no data and based only upon personal experience. Almost everything he said could be said about many businesses, both large and small.

The unnecessary and distracting profanity didn't help much either.

</comment><comment><USER8> The problem this post neglects is distribution. Hunting and finding potential customers among 5,000,000 is a lot more difficult than among 500.

<comment><USER9> Seems to me that if you're solving a real problem for a real audience and put in the doing the market schlep, then it would be easy enough for you to reach your customers in the 5,000,000.

No one publishes a list of the Fortune 5,000,000. But having a convenient list of 500 companies published in a magazine once a year doesn't make them any more likely to pay attention to you anyway.

</comment></comment><comment><USER10> on the other hand, you have a lot more hit and miss with the small to medium business market, they're more likely to not pay at all or simply drop an entire project on a whim without having to have a reason that they can peddle to the committee in charge of the project, at the same time they're only a step removed from the general public attitude of "My cousin could make it for 800$, what can you add to the equation?" and tend to be far more budget sensitive than their larger counterparts.

That said, the article does make some good points.

<comment><USER11> It's primarily about spreading the risk out to many more customers, so even if this happens in a few customers, it doesn't affect your core cash flow.</comment></comment>


Why not a Y Combinator branch in India - <AUTHOR>

India has a rich hacker potential to bring in a lot of startups. But what is missing is a strong community to mentor/guide and startup hubs like ycombinator. With low cost and qualified software engineers India can very well solve the cost and man-power problem of startups and if ycombinator starts a startup hub here in bangalore or chennai, they can considerably reduce the initial funding amount they make. <comment><USER2> Interesting.. But wouldn't the idea and the initiative come from somebody in India (Somebody there, perhaps yourself?) edit: posting from India, traveling :)

<comment><AUTHOR> Yes, it would be nice if it comes from India, but somebody has to bring in an initial momentum to turn the rich people's/investors attention in India, towards it.

</comment></comment><comment><USER3> You mean like iAccelerator: <http://brajeshwar.com/2009/iaccelerator-2009/>

<comment><USER4> re iAccelerator. Caveat Emptor <http://news.ycombinator.com/item?id=842882></comment></comment>


We cut our Flask page load times by 60% with one line of code - <AUTHOR> https://medium.com/@5hreyans/the-one-weird-trick-that-cut-our-flask-page-load-time-by-70-87145335f679 <comment><USER2> Seems like this could possibly lead to memory leak? No upper bound on the memory usage?

<comment><USER3> I'm not familiar with Jinja caching but I think it only caches the number of templates you got, so it grows to a fixed size.

</comment></comment><comment><USER4> Well done!

</comment><comment><USER5> I added this, hope it improves things.</comment>


One year at Y Combinator Research - <AUTHOR> http://elevr.com/1-year-at-ycr/ <comment><USER2> "So we embraced the fundamental truth that sitting at a desk or standing in one position is not what human bodies were made for."

That's pretty cool, but I'd love to see more serious research to support this claim. There was a tendency for people to work standing up[0]. I, for example, when I need to do things fast I prefer to do the work standing up, but I end up getting very anxious, so I can not work that way for too long.

During meetings that use the Sprint process[1], not all people like to be seated, but this should be because everyone should participate in the whole process.

[0][http://edition.cnn.com/2016/06/08/health/standing-desk- produ...](http://edition.cnn.com/2016/06/08/health/standing-desk- productivity/) [1][http://www.gv.com/sprint/](http://www.gv.com/sprint/)

<comment><USER3> I think that the answer to the fundamental truth about what humans were made for is 'walking'.

Maybe, the office environment of the future is about hunting and recollecting business goals.

<comment><USER4> Or more precisely: having a physiology best suited to walk/run mode was an evolutionary advantage for most humans. Maybe we can tinker with our genome to produce a sit-mode optimized human in the future, if desired. For me personally, I would rather be able to hike all day, thank you.

</comment></comment></comment><comment><USER5> 5:26 "and we found that with any work we do in VR, we always end up on the floor at some point..."

Looked as if they were high on drugs on something... but then when bluetooth handsfree headsets first came out, I thought they were crazy people talking to themselves.

<comment><USER6> And look where bluetooth handsfree headsets are now.

</comment></comment><comment><USER7> The site seems slow, so here is the video: [https://www.youtube.com/watch?v=F7yLL5fJxT4](https://www.youtube.com/watch?v=F7yLL5fJxT4)

Really cool, exciting stuff that they seem to be doing! Also awesome that YC is funding this sort of stuff.

</comment><comment><USER8> I know that it is somehow irrational but am I the only one actually scared by VR? It seems so good that I am afraid will decouple people from the real world.

As human specie are we sure that we will be able to manage it?

Are we sure that the negative effect will be couter balanced by the good one? What if we get hooked to VR?

What will be the meaning of "real"?

<comment><USER9> Along a similar path, there was a dystopian theory (story?) I came across that made a somewhat insightful reference to this in connection with the Fermi Paradox - what if advanced civilizations all "go digital" (or in to the "XR" space)? I could imagine future peoples not being bothered to physically explore if their new reality all existed in a virtual/holographic state. A self-imposed pod, The Matrix-style, for everyone. Man, I love sci-fi.

</comment></comment><comment><USER10> In the video it sounds like they are against using the scientific method because they don't have a hypothesis. So my question is what goes into their publications and work featured in Nature?

<comment><USER11> You could have just clicked the link yourself [http://www.nature.com/news/mathematicians-create-warped- worl...](http://www.nature.com/news/mathematicians-create-warped-worlds-in- virtual-reality-1.21689)

<comment><USER10> Ah, so it's not like a published paper in Nature. It's news about research covered by nature.

</comment></comment></comment><comment><USER12> oO looks like second life.

How do you get payed for doing this a year long?

"research"

</comment><comment><USER13> The best for me would be to not stare at a screen(s) all day, with VR it will be even worse, like literally having a screen on your head all the time :-)

</comment><comment><USER14> Wow, looks like a lot of interesting stuff for one year!

I especially liked the Venn Kitchen. Can't wait to try that out once I get me some VR gear.

</comment><comment><USER15> Cool work. Do you have any ideas about letting multitask with VR?

</comment><comment><USER16> This is cool. I wonder how one might get involved.

</comment><comment><USER17> finally some vr ppl who aren't bros

</comment><comment><USER18> Hmm i have to think about this some more but my initial thinking is that they are approaching VR research the wrong way.

<comment><AUTHOR> I'm really curious why you would make the first comment here so negative if you don't really know what they're doing and don't have anything to add.

<comment><USER18> I wasn't trying to be negative. I am not talking about the technical side but about the philosophical. And there I do know what they are doing as they explained this themselves.

What stood out for me was this.

 _" We don't think VR's power is in simulating reality."_

This literally flies in the phase of said reality, case in point flight simulation. Furthermore so many upcoming uses for remote controlling robots in space, large machinery in toxic places, the ability to help children with autism. I could go on. There are an extremely large amount of real value and real power in simulating reality exactly because it allow us to test hypotheses, train and remote control, furthermore any robot worth it's salt need to be able to simulate reality. In other words. The very basic premise IMO is flawed if they don't think the power is in that.

Anyway I certainly didn't want to claim they don't know how to do their research, just think that their premise is rather flawed if they really believe there is no power in simulating reality.

<comment><AUTHOR> Simulation is useful in itself, but what does that have to do with VR?

<comment><USER18> vr simulating reality i.e flight simulator. you dont need googles to do VR</comment></comment></comment></comment></comment>


Show HN: I made a match game to propose to my girlfriend - <AUTHOR> https://github.com/johnlinvc/bestmate <comment><USER2> This is cute! I hope she liked it and the effort you put into it.

How did you like using SpriteKit as a game framework? Would you recommend it for iOS development?

</comment><comment><USER3> Did she say yes?</comment>


I Hate the New Macbooks - <AUTHOR> https://www.codeweavers.com/about/blogs/jparshall/2015/6/30/i-hate-the-new-macbooks <comment><USER2> That was quite the rant. There's a bunch of stuff to object to in it, but limiting my criticism to the complaint that perplexes me the most frequently: ...Why are people so caught up on the number of connectors? Why is it difficult to have a hub at your desk to plug your accessories into? When I'm at work, generally need more screen real estate than when I'm relaxing at home. Is it _that_ unreasonable to assume that the vast majority of _professionals_ work from the same desk each day and so can deal with having a hub or some external monitors for the time they're doing actual work?

[edit: grammar/wording]

<comment><USER3> I get that the macbook works for your story, and that's great. But the problem is that other peoples' stories of using a laptop are often uncomfortable-to- impossible to achieve with a mac.

 _Is it that unreasonable to assume that the vast majority of professionals work from the same desk each day_

No, but it would be unreasonable to assume that they do "actual work" exclusively or near-excursively from that desk. I have a mac at my work desk, and could have gotten a macbook too, but the reason I chose a thinkpad is the frequency I'm using peripherals in a meeting room. And nothing fancy either, often just a mouse, display out and network.

 _Why is it difficult to have a hub at your desk to plug your accessories into?_

I guess I assume that the point of having a laptop is portable convenience, even if that makes me unreasonable. I don't find it unusual to want to do "actual work" from collaborative areas like meeting rooms, electronics labs or a co-workers desk. Or from home, or business travel.

</comment></comment><comment><USER4> Recently, I bought a Macbook Pro 13" and it was unusable for me. The effective resolution is to large in the standard pixel doubling mode. Switching it to something smaller cripples the operating system. Since I switch workspaces quite frequently, I can't live with a stuttering animation. That would have driven me crazy.

Not only that, the panel (or diffuser oder backlight or whatever is in there) is loose. So if you tilt it, it's going to move and make a soft but audible sound. I had two brand new Macbook Pros which had that issue. One of them should have been repaired but I was told that it is "normal."

Look, we've moved away from spindles to No More Moving Parts. And they tell me, that the display panel moves around depending on the direction of gravitation?

These things pretty much make the Macbook Pro such an annoying computer that I couldn't use it and sent it back.

The sad part about the rant of the article's author and my complaints is that there is nowhere else to go once you've been locked into OS X. It becomes a question of what is the least terrible choice.

You wait generation after generation hoping they'd make a computer that is just right for you. But they won't. That's the point where you end up ranting on the internet or otherwise get really pissed.

And once you decide to go Linux, you might end up happier but you can forget any interoperability between Linux and OS X/iOS. That is, if you care about that. I don't even care about the last 321 iOS interoperability features for OS X. I just want a computer that works like I want it, not like Apple wants it.

</comment><comment><USER5> Just bought the new MBP this week. Personally:

Ethernet Port: Don't need

Optical Drive: Don't need, but took my old one out to make room for a hard drive in my previous MBP and put it in a case so I have it if I need it. Haven't actually used it since (about two years ago).

17" was always too big for me to lug around, always preferred the 15" (and always upgraded display to get more resolution which is not needed with retina). For me 15" is the right combination of screen real-estate and size.

And I actually _appreciate_ the slimmer design and lighter profile. It's noticeable over my almost 5 year old MBP that I'm upgrading from.

My only lament is that I wish everything wasn't soldered in so I could replace/upgrade it myself, but that's not just an Apple problem, most laptops are going that way in the name of decreasing size.

I'm pretty happy with this new kit actually, but I've only used it for a few days thus far.

<comment><USER6> I agree with your points. This guy writes like an angry 13 year old. I use an MBP at work every single day and I've never had any problems with power. Thunderbolt is a good standard so that is a very weak argument. And seriously LOL if you're using CD/DVD media in 2015. Can't video edit on a 15" monitor? Try getting better skills.

</comment></comment><comment><USER7> The lack of ports (notably ethernet) is minorly annoying to me, but much worse than that is the totally inadequate cooling. My 2013 15" MBP quickly overheats and thermally throttles when compiling. Maxing the fans doesn't help much -- there are only tiny slits for air intakes.

</comment><comment> k-mcgrady >> CD Drive

It's 2015. Very, very few people need that.

>> Ethernet

Probably should be on a pro laptop but again it's not used very much anymore.

>> 17" screen

Doesn't the addition of retina resolution to the 15" make up for this?

Also this is nothing to do with the new MacBooks as those things have been gone for quite a while now.

<comment><USER8> Ethernet is great if you want network stability and speed.

<comment><USER9> Or the ability to directly wire to factory-fresh "192.168.0.1" routers/switches/etc.

</comment></comment></comment><comment><USER10> I certainly think Apple would sell a lot of 17" MBPs that were thick enough to house an optical drive or extra battery in the space.

But I love the new rMBPs, and I suspect more pros enjoy the weight savings, battery life, and fantastic displays than are irked by the lack of an optical drive.

<comment><USER11> A lot of as in "a quarter of a million a year for a few years running"? I doubt it, and I guess that may not even be what they would need to make it a successful product at their scale (by my counting on apple.com, they now have 6 different notebook form factors and 5 different desktop ones, and Google tells me they sold over 19M Macs in 2014)

Add in that most of the 17" models sold likely would cost them a sale of a smaller one, and I doubt the numbers would add up for them.

</comment></comment><comment><USER12> It sounds like you need a desktop.

<comment><USER2> or even just a modern workstation

</comment></comment><comment><USER13> I've the new macbook 12" for 2 weeks and I am back to a max-out 15" mid-2015. Yeah, it was slow but I miss the form factor so much, I am going to buy it back. You can really fall in love with it.

<comment><USER14> Any idea how the 12" compares to the Macbook Air in terms of performance? I'm running a 2014 13", the i5 CPU is fine for my needs but more memory (I've got 4GB) would be good when running VMs.

<comment><USER13> Should be comparable or faster. Scored ~2300 single core ~5500 multi core (Geekbench) with a 1.2Ghz.

</comment></comment></comment><comment><USER15> Reminds me of [http://www.penny-arcade.com/comic/2003/08/25](http://www.penny- arcade.com/comic/2003/08/25)

</comment><comment><USER16> Agree: Ethernet on Pro models, 17" option (probably has more to do with battery life than finding screens)

Disagree: CD drive (that's over), 2nd Thunderbolt

<comment><USER8> Ethernet and 17" and possibly some extra USB on the pro is good but yeah hardly anybody needs an optical drive.

<comment><USER17> I don't get the 17", they were insanely big and heavy. The 15" rMBP can run in the same effective screen resolution, while also being significantly smaller and lighter. Wins all round!

<comment><USER8> You obviously have much younger eyes.

</comment></comment></comment></comment><comment><USER18> Maybe you should buy an actual desktop, not a laptop.

People work from coffee shops now, they work on the train, on the plane, they bring their laptops to the "war room" at work for important meetings. They move from desk to desk for pair programming sessions. Can you imagine how much of a pain it would be with 17'' laptops?

Stop bitching about a tool that is _not_ designed to address your needs.

</comment><comment><USER19> Man-up and run Linux on a ThinkPad

</comment><comment><USER20> No complaints about the chiclet keyboards?</comment>


Ship.io brings mobile CI to app developers - <AUTHOR> https://ship.io/ship-io-launches-out-of-public-beta/

<comment><USER2> As one of the engineers on Ship -- woohoo!

</comment><comment><USER3> please, please don't modify scroll speed, it's a system wide option, not per website setting

</comment><comment><USER4> is there a price page somewhere?

<comment><USER5> [https://ship.io/pricing/](https://ship.io/pricing/)</comment></comment>


It's SO over: cool cyberkids abandon social networking sites - <AUTHOR> http://www.guardian.co.uk/media/2009/aug/06/young-abandon-social-networking-sites <comment><USER2> I really hope facebook and twitter are fads that will be abandoned and forgotten. I don't want to be practically forced to use them just to stay in touch.

<comment><USER3> So what _do_ you want to use to keep in touch? The telephone? I don't think people would appreciate it if you kept calling them every few days asking, "What are you doing now?".

<comment><USER4> > "What are you doing now?"

We don't need to know this. We (this social media culture/generation) spend more time finding out what other people are doing than actually doing anything. It doesn't _matter_ what your friends or your brother or your aunt did today or last night or last month even.

<comment><USER5> Even though Facebook is largely defined by the power users and the company's goal is to just keep ratcheting up engagement, I don't think that's the right way to judge it as a service.

As a casual user who visits Facebook a couple times a week, I find it to be tremendously valuable. Contrast with email for a moment. I somehow made it into my inlaws' family list. This is a group of perhaps 100 families who all manage their own copy of the list via Reply All. Many of them post multi-page updates of their domestic tasks several times a week. I can never be removed from or block this list because I may receive legitimate email from any of these people. I may occasionally actually be interested in what they are doing, but as it is the problem is worse than spam by a long shot. Now that some of them are getting on Facebook it is a huge improvement. I can block the truly annoying people and still keep ambient awareness of what's going on _on my own schedule_.

I think Facebook is a tremendously useful tool, which is often obscured inside the echo-chamber by the feeding frenzies around virality and engagement. In other words, I believe Facebook is sustainable.

</comment></comment></comment></comment><comment><USER6> I'm tired of articles that disprove their own titles

"Clearly take-up among under 16-year-olds is very high … so we cannot say for certain whether this is people in a certain age group who are not setting up social networking profiles or whether it's a population shift which is reflecting people getting older and having a social networking profile that they set up two years ago," he said. "The main point is the profile of social networking users is getting older."

<comment><USER7> It also says this:

 _among 15-to 24-year-olds (...) data suggests they are spending less time on social networking sites._

</comment></comment><comment><USER8> Those stats don't show that 15- to 24-year-olds are moving away from facebook. Just that 25- to 34-year-olds are signing up at a faster rate.

<comment><USER9> I like the guardians "figures behind the story" stuff, really nice. But it does show they're relying on a percentage which means that if the overall percent of 15-24 yo using the net has increased then the absolute number using SNS (Social Networking Sites) could have actually increased.

Also, the figures look pretty bogus, apparently 22% of people age 15-24 have their own website? (this is not counting blogs or SNS, eg MySpace). I don't know a huge number of people in this age bracket but none have their own websites.

</comment></comment><comment><USER10> Potentially great news for facebook, if they can maintain their growth while seeing an increase in the age of users. Older users have greater spending power making them a more valuable audience to advertisers.

<comment><USER3> Well said. As a college student, I'd be less than willing to whip out my credit card and purchase something off the web.

EDIT: Where "less than willing" means "OMG I HAZ NO CREDIT CARD!!1!"

</comment></comment><comment><USER11> What is a cool cyberkid?

<comment><USER12> <http://www.youtube.com/watch?v=b7tazcxWUwk>

<comment><USER5> Oh man you soooo nailed it. Best video response ever.

</comment></comment></comment><comment><USER13> "Ofcom research shows 5% drop in 15 to 24-year-olds using social networking sites"

What sort of conclusion can you draw from a single 5% change in data? What's the noise level in that sample?

<comment><USER9> Isn't that a 5% drop of 15-24 yo _online_ that are using SNS. So an increase in absolute users would create a decrease in %.

</comment></comment><comment><USER14> Great news for facebook et al! This must mean that they're going mainstream. Attracting the cool crowd as a business strategy is overrated imho.

</comment><comment><USER15> Cool cyberkids never were on social networking sites. Heck, they never even used a browser. They mail themselves single webpages and check them out in GNUS. Cheech. Really.

<comment><USER2> Richard Stallman is kinda old to be called a "cool cyberkid", you know..

<comment><USER15> Compared to Donald Knuth he is young.

</comment></comment></comment><comment><USER16> [http://www.guardian.co.uk/media/2009/aug/03/value-social- net...](http://www.guardian.co.uk/media/2009/aug/03/value-social-networking)

fits in, doesn't it</comment>


Internet Draft: SMTP Strict Transport Security - <AUTHOR> https://tools.ietf.org/html/draft-margolis-smtp-sts-00 <comment><USER3> Very interesting, seems like this would have potential to improve email transit security quite a bit. It is encouraging to see Google, Microsoft, Yahoo and Comcast in the authors, that would indicate that this has good chance of being applied to large portion of internet email.

Of course email at rest security remains an issue, but that another story.

<comment><USER4> > encouraging to see Google, Microsoft, Yahoo and Comcast

For all intents and purposes this is most of the English speaking internet. If you swap Yahoo for Verizon and Apple you'd be pretty close.

So, yeah encouraging to get this standard applied, less so if you think it is good for the internet to offload an outsize share of control to 5-10 corporations.

<comment><USER5> Is there anything about IETF standards that creates an outsize share of control for a limited number of corporations?

<comment><USER6> Only in the sense that larger companies can afford to fund their employees to work on IETF standards groups, and are thus more likely to end up contributing, editing and managing IETF groups.

The funding is not large, though: no dues, no grants, just the time that people spend and airfare/hotels up to three times a year -- usually two of those being inside the US. And it's possible to have quite a lot of impact simply by volunteering your time in a group in which you have some expertise.

</comment></comment></comment></comment><comment><USER7> Can't we pretty much please make it reasonably generic and not SMTP-specific?

There are a lot of protocols (say XMPP, IRC or IMAP) around that have opportunistic encryption with STARTTLS-like semantics. Surely, they could all benefit from a similar solution.

<comment><USER8> There are a lot more protocols that would benefit from the more generic and much simpler solution of "define a standard port where the service listens over TLS".

IRCS has settled on 6697: [https://tools.ietf.org/html/rfc7194](https://tools.ietf.org/html/rfc7194)

IMAPS uses 993.

<comment><USER9> Just having a dedicated port for TLS-wrapped version of the protocol wouldn't help here. HTTPS has 443, yet we still need HSTS to enforce it.

That said, dedicated SMTPS port would still be beneficial by cutting down at least 2 RTTs (HELO/EHLO + STARTTLS) from overall transaction time.

</comment></comment></comment><comment><USER10> Excellent! Strict transport security for SMTP has been sorely needed. Once it's widely deployed, it will finally ensure that virtually all email communication occurs over TLS.

TLS is already widely supported among large ISPs, but until now it has been far too easy to fall back to plaintext. There wasn't any way for a receiving ISP to ask all senders to use TLS and not fall back, which meant it happened occasionally. It's why Google's "Safer Email" transparency report shows many senders at 99% percent TLS, rather than 100%:

[https://www.google.com/transparencyreport/saferemail/](https://www.google.com/transparencyreport/saferemail/)

As receivers deploy strict TLS policies, and as senders add support, I expect to see these numbers reach 100% and stay there. I look forward to having strict TLS support in place in our email systems. Nice job making this happen, folks who contributed!

<comment><USER11> We are working to switch Haraka to use TLS by default in all systems. A big part of that is adding support for letsencrypt so that we can trivially create a secure outbound certificate for every mail. This stuff is important and we need to make email secure.

<comment><USER12> [https://en.m.wikipedia.org/wiki/DNS- based_Authentication_of_...](https://en.m.wikipedia.org/wiki/DNS- based_Authentication_of_Named_Entities)

</comment></comment></comment><comment><USER13> It would be nice to also consider completely dropping support for non-TLS SMTP.

Unlike HTTP where connecting to abandoned non-TLS websites can be useful, e-mail is only useful if someone is reading it, and if they are reading it they can take action to enable TLS.

<comment><USER14> Well, we missed out on mandatory encryption in HTTP/2, despite that requiring the webserver to turn it on, so for some reason we still have a lobby for unsecured communications.

<comment><USER15> Except browsers won't implement non-TLS HTTP2. So for all the use cases that matter, it's fine. Another good example of implementation trumping "standards".

</comment></comment></comment><comment><USER16> Successful deployment of STS would bring to zero the number of real-world use cases for DNSSEC/DANE, which would be a very good thing.

<comment><USER17> Why? They solve different problems. DNSSEC/DANE moves the TLS CA into the hands of the DNS hierarchy from various corporations. STS just says to use TLS (with this cert, but you can only know the cert is OK to begin with because of a CA, or DANE).

<comment><USER16> Because the only remaining reason to deploy DNSSEC is to exploit DANE to allow SMTP MTAs to force TLS. All the other uses of DNSSEC are already DOA.

It's a little tricky to explain why this is the case without getting into a lot of gritty detail. A shorthand answer is that browser vendors have, pretty much as a group, decided not to adopt DANE (the DNSSEC-based alternative to the X.509 CA system), and DANE is the only reason anyone cares about DNS security on an Internet where everything is going to be encrypted (usually with TLS) by default.

<comment><USER18> Is SSHFP not a legitimate use case for DNSSEC? (Genuinely curious.)

<comment><USER16> No, SSHFP is pretty silly as a motivating use case for DNSSEC. There's nothing it does that you can't do (better!) with some other system. It makes sense if you _already have_ a secure DNS. But that begs the question of _why_ you would need a secure DNS.

You don't need a secure DNS for the web.

You don't, with STS deployed, need a secure DNS for email.

Is publishing SSH key fingerprints so important that we should do a forklift upgrade of the DNS? No, of course not.

<comment><USER19> STS information is stored in DNS records. Why would you not want to secure those?

Also, I think you're underestimating the growth of DNSSEC deployments. I've been watching DNSSEC growth for about 2 years and it is steadily moving up and to the right.

<comment><USER16> It has taken _two decades_ to get to this point. The protocol has been substantially revised _four times_ , and, after each of those four revisions, DNSSEC proponents said "now, we've got it right, and it's ready for universal deployment".

It is nowhere near ready for universal deployment today, and, indeed, virtually nobody relies on it, unlike TLS.

<comment><USER19> DNSSEC ain't pretty. I'll agree with you there, but that doesn't mean it isn't the best thing going for us in terms of securing the DNS. Like it or not it's important to be able to trust DNS responses.

I guess I don't have some expectation that deployment should take place quickly. Or that the first go at a protocol is going to always get it right. Just because a journey is difficult doesn't mean the journey isn't worth taking.

DNSSEC and TLS are unrelated. They're trying to solve different problems.

<comment><USER16> There is no point to securing the DNS. There are only downsides.

<comment><USER20> *using DNSSEC

<comment><USER16> I don't think there's any point to securing the DNS at all.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER21> Interesting to see the list of contributors from the various companies: Google, Inc, Yahoo!, Inc, Comcast, Inc, Microsoft, Inc, LinkedIn, 1&1 Mail & Media Development & Technology GmbH . One of my goals is to contribute to an RFC.

<comment><USER22> Join a working group mailing list and pay very close attention. Most of the work happens there, as opposed to at the 3x a year meeting.

<comment><USER21> I'm currently subscribed to the DNSOP mailing list, which is really interesting, except it's hard to follow since I just joined.

</comment></comment></comment><comment><USER23> Is there a TL;DR version of how adding SSL will make it a whole lot better? Sorry to be dumb on this subject but my understanding of how email works (in particular SMTP) seems like the whole model is busted to begin with.

Are we still sending basically plain text unsigned messages using something akin to the pony express? Does it matter that the pony express carriers communicates securely so no bad guys can snoop the carriers bag of messages At least in the old days you could put a wax seal on the letter to know the letter was legit and not tampered with. With email the entire system is flawed from the get go.

<comment><USER11> Here is my vague attempt at ELI5:

Email is sent via a protocol called SMTP.

SMTP goes over port 25 between major senders (there are other ports but forget that for now).

Since it uses a single port, you can't distinguish between encrypted and plain text communication until you know each end supports encryption. A dated philosophy but people don't upgrade their email servers as often as they do their web browsers so it made sense at the time.

Since the plain text receiving server says "yes I can do STARTTLS", this is easy to man in the middle intercept and say "no encryption here" and the mail goes through anyway.

Even if the receiving end says all mail must arrive over TLS the man in the middle can currently circumvent that by receiving in plain text and forwarding onwards via TLS

This is an RFC to try and prevent that happening.

This stuff is hard, and email nerds (via MAAWG and various other places) have been working on this for years. We don't want to break your current email service, and bringing things up to speed without breaking a ton of eggs has been hurting email for a long time, but we spent too long stopping spam instead of thinking about these problems. Sorry!

<comment><USER24> I don't think the use of a single port is really at the heart of the problem. Even if SMTP with TLS ran over port 26 (say), you wouldn't know if a timeout on port 26 meant the server wasn't listening on port 26 or a MITM had just chosen to drop your packets.

Discovering if someone supports Protocol++ if the fallback to Protocol is insecure is a hard problem.

</comment></comment></comment><comment><USER25> I only found [https://github.com/mrisher/smtp- sts](https://github.com/mrisher/smtp-sts) so far, but this is just docs. Any implementations in the works?

<comment><USER11> Everyone involved is working on implementations, as well as plenty who aren't involved.

</comment></comment><comment><USER26> Why do we need to add support for protocols individually for this? Can't we just introduce a TLS extension and an API for detecting these "always use TLS" requests in OpenSSL etc.?

<comment><USER11> SMTP starts in cleartext. That's the problem.

You upgrade to TLS later. But only if the server says it can do that.

A MITM attack can easily say that the receiver can't do TLS and thus can see everything that passes.

This RFC specifies a way to prevent this, assuming clients abide by the requirements. It will be a long and slow roll out to get this done. But it is worth it.

<comment><USER27> This seems like the slowest possible way to make no useful change. Literally every SMTP-capable software package on earth supports SMTPS on a dedicated port, which requires no changes to protocol. Why not just formalize and mandate this, instead of clinging to a braindead design that requires SMTP to munge the transport level? STARTTLS is a hack. It is not something to be preserved. If the goal is 100% TLS coverage, just mandate that (since everyone already supports it) and move on.

This kind of bureacratic busywork is really, really frustrating. SMTP is nice and simple and does not benefit from this proposal except in the most abstract checklist-compliance sense.

<comment><USER24> If you required TLS on all SMTP, you would in fact end up having to fail a large number of messages.

Even worse, of the domains that support STARTTLS, a sizable number either don't present certificates that chain to a widely trusted root, or don't present certificates that actually match their MX. Worse still, because many domains' MXs don't match the domain itself, even if the certificate is trusted for the MX, it may not be trusted for the domain.[1]

So I think unfortunately we're not anywhere near a world where we could actually just drop email on the floor if TLS-with-a-valid-cert isn't present ("valid" not being clearly defined here, of course). I do think we're slowly moving in that direction[2].

It's certainly true that retrofitting security makes the whole thing more complicated, of course. That's a strong argument for ensuring that any retrofitting we do is itself forward-compatible with what we want to do in 30 years. Or for inventing time machines.

1\. [http://static.googleusercontent.com/media/research.google.co...](http://static.googleusercontent.com/media/research.google.com/en//pubs/archive/43962.pdf) 2\. e.g. [http://arstechnica.com/information- technology/2016/02/gmail-...](http://arstechnica.com/information- technology/2016/02/gmail-to-warn-you-if-your-friends-arent-using-secure- email/)

<comment><USER27> >Even worse, of the domains that support STARTTLS, a sizable number either don't present certificates that chain to a widely trusted root, or don't present certificates that actually match their MX. Worse still, because many domains' MXs don't match the domain itself, even if the certificate is trusted for the MX, it may not be trusted for the domain.

This is madness, though. TLS is _transport-layer_ security. It's not kerberos and it was never intended to be. The cert produced by the MX should be valid for the MX. Trust is an illusion, but to the extent that you decide to trust anything in the CA system, you trust it for the MX _only_ and use SPF etc to determine if the MX is the correct one.

STARTTLS is a bad idea and should go away entirely. It forces an SMTP server to care about the transport layer, and that's entirely incorrect. I have plenty of SMTP servers that communicate on my networks without ever touching TCP/IP -- forcing them to support STARTTLS specifically is moving _backwards_.

This RFC is strongly dependent on the internet looking pretty much exactly like it looks today, and enforcing that mode of operation indefinitely. It's short-sighted and harmful to the entire email world.

<comment><USER24> But I think the authentication problem is in fact the hard problem. Assuming we got rid of STARTTLS (the actual verb) and just always did TLS (say, on some other port), how do you propose to solve it?

<comment><USER27> Fortunately, we have an extensible protocol that already supports service advertising and negotiation. There's no reason we can't have an AUTH module that works both ways (both the client and server mutually authenticate, independent of the transport-layer encryption).

</comment></comment></comment></comment></comment></comment></comment><comment><USER28> Those who have taken a close look, how comprehensive is this? Any risk of downgrade attacks, etc?

<comment><USER29> "SMTP STS relies on the certificate authority (CA) system and a trust-on- first-use (TOFU) approach to avoid interception. The TOFU model allows a degree of security similar to that of HPKP [RFC7469], reducing the complexity but without the guarantees on first use offered by DNSSEC."

Also, can be used with DANE for additional security.

<comment><USER16> If, like me, you believe the only real-world adversary for large-scale mail transport between places like Google and Yahoo is state-level actors and dragnet surveillance, then deploying DANE _reduces_ your security, by tying you to trust anchors controlled by world governments.

DANE is generally a bad idea, and it's great that STS is explicitly proposed as an _alternative to_ it, not an _application of_ it.

<comment><USER26> The CA system already uses the DNS as a trust anchor, and will continue to do so as long as DV certs are the standard. DANE likely would not have enabled any form of attack that isn't already possible.

What DANE _would_ have done is end the madness that allows me to hack your wordpress blog for a day and then go get myself a certificate for your domain, for free, that doesn't expire for _three years_. A certificate you will never be able to detect the issue thereof and cannot easily revoke if you do.

And STS isn't an 'alternative' to DANE. The two are completely orthogonal

<comment><USER16> Arguments like this presuppose that the TLS security system is exactly as it was in 1999. But, of course, it isn't: major sites all pin certificates now, so that if you're well-equipped enough to subvert a CA and you use it to try to subvert a major site, there's a very good chance that literally all you'll accomplish is getting that entire CA blacklisted.

STS and DANE aren't orthogonal. DNSSEC/DANE offers such marginal value to HTTPS that the browsers that once offered pilot support for it have now eliminated that code; it is off the roadmap for the web. The remaining motivating use case for DNSSEC was SMTP security; DANE was a way to ensure that MTAs used secure transports and avoided downgrade attacks.

But STS does the same thing without requiring the forklift replacement of DNS that DNSSEC requires.

<comment><USER26> I don't know where to begin.

> Arguments like this presuppose that the TLS security system is exactly as it > was in 1999

For the majority, it is. The % of sites that deploy _all_ of the latest HTTPS bells and whistles, even just looking at the minority of sites that actually enable TLS, is in the low single digits. Only 8% of sites surveyed by Qualys SSL Labs... sites that are presumably run by people who care about security, unlike my bank, even bother to enable HSTS.

> major sites all pin certificates now

My bank doesn't. Enabling HPKP and HSTS is just risky from a commercial point- of-view. People aren't good at key management. If you botch it, you make your site inaccessible and you lose customers.

People screw it up all the time. I've done it. I was speaking to someone just today who was over-zealous with 'includeSubdomains' and made their product blog inaccessible (it was on a blog subdomain, which had an invalid TLS setup because wordpress.com don't support TLS on custom domains). It happens.

> if you're well-equipped enough to subvert a CA

Strawman, I never held this up as a threat. In any case, it's a bad defence of PKI. Being able to choose from N CAs doesn't help you. You only have to subvert _one_ CA to own the world, just like DANE, where an attacker only has to break your registrar, or the domain registry, and you're toast. The 'world governments' you fear have the capability and thensome. Irrelevant.

The threat I explicitly mentioned is that if I own your DNS, I can get myself a cert for you domain. This has the same same threat models as DANE (if "owning your DNS" involves me compromising your DNS server and getting your DNSSEC keys, or guessing your domain registrar password), except DANE doesn't depend on horrible, ineffective, and privacy-invasive, hacks like OSCP... or allow me to simply keep certificates for domains I no longer own. DNS caching effectively gives you the equivalent of OCSP stapling for free.

> major sites all pin certificates now

TLSA records have all the configurability and capability of HPKP and more, and can be applied to any protocol/endpoint. They even cross the isle to work with the CA system if you so desire, unlike HSTS+HPKP which has become hostile to anything self-signed.

> STS and DANE aren't orthogonal

They are. DANE relates to key-pinning via TLSA records, not HSTS.

> forklift replacement of DNS that DNSSEC requires.

DNSSEC is backward compatible. You're talking twaddle. Enabling it these days, if you control your own DNS server, also takes seconds. With EC digital signatures, it's even sensible. Setting up HPKP+HSTS+OSCP stapling is far more fiddley...and stuck in the RSA stone age.

<comment><USER16> TLSA records _do not_ have that capability, and, more importantly, the root of trust for TLSA records are organizations _controlled by the government_. The "Five Eyes" partnership can replace signatures for any DNSSEC domain in .COM, .NET, .ORG, .EDU, .UK, .AU, and .IO.

It seems crazy to me that, after years of hyperventilating about the implications of the Snowden disclosures, anyone could take DNSSEC seriously. But people do!

At this point, I'm just recapitulating things I've already written, so:

[http://sockpuppet.org/blog/2015/01/15/against- dnssec/](http://sockpuppet.org/blog/2015/01/15/against-dnssec/)

<comment><USER30> Your arguments does not make sense as a coherent whole. Any one may not be wrong in itself, but the problems described are either not inherent to secure DNS, or are something that is much worse with every other proposal (including keeping today's system).

1\. Your main argument is that the NSA and its cohorts have control over a handful of many top level domains available. But the same control that would allow them to take control over domains and generate valid DNS signatures for them does allow them to generate valid certificates in every proposed global PKI system, including today's. There is literally zero difference in attack space here.

2\. Several of the current CA institutions are under government control. Any one can generate a valid certificate for any domain. It can be done without a trace of evidence. The same active attack against a DNSSEC signed TLD would by necessity be much more visible.

3\. Given that DV PKI is what TLS relies on, any adversary that can modify DNS packets in-flight can also create a valid TLS certificate today. We know these attacks are taking place from the Snowden documents.

4\. An attacker can choose which CA to attack, and pick the one that is easiest to fool, does not participate in Certificate Transparency etc. There are literally hundreds to choose from. You can mount an attack in advance. Stuxnet suggests this is routine.

5\. There are no alternatives that solves what secure DNS does. Key pinning and HSTS is important, but offer a trust-of-first-use model that can at best be complementary to a PKI. It is also important to note that HSTS shares the same deployment problems DNSSEC does. One mistake and your web server and domain is inaccessible. That is the reason none of the banks offer neither HSTS nor DANE. At least my bank sign their domain, so their step should be small.

The smoke-and-mirrors argument that DNSSEC gives governments control over "their" top level domains, when in fact it makes the scope of their control much smaller and more well defined, would be expected from someone who wants to maintain status quo as long as possible.

<comment><USER16> I don't think many people want to read this deep into a tangent thread, so I'm going to keep my response very terse.

1\. It's not my main argument, but, no: when a CA misbehaves, it is blacklisted (Google's done this). Google can't blacklist .com.

2\. No. See FAQ.

3\. No. See FAQ.

4\. They can't do that if the certificate they're after is pinned. All they'll accomplish is getting the CA killed.

5\. The thing DNSSEC secures simply doesn't need to be secured, any more than the IP options header does.

<comment><USER30> 1\. That example is not very useful. It's hard to blacklist .com, but it's even harder to blacklist Verisign. (Which by the way runs all of .com, and they have full power to delegate any domain and any certificate to anybody. This is not a theoretical attack.)

2/3\. If you mean the FAQ you wrote yourself, it's misleading at this very point.

4\. Pinning is useful, but it isn't a PKI. It's equally useful no matter how you issue certificates.

5\. Domain name delegation are one of the Internet's weakest points today. Crypographic assurance of domain ownership would be very useful for a number of reasons.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER31> Finally!

</comment><comment><USER12> LOL...bunch of stuff why/why not with DANE when DANE really solves this...

</comment><comment><USER12> Postfix supports Dane

</comment><comment><USER12> Disadvantages When Used Without DANE

       When deployed alone (i.e. without a DANE record, and using Web PKI
       for certificate verification), SMTP STS offers the following
       disadvantages compared to DANE:

       o  Infrastructure: DANE may be easier for some providers to deploy.
          In particular, for providers who already support DNSSEC, SMTP STS
          would additionally require they obtain a CA-signed x509
          certificate for the recipient domain.

       o  Security: DANE offers an advantage against policy-lookup DoS
          attacks; that is, while a DNSSEC-signed NX response to a DANE
          lookup authoritatively indicates the lack of a DANE record, such
          an option to authenticate policy non-existence does not exist when
          looking up a policy over plain DNS.

</comment><comment><USER32> do the same for the fucking DNS protocol, which is clear-text, it's the weapon of choice for all surveillance/censorship freaks and nobody cares about. And by 'nobody' I am not referring to actual random Joe users, but you - <USER2> fucking mastermind developers who create stuff that nobody cares about, hosted on .io domains just because it is cool and looks like some start-up that's about the be the next big thing.

Please fix the DNS crap and you will be remembered in the history of those who gave a damn about totally broken stuff.

<comment><USER29> DNSCurve - [https://en.wikipedia.org/wiki/DNSCurve](https://en.wikipedia.org/wiki/DNSCurve)

<comment><USER32> you do realize that not even 0.001% of people use that, right? DNS has to be encrypted by default for everyone. As in client -> recursor. Without any 3rd party software.

<comment><USER33> Then you must ask the OS vendors to include it, not startup developers.

And in any case, encrypting DNS won't solve the surveillance issue, since the HTTPS handshake sends the domain in clear-text, so that the server knows which certificate to send ([https://en.wikipedia.org/wiki/Server_Name_Indication](https://en.wikipedia.org/wiki/Server_Name_Indication))

<comment><USER34> One could use a single certificate that is valid for all domain on the server

<comment><USER33> The client would still send the domain, since it doesn't known the server only has one certificate (the domain is sent in the first message, the ClientHello).

<comment><USER34> oh yes very true. Had not thougth of that.</comment></comment></comment></comment></comment></comment></comment>