Software Has Eaten Everything but Hiring Credentials, Why? - <AUTHOR> https://medium.com/@NewtrustFndtn/software-has-eaten-everything-but-credentials-why-dae3fd994b45 <comment><USER2> Boy, Tedium has eaten articles about the trouble that Tedium writers have hiring people.

Lesson: if you want to hire people, don't write for Tedium.</comment>


Zoom rolled their own encryption scheme, transmit keys through servers in China - <AUTHOR> https://citizenlab.ca/2020/04/move-fast-roll-your-own-crypto-a-quick-look-at-the-confidentiality-of-zoom-meetings/ <comment><USER2> Matthew Green's article on this is has a thread here: [https://news.ycombinator.com/item?id=22771193](https://news.ycombinator.com/item?id=22771193)

The Intercept article on it has a thread here: [https://news.ycombinator.com/item?id=22767807](https://news.ycombinator.com/item?id=22767807)

It's probably too much of a stretch to merge all these, because many comments are about specifics of those posts, and the ones that aren't are kind of generic and so maybe not worth merging anyway ([https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20generic%20discussion&sort=byDate&type=comment)).

<comment><USER3> Hi dang,

Thanks in advance for all your moderation efforts that make HN the site we all love to use on a regular basis.

I'm curious if you've ever considered writing a blog post about some of the things you've learned from your years of moderation? You spend so much time on HN, you must have seen lots of patterns and have lots of insights on...well, everything that gets posted on HN to everybody that posts on HN. I'd genuinely be interested in reading it if you ever did.

Cheers, a semi-anonymous HN user

<comment><USER4> While you wait for his response:

[https://www.newyorker.com/news/letter-from-silicon- valley/th...](https://www.newyorker.com/news/letter-from-silicon-valley/the- lonely-work-of-moderating-hacker-news)

<comment><USER5> _At first, the site attracted about sixteen hundred daily visitors, and Graham moderated and maintained it himself. Today, around five million people read Hacker News each month, and it's grown more difficult to moderate. The technical discussions remain varied and can be insightful. But social, cultural, and political conversations, which, despite the guidelines, have proliferated, tend to devolve. A recent comment thread about a Times article, "YouTube to Remove Thousands of Videos Pushing Extreme Views," yielded a response likening journalism and propaganda; a muddled juxtaposition of pornography and Holocaust denial; a vague side conversation about the average I.Q. of Hacker News commenters; and confused analogies between white supremacists and Black Lives Matter activists. In April, when a story about Katie Bouman, an M.I.T. researcher who helped develop a technology that captured the first photo of a black hole, rose to the front page, users combed through her code on GitHub in an effort to undermine the weight of her contributions.

The site's now characteristic tone of performative erudition—hyperrational, dispassionate, contrarian, authoritative—often masks a deeper recklessness. Ill-advised citations proliferate; thought experiments abound; humane arguments are dismissed as emotional or irrational. Logic, applied narrowly, is used to justify broad moral positions. The most admired arguments are made with data, but the origins, veracity, and malleability of those data tend to be ancillary concerns. The message-board intellectualism that might once have impressed V.C. observers like Graham has developed into an intellectual style all its own. Hacker News readers who visit the site to learn how engineers and entrepreneurs talk, and what they talk about, can find themselves immersed in conversations that resemble the output of duelling Markov bots trained on libertarian economics blogs, "The Tim Ferriss Show," and the work of Yuval Noah Harari._

Not sure whether to agree or disagree.

<comment><USER6> I find that the opposite is true. Most comments are emotional, and I have to search for controversial comments to find anything objective/worth reading. Like Reddit, this site is biased to the political left (USA). I wish we could just avoid all politics in tech.

<comment><USER7> I don't think it's possible to avoid politics in any profession. Teachers care about education reform, which is a political subject. Doctors care about the healthcare system, which is a political subject. Civil engineers care about building codes and safety regulations, which are political subjects. Accountants care about tax laws, which are an incredibly political subject. Social workers care about welfare programs, which is also a very political subject. You might not talk about it in the realm of politics while at work, but it has an impact on your work as well as the lives of the public.

You could even argue that being "apolitical" actually means that your political opinion is that the status quo is acceptable, which other people may disagree with. For instance, some people believe that selling water is unethical because it's a basic human need which you should always have free access to -- saying that the status quo is acceptable means that you don't think that for-sale water is unethical. There's nothing wrong with that opinion, but it is an opinion (and a political one at that).

<comment><USER8> I don't express my political beliefs here because I think I would be massively down voted. I think that's true for lots of other users.

<comment><USER9> The way it's presented makes a huge difference. People are obliterated for any political opinion if presented in a way that treats politics like a game instead of something that affects everyone.

Make a polite, clear-headed enough argument for something like eugenics and people will upvote you. It's troubling, but I can make a pro-socialism post under the same conditions. It's an uneasy peace.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> The serverside key handling stuff is bad, but generally known (Zoom has features whose natural implementation require them to keep keys serverside).

People are dunking on Zoom for rolling their own crypto and coming up with AES-128-ECB. This is also bad, but people should be aware that it's a lot more complicated than "you can see penguins through it".

You can see penguins through an ECB-encrypted bitmap because discrete blocks of the bitmap image repeat, and thus have the same ciphertext, and these correspondences carry obvious meaning in a bitmap. The same is not automatically true of video or audio data with normal codecs. Aaron Toponce points out that sensor noise will likely scramble ECB ciphertexts, for instance.

Colm MacCárthaigh makes an even more important point, which is that it's already very trick to reliably encrypt voice tracks, because common encoding and transmission techniques make them susceptible to traffic analysis. So, for instance, you can quickly find papers about exploiting silence suppression to make predictions about speech in an encrypted audio channel. The point here being, cryptanalytic attacks on ECB are unlikely to be anyone's first recourse.

Obviously, the 128 bit AES key thing doesn't really have any practical impact.

Designers should religiously avoid ECB mode, but the real danger of ECB is in interactive settings, where we as attackers get to _induce_ plaintext patterns, and use chosen boundaries to isolate targeted ciphertext. Bulk video and audio transmission isn't that kind of interactive setting. You still don't want to read people saying that ECB is OK; it's bad.

Essentially: it seems like Zoom's cryptography is bad, but not in a way that really matters compared to brochure-level badness of non-end-to-end- encryption.

<comment><USER11> Screen sharing a presentation is problematic; lots of discrete blocks of bitmap image being repeated.

<comment><USER12> If Zoom supports stock background filters or modes, that would seem to be another massive source of repeating plaintext, depending on the implementation.

<comment><USER10> I mean, it won't be, for the same reason 'tedunangst points out above. But even if it was: the repeats you'd be referring to would be leaking... stock background filters and modes.

</comment></comment></comment></comment><comment><USER13> This is honestly the best "Zoom is bad" summery I've seen so far. While I certainly believe some of the Zoom hate is blown out of proportion, this article does a good job explaining to someone who isn't a security expert what the issues are. I've been getting questions about the company from family and friends, and will be forwarding this to them. Well done.

<comment><USER14> This is a great article, but as an educational provider it fails to answer one question: Why should I care?

The only concerning thing for me is, why would they lie about using AES-256 when none of my users (and I assume most of their users) would care in any way about AES-256 vs. AES-128 in ECB mode. Why would they lie?

Even after this, having my users conducting university lessons over something that might be decrypted in China is honestly not that big of an issue. I would of course prefer it if these meetings would be private from the PRCs scrutiny but at least in my situation (and I think most educational contexts) this is not really that important.

<comment><USER15> Lets say these lessons are a politics seminar discussing whatever PRC finds objectionable, then family of the student back in the old country get their social credit score deducted.

Or even better use those recording in the future as compromat as needed.

<comment><USER16> I don't know how much free time they have over there, but snooping in on courses that a relative outside the country is taking and storing all of them... I mean, if you want to peg someone's social credit score, just stakeout their house and wait for them to spit outside or something. Hell, just make something up and dare them to come argue. Why go to all that effort?

<comment><USER17> Doesnt go exactly like that. More like: CCTV captures someone going to an area where known rebels or political activists live. (Look up videos on chinas face recognition, its insane.) Police decide to look through the person's zoom meeting transcripts, making a search on certain keywords. They find evidence of rebellious activities, and order further surveillance on the individual or arrest them.

<comment><USER16> In a surveillance state of the scope you've described, triangulating the zoom transcripts of an international relative's course work back to someone you spotted on CCTV is still hardly worth the extra trouble. At that level of erosion of civil liberties, they can already send the jackboots to break down the door when they make the CCTV match. Don't find anything? You plant something or coerce them into ratting on someone else. Why would you go mining terabytes of data that's mostly boring meetings and calls from grandma?

<comment><USER18> It's all take data collection and they mine it later. 10 years from now they go looking for video from you. And yes, if you don't think people have weird incentives and time on their hands, have a look at the shitshow of US Presidential politics.

</comment></comment></comment></comment></comment></comment></comment><comment><USER19> Using AES in ECB mode is clearly a bad choice, but honestly it's not that horrible for high entropy data like compressed audio/video. I'm sure someone could prove me wrong one day, but it seems hard to extract any useful patterns out of compressed audio/video. It does check the box of "uses encryption" for regulatory reasons (while missing the intent). It's pretty egregious considering how easy this is to get right.

The 128-bit key is not inherently wrong if they were rotating these out during the stream. That being said, there's no reason not to do it right and use a mode like GCM with a longer key - most hardware supports acceleration for AES-256 these days. It can actually be slower to use a 128-bit key on 64-bit systems.

While I respect the decision not to disclose the waiting room vulnerability, it's pretty obvious what's going on given the context. They probably shouldn't have mentioned where the vulnerability is.

I'm honestly surprised anyone with technical knowledge thought that Zoom was actually doing end-to-end encryption given how the software works. All of the video transcoding/downconversion is clearly happening on the server. Your client is not sending multiple compressed streams for varying connection bandwidths. That's the main reason a lot of people like Zoom - it actually works well with dozens or hundreds of participants.

<comment><USER20> > Using AES in ECB mode is clearly a bad choice, but honestly it's not that > horrible for high entropy data like compressed audio/video. I'm sure someone > could prove me wrong one day, but it seems hard to extract any useful > patterns out of compressed audio/video.

...you're joking right? The Wikipedia example for why ECB is not recommended is literally an image:

[https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation](https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation)

Edit: This applies to compression too. Please refer to Shannon's source coding theorem.

<comment><USER19> It's definitely a terrible choice for _uncompressed_ images or video. I'm arguing it _probably_ isn't that bad for highly compressed video. That being said, if you're encrypting any data stream you should use an appropriate stream cipher.

<comment><USER21> If the encryption scheme is poor, why would the data being compressed or not matter?

<comment><USER22> Compression already makes a compressed file roughly indistinguishable from random noise (module access to the decompressor). So the patterns have been removed.

That doesn't make this _good_ , but it means that one specific example isn't immediately applicable.

<comment><USER23> There's more in the stream than just compressed data. There'll be metadata info that you can make reasonable guesses about. ECB mode lets you take that information and apply it to other blocks in the ciphertext.

<comment><USER24> This thread is an _excellent_ illustration of why you don't want your encryption implemented by merely good coders. You need people who know what they are doing.

<comment><USER22> I'm literally one of those people who "knows what they're doing". This is the problem with discussing ECB on an online forum. There's no space to have a nuanced discussion without people cargo culting "ECB bad" over every comment.

Yes, ECB is almost always the wrong choice. Yes, there are other ways it's going to fail in this use case. Yes, compression before encryption itself often enables other attacks. No, I should not have to prefix a comment about ECB with this type of disclaimer when I'm making (what should be) an uncontroversial statement that the tux attack doesn't directly apply to compressed image data.

Ironically, when designing a protocol for my company, one of the reasons we _didn't_ use ECB when it would have been entirely justified (each chunk of data was precisely one block in size and keys were only ever used once) was because of potential backlash from people who only know "ECB bad" and nothing more.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> "Zoom, a Silicon Valley-based company, appears to own three companies in China through which at least 700 employees are paid to develop Zoom's software. This arrangement is ostensibly an effort at labor arbitrage: Zoom can avoid paying US wages while selling to US customers, thus increasing their profit margin. However, this arrangement may make Zoom responsive to pressure from Chinese authorities."

I'm not here to defend zoom but any and all companies that can do this have and are doing the very same thing to minimize costs. It's not great but it's the expected way of managing a software company in 2020. It would be hard to do business otherwise.

Whether it's good or bad that's a question that will need to be reexamined given the current situation.

</comment><comment><USER26> Given Zoom is blocked in China, what reason is there for the main key server to be there?

Even ignoring the appearances, for latency and the fault tolerance reasons, China is the last place you'd want to put it a critical server for an app used in the West.

<comment><USER27> Zoom is no longer blocked in China.

</comment></comment><comment><USER28> I really don't think this counts as rolling your own crypto. They just used a weak implementation of existing methods.

No more rolling your own crypto than if I were to use DES.

<comment><USER19> I agree - all security is assembled from lower level primitives and can be insecure despite using good building blocks. AES (even AES-128) is a fine choice, ECB mode is even okay in some contexts, but using that a stream cipher is not appropriate.

<comment><USER29> Definitely. Some other places (I think Telegram iirc) do actually create their own encryption algorithms without using existing ones. That's what I thought rolling your own crypto scheme was. If the problem with Zoom is that they chose a poor mode for the algorithm, why doesn't the headline say that? Creating your own encryption algorithm is way worse.

If rolling your own encryption scheme is just choosing what algorithm you use — every system does that. So it's not headline worthy. :/ I get that zoom needs to make better choices, but the rhetoric around it has been pretty poor and unhelpful.

</comment></comment></comment><comment><USER30> > Zoom's most recent SEC filing shows that the company (through its Chinese > affiliates) employs at least 700 employees in China that work in "research > and development."

Wow. What could all of these people possibly be doing? It can't be development and QA; what's going on over there?

<comment><USER31> You do realize development include software engineering, right? 700 people doing programming isn't even remotely surprising.

Not to defend them against the recent security fiasco, but innuendos such as this that links "employees working in China" directly with "shady business" makes me at least uncomfortable.

<comment><USER32> I didn't read it as suggesting it was "shady business". I read it as an insinuation that the company didn't know what it was doing from the top down, so they didn't hire smartly or manage well; they just threw numbers of people at the problem (and got predictably bad results).

With good management, a team of 50 should be able to provide what Zoom provides.

<comment><USER31> Yeah, moments after replying I realized there is a more charitable read :-)

Of course, with this read comes the age old question of "I can build Google/FB with 20 good men, what are they doing?"

<comment><USER33> > Of course, with this read comes the age old question of "I can build > Google/FB with 20 good men, what are they doing?"

Well, this would explain Google's pattern of constantly churning out new products on the theory that hey, maybe someone somewhere wants it.

If you need 20 people to run your actual operations but you've hired 20,000 people, what are the other 20,000 people supposed to do?

</comment></comment></comment></comment></comment><comment><USER34> >However, this arrangement may make Zoom responsive to pressure from Chinese authorities.

Zoom doesn't even have to be responsive to pressure, just a developer has to be. And they live there so yah they'll be understandably responsive.

</comment><comment><USER35> Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these days are like this.

If you "waste" time on the real important stuff such as a good design, user security, or the like, you will lose over to a competitor who didn't and therefore was able to spend more time on marketing.

If you waste your time on user privacy you will be totally crushed by that competitor whose definition of "privacy" was "how much can I pester this user until he gives me access to his address book so I can spam his friends?".

I don't think this is good. I think this is very sad. But it is what it is.

I still remember the Whatsapp founders coming into the jabber mailing lists with "please let me configure my server"-type questions, for god's sake.

<comment><USER36> This is a bad point. The difference between using AES-128 and AES-256 from a code standpoint is trivial. The only explanation for this is either gross incompetence or malevolence. Personally I don't use Zoom, nor would I recommend its use for even personal conversation.

<comment><USER37> the difference is a copy and paste from an older StackOverflow post.

<comment><USER36> Using code without understanding its implications would fall in the gross incompetence category.

<comment><USER35> And my point is that this happens all the time. Natural selection seems to favor the type of company that would just copy&paste from SO (then spend their resources on some fancy viral marketing) instead of the one that would stop to think about it.

<comment><USER38> People shouldn't be surprised, but they _should_ be upset.

</comment></comment></comment></comment></comment></comment><comment><USER39> Why can't people bother to construct a minimally secure encryption system given that there are so many good documents and code examples out there?

I don't mean anything with ratcheting, forward secrecy, replay protection, nonce reuse resistance, or any other bells and whistles, just basic competent symmetric encryption without gaping holes or ridiculous bizarre design choices?

It's not hard!

(1) Generate 12 bytes of random nonce using a good secure random source, prepend to message.

(2) Use nonce to initialize AES-GCM.

(3) Run it through AES-GCM, append tag.

(4) Done.

That's not hard and it's secure enough for common use cases.

<comment><USER19> The only thing I can think if is that _maybe_ the protocol Zoom is using precludes prepending the nonce due to the packet format. But surely there's some way to do this with packet counters and user IDs. It's possible this was an intermediate step but I'm really stretching for excuses here.

<comment><USER39> Yes you can construct an IV from other state, though it's not ideal. Another good fit might be modes designed for disk encryption as those are designed for cases where you can't pad (e.g. disk blocks).

There's also AES-GCM-SIV and its relatives which construct the nonce from a MAC of the plaintext and _technically_ do not require a separate IV, though if you don't use one any duplicate message will be obvious.

Those are somewhat more complex but honestly even if you don't get those perfect it's almost definitely better than ECB.

</comment></comment></comment><comment><USER40> Was this done in the interest of convenience, as most Zoom appologists have been clamining?

<comment><USER39> This looks like either incompetence or intentionally weak crypto.

<comment><USER19> I agree, it's probably lack of appropriate expertise. There are much more subtle and useful ways to make this intentionally weak (like subtle nonce reuse with GCM). Or just giving Chinese authorities access to the key like the article implies.

</comment></comment></comment><comment><USER41> Is it possible that China is actually gleaning foreign IP from Zoom customers?

<comment><USER42> Is it possible that China is actually part of routable public Internet at all?

Should ICANN give each assigned IP block a flag to indicate whether it's capitalist or communist, so vendors can connect more carefully?

</comment></comment><comment><USER43> always wondered why zoom.us url not zoom.com which they both own.

it's basically to give the perception it's US company and assumed trustworthy.

<comment><USER44> It is a US company. It's a US Public company.

</comment></comment><comment><USER45> Keynote:

 _Zoom's encryption and decryption use AES in ECB mode_

<comment><USER46> Jesus, that's a textbook example of a bad encryption mode.

<comment><USER47> Makes you wonder how someone could approve that pull request...

<comment><USER48> It's possible it comes from a corporate culture that is focused on ease-of-use over security. This is not the first time that they've done some questionable things to reduce friction. See for example [https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac- pa...](https://www.theverge.com/2019/7/9/20688113/zoom-apple-mac-patch- vulnerability-emergency-fix-web-server-remove), where they installed a secret webserver to save Mac users a single click.

</comment></comment></comment></comment><comment><USER49> Could we fix the title of this post please? There is a GULF of difference between 'transmit keys through servers in China' and the actual text from the article, " We suspect that keys may be distributed through these servers."

Implication is fine, but it should not be declarative without proof.

<comment><USER50> The article is quite direct: key directly sent to client in USA directly from a server in china. what is unclear?

<comment><USER49> Have read the whole article myself, I did not see that explicitly stated. Could you provide the quote?

<comment><USER51> > In addition, we identify potential areas of concern in Zoom's > infrastructure, including observing the transmission of meeting encryption > keys through China.

<comment><USER49> Thanks! Indeed that was in their opener, but their clarifying statement is broader.

FTA "We suspect that keys may be distributed through these servers. A company primarily catering to North American clients that sometimes distributes encryption keys through servers in China is potentially concerning, given that Zoom may be legally obligated to disclose these keys to authorities in China."

"We suspect" is not the same as "we are certain".

<comment><USER48> They observed keys being transmitted to Chinese servers, which makes them to suspect that Zoom is distributing keys via these servers. They have worded this very carefully to avoid claiming something that they cannot confirm (distribution to multiple users).

</comment></comment></comment></comment></comment></comment><comment><USER52> Is there any reasonable explanation for why this scheme was designed in this manner?

<comment><USER19> It's possible some protocol issues prohibit the use of other stream cipher modes like AES-GCM. I can't think of any but maybe:

* Dropped packets/out of order packets. You should be able to include the IV/counter with the packet but maybe the protocol prohibits that.

* Avoiding reusing counters between participants - seems like you could just use the participant ID as part of the counter and avoid this

* Concerns about partial packet loss - shouldn't happen with UDP and GCM would handle this just as well

I'm trying but I can't think of a good reason to do it this way.

</comment></comment><comment><USER53> If I were to design a video conference platform my focus would be usability, video quality, speed.

Because those are the things that matters to end-users; if it gives up some security because there is a server somewhere that decrypts, converts and reencrypt the traffic then that is a trade-off but so be it if the goal is to create a popular widely used platform.

</comment><comment><USER54> What'd I tell you? This is either malice, or sufficient incompetence as to be indistinguishable from malice.

</comment><comment><USER55> Zoom deserves a lot of animosity for its _privacy_ issues like sharing data with Facebook.

On the other hand I am mystified by all the security hype. Yes I might be able to guess a Zoom meeting ID, just as if I might guess your phone number and prank call you. In a Zoom meeting _you can see who is connected_. In the old days of conference calls do you remember asking "who's on the line?". What are you talking about that requires encryption?

If so there are tools for that - signal, etc.

<comment><USER56> > What are you talking about that requires encryption?

The UK are using it for Cabinet meetings - [https://www.bbc.co.uk/news/technology-52126534](https://www.bbc.co.uk/news/technology-52126534)

<comment><USER28> > In a crisis, communication at speed is the priority.

And UK officials say the risks of not communicating in the middle of fast- moving events far outweigh the possible security risks of using such a system.

They add most government work to do with the coronavirus is unclassified and anything highly classified is communicated over secure systems

Government meetings use the paid-for version of the system and are password protected to prevent "Zoom-bombing", when uninvited individuals intrude on calls.

The UK Ministry of Defence also said Zoom should not be used for classified conversations.

And it is understood Nato's policy not to use Zoom for any meetings, briefings or conversations between member state ambassadors if classified or sensitive information is shared.

Nato staff are understood to be using "more stable and secure" means of communication.

=====

They seem to be perfectly well aware of their threat model

</comment></comment></comment><comment><USER57> Just out of curiousity I decided to check for a particular representation on the Zoom website. There must be some "magic" in these words because so many tech companies use them.

" _We take security seriously_ and we are proud to exceed industry standards when it comes to your organizations communications."

[https://zoom.us/security](https://zoom.us/security)

</comment><comment><USER58> Just a pet-peeve here: I am well aware if the CCP and how they run things in China as well as their hostilities against the west. But sending traffic or anything to or through China in itself is not a security risk. If the data goes through the US and you are european, whatever protocol weakness exists should also worry you because of possible network and server-side adversaries in the US.

"China" is a threat not a vulnerability is all I meant, and using it for hype- training seems dishonest.

I've had meetings with people in different companies using webex,goto meeting,skype , zoom,teams and hangouts. I found hangouts to be the most worrysome with regards to privacy (not security). A lot of the issues that keep popping up about zoom this week might also apply to the others (looking at you webex!).

Zoom became popular because you can see everyone's video all at once. They had a betterr product. Vulnerabilities don't make a product bad, how you handle them does! If anything, I would like someone to show me how the free security audit zoom received by the hype crowd this week does not make it a superior alternative (provided they continue patching it).

</comment><comment><USER2> The Intercept article about this has a thread here: [https://news.ycombinator.com/item?id=22767807](https://news.ycombinator.com/item?id=22767807)

</comment><comment><USER59> On Ubuntu would installing Zoom via Snap be preferable than as a normal package when it comes to security / sandboxing, should the case be that they turn evil?

<comment><USER11> Yes, that would be vastly preferable. Normally, the client would still have access to quite a bit (Lots of $HOME for example, minus security sensitive files). It would be possible for the packager to turn off that access too and completely lock it down, turning off those interfaces and providing a fake $HOME etc. A good reason for the packager to not be Zoom Corp, but getting a distribution license might be tricky.

</comment></comment><comment><USER60> Is there any validity to the claim from earlier in the week (comments here on HN) that they Have engineers based out of China and it's essentially tied to the CCP?

</comment><comment><USER8> I didn't use Zoom. What advantages does it have over Microsoft Teams, Webex or Skype?

</comment><comment><USER61> Looks like Zoom to video conference security is like Flash to web browser security.

</comment><comment><USER62> Is it possible to use Zoom on Linux from an ordinary user without sudo rights?

<comment> a-nikolaev I just downloaded their binary build and it worked without sudo (you need to run "ZoomLauncher" file).

That being said, I did not get the impression of an easy to use app that "just works" (at least with my tiling window manager), things were confusing, clunky and rather idiosyncratic (e.g. sharing a screen was weird, and the whiteboard did not work).

<comment><USER62> Did you use it to talk to someone? I ran it too, but wanted to make sure it really works without being installed.

<comment> a-nikolaev Yeah, I used it for calls, did not install anything.

</comment></comment></comment></comment><comment><USER63> Zoom has betrayed us all! Congress must require zoom to explain why they are sending encryption keys to China when all participants are USA citizens. Zoom is betraying USA citizens and their customers. We must pressure USA zoom execs to explain exactly why they are doing this.

</comment><comment><USER64> And this is why you don't use unproven apps that come out of nowhere simply because they are "popular."

</comment><comment><USER65> A Chinese founder cooperating with Chinese government is not something to be critical about, there is different political perspective.

</comment><comment><USER66> [https://classicprogrammerpaintings.com/post/148027314949/we-...](https://classicprogrammerpaintings.com/post/148027314949/we- rolled-our-own-crypto-pieter-bruegel-the)

</comment><comment><USER67> Zoom just works great ... just focus on making a better product (aggh Google Hangouts) than hyping up the hysteria by adding China to the mix.

It is rather suspicious to see all the articles of late.

<comment><USER68> Nothing suspicious.

Zoom is in the news lately, so there are more researchers and others looking at their security practices.

Bloggers know that they'll get clicks by writing about Zoom.

China is just thrown in since they're the Boogieman in the US these days.</comment></comment>


Groupon Clone Generator - <AUTHOR> http://grouponclone.contussupport.com/ <comment><AUTHOR> Couldn't believe this was real...</comment>


A Skeptic Looks at Alternative Energy - <AUTHOR> http://spectrum.ieee.org/energy/renewables/a-skeptic-looks-at-alternative-energy/0

<comment><USER3> That's probably one of the best articles I've read on the real nature of 'alternative' energy in a while.

My rule of thumb is simple : if someone calls it 'Alternative Energy', it means it's an alternate to having a cheap, ready supply of energy. Otherwise, it would just be called 'energy'. Nobody calls Nuclear power alternate energy, even though it's radically different to anything else that came before it in terms of generating power.

The percentage of power generated from wind globally, currently, rounded to the nearest decimal place is zero.

Trillions of dollars have been spent on windfarms and solar panels around the world, and, as the article notes, it has made zero difference to the overall energy mix. Yet it has affected national economies in real ways - <USER2> bankruptcies in Germany, Spain and elsewhere have real costs, as does taking the most basic economic input - energy - and making it more expensive for zero environmental gain at the global level. Despite the countless examples of failures to point to, the boosters insist that it's the right course, when any plain analysis shows the exact opposite.

There are plenty of people who hand-wave around the very real problems as outlined in the article, and say things like 'give it time, it will work out'. But you have to be a starry-eyed believer who trusts in state-coerced solutions to gloss over the myriad of problems of trying to jump-start essentially niche technologies into mainstream adoption.

It takes real courage to rely on human ingenuity to solve problems and come up with solutions. It's frightening to look at an issue and realise you have no answers at all.

But what's worse is to set off on a futile and damaging strategy just to be seen to be doing something, when that thing is ineffective at best, and damaging at worst due to the self-delusion inherent. This holds at the personal, family, business, state, national and global level.

<comment><USER4> > The percentage of power generated from wind globally, currently, rounded to > the nearest decimal place is zero.

This is just not true. I'm not sure what it is globally, but in the US it's several percent (which is not zero percent under any rounding I'm aware of). More to the point, it produces more than 10% of the electricity in five U.S. states. It's also the fastest-growing energy source in the world, even faster than natural gas.

> Trillions of dollars have been spent on windfarms and solar panels around > the world, and, as the article notes, it has made zero difference to the > overall energy mix.

Nowhere near "trillions of dollars" have been spent on wind farms. You're just making things up.

> Yet it has affected national economies in real ways - the bankruptcies in > Germany, Spain and elsewhere have real costs, as does taking the most basic > economic input - energy - and making it more expensive for zero > environmental gain at the global level.

The bankruptcies in Germany, Spain, etc, are the fault of alternative energy?

> Despite the countless examples of failures to point to, the boosters insist > that it's the right course, when any plain analysis shows the exact > opposite.

The analysis of the "skeptics" almost always leaves out the vast externalized costs of traditional energy sources. E.g. if hundreds of billions of dollars of externalized costs from coal were factored into the price of coal, coal power would be more expensive than wind power: [http://www.huffingtonpost.com/dave-cooper/harvard-study- coal...](http://www.huffingtonpost.com/dave-cooper/harvard-study-coal-costs- _b_831755.html).

> But you have to be a starry-eyed believer who trusts in state-coerced > solutions

There is nothing starry-eyed about the economists who point out that the free market naturally underproduces fundamental R&D. Pick up an Economics 101 book sometime.

<comment><USER3> \- Globally wind power produced < 0.5% of energy last year. Most people forget, or don't realise, that the current obsession with alternative energy is limited to parts of Western Europe and parts of the USA. It has virtually no traction elsewhere in the world.

\- You're right, I should have written billions instead of trillions, though I'd be surprised if it hasn't reached a trillion by now. It's still an insane amount of money.

\- Bankruptcies in Germany and Spain by solar companies are very much the cause of bad policies - by pumping up a sector with unsustainable subsidies, then being forced to remove subsidies precisely because they are unsustainable. This creates a bubble into which resources rush, which then bursts and creates a lot of problems.

This is the fundamental problem, of trying to coerce a particular set of technologies into place when they aren't suitable for it. The correct response is to admit there is no current technical solution to affordable energy without burning stuff. There is a noisy subset of people who don't agree with this position, and that's fair enough. History has always proven that major advances come from unexpected areas, and tend to render prior technologies obselete almost overnight.

<comment><USER5> These comments are not necessary exclusive. Parent said electricity while brc indicates globally wind power produced < 0.% of <energy>.

Of course, no thermal plant has been built in the US in the past 50 years without some subsidies -- both direct and indirect. So, it's a bit of a red- herring argument.

<comment><USER4> The "no subsidies" bit is really a massive red-herring.

Even without taxes, fossil fuels are hugely subsidized. The lack of effective legal frameworks to prevent e.g. coal plants from shifting the inherent costs of coal power onto people in surrounding neighborhoods is an implicit subsidy. Letting them shift $100 of environmental damage onto the residents of West Virginia is exactly the same as giving them a $100 check.

</comment></comment></comment></comment></comment><comment><USER6> The future of energy is natural gas. End of story.

Alternative natural gas production -- "fracking" generally -- has been researched, prototyped, implemented, and grown over the past 15-20 years to the point where one can reasonably envision a future where natural gas displaces coal and crude oil to become the most important energy sources in the world.

It emits way less carbon than coal or oil, it is everywhere, it can be liquified relatively cheaply and transported around the world by super tanker, people are less afraid of it than nuclear power, and the technology to actually use it has been around forever. Electricity...home heating...hydrogen fuel cells...all easy with natural gas.

As a general rule, when The Economist publishes a 14-page spread about something, it's pretty much hit the mainstream. They did that 2 weeks ago. <http://www.economist.com/node/21558432>

<comment><USER7> How much natural gas is there, and how long will it last?

<comment><USER8> The near future of American energy is natural gas. Are you telling me that somebody knows what's going to happen after that?

<comment><USER6> Fair enough.

</comment></comment></comment></comment><comment><USER9> 3 immediate flaws:

He ignores completely hydro and geothermal power. They help Iceland (100%) and New Zealand (77%) amongst others to near complete sustainability for electricity generation.

While mentioned, the cost of co2e emissions from gas is glossed over. Charge the true economic value for emissions and hydrocarbon sources are going to be wildly more expensive.

He criticizes China for unfairly subsidizing wind on the one hand (their solar story is amazing btw) then complains China is building too many coal plants shortly thereafter.

<comment><USER3> NZ and Iceland are tiny.

Iceland has a total population of 319,000.

NZ has a total population of 4.4m.

Both are situated on active volcanic areas.

Iceland is a geologically new island formed by the spreading of the mid- atlantic ridge.

NZ is basically a giant mountain range sticking out from the bottom of the ocean, in a climate where it rains and snows, a lot.

They are interesting cases in using technology to generate power both at low cost and minimal environmental impact, but in no way at all are they models for the rest of the world.

An externality can't be costed because there is no way to know the cost. You can only model it. As there is no way to validate the model, you end up with many competing models with no way of knowing which one is correct. As such, you can't give an accurate price.

<comment><USER10> Borehole geothermal is possible too. Basically, find a large, hot mass of rock close to the surface, drill down a couple of kilometres, pump water down and get steam out (typical temp is ~200-300C).

That's in Australia, known for its geological stability, lack of active volcanoes, etc.

<comment><USER11> In _theory_.

In practice nobody has managed to produce a commercial-scale plant that actually does that.

For example: the deeper the borehole, the more noticeable the effect of tectonic drift.

<comment><USER10> Drift? Not in Australia. Even in other parts of the world, most of the boreholes are proposed in large granite masses (they're hot because of radioactive decay as well as conduction) which are relatively static.

Mostly it's just an issue of getting enough investment to get a plant off the ground - there's no major technical impediment involved.

<comment><USER11> Yes, even in Australia. We're very stable by geological standards, yet we still have minor fault lines and the whole plate is still moving north.

When your borehole is kilometres deep it only takes a tiny amount of drift to start breaking stuff all up and down the system.

And superhot steam is not exactly a friendly substance to begin with.

The main company who've been working on the Australian deep-drilling geothermal problem is Geodynamics. And they have been at it for years and years. They've consumed tens of millions of dollars and have, so far, not successfully produced a deep-geothermal plant.

It's just not as easy as people make out.

<comment><USER12> >And superhot steam is not exactly a friendly substance to begin with.

Don't pretty much all power sources use "superhot" steam to turn turbines? What's special about this steam?

<comment><USER11> It's dirty.

Laugh if you like; but the stuff used in stationary plants isn't full of an unpredictable cocktail of dissolved minerals and hydrocarbons.

Truthfully I am not across the detail of the problems with deep boreholes.

I _am_ however across the fact that it hasn't worked yet. And we're talking stuff that Very Intelligent People With A Lot Of Funding have been working on for quite a while at this point. And they don't even have a working proof-of- concept plant working yet.

Deep borehole geothermal sounds great on paper, but the engineering challenges are enormous and yet to be surmounted. By comparison oil, gas and _especially_ coal are absolute doddles with work with.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER13> Clean energy is expensive, takes a long time to build, and introduces more problems, but we have no other choice! We can either suffer the consequences of global warming or try to avoid the worst of it. Sticking with fossil fuels is not a choice unless we can somehow make them out of C02 we remove from the atmosphere for that purpose. All the choices we could make to deal with the global energy crisis are terrible, we have to pick the one that hurts the least. We can hurt the economy and stop burning fossil fuels, or we can take almost certainly catastrophic risks with the only planet we have to live on.

People love to blame China, but they are polluting to make goods we then import in many cases and are not responsible for squandering the giant fossil fuel inheritance of the modern age. Of course they may wish to get their share of what remains as long as everyone else is burning it anyway.

<comment><USER14> > Clean energy is expensive, takes a long time to build, and introduces more > problems,

And doesn't exist. Nuclear power is the best option, with natural gas second. Everything else is too small to matter.

<comment><USER13> A back of the envelope calculation shows that solar and wind power can both be useful components of an overall energy solution ([http://physics.ucsd.edu/do- the-math/2011/12/wind-fights-sola...](http://physics.ucsd.edu/do-the- math/2011/12/wind-fights-solar/) also see David MacKay's excellent book free online <http://www.withouthotair.com/>). Ultimately, solar is more abundant than wind and is sufficiently abundant that it can be useful in dealing with the energy crisis. But, I don't care, I want any plan that adds up. Solar and wind could be a piece of such a plan so I don't rule them out. Fission is very attractive as well, especially for baseload power. None of these things solve the liquid fuels crisis and there is no sign that we are building ANY of them on a sufficient scale anyway, so we are probably doomed to play dangerous games with the earth's climate.

</comment></comment></comment><comment><USER15> I started reading it and admiring their attention to detail with the first two charts. Extremely clear and informative:

[http://spectrum.ieee.org/img/07OLAltEnergytechfig3-134088965...](http://spectrum.ieee.org/img/07OLAltEnergytechfig3-1340889659713.jpg)

Then it went down hill fast, culminating in stuff like this:

[http://spectrum.ieee.org/img/07OLAltEnergyFigIcon3-134012678...](http://spectrum.ieee.org/img/07OLAltEnergyFigIcon3-1340126783409.jpg) and [http://spectrum.ieee.org/img/07OLAltEnergyFigIcon5-134020183...](http://spectrum.ieee.org/img/07OLAltEnergyFigIcon5-1340201830000.jpg)

Edit: spelling.

<comment><USER4> I'm not sure what to make of that last chart... it's showing wind power increasing from 0.09% to 2.91% in only 20 years (which is the blink of an eye in an industry that moves as glacially slow as electricity production--Chicago just this year shut down a couple of coal plants that were over a century old). If the trend holds up then in another 20 years alms tall our electricity will be produced by wind!

<comment><USER16> I think his point about that is that promises of renewables replacing traditional sources in ten and twenty year time-frames (such as the proponents he cites) is wildly optimistic. I think the time frames to adoption and ramp- up to significant share are his main points of contention, via a vis boosters of renewables as solution to our energy problems.

<comment><USER4> It seems like a very "neener-neener" argument to me. Okay, so what, proponents of wind and solar a decade ago were overly optimistic about how quickly such technologies would take over. NASA scientists also thought we'd be going to Mars by 2025. What does that prove?

At the end of the day, the installed capacity of wind power has tripled in just the last several years. The price of solar panels has fallen through the floor. A number of U.S. states are seeing immediate local benefits from supplying > 10% of their electricity through wind power. I'm not quite sure why "% of global electricity consumption" is the only salient metric. Even if Texas's gas guzzling keeps the overall % low, Iowa still has cleaner air by supplying 14% of its electricity needs through wind power.

<comment><USER16> > NASA scientists also thought we'd be going to Mars by 2025. What does that > prove?

We don't _have_ to go to Mars tomorrow. We _do_ need energy right now. Panel prices have fallen through the floor, but panels are only one component in the PV energy production cycle. He cites that residential PV production cost per kW/h hasn't changed significantly since the 2000's. (~¢30 sunny and ~¢60 cloudy areas) traditional production means average 11 to ¢12 kW/h.

>A number of U.S. states are seeing immediate local benefits from supplying > 10% of their electricity through wind power.

That's definitely a positive outcome, but an investment in anything will bring jobs (tearing up roads and repaving). I think he's trying to find out it it makes economic sense to invest in wind power versus something else. I think it's debatable, at least. He might be proven wrong, but so might others.

>I'm not quite sure why "% of global electricity consumption" is the only salient metric

I think it's because his main point is about trying to prevent going over the 450ppm of CO2 in the atmosphere --which isn't regionally manifested but globally manifested.

</comment></comment></comment></comment></comment><comment><USER17> HN is not good with discussing these kind of articles. Far too many armchair experts. At least with the programming articles you get the occasional comment from someone who really knows something. Here its just a lot of noise.

<comment><USER8> Instead of any sort of useful statement _about_ the article, what's this? A thinly-veiled appeal to authority, simultaneously claiming that I am the weak link in this thread? Yes please...

<comment><USER17> I don't understand your point. Is there a rule against discussing the discussion? Its not appealing to any authority or claiming anything of the sort you describe - you are putting words in my mouth...

</comment></comment></comment><comment><USER18> The article notes that the total CO2 emission from India and China is rising and crossing the US. This is true but the per capita emission is still a fraction of that of US[1]. It will be impossible for China and India to compete if they aren't allowed the same per capita emission as the developed world. Per capita the US CO2 emission is huge.

[1] [http://data.un.org/Data.aspx?q=co2+emissions+per+capita&...](http://data.un.org/Data.aspx?q=co2+emissions+per+capita&d=WDI&f=Indicator_Code%3aEN.ATM.CO2E.PC%3bCountry_Code%3aCHN%2cIND%2cUSA%3bTime_Code%3aYR2008&c=1,2&s=Country_Name:asc&p=Time_Code&v=1)

<comment><USER16> I don't think his main point was to compare per capita emissions but to illustrate the futility in deploying comparatively costly alternative energies when the great majority of new energy production is "dirty".

<comment><USER5> Though, his op/ed was devoid of any data regarding cost.

</comment></comment></comment><comment><USER19> This article article is ridiculous. He acts as if alternative energy sources must be cheaper than our current energy sources to be worthwhile. Of course alternative energy sources cost less, if they didn't we wouldn't be having this discussion. There would not be much of a need to worry about co2 emissions.

But in fact we do live in a world where co2 emissions are an issue. The author more or less acknowledges this and then simply ignores it. What exactly is he proposing as an alternative? Nothing. If we are to avoid the worst effects of global warming we're going to have to pay a price.

Furthermore he then goes on to completely paper over the fact that costs have been dropping significantly. The numbers that he sites for solar prices come from here: [http://www.solarbuzz.com/facts-and-figures/retail-price- envi...](http://www.solarbuzz.com/facts-and-figures/retail-price- environment/solar-electricity-prices)

Solar module prices have dropped 50% over the last decade. Working backward from the numbers on solarbuzz that would mean that a residential scale system's price has dropped 25%.

And by cherry picking the prices for a residential scale installation (28.9 / 63.1 cents per kwh) he ignores the fact that industrial scale systems are much closer to parity. The price for these systems is half of that 15.15 / 33.3. And these numbers have been declining. While the age of mass scale decentralized solar generation may not be here yet, the age of solar may be here much sooner than the author would like to admit.

</comment><comment><USER20> There can be no denying that solar panels and other alternative energy sources _are_ an extremely good long-term investment for those who own homes or brick and mortar companies. Don't let any amount of "skepticism" fool you into thinking it is not a good investment.

<comment><USER21> I won't inconvenience you with the facts, then

<comment><USER20> approx. 8 year payoff (to break even with what you would have paid for utility bills) with around a 30 year lifespan at least...4x ROI. How is that a bad investment??

<comment><USER3> Because it relies on someone overpaying you for the electricity produced, which is added onto someone elses' bill.

In a democracy, that's not sustainable. Sooner or later, someone will get voted in that promises the remove the subsidy.

Indeed this is happening all over the world.

It also leads to resource misallocation whereby time + money + manpower is spent farming subsidies over other productive activities.

If your example is for an unsubsidised installation, then it's a good ROI. Otherwise, it's a bad idea as well as morally questionable. The poorer members of society shouldn't pay more for basic energy to make richer members get excessive returns.

<comment><USER5> You assume specific aspects regarding the regulatory environment for the parent. Are you sure that they're talking about a full-NEM style arrangement like found in California, or is it something akin to Australia (or Wisconsin) where you're credited at avoided cost for exports to the grid?

I strongly agree that subsidies distort markets (usually to the detriment of society). However, with energy, emerging technologies are competing with incumbent technologies with a host of direct and indirect subsidies.

Regardless, for the parent -- solar isn't always a good investment. You need sunny areas with high electricity prices. While this is found frequently, it is not ubiquitous.

<comment><USER3> Most of Australia has had what are called 'FiT' or 'Feed in Tariff'. This was a price above and beyond the retail price of electricity that was paid for solar panel owners.

It varies state to state, but was up to 44c kwh.

However, because of the fact that these schemes blew out in cost (original estimates in NSW were about $1.6b in total, but ended up something like $6b per year) - principally because of the same analysis as the parent comment - 'hey ! free money!' - the schemes are being wound back agressively and closed to new entrants. In most cases, they have been trimmed back to pay the wholesale cost of electricity if your house is a net producer.

The perverse incentives meant that many people would turn everything off during the day, and then switch it all on again as soon as the solar panels stopped producing power. So daytime usage would end up exporting maximum power to the grid, while nighttime usage would climb as homeowners used power-hungry appliances like clothes dryers after dark.

The end result is that a lot of small businesses that started up will now close in a classic boom-bust cycle that could have been prevented.

In case it's not clear, I have a very real moral problem with subsidised solar power. Nobody would float the idea of a law that meant bus prices were increased to pay rebates to owners of a Mercedes, but effectively that is what solar FIT regimes do. They increase the cost of energy for people who cannot afford a solar panel install (those in rented accomodation, or in multi-unit dwellings) to benefit those who have their own house and the spare capital to spend on solar panels.

<comment><USER10> $6b is not so bad when you consider that coal subsidies are in about the same ballpark: [http://www.couriermail.com.au/business/coal-and-gas- paid-7b-...](http://www.couriermail.com.au/business/coal-and-gas-paid-7b-in- subsidies/story-fn7kjcme-1226301312395)

And there's no moral problem. To paraphrase Winston Churchill - you're just haggling over the price.

<comment><USER22> And the amount of energy produced is in the same ballpark too?

<comment><USER10> We're talking cost per kWhr, so yes, per kWhr.

The issue is that coal is quoted at 10c/kWhr, solar at a higher rate, but that neglects subsidies and negative externalities like climate change. Once you balance the subsidies and introduce a carbon price, coal starts to look a lot worse.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER8> Yep, this plainly correct argument has been persistently ignored by everyone on the bandwagon for an embarrassingly long time now, and that is leading, predictably, to some unfortunate situations. Nice to see that the IEEE has at least an ounce of integrity left.

</comment><comment><USER23> The article somehow implies that the feed-in tariff is Germany was 0.57 EUR until 2011 when it was cut 29%. In fact, there is a formula for automatic tariff cuts built into the law that introduced them: if i recall it correctly, tariff goes 8% down each year at least, but more if there is over 3.5 GW installed. That way, they descended to the levels that are currently much below retail electricity prices there, 0.17-0.24 EUR depending on the size of installation, with electricity being 0.24-0.29 depending on the region. And yet it is highly profitable to install solar systems there.

Retail grid parity in Germany has been achieved.

</comment><comment><USER24> No mention of liquid fluoride thorium reactors (LFTR) or algae-produced oil. Lame.

<comment><USER25> Or many of the other promising and fascinating technologies currently being developed. Not all of them will work, but a few innovations will go a long way to fixing the energy problem.

</comment></comment><comment><USER26> Solar with storage will become ubiquitous when the price point on the storage becomes low enough. The panels themselves are right on the edge of mainstream viability right now, and the technologies involved are getting cheaper and more efficient all the time and unlike most other energy production methods, can be successfully integrated into existing urban architecture.

<comment><USER14> The panels have been "right on the edge of mainstream viability" for 20-30 years now. What's different this time?

<comment><USER26> this - [http://rwer.wordpress.com/2012/03/12/energy-prices-two- trend...](http://rwer.wordpress.com/2012/03/12/energy-prices-two- trends-2-graphs/)

<comment><USER14> It's hard to take those graphs seriously when they are not logarithmic, but I see your point.

Also, comparing to oil is terrible - they should compare to electricity instead which has hardly changed in price.

And if the price is really falling so well, why are we pushing things? Let the price keep falling and people will naturally switch, with no need to subsidies.

Speaking of - does that price take into account subsidies?</comment></comment></comment></comment>


Chinese Startup Hopes to Capture Apple's Magic - <AUTHOR> http://blogs.wsj.com/digits/2014/01/12/chinese-startup-hopes-to-capture-apples-magic/

<comment><USER2> A percentage of Apple's "secret" is California and it's culture. If China is going to try to capture Apple's mystique it will need to move to the west coast.</comment>


Pair (YC W12) raises $4.2M round of funding - <AUTHOR> http://techcrunch.com/2012/05/01/yuri-milner-dave-morin-sv-angel-crunchfund-and-more-hook-up-pair-with-4-2m/ <comment><USER2> Can someone explain the opportunity in Pair? I tried it for a few days with my wife. Cool concept and thumb kiss was cute but we later reverted to iMessage just cause its more convenient and accessible. What 'pain point' does pair solve?

<comment><USER3> My wife and I use Pair almost daily since I first saw the post on HN. I think it has to do with Pair feeling like our private chat (though I know nothing server-based really is). iMessage is what I use to talk to everyone. Whatsapp is what I use to talk to everyone outside US. Pair is just for my wife. Both of us have stressful work-lives so sending cute drawings over pair is a welcome break. We were so excited on Tuesday when we thumb-kissed for the first time while not being on the same sofa.

I don't think of Pair as a communication app. I think of it as our time together when we're far apart. iMessage is gathering around the water cooler. Pair is pillow-talk in the bedroom. I know it's not a rational or testable statement but it "feels" private and personal. And emotions are a big deal when you're talking about apps and Pair seems to have got it right.

* above statements not sponsored by Pair, just a happy user :)

<comment> why-el I am considering a move towards Pair myself. I am away from my girlfriend for the next five months or so and up to now we are only using Facebook messages, and I have growing concerns over privacy (Not that a move to Pair will solve them). But what is pushing me most towards Pair is that sometimes I go to Facebook just to message my girlfriend and it sort of drag me towards answering other messages and notifications and so on. Having an app just for your significant other is a huge plus.

<comment><USER3> > Having an app just for your significant other is a huge plus.

I couldn't have said it better.

<comment> why-el I am pretty sure I was going for a 'for you and your partner' there. Not sure where that you want. Glad it's entertaining.

<comment><USER3> I was agreeing with you, in fact, complimenting you.

<comment> why-el Yeah sorry. I was a bit sleep deprived there so my English as a second language tool set failed me. ;)

</comment></comment></comment></comment></comment></comment></comment><comment><USER4> I think this goes to show how valuable being part of YC is. Were any other app like this to try and raise money outside of that circle, I think it would be difficult. Not to say Pair and its team isn't deserving, but 4.2 is a lot of cash.

I'm sure the YC team and Pair would say that it's more than just a mobile app though, which makes me curious...what do investors want to see when funding an app like this? Where is the distinction between something like Camera+, which is profitable but probably not fundable, and something like this or Instagram?

</comment><comment><USER5> I don't get the value add here and why its fundable. I'm sure its useful, but will it become ubiquitous? I doubt it. So it seems like the VC's are trying to have another Instagram hit.

But that's a VC's job. To take risks and hope for the next big thing. I don't see it here. Maybe this team, but not this idea.

<comment><USER6> Seems like a niche product, but I reckon it's got huge potential. People are vain. This lets someone else make you feel good 24/7. I think $4.2m is going to get this into a lot of pockets.

</comment></comment><comment><USER7> Some of the hardest working founders I know. Fully deserved.

</comment><comment><USER8> great job guys!

now allow me to overstep my bounds: your trypair.com site is nearly impossible to read.

here, i made a few changes: <http://i.imgur.com/REGrI.jpg>

i'll send the psd if you want. it's just 10 minutes of mods without much effort, but i think this should be easier to read.

<comment><USER9> If you're good at something never do it for free.

<comment><USER10> There goes the freemium business model...

</comment></comment></comment><comment><USER11> This discriminates against love triangles.

<comment><USER12> Gotta read to the end: <http://trytrio.com/>

<comment><USER13> I through it was real until I read "Coming soon to Windows Phone and MS-DOS" ... there must be something wrong with me.

</comment></comment></comment><comment><USER14> Seeing as pair.com has been around as a very popular/huge web host since the mid 90's, they're never going to get their titular domain...

<comment><USER15> As they're an iPhone app, it doesn't really matter -- Pair web hosting (an awesome FreeBSD based hosting provider on the east coast, I first used them in the late 1990s) doesn't have any apps in the app store as far as I can tell.

</comment></comment><comment><USER16> First movers in a space they have somewhat created. Would have loved it a couple of years ago.

Lots of potential in related verticles. Let the copy cats begin.

<comment><USER17> Working on it.

<comment><USER18> Pair for owners and pets?

<comment><USER19> Purr?

</comment></comment></comment></comment><comment><USER20> Props to the team. Haven't had a chance to try it yet (Android) but when I enquired they got back to me so quickly and followed up as soon as pre- registration was ready. Solid customer service!

</comment><comment><USER21> Great to see a Velocity Venture Fund winner (Winter 2011), from the University of Waterloo getting up there.

Congrats to the team - (come home to visit velocity!)

<comment><USER7> You sure the venture fund was around in 2011 Winter? Pretty sure it didn't start until later.

</comment></comment><comment><USER22> congrats guys! Its amazing how far you have come along in such a short amount of time.

</comment><comment><USER23> Well done guys</comment>


Show HN: Universal Admin Interface – Introducing AaaS (Admin as a Service) - <AUTHOR> http://beta.forestadmin.com <comment><AUTHOR> Hey guys, I'm a dev frustrated by creating unloved admin interface. That's why I created Forest - a SaaS (we never have your data) that provides instantly a customizable admin interface to your webapp.

I'd like to be challenged here, it would be awesome :)

</comment><comment><USER2> I might be Forest's biggest fan!

Forest couldn't be much easier to set up. We've been using it here at Willing for a while and we're really happy – it took less than an hour to set everything up and add a few custom actions.

On average, we save 4-5 hours per week by giving our customer support team the ability to safely perform actions that previously would have been handled by the dev team.

We haven't yet taken full advantage of creating data visualizations in Forest, perhaps @seyz can show some off.

<comment><AUTHOR> Willing was definitely the mother of all use cases, with your custom actions already coded it was a matter of only a few lines to extend the Forest connector and it was done. Haha, I see the data viz still do the trick, here is a screenshot: [http://www.forestadmin.com/public/img/screenshots/screenshot...](http://www.forestadmin.com/public/img/screenshots/screenshot --firstname.lastname@example.com)

</comment></comment><comment><USER3> I've been using it for a month, and it clearly helps a lot: in less than 5 minutes I have managed to have a complete admin for my apps. A huge improvement when you want to advance quickly.

Keep up the good work guys!

</comment><comment><USER4> I clicked "Get Started" and was only then shown, that it only supports Rails or Express.

Are there plans to support other frameworks, namely Django!?

Edit: Now I see the "Others" tab on the site. Signed up!

<comment><AUTHOR> Apologies for the trouble, the homepage is obviously a WIP and it could be more straightforward on that regard. Django is on our to-do list of supported framework, we're going as soon as possible and will let you know as soon as it's available! :-)</comment></comment>


Swift 5.2 Release Process - <AUTHOR> https://swift.org/blog/5-2-release-process/ <comment><USER2> I'm going to have to read into these release notes!</comment>


Lyft vs. Uber: A Tale of Two S-1's - <AUTHOR> https://benjamintseng.com/2019/04/lyft-vs-uber-a-tale-of-two-s-1s/ <comment><USER2> Looks like Uber is better on every metric, total volume, growth, revenue, the only area they are behind is margin where they are taking less from their drivers than Lyft is.

While Uber looks healthier especially given it's size, Lyft's reception after the IPO was quite negative, with the stock falling 30% immediately in the days that followed.

Even with better economics and larger scale the larger question looms, which is how do these businesses turn profitable.

Are they subsidizing a market and creating it by charging less, or will they reach a certain scale and be able to cut back on certain expenses which will give them profitability.

I don't think Amazon is a fair comparison here, because they were investing in infrastructure, building out global logistics, which is different from Uber and Lyft. They should be much more profitable because they don't have to invest in that. They don't know warehouses and logistics, and everything else that e-commerce required.

Also in the case of Amazon the supposed profits would be reinvested in the business with large CapEx spend, here it seems that the negative margins are being spent on sales and marketing, which isn't the same as what Amazon was doing when it was treading in the negative for a decade.

<comment><USER3> According to Aswath Damodaran [1], Professor at NYU and an expert at valuing companies, if he had to invest between Uber and Lyft, he will choose the latter.

Who are we kidding? Uber, already a gigantic loss machine, continues to invest in loss-making ventures like Food Delivery and E-Scooters. Uber has spread itself to so many areas and markets that I can't see how it'll ever be profitable without making huge cutbacks. The volume and growth are of little significance when they are failing miserably to contain their losses.

Compounding it is the fact that there's nothing sticky about any of their business ventures. Customers will choose the cheapest option, so they can never go beyond a certain range of prices. Even if Uber does become profitable, I highly doubt it ever will join the leagues of Apple, Google or Facebook.

[1]: [https://www.youtube.com/watch?v=K0wky8yyjuM](https://www.youtube.com/watch?v=K0wky8yyjuM)

<comment><USER4> Yes, a so-called 'expert in valuing companies' who doesn't do any actual investing himself.

<comment><USER5> I don't know anything about the man or his success record, but as an academic he may not wish to be accused of conflict of interest by promoting companies where he has a personal financial stake.

<comment><USER6> Academics (pure academics) don't have a good track record predicting valuations/prices, period.

The people who _actually_ have the ability or to predict valuations/prices (better than the market) are busy making millions, if not billions, of dollars, and they most certainly aren't going to tell _you_ about their predictions/models. If they do, it's after they've already invested or shorted the asset.

<comment><USER7> This isn't quite true and you've pretty much identified the reason why. Academics are not investors and their objective isn't to profit but to publish their research.

Academics identify a pattern that generates superior risk-adjusted returns and then publish their findings - this then leads to the anomaly disappearing as investors trade away the alpha. [0] The track record of an academic can therefore only be meaningfully discussed in terms of how well their model performs in back-testing. Saying they don't have a good track record misses this point.

Perhaps there are successful academic investors who achieve alpha and don't publish their research, however they wouldn't show up in any meta analysis.

[0] [https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3054718](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3054718)

<comment><USER8> Why would someone publish money making information rather than make the money for themselves?

<comment><USER9> > _Why would someone publish money making information rather than make the > money for themselves?_

Perhaps because they _enjoy_ academia far more than money making?

Some people like Grigori Perelman [0] are just not interested in money or fame, or both.

0: [https://en.wikipedia.org/wiki/Grigori_Perelman](https://en.wikipedia.org/wiki/Grigori_Perelman)

<comment><USER8> I'm not aware of Perelman publishing a "a pattern that generates superior risk-adjusted returns".

That type of information is worth millions, and there are many investment firms offering very lucrative positions to those that can identify a pattern that generates superior risk-adjusted returns.

Outside of very rare outliers, it doesn't seem reasonable to assume that information that will generate outsized returns will be publicly available.

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER10> My buddy works for a law firm and was telling me that they often represent technology companies when they IPO. It turns out there's an intense amount of research that goes into the S-1 process. The law firm makes a huge spreadsheet, with each row representing a sentence from the S-1, along with evidence supporting the truth of that sentence. They do this because, if the price goes down after the IPO, there's inevitably a lawsuit, and the company needs to justify everything it said in the IPO.

<comment><USER11> Could be a fun startup idea: NLP for securities legal action against IPOs for investors.

<comment><USER12> Good luck getting VCs to fund something that fights against their primary source of return.

<comment><USER13> It'll have to be a lifestyle business /s

</comment></comment></comment></comment><comment><USER14> This comparison is very flawed as it fails to recognise a major difference: the two companies work in very different markets.

Lyft is only active in the US while Uber is spread in many different countries. Unit economics look totally different in NYC, Cairo, and Rio.

<comment><USER15> I'm not so sure about that. Yes, the baseline numbers will be very different, but the _economics_ of ride share are pretty much the same anywhere: there's an existing market price for taxis, which is more or less inflated everywhere due to regulation and inefficiency, and Uber/Lyft/whoever can provide a similar or better service at a profit... except that there's competition fueled by a bonfire of VC money pushing the margin deep into the red.

<comment><USER14> Think about factors such as: cost of vehicle ownership, cost of fuel, minimum wage, social policies, unemployment, public transport infrastructure, population density, specific ride sharing regulation, traffic congestion.

All of these directly effect the unit economics of ride sharing.

<comment><USER15> You're missing my point. All those factors are real, but they set the unit economics of _taxi service_ , which in turn sets the baseline for Uber/Lyft pricing.

So if the market price for taxi service in a city is X, already accounting for all those factors, Uber/Lyft should be able to deliver the same or better service for (say) 0.9X, again accounting for the factors but adding in efficiency gains from bypassing parasitical taxi medallion owners, not needing dedicated vehicles, having much easier ordering, etc. There will be some variance in how big that factor is (eg. NYC's $1 million medallions gave Uber a really juicy margin to exploit), but overall, if a city can sustain taxi service, it should be able to sustain Uber/Lyft too.

<comment><USER16> _overall, if a city can sustain taxi service, it should be able to sustain Uber /Lyft too_

So if a city wants to kill Uber/Lyft, all they need to do is to attack the rideshare margins directly. (Not that they really should. Uber/Lyft is probably a civic good.)

</comment></comment></comment></comment></comment><comment><USER17> These 'per driver' stats are not worth comparing when one company operates globally and the other operates in US+Canada. Nothing can really be concluded from them.

<comment><USER18> The non US markets would be expected to mostly drag down Uber's numbers though, for the most part they are significantly better. Its surprising that Uber didnt at least break out US vs non-US markets, maybe the story isnt really that good.

</comment></comment><comment><USER19> the buried lede is lyft's opex spike right before their ipo. typically you'd try to subdue expenses to make the profitability numbers look better, unless you have other problems to fix that you can spend your way out of.

(taking these graphs as truth) lyft's gross margins were flagging, so it seems they goosed gross margins with opex, like marketing (likely promos) and better customer service (e.g., refunds). they spent their way to higher gross margins so they could look better than uber for ipo.

but as the rest of the analysis points out, lyft is seriously behind uber in the race to overall profitability despite higher per ride take rates. they're still a risky investment in comparison.

</comment><comment><USER20> I can see some of these stats in action. Where I live (Bay Area) Lyft is always more expensive (I typically check them both), sometimes by a _lot_. While in Manhattan I find Lyft cheaper about a third of the time. So no surprise I take more uber rides.

I have more incentive to stick with Uber now I've read this as the drivers make more (and typically the same driver does both anyway)

<comment><USER21> Drivers use Lyft for a reason; they may have a greater bonus payment that balances out the higher commission to Lyft. As a rider, you should use whichever platform will get you to your destination the soonest and for the least amount of money.

<comment><USER22> > Drivers use Lyft for a reason; they may have a greater bonus payment that > balances out the higher commission to Lyft

Drivers use Lyft because riders use Lyft, and it's better to drive for either at a given time than neither. It doesn't mean Lyft pays equally or higher.

</comment></comment></comment><comment><USER23> It is entirely possible for two companies to be the same but also different in how they see their market and revenues. So, without having a deeper understanding of reading financials, comparisons drawn solely based on numbers are flawed.

For example,

Uber says:

> We derive our revenue principally from service fees paid by our Driver and > restaurant partners for the use of our platform in connection with our > Ridesharing products and Uber Eats offering provided by our partners to end- > users. Our sole performance obligation in the transaction is to connect > partners with end-users to facilitate the completion of a successful > Ridesharing trip or Uber Eats meal delivery. _Because end-users access our > platform for free and we have no performance obligation to end-users, end- > users are not our customers._

By making this distinction, Uber might be on a path of trying to maximize it's driver/restaurant unit economics and not on the per user metric.

While Lyft also thinks of drivers as their end customer but doesn't clarify the position of end-users like Uber:

> We provide a service to drivers to complete a successful transportation > service for riders. This service includes on-demand lead generation that > assists drivers to find, receive and fulfill on-demand requests from riders > seeking transportation services and related collection activities using our > Lyft platform. _As a result, our single performance obligation in the > transaction is to connect drivers with riders to facilitate the completion > of a successful transportation service for riders._

<comment><USER24> > Because end-users access our platform for free and we have no performance > obligation to end-users, end-users are not our customers.

That's some bracing cynicism there. So their business plan is to keep paying their taxi drivers less (with VC money), or providing worse service, until they figure out self-driving cars or run out of money?

<comment><USER25> It's actually the opposite. You're misunderstanding "end-users" and projecting your inherent bias against Uber. Once I explain what it _actually_ means, you'll probably project it again but here you're just doing so incorrectly :)

"End-users" as defined here are actually the riders/"eaters" of Uber. Uber is saying these people are not their customers because they are just providing access to drivers/restaurants+delivery people with their platform. What Uber is saying is that driver/restaurants/devliery people are independently selling their products/services on Uber as a platform and that end-users (riders/eaters/consumers) are simply given free access.

</comment></comment></comment><comment><USER26> Calling it now, Uber has several large loans coming due in 2021 and 2022. I suspect we will see the bankruptcy proceedings around that time.

They may survive, not strapped with the debt, perhaps they'll be profitable. Aka they will just have debt restructuring. Regardless, that's when I suspect the bankruptcy will occur.

<comment><USER27> this is wishful thinking, Uber is everywhere and too big to fail. It might be hard to see if you don't travel much outside the US.

On the other hand, I don't know anyone outside the US who knows Lyft.

<comment><USER28> How is Uber, a company that has never made money, and has competitors in every market in taxi cabs, too big to fail? TBTF refers to banks, not side investments from SoftBank and Saudi Arabia.

</comment></comment></comment><comment><USER29> From the drivers I know, they much prefer to drive for Lyft. Almost entirely because they say Lyft riders leave much larger tips and Uber drivers tip much less if at all.

</comment><comment><USER30> Interesting!

This heading sounds off "Despite Pocketing More, Lyft Loses More per User". Shouldn't that be "Uber loses more…"?

<comment><USER31> The profit per monthly active user and the profit per ride graphs both show Lyft losing more.

</comment></comment><comment><USER32> When the business matures, the margins in the TNC business will be razor thin.

There will be local competitors in every city. There will be pure software companies that build TNC apps and sell operating services. Maybe Vuitton, Apple, Waymo, Herz, Hilton, Star Alliance, Oneworld etc. also have their own mobility service provider networks.

Say 4 billion people, 1% of them do ride-hailing of some kind, every one of them has five ride sharing apps and they pay $0.20 per day for each. That's $15B in revenue total for all those involved.

</comment><comment><USER33> They both got the stock ticker that matches the company name, but could that be a bad thing? eg. If you google "lyft" it brings up the company and an Ad to drive for lyft, so to see the stock price (in G) you have to type "nasdaq:lyft".

<comment><USER34> I'd say overall it's a good thing, because you can say the ticker and people will know what company you're talking about.

Try that with Boeing, Intel, or Starbucks.

Who cares what Google shows.</comment></comment>


Hey Pinterest, When Will a Public API be Available? - <AUTHOR> http://blog.programmableweb.com/2012/06/01/hey-pinterest-when-will-a-public-api-be-available/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+ProgrammableWeb+%28ProgrammableWeb%3A+Blog%29 <comment><USER2> December 22rd, 2012 is the date that has been given, but I believe it's a joke. This Facebook Group [1] has been the best source of information I have found for info on the API, and there is at least one developer from Pinterest who has come into the group to talk about where they are with it.

[1][https://www.facebook.com/groups/pinterestapi/?bookmark_t=gro...](https://www.facebook.com/groups/pinterestapi/?bookmark_t=group)</comment>


Philosophy, the Sartre blend: uncovering the birth of existentialism - <AUTHOR> http://www.newstatesman.com/culture/books/2016/09/philosophy-sartre-blend-uncovering-birth-existentialism <comment><USER2> Also not for nothing, but Kiregaard is really the father of existentialism

<comment><USER3> I didn't realize he was considered an existentialist, actually. I thought he was considered more of a godfather type figure, like Iggy Pop and punk music. Thanks for the comment, enjoyed reading through Kierkegaard's Wikipedia page.

</comment></comment><comment><USER4> _"...What is shown by the crowds that lined the Boulevard du Montparnasse to catch a glimpse of Sartre's hearse is not something about France, but something about Sartre in his own right, something that demands explanation. Why were so many people drawn to him? Why did he matter to so many?

"For Sarah Bakewell, the answer lies in the peculiar appeal, and the timeliness, of the philosophy that he espoused: existentialism. "_

I have to disagree. Not that Existentialism is unimportant but I would assert that it was "something about France" in the sense that philosophers are highly respected and that they essentially are public figures akin to celebrities.

You could even say it shows "something about America" (or England) that other countries respecting philosophers as much as we respect reality TV show stars is considered strange and needing of explanation.

</comment><comment><USER5> Existialism, obviously, has been around long before Sartre in Eastern (originally Indian) philosophy and partially in the philosophy of Schopenhauer.

Actually, what Sartre called existentialism is the Asian way of life, at least in societies influenced by the original Hindu philosophy (Upanishads) and its Buddhist derivatives and finally the Gita.

<comment><USER6> Sartre did not consider himself an existentialist, in the same sense as Nietzsche, Heidegger, and Kierkegaarde. He considered himself an absurdist, whatever that means. Also, Nietzsche was explicitly opposed to bhuddism, although this was most likely based on a flawed understanding of bhuddism, as was common at the time.

I'm basing all of this on memory of something I've read long ago, but with enough google fu you might be able to find the references for these claims.

<comment><USER3> I thought Sartre considered himself an existentialist and Camus was an absurdist.

<comment><USER6> no you're right, I was thinking of Camus. The lineage is Schopenhauer -> Nietzsche -> Heidegger -> Sartre, with Camus and Kierkegaarde by themselves.

Some criticism: Sartre isn't as respected as the others in academic philosophy (in popular culture, it's another story). Heidegger was an unrepentant Nazi who turned on his Jewish mentor after Hitler came to power, and Schopenhauer was considered a hypocrite by Bertrand Russell.

Nietzsche is clean, and pretty much practiced what he preached.

</comment></comment></comment></comment><comment><USER7> Don't worry, everybody, I have a super-soaker.

...I have nothing to apologize for.

<comment><USER6> Good obscure xkcd reference

<comment><USER7> Obscure? That's easily one of the most famous strips ever, right behind sudo.</comment></comment></comment>


Converting GW-BASIC to the Z80 - <AUTHOR> https://tia.mat.br/posts/2020/06/21/converting-gwbasic-to-z80.html <comment><USER2> It seems potentially a "call for help":

"I appreciate help if this is the kind of rabbit hole you'd like to burrow in."

The current status is of the conversion:

"a lot of instructions being generated are invalid and the code generator has to be reviewed."

If it is, and the author is reading this, I suggest documenting exactly one by one the open issues. There are surely readers here that are able to "see" and propose a fix for some details without investing a lot of energy upfront to first figure out what the issues are.

</comment><comment><USER3> Looks like others have tried an x86 to z80 asm converter before. Maybe some ideas there:

[https://github.com/Zany80/x86-to-z80](https://github.com/Zany80/x86-to-z80)

</comment><comment><USER4> BASIC on the Apple ][ did a linear search from the start of the program for each GOTO and GOSUB. I wonder if GW still does that...

<comment><USER3> It does that for "FOR" loops: [https://github.com/microsoft/GW- BASIC/blob/09ad7bc671c90f0ee...](https://github.com/microsoft/GW- BASIC/blob/09ad7bc671c90f0eeff4cb7593121ad6f170d903/GWMAIN.ASM#L305)</comment></comment>


Ask HN: What projects and blog posts should I make to get a job? - <AUTHOR> I have a weak resume (many short jobs, the only long running jobs are non-technical) so I'm doing hobby projects to try to beef up my job applications.<p>What kind of projects do companies look for when evaluating a candidate? What will help me get a foot in the door? <comment><USER2> I think it can be helpful in this situation to work backwards, starting with:

\- What type of jobs do you want to get? This can be extremely general (web vs mobile), or more specific (a particular industry, for example). \- What are the most important skills/popular technologies for those jobs? You can figure this out by browsing job listings. \- What projects/blog posts could you build that A. Interest you and B. Incorporate those technologies/skills?

It sounds like you're applying for more junior roles. In this case, your interviewer is not going to be vetting your example projects to see if you built a market-ready application. They want to see that you generally know what you're doing and have some relevant experience.</comment>


Ask HN: SSH is still safe, after NSA? - <AUTHOR> After all this news about NSA spying everything, is SSH still a safe tool? <comment><USER2> Almost certainly, provided you're running a recent-enough version.

A snooper at the line level would be able to see that you were SSH'ing to a given system and the amount of data transferred, but nothing more.

SSH has had very few vulnerabilities and has been really put through the ringer crypto-wise for quite some time. The protocol itself is likely quite solid. Of its common crypto algorithms, the only one I'd avoid is arcfour/RC4. It's an algorithm that's known to be somewhat weaker than other common algos. Blowfish, AES, CAST, Salsa20, Twofish, etc. are not known to have any practical real-world-usable attacks against full-round versions.

Keep in mind that in the crypto world a "break" is anything that shortens the time to recover the key from that of a brute force search. So if I find a shortcut to crack a 2^128 key size symmetric cipher in "only" 2^112 iterations, that's a break. But it's not useful in the real world. To be useful in the real world, a break has to shorten things down to... well... depends on the adversary but probably <2^64.

Of course you cannot rule out the possibility that the NSA has unpublished attacks against any of these, but most cryptographers I've read consider it somewhat unlikely that they have an unpublished attack good enough to _efficiently_ crack them and read traffic in a real world scenario.

<comment><USER3> > SSH'ing to a given system and the amount of data transferred, but nothing > more.

A passive eavesdropper sees very precise timing of every keystroke, as well as the timing and size of the response.

This is enough to reconstruct text being typed with surprisingly good accuracy.

<comment><USER4> I am pretty sure NSA's would have better ways to get information about you than to just rely on periodicity of your keystrokes and doing all those analytics based on heuristics.

<comment><USER3> This has nothing to do with 'information about me'. The NSA has bunch of old declassified internal newsletters on their website. Traffic and timing side channels analysis is classic, old-school SIGINT.

</comment></comment></comment></comment><comment><USER4> SSH is not safe if you ssh into a resource (directly or indirectly) controlled by NSA. The protocol as such is secure in the sense that for an 'adversary' with average compute power, it is impossible to 'break' the protocol.

</comment><comment><USER5> As safe as your private key / password.

</comment><comment><USER6> > is SSH still a safe tool?

Is there something better?

<comment><USER7> Well ssh is a fairly complex daemon with quite a few features. For example with OpenSSH you can authenticate with a preshared key and challenge response or with PAM integration, or with a regular unix password. It also supports several types of encryption. All these things are useful but requires more code.

Some people would argue that a very simple daemon with fewer features might be more secure because it has less attack area. For example Colin Percival of Tarsnap created spiped which essentially replaces 'ssh -L'. It only supports shared key authentication and AES-256 and consists of only about 4000 lines. He connects to ssh through a spipe tunnel.

[https://www.tarsnap.com/spiped.html](https://www.tarsnap.com/spiped.html)

<comment><USER6> > Some people would argue that a very simple daemon with fewer features might > be more secure because it has less attack area.

If it's true for something like a web server, it ought to be true for SSH. Thanks for the link to spiped.</comment></comment></comment>


Ask HN: How did you grow your SaaS app to $1m ARR? - <AUTHOR> <comment><USER2> I've been running a UX/UI design service for B2B SaaS companies for many years ([http://fairpixels.pro](http://fairpixels.pro)), which has given me valuable insights into what makes SaaS companies fail & succeed. Many of them are well over that $1M ARR mark. Here are some of the elements I've seen the successful companies have in common that got them where they are today.

\- _Sell to businesses_ : Even some of the B2C SaaS apps I've worked with, switched to selling to companies because it's relatively easier to build a highly profitable business in less time. I've seen companies price their product 'too low'. Which lead potential customers think their product was crap. Your price creates a perceived value in the eyes of your customers. And the best customers are businesses

\- _Don't worry about competitors_ : None of the successful SaaS apps were unique one-of-a-kind ideas. They entered existing markets with existing, large players.

\- _Target businesses in an industry you know_ : Usually translated as 'follow your passion', but really it's about diving into industries you know something about. You know the potential customers, their painpoints, etc. If you're going to build a SaaS app that's in an industry outside of your comfort zone, it'll be a slow uphill climb.

\- _Keep it simple_ : Many engineers feel uncomfortable launching something simple. They keep adding features in order to make themselves feel good about the level of complexity their product has. Really 100% of the successful companies did 1 thing really really well.

\- _Solve a problem_ : Don't start thinking of solutions based on a tech stack you know. Find a problem some of the companies you know have. Spend 80% of your time understanding that problem really really well. This means understanding the amount of money it is costing these companies. How much time they are wasting because of it. The words they use to describe that problem, etc. Engineers are usually very good at building the solution. The hardest part is understanding the business problem inside out.</comment>


Soviet Image Editing Tool from 1987 - <AUTHOR> http://www.youtube.com/watch?v=t2PsiJXswiM

<comment><AUTHOR> Just saw that a link to an article that included this video has been posted and is being discussed at <http://news.ycombinator.com/item?id=1868505>

#oops</comment>


Migrating legacy app to a Symfony Components based framework (Part I) - <AUTHOR> http://zubte.com/blog/migrating-legacy-app-to-a-symfony-components-based-framework-part-i/

<comment><USER2> If you found this interesting, you would probably also find Fabien's articles on writing your own framework on top of Symfony2 components interesting as well.

[http://fabien.potencier.org/article/50/create-your-own- frame...](http://fabien.potencier.org/article/50/create-your-own-framework-on- top-of-the-symfony2-components-part-1)</comment>


OH8X Base Jump - <AUTHOR> http://www.cqdx.ru/ham/ham_video/oh8x-base-jump/ <comment><USER2> Nice, but not as cool as base-jumping from an university library window - <http://www.youtube.com/watch?v=5PT5hsgi2Ss>

<comment><AUTHOR> But there is no Ham Radio aspect in this one!

</comment></comment><comment><AUTHOR> Actually, I am more interested in the tower and the operation. Few hobbies have the physical scale that Ham Radio does.</comment>